1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
10 #include "appendfile.h"
12 #ifdef SUPPORT_MAILDIR
13 #include "tf_maildir.h"
17 /* Options specific to the appendfile transport. They must be in alphabetic
18 order (note that "_" comes before the lower case letters). Some of them are
19 stored in the publicly visible instance block - these are flagged with the
22 optionlist appendfile_transport_options
[] = {
23 #ifdef SUPPORT_MAILDIR
24 { "*expand_maildir_use_size_file", opt_stringptr
,
25 (void *)offsetof(appendfile_transport_options_block
, expand_maildir_use_size_file
) },
27 { "*set_use_fcntl_lock",opt_bool
| opt_hidden
,
28 (void *)offsetof(appendfile_transport_options_block
, set_use_fcntl
) },
29 { "*set_use_flock_lock",opt_bool
| opt_hidden
,
30 (void *)offsetof(appendfile_transport_options_block
, set_use_flock
) },
31 { "*set_use_lockfile", opt_bool
| opt_hidden
,
32 (void *)offsetof(appendfile_transport_options_block
, set_use_lockfile
) },
34 { "*set_use_mbx_lock", opt_bool
| opt_hidden
,
35 (void *)offsetof(appendfile_transport_options_block
, set_use_mbx_lock
) },
37 { "allow_fifo", opt_bool
,
38 (void *)offsetof(appendfile_transport_options_block
, allow_fifo
) },
39 { "allow_symlink", opt_bool
,
40 (void *)offsetof(appendfile_transport_options_block
, allow_symlink
) },
41 { "batch_id", opt_stringptr
| opt_public
,
42 (void *)offsetof(transport_instance
, batch_id
) },
43 { "batch_max", opt_int
| opt_public
,
44 (void *)offsetof(transport_instance
, batch_max
) },
45 { "check_group", opt_bool
,
46 (void *)offsetof(appendfile_transport_options_block
, check_group
) },
47 { "check_owner", opt_bool
,
48 (void *)offsetof(appendfile_transport_options_block
, check_owner
) },
49 { "check_string", opt_stringptr
,
50 (void *)offsetof(appendfile_transport_options_block
, check_string
) },
51 { "create_directory", opt_bool
,
52 (void *)offsetof(appendfile_transport_options_block
, create_directory
) },
53 { "create_file", opt_stringptr
,
54 (void *)offsetof(appendfile_transport_options_block
, create_file_string
) },
55 { "directory", opt_stringptr
,
56 (void *)offsetof(appendfile_transport_options_block
, dirname
) },
57 { "directory_file", opt_stringptr
,
58 (void *)offsetof(appendfile_transport_options_block
, dirfilename
) },
59 { "directory_mode", opt_octint
,
60 (void *)offsetof(appendfile_transport_options_block
, dirmode
) },
61 { "escape_string", opt_stringptr
,
62 (void *)offsetof(appendfile_transport_options_block
, escape_string
) },
63 { "file", opt_stringptr
,
64 (void *)offsetof(appendfile_transport_options_block
, filename
) },
65 { "file_format", opt_stringptr
,
66 (void *)offsetof(appendfile_transport_options_block
, file_format
) },
67 { "file_must_exist", opt_bool
,
68 (void *)offsetof(appendfile_transport_options_block
, file_must_exist
) },
69 { "lock_fcntl_timeout", opt_time
,
70 (void *)offsetof(appendfile_transport_options_block
, lock_fcntl_timeout
) },
71 { "lock_flock_timeout", opt_time
,
72 (void *)offsetof(appendfile_transport_options_block
, lock_flock_timeout
) },
73 { "lock_interval", opt_time
,
74 (void *)offsetof(appendfile_transport_options_block
, lock_interval
) },
75 { "lock_retries", opt_int
,
76 (void *)offsetof(appendfile_transport_options_block
, lock_retries
) },
77 { "lockfile_mode", opt_octint
,
78 (void *)offsetof(appendfile_transport_options_block
, lockfile_mode
) },
79 { "lockfile_timeout", opt_time
,
80 (void *)offsetof(appendfile_transport_options_block
, lockfile_timeout
) },
81 { "mailbox_filecount", opt_stringptr
,
82 (void *)offsetof(appendfile_transport_options_block
, mailbox_filecount_string
) },
83 { "mailbox_size", opt_stringptr
,
84 (void *)offsetof(appendfile_transport_options_block
, mailbox_size_string
) },
85 #ifdef SUPPORT_MAILDIR
86 { "maildir_format", opt_bool
,
87 (void *)offsetof(appendfile_transport_options_block
, maildir_format
) } ,
88 { "maildir_quota_directory_regex", opt_stringptr
,
89 (void *)offsetof(appendfile_transport_options_block
, maildir_dir_regex
) },
90 { "maildir_retries", opt_int
,
91 (void *)offsetof(appendfile_transport_options_block
, maildir_retries
) },
92 { "maildir_tag", opt_stringptr
,
93 (void *)offsetof(appendfile_transport_options_block
, maildir_tag
) },
94 { "maildir_use_size_file", opt_expand_bool
,
95 (void *)offsetof(appendfile_transport_options_block
, maildir_use_size_file
) } ,
96 { "maildirfolder_create_regex", opt_stringptr
,
97 (void *)offsetof(appendfile_transport_options_block
, maildirfolder_create_regex
) },
98 #endif /* SUPPORT_MAILDIR */
99 #ifdef SUPPORT_MAILSTORE
100 { "mailstore_format", opt_bool
,
101 (void *)offsetof(appendfile_transport_options_block
, mailstore_format
) },
102 { "mailstore_prefix", opt_stringptr
,
103 (void *)offsetof(appendfile_transport_options_block
, mailstore_prefix
) },
104 { "mailstore_suffix", opt_stringptr
,
105 (void *)offsetof(appendfile_transport_options_block
, mailstore_suffix
) },
106 #endif /* SUPPORT_MAILSTORE */
108 { "mbx_format", opt_bool
,
109 (void *)offsetof(appendfile_transport_options_block
, mbx_format
) } ,
110 #endif /* SUPPORT_MBX */
111 { "message_prefix", opt_stringptr
,
112 (void *)offsetof(appendfile_transport_options_block
, message_prefix
) },
113 { "message_suffix", opt_stringptr
,
114 (void *)offsetof(appendfile_transport_options_block
, message_suffix
) },
115 { "mode", opt_octint
,
116 (void *)offsetof(appendfile_transport_options_block
, mode
) },
117 { "mode_fail_narrower",opt_bool
,
118 (void *)offsetof(appendfile_transport_options_block
, mode_fail_narrower
) },
119 { "notify_comsat", opt_bool
,
120 (void *)offsetof(appendfile_transport_options_block
, notify_comsat
) },
121 { "quota", opt_stringptr
,
122 (void *)offsetof(appendfile_transport_options_block
, quota
) },
123 { "quota_directory", opt_stringptr
,
124 (void *)offsetof(appendfile_transport_options_block
, quota_directory
) },
125 { "quota_filecount", opt_stringptr
,
126 (void *)offsetof(appendfile_transport_options_block
, quota_filecount
) },
127 { "quota_is_inclusive", opt_bool
,
128 (void *)offsetof(appendfile_transport_options_block
, quota_is_inclusive
) },
129 { "quota_size_regex", opt_stringptr
,
130 (void *)offsetof(appendfile_transport_options_block
, quota_size_regex
) },
131 { "quota_warn_message", opt_stringptr
| opt_public
,
132 (void *)offsetof(transport_instance
, warn_message
) },
133 { "quota_warn_threshold", opt_stringptr
,
134 (void *)offsetof(appendfile_transport_options_block
, quota_warn_threshold
) },
135 { "use_bsmtp", opt_bool
,
136 (void *)offsetof(appendfile_transport_options_block
, use_bsmtp
) },
137 { "use_crlf", opt_bool
,
138 (void *)offsetof(appendfile_transport_options_block
, use_crlf
) },
139 { "use_fcntl_lock", opt_bool_set
,
140 (void *)offsetof(appendfile_transport_options_block
, use_fcntl
) },
141 { "use_flock_lock", opt_bool_set
,
142 (void *)offsetof(appendfile_transport_options_block
, use_flock
) },
143 { "use_lockfile", opt_bool_set
,
144 (void *)offsetof(appendfile_transport_options_block
, use_lockfile
) },
146 { "use_mbx_lock", opt_bool_set
,
147 (void *)offsetof(appendfile_transport_options_block
, use_mbx_lock
) },
148 #endif /* SUPPORT_MBX */
151 /* Size of the options list. An extern variable has to be used so that its
152 address can appear in the tables drtables.c. */
154 int appendfile_transport_options_count
=
155 sizeof(appendfile_transport_options
)/sizeof(optionlist
);
161 appendfile_transport_options_block appendfile_transport_option_defaults
= {0};
162 void appendfile_transport_init(transport_instance
*tblock
) {}
163 BOOL
appendfile_transport_entry(transport_instance
*tblock
, address_item
*addr
) {return FALSE
;}
165 #else /*!MACRO_PREDEF*/
167 /* Default private options block for the appendfile transport. */
169 appendfile_transport_options_block appendfile_transport_option_defaults
= {
172 US
"q${base62:$tod_epoch}-$inode", /* dirfilename */
173 NULL
, /* message_prefix (default reset in init if not bsmtp) */
174 NULL
, /* message_suffix (ditto) */
175 US
"anywhere", /* create_file_string (string value for create_file) */
177 NULL
, /* quota_directory */
178 NULL
, /* quota_filecount */
179 NULL
, /* quota_size_regex */
180 NULL
, /* quota_warn_threshold */
181 NULL
, /* mailbox_size_string */
182 NULL
, /* mailbox_filecount_string */
183 NULL
, /* expand_maildir_use_size_file */
184 US
"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
185 NULL
, /* maildir_tag */
186 NULL
, /* maildirfolder_create_regex */
187 NULL
, /* mailstore_prefix */
188 NULL
, /* mailstore_suffix */
189 NULL
, /* check_string (default changed for non-bsmtp file)*/
190 NULL
, /* escape_string (ditto) */
191 NULL
, /* file_format */
193 0, /* quota_warn_threshold_value */
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
196 0, /* quota_filecount_value */
197 APPENDFILE_MODE
, /* mode */
198 APPENDFILE_DIRECTORY_MODE
, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE
, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere
,/* create_file */
208 FALSE
, /* allow_fifo */
209 FALSE
, /* allow_symlink */
210 FALSE
, /* check_group */
211 TRUE
, /* check_owner */
212 TRUE
, /* create_directory */
213 FALSE
, /* notify_comsat */
214 TRUE
, /* use_lockfile */
215 FALSE
, /* set_use_lockfile */
216 TRUE
, /* use_fcntl */
217 FALSE
, /* set_use_fcntl */
218 FALSE
, /* use_flock */
219 FALSE
, /* set_use_flock */
220 FALSE
, /* use_mbx_lock */
221 FALSE
, /* set_use_mbx_lock */
222 FALSE
, /* use_bsmtp */
223 FALSE
, /* use_crlf */
224 FALSE
, /* file_must_exist */
225 TRUE
, /* mode_fail_narrower */
226 FALSE
, /* maildir_format */
227 FALSE
, /* maildir_use_size_file */
228 FALSE
, /* mailstore_format */
229 FALSE
, /* mbx_format */
230 FALSE
, /* quota_warn_threshold_is_percent */
231 TRUE
, /* quota_is_inclusive */
232 FALSE
, /* quota_no_check */
233 FALSE
/* quota_filecount_no_check */
237 /* Encodings for mailbox formats, and their names. MBX format is actually
238 supported only if SUPPORT_MBX is set. */
240 enum { mbf_unix
, mbf_mbx
, mbf_smail
, mbf_maildir
, mbf_mailstore
};
242 static const char *mailbox_formats
[] = {
243 "unix", "mbx", "smail", "maildir", "mailstore" };
246 /* Check warn threshold only if quota size set or not a percentage threshold
247 percentage check should only be done if quota > 0 */
249 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
250 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
254 /*************************************************
255 * Setup entry point *
256 *************************************************/
258 /* Called for each delivery in the privileged state, just before the uid/gid
259 are changed and the main entry point is called. We use this function to
260 expand any quota settings, so that it can access files that may not be readable
261 by the user. It is also used to pick up external mailbox size information, if
265 tblock points to the transport instance
266 addrlist addresses about to be delivered (not used)
267 dummy not used (doesn't pass back data)
268 uid the uid that will be set (not used)
269 gid the gid that will be set (not used)
270 errmsg where to put an error message
272 Returns: OK, FAIL, or DEFER
276 appendfile_transport_setup(transport_instance
*tblock
, address_item
*addrlist
,
277 transport_feedback
*dummy
, uid_t uid
, gid_t gid
, uschar
**errmsg
)
279 appendfile_transport_options_block
*ob
=
280 (appendfile_transport_options_block
*)(tblock
->options_block
);
281 uschar
*q
= ob
->quota
;
282 double default_value
= 0.0;
284 addrlist
= addrlist
; /* Keep picky compilers happy */
289 if (ob
->expand_maildir_use_size_file
)
290 ob
->maildir_use_size_file
= expand_check_condition(ob
->expand_maildir_use_size_file
,
291 US
"`maildir_use_size_file` in transport", tblock
->name
);
293 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
296 for (int i
= 0; i
< 5; i
++)
300 uschar
*which
= NULL
;
302 if (q
== NULL
) d
= default_value
;
306 uschar
*s
= expand_string(q
);
310 *errmsg
= string_sprintf("Expansion of \"%s\" in %s transport failed: "
311 "%s", q
, tblock
->name
, expand_string_message
);
312 return f
.search_find_defer
? DEFER
: FAIL
;
315 d
= Ustrtod(s
, &rest
);
317 /* Handle following characters K, M, G, %, the latter being permitted
318 for quota_warn_threshold only. A threshold with no quota setting is
321 if (tolower(*rest
) == 'k') { d
*= 1024.0; rest
++; }
322 else if (tolower(*rest
) == 'm') { d
*= 1024.0*1024.0; rest
++; }
323 else if (tolower(*rest
) == 'g') { d
*= 1024.0*1024.0*1024.0; rest
++; }
324 else if (*rest
== '%' && i
== 2)
326 if (ob
->quota_value
<= 0 && !ob
->maildir_use_size_file
)
328 else if ((int)d
< 0 || (int)d
> 100)
330 *errmsg
= string_sprintf("Invalid quota_warn_threshold percentage (%d)"
331 " for %s transport", (int)d
, tblock
->name
);
334 ob
->quota_warn_threshold_is_percent
= TRUE
;
339 /* For quota and quota_filecount there may be options
340 appended. Currently only "no_check", so we can be lazy parsing it */
341 if (i
< 2 && Ustrstr(rest
, "/no_check") == rest
)
344 rest
+= sizeof("/no_check") - 1;
347 while (isspace(*rest
)) rest
++;
351 *errmsg
= string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
352 "in %s transport", s
, q
, tblock
->name
);
357 /* Set each value, checking for possible overflow. */
362 if (d
>= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t
) <= 4)
364 ob
->quota_value
= (off_t
)d
;
365 ob
->quota_no_check
= no_check
;
366 q
= ob
->quota_filecount
;
370 if (d
>= 2.0*1024.0*1024.0*1024.0)
371 which
= US
"quota_filecount";
372 ob
->quota_filecount_value
= (int)d
;
373 ob
->quota_filecount_no_check
= no_check
;
374 q
= ob
->quota_warn_threshold
;
378 if (d
>= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t
) <= 4)
379 which
= US
"quota_warn_threshold";
380 ob
->quota_warn_threshold_value
= (off_t
)d
;
381 q
= ob
->mailbox_size_string
;
382 default_value
= -1.0;
386 if (d
>= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t
) <= 4)
387 which
= US
"mailbox_size";;
388 ob
->mailbox_size_value
= (off_t
)d
;
389 q
= ob
->mailbox_filecount_string
;
393 if (d
>= 2.0*1024.0*1024.0*1024.0)
394 which
= US
"mailbox_filecount";
395 ob
->mailbox_filecount_value
= (int)d
;
401 *errmsg
= string_sprintf("%s value %.10g is too large (overflow) in "
402 "%s transport", which
, d
, tblock
->name
);
412 /*************************************************
413 * Initialization entry point *
414 *************************************************/
416 /* Called for each instance, after its options have been read, to
417 enable consistency checks to be done, or anything else that needs
421 appendfile_transport_init(transport_instance
*tblock
)
423 appendfile_transport_options_block
*ob
=
424 (appendfile_transport_options_block
*)(tblock
->options_block
);
426 /* Set up the setup entry point, to be called in the privileged state */
428 tblock
->setup
= appendfile_transport_setup
;
430 /* Lock_retries must be greater than zero */
432 if (ob
->lock_retries
== 0) ob
->lock_retries
= 1;
434 /* Only one of a file name or directory name must be given. */
436 if (ob
->filename
!= NULL
&& ob
->dirname
!= NULL
)
437 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s transport:\n "
438 "only one of \"file\" or \"directory\" can be specified", tblock
->name
);
440 /* If a file name was specified, neither quota_filecount nor quota_directory
443 if (ob
->filename
!= NULL
)
445 if (ob
->quota_filecount
!= NULL
)
446 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s transport:\n "
447 "quota_filecount must not be set without \"directory\"", tblock
->name
);
448 if (ob
->quota_directory
!= NULL
)
449 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s transport:\n "
450 "quota_directory must not be set without \"directory\"", tblock
->name
);
453 /* The default locking depends on whether MBX is set or not. Change the
454 built-in default if none of the lock options has been explicitly set. At least
455 one form of locking is required in all cases, but mbx locking changes the
456 meaning of fcntl and flock locking. */
458 /* Not all operating systems provide flock(). For those that do, if flock is
459 requested, the default for fcntl is FALSE. */
464 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s transport:\n "
465 "flock() support was not available in the operating system when this "
466 "binary was built", tblock
->name
);
467 #endif /* NO_FLOCK */
468 if (!ob
->set_use_fcntl
) ob
->use_fcntl
= FALSE
;
474 if (!ob
->set_use_lockfile
&& !ob
->set_use_fcntl
&& !ob
->set_use_flock
&&
475 !ob
->set_use_mbx_lock
)
477 ob
->use_lockfile
= ob
->use_flock
= FALSE
;
478 ob
->use_mbx_lock
= ob
->use_fcntl
= TRUE
;
480 else if (ob
->use_mbx_lock
)
482 if (!ob
->set_use_lockfile
) ob
->use_lockfile
= FALSE
;
483 if (!ob
->set_use_fcntl
) ob
->use_fcntl
= FALSE
;
484 if (!ob
->set_use_flock
) ob
->use_flock
= FALSE
;
485 if (!ob
->use_fcntl
&& !ob
->use_flock
) ob
->use_fcntl
= TRUE
;
488 #endif /* SUPPORT_MBX */
490 if (!ob
->use_fcntl
&& !ob
->use_flock
&& !ob
->use_lockfile
&& !ob
->use_mbx_lock
)
491 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s transport:\n "
492 "no locking configured", tblock
->name
);
494 /* Unset timeouts for non-used locking types */
496 if (!ob
->use_fcntl
) ob
->lock_fcntl_timeout
= 0;
497 if (!ob
->use_flock
) ob
->lock_flock_timeout
= 0;
499 /* If a directory name was specified, only one of maildir or mailstore may be
500 specified, and if quota_filecount or quota_directory is given, quota must
503 if (ob
->dirname
!= NULL
)
505 if (ob
->maildir_format
&& ob
->mailstore_format
)
506 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s transport:\n "
507 "only one of maildir and mailstore may be specified", tblock
->name
);
508 if (ob
->quota_filecount
!= NULL
&& ob
->quota
== NULL
)
509 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s transport:\n "
510 "quota must be set if quota_filecount is set", tblock
->name
);
511 if (ob
->quota_directory
!= NULL
&& ob
->quota
== NULL
)
512 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG_FOR
, "%s transport:\n "
513 "quota must be set if quota_directory is set", tblock
->name
);
516 /* If a fixed uid field is set, then a gid field must also be set. */
518 if (tblock
->uid_set
&& !tblock
->gid_set
&& tblock
->expand_gid
== NULL
)
519 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG
,
520 "user set without group for the %s transport", tblock
->name
);
522 /* If "create_file" is set, check that a valid option is given, and set the
525 if (ob
->create_file_string
!= NULL
)
528 if (Ustrcmp(ob
->create_file_string
, "anywhere") == 0) value
= create_anywhere
;
529 else if (Ustrcmp(ob
->create_file_string
, "belowhome") == 0) value
=
531 else if (Ustrcmp(ob
->create_file_string
, "inhome") == 0)
532 value
= create_inhome
;
534 log_write(0, LOG_PANIC_DIE
|LOG_CONFIG
,
535 "invalid value given for \"file_create\" for the %s transport: %s",
536 tblock
->name
, ob
->create_file_string
);
537 ob
->create_file
= value
;
540 /* If quota_warn_threshold is set, set up default for warn_message. It may
541 not be used if the actual threshold for a given delivery ends up as zero,
542 of if it's given as a percentage and there's no quota setting. */
544 if (ob
->quota_warn_threshold
!= NULL
)
546 if (tblock
->warn_message
== NULL
) tblock
->warn_message
= US
547 "To: $local_part@$domain\n"
548 "Subject: Your mailbox\n\n"
549 "This message is automatically created by mail delivery software (Exim).\n\n"
550 "The size of your mailbox has exceeded a warning threshold that is\n"
551 "set by the system administrator.\n";
554 /* If batch SMTP is set, force the check and escape strings, and arrange that
555 headers are also escaped. */
559 ob
->check_string
= US
".";
560 ob
->escape_string
= US
"..";
561 ob
->options
|= topt_escape_headers
;
564 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
565 insert default values for for the affixes and the check/escape strings. */
567 else if (ob
->dirname
== NULL
&& !ob
->maildir_format
&& !ob
->mailstore_format
)
569 if (ob
->message_prefix
== NULL
) ob
->message_prefix
=
570 US
"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
571 if (ob
->message_suffix
== NULL
) ob
->message_suffix
= US
"\n";
572 if (ob
->check_string
== NULL
) ob
->check_string
= US
"From ";
573 if (ob
->escape_string
== NULL
) ob
->escape_string
= US
">From ";
577 /* Set up the bitwise options for transport_write_message from the various
578 driver options. Only one of body_only and headers_only can be set. */
581 (tblock
->body_only
? topt_no_headers
: 0) |
582 (tblock
->headers_only
? topt_no_body
: 0) |
583 (tblock
->return_path_add
? topt_add_return_path
: 0) |
584 (tblock
->delivery_date_add
? topt_add_delivery_date
: 0) |
585 (tblock
->envelope_to_add
? topt_add_envelope_to
: 0) |
586 ((ob
->use_crlf
|| ob
->mbx_format
) ? topt_use_crlf
: 0);
591 /*************************************************
593 *************************************************/
595 /* The comsat daemon is the thing that provides asynchronous notification of
596 the arrival of local messages, if requested by the user by "biff y". It is a
597 BSD thing that uses a TCP/IP protocol for communication. A message consisting
598 of the text "user@offset" must be sent, where offset is the place in the
599 mailbox where new mail starts. There is no scope for telling it which file to
600 look at, which makes it a less than useful if mail is being delivered into a
601 non-standard place such as the user's home directory. In fact, it doesn't seem
602 to pay much attention to the offset.
606 offset offset in mailbox
612 notify_comsat(uschar
*user
, off_t offset
)
618 DEBUG(D_transport
) debug_printf("notify_comsat called\n");
620 s
= string_sprintf("%.200s@" OFF_T_FMT
"\n", user
, offset
);
622 if ((sp
= getservbyname("biff", "udp")) == NULL
)
624 DEBUG(D_transport
) debug_printf("biff/udp is an unknown service");
628 host
.name
= US
"localhost";
632 /* This code is all set up to look up "localhost" and use all its addresses
633 until one succeeds. However, it appears that at least on some systems, comsat
634 doesn't listen on the ::1 address. So for the moment, just force the address to
635 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
636 can be changed. (But actually, comsat is probably dying out anyway.) */
639 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
641 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
646 host
.address
= US
"127.0.0.1";
649 for (host_item
* h
= &host
; h
; h
= h
->next
)
652 int host_af
= Ustrchr(h
->address
, ':') != NULL
? AF_INET6
: AF_INET
;
654 DEBUG(D_transport
) debug_printf("calling comsat on %s\n", h
->address
);
656 if ((sock
= ip_socket(SOCK_DGRAM
, host_af
)) < 0) continue;
658 /* Connect never fails for a UDP socket, so don't set a timeout. */
660 (void)ip_connect(sock
, host_af
, h
->address
, ntohs(sp
->s_port
), 0, NULL
);
661 rc
= send(sock
, s
, Ustrlen(s
) + 1, 0);
666 debug_printf("send to comsat failed for %s: %s\n", strerror(errno
),
673 /*************************************************
674 * Check the format of a file *
675 *************************************************/
677 /* This function is called when file_format is set, to check that an existing
678 file has the right format. The format string contains text/transport pairs. The
679 string matching is literal. we just read big_buffer_size bytes, because this is
680 all about the first few bytes of a file.
684 tblock the transport block
685 addr the address block - for inserting error data
687 Returns: pointer to the required transport, or NULL
691 check_file_format(int cfd
, transport_instance
*tblock
, address_item
*addr
)
693 const uschar
*format
=
694 ((appendfile_transport_options_block
*)(tblock
->options_block
))->file_format
;
696 int len
= read(cfd
, data
, sizeof(data
));
700 DEBUG(D_transport
) debug_printf("checking file format\n");
702 /* An empty file matches the current transport */
704 if (len
== 0) return tblock
;
706 /* Search the formats for a match */
708 while ((s
= string_nextinlist(&format
,&sep
,big_buffer
,big_buffer_size
)))
710 int slen
= Ustrlen(s
);
711 BOOL match
= len
>= slen
&& Ustrncmp(data
, s
, slen
) == 0;
712 uschar
*tp
= string_nextinlist(&format
, &sep
, big_buffer
, big_buffer_size
);
716 for (transport_instance
* tt
= transports
; tt
; tt
= tt
->next
)
717 if (Ustrcmp(tp
, tt
->name
) == 0)
720 debug_printf("file format -> %s transport\n", tt
->name
);
723 addr
->basic_errno
= ERRNO_BADTRANSPORT
;
724 addr
->message
= string_sprintf("%s transport (for %.*s format) not found",
730 /* Failed to find a match */
732 addr
->basic_errno
= ERRNO_FORMATUNKNOWN
;
733 addr
->message
= US
"mailbox file format unrecognized";
740 /*************************************************
741 * Check directory's files for quota *
742 *************************************************/
744 /* This function is called if quota is set for one of the delivery modes that
745 delivers into a specific directory. It scans the directory and stats all the
746 files in order to get a total size and count. This is an expensive thing to do,
747 but some people are prepared to bear the cost. Alternatively, if size_regex is
748 set, it is used as a regex to try to extract the size from the file name, a
749 strategy that some people use on maildir files on systems where the users have
752 The function is global, because it is also called from tf_maildir.c for maildir
753 folders (which should contain only regular files).
755 Note: Any problems can be written to debugging output, but cannot be written to
756 the log, because we are running as an unprivileged user here.
759 dirname the name of the directory
760 countptr where to add the file count (because this function recurses)
761 regex a compiled regex to get the size from a name
763 Returns: the sum of the sizes of the stattable files
764 zero if the directory cannot be opened
768 check_dir_size(const uschar
* dirname
, int *countptr
, const pcre
*regex
)
772 int count
= *countptr
;
776 dir
= opendir(CS dirname
);
777 if (dir
== NULL
) return 0;
779 while ((ent
= readdir(dir
)) != NULL
)
781 uschar
* path
, * name
= US ent
->d_name
;
783 if (Ustrcmp(name
, ".") == 0 || Ustrcmp(name
, "..") == 0) continue;
787 /* If there's a regex, try to find the size using it */
792 if (pcre_exec(regex
, NULL
, CS name
, Ustrlen(name
), 0, 0, ovector
,6) >= 2)
795 off_t size
= (off_t
)Ustrtod(name
+ ovector
[2], &endptr
);
796 if (endptr
== name
+ ovector
[3])
800 debug_printf("check_dir_size: size from %s is " OFF_T_FMT
"\n", name
,
806 debug_printf("check_dir_size: regex did not match %s\n", name
);
809 /* No regex or no match for the regex, or captured non-digits */
811 path
= string_sprintf("%s/%s", dirname
, name
);
813 if (Ustat(path
, &statbuf
) < 0)
816 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno
, path
,
821 if ((statbuf
.st_mode
& S_IFMT
) == S_IFREG
)
822 sum
+= statbuf
.st_size
;
823 else if ((statbuf
.st_mode
& S_IFMT
) == S_IFDIR
)
824 sum
+= check_dir_size(path
, &count
, regex
);
829 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT
" count=%d\n", dirname
,
839 /*************************************************
840 * Apply a lock to a file descriptor *
841 *************************************************/
843 /* This function applies a lock to a file descriptor, using a blocking or
844 non-blocking lock, depending on the timeout value. It can apply either or
845 both of a fcntl() and a flock() lock. However, not all OS support flock();
846 for those that don't, the use_flock option cannot be set.
849 fd the file descriptor
850 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
851 fcntl() format); the flock() type is deduced if needed
852 dofcntl do fcntl() locking
853 fcntltime non-zero to use blocking fcntl()
854 doflock do flock() locking
855 flocktime non-zero to use blocking flock()
857 Returns: yield of the fcntl() or flock() call, with errno preserved;
858 sigalrm_seen set if there has been a timeout
862 apply_lock(int fd
, int fcntltype
, BOOL dofcntl
, int fcntltime
, BOOL doflock
,
867 struct flock lock_data
;
868 lock_data
.l_type
= fcntltype
;
869 lock_data
.l_whence
= lock_data
.l_start
= lock_data
.l_len
= 0;
871 sigalrm_seen
= FALSE
;
878 yield
= fcntl(fd
, F_SETLKW
, &lock_data
);
883 else yield
= fcntl(fd
, F_SETLK
, &lock_data
);
887 if (doflock
&& (yield
>= 0))
889 int flocktype
= (fcntltype
== F_WRLCK
) ? LOCK_EX
: LOCK_SH
;
893 yield
= flock(fd
, flocktype
);
898 else yield
= flock(fd
, flocktype
| LOCK_NB
);
900 #endif /* NO_FLOCK */
909 /*************************************************
910 * Copy message into MBX mailbox *
911 *************************************************/
913 /* This function is called when a message intended for a MBX mailbox has been
914 written to a temporary file. We can now get the size of the message and then
915 copy it in MBX format to the mailbox.
918 to_fd fd to write to (the real mailbox)
919 from_fd fd to read from (the temporary file)
920 saved_size current size of mailbox
922 Returns: OK if all went well, DEFER otherwise, with errno preserved
923 the number of bytes written are added to transport_count
924 by virtue of calling transport_write_block()
927 /* Values taken from c-client */
929 #define MBX_HDRSIZE 2048
930 #define MBX_NUSERFLAGS 30
933 copy_mbx_message(int to_fd
, int from_fd
, off_t saved_size
)
938 transport_ctx tctx
= { .u
={.fd
= to_fd
}, .options
= topt_not_socket
};
940 /* If the current mailbox size is zero, write a header block */
945 memset (deliver_out_buffer
, '\0', MBX_HDRSIZE
);
946 sprintf(CS(s
= deliver_out_buffer
), "*mbx*\015\012%08lx00000000\015\012",
947 (long int)time(NULL
));
948 for (int i
= 0; i
< MBX_NUSERFLAGS
; i
++)
949 sprintf (CS(s
+= Ustrlen(s
)), "\015\012");
950 if (!transport_write_block (&tctx
, deliver_out_buffer
, MBX_HDRSIZE
, FALSE
))
954 DEBUG(D_transport
) debug_printf("copying MBX message from temporary file\n");
956 /* Now construct the message's header from the time and the RFC822 file
957 size, including CRLFs, which is the size of the input (temporary) file. */
959 if (fstat(from_fd
, &statbuf
) < 0) return DEFER
;
960 size
= statbuf
.st_size
;
962 sprintf (CS deliver_out_buffer
, "%s," OFF_T_FMT
";%08lx%04x-%08x\015\012",
963 tod_stamp(tod_mbx
), size
, 0L, 0, 0);
964 used
= Ustrlen(deliver_out_buffer
);
966 /* Rewind the temporary file, and copy it over in chunks. */
968 if (lseek(from_fd
, 0 , SEEK_SET
) < 0) return DEFER
;
972 int len
= read(from_fd
, deliver_out_buffer
+ used
,
973 DELIVER_OUT_BUFFER_SIZE
- used
);
976 if (len
== 0) errno
= ERRNO_MBXLENGTH
;
979 if (!transport_write_block(&tctx
, deliver_out_buffer
, used
+ len
, FALSE
))
987 #endif /* SUPPORT_MBX */
991 /*************************************************
992 * Check creation is permitted *
993 *************************************************/
995 /* This function checks whether a given file name is permitted to be created,
996 as controlled by the create_file option. If no home directory is set, however,
997 we can't do any tests.
1000 filename the file name
1001 create_file the ob->create_file option
1003 Returns: TRUE if creation is permitted
1007 check_creation(uschar
*filename
, int create_file
)
1011 if (deliver_home
!= NULL
&& create_file
!= create_anywhere
)
1013 int len
= Ustrlen(deliver_home
);
1014 uschar
*file
= filename
;
1016 while (file
[0] == '/' && file
[1] == '/') file
++;
1017 if (Ustrncmp(file
, deliver_home
, len
) != 0 || file
[len
] != '/' ||
1018 ( Ustrchr(file
+len
+2, '/') != NULL
&&
1020 create_file
!= create_belowhome
||
1021 Ustrstr(file
+len
, "/../") != NULL
1026 /* If yield is TRUE, the file name starts with the home directory, and does
1027 not contain any instances of "/../" in the "belowhome" case. However, it may
1028 still contain symbolic links. We can check for this by making use of
1029 realpath(), which most Unixes seem to have (but make it possible to cut this
1030 out). We can't just use realpath() on the whole file name, because we know
1031 the file itself doesn't exist, and intermediate directories may also not
1032 exist. What we want to know is the real path of the longest existing part of
1033 the path. That must match the home directory's beginning, whichever is the
1037 if (yield
&& create_file
== create_belowhome
)
1041 for (uschar
* slash
= Ustrrchr(file
, '/'); /* There is known to be one */
1042 rp
== NULL
&& slash
> file
; /* Stop if reached beginning */
1046 rp
= US
realpath(CS file
, CS big_buffer
);
1047 next
= Ustrrchr(file
, '/');
1051 /* If rp == NULL it means that none of the relevant directories exist.
1052 This is not a problem here - it means that no symbolic links can exist,
1053 which is all we are worried about. Otherwise, we must compare it
1054 against the start of the home directory. However, that may itself
1055 contain symbolic links, so we have to "realpath" it as well, if
1060 uschar hdbuffer
[PATH_MAX
+1];
1061 uschar
*rph
= deliver_home
;
1062 int rlen
= Ustrlen(big_buffer
);
1064 rp
= US
realpath(CS deliver_home
, CS hdbuffer
);
1071 if (rlen
> len
) rlen
= len
;
1072 if (Ustrncmp(rph
, big_buffer
, rlen
) != 0)
1075 DEBUG(D_transport
) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1076 big_buffer
, deliver_home
);
1080 #endif /* NO_REALPATH */
1088 /*************************************************
1089 * Main entry point *
1090 *************************************************/
1092 /* See local README for general interface details. This transport always
1093 returns FALSE, indicating that the status which has been placed in the first
1094 address should be copied to any other addresses in a batch.
1096 Appendfile delivery is tricky and has led to various security problems in other
1097 mailers. The logic used here is therefore laid out in some detail. When this
1098 function is called, we are running in a subprocess which has had its gid and
1099 uid set to the appropriate values. Therefore, we cannot write directly to the
1100 exim logs. Any errors must be handled by setting appropriate return codes.
1101 Note that the default setting for addr->transport_return is DEFER, so it need
1102 not be set unless some other value is required.
1104 The code below calls geteuid() rather than getuid() to get the current uid
1105 because in weird configurations not running setuid root there may be a
1106 difference. In the standard configuration, where setuid() has been used in the
1107 delivery process, there will be no difference between the uid and the euid.
1109 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1110 alias expansion. Otherwise, there must be a configured file name or
1113 The following items apply in the case when a file name (as opposed to a
1114 directory name) is given, that is, when appending to a single file:
1116 (2f) Expand the file name.
1118 (3f) If the file name is /dev/null, return success (optimization).
1120 (4f) If the file_format options is set, open the file for reading, and check
1121 that the bytes at the start of the file match one of the given strings.
1122 If the check indicates a transport other than the current one should be
1123 used, pass control to that other transport. Otherwise continue. An empty
1124 or non-existent file matches the current transport. The file is closed
1127 (5f) If a lock file is required, create it (see extensive separate comments
1128 below about the algorithm for doing this). It is important to do this
1129 before opening the mailbox if NFS is in use.
1131 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1132 details of any symbolic link.
1134 (7f) If the file already exists:
1136 Check the owner and group if necessary, and defer if they are wrong.
1138 If it is a symbolic link AND the allow_symlink option is set (NOT the
1139 default), go back to (6f) but this time use stat() instead of lstat().
1141 If it's not a regular file (or FIFO when permitted), defer delivery.
1143 Check permissions. If the required permissions are *less* than the
1144 existing ones, or supplied by the address (often by the user via filter),
1145 chmod() the file. Otherwise, defer.
1147 Save the inode number.
1149 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1151 If open fails because the file does not exist, go to (6f); on any other
1154 Check the inode number hasn't changed - I realize this isn't perfect (an
1155 inode can be reused) but it's cheap and will catch some of the races.
1157 Check it's still a regular file (or FIFO if permitted).
1159 Check that the owner and permissions haven't changed.
1161 If file_format is set, check that the file still matches the format for
1162 the current transport. If not, defer delivery.
1164 (8f) If file does not exist initially:
1166 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1167 this is via a symbolic link (only possible if allow_symlinks is set), in
1168 which case don't use O_EXCL, as it doesn't work.
1170 If open fails because the file already exists, go to (6f). To avoid
1171 looping for ever in a situation where the file is continuously being
1172 created and deleted, all of this happens inside a loop that operates
1173 lock_retries times and includes the fcntl and flock locking. If the
1174 loop completes without the file getting opened, defer and request
1175 freezing, because something really weird is happening.
1177 If open fails for any other reason, defer for subsequent delivery except
1178 when this is a file delivery resulting from an alias or forward expansion
1179 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1180 most likely a user rather than a configuration error.
1182 (9f) We now have the file checked and open for writing. If so configured, lock
1183 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1184 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1185 still fails, give up and defer delivery.
1187 (10f)Save the access time (for subsequent restoration) and the size of the
1188 file, for comsat and for re-setting if delivery fails in the middle -
1189 e.g. for quota exceeded.
1191 The following items apply in the case when a directory name is given:
1193 (2d) Create a new file in the directory using a temporary name, by opening for
1194 writing and with O_CREAT. If maildir format is being used, the file
1195 is created in a temporary subdirectory with a prescribed name. If
1196 mailstore format is being used, the envelope file is first created with a
1197 temporary name, then the data file.
1199 The following items apply in all cases:
1201 (11) We now have the file open for writing, and locked if it was given as a
1202 file name. Write the message and flush the file, unless there is a setting
1203 of the local quota option, in which case we can check for its excession
1204 without doing any writing.
1206 In the case of MBX format mailboxes, the message is first written to a
1207 temporary file, in order to get its correct length. This is then copied to
1208 the real file, preceded by an MBX header.
1210 If there is a quota error on writing, defer the address. Timeout logic
1211 will determine for how long retries are attempted. We restore the mailbox
1212 to its original length if it's a single file. There doesn't seem to be a
1213 uniform error code for quota excession (it even differs between SunOS4
1214 and some versions of SunOS5) so a system-dependent macro called
1215 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1218 For any other error (most commonly disk full), do the same.
1220 The following applies after appending to a file:
1222 (12f)Restore the atime; notify_comsat if required; close the file (which
1223 unlocks it if it was locked). Delete the lock file if it exists.
1225 The following applies after writing a unique file in a directory:
1227 (12d)For maildir format, rename the file into the new directory. For mailstore
1228 format, rename the envelope file to its correct name. Otherwise, generate
1229 a unique name from the directory_file option, and rename to that, possibly
1230 trying a few times if the file exists and re-expanding the name gives a
1233 This transport yields FAIL only when a file name is generated by an alias or
1234 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1235 All other failures return DEFER (in addr->transport_return). */
1239 appendfile_transport_entry(
1240 transport_instance
*tblock
, /* data for this instantiation */
1241 address_item
*addr
) /* address we are working on */
1243 appendfile_transport_options_block
*ob
=
1244 (appendfile_transport_options_block
*)(tblock
->options_block
);
1245 struct stat statbuf
;
1246 uschar
*fdname
= NULL
;
1247 uschar
*filename
= NULL
;
1248 uschar
*hitchname
= NULL
;
1249 uschar
*dataname
= NULL
;
1250 uschar
*lockname
= NULL
;
1251 uschar
*newname
= NULL
;
1252 uschar
*nametag
= NULL
;
1254 uschar
*filecount_msg
= US
"";
1256 struct utimbuf times
;
1257 struct timeval msg_tv
;
1258 BOOL disable_quota
= FALSE
;
1259 BOOL isdirectory
= FALSE
;
1260 BOOL isfifo
= FALSE
;
1261 BOOL wait_for_tick
= FALSE
;
1262 uid_t uid
= geteuid(); /* See note above */
1263 gid_t gid
= getegid();
1265 int mode
= (addr
->mode
> 0) ? addr
->mode
: ob
->mode
;
1266 off_t saved_size
= -1;
1267 off_t mailbox_size
= ob
->mailbox_size_value
;
1268 int mailbox_filecount
= ob
->mailbox_filecount_value
;
1276 int mbx_lockfd
= -1;
1277 uschar mbx_lockname
[40];
1278 FILE *temp_file
= NULL
;
1279 #endif /* SUPPORT_MBX */
1281 #ifdef SUPPORT_MAILDIR
1282 int maildirsize_fd
= -1; /* fd for maildirsize file */
1283 int maildir_save_errno
;
1287 DEBUG(D_transport
) debug_printf("appendfile transport entered\n");
1289 /* An "address_file" or "address_directory" transport is used to deliver to
1290 files specified via .forward or an alias file. Prior to release 4.20, the
1291 "file" and "directory" options were ignored in this case. This has been changed
1292 to allow the redirection data to specify what is in effect a folder, whose
1293 location is determined by the options on the transport.
1295 Compatibility with the case when neither option is set is retained by forcing a
1296 value for the file or directory name. A directory delivery is assumed if the
1297 last character of the path from the router is '/'.
1299 The file path is in the local part of the address, but not in the $local_part
1300 variable (that holds the parent local part). It is, however, in the
1301 $address_file variable. Below, we update the local part in the address if it
1302 changes by expansion, so that the final path ends up in the log. */
1304 if (testflag(addr
, af_file
) &&
1305 ob
->filename
== NULL
&&
1306 ob
->dirname
== NULL
)
1308 fdname
= US
"$address_file";
1309 if (address_file
[Ustrlen(address_file
)-1] == '/' ||
1310 ob
->maildir_format
||
1311 ob
->mailstore_format
)
1315 /* Handle (a) an "address file" delivery where "file" or "directory" is
1316 explicitly set and (b) a non-address_file delivery, where one of "file" or
1317 "directory" must be set; initialization ensures that they are not both set. */
1321 fdname
= ob
->filename
;
1324 fdname
= ob
->dirname
;
1329 addr
->transport_return
= PANIC
;
1330 addr
->message
= string_sprintf("Mandatory file or directory option "
1331 "missing from %s transport", tblock
->name
);
1336 /* Maildir and mailstore require a directory */
1338 if ((ob
->maildir_format
|| ob
->mailstore_format
) && !isdirectory
)
1340 addr
->transport_return
= PANIC
;
1341 addr
->message
= string_sprintf("mail%s_format requires \"directory\" "
1342 "to be specified for the %s transport",
1343 ob
->maildir_format
? "dir" : "store", tblock
->name
);
1347 path
= expand_string(fdname
);
1351 addr
->transport_return
= PANIC
;
1352 addr
->message
= string_sprintf("Expansion of \"%s\" (file or directory "
1353 "name for %s transport) failed: %s", fdname
, tblock
->name
,
1354 expand_string_message
);
1360 addr
->message
= string_sprintf("appendfile: file or directory name "
1361 "\"%s\" is not absolute", path
);
1362 addr
->basic_errno
= ERRNO_NOTABSOLUTE
;
1366 /* For a file delivery, make sure the local part in the address(es) is updated
1367 to the true local part. */
1369 if (testflag(addr
, af_file
))
1370 for (address_item
* addr2
= addr
; addr2
!= NULL
; addr2
= addr2
->next
)
1371 addr2
->local_part
= string_copy(path
);
1373 /* The available mailbox formats depend on whether it is a directory or a file
1379 #ifdef SUPPORT_MAILDIR
1380 (ob
->maildir_format
) ? mbf_maildir
:
1382 #ifdef SUPPORT_MAILSTORE
1383 (ob
->mailstore_format
) ? mbf_mailstore
:
1391 (ob
->mbx_format
) ? mbf_mbx
:
1398 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1400 " warning=" OFF_T_FMT
"%s\n"
1401 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1402 "maildir_use_size_file=%s\n",
1403 mode
, ob
->notify_comsat
, ob
->quota_value
,
1404 ob
->quota_no_check
? " (no_check)" : "",
1405 ob
->quota_filecount_no_check
? " (no_check_filecount)" : "",
1406 ob
->quota_warn_threshold_value
,
1407 ob
->quota_warn_threshold_is_percent
? "%" : "",
1408 isdirectory
? "directory" : "file",
1409 path
, mailbox_formats
[mbformat
],
1410 (ob
->message_prefix
== NULL
) ? US
"null" : string_printing(ob
->message_prefix
),
1411 (ob
->message_suffix
== NULL
) ? US
"null" : string_printing(ob
->message_suffix
),
1412 (ob
->maildir_use_size_file
) ? "yes" : "no");
1414 if (!isdirectory
) debug_printf(" locking by %s%s%s%s%s\n",
1415 ob
->use_lockfile
? "lockfile " : "",
1416 ob
->use_mbx_lock
? "mbx locking (" : "",
1417 ob
->use_fcntl
? "fcntl " : "",
1418 ob
->use_flock
? "flock" : "",
1419 ob
->use_mbx_lock
? ")" : "");
1422 /* If the -N option is set, can't do any more. */
1427 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1429 addr
->transport_return
= OK
;
1433 /* Handle the case of a file name. If the file name is /dev/null, we can save
1434 ourselves some effort and just give a success return right away. */
1438 BOOL use_lstat
= TRUE
;
1439 BOOL file_opened
= FALSE
;
1440 BOOL allow_creation_here
= TRUE
;
1442 if (Ustrcmp(path
, "/dev/null") == 0)
1444 addr
->transport_return
= OK
;
1448 /* Set the name of the file to be opened, and the file to which the data
1449 is written, and find out if we are permitted to create a non-existent file. */
1451 dataname
= filename
= path
;
1452 allow_creation_here
= check_creation(filename
, ob
->create_file
);
1454 /* If ob->create_directory is set, attempt to create the directories in
1455 which this mailbox lives, but only if we are permitted to create the file
1456 itself. We know we are dealing with an absolute path, because this was
1459 if (ob
->create_directory
&& allow_creation_here
)
1461 uschar
*p
= Ustrrchr(path
, '/');
1463 if (!directory_make(NULL
, path
, ob
->dirmode
, FALSE
))
1465 addr
->basic_errno
= errno
;
1467 string_sprintf("failed to create directories for %s: %s", path
,
1469 DEBUG(D_transport
) debug_printf("%s transport: %s\n", tblock
->name
, path
);
1475 /* If file_format is set we must check that any existing file matches one of
1476 the configured formats by checking the bytes it starts with. A match then
1477 indicates a specific transport - if it is not this one, pass control to it.
1478 Otherwise carry on here. An empty or non-existent file matches the current
1479 transport. We don't need to distinguish between non-existence and other open
1480 failures because if an existing file fails to open here, it will also fail
1481 again later when O_RDWR is used. */
1483 if (ob
->file_format
!= NULL
)
1485 int cfd
= Uopen(path
, O_RDONLY
, 0);
1488 transport_instance
*tt
= check_file_format(cfd
, tblock
, addr
);
1491 /* If another transport is indicated, call it and return; if no transport
1492 was found, just return - the error data will have been set up.*/
1498 set_process_info("delivering %s to %s using %s", message_id
,
1499 addr
->local_part
, tt
->name
);
1500 debug_print_string(tt
->debug_string
);
1501 addr
->transport
= tt
;
1502 (tt
->info
->code
)(tt
, addr
);
1509 /* The locking of mailbox files is worse than the naming of cats, which is
1510 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1511 three different names, so several different styles of locking are used.
1513 Research in other programs that lock mailboxes shows that there is no
1514 universally standard method. Having mailboxes NFS-mounted on the system that
1515 is delivering mail is not the best thing, but people do run like this,
1516 and so the code must do its best to cope.
1518 Three different locking mechanisms are supported. The initialization function
1519 checks that at least one is configured.
1523 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1524 will work over NFS. Only after that is done do we actually open the mailbox
1525 and apply locks to it (if configured).
1527 Originally, Exim got the file opened before doing anything about locking.
1528 However, a very occasional problem was observed on Solaris 2 when delivering
1529 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1530 gets remembered at open time. If another process on another host (that's
1531 important) has the file open and locked and writes to it and then releases
1532 the lock while the first process is waiting to get the lock, the first
1533 process may fail to write at the new end point of the file - despite the very
1534 definite statement about O_APPEND in the man page for write(). Experiments
1535 have reproduced this problem, but I do not know any way of forcing a host to
1536 update its attribute cache for an open NFS file. It would be nice if it did
1537 so when a lock was taken out, but this does not seem to happen. Anyway, to
1538 reduce the risk of this problem happening, we now create the lock file
1539 (if configured) *before* opening the mailbox. That will prevent two different
1540 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1541 however, but Pine at least seems to operate in the same way.
1543 Lockfiles should normally be used when NFS is involved, because of the above
1546 The logic for creating the lock file is:
1548 . The name of the lock file is <mailbox-name>.lock
1550 . First, create a "hitching post" name by adding the primary host name,
1551 current time and pid to the lock file name. This should be unique.
1553 . Create the hitching post file using WRONLY + CREAT + EXCL.
1555 . If that fails EACCES, we assume it means that the user is unable to create
1556 files in the mail spool directory. Some installations might operate in this
1557 manner, so there is a configuration option to allow this state not to be an
1558 error - we proceed to lock using fcntl only, after the file is open.
1560 . Otherwise, an error causes a deferment of the address.
1562 . Hard link the hitching post to the lock file name.
1564 . If the link succeeds, we have successfully created the lock file. Simply
1565 close and unlink the hitching post file.
1567 . If the link does not succeed, proceed as follows:
1569 o Fstat the hitching post file, and then close and unlink it.
1571 o Now examine the stat data. If the number of links to the file is exactly
1572 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1573 the return never made it back, so the link() function gave a failure
1576 . This method allows for the lock file to be created by some other process
1577 right up to the moment of the attempt to hard link it, and is also robust
1578 against NFS server crash-reboots, which would probably result in timeouts
1579 in the middle of link().
1581 . System crashes may cause lock files to get left lying around, and some means
1582 of flushing them is required. The approach of writing a pid (used by smail
1583 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1584 timeout, which seems a better approach. Since any program that writes to a
1585 mailbox using a lock file should complete its task very quickly, Pine
1586 removes lock files that are older than 5 minutes. We allow the value to be
1587 configurable on the transport.
1591 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1592 mailbox once it is open. This is done by default with a non-blocking lock.
1593 Failures to lock cause retries after a sleep, but only for a certain number
1594 of tries. A blocking lock is deliberately not used so that we don't hold the
1595 mailbox open. This minimizes the possibility of the NFS problem described
1596 under LOCK FILES above, if for some reason NFS deliveries are happening
1597 without lock files. However, the use of a non-blocking lock and sleep, though
1598 the safest approach, does not give the best performance on very busy systems.
1599 A blocking lock plus timeout does better. Therefore Exim has an option to
1600 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1601 enables the use of blocking fcntl() calls.
1605 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1606 same manner as for fcntl locking above. No-blocking/timeout is also set as
1607 above in lock_flock_timeout. Not all operating systems provide or support
1608 flock(). For those that don't (as determined by the definition of LOCK_SH in
1609 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1610 is implemented (not precisely) on top of fcntl(), which means there's no
1611 point in actually using it.
1615 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1616 then the rules used for locking in c-client are used. Exim takes out a shared
1617 lock on the mailbox file, and an exclusive lock on the file whose name is
1618 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1619 any other MBX client from getting an exclusive lock on it and expunging it.
1620 It also stops any other MBX client from unlinking the /tmp lock when it has
1623 The exclusive lock on the /tmp file prevents any other MBX client from
1624 updating the mailbox in any way. When writing is finished, if an exclusive
1625 lock on the mailbox can be obtained, indicating there are no current sharers,
1626 the /tmp file is unlinked.
1628 MBX locking can use either fcntl() or flock() locking. If neither
1629 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1630 The calls for getting these locks are by default non-blocking, as for non-mbx
1631 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1632 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1633 probably makes sense to set timeouts for any MBX deliveries. */
1636 /* Build a lock file if configured to do so - the existence of a lock
1637 file is subsequently checked by looking for a non-negative value of the
1638 file descriptor hd - even though the file is no longer open. */
1640 if (ob
->use_lockfile
)
1642 /* cf. exim_lock.c */
1643 lockname
= string_sprintf("%s.lock", filename
);
1644 hitchname
= string_sprintf( "%s.%s.%08x.%08x", lockname
, primary_hostname
,
1645 (unsigned int)(time(NULL
)), (unsigned int)getpid());
1647 DEBUG(D_transport
) debug_printf("lock name: %s\nhitch name: %s\n", lockname
,
1650 /* Lock file creation retry loop */
1652 for (i
= 0; i
< ob
->lock_retries
; sleep(ob
->lock_interval
), i
++)
1655 hd
= Uopen(hitchname
, O_WRONLY
| O_CREAT
| O_EXCL
, ob
->lockfile_mode
);
1659 addr
->basic_errno
= errno
;
1661 string_sprintf("creating lock file hitching post %s "
1662 "(euid=%ld egid=%ld)", hitchname
, (long int)geteuid(),
1663 (long int)getegid());
1667 /* Attempt to hitch the hitching post to the lock file. If link()
1668 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1669 file, and get rid of the hitching post. If the number of links was 2,
1670 the link was created, despite the failure of link(). If the hitch was
1671 not successful, try again, having unlinked the lock file if it is too
1674 There's a version of Linux (2.0.27) which doesn't update its local cache
1675 of the inode after link() by default - which many think is a bug - but
1676 if the link succeeds, this code will be OK. It just won't work in the
1677 case when link() fails after having actually created the link. The Linux
1678 NFS person is fixing this; a temporary patch is available if anyone is
1679 sufficiently worried. */
1681 if ((rc
= Ulink(hitchname
, lockname
)) != 0) fstat(hd
, &statbuf
);
1684 if (rc
!= 0 && statbuf
.st_nlink
!= 2)
1686 if (ob
->lockfile_timeout
> 0 && Ustat(lockname
, &statbuf
) == 0 &&
1687 time(NULL
) - statbuf
.st_ctime
> ob
->lockfile_timeout
)
1689 DEBUG(D_transport
) debug_printf("unlinking timed-out lock file\n");
1692 DEBUG(D_transport
) debug_printf("link of hitching post failed - retrying\n");
1696 DEBUG(D_transport
) debug_printf("lock file created\n");
1700 /* Check for too many tries at creating the lock file */
1702 if (i
>= ob
->lock_retries
)
1704 addr
->basic_errno
= ERRNO_LOCKFAILED
;
1705 addr
->message
= string_sprintf("failed to lock mailbox %s (lock file)",
1712 /* We now have to get the file open. First, stat() it and act on existence or
1713 non-existence. This is in a loop to handle the case of a file's being created
1714 or deleted as we watch, and also to handle retries when the locking fails.
1715 Rather than holding the file open while waiting for the fcntl() and/or
1716 flock() lock, we close and do the whole thing again. This should be safer,
1717 especially for NFS files, which might get altered from other hosts, making
1718 their cached sizes incorrect.
1720 With the default settings, no symlinks are permitted, but there is an option
1721 to permit symlinks for those sysadmins that know what they are doing.
1722 Shudder. However, insist that the initial symlink is owned by the right user.
1723 Thus lstat() is used initially; if a symlink is discovered, the loop is
1724 repeated such that stat() is used, to look at the end file. */
1726 for (i
= 0; i
< ob
->lock_retries
; i
++)
1728 int sleep_before_retry
= TRUE
;
1729 file_opened
= FALSE
;
1731 if((use_lstat
? Ulstat(filename
, &statbuf
) : Ustat(filename
, &statbuf
)) != 0)
1733 /* Let's hope that failure to stat (other than non-existence) is a
1736 if (errno
!= ENOENT
)
1738 addr
->basic_errno
= errno
;
1739 addr
->message
= string_sprintf("attempting to stat mailbox %s",
1744 /* File does not exist. If it is required to pre-exist this state is an
1747 if (ob
->file_must_exist
)
1749 addr
->basic_errno
= errno
;
1750 addr
->message
= string_sprintf("mailbox %s does not exist, "
1751 "but file_must_exist is set", filename
);
1755 /* If not permitted to create this file because it isn't in or below
1756 the home directory, generate an error. */
1758 if (!allow_creation_here
)
1760 addr
->basic_errno
= ERRNO_BADCREATE
;
1761 addr
->message
= string_sprintf("mailbox %s does not exist, "
1762 "but creation outside the home directory is not permitted",
1767 /* Attempt to create and open the file. If open fails because of
1768 pre-existence, go round the loop again. For any other error, defer the
1769 address, except for an alias or forward generated file name with EPERM,
1770 ENOENT, or EACCES, as those are most likely to be user errors rather
1771 than Exim config errors. When a symbolic link is permitted and points
1772 to a non-existent file, we get here with use_lstat = FALSE. In this case
1773 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1774 consistency and because MBX locking requires it in order to be able to
1775 get a shared lock. */
1777 fd
= Uopen(filename
, O_RDWR
| O_APPEND
| O_CREAT
|
1778 (use_lstat
? O_EXCL
: 0), mode
);
1781 if (errno
== EEXIST
) continue;
1782 addr
->basic_errno
= errno
;
1783 addr
->message
= string_sprintf("while creating mailbox %s",
1785 if (testflag(addr
, af_file
) &&
1786 (errno
== EPERM
|| errno
== ENOENT
|| errno
== EACCES
))
1787 addr
->transport_return
= FAIL
;
1791 /* We have successfully created and opened the file. Ensure that the group
1792 and the mode are correct. */
1794 if(exim_chown(filename
, uid
, gid
) || Uchmod(filename
, mode
))
1796 addr
->basic_errno
= errno
;
1797 addr
->message
= string_sprintf("while setting perms on mailbox %s",
1799 addr
->transport_return
= FAIL
;
1805 /* The file already exists. Test its type, ownership, and permissions, and
1806 save the inode for checking later. If symlinks are permitted (not the
1807 default or recommended state) it may be a symlink that already exists.
1808 Check its ownership and then look for the file at the end of the link(s).
1809 This at least prevents one user creating a symlink for another user in
1810 a sticky directory. */
1814 int oldmode
= (int)statbuf
.st_mode
;
1815 ino_t inode
= statbuf
.st_ino
;
1816 BOOL islink
= (oldmode
& S_IFMT
) == S_IFLNK
;
1818 isfifo
= FALSE
; /* In case things are changing */
1820 /* Check owner if required - the default. */
1822 if (ob
->check_owner
&& statbuf
.st_uid
!= uid
)
1824 addr
->basic_errno
= ERRNO_BADUGID
;
1825 addr
->message
= string_sprintf("mailbox %s%s has wrong uid "
1826 "(%ld != %ld)", filename
,
1827 islink
? " (symlink)" : "",
1828 (long int)(statbuf
.st_uid
), (long int)uid
);
1832 /* Group is checked only if check_group is set. */
1834 if (ob
->check_group
&& statbuf
.st_gid
!= gid
)
1836 addr
->basic_errno
= ERRNO_BADUGID
;
1837 addr
->message
= string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1838 filename
, islink
? " (symlink)" : "", statbuf
.st_gid
, gid
);
1842 /* Just in case this is a sticky-bit mail directory, we don't want
1843 users to be able to create hard links to other users' files. */
1845 if (statbuf
.st_nlink
!= 1)
1847 addr
->basic_errno
= ERRNO_NOTREGULAR
;
1848 addr
->message
= string_sprintf("mailbox %s%s has too many links (%d)",
1849 filename
, islink
? " (symlink)" : "", statbuf
.st_nlink
);
1854 /* If symlinks are permitted (not recommended), the lstat() above will
1855 have found the symlink. Its ownership has just been checked; go round
1856 the loop again, using stat() instead of lstat(). That will never yield a
1859 if (islink
&& ob
->allow_symlink
)
1862 i
--; /* Don't count this time round */
1866 /* An actual file exists. Check that it is a regular file, or FIFO
1869 if (ob
->allow_fifo
&& (oldmode
& S_IFMT
) == S_IFIFO
) isfifo
= TRUE
;
1871 else if ((oldmode
& S_IFMT
) != S_IFREG
)
1873 addr
->basic_errno
= ERRNO_NOTREGULAR
;
1874 addr
->message
= string_sprintf("mailbox %s is not a regular file%s",
1875 filename
, ob
->allow_fifo
? " or named pipe" : "");
1879 /* If the mode is not what it would be for a newly created file, change
1880 the permissions if the mode is supplied for the address. Otherwise,
1881 reduce but do not extend the permissions. If the newly created
1882 permissions are greater than the existing permissions, don't change
1883 things when the mode is not from the address. */
1885 if ((oldmode
= (oldmode
& 07777)) != mode
)
1887 int diffs
= oldmode
^ mode
;
1888 if (addr
->mode
> 0 || (diffs
& oldmode
) == diffs
)
1890 DEBUG(D_transport
) debug_printf("chmod %o %s\n", mode
, filename
);
1891 if (Uchmod(filename
, mode
) < 0)
1893 addr
->basic_errno
= errno
;
1894 addr
->message
= string_sprintf("attempting to chmod mailbox %s",
1901 /* Mode not from address, and newly-created permissions are greater
1902 than existing permissions. Default is to complain, but it can be
1903 configured to go ahead and try to deliver anyway if that's what
1904 the administration wants. */
1906 else if (ob
->mode_fail_narrower
)
1908 addr
->basic_errno
= ERRNO_BADMODE
;
1909 addr
->message
= string_sprintf("mailbox %s has the wrong mode %o "
1910 "(%o expected)", filename
, oldmode
, mode
);
1915 /* We are happy with the existing file. Open it, and then do further
1916 tests to ensure that it is the same file that we were just looking at.
1917 If the file does not now exist, restart this loop, going back to using
1918 lstat again. For an NFS error, just defer; other opening errors are
1919 more serious. The file is opened RDWR so that its format can be checked,
1920 and also MBX locking requires the use of a shared (read) lock. However,
1921 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1922 reading the pipe. */
1924 fd
= Uopen(filename
, isfifo
? (O_WRONLY
|O_NDELAY
) : (O_RDWR
|O_APPEND
),
1928 if (errno
== ENOENT
)
1933 addr
->basic_errno
= errno
;
1936 addr
->message
= string_sprintf("while opening named pipe %s "
1937 "(could mean no process is reading it)", filename
);
1939 else if (errno
!= EWOULDBLOCK
)
1941 addr
->message
= string_sprintf("while opening mailbox %s", filename
);
1946 /* This fstat really shouldn't fail, as we have an open file! There's a
1947 dilemma here. We use fstat in order to be sure we are peering at the file
1948 we have got open. However, that won't tell us if the file was reached
1949 via a symbolic link. We checked this above, but there is a race exposure
1950 if the link was created between the previous lstat and the open. However,
1951 it would have to be created with the same inode in order to pass the
1952 check below. If ob->allow_symlink is set, causing the use of stat rather
1953 than lstat above, symbolic links may be there anyway, and the checking is
1956 if (fstat(fd
, &statbuf
) < 0)
1958 addr
->basic_errno
= errno
;
1959 addr
->message
= string_sprintf("attempting to stat open mailbox %s",
1964 /* Check the inode; this is isn't a perfect check, but gives some
1967 if (inode
!= statbuf
.st_ino
)
1969 addr
->basic_errno
= ERRNO_INODECHANGED
;
1970 addr
->message
= string_sprintf("opened mailbox %s inode number changed "
1971 "from " INO_T_FMT
" to " INO_T_FMT
, filename
, inode
, statbuf
.st_ino
);
1972 addr
->special_action
= SPECIAL_FREEZE
;
1976 /* Check it's still a regular file or FIFO, and the uid, gid, and
1977 permissions have not changed. */
1979 if ((!isfifo
&& (statbuf
.st_mode
& S_IFMT
) != S_IFREG
) ||
1980 (isfifo
&& (statbuf
.st_mode
& S_IFMT
) != S_IFIFO
))
1982 addr
->basic_errno
= ERRNO_NOTREGULAR
;
1984 string_sprintf("opened mailbox %s is no longer a %s", filename
,
1985 isfifo
? "named pipe" : "regular file");
1986 addr
->special_action
= SPECIAL_FREEZE
;
1990 if ((ob
->check_owner
&& statbuf
.st_uid
!= uid
) ||
1991 (ob
->check_group
&& statbuf
.st_gid
!= gid
))
1993 addr
->basic_errno
= ERRNO_BADUGID
;
1995 string_sprintf("opened mailbox %s has wrong uid or gid", filename
);
1996 addr
->special_action
= SPECIAL_FREEZE
;
2000 if ((statbuf
.st_mode
& 07777) != oldmode
)
2002 addr
->basic_errno
= ERRNO_BADMODE
;
2003 addr
->message
= string_sprintf("opened mailbox %s has wrong mode %o "
2004 "(%o expected)", filename
, statbuf
.st_mode
& 07777, mode
);
2005 addr
->special_action
= SPECIAL_FREEZE
;
2009 /* If file_format is set, check that the format of the file has not
2010 changed. Error data is set by the testing function. */
2012 if (ob
->file_format
!= NULL
&&
2013 check_file_format(fd
, tblock
, addr
) != tblock
)
2015 addr
->message
= US
"open mailbox has changed format";
2019 /* The file is OK. Carry on to do the locking. */
2022 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
2023 locking rules if configured to do so. If a lock file is also required, it
2024 was created above and hd was left >= 0. At least one form of locking is
2025 required by the initialization function. If locking fails here, close the
2026 file and go round the loop all over again, after waiting for a bit, unless
2027 blocking locking was used. */
2030 if ((ob
->lock_fcntl_timeout
> 0) || (ob
->lock_flock_timeout
> 0))
2031 sleep_before_retry
= FALSE
;
2033 /* Simple fcntl() and/or flock() locking */
2035 if (!ob
->use_mbx_lock
&& (ob
->use_fcntl
|| ob
->use_flock
))
2037 if (apply_lock(fd
, F_WRLCK
, ob
->use_fcntl
, ob
->lock_fcntl_timeout
,
2038 ob
->use_flock
, ob
->lock_flock_timeout
) >= 0) break;
2041 /* MBX locking rules */
2044 else if (ob
->use_mbx_lock
)
2047 struct stat lstatbuf
, statbuf2
;
2048 if (apply_lock(fd
, F_RDLCK
, ob
->use_fcntl
, ob
->lock_fcntl_timeout
,
2049 ob
->use_flock
, ob
->lock_flock_timeout
) >= 0 &&
2050 fstat(fd
, &statbuf
) >= 0)
2052 sprintf(CS mbx_lockname
, "/tmp/.%lx.%lx", (long)statbuf
.st_dev
,
2053 (long)statbuf
.st_ino
);
2056 * 2010-05-29: SECURITY
2057 * Dan Rosenberg reported the presence of a race-condition in the
2058 * original code here. Beware that many systems still allow symlinks
2059 * to be followed in /tmp so an attacker can create a symlink pointing
2060 * elsewhere between a stat and an open, which we should avoid
2063 * It's unfortunate that we can't just use all the heavily debugged
2064 * locking from above.
2066 * Also: remember to mirror changes into exim_lock.c */
2068 /* first leave the old pre-check in place, it provides better
2069 * diagnostics for common cases */
2070 if (Ulstat(mbx_lockname
, &statbuf
) >= 0)
2072 if ((statbuf
.st_mode
& S_IFMT
) == S_IFLNK
)
2074 addr
->basic_errno
= ERRNO_LOCKFAILED
;
2075 addr
->message
= string_sprintf("symbolic link on MBX lock file %s",
2079 if (statbuf
.st_nlink
> 1)
2081 addr
->basic_errno
= ERRNO_LOCKFAILED
;
2082 addr
->message
= string_sprintf("hard link to MBX lock file %s",
2088 /* If we could just declare "we must be the ones who create this
2089 * file" then a hitching post in a subdir would work, since a
2090 * subdir directly in /tmp/ which we create wouldn't follow links
2091 * but this isn't our locking logic, so we can't safely change the
2092 * file existence rules. */
2094 /* On systems which support O_NOFOLLOW, it's the easiest and most
2095 * obviously correct security fix */
2096 mbx_tmp_oflags
= O_RDWR
| O_CREAT
;
2098 mbx_tmp_oflags
|= O_NOFOLLOW
;
2100 mbx_lockfd
= Uopen(mbx_lockname
, mbx_tmp_oflags
, ob
->lockfile_mode
);
2103 addr
->basic_errno
= ERRNO_LOCKFAILED
;
2104 addr
->message
= string_sprintf("failed to open MBX lock file %s :%s",
2105 mbx_lockname
, strerror(errno
));
2109 if (Ulstat(mbx_lockname
, &lstatbuf
) < 0)
2111 addr
->basic_errno
= ERRNO_LOCKFAILED
;
2112 addr
->message
= string_sprintf("attempting to lstat open MBX "
2113 "lock file %s: %s", mbx_lockname
, strerror(errno
));
2116 if (fstat(mbx_lockfd
, &statbuf2
) < 0)
2118 addr
->basic_errno
= ERRNO_LOCKFAILED
;
2119 addr
->message
= string_sprintf("attempting to stat fd of open MBX "
2120 "lock file %s: %s", mbx_lockname
, strerror(errno
));
2126 * statbuf: if exists, is file which existed prior to opening the
2127 * lockfile, might have been replaced since then
2128 * statbuf2: result of stat'ing the open fd, is what was actually
2130 * lstatbuf: result of lstat'ing the filename immediately after
2131 * the open but there's a race condition again between
2132 * those two steps: before open, symlink to foo, after
2133 * open but before lstat have one of:
2134 * * was no symlink, so is the opened file
2135 * (we created it, no messing possible after that point)
2137 * * symlink elsewhere
2138 * * hardlink elsewhere
2140 * Don't want to compare to device of /tmp because some modern systems
2141 * have regressed to having /tmp be the safe actual filesystem as
2142 * valuable data, so is mostly worthless, unless we assume that *only*
2143 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2144 * for further consideration.
2145 * No point in doing a readlink on the lockfile as that will always be
2146 * at a different point in time from when we open it, so tells us
2147 * nothing; attempts to clean up and delete after ourselves would risk
2148 * deleting a *third* filename.
2150 if ((statbuf2
.st_nlink
> 1) ||
2151 (lstatbuf
.st_nlink
> 1) ||
2152 (!S_ISREG(lstatbuf
.st_mode
)) ||
2153 (lstatbuf
.st_dev
!= statbuf2
.st_dev
) ||
2154 (lstatbuf
.st_ino
!= statbuf2
.st_ino
))
2156 addr
->basic_errno
= ERRNO_LOCKFAILED
;
2157 addr
->message
= string_sprintf("RACE CONDITION detected: "
2158 "mismatch post-initial-checks between \"%s\" and opened "
2159 "fd lead us to abort!", mbx_lockname
);
2163 (void)Uchmod(mbx_lockname
, ob
->lockfile_mode
);
2165 if (apply_lock(mbx_lockfd
, F_WRLCK
, ob
->use_fcntl
,
2166 ob
->lock_fcntl_timeout
, ob
->use_flock
, ob
->lock_flock_timeout
) >= 0)
2168 struct stat ostatbuf
;
2170 /* This tests for a specific race condition. Ensure that we still
2171 have the same file. */
2173 if (Ulstat(mbx_lockname
, &statbuf
) == 0 &&
2174 fstat(mbx_lockfd
, &ostatbuf
) == 0 &&
2175 statbuf
.st_dev
== ostatbuf
.st_dev
&&
2176 statbuf
.st_ino
== ostatbuf
.st_ino
)
2178 DEBUG(D_transport
) debug_printf("MBX lockfile %s changed "
2179 "between creation and locking\n", mbx_lockname
);
2182 DEBUG(D_transport
) debug_printf("failed to lock %s: %s\n", mbx_lockname
,
2184 (void)close(mbx_lockfd
);
2189 DEBUG(D_transport
) debug_printf("failed to fstat or get read lock on %s: %s\n",
2190 filename
, strerror(errno
));
2193 #endif /* SUPPORT_MBX */
2195 else break; /* No on-file locking required; break the open/lock loop */
2198 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2202 use_lstat
= TRUE
; /* Reset to use lstat first */
2205 /* If a blocking call timed out, break the retry loop if the total time
2206 so far is not less than than retries * interval. Use the larger of the
2207 flock() and fcntl() timeouts. */
2210 (i
+1) * ((ob
->lock_fcntl_timeout
> ob
->lock_flock_timeout
)?
2211 ob
->lock_fcntl_timeout
: ob
->lock_flock_timeout
) >=
2212 ob
->lock_retries
* ob
->lock_interval
)
2213 i
= ob
->lock_retries
;
2215 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2216 flock() that caused the problem. */
2218 if (i
< ob
->lock_retries
&& sleep_before_retry
) sleep(ob
->lock_interval
);
2221 /* Test for exceeding the maximum number of tries. Either the file remains
2222 locked, or, if we haven't got it open, something is terribly wrong... */
2224 if (i
>= ob
->lock_retries
)
2228 addr
->basic_errno
= ERRNO_EXISTRACE
;
2229 addr
->message
= string_sprintf("mailbox %s: existence unclear", filename
);
2230 addr
->special_action
= SPECIAL_FREEZE
;
2234 addr
->basic_errno
= ERRNO_LOCKFAILED
;
2235 addr
->message
= string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2241 DEBUG(D_transport
) debug_printf("mailbox %s is locked\n", filename
);
2243 /* Save access time (for subsequent restoration), modification time (for
2244 restoration if updating fails), size of file (for comsat and for re-setting if
2245 delivery fails in the middle - e.g. for quota exceeded). */
2247 if (fstat(fd
, &statbuf
) < 0)
2249 addr
->basic_errno
= errno
;
2250 addr
->message
= string_sprintf("while fstatting opened mailbox %s",
2255 times
.actime
= statbuf
.st_atime
;
2256 times
.modtime
= statbuf
.st_mtime
;
2257 saved_size
= statbuf
.st_size
;
2258 if (mailbox_size
< 0) mailbox_size
= saved_size
;
2259 mailbox_filecount
= 0; /* Not actually relevant for single-file mailbox */
2262 /* Prepare for writing to a new file (as opposed to appending to an old one).
2263 There are several different formats, but there is preliminary stuff concerned
2264 with quotas that applies to all of them. Finding the current size by directory
2265 scanning is expensive; for maildirs some fudges have been invented:
2267 (1) A regex can be used to extract a file size from its name;
2268 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2274 uschar
*check_path
= path
; /* Default quota check path */
2275 const pcre
*regex
= NULL
; /* Regex for file size from file name */
2277 if (!check_creation(string_sprintf("%s/any", path
), ob
->create_file
))
2279 addr
->basic_errno
= ERRNO_BADCREATE
;
2280 addr
->message
= string_sprintf("tried to create file in %s, but "
2281 "file creation outside the home directory is not permitted", path
);
2285 #ifdef SUPPORT_MAILDIR
2286 /* For a maildir delivery, ensure that all the relevant directories exist,
2287 and a maildirfolder file if necessary. */
2289 if (mbformat
== mbf_maildir
&& !maildir_ensure_directories(path
, addr
,
2290 ob
->create_directory
, ob
->dirmode
, ob
->maildirfolder_create_regex
))
2292 #endif /* SUPPORT_MAILDIR */
2294 /* If we are going to do a quota check, of if maildir_use_size_file is set
2295 for a maildir delivery, compile the regular expression if there is one. We
2296 may also need to adjust the path that is used. We need to do this for
2297 maildir_use_size_file even if the quota is unset, because we still want to
2298 create the file. When maildir support is not compiled,
2299 ob->maildir_use_size_file is always FALSE. */
2301 if (ob
->quota_value
> 0 || THRESHOLD_CHECK
|| ob
->maildir_use_size_file
)
2303 const uschar
*error
;
2306 /* Compile the regex if there is one. */
2308 if (ob
->quota_size_regex
!= NULL
)
2310 regex
= pcre_compile(CS ob
->quota_size_regex
, PCRE_COPT
,
2311 (const char **)&error
, &offset
, NULL
);
2314 addr
->message
= string_sprintf("appendfile: regular expression "
2315 "error: %s at offset %d while compiling %s", error
, offset
,
2316 ob
->quota_size_regex
);
2319 DEBUG(D_transport
) debug_printf("using regex for file sizes: %s\n",
2320 ob
->quota_size_regex
);
2323 /* Use an explicitly configured directory if set */
2325 if (ob
->quota_directory
!= NULL
)
2327 check_path
= expand_string(ob
->quota_directory
);
2328 if (check_path
== NULL
)
2330 addr
->transport_return
= PANIC
;
2331 addr
->message
= string_sprintf("Expansion of \"%s\" (quota_directory "
2332 "name for %s transport) failed: %s", ob
->quota_directory
,
2333 tblock
->name
, expand_string_message
);
2337 if (check_path
[0] != '/')
2339 addr
->message
= string_sprintf("appendfile: quota_directory name "
2340 "\"%s\" is not absolute", check_path
);
2341 addr
->basic_errno
= ERRNO_NOTABSOLUTE
;
2346 #ifdef SUPPORT_MAILDIR
2347 /* Otherwise, if we are handling a maildir delivery, and the directory
2348 contains a file called maildirfolder, this is a maildir++ feature telling
2349 us that this is a sub-directory of the real inbox. We should therefore do
2350 the quota check on the parent directory. Beware of the special case when
2351 the directory name itself ends in a slash. */
2353 else if (mbformat
== mbf_maildir
)
2355 struct stat statbuf
;
2356 if (Ustat(string_sprintf("%s/maildirfolder", path
), &statbuf
) >= 0)
2358 uschar
*new_check_path
= string_copy(check_path
);
2359 uschar
*slash
= Ustrrchr(new_check_path
, '/');
2365 slash
= Ustrrchr(new_check_path
, '/');
2370 check_path
= new_check_path
;
2371 DEBUG(D_transport
) debug_printf("maildirfolder file exists: "
2372 "quota check directory changed to %s\n", check_path
);
2377 #endif /* SUPPORT_MAILDIR */
2380 /* If we are using maildirsize files, we need to ensure that such a file
2381 exists and, if necessary, recalculate its contents. As a byproduct of this,
2382 we obtain the current size of the maildir. If no quota is to be enforced
2383 (ob->quota_value == 0), we still need the size if a threshold check will
2386 Another regular expression is used to determine which directories inside the
2387 maildir are going to be counted. */
2389 #ifdef SUPPORT_MAILDIR
2390 if (ob
->maildir_use_size_file
)
2392 const pcre
*dir_regex
= NULL
;
2393 const uschar
*error
;
2396 if (ob
->maildir_dir_regex
!= NULL
)
2398 int check_path_len
= Ustrlen(check_path
);
2400 dir_regex
= pcre_compile(CS ob
->maildir_dir_regex
, PCRE_COPT
,
2401 (const char **)&error
, &offset
, NULL
);
2402 if (dir_regex
== NULL
)
2404 addr
->message
= string_sprintf("appendfile: regular expression "
2405 "error: %s at offset %d while compiling %s", error
, offset
,
2406 ob
->maildir_dir_regex
);
2411 debug_printf("using regex for maildir directory selection: %s\n",
2412 ob
->maildir_dir_regex
);
2414 /* Check to see if we are delivering into an ignored directory, that is,
2415 if the delivery path starts with the quota check path, and the rest
2416 of the deliver path matches the regex; if so, set a flag to disable quota
2417 checking and maildirsize updating. */
2419 if (Ustrncmp(path
, check_path
, check_path_len
) == 0)
2421 uschar
*s
= path
+ check_path_len
;
2422 while (*s
== '/') s
++;
2423 s
= (*s
== 0) ? US
"new" : string_sprintf("%s/new", s
);
2424 if (pcre_exec(dir_regex
, NULL
, CS s
, Ustrlen(s
), 0, 0, NULL
, 0) < 0)
2426 disable_quota
= TRUE
;
2427 DEBUG(D_transport
) debug_printf("delivery directory does not match "
2428 "maildir_quota_directory_regex: disabling quota\n");
2433 /* Quota enforcement; create and check the file. There is some discussion
2434 about whether this should happen if the quota is unset. At present, Exim
2435 always creates the file. If we ever want to change this, uncomment
2436 appropriate lines below, possibly doing a check on some option. */
2438 /* if (???? || ob->quota_value > 0) */
2445 maildirsize_fd
= maildir_ensure_sizefile(check_path
, ob
, regex
, dir_regex
,
2448 if (maildirsize_fd
== -1)
2450 addr
->basic_errno
= errno
;
2451 addr
->message
= string_sprintf("while opening or reading "
2452 "%s/maildirsize", check_path
);
2455 /* can also return -2, which means that the file was removed because of
2456 raciness; but in this case, the size & filecount will still have been
2459 if (mailbox_size
< 0) mailbox_size
= size
;
2460 if (mailbox_filecount
< 0) mailbox_filecount
= filecount
;
2463 /* No quota enforcement; ensure file does *not* exist; calculate size if
2468 * time_t old_latest;
2469 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2470 * if (THRESHOLD_CHECK)
2471 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2472 * regex, dir_regex, FALSE);
2477 #endif /* SUPPORT_MAILDIR */
2479 /* Otherwise if we are going to do a quota check later on, and the mailbox
2480 size is not set, find the current size of the mailbox. Ditto for the file
2481 count. Note that ob->quota_filecount_value cannot be set without
2482 ob->quota_value being set. */
2484 if (!disable_quota
&&
2485 (ob
->quota_value
> 0 || THRESHOLD_CHECK
) &&
2486 (mailbox_size
< 0 ||
2487 (mailbox_filecount
< 0 && ob
->quota_filecount_value
> 0)))
2492 debug_printf("quota checks on directory %s\n", check_path
);
2493 size
= check_dir_size(check_path
, &filecount
, regex
);
2494 if (mailbox_size
< 0) mailbox_size
= size
;
2495 if (mailbox_filecount
< 0) mailbox_filecount
= filecount
;
2498 /* Handle the case of creating a unique file in a given directory (not in
2499 maildir or mailstore format - this is how smail did it). A temporary name is
2500 used to create the file. Later, when it is written, the name is changed to a
2501 unique one. There is no need to lock the file. An attempt is made to create
2502 the directory if it does not exist. */
2504 if (mbformat
== mbf_smail
)
2507 debug_printf("delivering to new file in %s\n", path
);
2508 filename
= dataname
=
2509 string_sprintf("%s/temp.%d.%s", path
, (int)getpid(), primary_hostname
);
2510 fd
= Uopen(filename
, O_WRONLY
|O_CREAT
, mode
);
2511 if (fd
< 0 && /* failed to open, and */
2512 (errno
!= ENOENT
|| /* either not non-exist */
2513 !ob
->create_directory
|| /* or not allowed to make */
2514 !directory_make(NULL
, path
, ob
->dirmode
, FALSE
) || /* or failed to create dir */
2515 (fd
= Uopen(filename
, O_WRONLY
|O_CREAT
|O_EXCL
, mode
)) < 0)) /* or then failed to open */
2517 addr
->basic_errno
= errno
;
2518 addr
->message
= string_sprintf("while creating file %s", filename
);
2523 #ifdef SUPPORT_MAILDIR
2525 /* Handle the case of a unique file in maildir format. The file is written to
2526 the tmp subdirectory, with a prescribed form of name. */
2528 else if (mbformat
== mbf_maildir
)
2531 debug_printf("delivering in maildir format in %s\n", path
);
2533 nametag
= ob
->maildir_tag
;
2535 /* Check that nametag expands successfully; a hard failure causes a panic
2536 return. The actual expansion for use happens again later, when
2537 $message_size is accurately known. */
2539 if (nametag
!= NULL
&& expand_string(nametag
) == NULL
&&
2540 !f
.expand_string_forcedfail
)
2542 addr
->transport_return
= PANIC
;
2543 addr
->message
= string_sprintf("Expansion of \"%s\" (maildir_tag "
2544 "for %s transport) failed: %s", nametag
, tblock
->name
,
2545 expand_string_message
);
2549 /* We ensured the existence of all the relevant directories above. Attempt
2550 to open the temporary file a limited number of times. I think this rather
2551 scary-looking for statement is actually OK. If open succeeds, the loop is
2552 broken; if not, there is a test on the value of i. Get the time again
2553 afresh each time round the loop. Its value goes into a variable that is
2554 checked at the end, to make sure we don't release this process until the
2555 clock has ticked. */
2557 for (int i
= 1;; i
++)
2561 (void)gettimeofday(&msg_tv
, NULL
);
2562 basename
= string_sprintf(TIME_T_FMT
".H%luP" PID_T_FMT
".%s",
2563 msg_tv
.tv_sec
, msg_tv
.tv_usec
, getpid(), primary_hostname
);
2565 filename
= dataname
= string_sprintf("tmp/%s", basename
);
2566 newname
= string_sprintf("new/%s", basename
);
2568 if (Ustat(filename
, &statbuf
) == 0)
2570 else if (errno
== ENOENT
)
2572 fd
= Uopen(filename
, O_WRONLY
| O_CREAT
| O_EXCL
, mode
);
2574 DEBUG (D_transport
) debug_printf ("open failed for %s: %s\n",
2575 filename
, strerror(errno
));
2578 /* Too many retries - give up */
2580 if (i
>= ob
->maildir_retries
)
2582 addr
->message
= string_sprintf ("failed to open %s (%d tr%s)",
2583 filename
, i
, (i
== 1) ? "y" : "ies");
2584 addr
->basic_errno
= errno
;
2585 if (errno
== errno_quota
|| errno
== ENOSPC
)
2586 addr
->user_message
= US
"mailbox is full";
2590 /* Open or stat failed but we haven't tried too many times yet. */
2595 /* Note that we have to ensure the clock has ticked before leaving */
2597 wait_for_tick
= TRUE
;
2599 /* Why are these here? Put in because they are present in the non-maildir
2600 directory case above. */
2602 if(exim_chown(filename
, uid
, gid
) || Uchmod(filename
, mode
))
2604 addr
->basic_errno
= errno
;
2605 addr
->message
= string_sprintf("while setting perms on maildir %s",
2611 #endif /* SUPPORT_MAILDIR */
2613 #ifdef SUPPORT_MAILSTORE
2615 /* Handle the case of a unique file in mailstore format. First write the
2616 envelope to a temporary file, then open the main file. The unique base name
2617 for the files consists of the message id plus the pid of this delivery
2623 mailstore_basename
= string_sprintf("%s/%s-%s", path
, message_id
,
2624 string_base62((long int)getpid()));
2627 debug_printf("delivering in mailstore format in %s\n", path
);
2629 filename
= string_sprintf("%s.tmp", mailstore_basename
);
2630 newname
= string_sprintf("%s.env", mailstore_basename
);
2631 dataname
= string_sprintf("%s.msg", mailstore_basename
);
2633 fd
= Uopen(filename
, O_WRONLY
|O_CREAT
|O_EXCL
, mode
);
2634 if (fd
< 0 && /* failed to open, and */
2635 (errno
!= ENOENT
|| /* either not non-exist */
2636 !ob
->create_directory
|| /* or not allowed to make */
2637 !directory_make(NULL
, path
, ob
->dirmode
, FALSE
) || /* or failed to create dir */
2638 (fd
= Uopen(filename
, O_WRONLY
|O_CREAT
|O_EXCL
, mode
)) < 0)) /* or then failed to open */
2640 addr
->basic_errno
= errno
;
2641 addr
->message
= string_sprintf("while creating file %s", filename
);
2645 /* Why are these here? Put in because they are present in the non-maildir
2646 directory case above. */
2648 if(exim_chown(filename
, uid
, gid
) || Uchmod(filename
, mode
))
2650 addr
->basic_errno
= errno
;
2651 addr
->message
= string_sprintf("while setting perms on file %s",
2656 /* Built a C stream from the open file descriptor. */
2658 if ((env_file
= fdopen(fd
, "wb")) == NULL
)
2660 addr
->basic_errno
= errno
;
2661 addr
->transport_return
= PANIC
;
2662 addr
->message
= string_sprintf("fdopen of %s ("
2663 "for %s transport) failed", filename
, tblock
->name
);
2669 /* Write the envelope file, then close it. */
2671 if (ob
->mailstore_prefix
!= NULL
)
2673 uschar
*s
= expand_string(ob
->mailstore_prefix
);
2676 if (!f
.expand_string_forcedfail
)
2678 addr
->transport_return
= PANIC
;
2679 addr
->message
= string_sprintf("Expansion of \"%s\" (mailstore "
2680 "prefix for %s transport) failed: %s", ob
->mailstore_prefix
,
2681 tblock
->name
, expand_string_message
);
2682 (void)fclose(env_file
);
2690 fprintf(env_file
, "%s", CS s
);
2691 if (n
== 0 || s
[n
-1] != '\n') fprintf(env_file
, "\n");
2695 fprintf(env_file
, "%s\n", sender_address
);
2697 for (address_item
* taddr
= addr
; taddr
; taddr
= taddr
->next
)
2698 fprintf(env_file
, "%s@%s\n", taddr
->local_part
, taddr
->domain
);
2700 if (ob
->mailstore_suffix
!= NULL
)
2702 uschar
*s
= expand_string(ob
->mailstore_suffix
);
2705 if (!f
.expand_string_forcedfail
)
2707 addr
->transport_return
= PANIC
;
2708 addr
->message
= string_sprintf("Expansion of \"%s\" (mailstore "
2709 "suffix for %s transport) failed: %s", ob
->mailstore_suffix
,
2710 tblock
->name
, expand_string_message
);
2711 (void)fclose(env_file
);
2719 fprintf(env_file
, "%s", CS s
);
2720 if (n
== 0 || s
[n
-1] != '\n') fprintf(env_file
, "\n");
2724 if (fclose(env_file
) != 0)
2726 addr
->basic_errno
= errno
;
2727 addr
->message
= string_sprintf("while closing %s", filename
);
2732 DEBUG(D_transport
) debug_printf("Envelope file %s written\n", filename
);
2734 /* Now open the data file, and ensure that it has the correct ownership and
2737 fd
= Uopen(dataname
, O_WRONLY
|O_CREAT
|O_EXCL
, mode
);
2740 addr
->basic_errno
= errno
;
2741 addr
->message
= string_sprintf("while creating file %s", dataname
);
2745 if(exim_chown(dataname
, uid
, gid
) || Uchmod(dataname
, mode
))
2747 addr
->basic_errno
= errno
;
2748 addr
->message
= string_sprintf("while setting perms on file %s",
2754 #endif /* SUPPORT_MAILSTORE */
2757 /* In all cases of writing to a new file, ensure that the file which is
2758 going to be renamed has the correct ownership and mode. */
2760 if(exim_chown(filename
, uid
, gid
) || Uchmod(filename
, mode
))
2762 addr
->basic_errno
= errno
;
2763 addr
->message
= string_sprintf("while setting perms on file %s",
2770 /* At last we can write the message to the file, preceded by any configured
2771 prefix line, and followed by any configured suffix line. If there are any
2772 writing errors, we must defer. */
2774 DEBUG(D_transport
) debug_printf("writing to file %s\n", dataname
);
2779 /* If there is a local quota setting, check that we are not going to exceed it
2780 with this message if quota_is_inclusive is set; if it is not set, the check
2781 is for the mailbox already being over quota (i.e. the current message is not
2782 included in the check). */
2784 if (!disable_quota
&& ob
->quota_value
> 0)
2788 debug_printf("Exim quota = " OFF_T_FMT
" old size = " OFF_T_FMT
2789 " this message = %d (%sincluded)\n",
2790 ob
->quota_value
, mailbox_size
, message_size
,
2791 ob
->quota_is_inclusive
? "" : "not ");
2792 debug_printf(" file count quota = %d count = %d\n",
2793 ob
->quota_filecount_value
, mailbox_filecount
);
2796 if (mailbox_size
+ (ob
->quota_is_inclusive
? message_size
:0) > ob
->quota_value
)
2799 if (!ob
->quota_no_check
)
2801 DEBUG(D_transport
) debug_printf("mailbox quota exceeded\n");
2803 errno
= ERRNO_EXIMQUOTA
;
2805 else DEBUG(D_transport
) debug_printf("mailbox quota exceeded but ignored\n");
2809 if (ob
->quota_filecount_value
> 0
2810 && mailbox_filecount
+ (ob
->quota_is_inclusive
? 1:0) >
2811 ob
->quota_filecount_value
)
2812 if(!ob
->quota_filecount_no_check
)
2814 DEBUG(D_transport
) debug_printf("mailbox file count quota exceeded\n");
2816 errno
= ERRNO_EXIMQUOTA
;
2817 filecount_msg
= US
" filecount";
2819 else DEBUG(D_transport
) if (ob
->quota_filecount_no_check
)
2820 debug_printf("mailbox file count quota exceeded but ignored\n");
2824 /* If we are writing in MBX format, what we actually do is to write the message
2825 to a temporary file, and then copy it to the real file once we know its size.
2826 This is the most straightforward way of getting the correct length in the
2827 separator line. So, what we do here is to save the real file descriptor, and
2828 replace it with one for a temporary file. The temporary file gets unlinked once
2829 opened, so that it goes away on closure. */
2832 if (yield
== OK
&& ob
->mbx_format
)
2834 temp_file
= tmpfile();
2835 if (temp_file
== NULL
)
2837 addr
->basic_errno
= errno
;
2838 addr
->message
= US
"while setting up temporary file";
2843 fd
= fileno(temp_file
);
2844 DEBUG(D_transport
) debug_printf("writing to temporary file\n");
2846 #endif /* SUPPORT_MBX */
2848 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2851 transport_count
= 0;
2852 transport_newlines
= 0;
2854 /* Write any configured prefix text first */
2856 if (yield
== OK
&& ob
->message_prefix
!= NULL
&& ob
->message_prefix
[0] != 0)
2858 uschar
*prefix
= expand_string(ob
->message_prefix
);
2861 errno
= ERRNO_EXPANDFAIL
;
2862 addr
->transport_return
= PANIC
;
2863 addr
->message
= string_sprintf("Expansion of \"%s\" (prefix for %s "
2864 "transport) failed", ob
->message_prefix
, tblock
->name
);
2867 else if (!transport_write_string(fd
, "%s", prefix
)) yield
= DEFER
;
2870 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2871 various different values for batching are handled outside; if there is more
2872 than one address available here, all must be included. If any address is a
2873 file, use its parent in the RCPT TO. */
2875 if (yield
== OK
&& ob
->use_bsmtp
)
2877 transport_count
= 0;
2878 transport_newlines
= 0;
2879 if (ob
->use_crlf
) cr
= US
"\r";
2880 if (!transport_write_string(fd
, "MAIL FROM:<%s>%s\n", return_path
, cr
))
2884 transport_newlines
++;
2885 for (address_item
* a
= addr
; a
!= NULL
; a
= a
->next
)
2887 address_item
*b
= testflag(a
, af_pfr
) ? a
->parent
: a
;
2888 if (!transport_write_string(fd
, "RCPT TO:<%s>%s\n",
2889 transport_rcpt_address(b
, tblock
->rcpt_include_affixes
), cr
))
2890 { yield
= DEFER
; break; }
2891 transport_newlines
++;
2893 if (yield
== OK
&& !transport_write_string(fd
, "DATA%s\n", cr
))
2896 transport_newlines
++;
2900 /* Now the message itself. The options for transport_write_message were set up
2901 at initialization time. */
2905 transport_ctx tctx
= {
2909 .check_string
= ob
->check_string
,
2910 .escape_string
= ob
->escape_string
,
2911 .options
= ob
->options
| topt_not_socket
2913 if (!transport_write_message(&tctx
, 0))
2917 /* Now a configured suffix. */
2919 if (yield
== OK
&& ob
->message_suffix
!= NULL
&& ob
->message_suffix
[0] != 0)
2921 uschar
*suffix
= expand_string(ob
->message_suffix
);
2924 errno
= ERRNO_EXPANDFAIL
;
2925 addr
->transport_return
= PANIC
;
2926 addr
->message
= string_sprintf("Expansion of \"%s\" (suffix for %s "
2927 "transport) failed", ob
->message_suffix
, tblock
->name
);
2930 else if (!transport_write_string(fd
, "%s", suffix
)) yield
= DEFER
;
2933 /* If batch smtp, write the terminating dot. */
2935 if (yield
== OK
&& ob
->use_bsmtp
) {
2936 if(!transport_write_string(fd
, ".%s\n", cr
)) yield
= DEFER
;
2937 else transport_newlines
++;
2940 /* If MBX format is being used, all that writing was to the temporary file.
2941 However, if there was an earlier failure (Exim quota exceeded, for example),
2942 the temporary file won't have got opened - and no writing will have been done.
2943 If writing was OK, we restore the fd, and call a function that copies the
2944 message in MBX format into the real file. Otherwise use the temporary name in
2948 if (temp_file
!= NULL
&& ob
->mbx_format
)
2955 transport_count
= 0; /* Reset transport count for actual write */
2956 /* No need to reset transport_newlines as we're just using a block copy
2957 * routine so the number won't be affected */
2958 yield
= copy_mbx_message(fd
, fileno(temp_file
), saved_size
);
2960 else if (errno
>= 0) dataname
= US
"temporary file";
2962 /* Preserve errno while closing the temporary file. */
2964 mbx_save_errno
= errno
;
2965 (void)fclose(temp_file
);
2966 errno
= mbx_save_errno
;
2968 #endif /* SUPPORT_MBX */
2970 /* Force out the remaining data to check for any errors; some OS don't allow
2971 fsync() to be called for a FIFO. */
2973 if (yield
== OK
&& !isfifo
&& EXIMfsync(fd
) < 0) yield
= DEFER
;
2975 /* Update message_size and message_linecount to the accurate count of bytes
2976 written, including added headers. Note; we subtract 1 from message_linecount as
2977 this variable doesn't count the new line between the header and the body of the
2980 message_size
= transport_count
;
2981 message_linecount
= transport_newlines
- 1;
2983 /* If using a maildir++ quota file, add this message's size to it, and
2984 close the file descriptor, except when the quota has been disabled because we
2985 are delivering into an uncounted folder. */
2987 #ifdef SUPPORT_MAILDIR
2990 if (yield
== OK
&& maildirsize_fd
>= 0)
2991 maildir_record_length(maildirsize_fd
, message_size
);
2992 maildir_save_errno
= errno
; /* Preserve errno while closing the file */
2993 if (maildirsize_fd
>= 0)
2994 (void)close(maildirsize_fd
);
2995 errno
= maildir_save_errno
;
2997 #endif /* SUPPORT_MAILDIR */
2999 /* If there is a quota warning threshold and we are have crossed it with this
3000 message, set the SPECIAL_WARN flag in the address, to cause a warning message
3003 if (!disable_quota
&& THRESHOLD_CHECK
)
3005 off_t threshold
= ob
->quota_warn_threshold_value
;
3006 if (ob
->quota_warn_threshold_is_percent
)
3007 threshold
= (off_t
)(((double)ob
->quota_value
* threshold
) / 100);
3009 debug_printf("quota = " OFF_T_FMT
3010 " threshold = " OFF_T_FMT
3011 " old size = " OFF_T_FMT
3012 " message size = %d\n",
3013 ob
->quota_value
, threshold
, mailbox_size
,
3015 if (mailbox_size
<= threshold
&& mailbox_size
+ message_size
> threshold
)
3016 addr
->special_action
= SPECIAL_WARN
;
3018 /******* You might think that the test ought to be this:
3020 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
3021 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
3023 * (indeed, I was sent a patch with that in). However, it is possible to
3024 * have a warning threshold without actually imposing a quota, and I have
3025 * therefore kept Exim backwards compatible.
3030 /* Handle error while writing the file. Control should come here directly after
3031 the error, with the reason in errno. In the case of expansion failure in prefix
3032 or suffix, it will be ERRNO_EXPANDFAIL. */
3036 addr
->special_action
= SPECIAL_NONE
; /* Cancel any quota warning */
3038 /* Save the error number. If positive, it will ultimately cause a strerror()
3039 call to generate some text. */
3041 addr
->basic_errno
= errno
;
3043 /* For system or Exim quota excession, or disk full, set more_errno to the
3044 time since the file was last read. If delivery was into a directory, the
3045 time since last read logic is not relevant, in general. However, for maildir
3046 deliveries we can approximate it by looking at the last modified time of the
3047 "new" subdirectory. Since Exim won't be adding new messages, a change to the
3048 "new" subdirectory implies that an MUA has moved a message from there to the
3051 if (errno
== errno_quota
|| errno
== ERRNO_EXIMQUOTA
|| errno
== ENOSPC
)
3053 addr
->more_errno
= 0;
3054 if (!isdirectory
) addr
->more_errno
= (int)(time(NULL
) - times
.actime
);
3056 #ifdef SUPPORT_MAILDIR
3057 else if (mbformat
== mbf_maildir
)
3059 struct stat statbuf
;
3060 if (Ustat("new", &statbuf
) < 0)
3062 DEBUG(D_transport
) debug_printf("maildir quota exceeded: "
3063 "stat error %d for \"new\": %s\n", errno
, strerror(errno
));
3065 else /* Want a repeatable time when in test harness */
3067 addr
->more_errno
= f
.running_in_test_harness
? 10 :
3068 (int)time(NULL
) - statbuf
.st_mtime
;
3071 debug_printf("maildir: time since \"new\" directory modified = %s\n",
3072 readconf_printtime(addr
->more_errno
));
3074 #endif /* SUPPORT_MAILDIR */
3077 /* Handle system quota excession. Add an explanatory phrase for the error
3078 message, since some systems don't have special quota-excession errors,
3079 and on those that do, "quota" doesn't always mean anything to the user. */
3081 if (errno
== errno_quota
)
3084 addr
->message
= string_sprintf("mailbox is full "
3085 "(quota exceeded while writing to file %s)", filename
);
3087 addr
->message
= US
"mailbox is full";
3089 addr
->user_message
= US
"mailbox is full";
3090 DEBUG(D_transport
) debug_printf("System quota exceeded for %s%s%s\n",
3092 isdirectory
? US
"" : US
": time since file read = ",
3093 isdirectory
? US
"" : readconf_printtime(addr
->more_errno
));
3096 /* Handle Exim's own quota-imposition */
3098 else if (errno
== ERRNO_EXIMQUOTA
)
3100 addr
->message
= string_sprintf("mailbox is full "
3101 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg
,
3103 addr
->user_message
= US
"mailbox is full";
3104 DEBUG(D_transport
) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3105 filecount_msg
, dataname
,
3106 isdirectory
? US
"" : US
": time since file read = ",
3107 isdirectory
? US
"" : readconf_printtime(addr
->more_errno
));
3110 /* Handle a process failure while writing via a filter; the return
3111 from child_close() is in more_errno. */
3113 else if (errno
== ERRNO_FILTER_FAIL
)
3116 addr
->message
= string_sprintf("transport filter process failed (%d) "
3117 "while writing to %s%s", addr
->more_errno
, dataname
,
3118 (addr
->more_errno
== EX_EXECFAILED
) ? ": unable to execute command" : "");
3121 /* Handle failure to expand header changes */
3123 else if (errno
== ERRNO_CHHEADER_FAIL
)
3127 string_sprintf("failed to expand headers_add or headers_remove while "
3128 "writing to %s: %s", dataname
, expand_string_message
);
3131 /* Handle failure to complete writing of a data block */
3133 else if (errno
== ERRNO_WRITEINCOMPLETE
)
3135 addr
->message
= string_sprintf("failed to write data block while "
3136 "writing to %s", dataname
);
3139 /* Handle length mismatch on MBX copying */
3142 else if (errno
== ERRNO_MBXLENGTH
)
3144 addr
->message
= string_sprintf("length mismatch while copying MBX "
3145 "temporary file to %s", dataname
);
3147 #endif /* SUPPORT_MBX */
3149 /* For other errors, a general-purpose explanation, if the message is
3152 else if (addr
->message
== NULL
)
3153 addr
->message
= string_sprintf("error while writing to %s", dataname
);
3155 /* For a file, reset the file size to what it was before we started, leaving
3156 the last modification time unchanged, so it will get reset also. All systems
3157 investigated so far have ftruncate(), whereas not all have the F_FREESP
3158 fcntl() call (BSDI & FreeBSD do not). */
3160 if (!isdirectory
&& ftruncate(fd
, saved_size
))
3161 DEBUG(D_transport
) debug_printf("Error resetting file size\n");
3164 /* Handle successful writing - we want the modification time to be now for
3165 appended files. Remove the default backstop error number. For a directory, now
3166 is the time to rename the file with a unique name. As soon as such a name
3167 appears it may get used by another process, so we close the file first and
3168 check that all is well. */
3172 times
.modtime
= time(NULL
);
3173 addr
->basic_errno
= 0;
3175 /* Handle the case of writing to a new file in a directory. This applies
3176 to all single-file formats - maildir, mailstore, and "smail format". */
3180 if (fstat(fd
, &statbuf
) < 0)
3182 addr
->basic_errno
= errno
;
3183 addr
->message
= string_sprintf("while fstatting opened message file %s",
3188 else if (close(fd
) < 0)
3190 addr
->basic_errno
= errno
;
3191 addr
->message
= string_sprintf("close() error for %s",
3192 (ob
->mailstore_format
) ? dataname
: filename
);
3196 /* File is successfully written and closed. Arrange to rename it. For the
3197 different kinds of single-file delivery, some games can be played with the
3198 name. The message size is by this time set to the accurate value so that
3199 its value can be used in expansions. */
3203 uschar
*renamename
= newname
;
3206 DEBUG(D_transport
) debug_printf("renaming temporary file\n");
3208 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3209 situation. The name is built by expanding the directory_file option, and
3210 we make the inode number available for use in this. The expansion was
3211 checked for syntactic validity above, before we wrote the file.
3213 We have to be careful here, in case the file name exists. (In the other
3214 cases, the names used are constructed to be unique.) The rename()
3215 function just replaces an existing file - we don't want that! So instead
3216 of calling rename(), we must use link() and unlink().
3218 In this case, if the link fails because of an existing file, we wait
3219 for one second and try the expansion again, to see if it produces a
3220 different value. Do this up to 5 times unless the name stops changing.
3221 This makes it possible to build values that are based on the time, and
3222 still cope with races from multiple simultaneous deliveries. */
3224 if (newname
== NULL
)
3227 uschar
*old_renameleaf
= US
"";
3229 for (int i
= 0; ; sleep(1), i
++)
3231 deliver_inode
= statbuf
.st_ino
;
3232 renameleaf
= expand_string(ob
->dirfilename
);
3235 if (renameleaf
== NULL
)
3237 addr
->transport_return
= PANIC
;
3238 addr
->message
= string_sprintf("Expansion of \"%s\" "
3239 "(directory_file for %s transport) failed: %s",
3240 ob
->dirfilename
, tblock
->name
, expand_string_message
);
3244 renamename
= string_sprintf("%s/%s", path
, renameleaf
);
3245 if (Ulink(filename
, renamename
) < 0)
3247 DEBUG(D_transport
) debug_printf("link failed: %s\n",
3249 if (errno
!= EEXIST
|| i
>= 4 ||
3250 Ustrcmp(renameleaf
, old_renameleaf
) == 0)
3252 addr
->basic_errno
= errno
;
3253 addr
->message
= string_sprintf("while renaming %s as %s",
3254 filename
, renamename
);
3258 old_renameleaf
= renameleaf
;
3259 DEBUG(D_transport
) debug_printf("%s exists - trying again\n",
3268 } /* re-expand loop */
3269 } /* not mailstore or maildir */
3271 /* For maildir and mailstore formats, the new name was created earlier,
3272 except that for maildir, there is the possibility of adding a "tag" on
3273 the end of the name by expanding the value of nametag. This usually
3274 includes a reference to the message size. The expansion of nametag was
3275 checked above, before the file was opened. It either succeeded, or
3276 provoked a soft failure. So any failure here can be treated as soft.
3277 Ignore non-printing characters and / and put a colon at the start if the
3278 first character is alphanumeric. */
3282 if (nametag
!= NULL
)
3284 uschar
*iptr
= expand_string(nametag
);
3287 uschar
*etag
= store_get(Ustrlen(iptr
) + 2, is_tainted(iptr
));
3288 uschar
*optr
= etag
;
3291 if (mac_isgraph(*iptr
) && *iptr
!= '/')
3293 if (optr
== etag
&& isalnum(*iptr
)) *optr
++ = ':';
3299 renamename
= string_sprintf("%s%s", newname
, etag
);
3303 /* Do the rename. If the name is too long and a tag exists, try again
3306 if (Urename(filename
, renamename
) < 0 &&
3307 (nametag
== NULL
|| errno
!= ENAMETOOLONG
||
3308 (renamename
= newname
, Urename(filename
, renamename
) < 0)))
3310 addr
->basic_errno
= errno
;
3311 addr
->message
= string_sprintf("while renaming %s as %s",
3312 filename
, renamename
);
3316 /* Rename succeeded */
3320 DEBUG(D_transport
) debug_printf("renamed %s as %s\n", filename
,
3322 filename
= dataname
= NULL
; /* Prevents attempt to unlink at end */
3324 } /* maildir or mailstore */
3325 } /* successful write + close */
3327 } /* write success */
3330 /* For a file, restore the last access time (atime), and set the modification
3331 time as required - changed if write succeeded, unchanged if not. */
3333 if (!isdirectory
) utime(CS filename
, ×
);
3335 /* Notify comsat if configured to do so. It only makes sense if the configured
3336 file is the one that the comsat daemon knows about. */
3338 if (ob
->notify_comsat
&& yield
== OK
&& deliver_localpart
!= NULL
)
3339 notify_comsat(deliver_localpart
, saved_size
);
3341 /* Pass back the final return code in the address structure */
3344 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3345 yield
, addr
->basic_errno
, addr
->more_errno
);
3347 addr
->transport_return
= yield
;
3349 /* Close the file, which will release the fcntl lock. For a directory write it
3350 is closed above, except in cases of error which goto RETURN, when we also need
3351 to remove the original file(s). For MBX locking, if all has gone well, before
3352 closing the file, see if we can get an exclusive lock on it, in which case we
3353 can unlink the /tmp lock file before closing it. This is always a non-blocking
3354 lock; there's no need to wait if we can't get it. If everything has gone right
3355 but close fails, defer the message. Then unlink the lock file, if present. This
3356 point in the code is jumped to from a number of places when errors are
3357 detected, in order to get the file closed and the lock file tidied away. */
3362 if (mbx_lockfd
>= 0)
3364 if (yield
== OK
&& apply_lock(fd
, F_WRLCK
, ob
->use_fcntl
, 0,
3365 ob
->use_flock
, 0) >= 0)
3368 debug_printf("unlinking MBX lock file %s\n", mbx_lockname
);
3369 Uunlink(mbx_lockname
);
3371 (void)close(mbx_lockfd
);
3373 #endif /* SUPPORT_MBX */
3375 if (fd
>= 0 && close(fd
) < 0 && yield
== OK
)
3377 addr
->basic_errno
= errno
;
3378 addr
->message
= string_sprintf("while closing %s", filename
);
3379 addr
->transport_return
= DEFER
;
3382 if (hd
>= 0) Uunlink(lockname
);
3384 /* We get here with isdirectory and filename set only in error situations. */
3386 if (isdirectory
&& filename
!= NULL
)
3389 if (dataname
!= filename
) Uunlink(dataname
);
3392 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3393 file name relies on time + pid. We must not allow the process to finish until
3394 the clock has move on by at least one microsecond. Usually we expect this
3395 already to be the case, but machines keep getting faster... */
3397 if (wait_for_tick
) exim_wait_tick(&msg_tv
, 1);
3399 /* A return of FALSE means that if there was an error, a common error was
3400 put in the first address of a batch. */
3405 #endif /*!MACRO_PREDEF*/
3406 /* End of transport/appendfile.c */