1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
10 #include "appendfile.h"
12 #ifdef SUPPORT_MAILDIR
13 #include "tf_maildir.h"
17 /* Options specific to the appendfile transport. They must be in alphabetic
18 order (note that "_" comes before the lower case letters). Some of them are
19 stored in the publicly visible instance block - these are flagged with the
22 optionlist appendfile_transport_options[] = {
23 #ifdef SUPPORT_MAILDIR
24 { "*expand_maildir_use_size_file", opt_stringptr,
25 (void *)offsetof(appendfile_transport_options_block, expand_maildir_use_size_file) },
27 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
28 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
29 { "*set_use_flock_lock",opt_bool | opt_hidden,
30 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
31 { "*set_use_lockfile", opt_bool | opt_hidden,
32 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
34 { "*set_use_mbx_lock", opt_bool | opt_hidden,
35 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
37 { "allow_fifo", opt_bool,
38 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
39 { "allow_symlink", opt_bool,
40 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
41 { "batch_id", opt_stringptr | opt_public,
42 (void *)offsetof(transport_instance, batch_id) },
43 { "batch_max", opt_int | opt_public,
44 (void *)offsetof(transport_instance, batch_max) },
45 { "check_group", opt_bool,
46 (void *)offsetof(appendfile_transport_options_block, check_group) },
47 { "check_owner", opt_bool,
48 (void *)offsetof(appendfile_transport_options_block, check_owner) },
49 { "check_string", opt_stringptr,
50 (void *)offsetof(appendfile_transport_options_block, check_string) },
51 { "create_directory", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, create_directory) },
53 { "create_file", opt_stringptr,
54 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
55 { "directory", opt_stringptr,
56 (void *)offsetof(appendfile_transport_options_block, dirname) },
57 { "directory_file", opt_stringptr,
58 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
59 { "directory_mode", opt_octint,
60 (void *)offsetof(appendfile_transport_options_block, dirmode) },
61 { "escape_string", opt_stringptr,
62 (void *)offsetof(appendfile_transport_options_block, escape_string) },
63 { "file", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, filename) },
65 { "file_format", opt_stringptr,
66 (void *)offsetof(appendfile_transport_options_block, file_format) },
67 { "file_must_exist", opt_bool,
68 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
69 { "lock_fcntl_timeout", opt_time,
70 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
71 { "lock_flock_timeout", opt_time,
72 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
73 { "lock_interval", opt_time,
74 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
75 { "lock_retries", opt_int,
76 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
77 { "lockfile_mode", opt_octint,
78 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
79 { "lockfile_timeout", opt_time,
80 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
81 { "mailbox_filecount", opt_stringptr,
82 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
83 { "mailbox_size", opt_stringptr,
84 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
85 #ifdef SUPPORT_MAILDIR
86 { "maildir_format", opt_bool,
87 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
88 { "maildir_quota_directory_regex", opt_stringptr,
89 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
90 { "maildir_retries", opt_int,
91 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
92 { "maildir_tag", opt_stringptr,
93 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
94 { "maildir_use_size_file", opt_expand_bool,
95 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
96 { "maildirfolder_create_regex", opt_stringptr,
97 (void *)offsetof(appendfile_transport_options_block, maildirfolder_create_regex ) },
98 #endif /* SUPPORT_MAILDIR */
99 #ifdef SUPPORT_MAILSTORE
100 { "mailstore_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
102 { "mailstore_prefix", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
104 { "mailstore_suffix", opt_stringptr,
105 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
106 #endif /* SUPPORT_MAILSTORE */
108 { "mbx_format", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
110 #endif /* SUPPORT_MBX */
111 { "message_prefix", opt_stringptr,
112 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
113 { "message_suffix", opt_stringptr,
114 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
115 { "mode", opt_octint,
116 (void *)offsetof(appendfile_transport_options_block, mode) },
117 { "mode_fail_narrower",opt_bool,
118 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
119 { "notify_comsat", opt_bool,
120 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
121 { "quota", opt_stringptr,
122 (void *)offsetof(appendfile_transport_options_block, quota) },
123 { "quota_directory", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
125 { "quota_filecount", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
127 { "quota_is_inclusive", opt_bool,
128 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
129 { "quota_size_regex", opt_stringptr,
130 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
131 { "quota_warn_message", opt_stringptr | opt_public,
132 (void *)offsetof(transport_instance, warn_message) },
133 { "quota_warn_threshold", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
135 { "use_bsmtp", opt_bool,
136 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
137 { "use_crlf", opt_bool,
138 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
139 { "use_fcntl_lock", opt_bool_set,
140 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
141 { "use_flock_lock", opt_bool_set,
142 (void *)offsetof(appendfile_transport_options_block, use_flock) },
143 { "use_lockfile", opt_bool_set,
144 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
146 { "use_mbx_lock", opt_bool_set,
147 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
148 #endif /* SUPPORT_MBX */
151 /* Size of the options list. An extern variable has to be used so that its
152 address can appear in the tables drtables.c. */
154 int appendfile_transport_options_count =
155 sizeof(appendfile_transport_options)/sizeof(optionlist);
161 appendfile_transport_options_block appendfile_transport_option_defaults = {0};
162 void appendfile_transport_init(transport_instance *tblock) {}
163 BOOL appendfile_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
165 #else /*!MACRO_PREDEF*/
167 /* Default private options block for the appendfile transport. */
169 appendfile_transport_options_block appendfile_transport_option_defaults = {
172 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
173 NULL, /* message_prefix (default reset in init if not bsmtp) */
174 NULL, /* message_suffix (ditto) */
175 US"anywhere", /* create_file_string (string value for create_file) */
177 NULL, /* quota_directory */
178 NULL, /* quota_filecount */
179 NULL, /* quota_size_regex */
180 NULL, /* quota_warn_threshold */
181 NULL, /* mailbox_size_string */
182 NULL, /* mailbox_filecount_string */
183 NULL, /* expand_maildir_use_size_file */
184 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
185 NULL, /* maildir_tag */
186 NULL, /* maildirfolder_create_regex */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
193 0, /* quota_warn_threshold_value */
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
196 0, /* quota_filecount_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE, /* quota_is_inclusive */
232 FALSE, /* quota_no_check */
233 FALSE /* quota_filecount_no_check */
237 /* Encodings for mailbox formats, and their names. MBX format is actually
238 supported only if SUPPORT_MBX is set. */
240 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
242 static const char *mailbox_formats[] = {
243 "unix", "mbx", "smail", "maildir", "mailstore" };
246 /* Check warn threshold only if quota size set or not a percentage threshold
247 percentage check should only be done if quota > 0 */
249 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
250 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
254 /*************************************************
255 * Setup entry point *
256 *************************************************/
258 /* Called for each delivery in the privileged state, just before the uid/gid
259 are changed and the main entry point is called. We use this function to
260 expand any quota settings, so that it can access files that may not be readable
261 by the user. It is also used to pick up external mailbox size information, if
265 tblock points to the transport instance
266 addrlist addresses about to be delivered (not used)
267 dummy not used (doesn't pass back data)
268 uid the uid that will be set (not used)
269 gid the gid that will be set (not used)
270 errmsg where to put an error message
272 Returns: OK, FAIL, or DEFER
276 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
277 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
279 appendfile_transport_options_block *ob =
280 (appendfile_transport_options_block *)(tblock->options_block);
281 uschar *q = ob->quota;
282 double default_value = 0.0;
285 addrlist = addrlist; /* Keep picky compilers happy */
290 if (ob->expand_maildir_use_size_file)
291 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
292 US"`maildir_use_size_file` in transport", tblock->name);
294 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
297 for (i = 0; i < 5; i++)
301 uschar *which = NULL;
303 if (q == NULL) d = default_value;
307 uschar *s = expand_string(q);
311 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
312 "%s", q, tblock->name, expand_string_message);
313 return search_find_defer ? DEFER : FAIL;
316 d = Ustrtod(s, &rest);
318 /* Handle following characters K, M, G, %, the latter being permitted
319 for quota_warn_threshold only. A threshold with no quota setting is
322 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
323 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
324 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
325 else if (*rest == '%' && i == 2)
327 if (ob->quota_value <= 0 && !ob->maildir_use_size_file)
329 else if ((int)d < 0 || (int)d > 100)
331 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
332 " for %s transport", (int)d, tblock->name);
335 ob->quota_warn_threshold_is_percent = TRUE;
340 /* For quota and quota_filecount there may be options
341 appended. Currently only "no_check", so we can be lazy parsing it */
342 if (i < 2 && Ustrstr(rest, "/no_check") == rest)
345 rest += sizeof("/no_check") - 1;
348 while (isspace(*rest)) rest++;
352 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
353 "in %s transport", s, q, tblock->name);
358 /* Set each value, checking for possible overflow. */
363 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
365 ob->quota_value = (off_t)d;
366 ob->quota_no_check = no_check;
367 q = ob->quota_filecount;
371 if (d >= 2.0*1024.0*1024.0*1024.0)
372 which = US"quota_filecount";
373 ob->quota_filecount_value = (int)d;
374 ob->quota_filecount_no_check = no_check;
375 q = ob->quota_warn_threshold;
379 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
380 which = US"quota_warn_threshold";
381 ob->quota_warn_threshold_value = (off_t)d;
382 q = ob->mailbox_size_string;
383 default_value = -1.0;
387 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
388 which = US"mailbox_size";;
389 ob->mailbox_size_value = (off_t)d;
390 q = ob->mailbox_filecount_string;
394 if (d >= 2.0*1024.0*1024.0*1024.0)
395 which = US"mailbox_filecount";
396 ob->mailbox_filecount_value = (int)d;
402 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
403 "%s transport", which, d, tblock->name);
413 /*************************************************
414 * Initialization entry point *
415 *************************************************/
417 /* Called for each instance, after its options have been read, to
418 enable consistency checks to be done, or anything else that needs
422 appendfile_transport_init(transport_instance *tblock)
424 appendfile_transport_options_block *ob =
425 (appendfile_transport_options_block *)(tblock->options_block);
427 /* Set up the setup entry point, to be called in the privileged state */
429 tblock->setup = appendfile_transport_setup;
431 /* Lock_retries must be greater than zero */
433 if (ob->lock_retries == 0) ob->lock_retries = 1;
435 /* Only one of a file name or directory name must be given. */
437 if (ob->filename != NULL && ob->dirname != NULL)
438 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
439 "only one of \"file\" or \"directory\" can be specified", tblock->name);
441 /* If a file name was specified, neither quota_filecount nor quota_directory
444 if (ob->filename != NULL)
446 if (ob->quota_filecount != NULL)
447 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
448 "quota_filecount must not be set without \"directory\"", tblock->name);
449 if (ob->quota_directory != NULL)
450 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
451 "quota_directory must not be set without \"directory\"", tblock->name);
454 /* The default locking depends on whether MBX is set or not. Change the
455 built-in default if none of the lock options has been explicitly set. At least
456 one form of locking is required in all cases, but mbx locking changes the
457 meaning of fcntl and flock locking. */
459 /* Not all operating systems provide flock(). For those that do, if flock is
460 requested, the default for fcntl is FALSE. */
465 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
466 "flock() support was not available in the operating system when this "
467 "binary was built", tblock->name);
468 #endif /* NO_FLOCK */
469 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
475 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
476 !ob->set_use_mbx_lock)
478 ob->use_lockfile = ob->use_flock = FALSE;
479 ob->use_mbx_lock = ob->use_fcntl = TRUE;
481 else if (ob->use_mbx_lock)
483 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
484 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
485 if (!ob->set_use_flock) ob->use_flock = FALSE;
486 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
489 #endif /* SUPPORT_MBX */
491 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
492 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
493 "no locking configured", tblock->name);
495 /* Unset timeouts for non-used locking types */
497 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
498 if (!ob->use_flock) ob->lock_flock_timeout = 0;
500 /* If a directory name was specified, only one of maildir or mailstore may be
501 specified, and if quota_filecount or quota_directory is given, quota must
504 if (ob->dirname != NULL)
506 if (ob->maildir_format && ob->mailstore_format)
507 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
508 "only one of maildir and mailstore may be specified", tblock->name);
509 if (ob->quota_filecount != NULL && ob->quota == NULL)
510 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
511 "quota must be set if quota_filecount is set", tblock->name);
512 if (ob->quota_directory != NULL && ob->quota == NULL)
513 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
514 "quota must be set if quota_directory is set", tblock->name);
517 /* If a fixed uid field is set, then a gid field must also be set. */
519 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
520 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
521 "user set without group for the %s transport", tblock->name);
523 /* If "create_file" is set, check that a valid option is given, and set the
526 if (ob->create_file_string != NULL)
529 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
530 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
532 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
533 value = create_inhome;
535 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
536 "invalid value given for \"file_create\" for the %s transport: %s",
537 tblock->name, ob->create_file_string);
538 ob->create_file = value;
541 /* If quota_warn_threshold is set, set up default for warn_message. It may
542 not be used if the actual threshold for a given delivery ends up as zero,
543 of if it's given as a percentage and there's no quota setting. */
545 if (ob->quota_warn_threshold != NULL)
547 if (tblock->warn_message == NULL) tblock->warn_message = US
548 "To: $local_part@$domain\n"
549 "Subject: Your mailbox\n\n"
550 "This message is automatically created by mail delivery software (Exim).\n\n"
551 "The size of your mailbox has exceeded a warning threshold that is\n"
552 "set by the system administrator.\n";
555 /* If batch SMTP is set, force the check and escape strings, and arrange that
556 headers are also escaped. */
560 ob->check_string = US".";
561 ob->escape_string = US"..";
562 ob->options |= topt_escape_headers;
565 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
566 insert default values for for the affixes and the check/escape strings. */
568 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
570 if (ob->message_prefix == NULL) ob->message_prefix =
571 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
572 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
573 if (ob->check_string == NULL) ob->check_string = US"From ";
574 if (ob->escape_string == NULL) ob->escape_string = US">From ";
578 /* Set up the bitwise options for transport_write_message from the various
579 driver options. Only one of body_only and headers_only can be set. */
582 (tblock->body_only ? topt_no_headers : 0) |
583 (tblock->headers_only ? topt_no_body : 0) |
584 (tblock->return_path_add ? topt_add_return_path : 0) |
585 (tblock->delivery_date_add ? topt_add_delivery_date : 0) |
586 (tblock->envelope_to_add ? topt_add_envelope_to : 0) |
587 ((ob->use_crlf || ob->mbx_format) ? topt_use_crlf : 0);
592 /*************************************************
594 *************************************************/
596 /* The comsat daemon is the thing that provides asynchronous notification of
597 the arrival of local messages, if requested by the user by "biff y". It is a
598 BSD thing that uses a TCP/IP protocol for communication. A message consisting
599 of the text "user@offset" must be sent, where offset is the place in the
600 mailbox where new mail starts. There is no scope for telling it which file to
601 look at, which makes it a less than useful if mail is being delivered into a
602 non-standard place such as the user's home directory. In fact, it doesn't seem
603 to pay much attention to the offset.
607 offset offset in mailbox
613 notify_comsat(uschar *user, off_t offset)
620 DEBUG(D_transport) debug_printf("notify_comsat called\n");
622 sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
624 if ((sp = getservbyname("biff", "udp")) == NULL)
626 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
630 host.name = US"localhost";
634 /* This code is all set up to look up "localhost" and use all its addresses
635 until one succeeds. However, it appears that at least on some systems, comsat
636 doesn't listen on the ::1 address. So for the moment, just force the address to
637 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
638 can be changed. (But actually, comsat is probably dying out anyway.) */
641 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
643 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
648 host.address = US"127.0.0.1";
651 for (h = &host; h; h = h->next)
654 int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
656 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
658 if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
660 /* Connect never fails for a UDP socket, so don't set a timeout. */
662 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, NULL);
663 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
668 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
675 /*************************************************
676 * Check the format of a file *
677 *************************************************/
679 /* This function is called when file_format is set, to check that an existing
680 file has the right format. The format string contains text/transport pairs. The
681 string matching is literal. we just read big_buffer_size bytes, because this is
682 all about the first few bytes of a file.
686 tblock the transport block
687 addr the address block - for inserting error data
689 Returns: pointer to the required transport, or NULL
693 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
695 const uschar *format =
696 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
698 int len = read(cfd, data, sizeof(data));
702 DEBUG(D_transport) debug_printf("checking file format\n");
704 /* An empty file matches the current transport */
706 if (len == 0) return tblock;
708 /* Search the formats for a match */
710 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size)))
712 int slen = Ustrlen(s);
713 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
714 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
718 transport_instance *tt;
719 for (tt = transports; tt; tt = tt->next)
720 if (Ustrcmp(tp, tt->name) == 0)
723 debug_printf("file format -> %s transport\n", tt->name);
726 addr->basic_errno = ERRNO_BADTRANSPORT;
727 addr->message = string_sprintf("%s transport (for %.*s format) not found",
733 /* Failed to find a match */
735 addr->basic_errno = ERRNO_FORMATUNKNOWN;
736 addr->message = US"mailbox file format unrecognized";
743 /*************************************************
744 * Check directory's files for quota *
745 *************************************************/
747 /* This function is called if quota is set for one of the delivery modes that
748 delivers into a specific directory. It scans the directory and stats all the
749 files in order to get a total size and count. This is an expensive thing to do,
750 but some people are prepared to bear the cost. Alternatively, if size_regex is
751 set, it is used as a regex to try to extract the size from the file name, a
752 strategy that some people use on maildir files on systems where the users have
755 The function is global, because it is also called from tf_maildir.c for maildir
756 folders (which should contain only regular files).
758 Note: Any problems can be written to debugging output, but cannot be written to
759 the log, because we are running as an unprivileged user here.
762 dirname the name of the directory
763 countptr where to add the file count (because this function recurses)
764 regex a compiled regex to get the size from a name
766 Returns: the sum of the sizes of the stattable files
767 zero if the directory cannot be opened
771 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
775 int count = *countptr;
779 dir = opendir(CS dirname);
780 if (dir == NULL) return 0;
782 while ((ent = readdir(dir)) != NULL)
784 uschar *name = US ent->d_name;
787 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
791 /* If there's a regex, try to find the size using it */
796 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
799 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
800 if (endptr == name + ovector[3])
804 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
810 debug_printf("check_dir_size: regex did not match %s\n", name);
813 /* No regex or no match for the regex, or captured non-digits */
815 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
818 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
823 if (Ustat(buffer, &statbuf) < 0)
826 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
831 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
832 sum += statbuf.st_size;
833 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
834 sum += check_dir_size(buffer, &count, regex);
839 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
849 /*************************************************
850 * Apply a lock to a file descriptor *
851 *************************************************/
853 /* This function applies a lock to a file descriptor, using a blocking or
854 non-blocking lock, depending on the timeout value. It can apply either or
855 both of a fcntl() and a flock() lock. However, not all OS support flock();
856 for those that don't, the use_flock option cannot be set.
859 fd the file descriptor
860 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
861 fcntl() format); the flock() type is deduced if needed
862 dofcntl do fcntl() locking
863 fcntltime non-zero to use blocking fcntl()
864 doflock do flock() locking
865 flocktime non-zero to use blocking flock()
867 Returns: yield of the fcntl() or flock() call, with errno preserved;
868 sigalrm_seen set if there has been a timeout
872 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
877 struct flock lock_data;
878 lock_data.l_type = fcntltype;
879 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
881 sigalrm_seen = FALSE;
888 yield = fcntl(fd, F_SETLKW, &lock_data);
893 else yield = fcntl(fd, F_SETLK, &lock_data);
897 if (doflock && (yield >= 0))
899 int flocktype = (fcntltype == F_WRLCK) ? LOCK_EX : LOCK_SH;
903 yield = flock(fd, flocktype);
908 else yield = flock(fd, flocktype | LOCK_NB);
910 #endif /* NO_FLOCK */
919 /*************************************************
920 * Copy message into MBX mailbox *
921 *************************************************/
923 /* This function is called when a message intended for a MBX mailbox has been
924 written to a temporary file. We can now get the size of the message and then
925 copy it in MBX format to the mailbox.
928 to_fd fd to write to (the real mailbox)
929 from_fd fd to read from (the temporary file)
930 saved_size current size of mailbox
932 Returns: OK if all went well, DEFER otherwise, with errno preserved
933 the number of bytes written are added to transport_count
934 by virtue of calling transport_write_block()
937 /* Values taken from c-client */
939 #define MBX_HDRSIZE 2048
940 #define MBX_NUSERFLAGS 30
943 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
948 transport_ctx tctx = {{0}};
952 /* If the current mailbox size is zero, write a header block */
958 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
959 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
960 (long int)time(NULL));
961 for (i = 0; i < MBX_NUSERFLAGS; i++)
962 sprintf (CS(s += Ustrlen(s)), "\015\012");
963 if (!transport_write_block (&tctx, deliver_out_buffer, MBX_HDRSIZE, FALSE))
967 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
969 /* Now construct the message's header from the time and the RFC822 file
970 size, including CRLFs, which is the size of the input (temporary) file. */
972 if (fstat(from_fd, &statbuf) < 0) return DEFER;
973 size = statbuf.st_size;
975 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
976 tod_stamp(tod_mbx), size, 0L, 0, 0);
977 used = Ustrlen(deliver_out_buffer);
979 /* Rewind the temporary file, and copy it over in chunks. */
981 if (lseek(from_fd, 0 , SEEK_SET) < 0) return DEFER;
985 int len = read(from_fd, deliver_out_buffer + used,
986 DELIVER_OUT_BUFFER_SIZE - used);
989 if (len == 0) errno = ERRNO_MBXLENGTH;
992 if (!transport_write_block(&tctx, deliver_out_buffer, used + len, FALSE))
1000 #endif /* SUPPORT_MBX */
1004 /*************************************************
1005 * Check creation is permitted *
1006 *************************************************/
1008 /* This function checks whether a given file name is permitted to be created,
1009 as controlled by the create_file option. If no home directory is set, however,
1010 we can't do any tests.
1013 filename the file name
1014 create_file the ob->create_file option
1016 Returns: TRUE if creation is permitted
1020 check_creation(uschar *filename, int create_file)
1024 if (deliver_home != NULL && create_file != create_anywhere)
1026 int len = Ustrlen(deliver_home);
1027 uschar *file = filename;
1029 while (file[0] == '/' && file[1] == '/') file++;
1030 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
1031 ( Ustrchr(file+len+2, '/') != NULL &&
1033 create_file != create_belowhome ||
1034 Ustrstr(file+len, "/../") != NULL
1039 /* If yield is TRUE, the file name starts with the home directory, and does
1040 not contain any instances of "/../" in the "belowhome" case. However, it may
1041 still contain symbolic links. We can check for this by making use of
1042 realpath(), which most Unixes seem to have (but make it possible to cut this
1043 out). We can't just use realpath() on the whole file name, because we know
1044 the file itself doesn't exist, and intermediate directories may also not
1045 exist. What we want to know is the real path of the longest existing part of
1046 the path. That must match the home directory's beginning, whichever is the
1050 if (yield && create_file == create_belowhome)
1052 uschar *slash, *next;
1054 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
1055 rp == NULL && slash > file; /* Stop if reached beginning */
1059 rp = US realpath(CS file, CS big_buffer);
1060 next = Ustrrchr(file, '/');
1064 /* If rp == NULL it means that none of the relevant directories exist.
1065 This is not a problem here - it means that no symbolic links can exist,
1066 which is all we are worried about. Otherwise, we must compare it
1067 against the start of the home directory. However, that may itself
1068 contain symbolic links, so we have to "realpath" it as well, if
1073 uschar hdbuffer[PATH_MAX+1];
1074 uschar *rph = deliver_home;
1075 int rlen = Ustrlen(big_buffer);
1077 rp = US realpath(CS deliver_home, CS hdbuffer);
1084 if (rlen > len) rlen = len;
1085 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1088 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1089 big_buffer, deliver_home);
1093 #endif /* NO_REALPATH */
1101 /*************************************************
1102 * Main entry point *
1103 *************************************************/
1105 /* See local README for general interface details. This transport always
1106 returns FALSE, indicating that the status which has been placed in the first
1107 address should be copied to any other addresses in a batch.
1109 Appendfile delivery is tricky and has led to various security problems in other
1110 mailers. The logic used here is therefore laid out in some detail. When this
1111 function is called, we are running in a subprocess which has had its gid and
1112 uid set to the appropriate values. Therefore, we cannot write directly to the
1113 exim logs. Any errors must be handled by setting appropriate return codes.
1114 Note that the default setting for addr->transport_return is DEFER, so it need
1115 not be set unless some other value is required.
1117 The code below calls geteuid() rather than getuid() to get the current uid
1118 because in weird configurations not running setuid root there may be a
1119 difference. In the standard configuration, where setuid() has been used in the
1120 delivery process, there will be no difference between the uid and the euid.
1122 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1123 alias expansion. Otherwise, there must be a configured file name or
1126 The following items apply in the case when a file name (as opposed to a
1127 directory name) is given, that is, when appending to a single file:
1129 (2f) Expand the file name.
1131 (3f) If the file name is /dev/null, return success (optimization).
1133 (4f) If the file_format options is set, open the file for reading, and check
1134 that the bytes at the start of the file match one of the given strings.
1135 If the check indicates a transport other than the current one should be
1136 used, pass control to that other transport. Otherwise continue. An empty
1137 or non-existent file matches the current transport. The file is closed
1140 (5f) If a lock file is required, create it (see extensive separate comments
1141 below about the algorithm for doing this). It is important to do this
1142 before opening the mailbox if NFS is in use.
1144 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1145 details of any symbolic link.
1147 (7f) If the file already exists:
1149 Check the owner and group if necessary, and defer if they are wrong.
1151 If it is a symbolic link AND the allow_symlink option is set (NOT the
1152 default), go back to (6f) but this time use stat() instead of lstat().
1154 If it's not a regular file (or FIFO when permitted), defer delivery.
1156 Check permissions. If the required permissions are *less* than the
1157 existing ones, or supplied by the address (often by the user via filter),
1158 chmod() the file. Otherwise, defer.
1160 Save the inode number.
1162 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1164 If open fails because the file does not exist, go to (6f); on any other
1167 Check the inode number hasn't changed - I realize this isn't perfect (an
1168 inode can be reused) but it's cheap and will catch some of the races.
1170 Check it's still a regular file (or FIFO if permitted).
1172 Check that the owner and permissions haven't changed.
1174 If file_format is set, check that the file still matches the format for
1175 the current transport. If not, defer delivery.
1177 (8f) If file does not exist initially:
1179 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1180 this is via a symbolic link (only possible if allow_symlinks is set), in
1181 which case don't use O_EXCL, as it doesn't work.
1183 If open fails because the file already exists, go to (6f). To avoid
1184 looping for ever in a situation where the file is continuously being
1185 created and deleted, all of this happens inside a loop that operates
1186 lock_retries times and includes the fcntl and flock locking. If the
1187 loop completes without the file getting opened, defer and request
1188 freezing, because something really weird is happening.
1190 If open fails for any other reason, defer for subsequent delivery except
1191 when this is a file delivery resulting from an alias or forward expansion
1192 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1193 most likely a user rather than a configuration error.
1195 (9f) We now have the file checked and open for writing. If so configured, lock
1196 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1197 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1198 still fails, give up and defer delivery.
1200 (10f)Save the access time (for subsequent restoration) and the size of the
1201 file, for comsat and for re-setting if delivery fails in the middle -
1202 e.g. for quota exceeded.
1204 The following items apply in the case when a directory name is given:
1206 (2d) Create a new file in the directory using a temporary name, by opening for
1207 writing and with O_CREAT. If maildir format is being used, the file
1208 is created in a temporary subdirectory with a prescribed name. If
1209 mailstore format is being used, the envelope file is first created with a
1210 temporary name, then the data file.
1212 The following items apply in all cases:
1214 (11) We now have the file open for writing, and locked if it was given as a
1215 file name. Write the message and flush the file, unless there is a setting
1216 of the local quota option, in which case we can check for its excession
1217 without doing any writing.
1219 In the case of MBX format mailboxes, the message is first written to a
1220 temporary file, in order to get its correct length. This is then copied to
1221 the real file, preceded by an MBX header.
1223 If there is a quota error on writing, defer the address. Timeout logic
1224 will determine for how long retries are attempted. We restore the mailbox
1225 to its original length if it's a single file. There doesn't seem to be a
1226 uniform error code for quota excession (it even differs between SunOS4
1227 and some versions of SunOS5) so a system-dependent macro called
1228 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1231 For any other error (most commonly disk full), do the same.
1233 The following applies after appending to a file:
1235 (12f)Restore the atime; notify_comsat if required; close the file (which
1236 unlocks it if it was locked). Delete the lock file if it exists.
1238 The following applies after writing a unique file in a directory:
1240 (12d)For maildir format, rename the file into the new directory. For mailstore
1241 format, rename the envelope file to its correct name. Otherwise, generate
1242 a unique name from the directory_file option, and rename to that, possibly
1243 trying a few times if the file exists and re-expanding the name gives a
1246 This transport yields FAIL only when a file name is generated by an alias or
1247 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1248 All other failures return DEFER (in addr->transport_return). */
1252 appendfile_transport_entry(
1253 transport_instance *tblock, /* data for this instantiation */
1254 address_item *addr) /* address we are working on */
1256 appendfile_transport_options_block *ob =
1257 (appendfile_transport_options_block *)(tblock->options_block);
1258 struct stat statbuf;
1259 uschar *fdname = NULL;
1260 uschar *filename = NULL;
1261 uschar *hitchname = NULL;
1262 uschar *dataname = NULL;
1263 uschar *lockname = NULL;
1264 uschar *newname = NULL;
1265 uschar *nametag = NULL;
1267 uschar *filecount_msg = US"";
1269 struct utimbuf times;
1270 struct timeval msg_tv;
1271 BOOL disable_quota = FALSE;
1272 BOOL isdirectory = FALSE;
1273 BOOL isfifo = FALSE;
1274 BOOL wait_for_tick = FALSE;
1275 uid_t uid = geteuid(); /* See note above */
1276 gid_t gid = getegid();
1278 int mode = (addr->mode > 0) ? addr->mode : ob->mode;
1279 off_t saved_size = -1;
1280 off_t mailbox_size = ob->mailbox_size_value;
1281 int mailbox_filecount = ob->mailbox_filecount_value;
1289 int mbx_lockfd = -1;
1290 uschar mbx_lockname[40];
1291 FILE *temp_file = NULL;
1292 #endif /* SUPPORT_MBX */
1294 #ifdef SUPPORT_MAILDIR
1295 int maildirsize_fd = -1; /* fd for maildirsize file */
1296 int maildir_save_errno;
1300 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1302 /* An "address_file" or "address_directory" transport is used to deliver to
1303 files specified via .forward or an alias file. Prior to release 4.20, the
1304 "file" and "directory" options were ignored in this case. This has been changed
1305 to allow the redirection data to specify what is in effect a folder, whose
1306 location is determined by the options on the transport.
1308 Compatibility with the case when neither option is set is retained by forcing a
1309 value for the file or directory name. A directory delivery is assumed if the
1310 last character of the path from the router is '/'.
1312 The file path is in the local part of the address, but not in the $local_part
1313 variable (that holds the parent local part). It is, however, in the
1314 $address_file variable. Below, we update the local part in the address if it
1315 changes by expansion, so that the final path ends up in the log. */
1317 if (testflag(addr, af_file) &&
1318 ob->filename == NULL &&
1319 ob->dirname == NULL)
1321 fdname = US"$address_file";
1322 if (address_file[Ustrlen(address_file)-1] == '/' ||
1323 ob->maildir_format ||
1324 ob->mailstore_format)
1328 /* Handle (a) an "address file" delivery where "file" or "directory" is
1329 explicitly set and (b) a non-address_file delivery, where one of "file" or
1330 "directory" must be set; initialization ensures that they are not both set. */
1334 fdname = ob->filename;
1337 fdname = ob->dirname;
1342 addr->transport_return = PANIC;
1343 addr->message = string_sprintf("Mandatory file or directory option "
1344 "missing from %s transport", tblock->name);
1349 /* Maildir and mailstore require a directory */
1351 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1353 addr->transport_return = PANIC;
1354 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1355 "to be specified for the %s transport",
1356 ob->maildir_format ? "dir" : "store", tblock->name);
1360 path = expand_string(fdname);
1364 addr->transport_return = PANIC;
1365 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1366 "name for %s transport) failed: %s", fdname, tblock->name,
1367 expand_string_message);
1373 addr->message = string_sprintf("appendfile: file or directory name "
1374 "\"%s\" is not absolute", path);
1375 addr->basic_errno = ERRNO_NOTABSOLUTE;
1379 /* For a file delivery, make sure the local part in the address(es) is updated
1380 to the true local part. */
1382 if (testflag(addr, af_file))
1384 address_item *addr2;
1385 for (addr2 = addr; addr2 != NULL; addr2 = addr2->next)
1386 addr2->local_part = string_copy(path);
1389 /* The available mailbox formats depend on whether it is a directory or a file
1395 #ifdef SUPPORT_MAILDIR
1396 (ob->maildir_format) ? mbf_maildir :
1398 #ifdef SUPPORT_MAILSTORE
1399 (ob->mailstore_format) ? mbf_mailstore :
1407 (ob->mbx_format) ? mbf_mbx :
1414 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1416 " warning=" OFF_T_FMT "%s\n"
1417 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1418 "maildir_use_size_file=%s\n",
1419 mode, ob->notify_comsat, ob->quota_value,
1420 ob->quota_no_check ? " (no_check)" : "",
1421 ob->quota_filecount_no_check ? " (no_check_filecount)" : "",
1422 ob->quota_warn_threshold_value,
1423 ob->quota_warn_threshold_is_percent ? "%" : "",
1424 isdirectory ? "directory" : "file",
1425 path, mailbox_formats[mbformat],
1426 (ob->message_prefix == NULL) ? US"null" : string_printing(ob->message_prefix),
1427 (ob->message_suffix == NULL) ? US"null" : string_printing(ob->message_suffix),
1428 (ob->maildir_use_size_file) ? "yes" : "no");
1430 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1431 ob->use_lockfile ? "lockfile " : "",
1432 ob->use_mbx_lock ? "mbx locking (" : "",
1433 ob->use_fcntl ? "fcntl " : "",
1434 ob->use_flock ? "flock" : "",
1435 ob->use_mbx_lock ? ")" : "");
1438 /* If the -N option is set, can't do any more. */
1443 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1445 addr->transport_return = OK;
1449 /* Handle the case of a file name. If the file name is /dev/null, we can save
1450 ourselves some effort and just give a success return right away. */
1454 BOOL use_lstat = TRUE;
1455 BOOL file_opened = FALSE;
1456 BOOL allow_creation_here = TRUE;
1458 if (Ustrcmp(path, "/dev/null") == 0)
1460 addr->transport_return = OK;
1464 /* Set the name of the file to be opened, and the file to which the data
1465 is written, and find out if we are permitted to create a non-existent file. */
1467 dataname = filename = path;
1468 allow_creation_here = check_creation(filename, ob->create_file);
1470 /* If ob->create_directory is set, attempt to create the directories in
1471 which this mailbox lives, but only if we are permitted to create the file
1472 itself. We know we are dealing with an absolute path, because this was
1475 if (ob->create_directory && allow_creation_here)
1477 uschar *p = Ustrrchr(path, '/');
1479 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1481 addr->basic_errno = errno;
1483 string_sprintf("failed to create directories for %s: %s", path,
1485 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1491 /* If file_format is set we must check that any existing file matches one of
1492 the configured formats by checking the bytes it starts with. A match then
1493 indicates a specific transport - if it is not this one, pass control to it.
1494 Otherwise carry on here. An empty or non-existent file matches the current
1495 transport. We don't need to distinguish between non-existence and other open
1496 failures because if an existing file fails to open here, it will also fail
1497 again later when O_RDWR is used. */
1499 if (ob->file_format != NULL)
1501 int cfd = Uopen(path, O_RDONLY, 0);
1504 transport_instance *tt = check_file_format(cfd, tblock, addr);
1507 /* If another transport is indicated, call it and return; if no transport
1508 was found, just return - the error data will have been set up.*/
1514 set_process_info("delivering %s to %s using %s", message_id,
1515 addr->local_part, tt->name);
1516 debug_print_string(tt->debug_string);
1517 addr->transport = tt;
1518 (tt->info->code)(tt, addr);
1525 /* The locking of mailbox files is worse than the naming of cats, which is
1526 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1527 three different names, so several different styles of locking are used.
1529 Research in other programs that lock mailboxes shows that there is no
1530 universally standard method. Having mailboxes NFS-mounted on the system that
1531 is delivering mail is not the best thing, but people do run like this,
1532 and so the code must do its best to cope.
1534 Three different locking mechanisms are supported. The initialization function
1535 checks that at least one is configured.
1539 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1540 will work over NFS. Only after that is done do we actually open the mailbox
1541 and apply locks to it (if configured).
1543 Originally, Exim got the file opened before doing anything about locking.
1544 However, a very occasional problem was observed on Solaris 2 when delivering
1545 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1546 gets remembered at open time. If another process on another host (that's
1547 important) has the file open and locked and writes to it and then releases
1548 the lock while the first process is waiting to get the lock, the first
1549 process may fail to write at the new end point of the file - despite the very
1550 definite statement about O_APPEND in the man page for write(). Experiments
1551 have reproduced this problem, but I do not know any way of forcing a host to
1552 update its attribute cache for an open NFS file. It would be nice if it did
1553 so when a lock was taken out, but this does not seem to happen. Anyway, to
1554 reduce the risk of this problem happening, we now create the lock file
1555 (if configured) *before* opening the mailbox. That will prevent two different
1556 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1557 however, but Pine at least seems to operate in the same way.
1559 Lockfiles should normally be used when NFS is involved, because of the above
1562 The logic for creating the lock file is:
1564 . The name of the lock file is <mailbox-name>.lock
1566 . First, create a "hitching post" name by adding the primary host name,
1567 current time and pid to the lock file name. This should be unique.
1569 . Create the hitching post file using WRONLY + CREAT + EXCL.
1571 . If that fails EACCES, we assume it means that the user is unable to create
1572 files in the mail spool directory. Some installations might operate in this
1573 manner, so there is a configuration option to allow this state not to be an
1574 error - we proceed to lock using fcntl only, after the file is open.
1576 . Otherwise, an error causes a deferment of the address.
1578 . Hard link the hitching post to the lock file name.
1580 . If the link succeeds, we have successfully created the lock file. Simply
1581 close and unlink the hitching post file.
1583 . If the link does not succeed, proceed as follows:
1585 o Fstat the hitching post file, and then close and unlink it.
1587 o Now examine the stat data. If the number of links to the file is exactly
1588 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1589 the return never made it back, so the link() function gave a failure
1592 . This method allows for the lock file to be created by some other process
1593 right up to the moment of the attempt to hard link it, and is also robust
1594 against NFS server crash-reboots, which would probably result in timeouts
1595 in the middle of link().
1597 . System crashes may cause lock files to get left lying around, and some means
1598 of flushing them is required. The approach of writing a pid (used by smail
1599 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1600 timeout, which seems a better approach. Since any program that writes to a
1601 mailbox using a lock file should complete its task very quickly, Pine
1602 removes lock files that are older than 5 minutes. We allow the value to be
1603 configurable on the transport.
1607 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1608 mailbox once it is open. This is done by default with a non-blocking lock.
1609 Failures to lock cause retries after a sleep, but only for a certain number
1610 of tries. A blocking lock is deliberately not used so that we don't hold the
1611 mailbox open. This minimizes the possibility of the NFS problem described
1612 under LOCK FILES above, if for some reason NFS deliveries are happening
1613 without lock files. However, the use of a non-blocking lock and sleep, though
1614 the safest approach, does not give the best performance on very busy systems.
1615 A blocking lock plus timeout does better. Therefore Exim has an option to
1616 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1617 enables the use of blocking fcntl() calls.
1621 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1622 same manner as for fcntl locking above. No-blocking/timeout is also set as
1623 above in lock_flock_timeout. Not all operating systems provide or support
1624 flock(). For those that don't (as determined by the definition of LOCK_SH in
1625 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1626 is implemented (not precisely) on top of fcntl(), which means there's no
1627 point in actually using it.
1631 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1632 then the rules used for locking in c-client are used. Exim takes out a shared
1633 lock on the mailbox file, and an exclusive lock on the file whose name is
1634 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1635 any other MBX client from getting an exclusive lock on it and expunging it.
1636 It also stops any other MBX client from unlinking the /tmp lock when it has
1639 The exclusive lock on the /tmp file prevents any other MBX client from
1640 updating the mailbox in any way. When writing is finished, if an exclusive
1641 lock on the mailbox can be obtained, indicating there are no current sharers,
1642 the /tmp file is unlinked.
1644 MBX locking can use either fcntl() or flock() locking. If neither
1645 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1646 The calls for getting these locks are by default non-blocking, as for non-mbx
1647 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1648 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1649 probably makes sense to set timeouts for any MBX deliveries. */
1652 /* Build a lock file if configured to do so - the existence of a lock
1653 file is subsequently checked by looking for a non-negative value of the
1654 file descriptor hd - even though the file is no longer open. */
1656 if (ob->use_lockfile)
1658 /* cf. exim_lock.c */
1659 lockname = string_sprintf("%s.lock", filename);
1660 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1661 (unsigned int)(time(NULL)), (unsigned int)getpid());
1663 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1666 /* Lock file creation retry loop */
1668 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1671 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1675 addr->basic_errno = errno;
1677 string_sprintf("creating lock file hitching post %s "
1678 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1679 (long int)getegid());
1683 /* Attempt to hitch the hitching post to the lock file. If link()
1684 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1685 file, and get rid of the hitching post. If the number of links was 2,
1686 the link was created, despite the failure of link(). If the hitch was
1687 not successful, try again, having unlinked the lock file if it is too
1690 There's a version of Linux (2.0.27) which doesn't update its local cache
1691 of the inode after link() by default - which many think is a bug - but
1692 if the link succeeds, this code will be OK. It just won't work in the
1693 case when link() fails after having actually created the link. The Linux
1694 NFS person is fixing this; a temporary patch is available if anyone is
1695 sufficiently worried. */
1697 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1700 if (rc != 0 && statbuf.st_nlink != 2)
1702 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1703 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1705 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1708 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1712 DEBUG(D_transport) debug_printf("lock file created\n");
1716 /* Check for too many tries at creating the lock file */
1718 if (i >= ob->lock_retries)
1720 addr->basic_errno = ERRNO_LOCKFAILED;
1721 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1728 /* We now have to get the file open. First, stat() it and act on existence or
1729 non-existence. This is in a loop to handle the case of a file's being created
1730 or deleted as we watch, and also to handle retries when the locking fails.
1731 Rather than holding the file open while waiting for the fcntl() and/or
1732 flock() lock, we close and do the whole thing again. This should be safer,
1733 especially for NFS files, which might get altered from other hosts, making
1734 their cached sizes incorrect.
1736 With the default settings, no symlinks are permitted, but there is an option
1737 to permit symlinks for those sysadmins that know what they are doing.
1738 Shudder. However, insist that the initial symlink is owned by the right user.
1739 Thus lstat() is used initially; if a symlink is discovered, the loop is
1740 repeated such that stat() is used, to look at the end file. */
1742 for (i = 0; i < ob->lock_retries; i++)
1744 int sleep_before_retry = TRUE;
1745 file_opened = FALSE;
1747 if((use_lstat ? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1749 /* Let's hope that failure to stat (other than non-existence) is a
1752 if (errno != ENOENT)
1754 addr->basic_errno = errno;
1755 addr->message = string_sprintf("attempting to stat mailbox %s",
1760 /* File does not exist. If it is required to pre-exist this state is an
1763 if (ob->file_must_exist)
1765 addr->basic_errno = errno;
1766 addr->message = string_sprintf("mailbox %s does not exist, "
1767 "but file_must_exist is set", filename);
1771 /* If not permitted to create this file because it isn't in or below
1772 the home directory, generate an error. */
1774 if (!allow_creation_here)
1776 addr->basic_errno = ERRNO_BADCREATE;
1777 addr->message = string_sprintf("mailbox %s does not exist, "
1778 "but creation outside the home directory is not permitted",
1783 /* Attempt to create and open the file. If open fails because of
1784 pre-existence, go round the loop again. For any other error, defer the
1785 address, except for an alias or forward generated file name with EPERM,
1786 ENOENT, or EACCES, as those are most likely to be user errors rather
1787 than Exim config errors. When a symbolic link is permitted and points
1788 to a non-existent file, we get here with use_lstat = FALSE. In this case
1789 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1790 consistency and because MBX locking requires it in order to be able to
1791 get a shared lock. */
1793 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1794 (use_lstat ? O_EXCL : 0), mode);
1797 if (errno == EEXIST) continue;
1798 addr->basic_errno = errno;
1799 addr->message = string_sprintf("while creating mailbox %s",
1801 if (testflag(addr, af_file) &&
1802 (errno == EPERM || errno == ENOENT || errno == EACCES))
1803 addr->transport_return = FAIL;
1807 /* We have successfully created and opened the file. Ensure that the group
1808 and the mode are correct. */
1810 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
1812 addr->basic_errno = errno;
1813 addr->message = string_sprintf("while setting perms on mailbox %s",
1815 addr->transport_return = FAIL;
1821 /* The file already exists. Test its type, ownership, and permissions, and
1822 save the inode for checking later. If symlinks are permitted (not the
1823 default or recommended state) it may be a symlink that already exists.
1824 Check its ownership and then look for the file at the end of the link(s).
1825 This at least prevents one user creating a symlink for another user in
1826 a sticky directory. */
1830 int oldmode = (int)statbuf.st_mode;
1831 ino_t inode = statbuf.st_ino;
1832 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1834 isfifo = FALSE; /* In case things are changing */
1836 /* Check owner if required - the default. */
1838 if (ob->check_owner && statbuf.st_uid != uid)
1840 addr->basic_errno = ERRNO_BADUGID;
1841 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1842 "(%ld != %ld)", filename,
1843 islink ? " (symlink)" : "",
1844 (long int)(statbuf.st_uid), (long int)uid);
1848 /* Group is checked only if check_group is set. */
1850 if (ob->check_group && statbuf.st_gid != gid)
1852 addr->basic_errno = ERRNO_BADUGID;
1853 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1854 filename, islink ? " (symlink)" : "", statbuf.st_gid, gid);
1858 /* Just in case this is a sticky-bit mail directory, we don't want
1859 users to be able to create hard links to other users' files. */
1861 if (statbuf.st_nlink != 1)
1863 addr->basic_errno = ERRNO_NOTREGULAR;
1864 addr->message = string_sprintf("mailbox %s%s has too many links (%d)",
1865 filename, islink ? " (symlink)" : "", statbuf.st_nlink);
1870 /* If symlinks are permitted (not recommended), the lstat() above will
1871 have found the symlink. Its ownership has just been checked; go round
1872 the loop again, using stat() instead of lstat(). That will never yield a
1875 if (islink && ob->allow_symlink)
1878 i--; /* Don't count this time round */
1882 /* An actual file exists. Check that it is a regular file, or FIFO
1885 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1887 else if ((oldmode & S_IFMT) != S_IFREG)
1889 addr->basic_errno = ERRNO_NOTREGULAR;
1890 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1891 filename, ob->allow_fifo ? " or named pipe" : "");
1895 /* If the mode is not what it would be for a newly created file, change
1896 the permissions if the mode is supplied for the address. Otherwise,
1897 reduce but do not extend the permissions. If the newly created
1898 permissions are greater than the existing permissions, don't change
1899 things when the mode is not from the address. */
1901 if ((oldmode = (oldmode & 07777)) != mode)
1903 int diffs = oldmode ^ mode;
1904 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1906 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1907 if (Uchmod(filename, mode) < 0)
1909 addr->basic_errno = errno;
1910 addr->message = string_sprintf("attempting to chmod mailbox %s",
1917 /* Mode not from address, and newly-created permissions are greater
1918 than existing permissions. Default is to complain, but it can be
1919 configured to go ahead and try to deliver anyway if that's what
1920 the administration wants. */
1922 else if (ob->mode_fail_narrower)
1924 addr->basic_errno = ERRNO_BADMODE;
1925 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1926 "(%o expected)", filename, oldmode, mode);
1931 /* We are happy with the existing file. Open it, and then do further
1932 tests to ensure that it is the same file that we were just looking at.
1933 If the file does not now exist, restart this loop, going back to using
1934 lstat again. For an NFS error, just defer; other opening errors are
1935 more serious. The file is opened RDWR so that its format can be checked,
1936 and also MBX locking requires the use of a shared (read) lock. However,
1937 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1938 reading the pipe. */
1940 fd = Uopen(filename, isfifo ? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1944 if (errno == ENOENT)
1949 addr->basic_errno = errno;
1952 addr->message = string_sprintf("while opening named pipe %s "
1953 "(could mean no process is reading it)", filename);
1955 else if (errno != EWOULDBLOCK)
1957 addr->message = string_sprintf("while opening mailbox %s", filename);
1962 /* This fstat really shouldn't fail, as we have an open file! There's a
1963 dilemma here. We use fstat in order to be sure we are peering at the file
1964 we have got open. However, that won't tell us if the file was reached
1965 via a symbolic link. We checked this above, but there is a race exposure
1966 if the link was created between the previous lstat and the open. However,
1967 it would have to be created with the same inode in order to pass the
1968 check below. If ob->allow_symlink is set, causing the use of stat rather
1969 than lstat above, symbolic links may be there anyway, and the checking is
1972 if (fstat(fd, &statbuf) < 0)
1974 addr->basic_errno = errno;
1975 addr->message = string_sprintf("attempting to stat open mailbox %s",
1980 /* Check the inode; this is isn't a perfect check, but gives some
1983 if (inode != statbuf.st_ino)
1985 addr->basic_errno = ERRNO_INODECHANGED;
1986 addr->message = string_sprintf("opened mailbox %s inode number changed "
1987 "from " INO_T_FMT " to " INO_T_FMT, filename, inode, statbuf.st_ino);
1988 addr->special_action = SPECIAL_FREEZE;
1992 /* Check it's still a regular file or FIFO, and the uid, gid, and
1993 permissions have not changed. */
1995 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1996 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1998 addr->basic_errno = ERRNO_NOTREGULAR;
2000 string_sprintf("opened mailbox %s is no longer a %s", filename,
2001 isfifo ? "named pipe" : "regular file");
2002 addr->special_action = SPECIAL_FREEZE;
2006 if ((ob->check_owner && statbuf.st_uid != uid) ||
2007 (ob->check_group && statbuf.st_gid != gid))
2009 addr->basic_errno = ERRNO_BADUGID;
2011 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
2012 addr->special_action = SPECIAL_FREEZE;
2016 if ((statbuf.st_mode & 07777) != oldmode)
2018 addr->basic_errno = ERRNO_BADMODE;
2019 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
2020 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
2021 addr->special_action = SPECIAL_FREEZE;
2025 /* If file_format is set, check that the format of the file has not
2026 changed. Error data is set by the testing function. */
2028 if (ob->file_format != NULL &&
2029 check_file_format(fd, tblock, addr) != tblock)
2031 addr->message = US"open mailbox has changed format";
2035 /* The file is OK. Carry on to do the locking. */
2038 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
2039 locking rules if configured to do so. If a lock file is also required, it
2040 was created above and hd was left >= 0. At least one form of locking is
2041 required by the initialization function. If locking fails here, close the
2042 file and go round the loop all over again, after waiting for a bit, unless
2043 blocking locking was used. */
2046 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
2047 sleep_before_retry = FALSE;
2049 /* Simple fcntl() and/or flock() locking */
2051 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
2053 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2054 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
2057 /* MBX locking rules */
2060 else if (ob->use_mbx_lock)
2063 struct stat lstatbuf, statbuf2;
2064 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2065 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
2066 fstat(fd, &statbuf) >= 0)
2068 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
2069 (long)statbuf.st_ino);
2072 * 2010-05-29: SECURITY
2073 * Dan Rosenberg reported the presence of a race-condition in the
2074 * original code here. Beware that many systems still allow symlinks
2075 * to be followed in /tmp so an attacker can create a symlink pointing
2076 * elsewhere between a stat and an open, which we should avoid
2079 * It's unfortunate that we can't just use all the heavily debugged
2080 * locking from above.
2082 * Also: remember to mirror changes into exim_lock.c */
2084 /* first leave the old pre-check in place, it provides better
2085 * diagnostics for common cases */
2086 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2088 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2090 addr->basic_errno = ERRNO_LOCKFAILED;
2091 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2095 if (statbuf.st_nlink > 1)
2097 addr->basic_errno = ERRNO_LOCKFAILED;
2098 addr->message = string_sprintf("hard link to MBX lock file %s",
2104 /* If we could just declare "we must be the ones who create this
2105 * file" then a hitching post in a subdir would work, since a
2106 * subdir directly in /tmp/ which we create wouldn't follow links
2107 * but this isn't our locking logic, so we can't safely change the
2108 * file existence rules. */
2110 /* On systems which support O_NOFOLLOW, it's the easiest and most
2111 * obviously correct security fix */
2112 mbx_tmp_oflags = O_RDWR | O_CREAT;
2114 mbx_tmp_oflags |= O_NOFOLLOW;
2116 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2119 addr->basic_errno = ERRNO_LOCKFAILED;
2120 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2121 mbx_lockname, strerror(errno));
2125 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2127 addr->basic_errno = ERRNO_LOCKFAILED;
2128 addr->message = string_sprintf("attempting to lstat open MBX "
2129 "lock file %s: %s", mbx_lockname, strerror(errno));
2132 if (fstat(mbx_lockfd, &statbuf2) < 0)
2134 addr->basic_errno = ERRNO_LOCKFAILED;
2135 addr->message = string_sprintf("attempting to stat fd of open MBX "
2136 "lock file %s: %s", mbx_lockname, strerror(errno));
2142 * statbuf: if exists, is file which existed prior to opening the
2143 * lockfile, might have been replaced since then
2144 * statbuf2: result of stat'ing the open fd, is what was actually
2146 * lstatbuf: result of lstat'ing the filename immediately after
2147 * the open but there's a race condition again between
2148 * those two steps: before open, symlink to foo, after
2149 * open but before lstat have one of:
2150 * * was no symlink, so is the opened file
2151 * (we created it, no messing possible after that point)
2153 * * symlink elsewhere
2154 * * hardlink elsewhere
2156 * Don't want to compare to device of /tmp because some modern systems
2157 * have regressed to having /tmp be the safe actual filesystem as
2158 * valuable data, so is mostly worthless, unless we assume that *only*
2159 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2160 * for further consideration.
2161 * No point in doing a readlink on the lockfile as that will always be
2162 * at a different point in time from when we open it, so tells us
2163 * nothing; attempts to clean up and delete after ourselves would risk
2164 * deleting a *third* filename.
2166 if ((statbuf2.st_nlink > 1) ||
2167 (lstatbuf.st_nlink > 1) ||
2168 (!S_ISREG(lstatbuf.st_mode)) ||
2169 (lstatbuf.st_dev != statbuf2.st_dev) ||
2170 (lstatbuf.st_ino != statbuf2.st_ino))
2172 addr->basic_errno = ERRNO_LOCKFAILED;
2173 addr->message = string_sprintf("RACE CONDITION detected: "
2174 "mismatch post-initial-checks between \"%s\" and opened "
2175 "fd lead us to abort!", mbx_lockname);
2179 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2181 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2182 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2184 struct stat ostatbuf;
2186 /* This tests for a specific race condition. Ensure that we still
2187 have the same file. */
2189 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2190 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2191 statbuf.st_dev == ostatbuf.st_dev &&
2192 statbuf.st_ino == ostatbuf.st_ino)
2194 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2195 "between creation and locking\n", mbx_lockname);
2198 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2200 (void)close(mbx_lockfd);
2205 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2206 filename, strerror(errno));
2209 #endif /* SUPPORT_MBX */
2211 else break; /* No on-file locking required; break the open/lock loop */
2214 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2218 use_lstat = TRUE; /* Reset to use lstat first */
2221 /* If a blocking call timed out, break the retry loop if the total time
2222 so far is not less than than retries * interval. Use the larger of the
2223 flock() and fcntl() timeouts. */
2226 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2227 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2228 ob->lock_retries * ob->lock_interval)
2229 i = ob->lock_retries;
2231 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2232 flock() that caused the problem. */
2234 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2237 /* Test for exceeding the maximum number of tries. Either the file remains
2238 locked, or, if we haven't got it open, something is terribly wrong... */
2240 if (i >= ob->lock_retries)
2244 addr->basic_errno = ERRNO_EXISTRACE;
2245 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2246 addr->special_action = SPECIAL_FREEZE;
2250 addr->basic_errno = ERRNO_LOCKFAILED;
2251 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2257 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2259 /* Save access time (for subsequent restoration), modification time (for
2260 restoration if updating fails), size of file (for comsat and for re-setting if
2261 delivery fails in the middle - e.g. for quota exceeded). */
2263 if (fstat(fd, &statbuf) < 0)
2265 addr->basic_errno = errno;
2266 addr->message = string_sprintf("while fstatting opened mailbox %s",
2271 times.actime = statbuf.st_atime;
2272 times.modtime = statbuf.st_mtime;
2273 saved_size = statbuf.st_size;
2274 if (mailbox_size < 0) mailbox_size = saved_size;
2275 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2278 /* Prepare for writing to a new file (as opposed to appending to an old one).
2279 There are several different formats, but there is preliminary stuff concerned
2280 with quotas that applies to all of them. Finding the current size by directory
2281 scanning is expensive; for maildirs some fudges have been invented:
2283 (1) A regex can be used to extract a file size from its name;
2284 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2290 uschar *check_path = path; /* Default quota check path */
2291 const pcre *regex = NULL; /* Regex for file size from file name */
2293 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2295 addr->basic_errno = ERRNO_BADCREATE;
2296 addr->message = string_sprintf("tried to create file in %s, but "
2297 "file creation outside the home directory is not permitted", path);
2301 #ifdef SUPPORT_MAILDIR
2302 /* For a maildir delivery, ensure that all the relevant directories exist,
2303 and a maildirfolder file if necessary. */
2305 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2306 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2308 #endif /* SUPPORT_MAILDIR */
2310 /* If we are going to do a quota check, of if maildir_use_size_file is set
2311 for a maildir delivery, compile the regular expression if there is one. We
2312 may also need to adjust the path that is used. We need to do this for
2313 maildir_use_size_file even if the quota is unset, because we still want to
2314 create the file. When maildir support is not compiled,
2315 ob->maildir_use_size_file is always FALSE. */
2317 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2319 const uschar *error;
2322 /* Compile the regex if there is one. */
2324 if (ob->quota_size_regex != NULL)
2326 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2327 (const char **)&error, &offset, NULL);
2330 addr->message = string_sprintf("appendfile: regular expression "
2331 "error: %s at offset %d while compiling %s", error, offset,
2332 ob->quota_size_regex);
2335 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2336 ob->quota_size_regex);
2339 /* Use an explicitly configured directory if set */
2341 if (ob->quota_directory != NULL)
2343 check_path = expand_string(ob->quota_directory);
2344 if (check_path == NULL)
2346 addr->transport_return = PANIC;
2347 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2348 "name for %s transport) failed: %s", ob->quota_directory,
2349 tblock->name, expand_string_message);
2353 if (check_path[0] != '/')
2355 addr->message = string_sprintf("appendfile: quota_directory name "
2356 "\"%s\" is not absolute", check_path);
2357 addr->basic_errno = ERRNO_NOTABSOLUTE;
2362 #ifdef SUPPORT_MAILDIR
2363 /* Otherwise, if we are handling a maildir delivery, and the directory
2364 contains a file called maildirfolder, this is a maildir++ feature telling
2365 us that this is a sub-directory of the real inbox. We should therefore do
2366 the quota check on the parent directory. Beware of the special case when
2367 the directory name itself ends in a slash. */
2369 else if (mbformat == mbf_maildir)
2371 struct stat statbuf;
2372 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2374 uschar *new_check_path = string_copy(check_path);
2375 uschar *slash = Ustrrchr(new_check_path, '/');
2381 slash = Ustrrchr(new_check_path, '/');
2386 check_path = new_check_path;
2387 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2388 "quota check directory changed to %s\n", check_path);
2393 #endif /* SUPPORT_MAILDIR */
2396 /* If we are using maildirsize files, we need to ensure that such a file
2397 exists and, if necessary, recalculate its contents. As a byproduct of this,
2398 we obtain the current size of the maildir. If no quota is to be enforced
2399 (ob->quota_value == 0), we still need the size if a threshold check will
2402 Another regular expression is used to determine which directories inside the
2403 maildir are going to be counted. */
2405 #ifdef SUPPORT_MAILDIR
2406 if (ob->maildir_use_size_file)
2408 const pcre *dir_regex = NULL;
2409 const uschar *error;
2412 if (ob->maildir_dir_regex != NULL)
2414 int check_path_len = Ustrlen(check_path);
2416 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2417 (const char **)&error, &offset, NULL);
2418 if (dir_regex == NULL)
2420 addr->message = string_sprintf("appendfile: regular expression "
2421 "error: %s at offset %d while compiling %s", error, offset,
2422 ob->maildir_dir_regex);
2427 debug_printf("using regex for maildir directory selection: %s\n",
2428 ob->maildir_dir_regex);
2430 /* Check to see if we are delivering into an ignored directory, that is,
2431 if the delivery path starts with the quota check path, and the rest
2432 of the deliver path matches the regex; if so, set a flag to disable quota
2433 checking and maildirsize updating. */
2435 if (Ustrncmp(path, check_path, check_path_len) == 0)
2437 uschar *s = path + check_path_len;
2438 while (*s == '/') s++;
2439 s = (*s == 0) ? US "new" : string_sprintf("%s/new", s);
2440 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2442 disable_quota = TRUE;
2443 DEBUG(D_transport) debug_printf("delivery directory does not match "
2444 "maildir_quota_directory_regex: disabling quota\n");
2449 /* Quota enforcement; create and check the file. There is some discussion
2450 about whether this should happen if the quota is unset. At present, Exim
2451 always creates the file. If we ever want to change this, uncomment
2452 appropriate lines below, possibly doing a check on some option. */
2454 /* if (???? || ob->quota_value > 0) */
2461 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2464 if (maildirsize_fd == -1)
2466 addr->basic_errno = errno;
2467 addr->message = string_sprintf("while opening or reading "
2468 "%s/maildirsize", check_path);
2471 /* can also return -2, which means that the file was removed because of
2472 raciness; but in this case, the size & filecount will still have been
2475 if (mailbox_size < 0) mailbox_size = size;
2476 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2479 /* No quota enforcement; ensure file does *not* exist; calculate size if
2484 * time_t old_latest;
2485 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2486 * if (THRESHOLD_CHECK)
2487 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2488 * regex, dir_regex, FALSE);
2493 #endif /* SUPPORT_MAILDIR */
2495 /* Otherwise if we are going to do a quota check later on, and the mailbox
2496 size is not set, find the current size of the mailbox. Ditto for the file
2497 count. Note that ob->quota_filecount_value cannot be set without
2498 ob->quota_value being set. */
2500 if (!disable_quota &&
2501 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2502 (mailbox_size < 0 ||
2503 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2508 debug_printf("quota checks on directory %s\n", check_path);
2509 size = check_dir_size(check_path, &filecount, regex);
2510 if (mailbox_size < 0) mailbox_size = size;
2511 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2514 /* Handle the case of creating a unique file in a given directory (not in
2515 maildir or mailstore format - this is how smail did it). A temporary name is
2516 used to create the file. Later, when it is written, the name is changed to a
2517 unique one. There is no need to lock the file. An attempt is made to create
2518 the directory if it does not exist. */
2520 if (mbformat == mbf_smail)
2523 debug_printf("delivering to new file in %s\n", path);
2524 filename = dataname =
2525 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2526 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2527 if (fd < 0 && /* failed to open, and */
2528 (errno != ENOENT || /* either not non-exist */
2529 !ob->create_directory || /* or not allowed to make */
2530 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2531 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2533 addr->basic_errno = errno;
2534 addr->message = string_sprintf("while creating file %s", filename);
2539 #ifdef SUPPORT_MAILDIR
2541 /* Handle the case of a unique file in maildir format. The file is written to
2542 the tmp subdirectory, with a prescribed form of name. */
2544 else if (mbformat == mbf_maildir)
2547 debug_printf("delivering in maildir format in %s\n", path);
2549 nametag = ob->maildir_tag;
2551 /* Check that nametag expands successfully; a hard failure causes a panic
2552 return. The actual expansion for use happens again later, when
2553 $message_size is accurately known. */
2555 if (nametag != NULL && expand_string(nametag) == NULL &&
2556 !expand_string_forcedfail)
2558 addr->transport_return = PANIC;
2559 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2560 "for %s transport) failed: %s", nametag, tblock->name,
2561 expand_string_message);
2565 /* We ensured the existence of all the relevant directories above. Attempt
2566 to open the temporary file a limited number of times. I think this rather
2567 scary-looking for statement is actually OK. If open succeeds, the loop is
2568 broken; if not, there is a test on the value of i. Get the time again
2569 afresh each time round the loop. Its value goes into a variable that is
2570 checked at the end, to make sure we don't release this process until the
2571 clock has ticked. */
2577 (void)gettimeofday(&msg_tv, NULL);
2578 basename = string_sprintf(TIME_T_FMT ".H%luP" PID_T_FMT ".%s",
2579 msg_tv.tv_sec, msg_tv.tv_usec, getpid(), primary_hostname);
2581 filename = dataname = string_sprintf("tmp/%s", basename);
2582 newname = string_sprintf("new/%s", basename);
2584 if (Ustat(filename, &statbuf) == 0)
2586 else if (errno == ENOENT)
2588 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2590 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2591 filename, strerror(errno));
2594 /* Too many retries - give up */
2596 if (i >= ob->maildir_retries)
2598 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2599 filename, i, (i == 1) ? "y" : "ies");
2600 addr->basic_errno = errno;
2601 if (errno == errno_quota || errno == ENOSPC)
2602 addr->user_message = US"mailbox is full";
2606 /* Open or stat failed but we haven't tried too many times yet. */
2611 /* Note that we have to ensure the clock has ticked before leaving */
2613 wait_for_tick = TRUE;
2615 /* Why are these here? Put in because they are present in the non-maildir
2616 directory case above. */
2618 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2620 addr->basic_errno = errno;
2621 addr->message = string_sprintf("while setting perms on maildir %s",
2627 #endif /* SUPPORT_MAILDIR */
2629 #ifdef SUPPORT_MAILSTORE
2631 /* Handle the case of a unique file in mailstore format. First write the
2632 envelope to a temporary file, then open the main file. The unique base name
2633 for the files consists of the message id plus the pid of this delivery
2639 address_item *taddr;
2640 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2641 string_base62((long int)getpid()));
2644 debug_printf("delivering in mailstore format in %s\n", path);
2646 filename = string_sprintf("%s.tmp", mailstore_basename);
2647 newname = string_sprintf("%s.env", mailstore_basename);
2648 dataname = string_sprintf("%s.msg", mailstore_basename);
2650 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2651 if (fd < 0 && /* failed to open, and */
2652 (errno != ENOENT || /* either not non-exist */
2653 !ob->create_directory || /* or not allowed to make */
2654 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2655 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2657 addr->basic_errno = errno;
2658 addr->message = string_sprintf("while creating file %s", filename);
2662 /* Why are these here? Put in because they are present in the non-maildir
2663 directory case above. */
2665 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2667 addr->basic_errno = errno;
2668 addr->message = string_sprintf("while setting perms on file %s",
2673 /* Built a C stream from the open file descriptor. */
2675 if ((env_file = fdopen(fd, "wb")) == NULL)
2677 addr->basic_errno = errno;
2678 addr->transport_return = PANIC;
2679 addr->message = string_sprintf("fdopen of %s ("
2680 "for %s transport) failed", filename, tblock->name);
2686 /* Write the envelope file, then close it. */
2688 if (ob->mailstore_prefix != NULL)
2690 uschar *s = expand_string(ob->mailstore_prefix);
2693 if (!expand_string_forcedfail)
2695 addr->transport_return = PANIC;
2696 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2697 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2698 tblock->name, expand_string_message);
2699 (void)fclose(env_file);
2707 fprintf(env_file, "%s", CS s);
2708 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2712 fprintf(env_file, "%s\n", sender_address);
2714 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2715 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2717 if (ob->mailstore_suffix != NULL)
2719 uschar *s = expand_string(ob->mailstore_suffix);
2722 if (!expand_string_forcedfail)
2724 addr->transport_return = PANIC;
2725 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2726 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2727 tblock->name, expand_string_message);
2728 (void)fclose(env_file);
2736 fprintf(env_file, "%s", CS s);
2737 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2741 if (fclose(env_file) != 0)
2743 addr->basic_errno = errno;
2744 addr->message = string_sprintf("while closing %s", filename);
2749 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2751 /* Now open the data file, and ensure that it has the correct ownership and
2754 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2757 addr->basic_errno = errno;
2758 addr->message = string_sprintf("while creating file %s", dataname);
2762 if(Uchown(dataname, uid, gid) || Uchmod(dataname, mode))
2764 addr->basic_errno = errno;
2765 addr->message = string_sprintf("while setting perms on file %s",
2771 #endif /* SUPPORT_MAILSTORE */
2774 /* In all cases of writing to a new file, ensure that the file which is
2775 going to be renamed has the correct ownership and mode. */
2777 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2779 addr->basic_errno = errno;
2780 addr->message = string_sprintf("while setting perms on file %s",
2787 /* At last we can write the message to the file, preceded by any configured
2788 prefix line, and followed by any configured suffix line. If there are any
2789 writing errors, we must defer. */
2791 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2796 /* If there is a local quota setting, check that we are not going to exceed it
2797 with this message if quota_is_inclusive is set; if it is not set, the check
2798 is for the mailbox already being over quota (i.e. the current message is not
2799 included in the check). */
2801 if (!disable_quota && ob->quota_value > 0)
2805 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2806 " this message = %d (%sincluded)\n",
2807 ob->quota_value, mailbox_size, message_size,
2808 ob->quota_is_inclusive ? "" : "not ");
2809 debug_printf(" file count quota = %d count = %d\n",
2810 ob->quota_filecount_value, mailbox_filecount);
2813 if (mailbox_size + (ob->quota_is_inclusive ? message_size:0) > ob->quota_value)
2816 if (!ob->quota_no_check)
2818 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2820 errno = ERRNO_EXIMQUOTA;
2822 else DEBUG(D_transport) debug_printf("mailbox quota exceeded but ignored\n");
2826 if (ob->quota_filecount_value > 0
2827 && mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2828 ob->quota_filecount_value)
2829 if(!ob->quota_filecount_no_check)
2831 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2833 errno = ERRNO_EXIMQUOTA;
2834 filecount_msg = US" filecount";
2836 else DEBUG(D_transport) if (ob->quota_filecount_no_check)
2837 debug_printf("mailbox file count quota exceeded but ignored\n");
2841 /* If we are writing in MBX format, what we actually do is to write the message
2842 to a temporary file, and then copy it to the real file once we know its size.
2843 This is the most straightforward way of getting the correct length in the
2844 separator line. So, what we do here is to save the real file descriptor, and
2845 replace it with one for a temporary file. The temporary file gets unlinked once
2846 opened, so that it goes away on closure. */
2849 if (yield == OK && ob->mbx_format)
2851 temp_file = tmpfile();
2852 if (temp_file == NULL)
2854 addr->basic_errno = errno;
2855 addr->message = US"while setting up temporary file";
2860 fd = fileno(temp_file);
2861 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2863 #endif /* SUPPORT_MBX */
2865 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2868 transport_count = 0;
2869 transport_newlines = 0;
2871 /* Write any configured prefix text first */
2873 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2875 uschar *prefix = expand_string(ob->message_prefix);
2878 errno = ERRNO_EXPANDFAIL;
2879 addr->transport_return = PANIC;
2880 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2881 "transport) failed", ob->message_prefix, tblock->name);
2884 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2887 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2888 various different values for batching are handled outside; if there is more
2889 than one address available here, all must be included. If any address is a
2890 file, use its parent in the RCPT TO. */
2892 if (yield == OK && ob->use_bsmtp)
2894 transport_count = 0;
2895 transport_newlines = 0;
2896 if (ob->use_crlf) cr = US"\r";
2897 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2902 transport_newlines++;
2903 for (a = addr; a != NULL; a = a->next)
2905 address_item *b = testflag(a, af_pfr) ? a->parent: a;
2906 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2907 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2908 { yield = DEFER; break; }
2909 transport_newlines++;
2911 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2914 transport_newlines++;
2918 /* Now the message itself. The options for transport_write_message were set up
2919 at initialization time. */
2923 transport_ctx tctx = {
2931 if (!transport_write_message(&tctx, 0))
2935 /* Now a configured suffix. */
2937 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2939 uschar *suffix = expand_string(ob->message_suffix);
2942 errno = ERRNO_EXPANDFAIL;
2943 addr->transport_return = PANIC;
2944 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2945 "transport) failed", ob->message_suffix, tblock->name);
2948 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2951 /* If batch smtp, write the terminating dot. */
2953 if (yield == OK && ob->use_bsmtp ) {
2954 if(!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2955 else transport_newlines++;
2958 /* If MBX format is being used, all that writing was to the temporary file.
2959 However, if there was an earlier failure (Exim quota exceeded, for example),
2960 the temporary file won't have got opened - and no writing will have been done.
2961 If writing was OK, we restore the fd, and call a function that copies the
2962 message in MBX format into the real file. Otherwise use the temporary name in
2966 if (temp_file != NULL && ob->mbx_format)
2973 transport_count = 0; /* Reset transport count for actual write */
2974 /* No need to reset transport_newlines as we're just using a block copy
2975 * routine so the number won't be affected */
2976 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2978 else if (errno >= 0) dataname = US"temporary file";
2980 /* Preserve errno while closing the temporary file. */
2982 mbx_save_errno = errno;
2983 (void)fclose(temp_file);
2984 errno = mbx_save_errno;
2986 #endif /* SUPPORT_MBX */
2988 /* Force out the remaining data to check for any errors; some OS don't allow
2989 fsync() to be called for a FIFO. */
2991 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2993 /* Update message_size and message_linecount to the accurate count of bytes
2994 written, including added headers. Note; we subtract 1 from message_linecount as
2995 this variable doesn't count the new line between the header and the body of the
2998 message_size = transport_count;
2999 message_linecount = transport_newlines - 1;
3001 /* If using a maildir++ quota file, add this message's size to it, and
3002 close the file descriptor, except when the quota has been disabled because we
3003 are delivering into an uncounted folder. */
3005 #ifdef SUPPORT_MAILDIR
3008 if (yield == OK && maildirsize_fd >= 0)
3009 maildir_record_length(maildirsize_fd, message_size);
3010 maildir_save_errno = errno; /* Preserve errno while closing the file */
3011 if (maildirsize_fd >= 0)
3012 (void)close(maildirsize_fd);
3013 errno = maildir_save_errno;
3015 #endif /* SUPPORT_MAILDIR */
3017 /* If there is a quota warning threshold and we are have crossed it with this
3018 message, set the SPECIAL_WARN flag in the address, to cause a warning message
3021 if (!disable_quota && THRESHOLD_CHECK)
3023 off_t threshold = ob->quota_warn_threshold_value;
3024 if (ob->quota_warn_threshold_is_percent)
3025 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
3027 debug_printf("quota = " OFF_T_FMT
3028 " threshold = " OFF_T_FMT
3029 " old size = " OFF_T_FMT
3030 " message size = %d\n",
3031 ob->quota_value, threshold, mailbox_size,
3033 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
3034 addr->special_action = SPECIAL_WARN;
3036 /******* You might think that the test ought to be this:
3038 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
3039 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
3041 * (indeed, I was sent a patch with that in). However, it is possible to
3042 * have a warning threshold without actually imposing a quota, and I have
3043 * therefore kept Exim backwards compatible.
3048 /* Handle error while writing the file. Control should come here directly after
3049 the error, with the reason in errno. In the case of expansion failure in prefix
3050 or suffix, it will be ERRNO_EXPANDFAIL. */
3054 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
3056 /* Save the error number. If positive, it will ultimately cause a strerror()
3057 call to generate some text. */
3059 addr->basic_errno = errno;
3061 /* For system or Exim quota excession, or disk full, set more_errno to the
3062 time since the file was last read. If delivery was into a directory, the
3063 time since last read logic is not relevant, in general. However, for maildir
3064 deliveries we can approximate it by looking at the last modified time of the
3065 "new" subdirectory. Since Exim won't be adding new messages, a change to the
3066 "new" subdirectory implies that an MUA has moved a message from there to the
3069 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
3071 addr->more_errno = 0;
3072 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
3074 #ifdef SUPPORT_MAILDIR
3075 else if (mbformat == mbf_maildir)
3077 struct stat statbuf;
3078 if (Ustat("new", &statbuf) < 0)
3080 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
3081 "stat error %d for \"new\": %s\n", errno, strerror(errno));
3083 else /* Want a repeatable time when in test harness */
3085 addr->more_errno = running_in_test_harness ? 10 :
3086 (int)time(NULL) - statbuf.st_mtime;
3089 debug_printf("maildir: time since \"new\" directory modified = %s\n",
3090 readconf_printtime(addr->more_errno));
3092 #endif /* SUPPORT_MAILDIR */
3095 /* Handle system quota excession. Add an explanatory phrase for the error
3096 message, since some systems don't have special quota-excession errors,
3097 and on those that do, "quota" doesn't always mean anything to the user. */
3099 if (errno == errno_quota)
3102 addr->message = string_sprintf("mailbox is full "
3103 "(quota exceeded while writing to file %s)", filename);
3105 addr->message = string_sprintf("mailbox is full");
3107 addr->user_message = US"mailbox is full";
3108 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3110 isdirectory ? US"" : US": time since file read = ",
3111 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3114 /* Handle Exim's own quota-imposition */
3116 else if (errno == ERRNO_EXIMQUOTA)
3118 addr->message = string_sprintf("mailbox is full "
3119 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3121 addr->user_message = US"mailbox is full";
3122 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3123 filecount_msg, dataname,
3124 isdirectory ? US"" : US": time since file read = ",
3125 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3128 /* Handle a process failure while writing via a filter; the return
3129 from child_close() is in more_errno. */
3131 else if (errno == ERRNO_FILTER_FAIL)
3134 addr->message = string_sprintf("transport filter process failed (%d) "
3135 "while writing to %s%s", addr->more_errno, dataname,
3136 (addr->more_errno == EX_EXECFAILED) ? ": unable to execute command" : "");
3139 /* Handle failure to expand header changes */
3141 else if (errno == ERRNO_CHHEADER_FAIL)
3145 string_sprintf("failed to expand headers_add or headers_remove while "
3146 "writing to %s: %s", dataname, expand_string_message);
3149 /* Handle failure to complete writing of a data block */
3151 else if (errno == ERRNO_WRITEINCOMPLETE)
3153 addr->message = string_sprintf("failed to write data block while "
3154 "writing to %s", dataname);
3157 /* Handle length mismatch on MBX copying */
3160 else if (errno == ERRNO_MBXLENGTH)
3162 addr->message = string_sprintf("length mismatch while copying MBX "
3163 "temporary file to %s", dataname);
3165 #endif /* SUPPORT_MBX */
3167 /* For other errors, a general-purpose explanation, if the message is
3170 else if (addr->message == NULL)
3171 addr->message = string_sprintf("error while writing to %s", dataname);
3173 /* For a file, reset the file size to what it was before we started, leaving
3174 the last modification time unchanged, so it will get reset also. All systems
3175 investigated so far have ftruncate(), whereas not all have the F_FREESP
3176 fcntl() call (BSDI & FreeBSD do not). */
3178 if (!isdirectory && ftruncate(fd, saved_size))
3179 DEBUG(D_transport) debug_printf("Error resetting file size\n");
3182 /* Handle successful writing - we want the modification time to be now for
3183 appended files. Remove the default backstop error number. For a directory, now
3184 is the time to rename the file with a unique name. As soon as such a name
3185 appears it may get used by another process, so we close the file first and
3186 check that all is well. */
3190 times.modtime = time(NULL);
3191 addr->basic_errno = 0;
3193 /* Handle the case of writing to a new file in a directory. This applies
3194 to all single-file formats - maildir, mailstore, and "smail format". */
3198 if (fstat(fd, &statbuf) < 0)
3200 addr->basic_errno = errno;
3201 addr->message = string_sprintf("while fstatting opened message file %s",
3206 else if (close(fd) < 0)
3208 addr->basic_errno = errno;
3209 addr->message = string_sprintf("close() error for %s",
3210 (ob->mailstore_format) ? dataname : filename);
3214 /* File is successfully written and closed. Arrange to rename it. For the
3215 different kinds of single-file delivery, some games can be played with the
3216 name. The message size is by this time set to the accurate value so that
3217 its value can be used in expansions. */
3221 uschar *renamename = newname;
3224 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3226 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3227 situation. The name is built by expanding the directory_file option, and
3228 we make the inode number available for use in this. The expansion was
3229 checked for syntactic validity above, before we wrote the file.
3231 We have to be careful here, in case the file name exists. (In the other
3232 cases, the names used are constructed to be unique.) The rename()
3233 function just replaces an existing file - we don't want that! So instead
3234 of calling rename(), we must use link() and unlink().
3236 In this case, if the link fails because of an existing file, we wait
3237 for one second and try the expansion again, to see if it produces a
3238 different value. Do this up to 5 times unless the name stops changing.
3239 This makes it possible to build values that are based on the time, and
3240 still cope with races from multiple simultaneous deliveries. */
3242 if (newname == NULL)
3246 uschar *old_renameleaf = US"";
3248 for (i = 0; ; sleep(1), i++)
3250 deliver_inode = statbuf.st_ino;
3251 renameleaf = expand_string(ob->dirfilename);
3254 if (renameleaf == NULL)
3256 addr->transport_return = PANIC;
3257 addr->message = string_sprintf("Expansion of \"%s\" "
3258 "(directory_file for %s transport) failed: %s",
3259 ob->dirfilename, tblock->name, expand_string_message);
3263 renamename = string_sprintf("%s/%s", path, renameleaf);
3264 if (Ulink(filename, renamename) < 0)
3266 DEBUG(D_transport) debug_printf("link failed: %s\n",
3268 if (errno != EEXIST || i >= 4 ||
3269 Ustrcmp(renameleaf, old_renameleaf) == 0)
3271 addr->basic_errno = errno;
3272 addr->message = string_sprintf("while renaming %s as %s",
3273 filename, renamename);
3277 old_renameleaf = renameleaf;
3278 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3287 } /* re-expand loop */
3288 } /* not mailstore or maildir */
3290 /* For maildir and mailstore formats, the new name was created earlier,
3291 except that for maildir, there is the possibility of adding a "tag" on
3292 the end of the name by expanding the value of nametag. This usually
3293 includes a reference to the message size. The expansion of nametag was
3294 checked above, before the file was opened. It either succeeded, or
3295 provoked a soft failure. So any failure here can be treated as soft.
3296 Ignore non-printing characters and / and put a colon at the start if the
3297 first character is alphanumeric. */
3301 if (nametag != NULL)
3303 uschar *iptr = expand_string(nametag);
3306 uschar *etag = store_get(Ustrlen(iptr) + 2);
3307 uschar *optr = etag;
3310 if (mac_isgraph(*iptr) && *iptr != '/')
3312 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3318 renamename = string_sprintf("%s%s", newname, etag);
3322 /* Do the rename. If the name is too long and a tag exists, try again
3325 if (Urename(filename, renamename) < 0 &&
3326 (nametag == NULL || errno != ENAMETOOLONG ||
3327 (renamename = newname, Urename(filename, renamename) < 0)))
3329 addr->basic_errno = errno;
3330 addr->message = string_sprintf("while renaming %s as %s",
3331 filename, renamename);
3335 /* Rename succeeded */
3339 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3341 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3343 } /* maildir or mailstore */
3344 } /* successful write + close */
3346 } /* write success */
3349 /* For a file, restore the last access time (atime), and set the modification
3350 time as required - changed if write succeeded, unchanged if not. */
3352 if (!isdirectory) utime(CS filename, ×);
3354 /* Notify comsat if configured to do so. It only makes sense if the configured
3355 file is the one that the comsat daemon knows about. */
3357 if (ob->notify_comsat && yield == OK && deliver_localpart != NULL)
3358 notify_comsat(deliver_localpart, saved_size);
3360 /* Pass back the final return code in the address structure */
3363 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3364 yield, addr->basic_errno, addr->more_errno);
3366 addr->transport_return = yield;
3368 /* Close the file, which will release the fcntl lock. For a directory write it
3369 is closed above, except in cases of error which goto RETURN, when we also need
3370 to remove the original file(s). For MBX locking, if all has gone well, before
3371 closing the file, see if we can get an exclusive lock on it, in which case we
3372 can unlink the /tmp lock file before closing it. This is always a non-blocking
3373 lock; there's no need to wait if we can't get it. If everything has gone right
3374 but close fails, defer the message. Then unlink the lock file, if present. This
3375 point in the code is jumped to from a number of places when errors are
3376 detected, in order to get the file closed and the lock file tidied away. */
3381 if (mbx_lockfd >= 0)
3383 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3384 ob->use_flock, 0) >= 0)
3387 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3388 Uunlink(mbx_lockname);
3390 (void)close(mbx_lockfd);
3392 #endif /* SUPPORT_MBX */
3394 if (fd >= 0 && close(fd) < 0 && yield == OK)
3396 addr->basic_errno = errno;
3397 addr->message = string_sprintf("while closing %s", filename);
3398 addr->transport_return = DEFER;
3401 if (hd >= 0) Uunlink(lockname);
3403 /* We get here with isdirectory and filename set only in error situations. */
3405 if (isdirectory && filename != NULL)
3408 if (dataname != filename) Uunlink(dataname);
3411 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3412 file name relies on time + pid. We must not allow the process to finish until
3413 the clock has move on by at least one microsecond. Usually we expect this
3414 already to be the case, but machines keep getting faster... */
3416 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3418 /* A return of FALSE means that if there was an error, a common error was
3419 put in the first address of a batch. */
3424 #endif /*!MACRO_PREDEF*/
3425 /* End of transport/appendfile.c */