1 /* $Cambridge: exim/src/src/spool_out.c,v 1.1.2.1 2004/12/02 09:15:11 tom Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2004 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* Functions for writing spool files, and moving them about. */
17 /*************************************************
18 * Deal with header writing errors *
19 *************************************************/
21 /* This function is called immediately after errors in writing the spool, with
22 errno still set. It creates and error message, depending on the circumstances.
23 If errmsg is NULL, it logs the message and panic-dies. Otherwise errmsg is set
24 to point to the message, and -1 is returned. This function makes the code of
25 spool_write_header() a bit neater.
28 where SW_RECEIVING, SW_DELIVERING, or SW_MODIFYING
29 errmsg where to put the message; NULL => panic-die
30 s text to add to log string
31 temp_name name of temp file to unlink
32 f FILE to close, if not NULL
34 Returns: -1 if errmsg is not NULL; otherwise doesn't return
38 spool_write_error(int where, uschar **errmsg, uschar *s, uschar *temp_name,
41 uschar *msg = (where == SW_RECEIVING)?
42 string_sprintf("spool file %s error while receiving from %s: %s", s,
43 (sender_fullhost != NULL)? sender_fullhost : sender_ident,
46 string_sprintf("spool file %s error while %s: %s", s,
47 (where == SW_DELIVERING)? "delivering" : "modifying",
50 if (temp_name != NULL) Uunlink(temp_name);
51 if (f != NULL) fclose(f);
54 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", msg);
63 /*************************************************
64 * Open file under temporary name *
65 *************************************************/
67 /* This is used for opening spool files under a temporary name,
68 with a single attempt at deleting if they already exist.
70 Argument: temporary name for spool header file
71 Returns: file descriptor of open file, or < 0 on failure, with errno unchanged
75 spool_open_temp(uschar *temp_name)
77 int fd = Uopen(temp_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
79 /* If the file already exists, something has gone wrong. This process may well
80 have previously created the file if it is delivering more than one address, but
81 it should have renamed it almost immediately. A file could, however, be left
82 around as a result of a system crash, and by coincidence this process might
83 have the same pid. We therefore have one go at unlinking it before giving up.
86 if (fd < 0 && errno == EEXIST)
88 DEBUG(D_any) debug_printf("%s exists: unlinking\n", temp_name);
90 fd = Uopen(temp_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
93 /* If the file has been opened, make sure the file's group is the Exim gid, and
94 double-check the mode because the group setting doesn't always get set
99 fchown(fd, exim_uid, exim_gid);
100 fchmod(fd, SPOOL_MODE);
108 /*************************************************
109 * Write the header spool file *
110 *************************************************/
112 /* Returns the size of the file for success; zero for failure. The file is
113 written under a temporary name, and then renamed. It's done this way so that it
114 works with re-writing the file on message deferral as well as for the initial
115 write. Whenever this function is called, the data file for the message should
116 be open and locked, thus preventing any other exim process from working on this
121 where SW_RECEIVING, SW_DELIVERING, or SW_MODIFYING
122 errmsg where to put an error message; if NULL, panic-die on error
124 Returns: the size of the header texts on success;
125 negative on writing failure, unless errmsg == NULL
129 spool_write_header(uschar *id, int where, uschar **errmsg)
138 uschar temp_name[256];
140 sprintf(CS temp_name, "%s/input/%s/hdr.%d", spool_directory, message_subdir,
142 fd = spool_open_temp(temp_name);
143 if (fd < 0) return spool_write_error(where, errmsg, US"open", NULL, NULL);
144 f = fdopen(fd, "wb");
145 DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file\n");
147 /* We now have an open file to which the header data is to be written. Start
148 with the file's leaf name, to make the file self-identifying. Continue with the
149 identity of the submitting user, followed by the sender's address. The sender's
150 address is enclosed in <> because it might be the null address. Then write the
151 received time and the number of warning messages that have been sent. */
153 fprintf(f, "%s-H\n", message_id);
154 fprintf(f, "%.63s %ld %ld\n", originator_login, (long int)originator_uid,
155 (long int)originator_gid);
156 fprintf(f, "<%s>\n", sender_address);
157 fprintf(f, "%d %d\n", received_time, warning_count);
159 /* If there is information about a sending host, remember it. The HELO
160 data can be set for local SMTP as well as remote. */
162 if (sender_helo_name != NULL)
163 fprintf(f, "-helo_name %s\n", sender_helo_name);
165 if (sender_host_address != NULL)
167 fprintf(f, "-host_address %s.%d\n", sender_host_address, sender_host_port);
168 if (sender_host_name != NULL)
169 fprintf(f, "-host_name %s\n", sender_host_name);
170 if (sender_host_authenticated != NULL)
171 fprintf(f, "-host_auth %s\n", sender_host_authenticated);
174 /* Also about the interface a message came in on */
176 if (interface_address != NULL)
177 fprintf(f, "-interface_address %s.%d\n", interface_address, interface_port);
179 /* Likewise for any ident information; for local messages this is
180 likely to be the same as originator_login, but will be different if
181 the originator was root, forcing a different ident. */
183 if (sender_ident != NULL) fprintf(f, "-ident %s\n", sender_ident);
185 /* Ditto for the received protocol */
187 if (received_protocol != NULL)
188 fprintf(f, "-received_protocol %s\n", received_protocol);
190 /* Preserve any ACL variables that are set. Because the values may contain
191 newlines, we use an explicit length. */
193 for (i = 0; i < ACL_C_MAX + ACL_M_MAX; i++)
195 if (acl_var[i] != NULL)
196 fprintf(f, "-acl %d %d\n%s\n", i, Ustrlen(acl_var[i]), acl_var[i]);
199 /* Now any other data that needs to be remembered. */
201 fprintf(f, "-body_linecount %d\n", body_linecount);
203 if (body_zerocount > 0) fprintf(f, "-body_zerocount %d\n", body_zerocount);
205 if (authenticated_id != NULL)
206 fprintf(f, "-auth_id %s\n", authenticated_id);
207 if (authenticated_sender != NULL)
208 fprintf(f, "-auth_sender %s\n", authenticated_sender);
210 if (allow_unqualified_recipient) fprintf(f, "-allow_unqualified_recipient\n");
211 if (allow_unqualified_sender) fprintf(f, "-allow_unqualified_sender\n");
212 if (deliver_firsttime) fprintf(f, "-deliver_firsttime\n");
213 if (deliver_freeze) fprintf(f, "-frozen %d\n", deliver_frozen_at);
214 if (dont_deliver) fprintf(f, "-N\n");
215 if (host_lookup_failed) fprintf(f, "-host_lookup_failed\n");
216 if (sender_local) fprintf(f, "-local\n");
217 if (local_error_message) fprintf(f, "-localerror\n");
218 if (local_scan_data != NULL) fprintf(f, "-local_scan %s\n", local_scan_data);
219 #ifdef WITH_CONTENT_SCAN
220 if (spam_score_int != NULL) fprintf(f,"-spam_score_int %s\n", spam_score_int);
222 if (deliver_manual_thaw) fprintf(f, "-manual_thaw\n");
223 if (sender_set_untrusted) fprintf(f, "-sender_set_untrusted\n");
226 if (tls_certificate_verified) fprintf(f, "-tls_certificate_verified\n");
227 if (tls_cipher != NULL) fprintf(f, "-tls_cipher %s\n", tls_cipher);
228 if (tls_peerdn != NULL) fprintf(f, "-tls_peerdn %s\n", tls_peerdn);
231 /* To complete the envelope, write out the tree of non-recipients, followed by
232 the list of recipients. These won't be disjoint the first time, when no
233 checking has been done. If a recipient is a "one-time" alias, it is followed by
234 a space and its parent address number (pno). */
236 tree_write(tree_nonrecipients, f);
237 fprintf(f, "%d\n", recipients_count);
238 for (i = 0; i < recipients_count; i++)
240 recipient_item *r = recipients_list + i;
241 if (r->pno < 0 && r->errors_to == NULL)
242 fprintf(f, "%s\n", r->address);
245 uschar *errors_to = (r->errors_to == NULL)? US"" : r->errors_to;
246 fprintf(f, "%s %s %d,%d#1\n", r->address, errors_to,
247 Ustrlen(errors_to), r->pno);
251 /* Put a blank line before the headers */
255 /* Save the size of the file so far so we can subtract it from the final length
256 to get the actual size of the headers. */
260 size_correction = statbuf.st_size;
262 /* Finally, write out the message's headers. To make it easier to read them
263 in again, precede each one with the count of its length. Make the count fixed
264 length to aid human eyes when debugging and arrange for it not be included in
265 the size. It is followed by a space for normal headers, a flagging letter for
266 various other headers, or an asterisk for old headers that have been rewritten.
267 These are saved as a record for debugging. Don't included them in the message's
270 for (h = header_list; h != NULL; h = h->next)
272 fprintf(f, "%03d%c %s", h->slen, h->type, h->text);
273 size_correction += 5;
274 if (h->type == '*') size_correction += h->slen;
277 /* Flush and check for any errors while writing */
279 if (fflush(f) != 0 || ferror(f))
280 return spool_write_error(where, errmsg, US"write", temp_name, f);
282 /* Force the file's contents to be written to disk. Note that fflush()
283 just pushes it out of C, and fclose() doesn't guarantee to do the write
284 either. That's just the way Unix works... */
286 if (fsync(fileno(f)) < 0)
287 return spool_write_error(where, errmsg, US"sync", temp_name, f);
289 /* Get the size of the file, and close it. */
293 return spool_write_error(where, errmsg, US"close", temp_name, NULL);
295 /* Rename the file to its correct name, thereby replacing any previous
298 sprintf(CS name, "%s/input/%s/%s-H", spool_directory, message_subdir, id);
300 if (Urename(temp_name, name) < 0)
301 return spool_write_error(where, errmsg, US"rename", temp_name, NULL);
303 /* Linux (and maybe other OS?) does not automatically sync a directory after
304 an operation like rename. We therefore have to do it forcibly ourselves in
305 these cases, to make sure the file is actually accessible on disk, as opposed
306 to just the data being accessible from a file in lost+found. Linux also has
307 O_DIRECTORY, for opening a directory.
309 However, it turns out that some file systems (some versions of NFS?) do not
310 support directory syncing. It seems safe enough to ignore EINVAL to cope with
311 these cases. One hack on top of another... but that's life. */
313 #ifdef NEED_SYNC_DIRECTORY
315 sprintf(CS temp_name, "%s/input/%s/.", spool_directory, message_subdir);
318 #define O_DIRECTORY 0
321 if ((fd = Uopen(temp_name, O_RDONLY|O_DIRECTORY, 0)) < 0)
322 return spool_write_error(where, errmsg, US"directory open", name, NULL);
324 if (fsync(fd) < 0 && errno != EINVAL)
325 return spool_write_error(where, errmsg, US"directory sync", name, NULL);
328 return spool_write_error(where, errmsg, US"directory close", name, NULL);
330 #endif /* NEED_SYNC_DIRECTORY */
332 /* Return the number of characters in the headers, which is the file size, less
333 the prelimary stuff, less the additional count fields on the headers. */
335 DEBUG(D_receive) debug_printf("Size of headers = %d\n",
336 (int)(statbuf.st_size - size_correction));
338 return statbuf.st_size - size_correction;
342 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
344 /************************************************
346 ************************************************/
348 /* Used by spool_move_message() below. Note re the use of sprintf(): the value
349 of spool_directory is checked to ensure that it is less than 200 characters at
353 dir base directory name
354 subdir subdirectory name
356 suffix suffix to add to id
357 from source directory prefix
358 to destination directory prefix
359 noentok if TRUE, absence of file is not an error
361 Returns: TRUE if all went well
362 FALSE, having panic logged if not
366 make_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
367 uschar *to, BOOL noentok)
369 uschar f[256], t[256];
370 sprintf(CS f, "%s/%s%s/%s/%s%s", spool_directory, from, dir, subdir, id, suffix);
371 sprintf(CS t, "%s/%s%s/%s/%s%s", spool_directory, to, dir, subdir, id, suffix);
372 if (Ulink(f, t) < 0 && (!noentok || errno != ENOENT))
374 log_write(0, LOG_MAIN|LOG_PANIC, "link(\"%s\", \"%s\") failed while moving "
375 "message: %s", f, t, strerror(errno));
383 /************************************************
385 ************************************************/
387 /* Used by spool_move_message() below. Note re the use of sprintf(): the value
388 of spool_directory is checked to ensure that it is less than 200 characters at
392 dir base directory name
393 subdir subdirectory name
395 suffix suffix to add to id
396 from source directory prefix
397 noentok if TRUE, absence of file is not an error
399 Returns: TRUE if all went well
400 FALSE, having panic logged if not
404 break_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
408 sprintf(CS f, "%s/%s%s/%s/%s%s", spool_directory, from, dir, subdir, id, suffix);
409 if (Uunlink(f) < 0 && (!noentok || errno != ENOENT))
411 log_write(0, LOG_MAIN|LOG_PANIC, "unlink(\"%s\") failed while moving "
412 "message: %s", f, strerror(errno));
420 /************************************************
421 * Move message files *
422 ************************************************/
424 /* Move the files for a message (-H, -D, and msglog) from one directory (or
425 hierarchy) to another. It is assume that there is no -J file in existence when
426 this is done. At present, this is used only when move_frozen_messages is set,
427 so compile it only when that support is configured.
430 id the id of the message to be delivered
431 subdir the subdirectory name, or an empty string
432 from a prefix for "input" or "msglog" for where the message is now
433 to a prefix for "input" or "msglog" for where the message is to go
435 Returns: TRUE if all is well
436 FALSE if not, with error logged in panic and main logs
440 spool_move_message(uschar *id, uschar *subdir, uschar *from, uschar *to)
442 /* Create any output directories that do not exist. */
444 sprintf(CS big_buffer, "%sinput/%s", to, subdir);
445 (void)directory_make(spool_directory, big_buffer, INPUT_DIRECTORY_MODE, TRUE);
446 sprintf(CS big_buffer, "%smsglog/%s", to, subdir);
447 (void)directory_make(spool_directory, big_buffer, INPUT_DIRECTORY_MODE, TRUE);
449 /* Move the message by first creating new hard links for all the files, and
450 then removing the old links. When moving messages onto the main spool, the -H
451 file should be set up last, because that's the one that tells Exim there is a
452 message to be delivered, so we create its new link last and remove its old link
453 first. Programs that look at the alternate directories should follow the same
454 rule of waiting for a -H file before doing anything. When moving messsages off
455 the mail spool, the -D file should be open and locked at the time, thus keeping
458 if (!make_link(US"msglog", subdir, id, US"", from, to, TRUE) ||
459 !make_link(US"input", subdir, id, US"-D", from, to, FALSE) ||
460 !make_link(US"input", subdir, id, US"-H", from, to, FALSE))
463 if (!break_link(US"input", subdir, id, US"-H", from, FALSE) ||
464 !break_link(US"input", subdir, id, US"-D", from, FALSE) ||
465 !break_link(US"msglog", subdir, id, US"", from, TRUE))
468 log_write(0, LOG_MAIN, "moved from %sinput, %smsglog to %sinput, %smsglog",
476 /* End of spool_out.c */