1 /* $Cambridge: exim/src/src/transports/appendfile.c,v 1.12 2006/02/10 16:29:20 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2006 */
8 /* See the file NOTICE for conditions of use and distribution. */
12 #include "appendfile.h"
14 #ifdef SUPPORT_MAILDIR
15 #include "tf_maildir.h"
19 /* Encodings for mailbox formats, and their names. MBX format is actually
20 supported only if SUPPORT_MBX is set. */
22 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
24 static char *mailbox_formats[] = {
25 "unix", "mbx", "smail", "maildir", "mailstore" };
28 /* Check warn threshold only if quota size set or not a percentage threshold
29 percentage check should only be done if quota > 0 */
31 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
32 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
35 /* Options specific to the appendfile transport. They must be in alphabetic
36 order (note that "_" comes before the lower case letters). Some of them are
37 stored in the publicly visible instance block - these are flagged with the
40 optionlist appendfile_transport_options[] = {
41 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
42 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
43 { "*set_use_flock_lock",opt_bool | opt_hidden,
44 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
45 { "*set_use_lockfile", opt_bool | opt_hidden,
46 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
48 { "*set_use_mbx_lock", opt_bool | opt_hidden,
49 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
51 { "allow_fifo", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
53 { "allow_symlink", opt_bool,
54 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
55 { "batch_id", opt_stringptr | opt_public,
56 (void *)offsetof(transport_instance, batch_id) },
57 { "batch_max", opt_int | opt_public,
58 (void *)offsetof(transport_instance, batch_max) },
59 { "check_group", opt_bool,
60 (void *)offsetof(appendfile_transport_options_block, check_group) },
61 { "check_owner", opt_bool,
62 (void *)offsetof(appendfile_transport_options_block, check_owner) },
63 { "check_string", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, check_string) },
65 { "create_directory", opt_bool,
66 (void *)offsetof(appendfile_transport_options_block, create_directory) },
67 { "create_file", opt_stringptr,
68 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
69 { "directory", opt_stringptr,
70 (void *)offsetof(appendfile_transport_options_block, dirname) },
71 { "directory_file", opt_stringptr,
72 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
73 { "directory_mode", opt_octint,
74 (void *)offsetof(appendfile_transport_options_block, dirmode) },
75 { "escape_string", opt_stringptr,
76 (void *)offsetof(appendfile_transport_options_block, escape_string) },
77 { "file", opt_stringptr,
78 (void *)offsetof(appendfile_transport_options_block, filename) },
79 { "file_format", opt_stringptr,
80 (void *)offsetof(appendfile_transport_options_block, file_format) },
81 { "file_must_exist", opt_bool,
82 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
83 { "lock_fcntl_timeout", opt_time,
84 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
85 { "lock_flock_timeout", opt_time,
86 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
87 { "lock_interval", opt_time,
88 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
89 { "lock_retries", opt_int,
90 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
91 { "lockfile_mode", opt_octint,
92 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
93 { "lockfile_timeout", opt_time,
94 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
95 { "mailbox_filecount", opt_stringptr,
96 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
97 { "mailbox_size", opt_stringptr,
98 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
99 #ifdef SUPPORT_MAILDIR
100 { "maildir_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
102 { "maildir_quota_directory_regex", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
104 { "maildir_retries", opt_int,
105 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
106 { "maildir_tag", opt_stringptr,
107 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
108 { "maildir_use_size_file", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
110 #endif /* SUPPORT_MAILDIR */
111 #ifdef SUPPORT_MAILSTORE
112 { "mailstore_format", opt_bool,
113 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
114 { "mailstore_prefix", opt_stringptr,
115 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
116 { "mailstore_suffix", opt_stringptr,
117 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
118 #endif /* SUPPORT_MAILSTORE */
120 { "mbx_format", opt_bool,
121 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
122 #endif /* SUPPORT_MBX */
123 { "message_prefix", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
125 { "message_suffix", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
127 { "mode", opt_octint,
128 (void *)offsetof(appendfile_transport_options_block, mode) },
129 { "mode_fail_narrower",opt_bool,
130 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
131 { "notify_comsat", opt_bool,
132 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
133 { "quota", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota) },
135 { "quota_directory", opt_stringptr,
136 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
137 { "quota_filecount", opt_stringptr,
138 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
139 { "quota_is_inclusive", opt_bool,
140 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
141 { "quota_size_regex", opt_stringptr,
142 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
143 { "quota_warn_message", opt_stringptr | opt_public,
144 (void *)offsetof(transport_instance, warn_message) },
145 { "quota_warn_threshold", opt_stringptr,
146 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
147 { "use_bsmtp", opt_bool,
148 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
149 { "use_crlf", opt_bool,
150 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
151 { "use_fcntl_lock", opt_bool_set,
152 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
153 { "use_flock_lock", opt_bool_set,
154 (void *)offsetof(appendfile_transport_options_block, use_flock) },
155 { "use_lockfile", opt_bool_set,
156 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
158 { "use_mbx_lock", opt_bool_set,
159 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
160 #endif /* SUPPORT_MBX */
163 /* Size of the options list. An extern variable has to be used so that its
164 address can appear in the tables drtables.c. */
166 int appendfile_transport_options_count =
167 sizeof(appendfile_transport_options)/sizeof(optionlist);
169 /* Default private options block for the appendfile transport. */
171 appendfile_transport_options_block appendfile_transport_option_defaults = {
174 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
175 NULL, /* message_prefix (default reset in init if not bsmtp) */
176 NULL, /* message_suffix (ditto) */
177 US"anywhere", /* create_file_string (string value for create_file) */
179 NULL, /* quota_directory */
180 NULL, /* quota_filecount */
181 NULL, /* quota_size_regex */
182 NULL, /* quota_warn_threshold */
183 NULL, /* mailbox_size_string */
184 NULL, /* mailbox_filecount_string */
185 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
186 NULL, /* maildir_tag */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
193 0, /* quota_warn_threshold_value */
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
196 0, /* quota_filecount_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE /* quota_is_inclusive */
236 /*************************************************
237 * Setup entry point *
238 *************************************************/
240 /* Called for each delivery in the privileged state, just before the uid/gid
241 are changed and the main entry point is called. We use this function to
242 expand any quota settings, so that it can access files that may not be readable
243 by the user. It is also used to pick up external mailbox size information, if
247 tblock points to the transport instance
248 addrlist addresses about to be delivered (not used)
249 dummy not used (doesn't pass back data)
250 errmsg where to put an error message
252 Returns: OK, FAIL, or DEFER
256 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
257 transport_feedback *dummy, uschar **errmsg)
259 appendfile_transport_options_block *ob =
260 (appendfile_transport_options_block *)(tblock->options_block);
261 uschar *q = ob->quota;
262 double default_value = 0.0;
265 addrlist = addrlist; /* Keep picky compilers happy */
268 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
271 for (i = 0; i < 5; i++)
274 uschar *which = NULL;
276 if (q == NULL) d = default_value; else
279 uschar *s = expand_string(q);
283 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
284 "%s", q, tblock->name, expand_string_message);
285 return search_find_defer? DEFER : FAIL;
288 d = Ustrtod(s, &rest);
290 /* Handle following characters K, M, G, %, the latter being permitted
291 for quota_warn_threshold only. A threshold with no quota setting is
294 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
295 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
296 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
297 else if (*rest == '%' && i == 2)
299 if (ob->quota_value <= 0 && !ob->maildir_use_size_file) d = 0;
300 else if ((int)d < 0 || (int)d > 100)
302 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
303 " for %s transport", (int)d, tblock->name);
306 ob->quota_warn_threshold_is_percent = TRUE;
310 while (isspace(*rest)) rest++;
314 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
315 "in %s transport", s, q, tblock->name);
320 /* Set each value, checking for possible overflow. */
325 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4) which = US"quota";
326 ob->quota_value = (off_t)d;
327 q = ob->quota_filecount;
331 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"quota_filecount";
332 ob->quota_filecount_value = (int)d;
333 q = ob->quota_warn_threshold;
337 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
338 which = US"quota_warn_threshold";
339 ob->quota_warn_threshold_value = (off_t)d;
340 q = ob->mailbox_size_string;
341 default_value = -1.0;
345 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
346 which = US"mailbox_size";;
347 ob->mailbox_size_value = (off_t)d;
348 q = ob->mailbox_filecount_string;
352 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"mailbox_filecount";
353 ob->mailbox_filecount_value = (int)d;
359 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
360 "%s transport", which, d, tblock->name);
370 /*************************************************
371 * Initialization entry point *
372 *************************************************/
374 /* Called for each instance, after its options have been read, to
375 enable consistency checks to be done, or anything else that needs
379 appendfile_transport_init(transport_instance *tblock)
381 appendfile_transport_options_block *ob =
382 (appendfile_transport_options_block *)(tblock->options_block);
384 /* Set up the setup entry point, to be called in the privileged state */
386 tblock->setup = appendfile_transport_setup;
388 /* Lock_retries must be greater than zero */
390 if (ob->lock_retries == 0) ob->lock_retries = 1;
392 /* Only one of a file name or directory name must be given. */
394 if (ob->filename != NULL && ob->dirname != NULL)
395 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
396 "only one of \"file\" or \"directory\" can be specified", tblock->name);
398 /* If a file name was specified, neither quota_filecount nor quota_directory
401 if (ob->filename != NULL)
403 if (ob->quota_filecount != NULL)
404 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
405 "quota_filecount must not be set without \"directory\"", tblock->name);
406 if (ob->quota_directory != NULL)
407 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
408 "quota_directory must not be set without \"directory\"", tblock->name);
411 /* The default locking depends on whether MBX is set or not. Change the
412 built-in default if none of the lock options has been explicitly set. At least
413 one form of locking is required in all cases, but mbx locking changes the
414 meaning of fcntl and flock locking. */
416 /* Not all operating systems provide flock(). For those that do, if flock is
417 requested, the default for fcntl is FALSE. */
422 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
423 "flock() support was not available in the operating system when this "
424 "binary was built", tblock->name);
425 #endif /* NO_FLOCK */
426 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
432 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
433 !ob->set_use_mbx_lock)
435 ob->use_lockfile = ob->use_flock = FALSE;
436 ob->use_mbx_lock = ob->use_fcntl = TRUE;
438 else if (ob->use_mbx_lock)
440 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
441 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
442 if (!ob->set_use_flock) ob->use_flock = FALSE;
443 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
446 #endif /* SUPPORT_MBX */
448 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
449 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
450 "no locking configured", tblock->name);
452 /* Unset timeouts for non-used locking types */
454 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
455 if (!ob->use_flock) ob->lock_flock_timeout = 0;
457 /* If a directory name was specified, only one of maildir or mailstore may be
458 specified, and if quota_filecount or quota_directory is given, quota must
461 if (ob->dirname != NULL)
463 if (ob->maildir_format && ob->mailstore_format)
464 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
465 "only one of maildir and mailstore may be specified", tblock->name);
466 if (ob->quota_filecount != NULL && ob->quota == NULL)
467 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
468 "quota must be set if quota_filecount is set", tblock->name);
469 if (ob->quota_directory != NULL && ob->quota == NULL)
470 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
471 "quota must be set if quota_directory is set", tblock->name);
474 /* If a fixed uid field is set, then a gid field must also be set. */
476 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
477 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
478 "user set without group for the %s transport", tblock->name);
480 /* If "create_file" is set, check that a valid option is given, and set the
483 if (ob->create_file_string != NULL)
486 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
487 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
489 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
490 value = create_inhome;
492 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
493 "invalid value given for \"file_create\" for the %s transport: %s",
494 tblock->name, ob->create_file_string);
495 ob->create_file = value;
498 /* If quota_warn_threshold is set, set up default for warn_message. It may
499 not be used if the actual threshold for a given delivery ends up as zero,
500 of if it's given as a percentage and there's no quota setting. */
502 if (ob->quota_warn_threshold != NULL)
504 if (tblock->warn_message == NULL) tblock->warn_message = US
505 "To: $local_part@$domain\n"
506 "Subject: Your mailbox\n\n"
507 "This message is automatically created by mail delivery software (Exim).\n\n"
508 "The size of your mailbox has exceeded a warning threshold that is\n"
509 "set by the system administrator.\n";
512 /* If batch SMTP is set, force the check and escape strings, and arrange that
513 headers are also escaped. */
517 ob->check_string = US".";
518 ob->escape_string = US"..";
519 ob->options |= topt_escape_headers;
522 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
523 insert default values for for the affixes and the check/escape strings. */
525 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
527 if (ob->message_prefix == NULL) ob->message_prefix =
528 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
529 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
530 if (ob->check_string == NULL) ob->check_string = US"From ";
531 if (ob->escape_string == NULL) ob->escape_string = US">From ";
535 /* Set up the bitwise options for transport_write_message from the various
536 driver options. Only one of body_only and headers_only can be set. */
539 (tblock->body_only? topt_no_headers : 0) |
540 (tblock->headers_only? topt_no_body : 0) |
541 (tblock->return_path_add? topt_add_return_path : 0) |
542 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
543 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
544 ((ob->use_crlf || ob->mbx_format)? topt_use_crlf : 0);
549 /*************************************************
551 *************************************************/
553 /* The comsat daemon is the thing that provides asynchronous notification of
554 the arrival of local messages, if requested by the user by "biff y". It is a
555 BSD thing that uses a TCP/IP protocol for communication. A message consisting
556 of the text "user@offset" must be sent, where offset is the place in the
557 mailbox where new mail starts. There is no scope for telling it which file to
558 look at, which makes it a less than useful if mail is being delivered into a
559 non-standard place such as the user's home directory. In fact, it doesn't seem
560 to pay much attention to the offset.
564 offset offset in mailbox
570 notify_comsat(uschar *user, off_t offset)
577 DEBUG(D_transport) debug_printf("notify_comsat called\n");
579 sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
581 if ((sp = getservbyname("biff", "udp")) == NULL)
583 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
587 host.name = US"localhost";
591 /* This code is all set up to look up "localhost" and use all its addresses
592 until one succeeds. However, it appears that at least on some systems, comsat
593 doesn't listen on the ::1 address. So for the moment, just force the address to
594 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
598 if (host_find_byname(&host, NULL, NULL, FALSE) == HOST_FIND_FAILED)
600 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
605 host.address = US"127.0.0.1";
608 for (h = &host; h != NULL; h = h->next)
611 int host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
613 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
615 sock = ip_socket(SOCK_DGRAM, host_af);
616 if (sock < 0) continue;
618 /* Connect never fails for a UDP socket, so don't set a timeout. */
620 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0);
621 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
626 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
633 /*************************************************
634 * Check the format of a file *
635 *************************************************/
637 /* This function is called when file_format is set, to check that an existing
638 file has the right format. The format string contains text/transport pairs. The
639 string matching is literal. we just read big_buffer_size bytes, because this is
640 all about the first few bytes of a file.
644 tblock the transport block
645 addr the address block - for inserting error data
647 Returns: pointer to the required transport, or NULL
651 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
654 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
656 int len = read(cfd, data, sizeof(data));
660 DEBUG(D_transport) debug_printf("checking file format\n");
662 /* An empty file matches the current transport */
664 if (len == 0) return tblock;
666 /* Search the formats for a match */
668 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size))!= NULL)
670 int slen = Ustrlen(s);
671 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
672 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
675 transport_instance *tt;
676 for (tt = transports; tt != NULL; tt = tt->next)
677 if (Ustrcmp(tp, tt->name) == 0)
680 debug_printf("file format -> %s transport\n", tt->name);
683 addr->basic_errno = ERRNO_BADTRANSPORT;
684 addr->message = string_sprintf("%s transport (for %.*s format) not found",
690 /* Failed to find a match */
692 addr->basic_errno = ERRNO_FORMATUNKNOWN;
693 addr->message = US"mailbox file format unrecognized";
700 /*************************************************
701 * Check directory's files for quota *
702 *************************************************/
704 /* This function is called if quota is set for one of the delivery modes that
705 delivers into a specific directory. It scans the directory and stats all the
706 files in order to get a total size and count. This is an expensive thing to do,
707 but some people are prepared to bear the cost. Alternatively, if size_regex is
708 set, it is used as a regex to try to extract the size from the file name, a
709 strategy that some people use on maildir files on systems where the users have
712 The function is global, because it is also called from tf_maildir.c for maildir
713 folders (which should contain only regular files).
715 Note: Any problems can be written to debugging output, but cannot be written to
716 the log, because we are running as an unprivileged user here.
719 dirname the name of the directory
720 countptr where to add the file count (because this function recurses)
721 regex a compiled regex to get the size from a name
723 Returns: the sum of the sizes of the stattable files
724 zero if the directory cannot be opened
728 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
732 int count = *countptr;
736 dir = opendir(CS dirname);
737 if (dir == NULL) return 0;
739 while ((ent = readdir(dir)) != NULL)
741 uschar *name = US ent->d_name;
744 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
748 /* If there's a regex, try to find the size using it */
753 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
756 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
757 if (endptr == name + ovector[3])
761 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
767 debug_printf("check_dir_size: regex did not match %s\n", name);
770 /* No regex or no match for the regex, or captured non-digits */
772 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
775 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
780 if (Ustat(buffer, &statbuf) < 0)
783 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
788 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
789 sum += statbuf.st_size;
790 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
791 sum += check_dir_size(buffer, &count, regex);
796 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
806 /*************************************************
807 * Apply a lock to a file descriptor *
808 *************************************************/
810 /* This function applies a lock to a file descriptor, using a blocking or
811 non-blocking lock, depending on the timeout value. It can apply either or
812 both of a fcntl() and a flock() lock. However, not all OS support flock();
813 for those that don't, the use_flock option cannot be set.
816 fd the file descriptor
817 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
818 fcntl() format); the flock() type is deduced if needed
819 dofcntl do fcntl() locking
820 fcntltime non-zero to use blocking fcntl()
821 doflock do flock() locking
822 flocktime non-zero to use blocking flock()
824 Returns: yield of the fcntl() or flock() call, with errno preserved;
825 sigalrm_seen set if there has been a timeout
829 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
834 struct flock lock_data;
835 lock_data.l_type = fcntltype;
836 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
838 sigalrm_seen = FALSE;
845 yield = fcntl(fd, F_SETLKW, &lock_data);
850 else yield = fcntl(fd, F_SETLK, &lock_data);
854 if (doflock && (yield >= 0))
856 int flocktype = (fcntltype == F_WRLCK)? LOCK_EX : LOCK_SH;
860 yield = flock(fd, flocktype);
865 else yield = flock(fd, flocktype | LOCK_NB);
867 #endif /* NO_FLOCK */
876 /*************************************************
877 * Copy message into MBX mailbox *
878 *************************************************/
880 /* This function is called when a message intended for a MBX mailbox has been
881 written to a temporary file. We can now get the size of the message and then
882 copy it in MBX format to the mailbox.
885 to_fd fd to write to (the real mailbox)
886 from_fd fd to read from (the temporary file)
887 saved_size current size of mailbox
889 Returns: OK if all went well, DEFER otherwise, with errno preserved
890 the number of bytes written are added to transport_count
891 by virtue of calling transport_write_block()
894 /* Values taken from c-client */
896 #define MBX_HDRSIZE 2048
897 #define MBX_NUSERFLAGS 30
900 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
906 /* If the current mailbox size is zero, write a header block */
912 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
913 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
914 (long int)time(NULL));
915 for (i = 0; i < MBX_NUSERFLAGS; i++)
916 sprintf (CS(s += Ustrlen(s)), "\015\012");
917 if (!transport_write_block (to_fd, deliver_out_buffer, MBX_HDRSIZE))
921 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
923 /* Now construct the message's header from the time and the RFC822 file
924 size, including CRLFs, which is the size of the input (temporary) file. */
926 if (fstat(from_fd, &statbuf) < 0) return DEFER;
927 size = statbuf.st_size;
929 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
930 tod_stamp(tod_mbx), size, 0L, 0, 0);
931 used = Ustrlen(deliver_out_buffer);
933 /* Rewind the temporary file, and copy it over in chunks. */
935 lseek(from_fd, 0 , SEEK_SET);
939 int len = read(from_fd, deliver_out_buffer + used,
940 DELIVER_OUT_BUFFER_SIZE - used);
943 if (len == 0) errno = ERRNO_MBXLENGTH;
946 if (!transport_write_block(to_fd, deliver_out_buffer, used + len))
954 #endif /* SUPPORT_MBX */
958 /*************************************************
959 * Check creation is permitted *
960 *************************************************/
962 /* This function checks whether a given file name is permitted to be created,
963 as controlled by the create_file option. If no home directory is set, however,
964 we can't do any tests.
967 filename the file name
968 create_file the ob->create_file option
970 Returns: TRUE if creation is permitted
974 check_creation(uschar *filename, int create_file)
978 if (deliver_home != NULL && create_file != create_anywhere)
980 int len = Ustrlen(deliver_home);
981 uschar *file = filename;
983 while (file[0] == '/' && file[1] == '/') file++;
984 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
985 ( Ustrchr(file+len+2, '/') != NULL &&
987 create_file != create_belowhome ||
988 Ustrstr(file+len, "/../") != NULL
993 /* If yield is TRUE, the file name starts with the home directory, and does
994 not contain any instances of "/../" in the "belowhome" case. However, it may
995 still contain symbolic links. We can check for this by making use of
996 realpath(), which most Unixes seem to have (but make it possible to cut this
997 out). We can't just use realpath() on the whole file name, because we know
998 the file itself doesn't exist, and intermediate directories may also not
999 exist. What we want to know is the real path of the longest existing part of
1000 the path. That must match the home directory's beginning, whichever is the
1004 if (yield && create_file == create_belowhome)
1006 uschar *slash, *next;
1008 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
1009 rp == NULL && slash > file; /* Stop if reached beginning */
1013 rp = US realpath(CS file, CS big_buffer);
1014 next = Ustrrchr(file, '/');
1018 /* If rp == NULL it means that none of the relevant directories exist.
1019 This is not a problem here - it means that no symbolic links can exist,
1020 which is all we are worried about. Otherwise, we must compare it
1021 against the start of the home directory. However, that may itself
1022 contain symbolic links, so we have to "realpath" it as well, if
1027 uschar hdbuffer[PATH_MAX+1];
1028 uschar *rph = deliver_home;
1029 int rlen = Ustrlen(big_buffer);
1031 rp = US realpath(CS deliver_home, CS hdbuffer);
1038 if (rlen > len) rlen = len;
1039 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1042 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1043 big_buffer, deliver_home);
1047 #endif /* NO_REALPATH */
1055 /*************************************************
1056 * Main entry point *
1057 *************************************************/
1059 /* See local README for general interface details. This transport always
1060 returns FALSE, indicating that the status which has been placed in the first
1061 address should be copied to any other addresses in a batch.
1063 Appendfile delivery is tricky and has led to various security problems in other
1064 mailers. The logic used here is therefore laid out in some detail. When this
1065 function is called, we are running in a subprocess which has had its gid and
1066 uid set to the appropriate values. Therefore, we cannot write directly to the
1067 exim logs. Any errors must be handled by setting appropriate return codes.
1068 Note that the default setting for addr->transport_return is DEFER, so it need
1069 not be set unless some other value is required.
1071 The code below calls geteuid() rather than getuid() to get the current uid
1072 because in weird configurations not running setuid root there may be a
1073 difference. In the standard configuration, where setuid() has been used in the
1074 delivery process, there will be no difference between the uid and the euid.
1076 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1077 alias expansion. Otherwise, there must be a configured file name or
1080 The following items apply in the case when a file name (as opposed to a
1081 directory name) is given, that is, when appending to a single file:
1083 (2f) Expand the file name.
1085 (3f) If the file name is /dev/null, return success (optimization).
1087 (4f) If the file_format options is set, open the file for reading, and check
1088 that the bytes at the start of the file match one of the given strings.
1089 If the check indicates a transport other than the current one should be
1090 used, pass control to that other transport. Otherwise continue. An empty
1091 or non-existent file matches the current transport. The file is closed
1094 (5f) If a lock file is required, create it (see extensive separate comments
1095 below about the algorithm for doing this). It is important to do this
1096 before opening the mailbox if NFS is in use.
1098 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1099 details of any symbolic link.
1101 (7f) If the file already exists:
1103 Check the owner and group if necessary, and defer if they are wrong.
1105 If it is a symbolic link AND the allow_symlink option is set (NOT the
1106 default), go back to (6f) but this time use stat() instead of lstat().
1108 If it's not a regular file (or FIFO when permitted), defer delivery.
1110 Check permissions. If the required permissions are *less* than the
1111 existing ones, or supplied by the address (often by the user via filter),
1112 chmod() the file. Otherwise, defer.
1114 Save the inode number.
1116 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1118 If open fails because the file does not exist, go to (6f); on any other
1121 Check the inode number hasn't changed - I realize this isn't perfect (an
1122 inode can be reused) but it's cheap and will catch some of the races.
1124 Check it's still a regular file (or FIFO if permitted).
1126 Check that the owner and permissions haven't changed.
1128 If file_format is set, check that the file still matches the format for
1129 the current transport. If not, defer delivery.
1131 (8f) If file does not exist initially:
1133 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1134 this is via a symbolic link (only possible if allow_symlinks is set), in
1135 which case don't use O_EXCL, as it dosn't work.
1137 If open fails because the file already exists, go to (6f). To avoid
1138 looping for ever in a situation where the file is continuously being
1139 created and deleted, all of this happens inside a loop that operates
1140 lock_retries times and includes the fcntl and flock locking. If the
1141 loop completes without the file getting opened, defer and request
1142 freezing, because something really weird is happening.
1144 If open fails for any other reason, defer for subsequent delivery except
1145 when this is a file delivery resulting from an alias or forward expansion
1146 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1147 most likely a user rather than a configuration error.
1149 (9f) We now have the file checked and open for writing. If so configured, lock
1150 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1151 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1152 still fails, give up and defer delivery.
1154 (10f)Save the access time (for subsequent restoration) and the size of the
1155 file, for comsat and for re-setting if delivery fails in the middle -
1156 e.g. for quota exceeded.
1158 The following items apply in the case when a directory name is given:
1160 (2d) Create a new file in the directory using a temporary name, by opening for
1161 writing and with O_CREAT. If maildir format is being used, the file
1162 is created in a temporary subdirectory with a prescribed name. If
1163 mailstore format is being used, the envelope file is first created with a
1164 temporary name, then the data file.
1166 The following items apply in all cases:
1168 (11) We now have the file open for writing, and locked if it was given as a
1169 file name. Write the message and flush the file, unless there is a setting
1170 of the local quota option, in which case we can check for its excession
1171 without doing any writing.
1173 In the case of MBX format mailboxes, the message is first written to a
1174 temporary file, in order to get its correct length. This is then copied to
1175 the real file, preceded by an MBX header.
1177 If there is a quota error on writing, defer the address. Timeout logic
1178 will determine for how long retries are attempted. We restore the mailbox
1179 to its original length if it's a single file. There doesn't seem to be a
1180 uniform error code for quota excession (it even differs between SunOS4
1181 and some versions of SunOS5) so a system-dependent macro called
1182 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1185 For any other error (most commonly disk full), do the same.
1187 The following applies after appending to a file:
1189 (12f)Restore the atime; notify_comsat if required; close the file (which
1190 unlocks it if it was locked). Delete the lock file if it exists.
1192 The following applies after writing a unique file in a directory:
1194 (12d)For maildir format, rename the file into the new directory. For mailstore
1195 format, rename the envelope file to its correct name. Otherwise, generate
1196 a unique name from the directory_file option, and rename to that, possibly
1197 trying a few times if the file exists and re-expanding the name gives a
1200 This transport yields FAIL only when a file name is generated by an alias or
1201 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1202 All other failures return DEFER (in addr->transport_return). */
1206 appendfile_transport_entry(
1207 transport_instance *tblock, /* data for this instantiation */
1208 address_item *addr) /* address we are working on */
1210 appendfile_transport_options_block *ob =
1211 (appendfile_transport_options_block *)(tblock->options_block);
1212 struct stat statbuf;
1213 uschar *fdname = NULL;
1214 uschar *filename = NULL;
1215 uschar *hitchname = NULL;
1216 uschar *dataname = NULL;
1217 uschar *lockname = NULL;
1218 uschar *newname = NULL;
1219 uschar *nametag = NULL;
1221 uschar *filecount_msg = US"";
1223 struct utimbuf times;
1224 struct timeval msg_tv;
1225 BOOL isdirectory = FALSE;
1226 BOOL isfifo = FALSE;
1227 BOOL wait_for_tick = FALSE;
1228 uid_t uid = geteuid(); /* See note above */
1229 gid_t gid = getegid();
1231 int mode = (addr->mode > 0)? addr->mode : ob->mode;
1232 off_t saved_size = -1;
1233 off_t mailbox_size = ob->mailbox_size_value;
1234 int mailbox_filecount = ob->mailbox_filecount_value;
1242 int mbx_lockfd = -1;
1243 uschar mbx_lockname[40];
1244 FILE *temp_file = NULL;
1245 #endif /* SUPPORT_MBX */
1247 #ifdef SUPPORT_MAILDIR
1248 int maildirsize_fd = -1; /* fd for maildirsize file */
1249 int maildir_save_errno;
1253 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1255 /* An "address_file" or "address_directory" transport is used to deliver to
1256 files specified via .forward or an alias file. Prior to release 4.20, the
1257 "file" and "directory" options were ignored in this case. This has been changed
1258 to allow the redirection data to specify what is in effect a folder, whose
1259 location is determined by the options on the transport.
1261 Compatibility with the case when neither option is set is retained by forcing a
1262 value for the file or directory name. A directory delivery is assumed if the
1263 last character of the path from the router is '/'.
1265 The file path is in the local part of the address, but not in the $local_part
1266 variable (that holds the parent local part). It is, however, in the
1267 $address_file variable. Below, we update the local part in the address if it
1268 changes by expansion, so that the final path ends up in the log. */
1270 if (testflag(addr, af_file) &&
1271 ob->filename == NULL &&
1272 ob->dirname == NULL)
1274 fdname = US"$address_file";
1275 if (address_file[Ustrlen(address_file)-1] == '/' ||
1276 ob->maildir_format ||
1277 ob->mailstore_format)
1281 /* Handle (a) an "address file" delivery where "file" or "directory" is
1282 explicitly set and (b) a non-address_file delivery, where one of "file" or
1283 "directory" must be set; initialization ensures that they are not both set. */
1287 fdname = ob->filename;
1290 fdname = ob->dirname;
1295 addr->transport_return = PANIC;
1296 addr->message = string_sprintf("Mandatory file or directory option "
1297 "missing from %s transport", tblock->name);
1302 /* Maildir and mailstore require a directory */
1304 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1306 addr->transport_return = PANIC;
1307 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1308 "to be specified for the %s transport",
1309 ob->maildir_format? "dir" : "store", tblock->name);
1313 path = expand_string(fdname);
1317 addr->transport_return = PANIC;
1318 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1319 "name for %s transport) failed: %s", fdname, tblock->name,
1320 expand_string_message);
1326 addr->message = string_sprintf("appendfile: file or directory name "
1327 "\"%s\" is not absolute", path);
1328 addr->basic_errno = ERRNO_NOTABSOLUTE;
1332 /* For a file delivery, make sure the local part in the address is updated to
1333 the true local part. */
1335 if (testflag(addr, af_file)) addr->local_part = string_copy(path);
1337 /* The available mailbox formats depend on whether it is a directory or a file
1343 #ifdef SUPPORT_MAILDIR
1344 (ob->maildir_format)? mbf_maildir :
1346 #ifdef SUPPORT_MAILSTORE
1347 (ob->mailstore_format)? mbf_mailstore :
1355 (ob->mbx_format)? mbf_mbx :
1362 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1363 " warning=" OFF_T_FMT "%s\n"
1364 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1365 "maildir_use_size_file=%s\n",
1366 mode, ob->notify_comsat, ob->quota_value,
1367 ob->quota_warn_threshold_value,
1368 ob->quota_warn_threshold_is_percent? "%" : "",
1369 isdirectory? "directory" : "file",
1370 path, mailbox_formats[mbformat],
1371 (ob->message_prefix == NULL)? US"null" : string_printing(ob->message_prefix),
1372 (ob->message_suffix == NULL)? US"null" : string_printing(ob->message_suffix),
1373 (ob->maildir_use_size_file)? "yes" : "no");
1375 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1376 ob->use_lockfile? "lockfile " : "",
1377 ob->use_mbx_lock? "mbx locking (" : "",
1378 ob->use_fcntl? "fcntl " : "",
1379 ob->use_flock? "flock" : "",
1380 ob->use_mbx_lock? ")" : "");
1383 /* If the -N option is set, can't do any more. */
1388 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1390 addr->transport_return = OK;
1394 /* Handle the case of a file name. If the file name is /dev/null, we can save
1395 ourselves some effort and just give a success return right away. */
1399 BOOL use_lstat = TRUE;
1400 BOOL file_opened = FALSE;
1401 BOOL allow_creation_here = TRUE;
1403 if (Ustrcmp(path, "/dev/null") == 0)
1405 addr->transport_return = OK;
1409 /* Set the name of the file to be opened, and the file to which the data
1410 is written, and find out if we are permitted to create a non-existent file. */
1412 dataname = filename = path;
1413 allow_creation_here = check_creation(filename, ob->create_file);
1415 /* If ob->create_directory is set, attempt to create the directories in
1416 which this mailbox lives, but only if we are permitted to create the file
1417 itself. We know we are dealing with an absolute path, because this was
1420 if (ob->create_directory && allow_creation_here)
1422 uschar *p = Ustrrchr(path, '/');
1424 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1426 addr->basic_errno = errno;
1428 string_sprintf("failed to create directories for %s: %s", path,
1430 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1436 /* If file_format is set we must check that any existing file matches one of
1437 the configured formats by checking the bytes it starts with. A match then
1438 indicates a specific transport - if it is not this one, pass control to it.
1439 Otherwise carry on here. An empty or non-existent file matches the current
1440 transport. We don't need to distinguish between non-existence and other open
1441 failures because if an existing file fails to open here, it will also fail
1442 again later when O_RDWR is used. */
1444 if (ob->file_format != NULL)
1446 int cfd = Uopen(path, O_RDONLY, 0);
1449 transport_instance *tt = check_file_format(cfd, tblock, addr);
1452 /* If another transport is indicated, call it and return; if no transport
1453 was found, just return - the error data will have been set up.*/
1459 set_process_info("delivering %s to %s using %s", message_id,
1460 addr->local_part, tt->name);
1461 debug_print_string(tt->debug_string);
1462 addr->transport = tt;
1463 (tt->info->code)(tt, addr);
1470 /* The locking of mailbox files is worse than the naming of cats, which is
1471 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1472 three different names, so several different styles of locking are used.
1474 Research in other programs that lock mailboxes shows that there is no
1475 universally standard method. Having mailboxes NFS-mounted on the system that
1476 is delivering mail is not the best thing, but people do run like this,
1477 and so the code must do its best to cope.
1479 Three different locking mechanisms are supported. The initialization function
1480 checks that at least one is configured.
1484 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1485 will work over NFS. Only after that is done do we actually open the mailbox
1486 and apply locks to it (if configured).
1488 Originally, Exim got the file opened before doing anything about locking.
1489 However, a very occasional problem was observed on Solaris 2 when delivering
1490 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1491 gets remembered at open time. If another process on another host (that's
1492 important) has the file open and locked and writes to it and then releases
1493 the lock while the first process is waiting to get the lock, the first
1494 process may fail to write at the new end point of the file - despite the very
1495 definite statement about O_APPEND in the man page for write(). Experiments
1496 have reproduced this problem, but I do not know any way of forcing a host to
1497 update its attribute cache for an open NFS file. It would be nice if it did
1498 so when a lock was taken out, but this does not seem to happen. Anyway, to
1499 reduce the risk of this problem happening, we now create the lock file
1500 (if configured) *before* opening the mailbox. That will prevent two different
1501 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1502 however, but Pine at least seems to operate in the same way.
1504 Lockfiles should normally be used when NFS is involved, because of the above
1507 The logic for creating the lock file is:
1509 . The name of the lock file is <mailbox-name>.lock
1511 . First, create a "hitching post" name by adding the primary host name,
1512 current time and pid to the lock file name. This should be unique.
1514 . Create the hitching post file using WRONLY + CREAT + EXCL.
1516 . If that fails EACCES, we assume it means that the user is unable to create
1517 files in the mail spool directory. Some installations might operate in this
1518 manner, so there is a configuration option to allow this state not to be an
1519 error - we proceed to lock using fcntl only, after the file is open.
1521 . Otherwise, an error causes a deferment of the address.
1523 . Hard link the hitching post to the lock file name.
1525 . If the link succeeds, we have successfully created the lock file. Simply
1526 close and unlink the hitching post file.
1528 . If the link does not succeed, proceed as follows:
1530 o Fstat the hitching post file, and then close and unlink it.
1532 o Now examine the stat data. If the number of links to the file is exactly
1533 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1534 the return never made it back, so the link() function gave a failure
1537 . This method allows for the lock file to be created by some other process
1538 right up to the moment of the attempt to hard link it, and is also robust
1539 against NFS server crash-reboots, which would probably result in timeouts
1540 in the middle of link().
1542 . System crashes may cause lock files to get left lying around, and some means
1543 of flushing them is required. The approach of writing a pid (used by smail
1544 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1545 timeout, which seems a better approach. Since any program that writes to a
1546 mailbox using a lock file should complete its task very quickly, Pine
1547 removes lock files that are older than 5 minutes. We allow the value to be
1548 configurable on the transport.
1552 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1553 mailbox once it is open. This is done by default with a non-blocking lock.
1554 Failures to lock cause retries after a sleep, but only for a certain number
1555 of tries. A blocking lock is deliberately not used so that we don't hold the
1556 mailbox open. This minimizes the possibility of the NFS problem described
1557 under LOCK FILES above, if for some reason NFS deliveries are happening
1558 without lock files. However, the use of a non-blocking lock and sleep, though
1559 the safest approach, does not give the best performance on very busy systems.
1560 A blocking lock plus timeout does better. Therefore Exim has an option to
1561 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1562 enables the use of blocking fcntl() calls.
1566 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1567 same manner as for fcntl locking above. No-blocking/timeout is also set as
1568 above in lock_flock_timeout. Not all operating systems provide or support
1569 flock(). For those that don't (as determined by the definition of LOCK_SH in
1570 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1571 is implemented (not precisely) on top of fcntl(), which means there's no
1572 point in actually using it.
1576 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1577 then the rules used for locking in c-client are used. Exim takes out a shared
1578 lock on the mailbox file, and an exclusive lock on the file whose name is
1579 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1580 any other MBX client from getting an exclusive lock on it and expunging it.
1581 It also stops any other MBX client from unlinking the /tmp lock when it has
1584 The exclusive lock on the /tmp file prevents any other MBX client from
1585 updating the mailbox in any way. When writing is finished, if an exclusive
1586 lock on the mailbox can be obtained, indicating there are no current sharers,
1587 the /tmp file is unlinked.
1589 MBX locking can use either fcntl() or flock() locking. If neither
1590 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1591 The calls for getting these locks are by default non-blocking, as for non-mbx
1592 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1593 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1594 probably makes sense to set timeouts for any MBX deliveries. */
1597 /* Build a lock file if configured to do so - the existence of a lock
1598 file is subsequently checked by looking for a non-negative value of the
1599 file descriptor hd - even though the file is no longer open. */
1601 if (ob->use_lockfile)
1603 lockname = string_sprintf("%s.lock", filename);
1604 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1605 (unsigned int)(time(NULL)), (unsigned int)getpid());
1607 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1610 /* Lock file creation retry loop */
1612 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1615 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1619 addr->basic_errno = errno;
1621 string_sprintf("creating lock file hitching post %s "
1622 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1623 (long int)getegid());
1627 /* Attempt to hitch the hitching post to the lock file. If link()
1628 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1629 file, and get rid of the hitching post. If the number of links was 2,
1630 the link was created, despite the failure of link(). If the hitch was
1631 not successful, try again, having unlinked the lock file if it is too
1634 There's a version of Linux (2.0.27) which doesn't update its local cache
1635 of the inode after link() by default - which many think is a bug - but
1636 if the link succeeds, this code will be OK. It just won't work in the
1637 case when link() fails after having actually created the link. The Linux
1638 NFS person is fixing this; a temporary patch is available if anyone is
1639 sufficiently worried. */
1641 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1644 if (rc != 0 && statbuf.st_nlink != 2)
1646 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1647 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1649 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1652 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1656 DEBUG(D_transport) debug_printf("lock file created\n");
1660 /* Check for too many tries at creating the lock file */
1662 if (i >= ob->lock_retries)
1664 addr->basic_errno = ERRNO_LOCKFAILED;
1665 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1672 /* We now have to get the file open. First, stat() it and act on existence or
1673 non-existence. This is in a loop to handle the case of a file's being created
1674 or deleted as we watch, and also to handle retries when the locking fails.
1675 Rather than holding the file open while waiting for the fcntl() and/or
1676 flock() lock, we close and do the whole thing again. This should be safer,
1677 especially for NFS files, which might get altered from other hosts, making
1678 their cached sizes incorrect.
1680 With the default settings, no symlinks are permitted, but there is an option
1681 to permit symlinks for those sysadmins that know what they are doing.
1682 Shudder. However, insist that the initial symlink is owned by the right user.
1683 Thus lstat() is used initially; if a symlink is discovered, the loop is
1684 repeated such that stat() is used, to look at the end file. */
1686 for (i = 0; i < ob->lock_retries; i++)
1688 int sleep_before_retry = TRUE;
1689 file_opened = FALSE;
1691 if((use_lstat? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1693 /* Let's hope that failure to stat (other than non-existence) is a
1696 if (errno != ENOENT)
1698 addr->basic_errno = errno;
1699 addr->message = string_sprintf("attempting to stat mailbox %s",
1704 /* File does not exist. If it is required to pre-exist this state is an
1707 if (ob->file_must_exist)
1709 addr->basic_errno = errno;
1710 addr->message = string_sprintf("mailbox %s does not exist, "
1711 "but file_must_exist is set", filename);
1715 /* If not permitted to create this file because it isn't in or below
1716 the home directory, generate an error. */
1718 if (!allow_creation_here)
1720 addr->basic_errno = ERRNO_BADCREATE;
1721 addr->message = string_sprintf("mailbox %s does not exist, "
1722 "but creation outside the home directory is not permitted",
1727 /* Attempt to create and open the file. If open fails because of
1728 pre-existence, go round the loop again. For any other error, defer the
1729 address, except for an alias or forward generated file name with EPERM,
1730 ENOENT, or EACCES, as those are most likely to be user errors rather
1731 than Exim config errors. When a symbolic link is permitted and points
1732 to a non-existent file, we get here with use_lstat = FALSE. In this case
1733 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1734 consistency and because MBX locking requires it in order to be able to
1735 get a shared lock. */
1737 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1738 (use_lstat? O_EXCL : 0), mode);
1741 if (errno == EEXIST) continue;
1742 addr->basic_errno = errno;
1743 addr->message = string_sprintf("while creating mailbox %s",
1745 if (testflag(addr, af_file) &&
1746 (errno == EPERM || errno == ENOENT || errno == EACCES))
1747 addr->transport_return = FAIL;
1751 /* We have successfully created and opened the file. Ensure that the group
1752 and the mode are correct. */
1754 (void)Uchown(filename, uid, gid);
1755 (void)Uchmod(filename, mode);
1759 /* The file already exists. Test its type, ownership, and permissions, and
1760 save the inode for checking later. If symlinks are permitted (not the
1761 default or recommended state) it may be a symlink that already exists.
1762 Check its ownership and then look for the file at the end of the link(s).
1763 This at least prevents one user creating a symlink for another user in
1764 a sticky directory. */
1768 int oldmode = (int)statbuf.st_mode;
1769 ino_t inode = statbuf.st_ino;
1770 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1772 isfifo = FALSE; /* In case things are changing */
1774 /* Check owner if required - the default. */
1776 if (ob->check_owner && statbuf.st_uid != uid)
1778 addr->basic_errno = ERRNO_BADUGID;
1779 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1780 "(%ld != %ld)", filename,
1781 islink? " (symlink)" : "",
1782 (long int)(statbuf.st_uid), (long int)uid);
1786 /* Group is checked only if check_group is set. */
1788 if (ob->check_group && statbuf.st_gid != gid)
1790 addr->basic_errno = ERRNO_BADUGID;
1791 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1792 filename, islink? " (symlink)" : "", statbuf.st_gid, gid);
1796 /* If symlinks are permitted (not recommended), the lstat() above will
1797 have found the symlink. Its ownership has just been checked; go round
1798 the loop again, using stat() instead of lstat(). That will never yield a
1801 if (islink && ob->allow_symlink)
1804 i--; /* Don't count this time round */
1808 /* An actual file exists. Check that it is a regular file, or FIFO
1811 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1813 else if ((oldmode & S_IFMT) != S_IFREG)
1815 addr->basic_errno = ERRNO_NOTREGULAR;
1816 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1817 filename, ob->allow_fifo? " or named pipe" : "");
1821 /* If the mode is not what it would be for a newly created file, change
1822 the permissions if the mode is supplied for the address. Otherwise,
1823 reduce but do not extend the permissions. If the newly created
1824 permissions are greater than the existing permissions, don't change
1825 things when the mode is not from the address. */
1827 if ((oldmode = (oldmode & 07777)) != mode)
1829 int diffs = oldmode ^ mode;
1830 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1832 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1833 if (Uchmod(filename, mode) < 0)
1835 addr->basic_errno = errno;
1836 addr->message = string_sprintf("attempting to chmod mailbox %s",
1843 /* Mode not from address, and newly-created permissions are greater
1844 than existing permissions. Default is to complain, but it can be
1845 configured to go ahead and try to deliver anyway if that's what
1846 the administration wants. */
1848 else if (ob->mode_fail_narrower)
1850 addr->basic_errno = ERRNO_BADMODE;
1851 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1852 "(%o expected)", filename, oldmode, mode);
1857 /* We are happy with the existing file. Open it, and then do further
1858 tests to ensure that it is the same file that we were just looking at.
1859 If the file does not now exist, restart this loop, going back to using
1860 lstat again. For an NFS error, just defer; other opening errors are
1861 more serious. The file is opened RDWR so that its format can be checked,
1862 and also MBX locking requires the use of a shared (read) lock. However,
1863 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1864 reading the pipe. */
1866 fd = Uopen(filename, isfifo? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1870 if (errno == ENOENT)
1875 addr->basic_errno = errno;
1878 addr->message = string_sprintf("while opening named pipe %s "
1879 "(could mean no process is reading it)", filename);
1881 else if (errno != EWOULDBLOCK)
1883 addr->message = string_sprintf("while opening mailbox %s", filename);
1888 /* This fstat really shouldn't fail, as we have an open file! There's a
1889 dilemma here. We use fstat in order to be sure we are peering at the file
1890 we have got open. However, that won't tell us if the file was reached
1891 via a symbolic link. We checked this above, but there is a race exposure
1892 if the link was created between the previous lstat and the open. However,
1893 it would have to be created with the same inode in order to pass the
1894 check below. If ob->allow_symlink is set, causing the use of stat rather
1895 than lstat above, symbolic links may be there anyway, and the checking is
1898 if (fstat(fd, &statbuf) < 0)
1900 addr->basic_errno = errno;
1901 addr->message = string_sprintf("attempting to stat open mailbox %s",
1906 /* Check the inode; this is isn't a perfect check, but gives some
1909 if (inode != statbuf.st_ino)
1911 addr->basic_errno = ERRNO_INODECHANGED;
1912 addr->message = string_sprintf("opened mailbox %s inode number changed "
1913 "from %d to %ld", filename, inode, statbuf.st_ino);
1914 addr->special_action = SPECIAL_FREEZE;
1918 /* Check it's still a regular file or FIFO, and the uid, gid, and
1919 permissions have not changed. */
1921 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1922 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1924 addr->basic_errno = ERRNO_NOTREGULAR;
1926 string_sprintf("opened mailbox %s is no longer a %s", filename,
1927 isfifo? "named pipe" : "regular file");
1928 addr->special_action = SPECIAL_FREEZE;
1932 if ((ob->check_owner && statbuf.st_uid != uid) ||
1933 (ob->check_group && statbuf.st_gid != gid))
1935 addr->basic_errno = ERRNO_BADUGID;
1937 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1938 addr->special_action = SPECIAL_FREEZE;
1942 if ((statbuf.st_mode & 07777) != oldmode)
1944 addr->basic_errno = ERRNO_BADMODE;
1945 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1946 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1947 addr->special_action = SPECIAL_FREEZE;
1951 /* If file_format is set, check that the format of the file has not
1952 changed. Error data is set by the testing function. */
1954 if (ob->file_format != NULL &&
1955 check_file_format(fd, tblock, addr) != tblock)
1957 addr->message = US"open mailbox has changed format";
1961 /* The file is OK. Carry on to do the locking. */
1964 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1965 locking rules if configured to do so. If a lock file is also required, it
1966 was created above and hd was left >= 0. At least one form of locking is
1967 required by the initialization function. If locking fails here, close the
1968 file and go round the loop all over again, after waiting for a bit, unless
1969 blocking locking was used. */
1972 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1973 sleep_before_retry = FALSE;
1975 /* Simple fcntl() and/or flock() locking */
1977 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
1979 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1980 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
1983 /* MBX locking rules */
1986 else if (ob->use_mbx_lock)
1988 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1989 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
1990 fstat(fd, &statbuf) >= 0)
1992 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
1993 (long)statbuf.st_ino);
1995 if (Ulstat(mbx_lockname, &statbuf) >= 0)
1997 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
1999 addr->basic_errno = ERRNO_LOCKFAILED;
2000 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2004 if (statbuf.st_nlink > 1)
2006 addr->basic_errno = ERRNO_LOCKFAILED;
2007 addr->message = string_sprintf("hard link to MBX lock file %s",
2013 mbx_lockfd = Uopen(mbx_lockname, O_RDWR | O_CREAT, 0600);
2016 addr->basic_errno = ERRNO_LOCKFAILED;
2017 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2018 mbx_lockname, strerror(errno));
2022 (void)Uchmod(mbx_lockname, 0600);
2024 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2025 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2027 struct stat ostatbuf;
2029 /* This tests for a specific race condition. Ensure that we still
2030 have the same file. */
2032 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2033 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2034 statbuf.st_dev == ostatbuf.st_dev &&
2035 statbuf.st_ino == ostatbuf.st_ino)
2037 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2038 "between creation and locking\n", mbx_lockname);
2041 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2043 (void)close(mbx_lockfd);
2048 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2049 filename, strerror(errno));
2052 #endif /* SUPPORT_MBX */
2054 else break; /* No on-file locking required; break the open/lock loop */
2057 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2061 use_lstat = TRUE; /* Reset to use lstat first */
2064 /* If a blocking call timed out, break the retry loop if the total time
2065 so far is not less than than retries * interval. Use the larger of the
2066 flock() and fcntl() timeouts. */
2069 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2070 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2071 ob->lock_retries * ob->lock_interval)
2072 i = ob->lock_retries;
2074 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2075 flock() that caused the problem. */
2077 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2080 /* Test for exceeding the maximum number of tries. Either the file remains
2081 locked, or, if we haven't got it open, something is terribly wrong... */
2083 if (i >= ob->lock_retries)
2087 addr->basic_errno = ERRNO_EXISTRACE;
2088 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2089 addr->special_action = SPECIAL_FREEZE;
2093 addr->basic_errno = ERRNO_LOCKFAILED;
2094 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2100 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2102 /* Save access time (for subsequent restoration), modification time (for
2103 restoration if updating fails), size of file (for comsat and for re-setting if
2104 delivery fails in the middle - e.g. for quota exceeded). */
2106 if (fstat(fd, &statbuf) < 0)
2108 addr->basic_errno = errno;
2109 addr->message = string_sprintf("while fstatting opened mailbox %s",
2114 times.actime = statbuf.st_atime;
2115 times.modtime = statbuf.st_mtime;
2116 saved_size = statbuf.st_size;
2117 if (mailbox_size < 0) mailbox_size = saved_size;
2118 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2121 /* Prepare for writing to a new file (as opposed to appending to an old one).
2122 There are several different formats, but there is preliminary stuff concerned
2123 with quotas that applies to all of them. Finding the current size by directory
2124 scanning is expensive; for maildirs some fudges have been invented:
2126 (1) A regex can be used to extract a file size from its name;
2127 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2133 uschar *check_path = path; /* Default quota check path */
2134 const pcre *regex = NULL; /* Regex for file size from file name */
2136 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2138 addr->basic_errno = ERRNO_BADCREATE;
2139 addr->message = string_sprintf("tried to create file in %s, but "
2140 "file creation outside the home directory is not permitted", path);
2144 #ifdef SUPPORT_MAILDIR
2145 /* For a maildir delivery, ensure that all the relevant directories exist */
2147 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2148 ob->create_directory, ob->dirmode))
2150 #endif /* SUPPORT_MAILDIR */
2152 /* If we are going to do a quota check, of if maildir_use_size_file is set
2153 for a maildir delivery, compile the regular expression if there is one. We
2154 may also need to adjust the path that is used. We need to do this for
2155 maildir_use_size_file even if the quota is unset, because we still want to
2156 create the file. When maildir support is not compiled,
2157 ob->maildir_use_size_file is always FALSE. */
2159 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2161 const uschar *error;
2164 /* Compile the regex if there is one */
2166 if (ob->quota_size_regex != NULL)
2168 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2169 (const char **)&error, &offset, NULL);
2172 addr->message = string_sprintf("appendfile: regular expression "
2173 "error: %s at offset %d while compiling %s", error, offset,
2174 ob->quota_size_regex);
2179 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2180 ob->quota_size_regex);
2184 /* Use an explicitly configured directory if set */
2186 if (ob->quota_directory != NULL)
2188 check_path = expand_string(ob->quota_directory);
2189 if (check_path == NULL)
2191 addr->transport_return = PANIC;
2192 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2193 "name for %s transport) failed: %s", ob->quota_directory,
2194 tblock->name, expand_string_message);
2198 if (check_path[0] != '/')
2200 addr->message = string_sprintf("appendfile: quota_directory name "
2201 "\"%s\" is not absolute", check_path);
2202 addr->basic_errno = ERRNO_NOTABSOLUTE;
2207 #ifdef SUPPORT_MAILDIR
2208 /* Otherwise, if we are handling a maildir delivery, and the directory
2209 contains a file called maildirfolder, this is a maildir++ feature telling
2210 us that this is a sub-directory of the real inbox. We should therefore do
2211 the quota check on the parent directory. Beware of the special case when
2212 the directory name itself ends in a slash. */
2214 else if (mbformat == mbf_maildir)
2216 struct stat statbuf;
2217 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2219 uschar *new_check_path = string_copy(check_path);
2220 uschar *slash = Ustrrchr(new_check_path, '/');
2226 slash = Ustrrchr(new_check_path, '/');
2231 check_path = new_check_path;
2236 #endif /* SUPPORT_MAILDIR */
2239 /* If we are using maildirsize files, we need to ensure that such a file
2240 exists and, if necessary, recalculate its contents. As a byproduct of this,
2241 we obtain the current size of the maildir. If no quota is to be enforced
2242 (ob->quota_value == 0), we still need the size if a threshold check will
2245 Another regular expression is used to determine which directories inside the
2246 maildir are going to be counted. */
2248 #ifdef SUPPORT_MAILDIR
2249 if (ob->maildir_use_size_file)
2251 const pcre *dir_regex = NULL;
2252 const uschar *error;
2255 if (ob->maildir_dir_regex != NULL)
2257 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2258 (const char **)&error, &offset, NULL);
2259 if (dir_regex == NULL)
2261 addr->message = string_sprintf("appendfile: regular expression "
2262 "error: %s at offset %d while compiling %s", error, offset,
2263 ob->maildir_dir_regex);
2269 debug_printf("using regex for maildir directory selection: %s\n",
2270 ob->maildir_dir_regex);
2274 /* Quota enforcement; create and check the file. There is some discussion
2275 about whether this should happen if the quota is unset. At present, Exim
2276 always creates the file. If we ever want to change this, uncomment
2277 appropriate lines below, possibly doing a check on some option. */
2279 /* if (???? || ob->quota_value > 0) */
2285 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2288 if (maildirsize_fd == -1)
2290 addr->basic_errno = errno;
2291 addr->message = string_sprintf("while opening or reading "
2292 "%s/maildirsize", check_path);
2296 if (mailbox_size < 0) mailbox_size = size;
2297 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2300 /* No quota enforcement; ensure file does *not* exist; calculate size if
2305 * time_t old_latest;
2306 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2307 * if (THRESHOLD_CHECK)
2308 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2309 * regex, dir_regex, FALSE);
2314 #endif /* SUPPORT_MAILDIR */
2316 /* Otherwise (mailbox_size is not yet set), if we are going to do a quota
2317 check later on, find the current size of the mailbox. (We don't need to check
2318 ob->quota_filecount_value, because it can only be set if ob->quota_value is
2321 if ((mailbox_size < 0 || mailbox_filecount < 0) &&
2322 (ob->quota_value > 0 || THRESHOLD_CHECK))
2327 debug_printf("quota checks on directory %s\n", check_path);
2328 size = check_dir_size(check_path, &filecount, regex);
2329 if (mailbox_size < 0) mailbox_size = size;
2330 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2333 /* Handle the case of creating a unique file in a given directory (not in
2334 maildir or mailstore format - this is how smail did it). A temporary name is
2335 used to create the file. Later, when it is written, the name is changed to a
2336 unique one. There is no need to lock the file. An attempt is made to create
2337 the directory if it does not exist. */
2339 if (mbformat == mbf_smail)
2342 debug_printf("delivering to new file in %s\n", path);
2343 filename = dataname =
2344 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2345 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2346 if (fd < 0 && /* failed to open, and */
2347 (errno != ENOENT || /* either not non-exist */
2348 !ob->create_directory || /* or not allowed to make */
2349 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2350 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2352 addr->basic_errno = errno;
2353 addr->message = string_sprintf("while creating file %s", filename);
2358 #ifdef SUPPORT_MAILDIR
2360 /* Handle the case of a unique file in maildir format. The file is written to
2361 the tmp subdirectory, with a prescribed form of name. */
2363 else if (mbformat == mbf_maildir)
2366 debug_printf("delivering in maildir format in %s\n", path);
2368 nametag = ob->maildir_tag;
2370 /* Check that nametag expands successfully; a hard failure causes a panic
2371 return. The actual expansion for use happens again later, when
2372 $message_size is accurately known. */
2374 if (nametag != NULL && expand_string(nametag) == NULL &&
2375 !expand_string_forcedfail)
2377 addr->transport_return = PANIC;
2378 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2379 "for %s transport) failed: %s", nametag, tblock->name,
2380 expand_string_message);
2384 /* We ensured the existence of all the relevant directories above. Attempt
2385 to open the temporary file a limited number of times. I think this rather
2386 scary-looking for statement is actually OK. If open succeeds, the loop is
2387 broken; if not, there is a test on the value of i. Get the time again
2388 afresh each time round the loop. Its value goes into a variable that is
2389 checked at the end, to make sure we don't release this process until the
2390 clock has ticked. */
2396 (void)gettimeofday(&msg_tv, NULL);
2397 basename = string_sprintf("%lu.H%luP%lu.%s", msg_tv.tv_sec,
2398 msg_tv.tv_usec, getpid(), primary_hostname);
2400 filename = dataname = string_sprintf("tmp/%s", basename);
2401 newname = string_sprintf("new/%s", basename);
2403 if (Ustat(filename, &statbuf) == 0)
2405 else if (errno == ENOENT)
2407 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2409 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2410 filename, strerror(errno));
2413 /* Too many retries - give up */
2415 if (i >= ob->maildir_retries)
2417 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2418 filename, i, (i == 1)? "y" : "ies");
2419 addr->basic_errno = errno;
2423 /* Open or stat failed but we haven't tried too many times yet. */
2428 /* Note that we have to ensure the clock has ticked before leaving */
2430 wait_for_tick = TRUE;
2432 /* Why are these here? Put in because they are present in the non-maildir
2433 directory case above. */
2435 (void)Uchown(filename, uid, gid);
2436 (void)Uchmod(filename, mode);
2439 #endif /* SUPPORT_MAILDIR */
2441 #ifdef SUPPORT_MAILSTORE
2443 /* Handle the case of a unique file in mailstore format. First write the
2444 envelope to a temporary file, then open the main file. The unique base name
2445 for the files consists of the message id plus the pid of this delivery
2451 address_item *taddr;
2452 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2453 string_base62((long int)getpid()));
2456 debug_printf("delivering in mailstore format in %s\n", path);
2458 filename = string_sprintf("%s.tmp", mailstore_basename);
2459 newname = string_sprintf("%s.env", mailstore_basename);
2460 dataname = string_sprintf("%s.msg", mailstore_basename);
2462 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2463 if (fd < 0 && /* failed to open, and */
2464 (errno != ENOENT || /* either not non-exist */
2465 !ob->create_directory || /* or not allowed to make */
2466 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2467 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2469 addr->basic_errno = errno;
2470 addr->message = string_sprintf("while creating file %s", filename);
2474 /* Why are these here? Put in because they are present in the non-maildir
2475 directory case above. */
2477 (void)Uchown(filename, uid, gid);
2478 (void)Uchmod(filename, mode);
2480 /* Built a C stream from the open file descriptor. */
2482 if ((env_file = fdopen(fd, "wb")) == NULL)
2484 addr->basic_errno = errno;
2485 addr->transport_return = PANIC;
2486 addr->message = string_sprintf("fdopen of %s ("
2487 "for %s transport) failed", filename, tblock->name);
2493 /* Write the envelope file, then close it. */
2495 if (ob->mailstore_prefix != NULL)
2497 uschar *s = expand_string(ob->mailstore_prefix);
2500 if (!expand_string_forcedfail)
2502 addr->transport_return = PANIC;
2503 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2504 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2505 tblock->name, expand_string_message);
2506 (void)fclose(env_file);
2514 fprintf(env_file, "%s", CS s);
2515 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2519 fprintf(env_file, "%s\n", sender_address);
2521 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2522 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2524 if (ob->mailstore_suffix != NULL)
2526 uschar *s = expand_string(ob->mailstore_suffix);
2529 if (!expand_string_forcedfail)
2531 addr->transport_return = PANIC;
2532 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2533 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2534 tblock->name, expand_string_message);
2535 (void)fclose(env_file);
2543 fprintf(env_file, "%s", CS s);
2544 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2548 if (fclose(env_file) != 0)
2550 addr->basic_errno = errno;
2551 addr->message = string_sprintf("while closing %s", filename);
2556 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2558 /* Now open the data file, and ensure that it has the correct ownership and
2561 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2564 addr->basic_errno = errno;
2565 addr->message = string_sprintf("while creating file %s", dataname);
2569 (void)Uchown(dataname, uid, gid);
2570 (void)Uchmod(dataname, mode);
2573 #endif /* SUPPORT_MAILSTORE */
2576 /* In all cases of writing to a new file, ensure that the file which is
2577 going to be renamed has the correct ownership and mode. */
2579 (void)Uchown(filename, uid, gid);
2580 (void)Uchmod(filename, mode);
2584 /* At last we can write the message to the file, preceded by any configured
2585 prefix line, and followed by any configured suffix line. If there are any
2586 writing errors, we must defer. */
2588 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2593 /* If there is a local quota setting, check that we are not going to exceed it
2594 with this message if quota_is_inclusive is set; if it is not set, the check
2595 is for the mailbox already being over quota (i.e. the current message is not
2596 included in the check). */
2598 if (ob->quota_value > 0)
2602 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2603 " this message = %d (%sincluded)\n",
2604 ob->quota_value, mailbox_size, message_size,
2605 ob->quota_is_inclusive? "" : "not ");
2606 debug_printf(" file count quota = %d count = %d\n",
2607 ob->quota_filecount_value, mailbox_filecount);
2609 if (mailbox_size + (ob->quota_is_inclusive? message_size:0) > ob->quota_value)
2611 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2613 errno = ERRNO_EXIMQUOTA;
2615 else if (ob->quota_filecount_value > 0 &&
2616 mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2617 ob->quota_filecount_value)
2619 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2621 errno = ERRNO_EXIMQUOTA;
2622 filecount_msg = US" filecount";
2626 /* If we are writing in MBX format, what we actually do is to write the message
2627 to a temporary file, and then copy it to the real file once we know its size.
2628 This is the most straightforward way of getting the correct length in the
2629 separator line. So, what we do here is to save the real file descriptor, and
2630 replace it with one for a temporary file. The temporary file gets unlinked once
2631 opened, so that it goes away on closure. */
2634 if (yield == OK && ob->mbx_format)
2636 temp_file = tmpfile();
2637 if (temp_file == NULL)
2639 addr->basic_errno = errno;
2640 addr->message = US"while setting up temporary file";
2645 fd = fileno(temp_file);
2646 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2648 #endif /* SUPPORT_MBX */
2650 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2653 transport_count = 0;
2655 /* Write any configured prefix text first */
2657 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2659 uschar *prefix = expand_string(ob->message_prefix);
2662 errno = ERRNO_EXPANDFAIL;
2663 addr->transport_return = PANIC;
2664 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2665 "transport) failed", ob->message_prefix, tblock->name);
2668 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2671 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2672 various different values for batching are handled outside; if there is more
2673 than one address available here, all must be included. If any address is a
2674 file, use its parent in the RCPT TO. */
2676 if (yield == OK && ob->use_bsmtp)
2678 transport_count = 0;
2679 if (ob->use_crlf) cr = US"\r";
2680 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2685 for (a = addr; a != NULL; a = a->next)
2687 address_item *b = testflag(a, af_pfr)? a->parent: a;
2688 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2689 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2690 { yield = DEFER; break; }
2692 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2697 /* Now the message itself. The options for transport_write_message were set up
2698 at initialization time. */
2702 if (!transport_write_message(addr, fd, ob->options, 0, tblock->add_headers,
2703 tblock->remove_headers, ob->check_string, ob->escape_string,
2704 tblock->rewrite_rules, tblock->rewrite_existflags))
2708 /* Now a configured suffix. */
2710 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2712 uschar *suffix = expand_string(ob->message_suffix);
2715 errno = ERRNO_EXPANDFAIL;
2716 addr->transport_return = PANIC;
2717 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2718 "transport) failed", ob->message_suffix, tblock->name);
2721 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2724 /* If batch smtp, write the terminating dot. */
2726 if (yield == OK && ob->use_bsmtp &&
2727 !transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2729 /* If MBX format is being used, all that writing was to the temporary file.
2730 However, if there was an earlier failure (Exim quota exceeded, for example),
2731 the temporary file won't have got opened - and no writing will have been done.
2732 If writing was OK, we restore the fd, and call a function that copies the
2733 message in MBX format into the real file. Otherwise use the temporary name in
2737 if (temp_file != NULL && ob->mbx_format)
2744 transport_count = 0; /* Reset transport count for actual write */
2745 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2747 else if (errno >= 0) dataname = US"temporary file";
2749 /* Preserve errno while closing the temporary file. */
2751 mbx_save_errno = errno;
2752 (void)fclose(temp_file);
2753 errno = mbx_save_errno;
2755 #endif /* SUPPORT_MBX */
2757 /* Force out the remaining data to check for any errors; some OS don't allow
2758 fsync() to be called for a FIFO. */
2760 if (yield == OK && !isfifo && fsync(fd) < 0) yield = DEFER;
2762 /* Update message_size to the accurate count of bytes written, including
2765 message_size = transport_count;
2767 /* If using a maildir++ quota file, add this message's size to it, and
2768 close the file descriptor. */
2770 #ifdef SUPPORT_MAILDIR
2771 if (yield == OK && maildirsize_fd >= 0)
2772 maildir_record_length(maildirsize_fd, message_size);
2774 maildir_save_errno = errno; /* Preserve errno while closing the file */
2775 (void)close(maildirsize_fd);
2776 errno = maildir_save_errno;
2777 #endif /* SUPPORT_MAILDIR */
2779 /* If there is a quota warning threshold and we are have crossed it with this
2780 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2783 if (THRESHOLD_CHECK)
2785 off_t threshold = ob->quota_warn_threshold_value;
2786 if (ob->quota_warn_threshold_is_percent)
2787 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
2789 debug_printf("quota = " OFF_T_FMT
2790 " threshold = " OFF_T_FMT
2791 " old size = " OFF_T_FMT
2792 " message size = %d\n",
2793 ob->quota_value, threshold, mailbox_size,
2795 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2796 addr->special_action = SPECIAL_WARN;
2798 /******* You might think that the test ought to be this:
2800 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2801 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2803 * (indeed, I was sent a patch with that in). However, it is possible to
2804 * have a warning threshold without actually imposing a quota, and I have
2805 * therefore kept Exim backwards compatible.
2810 /* Handle error while writing the file. Control should come here directly after
2811 the error, with the reason in errno. In the case of expansion failure in prefix
2812 or suffix, it will be ERRNO_EXPANDFAIL. */
2816 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2818 /* Save the error number. If positive, it will ultimately cause a strerror()
2819 call to generate some text. */
2821 addr->basic_errno = errno;
2823 /* For system or Exim quota excession, or disk full, set more_errno to the
2824 time since the file was last read. If delivery was into a directory, the
2825 time since last read logic is not relevant, in general. However, for maildir
2826 deliveries we can approximate it by looking at the last modified time of the
2827 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2828 "new" subdirectory implies that an MUA has moved a message from there to the
2831 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2833 addr->more_errno = 0;
2834 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2836 #ifdef SUPPORT_MAILDIR
2837 else if (mbformat == mbf_maildir)
2839 struct stat statbuf;
2840 if (Ustat("new", &statbuf) < 0)
2842 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2843 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2845 else /* Want a repeatable time when in test harness */
2847 addr->more_errno = running_in_test_harness? 10 :
2848 (int)time(NULL) - statbuf.st_mtime;
2851 debug_printf("maildir: time since \"new\" directory modified = %s\n",
2852 readconf_printtime(addr->more_errno));
2854 #endif /* SUPPORT_MAILDIR */
2857 /* Handle system quota excession. Add an explanatory phrase for the error
2858 message, since some systems don't have special quota-excession errors,
2859 and on those that do, "quota" doesn't always mean anything to the user. */
2861 if (errno == errno_quota)
2864 addr->message = string_sprintf("mailbox is full "
2865 "(quota exceeded while writing to file %s)", filename);
2867 addr->message = string_sprintf("mailbox is full");
2869 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
2871 isdirectory? US"" : US": time since file read = ",
2872 isdirectory? US"" : readconf_printtime(addr->more_errno));
2875 /* Handle Exim's own quota-imposition */
2877 else if (errno == ERRNO_EXIMQUOTA)
2879 addr->message = string_sprintf("mailbox is full "
2880 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
2882 addr->user_message = US"mailbox is full";
2883 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
2884 filecount_msg, dataname,
2885 isdirectory? US"" : US": time since file read = ",
2886 isdirectory? US"" : readconf_printtime(addr->more_errno));
2889 /* Handle a process failure while writing via a filter; the return
2890 from child_close() is in more_errno. */
2892 else if (errno == ERRNO_FILTER_FAIL)
2895 addr->message = string_sprintf("transport filter process failed (%d) "
2896 "while writing to %s%s", addr->more_errno, dataname,
2897 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
2900 /* Handle failure to expand header changes */
2902 else if (errno == ERRNO_CHHEADER_FAIL)
2906 string_sprintf("failed to expand headers_add or headers_remove while "
2907 "writing to %s: %s", dataname, expand_string_message);
2910 /* Handle failure to complete writing of a data block */
2912 else if (errno == ERRNO_WRITEINCOMPLETE)
2914 addr->message = string_sprintf("failed to write data block while "
2915 "writing to %s", dataname);
2918 /* Handle length mismatch on MBX copying */
2921 else if (errno == ERRNO_MBXLENGTH)
2923 addr->message = string_sprintf("length mismatch while copying MBX "
2924 "temporary file to %s", dataname);
2926 #endif /* SUPPORT_MBX */
2928 /* For other errors, a general-purpose explanation, if the message is
2931 else if (addr->message == NULL)
2932 addr->message = string_sprintf("error while writing to %s", dataname);
2934 /* For a file, reset the file size to what it was before we started, leaving
2935 the last modification time unchanged, so it will get reset also. All systems
2936 investigated so far have ftruncate(), whereas not all have the F_FREESP
2937 fcntl() call (BSDI & FreeBSD do not). */
2939 if (!isdirectory) (void)ftruncate(fd, saved_size);
2942 /* Handle successful writing - we want the modification time to be now for
2943 appended files. Remove the default backstop error number. For a directory, now
2944 is the time to rename the file with a unique name. As soon as such a name
2945 appears it may get used by another process, so we close the file first and
2946 check that all is well. */
2950 times.modtime = time(NULL);
2951 addr->basic_errno = 0;
2953 /* Handle the case of writing to a new file in a directory. This applies
2954 to all single-file formats - maildir, mailstore, and "smail format". */
2958 if (fstat(fd, &statbuf) < 0)
2960 addr->basic_errno = errno;
2961 addr->message = string_sprintf("while fstatting opened message file %s",
2966 else if (close(fd) < 0)
2968 addr->basic_errno = errno;
2969 addr->message = string_sprintf("close() error for %s",
2970 (ob->mailstore_format)? dataname : filename);
2974 /* File is successfully written and closed. Arrange to rename it. For the
2975 different kinds of single-file delivery, some games can be played with the
2976 name. The message size is by this time set to the accurate value so that
2977 its value can be used in expansions. */
2981 uschar *renamename = newname;
2984 DEBUG(D_transport) debug_printf("renaming temporary file\n");
2986 /* If there is no rename name set, we are in a non-maildir, non-mailstore
2987 situation. The name is built by expanding the directory_file option, and
2988 we make the inode number available for use in this. The expansion was
2989 checked for syntactic validity above, before we wrote the file.
2991 We have to be careful here, in case the file name exists. (In the other
2992 cases, the names used are constructed to be unique.) The rename()
2993 function just replaces an existing file - we don't want that! So instead
2994 of calling rename(), we must use link() and unlink().
2996 In this case, if the link fails because of an existing file, we wait
2997 for one second and try the expansion again, to see if it produces a
2998 different value. Do this up to 5 times unless the name stops changing.
2999 This makes it possible to build values that are based on the time, and
3000 still cope with races from multiple simultaneous deliveries. */
3002 if (newname == NULL)
3006 uschar *old_renameleaf = US"";
3008 for (i = 0; ; sleep(1), i++)
3010 deliver_inode = statbuf.st_ino;
3011 renameleaf = expand_string(ob->dirfilename);
3014 if (renameleaf == NULL)
3016 addr->transport_return = PANIC;
3017 addr->message = string_sprintf("Expansion of \"%s\" "
3018 "(directory_file for %s transport) failed: %s",
3019 ob->dirfilename, tblock->name, expand_string_message);
3023 renamename = string_sprintf("%s/%s", path, renameleaf);
3024 if (Ulink(filename, renamename) < 0)
3026 DEBUG(D_transport) debug_printf("link failed: %s\n",
3028 if (errno != EEXIST || i >= 4 ||
3029 Ustrcmp(renameleaf, old_renameleaf) == 0)
3031 addr->basic_errno = errno;
3032 addr->message = string_sprintf("while renaming %s as %s",
3033 filename, renamename);
3037 old_renameleaf = renameleaf;
3038 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3047 } /* re-expand loop */
3048 } /* not mailstore or maildir */
3050 /* For maildir and mailstore formats, the new name was created earlier,
3051 except that for maildir, there is the possibility of adding a "tag" on
3052 the end of the name by expanding the value of nametag. This usually
3053 includes a reference to the message size. The expansion of nametag was
3054 checked above, before the file was opened. It either succeeded, or
3055 provoked a soft failure. So any failure here can be treated as soft.
3056 Ignore non-printing characters and / and put a colon at the start if the
3057 first character is alphanumeric. */
3061 if (nametag != NULL)
3063 uschar *iptr = expand_string(nametag);
3066 uschar *etag = store_get(Ustrlen(iptr) + 2);
3067 uschar *optr = etag;
3070 if (mac_isgraph(*iptr) && *iptr != '/')
3072 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3078 renamename = string_sprintf("%s%s", newname, etag);
3082 /* Do the rename. If the name is too long and a tag exists, try again
3085 if (Urename(filename, renamename) < 0 &&
3086 (nametag == NULL || errno != ENAMETOOLONG ||
3087 (renamename = newname, Urename(filename, renamename) < 0)))
3089 addr->basic_errno = errno;
3090 addr->message = string_sprintf("while renaming %s as %s",
3091 filename, renamename);
3095 /* Rename succeeded */
3099 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3101 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3103 } /* maildir or mailstore */
3104 } /* successful write + close */
3106 } /* write success */
3109 /* For a file, restore the last access time (atime), and set the modification
3110 time as required - changed if write succeeded, unchanged if not. */
3112 if (!isdirectory) utime(CS filename, ×);
3114 /* Notify comsat if configured to do so. It only makes sense if the configured
3115 file is the one that the comsat daemon knows about. */
3117 if (ob->notify_comsat && yield == OK && deliver_localpart != NULL)
3118 notify_comsat(deliver_localpart, saved_size);
3120 /* Pass back the final return code in the address structure */
3123 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3124 yield, addr->basic_errno, addr->more_errno);
3126 addr->transport_return = yield;
3128 /* Close the file, which will release the fcntl lock. For a directory write it
3129 is closed above, except in cases of error which goto RETURN, when we also need
3130 to remove the original file(s). For MBX locking, if all has gone well, before
3131 closing the file, see if we can get an exclusive lock on it, in which case we
3132 can unlink the /tmp lock file before closing it. This is always a non-blocking
3133 lock; there's no need to wait if we can't get it. If everything has gone right
3134 but close fails, defer the message. Then unlink the lock file, if present. This
3135 point in the code is jumped to from a number of places when errors are
3136 detected, in order to get the file closed and the lock file tidied away. */
3141 if (mbx_lockfd >= 0)
3143 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3144 ob->use_flock, 0) >= 0)
3147 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3148 Uunlink(mbx_lockname);
3150 (void)close(mbx_lockfd);
3152 #endif /* SUPPORT_MBX */
3154 if (fd >= 0 && close(fd) < 0 && yield == OK)
3156 addr->basic_errno = errno;
3157 addr->message = string_sprintf("while closing %s", filename);
3158 addr->transport_return = DEFER;
3161 if (hd >= 0) Uunlink(lockname);
3163 /* We get here with isdirectory and filename set only in error situations. */
3165 if (isdirectory && filename != NULL)
3168 if (dataname != filename) Uunlink(dataname);
3171 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3172 file name relies on time + pid. We must not allow the process to finish until
3173 the clock has move on by at least one microsecond. Usually we expect this
3174 already to be the case, but machines keep getting faster... */
3176 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3178 /* A return of FALSE means that if there was an error, a common error was
3179 put in the first address of a batch. */
3184 /* End of transport/appendfile.c */