tidying: CCSS macro
[exim.git] / src / src / transports / appendfile.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 #include "../exim.h"
10 #include "appendfile.h"
11
12 #ifdef SUPPORT_MAILDIR
13 #include "tf_maildir.h"
14 #endif
15
16
17 /* Options specific to the appendfile transport. They must be in alphabetic
18 order (note that "_" comes before the lower case letters). Some of them are
19 stored in the publicly visible instance block - these are flagged with the
20 opt_public flag. */
21
22 optionlist appendfile_transport_options[] = {
23 #ifdef SUPPORT_MAILDIR
24 { "*expand_maildir_use_size_file", opt_stringptr,
25 (void *)offsetof(appendfile_transport_options_block, expand_maildir_use_size_file) },
26 #endif
27 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
28 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
29 { "*set_use_flock_lock",opt_bool | opt_hidden,
30 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
31 { "*set_use_lockfile", opt_bool | opt_hidden,
32 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
33 #ifdef SUPPORT_MBX
34 { "*set_use_mbx_lock", opt_bool | opt_hidden,
35 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
36 #endif
37 { "allow_fifo", opt_bool,
38 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
39 { "allow_symlink", opt_bool,
40 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
41 { "batch_id", opt_stringptr | opt_public,
42 (void *)offsetof(transport_instance, batch_id) },
43 { "batch_max", opt_int | opt_public,
44 (void *)offsetof(transport_instance, batch_max) },
45 { "check_group", opt_bool,
46 (void *)offsetof(appendfile_transport_options_block, check_group) },
47 { "check_owner", opt_bool,
48 (void *)offsetof(appendfile_transport_options_block, check_owner) },
49 { "check_string", opt_stringptr,
50 (void *)offsetof(appendfile_transport_options_block, check_string) },
51 { "create_directory", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, create_directory) },
53 { "create_file", opt_stringptr,
54 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
55 { "directory", opt_stringptr,
56 (void *)offsetof(appendfile_transport_options_block, dirname) },
57 { "directory_file", opt_stringptr,
58 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
59 { "directory_mode", opt_octint,
60 (void *)offsetof(appendfile_transport_options_block, dirmode) },
61 { "escape_string", opt_stringptr,
62 (void *)offsetof(appendfile_transport_options_block, escape_string) },
63 { "file", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, filename) },
65 { "file_format", opt_stringptr,
66 (void *)offsetof(appendfile_transport_options_block, file_format) },
67 { "file_must_exist", opt_bool,
68 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
69 { "lock_fcntl_timeout", opt_time,
70 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
71 { "lock_flock_timeout", opt_time,
72 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
73 { "lock_interval", opt_time,
74 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
75 { "lock_retries", opt_int,
76 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
77 { "lockfile_mode", opt_octint,
78 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
79 { "lockfile_timeout", opt_time,
80 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
81 { "mailbox_filecount", opt_stringptr,
82 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
83 { "mailbox_size", opt_stringptr,
84 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
85 #ifdef SUPPORT_MAILDIR
86 { "maildir_format", opt_bool,
87 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
88 { "maildir_quota_directory_regex", opt_stringptr,
89 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
90 { "maildir_retries", opt_int,
91 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
92 { "maildir_tag", opt_stringptr,
93 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
94 { "maildir_use_size_file", opt_expand_bool,
95 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
96 { "maildirfolder_create_regex", opt_stringptr,
97 (void *)offsetof(appendfile_transport_options_block, maildirfolder_create_regex ) },
98 #endif /* SUPPORT_MAILDIR */
99 #ifdef SUPPORT_MAILSTORE
100 { "mailstore_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
102 { "mailstore_prefix", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
104 { "mailstore_suffix", opt_stringptr,
105 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
106 #endif /* SUPPORT_MAILSTORE */
107 #ifdef SUPPORT_MBX
108 { "mbx_format", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
110 #endif /* SUPPORT_MBX */
111 { "message_prefix", opt_stringptr,
112 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
113 { "message_suffix", opt_stringptr,
114 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
115 { "mode", opt_octint,
116 (void *)offsetof(appendfile_transport_options_block, mode) },
117 { "mode_fail_narrower",opt_bool,
118 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
119 { "notify_comsat", opt_bool,
120 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
121 { "quota", opt_stringptr,
122 (void *)offsetof(appendfile_transport_options_block, quota) },
123 { "quota_directory", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
125 { "quota_filecount", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
127 { "quota_is_inclusive", opt_bool,
128 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
129 { "quota_size_regex", opt_stringptr,
130 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
131 { "quota_warn_message", opt_stringptr | opt_public,
132 (void *)offsetof(transport_instance, warn_message) },
133 { "quota_warn_threshold", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
135 { "use_bsmtp", opt_bool,
136 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
137 { "use_crlf", opt_bool,
138 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
139 { "use_fcntl_lock", opt_bool_set,
140 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
141 { "use_flock_lock", opt_bool_set,
142 (void *)offsetof(appendfile_transport_options_block, use_flock) },
143 { "use_lockfile", opt_bool_set,
144 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
145 #ifdef SUPPORT_MBX
146 { "use_mbx_lock", opt_bool_set,
147 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
148 #endif /* SUPPORT_MBX */
149 };
150
151 /* Size of the options list. An extern variable has to be used so that its
152 address can appear in the tables drtables.c. */
153
154 int appendfile_transport_options_count =
155 sizeof(appendfile_transport_options)/sizeof(optionlist);
156
157
158 #ifdef MACRO_PREDEF
159
160 /* Dummy values */
161 appendfile_transport_options_block appendfile_transport_option_defaults = {0};
162 void appendfile_transport_init(transport_instance *tblock) {}
163 BOOL appendfile_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
164
165 #else /*!MACRO_PREDEF*/
166
167 /* Default private options block for the appendfile transport. */
168
169 appendfile_transport_options_block appendfile_transport_option_defaults = {
170 NULL, /* filename */
171 NULL, /* dirname */
172 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
173 NULL, /* message_prefix (default reset in init if not bsmtp) */
174 NULL, /* message_suffix (ditto) */
175 US"anywhere", /* create_file_string (string value for create_file) */
176 NULL, /* quota */
177 NULL, /* quota_directory */
178 NULL, /* quota_filecount */
179 NULL, /* quota_size_regex */
180 NULL, /* quota_warn_threshold */
181 NULL, /* mailbox_size_string */
182 NULL, /* mailbox_filecount_string */
183 NULL, /* expand_maildir_use_size_file */
184 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
185 NULL, /* maildir_tag */
186 NULL, /* maildirfolder_create_regex */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
192 0, /* quota_value */
193 0, /* quota_warn_threshold_value */
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
196 0, /* quota_filecount_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
207 0, /* options */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE, /* quota_is_inclusive */
232 FALSE, /* quota_no_check */
233 FALSE /* quota_filecount_no_check */
234 };
235
236
237 /* Encodings for mailbox formats, and their names. MBX format is actually
238 supported only if SUPPORT_MBX is set. */
239
240 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
241
242 static const char *mailbox_formats[] = {
243 "unix", "mbx", "smail", "maildir", "mailstore" };
244
245
246 /* Check warn threshold only if quota size set or not a percentage threshold
247 percentage check should only be done if quota > 0 */
248
249 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
250 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
251
252
253
254 /*************************************************
255 * Setup entry point *
256 *************************************************/
257
258 /* Called for each delivery in the privileged state, just before the uid/gid
259 are changed and the main entry point is called. We use this function to
260 expand any quota settings, so that it can access files that may not be readable
261 by the user. It is also used to pick up external mailbox size information, if
262 set.
263
264 Arguments:
265 tblock points to the transport instance
266 addrlist addresses about to be delivered (not used)
267 dummy not used (doesn't pass back data)
268 uid the uid that will be set (not used)
269 gid the gid that will be set (not used)
270 errmsg where to put an error message
271
272 Returns: OK, FAIL, or DEFER
273 */
274
275 static int
276 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
277 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
278 {
279 appendfile_transport_options_block *ob =
280 (appendfile_transport_options_block *)(tblock->options_block);
281 uschar *q = ob->quota;
282 double default_value = 0.0;
283
284 addrlist = addrlist; /* Keep picky compilers happy */
285 dummy = dummy;
286 uid = uid;
287 gid = gid;
288
289 if (ob->expand_maildir_use_size_file)
290 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
291 US"`maildir_use_size_file` in transport", tblock->name);
292
293 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
294 mailbox_filecount */
295
296 for (int i = 0; i < 5; i++)
297 {
298 double d;
299 int no_check = 0;
300 uschar *which = NULL;
301
302 if (q == NULL) d = default_value;
303 else
304 {
305 uschar *rest;
306 uschar *s = expand_string(q);
307
308 if (!s)
309 {
310 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
311 "%s", q, tblock->name, expand_string_message);
312 return f.search_find_defer ? DEFER : FAIL;
313 }
314
315 d = Ustrtod(s, &rest);
316
317 /* Handle following characters K, M, G, %, the latter being permitted
318 for quota_warn_threshold only. A threshold with no quota setting is
319 just ignored. */
320
321 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
322 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
323 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
324 else if (*rest == '%' && i == 2)
325 {
326 if (ob->quota_value <= 0 && !ob->maildir_use_size_file)
327 d = 0;
328 else if ((int)d < 0 || (int)d > 100)
329 {
330 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
331 " for %s transport", (int)d, tblock->name);
332 return FAIL;
333 }
334 ob->quota_warn_threshold_is_percent = TRUE;
335 rest++;
336 }
337
338
339 /* For quota and quota_filecount there may be options
340 appended. Currently only "no_check", so we can be lazy parsing it */
341 if (i < 2 && Ustrstr(rest, "/no_check") == rest)
342 {
343 no_check = 1;
344 rest += sizeof("/no_check") - 1;
345 }
346
347 while (isspace(*rest)) rest++;
348
349 if (*rest != 0)
350 {
351 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
352 "in %s transport", s, q, tblock->name);
353 return FAIL;
354 }
355 }
356
357 /* Set each value, checking for possible overflow. */
358
359 switch (i)
360 {
361 case 0:
362 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
363 which = US"quota";
364 ob->quota_value = (off_t)d;
365 ob->quota_no_check = no_check;
366 q = ob->quota_filecount;
367 break;
368
369 case 1:
370 if (d >= 2.0*1024.0*1024.0*1024.0)
371 which = US"quota_filecount";
372 ob->quota_filecount_value = (int)d;
373 ob->quota_filecount_no_check = no_check;
374 q = ob->quota_warn_threshold;
375 break;
376
377 case 2:
378 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
379 which = US"quota_warn_threshold";
380 ob->quota_warn_threshold_value = (off_t)d;
381 q = ob->mailbox_size_string;
382 default_value = -1.0;
383 break;
384
385 case 3:
386 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
387 which = US"mailbox_size";;
388 ob->mailbox_size_value = (off_t)d;
389 q = ob->mailbox_filecount_string;
390 break;
391
392 case 4:
393 if (d >= 2.0*1024.0*1024.0*1024.0)
394 which = US"mailbox_filecount";
395 ob->mailbox_filecount_value = (int)d;
396 break;
397 }
398
399 if (which)
400 {
401 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
402 "%s transport", which, d, tblock->name);
403 return FAIL;
404 }
405 }
406
407 return OK;
408 }
409
410
411
412 /*************************************************
413 * Initialization entry point *
414 *************************************************/
415
416 /* Called for each instance, after its options have been read, to
417 enable consistency checks to be done, or anything else that needs
418 to be set up. */
419
420 void
421 appendfile_transport_init(transport_instance *tblock)
422 {
423 appendfile_transport_options_block *ob =
424 (appendfile_transport_options_block *)(tblock->options_block);
425
426 /* Set up the setup entry point, to be called in the privileged state */
427
428 tblock->setup = appendfile_transport_setup;
429
430 /* Lock_retries must be greater than zero */
431
432 if (ob->lock_retries == 0) ob->lock_retries = 1;
433
434 /* Only one of a file name or directory name must be given. */
435
436 if (ob->filename != NULL && ob->dirname != NULL)
437 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
438 "only one of \"file\" or \"directory\" can be specified", tblock->name);
439
440 /* If a file name was specified, neither quota_filecount nor quota_directory
441 must be given. */
442
443 if (ob->filename != NULL)
444 {
445 if (ob->quota_filecount != NULL)
446 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
447 "quota_filecount must not be set without \"directory\"", tblock->name);
448 if (ob->quota_directory != NULL)
449 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
450 "quota_directory must not be set without \"directory\"", tblock->name);
451 }
452
453 /* The default locking depends on whether MBX is set or not. Change the
454 built-in default if none of the lock options has been explicitly set. At least
455 one form of locking is required in all cases, but mbx locking changes the
456 meaning of fcntl and flock locking. */
457
458 /* Not all operating systems provide flock(). For those that do, if flock is
459 requested, the default for fcntl is FALSE. */
460
461 if (ob->use_flock)
462 {
463 #ifdef NO_FLOCK
464 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
465 "flock() support was not available in the operating system when this "
466 "binary was built", tblock->name);
467 #endif /* NO_FLOCK */
468 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
469 }
470
471 #ifdef SUPPORT_MBX
472 if (ob->mbx_format)
473 {
474 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
475 !ob->set_use_mbx_lock)
476 {
477 ob->use_lockfile = ob->use_flock = FALSE;
478 ob->use_mbx_lock = ob->use_fcntl = TRUE;
479 }
480 else if (ob->use_mbx_lock)
481 {
482 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
483 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
484 if (!ob->set_use_flock) ob->use_flock = FALSE;
485 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
486 }
487 }
488 #endif /* SUPPORT_MBX */
489
490 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
491 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
492 "no locking configured", tblock->name);
493
494 /* Unset timeouts for non-used locking types */
495
496 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
497 if (!ob->use_flock) ob->lock_flock_timeout = 0;
498
499 /* If a directory name was specified, only one of maildir or mailstore may be
500 specified, and if quota_filecount or quota_directory is given, quota must
501 be set. */
502
503 if (ob->dirname != NULL)
504 {
505 if (ob->maildir_format && ob->mailstore_format)
506 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
507 "only one of maildir and mailstore may be specified", tblock->name);
508 if (ob->quota_filecount != NULL && ob->quota == NULL)
509 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
510 "quota must be set if quota_filecount is set", tblock->name);
511 if (ob->quota_directory != NULL && ob->quota == NULL)
512 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
513 "quota must be set if quota_directory is set", tblock->name);
514 }
515
516 /* If a fixed uid field is set, then a gid field must also be set. */
517
518 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
519 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
520 "user set without group for the %s transport", tblock->name);
521
522 /* If "create_file" is set, check that a valid option is given, and set the
523 integer variable. */
524
525 if (ob->create_file_string != NULL)
526 {
527 int value = 0;
528 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
529 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
530 create_belowhome;
531 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
532 value = create_inhome;
533 else
534 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
535 "invalid value given for \"file_create\" for the %s transport: %s",
536 tblock->name, ob->create_file_string);
537 ob->create_file = value;
538 }
539
540 /* If quota_warn_threshold is set, set up default for warn_message. It may
541 not be used if the actual threshold for a given delivery ends up as zero,
542 of if it's given as a percentage and there's no quota setting. */
543
544 if (ob->quota_warn_threshold != NULL)
545 {
546 if (tblock->warn_message == NULL) tblock->warn_message = US
547 "To: $local_part@$domain\n"
548 "Subject: Your mailbox\n\n"
549 "This message is automatically created by mail delivery software (Exim).\n\n"
550 "The size of your mailbox has exceeded a warning threshold that is\n"
551 "set by the system administrator.\n";
552 }
553
554 /* If batch SMTP is set, force the check and escape strings, and arrange that
555 headers are also escaped. */
556
557 if (ob->use_bsmtp)
558 {
559 ob->check_string = US".";
560 ob->escape_string = US"..";
561 ob->options |= topt_escape_headers;
562 }
563
564 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
565 insert default values for for the affixes and the check/escape strings. */
566
567 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
568 {
569 if (ob->message_prefix == NULL) ob->message_prefix =
570 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
571 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
572 if (ob->check_string == NULL) ob->check_string = US"From ";
573 if (ob->escape_string == NULL) ob->escape_string = US">From ";
574
575 }
576
577 /* Set up the bitwise options for transport_write_message from the various
578 driver options. Only one of body_only and headers_only can be set. */
579
580 ob->options |=
581 (tblock->body_only ? topt_no_headers : 0) |
582 (tblock->headers_only ? topt_no_body : 0) |
583 (tblock->return_path_add ? topt_add_return_path : 0) |
584 (tblock->delivery_date_add ? topt_add_delivery_date : 0) |
585 (tblock->envelope_to_add ? topt_add_envelope_to : 0) |
586 ((ob->use_crlf || ob->mbx_format) ? topt_use_crlf : 0);
587 }
588
589
590
591 /*************************************************
592 * Notify comsat *
593 *************************************************/
594
595 /* The comsat daemon is the thing that provides asynchronous notification of
596 the arrival of local messages, if requested by the user by "biff y". It is a
597 BSD thing that uses a TCP/IP protocol for communication. A message consisting
598 of the text "user@offset" must be sent, where offset is the place in the
599 mailbox where new mail starts. There is no scope for telling it which file to
600 look at, which makes it a less than useful if mail is being delivered into a
601 non-standard place such as the user's home directory. In fact, it doesn't seem
602 to pay much attention to the offset.
603
604 Arguments:
605 user user name
606 offset offset in mailbox
607
608 Returns: nothing
609 */
610
611 static void
612 notify_comsat(uschar *user, off_t offset)
613 {
614 struct servent *sp;
615 host_item host;
616 uschar * s;
617
618 DEBUG(D_transport) debug_printf("notify_comsat called\n");
619
620 s = string_sprintf("%.200s@" OFF_T_FMT "\n", user, offset);
621
622 if ((sp = getservbyname("biff", "udp")) == NULL)
623 {
624 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
625 return;
626 }
627
628 host.name = US"localhost";
629 host.next = NULL;
630
631
632 /* This code is all set up to look up "localhost" and use all its addresses
633 until one succeeds. However, it appears that at least on some systems, comsat
634 doesn't listen on the ::1 address. So for the moment, just force the address to
635 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
636 can be changed. (But actually, comsat is probably dying out anyway.) */
637
638 /******
639 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
640 {
641 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
642 return;
643 }
644 ******/
645
646 host.address = US"127.0.0.1";
647
648
649 for (host_item * h = &host; h; h = h->next)
650 {
651 int sock, rc;
652 int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
653
654 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
655
656 if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
657
658 /* Connect never fails for a UDP socket, so don't set a timeout. */
659
660 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, NULL);
661 rc = send(sock, s, Ustrlen(s) + 1, 0);
662 (void)close(sock);
663
664 if (rc >= 0) break;
665 DEBUG(D_transport)
666 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
667 h->address);
668 }
669 }
670
671
672
673 /*************************************************
674 * Check the format of a file *
675 *************************************************/
676
677 /* This function is called when file_format is set, to check that an existing
678 file has the right format. The format string contains text/transport pairs. The
679 string matching is literal. we just read big_buffer_size bytes, because this is
680 all about the first few bytes of a file.
681
682 Arguments:
683 cfd the open file
684 tblock the transport block
685 addr the address block - for inserting error data
686
687 Returns: pointer to the required transport, or NULL
688 */
689
690 transport_instance *
691 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
692 {
693 const uschar *format =
694 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
695 uschar data[256];
696 int len = read(cfd, data, sizeof(data));
697 int sep = 0;
698 uschar *s;
699
700 DEBUG(D_transport) debug_printf("checking file format\n");
701
702 /* An empty file matches the current transport */
703
704 if (len == 0) return tblock;
705
706 /* Search the formats for a match */
707
708 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size)))
709 {
710 int slen = Ustrlen(s);
711 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
712 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
713
714 if (match && tp)
715 {
716 for (transport_instance * tt = transports; tt; tt = tt->next)
717 if (Ustrcmp(tp, tt->name) == 0)
718 {
719 DEBUG(D_transport)
720 debug_printf("file format -> %s transport\n", tt->name);
721 return tt;
722 }
723 addr->basic_errno = ERRNO_BADTRANSPORT;
724 addr->message = string_sprintf("%s transport (for %.*s format) not found",
725 tp, slen, data);
726 return NULL;
727 }
728 }
729
730 /* Failed to find a match */
731
732 addr->basic_errno = ERRNO_FORMATUNKNOWN;
733 addr->message = US"mailbox file format unrecognized";
734 return NULL;
735 }
736
737
738
739
740 /*************************************************
741 * Check directory's files for quota *
742 *************************************************/
743
744 /* This function is called if quota is set for one of the delivery modes that
745 delivers into a specific directory. It scans the directory and stats all the
746 files in order to get a total size and count. This is an expensive thing to do,
747 but some people are prepared to bear the cost. Alternatively, if size_regex is
748 set, it is used as a regex to try to extract the size from the file name, a
749 strategy that some people use on maildir files on systems where the users have
750 no shell access.
751
752 The function is global, because it is also called from tf_maildir.c for maildir
753 folders (which should contain only regular files).
754
755 Note: Any problems can be written to debugging output, but cannot be written to
756 the log, because we are running as an unprivileged user here.
757
758 Arguments:
759 dirname the name of the directory
760 countptr where to add the file count (because this function recurses)
761 regex a compiled regex to get the size from a name
762
763 Returns: the sum of the sizes of the stattable files
764 zero if the directory cannot be opened
765 */
766
767 off_t
768 check_dir_size(const uschar * dirname, int *countptr, const pcre *regex)
769 {
770 DIR *dir;
771 off_t sum = 0;
772 int count = *countptr;
773 struct dirent *ent;
774 struct stat statbuf;
775
776 if (!(dir = opendir(CS dirname))) return 0;
777
778 while ((ent = readdir(dir)))
779 {
780 uschar * path, * name = US ent->d_name;
781
782 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
783
784 count++;
785
786 /* If there's a regex, try to find the size using it */
787
788 if (regex)
789 {
790 int ovector[6];
791 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
792 {
793 uschar *endptr;
794 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
795 if (endptr == name + ovector[3])
796 {
797 sum += size;
798 DEBUG(D_transport)
799 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
800 size);
801 continue;
802 }
803 }
804 DEBUG(D_transport)
805 debug_printf("check_dir_size: regex did not match %s\n", name);
806 }
807
808 /* No regex or no match for the regex, or captured non-digits */
809
810 path = string_sprintf("%s/%s", dirname, name);
811
812 if (Ustat(path, &statbuf) < 0)
813 {
814 DEBUG(D_transport)
815 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, path,
816 strerror(errno));
817 }
818 else
819 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
820 sum += statbuf.st_size / statbuf.st_nlink;
821 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
822 sum += check_dir_size(path, &count, regex);
823 }
824
825 closedir(dir);
826 DEBUG(D_transport)
827 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
828 sum, count);
829
830 *countptr = count;
831 return sum;
832 }
833
834
835
836
837 /*************************************************
838 * Apply a lock to a file descriptor *
839 *************************************************/
840
841 /* This function applies a lock to a file descriptor, using a blocking or
842 non-blocking lock, depending on the timeout value. It can apply either or
843 both of a fcntl() and a flock() lock. However, not all OS support flock();
844 for those that don't, the use_flock option cannot be set.
845
846 Arguments:
847 fd the file descriptor
848 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
849 fcntl() format); the flock() type is deduced if needed
850 dofcntl do fcntl() locking
851 fcntltime non-zero to use blocking fcntl()
852 doflock do flock() locking
853 flocktime non-zero to use blocking flock()
854
855 Returns: yield of the fcntl() or flock() call, with errno preserved;
856 sigalrm_seen set if there has been a timeout
857 */
858
859 static int
860 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
861 int flocktime)
862 {
863 int yield = 0;
864 int save_errno;
865 struct flock lock_data;
866 lock_data.l_type = fcntltype;
867 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
868
869 sigalrm_seen = FALSE;
870
871 if (dofcntl)
872 {
873 if (fcntltime > 0)
874 {
875 ALARM(fcntltime);
876 yield = fcntl(fd, F_SETLKW, &lock_data);
877 save_errno = errno;
878 ALARM_CLR(0);
879 errno = save_errno;
880 }
881 else yield = fcntl(fd, F_SETLK, &lock_data);
882 }
883
884 #ifndef NO_FLOCK
885 if (doflock && (yield >= 0))
886 {
887 int flocktype = (fcntltype == F_WRLCK) ? LOCK_EX : LOCK_SH;
888 if (flocktime > 0)
889 {
890 ALARM(flocktime);
891 yield = flock(fd, flocktype);
892 save_errno = errno;
893 ALARM_CLR(0);
894 errno = save_errno;
895 }
896 else yield = flock(fd, flocktype | LOCK_NB);
897 }
898 #endif /* NO_FLOCK */
899
900 return yield;
901 }
902
903
904
905
906 #ifdef SUPPORT_MBX
907 /*************************************************
908 * Copy message into MBX mailbox *
909 *************************************************/
910
911 /* This function is called when a message intended for a MBX mailbox has been
912 written to a temporary file. We can now get the size of the message and then
913 copy it in MBX format to the mailbox.
914
915 Arguments:
916 to_fd fd to write to (the real mailbox)
917 from_fd fd to read from (the temporary file)
918 saved_size current size of mailbox
919
920 Returns: OK if all went well, DEFER otherwise, with errno preserved
921 the number of bytes written are added to transport_count
922 by virtue of calling transport_write_block()
923 */
924
925 /* Values taken from c-client */
926
927 #define MBX_HDRSIZE 2048
928 #define MBX_NUSERFLAGS 30
929
930 static int
931 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
932 {
933 int used;
934 off_t size;
935 struct stat statbuf;
936 transport_ctx tctx = { .u={.fd = to_fd}, .options = topt_not_socket };
937
938 /* If the current mailbox size is zero, write a header block */
939
940 if (saved_size == 0)
941 {
942 uschar *s;
943 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
944 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
945 (long int)time(NULL));
946 for (int i = 0; i < MBX_NUSERFLAGS; i++)
947 sprintf (CS(s += Ustrlen(s)), "\015\012");
948 if (!transport_write_block (&tctx, deliver_out_buffer, MBX_HDRSIZE, FALSE))
949 return DEFER;
950 }
951
952 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
953
954 /* Now construct the message's header from the time and the RFC822 file
955 size, including CRLFs, which is the size of the input (temporary) file. */
956
957 if (fstat(from_fd, &statbuf) < 0) return DEFER;
958 size = statbuf.st_size;
959
960 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
961 tod_stamp(tod_mbx), size, 0L, 0, 0);
962 used = Ustrlen(deliver_out_buffer);
963
964 /* Rewind the temporary file, and copy it over in chunks. */
965
966 if (lseek(from_fd, 0 , SEEK_SET) < 0) return DEFER;
967
968 while (size > 0)
969 {
970 int len = read(from_fd, deliver_out_buffer + used,
971 DELIVER_OUT_BUFFER_SIZE - used);
972 if (len <= 0)
973 {
974 if (len == 0) errno = ERRNO_MBXLENGTH;
975 return DEFER;
976 }
977 if (!transport_write_block(&tctx, deliver_out_buffer, used + len, FALSE))
978 return DEFER;
979 size -= len;
980 used = 0;
981 }
982
983 return OK;
984 }
985 #endif /* SUPPORT_MBX */
986
987
988
989 /*************************************************
990 * Check creation is permitted *
991 *************************************************/
992
993 /* This function checks whether a given file name is permitted to be created,
994 as controlled by the create_file option. If no home directory is set, however,
995 we can't do any tests.
996
997 Arguments:
998 filename the file name
999 create_file the ob->create_file option
1000
1001 Returns: TRUE if creation is permitted
1002 */
1003
1004 static BOOL
1005 check_creation(uschar *filename, int create_file)
1006 {
1007 BOOL yield = TRUE;
1008
1009 if (deliver_home != NULL && create_file != create_anywhere)
1010 {
1011 int len = Ustrlen(deliver_home);
1012 uschar *file = filename;
1013
1014 while (file[0] == '/' && file[1] == '/') file++;
1015 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
1016 ( Ustrchr(file+len+2, '/') != NULL &&
1017 (
1018 create_file != create_belowhome ||
1019 Ustrstr(file+len, "/../") != NULL
1020 )
1021 )
1022 ) yield = FALSE;
1023
1024 /* If yield is TRUE, the file name starts with the home directory, and does
1025 not contain any instances of "/../" in the "belowhome" case. However, it may
1026 still contain symbolic links. We can check for this by making use of
1027 realpath(), which most Unixes seem to have (but make it possible to cut this
1028 out). We can't just use realpath() on the whole file name, because we know
1029 the file itself doesn't exist, and intermediate directories may also not
1030 exist. What we want to know is the real path of the longest existing part of
1031 the path. That must match the home directory's beginning, whichever is the
1032 shorter. */
1033
1034 #ifndef NO_REALPATH
1035 if (yield && create_file == create_belowhome)
1036 {
1037 uschar *next;
1038 uschar *rp = NULL;
1039 for (uschar * slash = Ustrrchr(file, '/'); /* There is known to be one */
1040 rp == NULL && slash > file; /* Stop if reached beginning */
1041 slash = next)
1042 {
1043 *slash = 0;
1044 rp = US realpath(CS file, CS big_buffer);
1045 next = Ustrrchr(file, '/');
1046 *slash = '/';
1047 }
1048
1049 /* If rp == NULL it means that none of the relevant directories exist.
1050 This is not a problem here - it means that no symbolic links can exist,
1051 which is all we are worried about. Otherwise, we must compare it
1052 against the start of the home directory. However, that may itself
1053 contain symbolic links, so we have to "realpath" it as well, if
1054 possible. */
1055
1056 if (rp != NULL)
1057 {
1058 uschar hdbuffer[PATH_MAX+1];
1059 uschar *rph = deliver_home;
1060 int rlen = Ustrlen(big_buffer);
1061
1062 rp = US realpath(CS deliver_home, CS hdbuffer);
1063 if (rp != NULL)
1064 {
1065 rph = hdbuffer;
1066 len = Ustrlen(rph);
1067 }
1068
1069 if (rlen > len) rlen = len;
1070 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1071 {
1072 yield = FALSE;
1073 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1074 big_buffer, deliver_home);
1075 }
1076 }
1077 }
1078 #endif /* NO_REALPATH */
1079 }
1080
1081 return yield;
1082 }
1083
1084
1085
1086 /*************************************************
1087 * Main entry point *
1088 *************************************************/
1089
1090 /* See local README for general interface details. This transport always
1091 returns FALSE, indicating that the status which has been placed in the first
1092 address should be copied to any other addresses in a batch.
1093
1094 Appendfile delivery is tricky and has led to various security problems in other
1095 mailers. The logic used here is therefore laid out in some detail. When this
1096 function is called, we are running in a subprocess which has had its gid and
1097 uid set to the appropriate values. Therefore, we cannot write directly to the
1098 exim logs. Any errors must be handled by setting appropriate return codes.
1099 Note that the default setting for addr->transport_return is DEFER, so it need
1100 not be set unless some other value is required.
1101
1102 The code below calls geteuid() rather than getuid() to get the current uid
1103 because in weird configurations not running setuid root there may be a
1104 difference. In the standard configuration, where setuid() has been used in the
1105 delivery process, there will be no difference between the uid and the euid.
1106
1107 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1108 alias expansion. Otherwise, there must be a configured file name or
1109 directory name.
1110
1111 The following items apply in the case when a file name (as opposed to a
1112 directory name) is given, that is, when appending to a single file:
1113
1114 (2f) Expand the file name.
1115
1116 (3f) If the file name is /dev/null, return success (optimization).
1117
1118 (4f) If the file_format options is set, open the file for reading, and check
1119 that the bytes at the start of the file match one of the given strings.
1120 If the check indicates a transport other than the current one should be
1121 used, pass control to that other transport. Otherwise continue. An empty
1122 or non-existent file matches the current transport. The file is closed
1123 after the check.
1124
1125 (5f) If a lock file is required, create it (see extensive separate comments
1126 below about the algorithm for doing this). It is important to do this
1127 before opening the mailbox if NFS is in use.
1128
1129 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1130 details of any symbolic link.
1131
1132 (7f) If the file already exists:
1133
1134 Check the owner and group if necessary, and defer if they are wrong.
1135
1136 If it is a symbolic link AND the allow_symlink option is set (NOT the
1137 default), go back to (6f) but this time use stat() instead of lstat().
1138
1139 If it's not a regular file (or FIFO when permitted), defer delivery.
1140
1141 Check permissions. If the required permissions are *less* than the
1142 existing ones, or supplied by the address (often by the user via filter),
1143 chmod() the file. Otherwise, defer.
1144
1145 Save the inode number.
1146
1147 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1148
1149 If open fails because the file does not exist, go to (6f); on any other
1150 failure, defer.
1151
1152 Check the inode number hasn't changed - I realize this isn't perfect (an
1153 inode can be reused) but it's cheap and will catch some of the races.
1154
1155 Check it's still a regular file (or FIFO if permitted).
1156
1157 Check that the owner and permissions haven't changed.
1158
1159 If file_format is set, check that the file still matches the format for
1160 the current transport. If not, defer delivery.
1161
1162 (8f) If file does not exist initially:
1163
1164 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1165 this is via a symbolic link (only possible if allow_symlinks is set), in
1166 which case don't use O_EXCL, as it doesn't work.
1167
1168 If open fails because the file already exists, go to (6f). To avoid
1169 looping for ever in a situation where the file is continuously being
1170 created and deleted, all of this happens inside a loop that operates
1171 lock_retries times and includes the fcntl and flock locking. If the
1172 loop completes without the file getting opened, defer and request
1173 freezing, because something really weird is happening.
1174
1175 If open fails for any other reason, defer for subsequent delivery except
1176 when this is a file delivery resulting from an alias or forward expansion
1177 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1178 most likely a user rather than a configuration error.
1179
1180 (9f) We now have the file checked and open for writing. If so configured, lock
1181 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1182 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1183 still fails, give up and defer delivery.
1184
1185 (10f)Save the access time (for subsequent restoration) and the size of the
1186 file, for comsat and for re-setting if delivery fails in the middle -
1187 e.g. for quota exceeded.
1188
1189 The following items apply in the case when a directory name is given:
1190
1191 (2d) Create a new file in the directory using a temporary name, by opening for
1192 writing and with O_CREAT. If maildir format is being used, the file
1193 is created in a temporary subdirectory with a prescribed name. If
1194 mailstore format is being used, the envelope file is first created with a
1195 temporary name, then the data file.
1196
1197 The following items apply in all cases:
1198
1199 (11) We now have the file open for writing, and locked if it was given as a
1200 file name. Write the message and flush the file, unless there is a setting
1201 of the local quota option, in which case we can check for its excession
1202 without doing any writing.
1203
1204 In the case of MBX format mailboxes, the message is first written to a
1205 temporary file, in order to get its correct length. This is then copied to
1206 the real file, preceded by an MBX header.
1207
1208 If there is a quota error on writing, defer the address. Timeout logic
1209 will determine for how long retries are attempted. We restore the mailbox
1210 to its original length if it's a single file. There doesn't seem to be a
1211 uniform error code for quota excession (it even differs between SunOS4
1212 and some versions of SunOS5) so a system-dependent macro called
1213 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1214 compile time.
1215
1216 For any other error (most commonly disk full), do the same.
1217
1218 The following applies after appending to a file:
1219
1220 (12f)Restore the atime; notify_comsat if required; close the file (which
1221 unlocks it if it was locked). Delete the lock file if it exists.
1222
1223 The following applies after writing a unique file in a directory:
1224
1225 (12d)For maildir format, rename the file into the new directory. For mailstore
1226 format, rename the envelope file to its correct name. Otherwise, generate
1227 a unique name from the directory_file option, and rename to that, possibly
1228 trying a few times if the file exists and re-expanding the name gives a
1229 different string.
1230
1231 This transport yields FAIL only when a file name is generated by an alias or
1232 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1233 All other failures return DEFER (in addr->transport_return). */
1234
1235
1236 BOOL
1237 appendfile_transport_entry(
1238 transport_instance *tblock, /* data for this instantiation */
1239 address_item *addr) /* address we are working on */
1240 {
1241 appendfile_transport_options_block *ob =
1242 (appendfile_transport_options_block *)(tblock->options_block);
1243 struct stat statbuf;
1244 uschar *fdname = NULL;
1245 uschar *filename = NULL;
1246 uschar *hitchname = NULL;
1247 uschar *dataname = NULL;
1248 uschar *lockname = NULL;
1249 uschar *newname = NULL;
1250 uschar *nametag = NULL;
1251 uschar *cr = US"";
1252 uschar *filecount_msg = US"";
1253 uschar *path;
1254 struct utimbuf times;
1255 struct timeval msg_tv;
1256 BOOL disable_quota = FALSE;
1257 BOOL isdirectory = FALSE;
1258 BOOL isfifo = FALSE;
1259 BOOL wait_for_tick = FALSE;
1260 uid_t uid = geteuid(); /* See note above */
1261 gid_t gid = getegid();
1262 int mbformat;
1263 int mode = (addr->mode > 0) ? addr->mode : ob->mode;
1264 off_t saved_size = -1;
1265 off_t mailbox_size = ob->mailbox_size_value;
1266 int mailbox_filecount = ob->mailbox_filecount_value;
1267 int hd = -1;
1268 int fd = -1;
1269 int yield = FAIL;
1270 int i;
1271
1272 #ifdef SUPPORT_MBX
1273 int save_fd = 0;
1274 int mbx_lockfd = -1;
1275 uschar mbx_lockname[40];
1276 FILE *temp_file = NULL;
1277 #endif /* SUPPORT_MBX */
1278
1279 #ifdef SUPPORT_MAILDIR
1280 int maildirsize_fd = -1; /* fd for maildirsize file */
1281 int maildir_save_errno;
1282 #endif
1283
1284
1285 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1286
1287 /* An "address_file" or "address_directory" transport is used to deliver to
1288 files specified via .forward or an alias file. Prior to release 4.20, the
1289 "file" and "directory" options were ignored in this case. This has been changed
1290 to allow the redirection data to specify what is in effect a folder, whose
1291 location is determined by the options on the transport.
1292
1293 Compatibility with the case when neither option is set is retained by forcing a
1294 value for the file or directory name. A directory delivery is assumed if the
1295 last character of the path from the router is '/'.
1296
1297 The file path is in the local part of the address, but not in the $local_part
1298 variable (that holds the parent local part). It is, however, in the
1299 $address_file variable. Below, we update the local part in the address if it
1300 changes by expansion, so that the final path ends up in the log. */
1301
1302 if (testflag(addr, af_file) &&
1303 ob->filename == NULL &&
1304 ob->dirname == NULL)
1305 {
1306 fdname = US"$address_file";
1307 if (address_file[Ustrlen(address_file)-1] == '/' ||
1308 ob->maildir_format ||
1309 ob->mailstore_format)
1310 isdirectory = TRUE;
1311 }
1312
1313 /* Handle (a) an "address file" delivery where "file" or "directory" is
1314 explicitly set and (b) a non-address_file delivery, where one of "file" or
1315 "directory" must be set; initialization ensures that they are not both set. */
1316
1317 if (fdname == NULL)
1318 {
1319 fdname = ob->filename;
1320 if (fdname == NULL)
1321 {
1322 fdname = ob->dirname;
1323 isdirectory = TRUE;
1324 }
1325 if (fdname == NULL)
1326 {
1327 addr->transport_return = PANIC;
1328 addr->message = string_sprintf("Mandatory file or directory option "
1329 "missing from %s transport", tblock->name);
1330 return FALSE;
1331 }
1332 }
1333
1334 /* Maildir and mailstore require a directory */
1335
1336 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1337 {
1338 addr->transport_return = PANIC;
1339 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1340 "to be specified for the %s transport",
1341 ob->maildir_format ? "dir" : "store", tblock->name);
1342 return FALSE;
1343 }
1344
1345 path = expand_string(fdname);
1346
1347 if (path == NULL)
1348 {
1349 addr->transport_return = PANIC;
1350 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1351 "name for %s transport) failed: %s", fdname, tblock->name,
1352 expand_string_message);
1353 return FALSE;
1354 }
1355
1356 if (path[0] != '/')
1357 {
1358 addr->message = string_sprintf("appendfile: file or directory name "
1359 "\"%s\" is not absolute", path);
1360 addr->basic_errno = ERRNO_NOTABSOLUTE;
1361 return FALSE;
1362 }
1363
1364 /* For a file delivery, make sure the local part in the address(es) is updated
1365 to the true local part. */
1366
1367 if (testflag(addr, af_file))
1368 for (address_item * addr2 = addr; addr2 != NULL; addr2 = addr2->next)
1369 addr2->local_part = string_copy(path);
1370
1371 /* The available mailbox formats depend on whether it is a directory or a file
1372 delivery. */
1373
1374 if (isdirectory)
1375 {
1376 mbformat =
1377 #ifdef SUPPORT_MAILDIR
1378 (ob->maildir_format) ? mbf_maildir :
1379 #endif
1380 #ifdef SUPPORT_MAILSTORE
1381 (ob->mailstore_format) ? mbf_mailstore :
1382 #endif
1383 mbf_smail;
1384 }
1385 else
1386 {
1387 mbformat =
1388 #ifdef SUPPORT_MBX
1389 (ob->mbx_format) ? mbf_mbx :
1390 #endif
1391 mbf_unix;
1392 }
1393
1394 DEBUG(D_transport)
1395 {
1396 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1397 "%s%s"
1398 " warning=" OFF_T_FMT "%s\n"
1399 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1400 "maildir_use_size_file=%s\n",
1401 mode, ob->notify_comsat, ob->quota_value,
1402 ob->quota_no_check ? " (no_check)" : "",
1403 ob->quota_filecount_no_check ? " (no_check_filecount)" : "",
1404 ob->quota_warn_threshold_value,
1405 ob->quota_warn_threshold_is_percent ? "%" : "",
1406 isdirectory ? "directory" : "file",
1407 path, mailbox_formats[mbformat],
1408 (ob->message_prefix == NULL) ? US"null" : string_printing(ob->message_prefix),
1409 (ob->message_suffix == NULL) ? US"null" : string_printing(ob->message_suffix),
1410 (ob->maildir_use_size_file) ? "yes" : "no");
1411
1412 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1413 ob->use_lockfile ? "lockfile " : "",
1414 ob->use_mbx_lock ? "mbx locking (" : "",
1415 ob->use_fcntl ? "fcntl " : "",
1416 ob->use_flock ? "flock" : "",
1417 ob->use_mbx_lock ? ")" : "");
1418 }
1419
1420 /* If the -N option is set, can't do any more. */
1421
1422 if (f.dont_deliver)
1423 {
1424 DEBUG(D_transport)
1425 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1426 tblock->name);
1427 addr->transport_return = OK;
1428 return FALSE;
1429 }
1430
1431 /* Handle the case of a file name. If the file name is /dev/null, we can save
1432 ourselves some effort and just give a success return right away. */
1433
1434 if (!isdirectory)
1435 {
1436 BOOL use_lstat = TRUE;
1437 BOOL file_opened = FALSE;
1438 BOOL allow_creation_here = TRUE;
1439
1440 if (Ustrcmp(path, "/dev/null") == 0)
1441 {
1442 addr->transport_return = OK;
1443 return FALSE;
1444 }
1445
1446 /* Set the name of the file to be opened, and the file to which the data
1447 is written, and find out if we are permitted to create a non-existent file. */
1448
1449 dataname = filename = path;
1450 allow_creation_here = check_creation(filename, ob->create_file);
1451
1452 /* If ob->create_directory is set, attempt to create the directories in
1453 which this mailbox lives, but only if we are permitted to create the file
1454 itself. We know we are dealing with an absolute path, because this was
1455 checked above. */
1456
1457 if (ob->create_directory && allow_creation_here)
1458 {
1459 uschar *p = Ustrrchr(path, '/');
1460 *p = '\0';
1461 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1462 {
1463 addr->basic_errno = errno;
1464 addr->message =
1465 string_sprintf("failed to create directories for %s: %s", path,
1466 strerror(errno));
1467 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1468 return FALSE;
1469 }
1470 *p = '/';
1471 }
1472
1473 /* If file_format is set we must check that any existing file matches one of
1474 the configured formats by checking the bytes it starts with. A match then
1475 indicates a specific transport - if it is not this one, pass control to it.
1476 Otherwise carry on here. An empty or non-existent file matches the current
1477 transport. We don't need to distinguish between non-existence and other open
1478 failures because if an existing file fails to open here, it will also fail
1479 again later when O_RDWR is used. */
1480
1481 if (ob->file_format != NULL)
1482 {
1483 int cfd = Uopen(path, O_RDONLY, 0);
1484 if (cfd >= 0)
1485 {
1486 transport_instance *tt = check_file_format(cfd, tblock, addr);
1487 (void)close(cfd);
1488
1489 /* If another transport is indicated, call it and return; if no transport
1490 was found, just return - the error data will have been set up.*/
1491
1492 if (tt != tblock)
1493 {
1494 if (tt != NULL)
1495 {
1496 set_process_info("delivering %s to %s using %s", message_id,
1497 addr->local_part, tt->name);
1498 debug_print_string(tt->debug_string);
1499 addr->transport = tt;
1500 (tt->info->code)(tt, addr);
1501 }
1502 return FALSE;
1503 }
1504 }
1505 }
1506
1507 /* The locking of mailbox files is worse than the naming of cats, which is
1508 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1509 three different names, so several different styles of locking are used.
1510
1511 Research in other programs that lock mailboxes shows that there is no
1512 universally standard method. Having mailboxes NFS-mounted on the system that
1513 is delivering mail is not the best thing, but people do run like this,
1514 and so the code must do its best to cope.
1515
1516 Three different locking mechanisms are supported. The initialization function
1517 checks that at least one is configured.
1518
1519 LOCK FILES
1520
1521 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1522 will work over NFS. Only after that is done do we actually open the mailbox
1523 and apply locks to it (if configured).
1524
1525 Originally, Exim got the file opened before doing anything about locking.
1526 However, a very occasional problem was observed on Solaris 2 when delivering
1527 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1528 gets remembered at open time. If another process on another host (that's
1529 important) has the file open and locked and writes to it and then releases
1530 the lock while the first process is waiting to get the lock, the first
1531 process may fail to write at the new end point of the file - despite the very
1532 definite statement about O_APPEND in the man page for write(). Experiments
1533 have reproduced this problem, but I do not know any way of forcing a host to
1534 update its attribute cache for an open NFS file. It would be nice if it did
1535 so when a lock was taken out, but this does not seem to happen. Anyway, to
1536 reduce the risk of this problem happening, we now create the lock file
1537 (if configured) *before* opening the mailbox. That will prevent two different
1538 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1539 however, but Pine at least seems to operate in the same way.
1540
1541 Lockfiles should normally be used when NFS is involved, because of the above
1542 problem.
1543
1544 The logic for creating the lock file is:
1545
1546 . The name of the lock file is <mailbox-name>.lock
1547
1548 . First, create a "hitching post" name by adding the primary host name,
1549 current time and pid to the lock file name. This should be unique.
1550
1551 . Create the hitching post file using WRONLY + CREAT + EXCL.
1552
1553 . If that fails EACCES, we assume it means that the user is unable to create
1554 files in the mail spool directory. Some installations might operate in this
1555 manner, so there is a configuration option to allow this state not to be an
1556 error - we proceed to lock using fcntl only, after the file is open.
1557
1558 . Otherwise, an error causes a deferment of the address.
1559
1560 . Hard link the hitching post to the lock file name.
1561
1562 . If the link succeeds, we have successfully created the lock file. Simply
1563 close and unlink the hitching post file.
1564
1565 . If the link does not succeed, proceed as follows:
1566
1567 o Fstat the hitching post file, and then close and unlink it.
1568
1569 o Now examine the stat data. If the number of links to the file is exactly
1570 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1571 the return never made it back, so the link() function gave a failure
1572 return.
1573
1574 . This method allows for the lock file to be created by some other process
1575 right up to the moment of the attempt to hard link it, and is also robust
1576 against NFS server crash-reboots, which would probably result in timeouts
1577 in the middle of link().
1578
1579 . System crashes may cause lock files to get left lying around, and some means
1580 of flushing them is required. The approach of writing a pid (used by smail
1581 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1582 timeout, which seems a better approach. Since any program that writes to a
1583 mailbox using a lock file should complete its task very quickly, Pine
1584 removes lock files that are older than 5 minutes. We allow the value to be
1585 configurable on the transport.
1586
1587 FCNTL LOCKING
1588
1589 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1590 mailbox once it is open. This is done by default with a non-blocking lock.
1591 Failures to lock cause retries after a sleep, but only for a certain number
1592 of tries. A blocking lock is deliberately not used so that we don't hold the
1593 mailbox open. This minimizes the possibility of the NFS problem described
1594 under LOCK FILES above, if for some reason NFS deliveries are happening
1595 without lock files. However, the use of a non-blocking lock and sleep, though
1596 the safest approach, does not give the best performance on very busy systems.
1597 A blocking lock plus timeout does better. Therefore Exim has an option to
1598 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1599 enables the use of blocking fcntl() calls.
1600
1601 FLOCK LOCKING
1602
1603 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1604 same manner as for fcntl locking above. No-blocking/timeout is also set as
1605 above in lock_flock_timeout. Not all operating systems provide or support
1606 flock(). For those that don't (as determined by the definition of LOCK_SH in
1607 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1608 is implemented (not precisely) on top of fcntl(), which means there's no
1609 point in actually using it.
1610
1611 MBX LOCKING
1612
1613 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1614 then the rules used for locking in c-client are used. Exim takes out a shared
1615 lock on the mailbox file, and an exclusive lock on the file whose name is
1616 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1617 any other MBX client from getting an exclusive lock on it and expunging it.
1618 It also stops any other MBX client from unlinking the /tmp lock when it has
1619 finished with it.
1620
1621 The exclusive lock on the /tmp file prevents any other MBX client from
1622 updating the mailbox in any way. When writing is finished, if an exclusive
1623 lock on the mailbox can be obtained, indicating there are no current sharers,
1624 the /tmp file is unlinked.
1625
1626 MBX locking can use either fcntl() or flock() locking. If neither
1627 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1628 The calls for getting these locks are by default non-blocking, as for non-mbx
1629 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1630 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1631 probably makes sense to set timeouts for any MBX deliveries. */
1632
1633
1634 /* Build a lock file if configured to do so - the existence of a lock
1635 file is subsequently checked by looking for a non-negative value of the
1636 file descriptor hd - even though the file is no longer open. */
1637
1638 if (ob->use_lockfile)
1639 {
1640 /* cf. exim_lock.c */
1641 lockname = string_sprintf("%s.lock", filename);
1642 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1643 (unsigned int)(time(NULL)), (unsigned int)getpid());
1644
1645 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1646 hitchname);
1647
1648 /* Lock file creation retry loop */
1649
1650 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1651 {
1652 int rc;
1653 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1654
1655 if (hd < 0)
1656 {
1657 addr->basic_errno = errno;
1658 addr->message =
1659 string_sprintf("creating lock file hitching post %s "
1660 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1661 (long int)getegid());
1662 return FALSE;
1663 }
1664
1665 /* Attempt to hitch the hitching post to the lock file. If link()
1666 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1667 file, and get rid of the hitching post. If the number of links was 2,
1668 the link was created, despite the failure of link(). If the hitch was
1669 not successful, try again, having unlinked the lock file if it is too
1670 old.
1671
1672 There's a version of Linux (2.0.27) which doesn't update its local cache
1673 of the inode after link() by default - which many think is a bug - but
1674 if the link succeeds, this code will be OK. It just won't work in the
1675 case when link() fails after having actually created the link. The Linux
1676 NFS person is fixing this; a temporary patch is available if anyone is
1677 sufficiently worried. */
1678
1679 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1680 (void)close(hd);
1681 Uunlink(hitchname);
1682 if (rc != 0 && statbuf.st_nlink != 2)
1683 {
1684 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1685 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1686 {
1687 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1688 Uunlink(lockname);
1689 }
1690 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1691 continue;
1692 }
1693
1694 DEBUG(D_transport) debug_printf("lock file created\n");
1695 break;
1696 }
1697
1698 /* Check for too many tries at creating the lock file */
1699
1700 if (i >= ob->lock_retries)
1701 {
1702 addr->basic_errno = ERRNO_LOCKFAILED;
1703 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1704 filename);
1705 return FALSE;
1706 }
1707 }
1708
1709
1710 /* We now have to get the file open. First, stat() it and act on existence or
1711 non-existence. This is in a loop to handle the case of a file's being created
1712 or deleted as we watch, and also to handle retries when the locking fails.
1713 Rather than holding the file open while waiting for the fcntl() and/or
1714 flock() lock, we close and do the whole thing again. This should be safer,
1715 especially for NFS files, which might get altered from other hosts, making
1716 their cached sizes incorrect.
1717
1718 With the default settings, no symlinks are permitted, but there is an option
1719 to permit symlinks for those sysadmins that know what they are doing.
1720 Shudder. However, insist that the initial symlink is owned by the right user.
1721 Thus lstat() is used initially; if a symlink is discovered, the loop is
1722 repeated such that stat() is used, to look at the end file. */
1723
1724 for (i = 0; i < ob->lock_retries; i++)
1725 {
1726 int sleep_before_retry = TRUE;
1727 file_opened = FALSE;
1728
1729 if((use_lstat ? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1730 {
1731 /* Let's hope that failure to stat (other than non-existence) is a
1732 rare event. */
1733
1734 if (errno != ENOENT)
1735 {
1736 addr->basic_errno = errno;
1737 addr->message = string_sprintf("attempting to stat mailbox %s",
1738 filename);
1739 goto RETURN;
1740 }
1741
1742 /* File does not exist. If it is required to pre-exist this state is an
1743 error. */
1744
1745 if (ob->file_must_exist)
1746 {
1747 addr->basic_errno = errno;
1748 addr->message = string_sprintf("mailbox %s does not exist, "
1749 "but file_must_exist is set", filename);
1750 goto RETURN;
1751 }
1752
1753 /* If not permitted to create this file because it isn't in or below
1754 the home directory, generate an error. */
1755
1756 if (!allow_creation_here)
1757 {
1758 addr->basic_errno = ERRNO_BADCREATE;
1759 addr->message = string_sprintf("mailbox %s does not exist, "
1760 "but creation outside the home directory is not permitted",
1761 filename);
1762 goto RETURN;
1763 }
1764
1765 /* Attempt to create and open the file. If open fails because of
1766 pre-existence, go round the loop again. For any other error, defer the
1767 address, except for an alias or forward generated file name with EPERM,
1768 ENOENT, or EACCES, as those are most likely to be user errors rather
1769 than Exim config errors. When a symbolic link is permitted and points
1770 to a non-existent file, we get here with use_lstat = FALSE. In this case
1771 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1772 consistency and because MBX locking requires it in order to be able to
1773 get a shared lock. */
1774
1775 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1776 (use_lstat ? O_EXCL : 0), mode);
1777 if (fd < 0)
1778 {
1779 if (errno == EEXIST) continue;
1780 addr->basic_errno = errno;
1781 addr->message = string_sprintf("while creating mailbox %s",
1782 filename);
1783 if (testflag(addr, af_file) &&
1784 (errno == EPERM || errno == ENOENT || errno == EACCES))
1785 addr->transport_return = FAIL;
1786 goto RETURN;
1787 }
1788
1789 /* We have successfully created and opened the file. Ensure that the group
1790 and the mode are correct. */
1791
1792 if(exim_chown(filename, uid, gid) || Uchmod(filename, mode))
1793 {
1794 addr->basic_errno = errno;
1795 addr->message = string_sprintf("while setting perms on mailbox %s",
1796 filename);
1797 addr->transport_return = FAIL;
1798 goto RETURN;
1799 }
1800 }
1801
1802
1803 /* The file already exists. Test its type, ownership, and permissions, and
1804 save the inode for checking later. If symlinks are permitted (not the
1805 default or recommended state) it may be a symlink that already exists.
1806 Check its ownership and then look for the file at the end of the link(s).
1807 This at least prevents one user creating a symlink for another user in
1808 a sticky directory. */
1809
1810 else
1811 {
1812 int oldmode = (int)statbuf.st_mode;
1813 ino_t inode = statbuf.st_ino;
1814 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1815
1816 isfifo = FALSE; /* In case things are changing */
1817
1818 /* Check owner if required - the default. */
1819
1820 if (ob->check_owner && statbuf.st_uid != uid)
1821 {
1822 addr->basic_errno = ERRNO_BADUGID;
1823 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1824 "(%ld != %ld)", filename,
1825 islink ? " (symlink)" : "",
1826 (long int)(statbuf.st_uid), (long int)uid);
1827 goto RETURN;
1828 }
1829
1830 /* Group is checked only if check_group is set. */
1831
1832 if (ob->check_group && statbuf.st_gid != gid)
1833 {
1834 addr->basic_errno = ERRNO_BADUGID;
1835 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1836 filename, islink ? " (symlink)" : "", statbuf.st_gid, gid);
1837 goto RETURN;
1838 }
1839
1840 /* Just in case this is a sticky-bit mail directory, we don't want
1841 users to be able to create hard links to other users' files. */
1842
1843 if (statbuf.st_nlink != 1)
1844 {
1845 addr->basic_errno = ERRNO_NOTREGULAR;
1846 addr->message = string_sprintf("mailbox %s%s has too many links (%d)",
1847 filename, islink ? " (symlink)" : "", statbuf.st_nlink);
1848 goto RETURN;
1849
1850 }
1851
1852 /* If symlinks are permitted (not recommended), the lstat() above will
1853 have found the symlink. Its ownership has just been checked; go round
1854 the loop again, using stat() instead of lstat(). That will never yield a
1855 mode of S_IFLNK. */
1856
1857 if (islink && ob->allow_symlink)
1858 {
1859 use_lstat = FALSE;
1860 i--; /* Don't count this time round */
1861 continue;
1862 }
1863
1864 /* An actual file exists. Check that it is a regular file, or FIFO
1865 if permitted. */
1866
1867 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1868
1869 else if ((oldmode & S_IFMT) != S_IFREG)
1870 {
1871 addr->basic_errno = ERRNO_NOTREGULAR;
1872 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1873 filename, ob->allow_fifo ? " or named pipe" : "");
1874 goto RETURN;
1875 }
1876
1877 /* If the mode is not what it would be for a newly created file, change
1878 the permissions if the mode is supplied for the address. Otherwise,
1879 reduce but do not extend the permissions. If the newly created
1880 permissions are greater than the existing permissions, don't change
1881 things when the mode is not from the address. */
1882
1883 if ((oldmode = (oldmode & 07777)) != mode)
1884 {
1885 int diffs = oldmode ^ mode;
1886 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1887 {
1888 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1889 if (Uchmod(filename, mode) < 0)
1890 {
1891 addr->basic_errno = errno;
1892 addr->message = string_sprintf("attempting to chmod mailbox %s",
1893 filename);
1894 goto RETURN;
1895 }
1896 oldmode = mode;
1897 }
1898
1899 /* Mode not from address, and newly-created permissions are greater
1900 than existing permissions. Default is to complain, but it can be
1901 configured to go ahead and try to deliver anyway if that's what
1902 the administration wants. */
1903
1904 else if (ob->mode_fail_narrower)
1905 {
1906 addr->basic_errno = ERRNO_BADMODE;
1907 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1908 "(%o expected)", filename, oldmode, mode);
1909 goto RETURN;
1910 }
1911 }
1912
1913 /* We are happy with the existing file. Open it, and then do further
1914 tests to ensure that it is the same file that we were just looking at.
1915 If the file does not now exist, restart this loop, going back to using
1916 lstat again. For an NFS error, just defer; other opening errors are
1917 more serious. The file is opened RDWR so that its format can be checked,
1918 and also MBX locking requires the use of a shared (read) lock. However,
1919 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1920 reading the pipe. */
1921
1922 fd = Uopen(filename, isfifo ? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1923 mode);
1924 if (fd < 0)
1925 {
1926 if (errno == ENOENT)
1927 {
1928 use_lstat = TRUE;
1929 continue;
1930 }
1931 addr->basic_errno = errno;
1932 if (isfifo)
1933 {
1934 addr->message = string_sprintf("while opening named pipe %s "
1935 "(could mean no process is reading it)", filename);
1936 }
1937 else if (errno != EWOULDBLOCK)
1938 {
1939 addr->message = string_sprintf("while opening mailbox %s", filename);
1940 }
1941 goto RETURN;
1942 }
1943
1944 /* This fstat really shouldn't fail, as we have an open file! There's a
1945 dilemma here. We use fstat in order to be sure we are peering at the file
1946 we have got open. However, that won't tell us if the file was reached
1947 via a symbolic link. We checked this above, but there is a race exposure
1948 if the link was created between the previous lstat and the open. However,
1949 it would have to be created with the same inode in order to pass the
1950 check below. If ob->allow_symlink is set, causing the use of stat rather
1951 than lstat above, symbolic links may be there anyway, and the checking is
1952 weaker. */
1953
1954 if (fstat(fd, &statbuf) < 0)
1955 {
1956 addr->basic_errno = errno;
1957 addr->message = string_sprintf("attempting to stat open mailbox %s",
1958 filename);
1959 goto RETURN;
1960 }
1961
1962 /* Check the inode; this is isn't a perfect check, but gives some
1963 confidence. */
1964
1965 if (inode != statbuf.st_ino)
1966 {
1967 addr->basic_errno = ERRNO_INODECHANGED;
1968 addr->message = string_sprintf("opened mailbox %s inode number changed "
1969 "from " INO_T_FMT " to " INO_T_FMT, filename, inode, statbuf.st_ino);
1970 addr->special_action = SPECIAL_FREEZE;
1971 goto RETURN;
1972 }
1973
1974 /* Check it's still a regular file or FIFO, and the uid, gid, and
1975 permissions have not changed. */
1976
1977 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1978 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1979 {
1980 addr->basic_errno = ERRNO_NOTREGULAR;
1981 addr->message =
1982 string_sprintf("opened mailbox %s is no longer a %s", filename,
1983 isfifo ? "named pipe" : "regular file");
1984 addr->special_action = SPECIAL_FREEZE;
1985 goto RETURN;
1986 }
1987
1988 if ((ob->check_owner && statbuf.st_uid != uid) ||
1989 (ob->check_group && statbuf.st_gid != gid))
1990 {
1991 addr->basic_errno = ERRNO_BADUGID;
1992 addr->message =
1993 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1994 addr->special_action = SPECIAL_FREEZE;
1995 goto RETURN;
1996 }
1997
1998 if ((statbuf.st_mode & 07777) != oldmode)
1999 {
2000 addr->basic_errno = ERRNO_BADMODE;
2001 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
2002 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
2003 addr->special_action = SPECIAL_FREEZE;
2004 goto RETURN;
2005 }
2006
2007 /* If file_format is set, check that the format of the file has not
2008 changed. Error data is set by the testing function. */
2009
2010 if (ob->file_format != NULL &&
2011 check_file_format(fd, tblock, addr) != tblock)
2012 {
2013 addr->message = US"open mailbox has changed format";
2014 goto RETURN;
2015 }
2016
2017 /* The file is OK. Carry on to do the locking. */
2018 }
2019
2020 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
2021 locking rules if configured to do so. If a lock file is also required, it
2022 was created above and hd was left >= 0. At least one form of locking is
2023 required by the initialization function. If locking fails here, close the
2024 file and go round the loop all over again, after waiting for a bit, unless
2025 blocking locking was used. */
2026
2027 file_opened = TRUE;
2028 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
2029 sleep_before_retry = FALSE;
2030
2031 /* Simple fcntl() and/or flock() locking */
2032
2033 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
2034 {
2035 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2036 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
2037 }
2038
2039 /* MBX locking rules */
2040
2041 #ifdef SUPPORT_MBX
2042 else if (ob->use_mbx_lock)
2043 {
2044 int mbx_tmp_oflags;
2045 struct stat lstatbuf, statbuf2;
2046 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2047 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
2048 fstat(fd, &statbuf) >= 0)
2049 {
2050 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
2051 (long)statbuf.st_ino);
2052
2053 /*
2054 * 2010-05-29: SECURITY
2055 * Dan Rosenberg reported the presence of a race-condition in the
2056 * original code here. Beware that many systems still allow symlinks
2057 * to be followed in /tmp so an attacker can create a symlink pointing
2058 * elsewhere between a stat and an open, which we should avoid
2059 * following.
2060 *
2061 * It's unfortunate that we can't just use all the heavily debugged
2062 * locking from above.
2063 *
2064 * Also: remember to mirror changes into exim_lock.c */
2065
2066 /* first leave the old pre-check in place, it provides better
2067 * diagnostics for common cases */
2068 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2069 {
2070 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2071 {
2072 addr->basic_errno = ERRNO_LOCKFAILED;
2073 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2074 mbx_lockname);
2075 goto RETURN;
2076 }
2077 if (statbuf.st_nlink > 1)
2078 {
2079 addr->basic_errno = ERRNO_LOCKFAILED;
2080 addr->message = string_sprintf("hard link to MBX lock file %s",
2081 mbx_lockname);
2082 goto RETURN;
2083 }
2084 }
2085
2086 /* If we could just declare "we must be the ones who create this
2087 * file" then a hitching post in a subdir would work, since a
2088 * subdir directly in /tmp/ which we create wouldn't follow links
2089 * but this isn't our locking logic, so we can't safely change the
2090 * file existence rules. */
2091
2092 /* On systems which support O_NOFOLLOW, it's the easiest and most
2093 * obviously correct security fix */
2094 mbx_tmp_oflags = O_RDWR | O_CREAT;
2095 #ifdef O_NOFOLLOW
2096 mbx_tmp_oflags |= O_NOFOLLOW;
2097 #endif
2098 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2099 if (mbx_lockfd < 0)
2100 {
2101 addr->basic_errno = ERRNO_LOCKFAILED;
2102 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2103 mbx_lockname, strerror(errno));
2104 goto RETURN;
2105 }
2106
2107 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2108 {
2109 addr->basic_errno = ERRNO_LOCKFAILED;
2110 addr->message = string_sprintf("attempting to lstat open MBX "
2111 "lock file %s: %s", mbx_lockname, strerror(errno));
2112 goto RETURN;
2113 }
2114 if (fstat(mbx_lockfd, &statbuf2) < 0)
2115 {
2116 addr->basic_errno = ERRNO_LOCKFAILED;
2117 addr->message = string_sprintf("attempting to stat fd of open MBX "
2118 "lock file %s: %s", mbx_lockname, strerror(errno));
2119 goto RETURN;
2120 }
2121
2122 /*
2123 * At this point:
2124 * statbuf: if exists, is file which existed prior to opening the
2125 * lockfile, might have been replaced since then
2126 * statbuf2: result of stat'ing the open fd, is what was actually
2127 * opened
2128 * lstatbuf: result of lstat'ing the filename immediately after
2129 * the open but there's a race condition again between
2130 * those two steps: before open, symlink to foo, after
2131 * open but before lstat have one of:
2132 * * was no symlink, so is the opened file
2133 * (we created it, no messing possible after that point)
2134 * * hardlink to foo
2135 * * symlink elsewhere
2136 * * hardlink elsewhere
2137 * * new file/other
2138 * Don't want to compare to device of /tmp because some modern systems
2139 * have regressed to having /tmp be the safe actual filesystem as
2140 * valuable data, so is mostly worthless, unless we assume that *only*
2141 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2142 * for further consideration.
2143 * No point in doing a readlink on the lockfile as that will always be
2144 * at a different point in time from when we open it, so tells us
2145 * nothing; attempts to clean up and delete after ourselves would risk
2146 * deleting a *third* filename.
2147 */
2148 if ((statbuf2.st_nlink > 1) ||
2149 (lstatbuf.st_nlink > 1) ||
2150 (!S_ISREG(lstatbuf.st_mode)) ||
2151 (lstatbuf.st_dev != statbuf2.st_dev) ||
2152 (lstatbuf.st_ino != statbuf2.st_ino))
2153 {
2154 addr->basic_errno = ERRNO_LOCKFAILED;
2155 addr->message = string_sprintf("RACE CONDITION detected: "
2156 "mismatch post-initial-checks between \"%s\" and opened "
2157 "fd lead us to abort!", mbx_lockname);
2158 goto RETURN;
2159 }
2160
2161 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2162
2163 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2164 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2165 {
2166 struct stat ostatbuf;
2167
2168 /* This tests for a specific race condition. Ensure that we still
2169 have the same file. */
2170
2171 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2172 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2173 statbuf.st_dev == ostatbuf.st_dev &&
2174 statbuf.st_ino == ostatbuf.st_ino)
2175 break;
2176 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2177 "between creation and locking\n", mbx_lockname);
2178 }
2179
2180 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2181 strerror(errno));
2182 (void)close(mbx_lockfd);
2183 mbx_lockfd = -1;
2184 }
2185 else
2186 {
2187 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2188 filename, strerror(errno));
2189 }
2190 }
2191 #endif /* SUPPORT_MBX */
2192
2193 else break; /* No on-file locking required; break the open/lock loop */
2194
2195 DEBUG(D_transport)
2196 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2197
2198 (void)close(fd);
2199 fd = -1;
2200 use_lstat = TRUE; /* Reset to use lstat first */
2201
2202
2203 /* If a blocking call timed out, break the retry loop if the total time
2204 so far is not less than than retries * interval. Use the larger of the
2205 flock() and fcntl() timeouts. */
2206
2207 if (sigalrm_seen &&
2208 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2209 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2210 ob->lock_retries * ob->lock_interval)
2211 i = ob->lock_retries;
2212
2213 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2214 flock() that caused the problem. */
2215
2216 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2217 }
2218
2219 /* Test for exceeding the maximum number of tries. Either the file remains
2220 locked, or, if we haven't got it open, something is terribly wrong... */
2221
2222 if (i >= ob->lock_retries)
2223 {
2224 if (!file_opened)
2225 {
2226 addr->basic_errno = ERRNO_EXISTRACE;
2227 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2228 addr->special_action = SPECIAL_FREEZE;
2229 }
2230 else
2231 {
2232 addr->basic_errno = ERRNO_LOCKFAILED;
2233 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2234 filename);
2235 }
2236 goto RETURN;
2237 }
2238
2239 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2240
2241 /* Save access time (for subsequent restoration), modification time (for
2242 restoration if updating fails), size of file (for comsat and for re-setting if
2243 delivery fails in the middle - e.g. for quota exceeded). */
2244
2245 if (fstat(fd, &statbuf) < 0)
2246 {
2247 addr->basic_errno = errno;
2248 addr->message = string_sprintf("while fstatting opened mailbox %s",
2249 filename);
2250 goto RETURN;
2251 }
2252
2253 times.actime = statbuf.st_atime;
2254 times.modtime = statbuf.st_mtime;
2255 saved_size = statbuf.st_size;
2256 if (mailbox_size < 0) mailbox_size = saved_size;
2257 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2258 }
2259
2260 /* Prepare for writing to a new file (as opposed to appending to an old one).
2261 There are several different formats, but there is preliminary stuff concerned
2262 with quotas that applies to all of them. Finding the current size by directory
2263 scanning is expensive; for maildirs some fudges have been invented:
2264
2265 (1) A regex can be used to extract a file size from its name;
2266 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2267 mailbox size.
2268 */
2269
2270 else
2271 {
2272 uschar *check_path = path; /* Default quota check path */
2273 const pcre *regex = NULL; /* Regex for file size from file name */
2274
2275 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2276 {
2277 addr->basic_errno = ERRNO_BADCREATE;
2278 addr->message = string_sprintf("tried to create file in %s, but "
2279 "file creation outside the home directory is not permitted", path);
2280 goto RETURN;
2281 }
2282
2283 #ifdef SUPPORT_MAILDIR
2284 /* For a maildir delivery, ensure that all the relevant directories exist,
2285 and a maildirfolder file if necessary. */
2286
2287 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2288 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2289 return FALSE;
2290 #endif /* SUPPORT_MAILDIR */
2291
2292 /* If we are going to do a quota check, of if maildir_use_size_file is set
2293 for a maildir delivery, compile the regular expression if there is one. We
2294 may also need to adjust the path that is used. We need to do this for
2295 maildir_use_size_file even if the quota is unset, because we still want to
2296 create the file. When maildir support is not compiled,
2297 ob->maildir_use_size_file is always FALSE. */
2298
2299 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2300 {
2301 const uschar *error;
2302 int offset;
2303
2304 /* Compile the regex if there is one. */
2305
2306 if (ob->quota_size_regex != NULL)
2307 {
2308 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2309 (const char **)&error, &offset, NULL);
2310 if (regex == NULL)
2311 {
2312 addr->message = string_sprintf("appendfile: regular expression "
2313 "error: %s at offset %d while compiling %s", error, offset,
2314 ob->quota_size_regex);
2315 return FALSE;
2316 }
2317 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2318 ob->quota_size_regex);
2319 }
2320
2321 /* Use an explicitly configured directory if set */
2322
2323 if (ob->quota_directory != NULL)
2324 {
2325 check_path = expand_string(ob->quota_directory);
2326 if (check_path == NULL)
2327 {
2328 addr->transport_return = PANIC;
2329 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2330 "name for %s transport) failed: %s", ob->quota_directory,
2331 tblock->name, expand_string_message);
2332 return FALSE;
2333 }
2334
2335 if (check_path[0] != '/')
2336 {
2337 addr->message = string_sprintf("appendfile: quota_directory name "
2338 "\"%s\" is not absolute", check_path);
2339 addr->basic_errno = ERRNO_NOTABSOLUTE;
2340 return FALSE;
2341 }
2342 }
2343
2344 #ifdef SUPPORT_MAILDIR
2345 /* Otherwise, if we are handling a maildir delivery, and the directory
2346 contains a file called maildirfolder, this is a maildir++ feature telling
2347 us that this is a sub-directory of the real inbox. We should therefore do
2348 the quota check on the parent directory. Beware of the special case when
2349 the directory name itself ends in a slash. */
2350
2351 else if (mbformat == mbf_maildir)
2352 {
2353 struct stat statbuf;
2354 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2355 {
2356 uschar *new_check_path = string_copy(check_path);
2357 uschar *slash = Ustrrchr(new_check_path, '/');
2358 if (slash != NULL)
2359 {
2360 if (slash[1] == 0)
2361 {
2362 *slash = 0;
2363 slash = Ustrrchr(new_check_path, '/');
2364 }
2365 if (slash != NULL)
2366 {
2367 *slash = 0;
2368 check_path = new_check_path;
2369 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2370 "quota check directory changed to %s\n", check_path);
2371 }
2372 }
2373 }
2374 }
2375 #endif /* SUPPORT_MAILDIR */
2376 }
2377
2378 /* If we are using maildirsize files, we need to ensure that such a file
2379 exists and, if necessary, recalculate its contents. As a byproduct of this,
2380 we obtain the current size of the maildir. If no quota is to be enforced
2381 (ob->quota_value == 0), we still need the size if a threshold check will
2382 happen later.
2383
2384 Another regular expression is used to determine which directories inside the
2385 maildir are going to be counted. */
2386
2387 #ifdef SUPPORT_MAILDIR
2388 if (ob->maildir_use_size_file)
2389 {
2390 const pcre *dir_regex = NULL;
2391 const uschar *error;
2392 int offset;
2393
2394 if (ob->maildir_dir_regex != NULL)
2395 {
2396 int check_path_len = Ustrlen(check_path);
2397
2398 if (!(dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2399 CCSS &error, &offset, NULL)))
2400 {
2401 addr->message = string_sprintf("appendfile: regular expression "
2402 "error: %s at offset %d while compiling %s", error, offset,
2403 ob->maildir_dir_regex);
2404 return FALSE;
2405 }
2406
2407 DEBUG(D_transport)
2408 debug_printf("using regex for maildir directory selection: %s\n",
2409 ob->maildir_dir_regex);
2410
2411 /* Check to see if we are delivering into an ignored directory, that is,
2412 if the delivery path starts with the quota check path, and the rest
2413 of the deliver path matches the regex; if so, set a flag to disable quota
2414 checking and maildirsize updating. */
2415
2416 if (Ustrncmp(path, check_path, check_path_len) == 0)
2417 {
2418 uschar *s = path + check_path_len;
2419 while (*s == '/') s++;
2420 s = (*s == 0) ? US "new" : string_sprintf("%s/new", s);
2421 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2422 {
2423 disable_quota = TRUE;
2424 DEBUG(D_transport) debug_printf("delivery directory does not match "
2425 "maildir_quota_directory_regex: disabling quota\n");
2426 }
2427 }
2428 }
2429
2430 /* Quota enforcement; create and check the file. There is some discussion
2431 about whether this should happen if the quota is unset. At present, Exim
2432 always creates the file. If we ever want to change this, uncomment
2433 appropriate lines below, possibly doing a check on some option. */
2434
2435 /* if (???? || ob->quota_value > 0) */
2436
2437 if (!disable_quota)
2438 {
2439 off_t size;
2440 int filecount;
2441
2442 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2443 &size, &filecount);
2444
2445 if (maildirsize_fd == -1)
2446 {
2447 addr->basic_errno = errno;
2448 addr->message = string_sprintf("while opening or reading "
2449 "%s/maildirsize", check_path);
2450 return FALSE;
2451 }
2452 /* can also return -2, which means that the file was removed because of
2453 raciness; but in this case, the size & filecount will still have been
2454 updated. */
2455
2456 if (mailbox_size < 0) mailbox_size = size;
2457 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2458 }
2459
2460 /* No quota enforcement; ensure file does *not* exist; calculate size if
2461 needed. */
2462
2463 /* else
2464 * {
2465 * time_t old_latest;
2466 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2467 * if (THRESHOLD_CHECK)
2468 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2469 * regex, dir_regex, FALSE);
2470 * }
2471 */
2472
2473 }
2474 #endif /* SUPPORT_MAILDIR */
2475
2476 /* Otherwise if we are going to do a quota check later on, and the mailbox
2477 size is not set, find the current size of the mailbox. Ditto for the file
2478 count. Note that ob->quota_filecount_value cannot be set without
2479 ob->quota_value being set. */
2480
2481 if (!disable_quota &&
2482 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2483 (mailbox_size < 0 ||
2484 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2485 {
2486 off_t size;
2487 int filecount = 0;
2488 DEBUG(D_transport)
2489 debug_printf("quota checks on directory %s\n", check_path);
2490 size = check_dir_size(check_path, &filecount, regex);
2491 if (mailbox_size < 0) mailbox_size = size;
2492 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2493 }
2494
2495 /* Handle the case of creating a unique file in a given directory (not in
2496 maildir or mailstore format - this is how smail did it). A temporary name is
2497 used to create the file. Later, when it is written, the name is changed to a
2498 unique one. There is no need to lock the file. An attempt is made to create
2499 the directory if it does not exist. */
2500
2501 if (mbformat == mbf_smail)
2502 {
2503 DEBUG(D_transport)
2504 debug_printf("delivering to new file in %s\n", path);
2505 filename = dataname =
2506 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2507 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2508 if (fd < 0 && /* failed to open, and */
2509 (errno != ENOENT || /* either not non-exist */
2510 !ob->create_directory || /* or not allowed to make */
2511 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2512 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2513 {
2514 addr->basic_errno = errno;
2515 addr->message = string_sprintf("while creating file %s", filename);
2516 return FALSE;
2517 }
2518 }
2519
2520 #ifdef SUPPORT_MAILDIR
2521
2522 /* Handle the case of a unique file in maildir format. The file is written to
2523 the tmp subdirectory, with a prescribed form of name. */
2524
2525 else if (mbformat == mbf_maildir)
2526 {
2527 DEBUG(D_transport)
2528 debug_printf("delivering in maildir format in %s\n", path);
2529
2530 nametag = ob->maildir_tag;
2531
2532 /* Check that nametag expands successfully; a hard failure causes a panic
2533 return. The actual expansion for use happens again later, when
2534 $message_size is accurately known. */
2535
2536 if (nametag != NULL && expand_string(nametag) == NULL &&
2537 !f.expand_string_forcedfail)
2538 {
2539 addr->transport_return = PANIC;
2540 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2541 "for %s transport) failed: %s", nametag, tblock->name,
2542 expand_string_message);
2543 return FALSE;
2544 }
2545
2546 /* We ensured the existence of all the relevant directories above. Attempt
2547 to open the temporary file a limited number of times. I think this rather
2548 scary-looking for statement is actually OK. If open succeeds, the loop is
2549 broken; if not, there is a test on the value of i. Get the time again
2550 afresh each time round the loop. Its value goes into a variable that is
2551 checked at the end, to make sure we don't release this process until the
2552 clock has ticked. */
2553
2554 for (int i = 1;; i++)
2555 {
2556 uschar *basename;
2557
2558 (void)gettimeofday(&msg_tv, NULL);
2559 basename = string_sprintf(TIME_T_FMT ".H%luP" PID_T_FMT ".%s",
2560 msg_tv.tv_sec, msg_tv.tv_usec, getpid(), primary_hostname);
2561
2562 filename = dataname = string_sprintf("tmp/%s", basename);
2563 newname = string_sprintf("new/%s", basename);
2564
2565 if (Ustat(filename, &statbuf) == 0)
2566 errno = EEXIST;
2567 else if (errno == ENOENT)
2568 {
2569 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2570 if (fd >= 0) break;
2571 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2572 filename, strerror(errno));
2573 }
2574
2575 /* Too many retries - give up */
2576
2577 if (i >= ob->maildir_retries)
2578 {
2579 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2580 filename, i, (i == 1) ? "y" : "ies");
2581 addr->basic_errno = errno;
2582 if (errno == errno_quota || errno == ENOSPC)
2583 addr->user_message = US"mailbox is full";
2584 return FALSE;
2585 }
2586
2587 /* Open or stat failed but we haven't tried too many times yet. */
2588
2589 sleep(2);
2590 }
2591
2592 /* Note that we have to ensure the clock has ticked before leaving */
2593
2594 wait_for_tick = TRUE;
2595
2596 /* Why are these here? Put in because they are present in the non-maildir
2597 directory case above. */
2598
2599 if(exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2600 {
2601 addr->basic_errno = errno;
2602 addr->message = string_sprintf("while setting perms on maildir %s",
2603 filename);
2604 return FALSE;
2605 }
2606 }
2607
2608 #endif /* SUPPORT_MAILDIR */
2609
2610 #ifdef SUPPORT_MAILSTORE
2611
2612 /* Handle the case of a unique file in mailstore format. First write the
2613 envelope to a temporary file, then open the main file. The unique base name
2614 for the files consists of the message id plus the pid of this delivery
2615 process. */
2616
2617 else
2618 {
2619 FILE *env_file;
2620 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2621 string_base62((long int)getpid()));
2622
2623 DEBUG(D_transport)
2624 debug_printf("delivering in mailstore format in %s\n", path);
2625
2626 filename = string_sprintf("%s.tmp", mailstore_basename);
2627 newname = string_sprintf("%s.env", mailstore_basename);
2628 dataname = string_sprintf("%s.msg", mailstore_basename);
2629
2630 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2631 if (fd < 0 && /* failed to open, and */
2632 (errno != ENOENT || /* either not non-exist */
2633 !ob->create_directory || /* or not allowed to make */
2634 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2635 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2636 {
2637 addr->basic_errno = errno;
2638 addr->message = string_sprintf("while creating file %s", filename);
2639 return FALSE;
2640 }
2641
2642 /* Why are these here? Put in because they are present in the non-maildir
2643 directory case above. */
2644
2645 if(exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2646 {
2647 addr->basic_errno = errno;
2648 addr->message = string_sprintf("while setting perms on file %s",
2649 filename);
2650 return FALSE;
2651 }
2652
2653 /* Built a C stream from the open file descriptor. */
2654
2655 if ((env_file = fdopen(fd, "wb")) == NULL)
2656 {
2657 addr->basic_errno = errno;
2658 addr->transport_return = PANIC;
2659 addr->message = string_sprintf("fdopen of %s ("
2660 "for %s transport) failed", filename, tblock->name);
2661 (void)close(fd);
2662 Uunlink(filename);
2663 return FALSE;
2664 }
2665
2666 /* Write the envelope file, then close it. */
2667
2668 if (ob->mailstore_prefix != NULL)
2669 {
2670 uschar *s = expand_string(ob->mailstore_prefix);
2671 if (s == NULL)
2672 {
2673 if (!f.expand_string_forcedfail)
2674 {
2675 addr->transport_return = PANIC;
2676 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2677 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2678 tblock->name, expand_string_message);
2679 (void)fclose(env_file);
2680 Uunlink(filename);
2681 return FALSE;
2682 }
2683 }
2684 else
2685 {
2686 int n = Ustrlen(s);
2687 fprintf(env_file, "%s", CS s);
2688 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2689 }
2690 }
2691
2692 fprintf(env_file, "%s\n", sender_address);
2693
2694 for (address_item * taddr = addr; taddr; taddr = taddr->next)
2695 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2696
2697 if (ob->mailstore_suffix != NULL)
2698 {
2699 uschar *s = expand_string(ob->mailstore_suffix);
2700 if (s == NULL)
2701 {
2702 if (!f.expand_string_forcedfail)
2703 {
2704 addr->transport_return = PANIC;
2705 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2706 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2707 tblock->name, expand_string_message);
2708 (void)fclose(env_file);
2709 Uunlink(filename);
2710 return FALSE;
2711 }
2712 }
2713 else
2714 {
2715 int n = Ustrlen(s);
2716 fprintf(env_file, "%s", CS s);
2717 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2718 }
2719 }
2720
2721 if (fclose(env_file) != 0)
2722 {
2723 addr->basic_errno = errno;
2724 addr->message = string_sprintf("while closing %s", filename);
2725 Uunlink(filename);
2726 return FALSE;
2727 }
2728
2729 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2730
2731 /* Now open the data file, and ensure that it has the correct ownership and
2732 mode. */
2733
2734 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2735 if (fd < 0)
2736 {
2737 addr->basic_errno = errno;
2738 addr->message = string_sprintf("while creating file %s", dataname);
2739 Uunlink(filename);
2740 return FALSE;
2741 }
2742 if(exim_chown(dataname, uid, gid) || Uchmod(dataname, mode))
2743 {
2744 addr->basic_errno = errno;
2745 addr->message = string_sprintf("while setting perms on file %s",
2746 dataname);
2747 return FALSE;
2748 }
2749 }
2750
2751 #endif /* SUPPORT_MAILSTORE */
2752
2753
2754 /* In all cases of writing to a new file, ensure that the file which is
2755 going to be renamed has the correct ownership and mode. */
2756
2757 if(exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2758 {
2759 addr->basic_errno = errno;
2760 addr->message = string_sprintf("while setting perms on file %s",
2761 filename);
2762 return FALSE;
2763 }
2764 }
2765
2766
2767 /* At last we can write the message to the file, preceded by any configured
2768 prefix line, and followed by any configured suffix line. If there are any
2769 writing errors, we must defer. */
2770
2771 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2772
2773 yield = OK;
2774 errno = 0;
2775
2776 /* If there is a local quota setting, check that we are not going to exceed it
2777 with this message if quota_is_inclusive is set; if it is not set, the check
2778 is for the mailbox already being over quota (i.e. the current message is not
2779 included in the check). */
2780
2781 if (!disable_quota && ob->quota_value > 0)
2782 {
2783 DEBUG(D_transport)
2784 {
2785 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2786 " this message = %d (%sincluded)\n",
2787 ob->quota_value, mailbox_size, message_size,
2788 ob->quota_is_inclusive ? "" : "not ");
2789 debug_printf(" file count quota = %d count = %d\n",
2790 ob->quota_filecount_value, mailbox_filecount);
2791 }
2792
2793 if (mailbox_size + (ob->quota_is_inclusive ? message_size:0) > ob->quota_value)
2794 {
2795
2796 if (!ob->quota_no_check)
2797 {
2798 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2799 yield = DEFER;
2800 errno = ERRNO_EXIMQUOTA;
2801 }
2802 else DEBUG(D_transport) debug_printf("mailbox quota exceeded but ignored\n");
2803
2804 }
2805
2806 if (ob->quota_filecount_value > 0
2807 && mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2808 ob->quota_filecount_value)
2809 if(!ob->quota_filecount_no_check)
2810 {
2811 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2812 yield = DEFER;
2813 errno = ERRNO_EXIMQUOTA;
2814 filecount_msg = US" filecount";
2815 }
2816 else DEBUG(D_transport) if (ob->quota_filecount_no_check)
2817 debug_printf("mailbox file count quota exceeded but ignored\n");
2818
2819 }
2820
2821 /* If we are writing in MBX format, what we actually do is to write the message
2822 to a temporary file, and then copy it to the real file once we know its size.
2823 This is the most straightforward way of getting the correct length in the
2824 separator line. So, what we do here is to save the real file descriptor, and
2825 replace it with one for a temporary file. The temporary file gets unlinked once
2826 opened, so that it goes away on closure. */
2827
2828 #ifdef SUPPORT_MBX
2829 if (yield == OK && ob->mbx_format)
2830 {
2831 temp_file = tmpfile();
2832 if (temp_file == NULL)
2833 {
2834 addr->basic_errno = errno;
2835 addr->message = US"while setting up temporary file";
2836 yield = DEFER;
2837 goto RETURN;
2838 }
2839 save_fd = fd;
2840 fd = fileno(temp_file);
2841 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2842 }
2843 #endif /* SUPPORT_MBX */
2844
2845 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2846 functions. */
2847
2848 transport_count = 0;
2849 transport_newlines = 0;
2850
2851 /* Write any configured prefix text first */
2852
2853 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2854 {
2855 uschar *prefix = expand_string(ob->message_prefix);
2856 if (prefix == NULL)
2857 {
2858 errno = ERRNO_EXPANDFAIL;
2859 addr->transport_return = PANIC;
2860 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2861 "transport) failed", ob->message_prefix, tblock->name);
2862 yield = DEFER;
2863 }
2864 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2865 }
2866
2867 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2868 various different values for batching are handled outside; if there is more
2869 than one address available here, all must be included. If any address is a
2870 file, use its parent in the RCPT TO. */
2871
2872 if (yield == OK && ob->use_bsmtp)
2873 {
2874 transport_count = 0;
2875 transport_newlines = 0;
2876 if (ob->use_crlf) cr = US"\r";
2877 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2878 yield = DEFER;
2879 else
2880 {
2881 transport_newlines++;
2882 for (address_item * a = addr; a != NULL; a = a->next)
2883 {
2884 address_item *b = testflag(a, af_pfr) ? a->parent: a;
2885 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2886 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2887 { yield = DEFER; break; }
2888 transport_newlines++;
2889 }
2890 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2891 yield = DEFER;
2892 else
2893 transport_newlines++;
2894 }
2895 }
2896
2897 /* Now the message itself. The options for transport_write_message were set up
2898 at initialization time. */
2899
2900 if (yield == OK)
2901 {
2902 transport_ctx tctx = {
2903 .u = {.fd=fd},
2904 .tblock = tblock,
2905 .addr = addr,
2906 .check_string = ob->check_string,
2907 .escape_string = ob->escape_string,
2908 .options = ob->options | topt_not_socket
2909 };
2910 if (!transport_write_message(&tctx, 0))
2911 yield = DEFER;
2912 }
2913
2914 /* Now a configured suffix. */
2915
2916 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2917 {
2918 uschar *suffix = expand_string(ob->message_suffix);
2919 if (suffix == NULL)
2920 {
2921 errno = ERRNO_EXPANDFAIL;
2922 addr->transport_return = PANIC;
2923 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2924 "transport) failed", ob->message_suffix, tblock->name);
2925 yield = DEFER;
2926 }
2927 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2928 }
2929
2930 /* If batch smtp, write the terminating dot. */
2931
2932 if (yield == OK && ob->use_bsmtp ) {
2933 if(!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2934 else transport_newlines++;
2935 }
2936
2937 /* If MBX format is being used, all that writing was to the temporary file.
2938 However, if there was an earlier failure (Exim quota exceeded, for example),
2939 the temporary file won't have got opened - and no writing will have been done.
2940 If writing was OK, we restore the fd, and call a function that copies the
2941 message in MBX format into the real file. Otherwise use the temporary name in
2942 any messages. */
2943
2944 #ifdef SUPPORT_MBX
2945 if (temp_file != NULL && ob->mbx_format)
2946 {
2947 int mbx_save_errno;
2948 fd = save_fd;
2949
2950 if (yield == OK)
2951 {
2952 transport_count = 0; /* Reset transport count for actual write */
2953 /* No need to reset transport_newlines as we're just using a block copy
2954 * routine so the number won't be affected */
2955 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2956 }
2957 else if (errno >= 0) dataname = US"temporary file";
2958
2959 /* Preserve errno while closing the temporary file. */
2960
2961 mbx_save_errno = errno;
2962 (void)fclose(temp_file);
2963 errno = mbx_save_errno;
2964 }
2965 #endif /* SUPPORT_MBX */
2966
2967 /* Force out the remaining data to check for any errors; some OS don't allow
2968 fsync() to be called for a FIFO. */
2969
2970 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2971
2972 /* Update message_size and message_linecount to the accurate count of bytes
2973 written, including added headers. Note; we subtract 1 from message_linecount as
2974 this variable doesn't count the new line between the header and the body of the
2975 message. */
2976
2977 message_size = transport_count;
2978 message_linecount = transport_newlines - 1;
2979
2980 /* If using a maildir++ quota file, add this message's size to it, and
2981 close the file descriptor, except when the quota has been disabled because we
2982 are delivering into an uncounted folder. */
2983
2984 #ifdef SUPPORT_MAILDIR
2985 if (!disable_quota)
2986 {
2987 if (yield == OK && maildirsize_fd >= 0)
2988 maildir_record_length(maildirsize_fd, message_size);
2989 maildir_save_errno = errno; /* Preserve errno while closing the file */
2990 if (maildirsize_fd >= 0)
2991 (void)close(maildirsize_fd);
2992 errno = maildir_save_errno;
2993 }
2994 #endif /* SUPPORT_MAILDIR */
2995
2996 /* If there is a quota warning threshold and we are have crossed it with this
2997 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2998 to be sent. */
2999
3000 if (!disable_quota && THRESHOLD_CHECK)
3001 {
3002 off_t threshold = ob->quota_warn_threshold_value;
3003 if (ob->quota_warn_threshold_is_percent)
3004 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
3005 DEBUG(D_transport)
3006 debug_printf("quota = " OFF_T_FMT
3007 " threshold = " OFF_T_FMT
3008 " old size = " OFF_T_FMT
3009 " message size = %d\n",
3010 ob->quota_value, threshold, mailbox_size,
3011 message_size);
3012 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
3013 addr->special_action = SPECIAL_WARN;
3014
3015 /******* You might think that the test ought to be this:
3016 *
3017 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
3018 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
3019 *
3020 * (indeed, I was sent a patch with that in). However, it is possible to
3021 * have a warning threshold without actually imposing a quota, and I have
3022 * therefore kept Exim backwards compatible.
3023 ********/
3024
3025 }
3026
3027 /* Handle error while writing the file. Control should come here directly after
3028 the error, with the reason in errno. In the case of expansion failure in prefix
3029 or suffix, it will be ERRNO_EXPANDFAIL. */
3030
3031 if (yield != OK)
3032 {
3033 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
3034
3035 /* Save the error number. If positive, it will ultimately cause a strerror()
3036 call to generate some text. */
3037
3038 addr->basic_errno = errno;
3039
3040 /* For system or Exim quota excession, or disk full, set more_errno to the
3041 time since the file was last read. If delivery was into a directory, the
3042 time since last read logic is not relevant, in general. However, for maildir
3043 deliveries we can approximate it by looking at the last modified time of the
3044 "new" subdirectory. Since Exim won't be adding new messages, a change to the
3045 "new" subdirectory implies that an MUA has moved a message from there to the
3046 "cur" directory. */
3047
3048 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
3049 {
3050 addr->more_errno = 0;
3051 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
3052
3053 #ifdef SUPPORT_MAILDIR
3054 else if (mbformat == mbf_maildir)
3055 {
3056 struct stat statbuf;
3057 if (Ustat("new", &statbuf) < 0)
3058 {
3059 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
3060 "stat error %d for \"new\": %s\n", errno, strerror(errno));
3061 }
3062 else /* Want a repeatable time when in test harness */
3063 {
3064 addr->more_errno = f.running_in_test_harness ? 10 :
3065 (int)time(NULL) - statbuf.st_mtime;
3066 }
3067 DEBUG(D_transport)
3068 debug_printf("maildir: time since \"new\" directory modified = %s\n",
3069 readconf_printtime(addr->more_errno));
3070 }
3071 #endif /* SUPPORT_MAILDIR */
3072 }
3073
3074 /* Handle system quota excession. Add an explanatory phrase for the error
3075 message, since some systems don't have special quota-excession errors,
3076 and on those that do, "quota" doesn't always mean anything to the user. */
3077
3078 if (errno == errno_quota)
3079 {
3080 #ifndef EDQUOT
3081 addr->message = string_sprintf("mailbox is full "
3082 "(quota exceeded while writing to file %s)", filename);
3083 #else
3084 addr->message = US"mailbox is full";
3085 #endif /* EDQUOT */
3086 addr->user_message = US"mailbox is full";
3087 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3088 dataname,
3089 isdirectory ? US"" : US": time since file read = ",
3090 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3091 }
3092
3093 /* Handle Exim's own quota-imposition */
3094
3095 else if (errno == ERRNO_EXIMQUOTA)
3096 {
3097 addr->message = string_sprintf("mailbox is full "
3098 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3099 dataname);
3100 addr->user_message = US"mailbox is full";
3101 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3102 filecount_msg, dataname,
3103 isdirectory ? US"" : US": time since file read = ",
3104 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3105 }
3106
3107 /* Handle a process failure while writing via a filter; the return
3108 from child_close() is in more_errno. */
3109
3110 else if (errno == ERRNO_FILTER_FAIL)
3111 {
3112 yield = PANIC;
3113 addr->message = string_sprintf("transport filter process failed (%d) "
3114 "while writing to %s%s", addr->more_errno, dataname,
3115 (addr->more_errno == EX_EXECFAILED) ? ": unable to execute command" : "");
3116 }
3117
3118 /* Handle failure to expand header changes */
3119
3120 else if (errno == ERRNO_CHHEADER_FAIL)
3121 {
3122 yield = PANIC;
3123 addr->message =
3124 string_sprintf("failed to expand headers_add or headers_remove while "
3125 "writing to %s: %s", dataname, expand_string_message);
3126 }
3127
3128 /* Handle failure to complete writing of a data block */
3129
3130 else if (errno == ERRNO_WRITEINCOMPLETE)
3131 {
3132 addr->message = string_sprintf("failed to write data block while "
3133 "writing to %s", dataname);
3134 }
3135
3136 /* Handle length mismatch on MBX copying */
3137
3138 #ifdef SUPPORT_MBX
3139 else if (errno == ERRNO_MBXLENGTH)
3140 {
3141 addr->message = string_sprintf("length mismatch while copying MBX "
3142 "temporary file to %s", dataname);
3143 }
3144 #endif /* SUPPORT_MBX */
3145
3146 /* For other errors, a general-purpose explanation, if the message is
3147 not already set. */
3148
3149 else if (addr->message == NULL)
3150 addr->message = string_sprintf("error while writing to %s", dataname);
3151
3152 /* For a file, reset the file size to what it was before we started, leaving
3153 the last modification time unchanged, so it will get reset also. All systems
3154 investigated so far have ftruncate(), whereas not all have the F_FREESP
3155 fcntl() call (BSDI & FreeBSD do not). */
3156
3157 if (!isdirectory && ftruncate(fd, saved_size))
3158 DEBUG(D_transport) debug_printf("Error resetting file size\n");
3159 }
3160
3161 /* Handle successful writing - we want the modification time to be now for
3162 appended files. Remove the default backstop error number. For a directory, now
3163 is the time to rename the file with a unique name. As soon as such a name
3164 appears it may get used by another process, so we close the file first and
3165 check that all is well. */
3166
3167 else
3168 {
3169 times.modtime = time(NULL);
3170 addr->basic_errno = 0;
3171
3172 /* Handle the case of writing to a new file in a directory. This applies
3173 to all single-file formats - maildir, mailstore, and "smail format". */
3174
3175 if (isdirectory)
3176 {
3177 if (fstat(fd, &statbuf) < 0)
3178 {
3179 addr->basic_errno = errno;
3180 addr->message = string_sprintf("while fstatting opened message file %s",
3181 filename);
3182 yield = DEFER;
3183 }
3184
3185 else if (close(fd) < 0)
3186 {
3187 addr->basic_errno = errno;
3188 addr->message = string_sprintf("close() error for %s",
3189 (ob->mailstore_format) ? dataname : filename);
3190 yield = DEFER;
3191 }
3192
3193 /* File is successfully written and closed. Arrange to rename it. For the
3194 different kinds of single-file delivery, some games can be played with the
3195 name. The message size is by this time set to the accurate value so that
3196 its value can be used in expansions. */
3197
3198 else
3199 {
3200 uschar *renamename = newname;
3201 fd = -1;
3202
3203 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3204
3205 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3206 situation. The name is built by expanding the directory_file option, and
3207 we make the inode number available for use in this. The expansion was
3208 checked for syntactic validity above, before we wrote the file.
3209
3210 We have to be careful here, in case the file name exists. (In the other
3211 cases, the names used are constructed to be unique.) The rename()
3212 function just replaces an existing file - we don't want that! So instead
3213 of calling rename(), we must use link() and unlink().
3214
3215 In this case, if the link fails because of an existing file, we wait
3216 for one second and try the expansion again, to see if it produces a
3217 different value. Do this up to 5 times unless the name stops changing.
3218 This makes it possible to build values that are based on the time, and
3219 still cope with races from multiple simultaneous deliveries. */
3220
3221 if (newname == NULL)
3222 {
3223 uschar *renameleaf;
3224 uschar *old_renameleaf = US"";
3225
3226 for (int i = 0; ; sleep(1), i++)
3227 {
3228 deliver_inode = statbuf.st_ino;
3229 renameleaf = expand_string(ob->dirfilename);
3230 deliver_inode = 0;</