1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
11 #include "appendfile.h"
13 #ifdef SUPPORT_MAILDIR
14 #include "tf_maildir.h"
18 /* Options specific to the appendfile transport. They must be in alphabetic
19 order (note that "_" comes before the lower case letters). Some of them are
20 stored in the publicly visible instance block - these are flagged with the
22 #define LOFF(field) OPT_OFF(appendfile_transport_options_block, field)
24 optionlist appendfile_transport_options[] = {
25 #ifdef SUPPORT_MAILDIR
26 { "*expand_maildir_use_size_file", opt_stringptr, LOFF(expand_maildir_use_size_file) },
28 { "*set_use_fcntl_lock",opt_bool | opt_hidden, LOFF(set_use_fcntl) },
29 { "*set_use_flock_lock",opt_bool | opt_hidden, LOFF(set_use_flock) },
30 { "*set_use_lockfile", opt_bool | opt_hidden, LOFF(set_use_lockfile) },
32 { "*set_use_mbx_lock", opt_bool | opt_hidden, LOFF(set_use_mbx_lock) },
34 { "allow_fifo", opt_bool, LOFF(allow_fifo) },
35 { "allow_symlink", opt_bool, LOFF(allow_symlink) },
36 { "batch_id", opt_stringptr | opt_public, OPT_OFF(transport_instance, batch_id) },
37 { "batch_max", opt_int | opt_public, OPT_OFF(transport_instance, batch_max) },
38 { "check_group", opt_bool, LOFF(check_group) },
39 { "check_owner", opt_bool, LOFF(check_owner) },
40 { "check_string", opt_stringptr, LOFF(check_string) },
41 { "create_directory", opt_bool, LOFF(create_directory) },
42 { "create_file", opt_stringptr, LOFF(create_file_string) },
43 { "directory", opt_stringptr, LOFF(dirname) },
44 { "directory_file", opt_stringptr, LOFF(dirfilename) },
45 { "directory_mode", opt_octint, LOFF(dirmode) },
46 { "escape_string", opt_stringptr, LOFF(escape_string) },
47 { "file", opt_stringptr, LOFF(filename) },
48 { "file_format", opt_stringptr, LOFF(file_format) },
49 { "file_must_exist", opt_bool, LOFF(file_must_exist) },
50 { "lock_fcntl_timeout", opt_time, LOFF(lock_fcntl_timeout) },
51 { "lock_flock_timeout", opt_time, LOFF(lock_flock_timeout) },
52 { "lock_interval", opt_time, LOFF(lock_interval) },
53 { "lock_retries", opt_int, LOFF(lock_retries) },
54 { "lockfile_mode", opt_octint, LOFF(lockfile_mode) },
55 { "lockfile_timeout", opt_time, LOFF(lockfile_timeout) },
56 { "mailbox_filecount", opt_stringptr, LOFF(mailbox_filecount_string) },
57 { "mailbox_size", opt_stringptr, LOFF(mailbox_size_string) },
58 #ifdef SUPPORT_MAILDIR
59 { "maildir_format", opt_bool, LOFF(maildir_format ) } ,
60 { "maildir_quota_directory_regex", opt_stringptr, LOFF(maildir_dir_regex) },
61 { "maildir_retries", opt_int, LOFF(maildir_retries) },
62 { "maildir_tag", opt_stringptr, LOFF(maildir_tag) },
63 { "maildir_use_size_file", opt_expand_bool, LOFF(maildir_use_size_file ) } ,
64 { "maildirfolder_create_regex", opt_stringptr, LOFF(maildirfolder_create_regex ) },
65 #endif /* SUPPORT_MAILDIR */
66 #ifdef SUPPORT_MAILSTORE
67 { "mailstore_format", opt_bool, LOFF(mailstore_format ) },
68 { "mailstore_prefix", opt_stringptr, LOFF(mailstore_prefix ) },
69 { "mailstore_suffix", opt_stringptr, LOFF(mailstore_suffix ) },
70 #endif /* SUPPORT_MAILSTORE */
72 { "mbx_format", opt_bool, LOFF(mbx_format ) } ,
73 #endif /* SUPPORT_MBX */
74 { "message_prefix", opt_stringptr, LOFF(message_prefix) },
75 { "message_suffix", opt_stringptr, LOFF(message_suffix) },
76 { "mode", opt_octint, LOFF(mode) },
77 { "mode_fail_narrower",opt_bool, LOFF(mode_fail_narrower) },
78 { "notify_comsat", opt_bool, LOFF(notify_comsat) },
79 { "quota", opt_stringptr, LOFF(quota) },
80 { "quota_directory", opt_stringptr, LOFF(quota_directory) },
81 { "quota_filecount", opt_stringptr, LOFF(quota_filecount) },
82 { "quota_is_inclusive", opt_bool, LOFF(quota_is_inclusive) },
83 { "quota_size_regex", opt_stringptr, LOFF(quota_size_regex) },
84 { "quota_warn_message", opt_stringptr | opt_public, OPT_OFF(transport_instance, warn_message) },
85 { "quota_warn_threshold", opt_stringptr, LOFF(quota_warn_threshold) },
86 { "use_bsmtp", opt_bool, LOFF(use_bsmtp) },
87 { "use_crlf", opt_bool, LOFF(use_crlf) },
88 { "use_fcntl_lock", opt_bool_set, LOFF(use_fcntl) },
89 { "use_flock_lock", opt_bool_set, LOFF(use_flock) },
90 { "use_lockfile", opt_bool_set, LOFF(use_lockfile) },
92 { "use_mbx_lock", opt_bool_set, LOFF(use_mbx_lock) },
93 #endif /* SUPPORT_MBX */
96 /* Size of the options list. An extern variable has to be used so that its
97 address can appear in the tables drtables.c. */
99 int appendfile_transport_options_count =
100 sizeof(appendfile_transport_options)/sizeof(optionlist);
106 appendfile_transport_options_block appendfile_transport_option_defaults = {0};
107 void appendfile_transport_init(transport_instance *tblock) {}
108 BOOL appendfile_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
110 #else /*!MACRO_PREDEF*/
112 /* Default private options block for the appendfile transport. */
114 appendfile_transport_options_block appendfile_transport_option_defaults = {
117 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
118 NULL, /* message_prefix (default reset in init if not bsmtp) */
119 NULL, /* message_suffix (ditto) */
120 US"anywhere", /* create_file_string (string value for create_file) */
122 NULL, /* quota_directory */
123 NULL, /* quota_filecount */
124 NULL, /* quota_size_regex */
125 NULL, /* quota_warn_threshold */
126 NULL, /* mailbox_size_string */
127 NULL, /* mailbox_filecount_string */
128 NULL, /* expand_maildir_use_size_file */
129 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
130 NULL, /* maildir_tag */
131 NULL, /* maildirfolder_create_regex */
132 NULL, /* mailstore_prefix */
133 NULL, /* mailstore_suffix */
134 NULL, /* check_string (default changed for non-bsmtp file)*/
135 NULL, /* escape_string (ditto) */
136 NULL, /* file_format */
138 0, /* quota_warn_threshold_value */
139 -1, /* mailbox_size_value */
140 -1, /* mailbox_filecount_value */
141 0, /* quota_filecount_value */
142 APPENDFILE_MODE, /* mode */
143 APPENDFILE_DIRECTORY_MODE, /* dirmode */
144 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
145 30*60, /* lockfile_timeout */
146 0, /* lock_fcntl_timeout */
147 0, /* lock_flock_timeout */
148 10, /* lock_retries */
149 3, /* lock_interval */
150 10, /* maildir_retries */
151 create_anywhere,/* create_file */
153 FALSE, /* allow_fifo */
154 FALSE, /* allow_symlink */
155 FALSE, /* check_group */
156 TRUE, /* check_owner */
157 TRUE, /* create_directory */
158 FALSE, /* notify_comsat */
159 TRUE, /* use_lockfile */
160 FALSE, /* set_use_lockfile */
161 TRUE, /* use_fcntl */
162 FALSE, /* set_use_fcntl */
163 FALSE, /* use_flock */
164 FALSE, /* set_use_flock */
165 FALSE, /* use_mbx_lock */
166 FALSE, /* set_use_mbx_lock */
167 FALSE, /* use_bsmtp */
168 FALSE, /* use_crlf */
169 FALSE, /* file_must_exist */
170 TRUE, /* mode_fail_narrower */
171 FALSE, /* maildir_format */
172 FALSE, /* maildir_use_size_file */
173 FALSE, /* mailstore_format */
174 FALSE, /* mbx_format */
175 FALSE, /* quota_warn_threshold_is_percent */
176 TRUE, /* quota_is_inclusive */
177 FALSE, /* quota_no_check */
178 FALSE /* quota_filecount_no_check */
182 /* Encodings for mailbox formats, and their names. MBX format is actually
183 supported only if SUPPORT_MBX is set. */
185 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
187 static const char *mailbox_formats[] = {
188 "unix", "mbx", "smail", "maildir", "mailstore" };
191 /* Check warn threshold only if quota size set or not a percentage threshold
192 percentage check should only be done if quota > 0 */
194 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
195 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
199 /*************************************************
200 * Setup entry point *
201 *************************************************/
203 /* Called for each delivery in the privileged state, just before the uid/gid
204 are changed and the main entry point is called. We use this function to
205 expand any quota settings, so that it can access files that may not be readable
206 by the user. It is also used to pick up external mailbox size information, if
210 tblock points to the transport instance
211 addrlist addresses about to be delivered (not used)
212 dummy not used (doesn't pass back data)
213 uid the uid that will be set (not used)
214 gid the gid that will be set (not used)
215 errmsg where to put an error message
217 Returns: OK, FAIL, or DEFER
224 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
225 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
227 appendfile_transport_options_block *ob =
228 (appendfile_transport_options_block *)(tblock->options_block);
229 uschar *q = ob->quota;
230 double default_value = 0.0;
232 addrlist = addrlist; /* Keep picky compilers happy */
237 /* we can't wait until we're not privileged anymore */
238 open_logs("appendfile");
240 if (ob->expand_maildir_use_size_file)
241 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
242 US"`maildir_use_size_file` in transport", tblock->name);
244 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
247 for (int i = 0; i < 5; i++)
251 uschar *which = NULL;
253 if (q == NULL) d = default_value;
257 uschar *s = expand_string(q);
261 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
262 "%s", q, tblock->name, expand_string_message);
263 return f.search_find_defer ? DEFER : FAIL;
266 d = Ustrtod(s, &rest);
268 /* Handle following characters K, M, G, %, the latter being permitted
269 for quota_warn_threshold only. A threshold with no quota setting is
272 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
273 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
274 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
275 else if (*rest == '%' && i == 2)
277 if (ob->quota_value <= 0 && !ob->maildir_use_size_file)
279 else if ((int)d < 0 || (int)d > 100)
281 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
282 " for %s transport", (int)d, tblock->name);
285 ob->quota_warn_threshold_is_percent = TRUE;
290 /* For quota and quota_filecount there may be options
291 appended. Currently only "no_check", so we can be lazy parsing it */
292 if (i < 2 && Ustrstr(rest, "/no_check") == rest)
295 rest += sizeof("/no_check") - 1;
298 Uskip_whitespace(&rest);
302 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
303 "in %s transport", s, q, tblock->name);
308 /* Set each value, checking for possible overflow. */
313 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
315 ob->quota_value = (off_t)d;
316 ob->quota_no_check = no_check;
317 q = ob->quota_filecount;
321 if (d >= 2.0*1024.0*1024.0*1024.0)
322 which = US"quota_filecount";
323 ob->quota_filecount_value = (int)d;
324 ob->quota_filecount_no_check = no_check;
325 q = ob->quota_warn_threshold;
329 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
330 which = US"quota_warn_threshold";
331 ob->quota_warn_threshold_value = (off_t)d;
332 q = ob->mailbox_size_string;
333 default_value = -1.0;
337 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
338 which = US"mailbox_size";;
339 ob->mailbox_size_value = (off_t)d;
340 q = ob->mailbox_filecount_string;
344 if (d >= 2.0*1024.0*1024.0*1024.0)
345 which = US"mailbox_filecount";
346 ob->mailbox_filecount_value = (int)d;
352 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
353 "%s transport", which, d, tblock->name);
363 /*************************************************
364 * Initialization entry point *
365 *************************************************/
367 /* Called for each instance, after its options have been read, to
368 enable consistency checks to be done, or anything else that needs
372 appendfile_transport_init(transport_instance *tblock)
374 appendfile_transport_options_block *ob =
375 (appendfile_transport_options_block *)(tblock->options_block);
377 /* Set up the setup entry point, to be called in the privileged state */
379 tblock->setup = appendfile_transport_setup;
381 /* Lock_retries must be greater than zero */
383 if (ob->lock_retries == 0) ob->lock_retries = 1;
385 /* Only one of a file name or directory name must be given. */
387 if (ob->filename && ob->dirname)
388 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
389 "only one of \"file\" or \"directory\" can be specified", tblock->name);
391 /* If a file name was specified, neither quota_filecount nor quota_directory
396 if (ob->quota_filecount)
397 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
398 "quota_filecount must not be set without \"directory\"", tblock->name);
399 if (ob->quota_directory)
400 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
401 "quota_directory must not be set without \"directory\"", tblock->name);
404 /* The default locking depends on whether MBX is set or not. Change the
405 built-in default if none of the lock options has been explicitly set. At least
406 one form of locking is required in all cases, but mbx locking changes the
407 meaning of fcntl and flock locking. */
409 /* Not all operating systems provide flock(). For those that do, if flock is
410 requested, the default for fcntl is FALSE. */
415 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
416 "flock() support was not available in the operating system when this "
417 "binary was built", tblock->name);
418 #endif /* NO_FLOCK */
419 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
424 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
425 !ob->set_use_mbx_lock)
427 ob->use_lockfile = ob->use_flock = FALSE;
428 ob->use_mbx_lock = ob->use_fcntl = TRUE;
430 else if (ob->use_mbx_lock)
432 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
433 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
434 if (!ob->set_use_flock) ob->use_flock = FALSE;
435 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
437 #endif /* SUPPORT_MBX */
439 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
440 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
441 "no locking configured", tblock->name);
443 /* Unset timeouts for non-used locking types */
445 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
446 if (!ob->use_flock) ob->lock_flock_timeout = 0;
448 /* If a directory name was specified, only one of maildir or mailstore may be
449 specified, and if quota_filecount or quota_directory is given, quota must
454 if (ob->maildir_format && ob->mailstore_format)
455 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
456 "only one of maildir and mailstore may be specified", tblock->name);
457 if (ob->quota_filecount != NULL && ob->quota == NULL)
458 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
459 "quota must be set if quota_filecount is set", tblock->name);
460 if (ob->quota_directory != NULL && ob->quota == NULL)
461 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
462 "quota must be set if quota_directory is set", tblock->name);
465 /* If a fixed uid field is set, then a gid field must also be set. */
467 if (tblock->uid_set && !tblock->gid_set && !tblock->expand_gid)
468 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
469 "user set without group for the %s transport", tblock->name);
471 /* If "create_file" is set, check that a valid option is given, and set the
474 if (ob->create_file_string)
477 if (Ustrcmp(ob->create_file_string, "anywhere") == 0)
478 value = create_anywhere;
479 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0)
480 value = create_belowhome;
481 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
482 value = create_inhome;
484 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
485 "invalid value given for \"file_create\" for the %s transport: %s",
486 tblock->name, ob->create_file_string);
487 ob->create_file = value;
490 /* If quota_warn_threshold is set, set up default for warn_message. It may
491 not be used if the actual threshold for a given delivery ends up as zero,
492 of if it's given as a percentage and there's no quota setting. */
494 if (ob->quota_warn_threshold)
496 if (!tblock->warn_message) tblock->warn_message = US
497 "To: $local_part@$domain\n"
498 "Subject: Your mailbox\n\n"
499 "This message is automatically created by mail delivery software (Exim).\n\n"
500 "The size of your mailbox has exceeded a warning threshold that is\n"
501 "set by the system administrator.\n";
504 /* If batch SMTP is set, force the check and escape strings, and arrange that
505 headers are also escaped. */
509 ob->check_string = US".";
510 ob->escape_string = US"..";
511 ob->options |= topt_escape_headers;
514 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
515 insert default values for for the affixes and the check/escape strings. */
517 else if (!ob->dirname && !ob->maildir_format && !ob->mailstore_format)
519 if (!ob->message_prefix) ob->message_prefix =
520 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
521 if (!ob->message_suffix) ob->message_suffix = US"\n";
522 if (!ob->check_string) ob->check_string = US"From ";
523 if (!ob->escape_string) ob->escape_string = US">From ";
527 /* Set up the bitwise options for transport_write_message from the various
528 driver options. Only one of body_only and headers_only can be set. */
531 (tblock->body_only ? topt_no_headers : 0) |
532 (tblock->headers_only ? topt_no_body : 0) |
533 (tblock->return_path_add ? topt_add_return_path : 0) |
534 (tblock->delivery_date_add ? topt_add_delivery_date : 0) |
535 (tblock->envelope_to_add ? topt_add_envelope_to : 0) |
536 ((ob->use_crlf || ob->mbx_format) ? topt_use_crlf : 0);
541 /*************************************************
543 *************************************************/
545 /* The comsat daemon is the thing that provides asynchronous notification of
546 the arrival of local messages, if requested by the user by "biff y". It is a
547 BSD thing that uses a TCP/IP protocol for communication. A message consisting
548 of the text "user@offset" must be sent, where offset is the place in the
549 mailbox where new mail starts. There is no scope for telling it which file to
550 look at, which makes it a less than useful if mail is being delivered into a
551 non-standard place such as the user's home directory. In fact, it doesn't seem
552 to pay much attention to the offset.
556 offset offset in mailbox
562 notify_comsat(uschar *user, off_t offset)
568 DEBUG(D_transport) debug_printf("notify_comsat called\n");
570 s = string_sprintf("%.200s@" OFF_T_FMT "\n", user, offset);
572 if ((sp = getservbyname("biff", "udp")) == NULL)
574 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
578 host.name = US"localhost";
582 /* This code is all set up to look up "localhost" and use all its addresses
583 until one succeeds. However, it appears that at least on some systems, comsat
584 doesn't listen on the ::1 address. So for the moment, just force the address to
585 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
586 can be changed. (But actually, comsat is probably dying out anyway.) */
589 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
591 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
596 host.address = US"127.0.0.1";
599 for (host_item * h = &host; h; h = h->next)
602 int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
604 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
606 if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
608 /* Connect never fails for a UDP socket, so don't set a timeout. */
610 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, NULL);
611 rc = send(sock, s, Ustrlen(s) + 1, 0);
616 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
623 /*************************************************
624 * Check the format of a file *
625 *************************************************/
627 /* This function is called when file_format is set, to check that an existing
628 file has the right format. The format string contains text/transport pairs. The
629 string matching is literal. we just read big_buffer_size bytes, because this is
630 all about the first few bytes of a file.
634 tblock the transport block
635 addr the address block - for inserting error data
637 Returns: pointer to the required transport, or NULL
641 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
643 const uschar *format =
644 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
646 int len = read(cfd, data, sizeof(data));
650 DEBUG(D_transport) debug_printf("checking file format\n");
652 /* An empty file matches the current transport */
654 if (len == 0) return tblock;
656 /* Search the formats for a match */
658 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size)))
660 int slen = Ustrlen(s);
661 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
662 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
666 for (transport_instance * tt = transports; tt; tt = tt->next)
667 if (Ustrcmp(tp, tt->name) == 0)
670 debug_printf("file format -> %s transport\n", tt->name);
673 addr->basic_errno = ERRNO_BADTRANSPORT;
674 addr->message = string_sprintf("%s transport (for %.*s format) not found",
680 /* Failed to find a match */
682 addr->basic_errno = ERRNO_FORMATUNKNOWN;
683 addr->message = US"mailbox file format unrecognized";
690 /*************************************************
691 * Check directory's files for quota *
692 *************************************************/
694 /* This function is called if quota is set for one of the delivery modes that
695 delivers into a specific directory. It scans the directory and stats all the
696 files in order to get a total size and count. This is an expensive thing to do,
697 but some people are prepared to bear the cost. Alternatively, if size_regex is
698 set, it is used as a regex to try to extract the size from the file name, a
699 strategy that some people use on maildir files on systems where the users have
702 The function is global, because it is also called from tf_maildir.c for maildir
703 folders (which should contain only regular files).
705 Note: Any problems can be written to debugging output, but cannot be written to
706 the log, because we are running as an unprivileged user here.
709 dirname the name of the directory
710 countptr where to add the file count (because this function recurses)
711 regex a compiled regex to get the size from a name
713 Returns: the sum of the sizes of the stattable files
714 zero if the directory cannot be opened
718 check_dir_size(const uschar * dirname, int *countptr, const pcre *regex)
722 int count = *countptr;
724 if (!(dir = exim_opendir(dirname))) return 0;
726 for (struct dirent *ent; ent = readdir(dir); )
728 uschar * path, * name = US ent->d_name;
731 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
735 /* If there's a regex, try to find the size using it */
740 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
743 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
744 if (endptr == name + ovector[3])
748 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
754 debug_printf("check_dir_size: regex did not match %s\n", name);
757 /* No regex or no match for the regex, or captured non-digits */
759 path = string_sprintf("%s/%s", dirname, name);
761 if (Ustat(path, &statbuf) < 0)
764 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, path,
768 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
769 sum += statbuf.st_size / statbuf.st_nlink;
770 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
771 sum += check_dir_size(path, &count, regex);
776 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
786 /*************************************************
787 * Apply a lock to a file descriptor *
788 *************************************************/
790 /* This function applies a lock to a file descriptor, using a blocking or
791 non-blocking lock, depending on the timeout value. It can apply either or
792 both of a fcntl() and a flock() lock. However, not all OS support flock();
793 for those that don't, the use_flock option cannot be set.
796 fd the file descriptor
797 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
798 fcntl() format); the flock() type is deduced if needed
799 dofcntl do fcntl() locking
800 fcntltime non-zero to use blocking fcntl()
801 doflock do flock() locking
802 flocktime non-zero to use blocking flock()
804 Returns: yield of the fcntl() or flock() call, with errno preserved;
805 sigalrm_seen set if there has been a timeout
809 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
814 struct flock lock_data;
815 lock_data.l_type = fcntltype;
816 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
818 sigalrm_seen = FALSE;
825 yield = fcntl(fd, F_SETLKW, &lock_data);
830 else yield = fcntl(fd, F_SETLK, &lock_data);
834 if (doflock && (yield >= 0))
836 int flocktype = (fcntltype == F_WRLCK) ? LOCK_EX : LOCK_SH;
840 yield = flock(fd, flocktype);
845 else yield = flock(fd, flocktype | LOCK_NB);
847 #endif /* NO_FLOCK */
856 /*************************************************
857 * Copy message into MBX mailbox *
858 *************************************************/
860 /* This function is called when a message intended for a MBX mailbox has been
861 written to a temporary file. We can now get the size of the message and then
862 copy it in MBX format to the mailbox.
865 to_fd fd to write to (the real mailbox)
866 from_fd fd to read from (the temporary file)
867 saved_size current size of mailbox
869 Returns: OK if all went well, DEFER otherwise, with errno preserved
870 the number of bytes written are added to transport_count
871 by virtue of calling transport_write_block()
874 /* Values taken from c-client */
876 #define MBX_HDRSIZE 2048
877 #define MBX_NUSERFLAGS 30
880 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
885 transport_ctx tctx = { .u={.fd = to_fd}, .options = topt_not_socket };
887 /* If the current mailbox size is zero, write a header block */
892 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
893 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
894 (long int)time(NULL));
895 for (int i = 0; i < MBX_NUSERFLAGS; i++)
896 sprintf (CS(s += Ustrlen(s)), "\015\012");
897 if (!transport_write_block (&tctx, deliver_out_buffer, MBX_HDRSIZE, FALSE))
901 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
903 /* Now construct the message's header from the time and the RFC822 file
904 size, including CRLFs, which is the size of the input (temporary) file. */
906 if (fstat(from_fd, &statbuf) < 0) return DEFER;
907 size = statbuf.st_size;
909 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
910 tod_stamp(tod_mbx), size, 0L, 0, 0);
911 used = Ustrlen(deliver_out_buffer);
913 /* Rewind the temporary file, and copy it over in chunks. */
915 if (lseek(from_fd, 0 , SEEK_SET) < 0) return DEFER;
919 int len = read(from_fd, deliver_out_buffer + used,
920 DELIVER_OUT_BUFFER_SIZE - used);
923 if (len == 0) errno = ERRNO_MBXLENGTH;
926 if (!transport_write_block(&tctx, deliver_out_buffer, used + len, FALSE))
934 #endif /* SUPPORT_MBX */
938 /*************************************************
939 * Check creation is permitted *
940 *************************************************/
942 /* This function checks whether a given file name is permitted to be created,
943 as controlled by the create_file option. If no home directory is set, however,
944 we can't do any tests.
947 filename the file name
948 create_file the ob->create_file option
950 Returns: TRUE if creation is permitted
954 check_creation(uschar *filename, int create_file)
958 if (deliver_home && create_file != create_anywhere)
960 int len = Ustrlen(deliver_home);
961 uschar *file = filename;
963 while (file[0] == '/' && file[1] == '/') file++;
964 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
965 ( Ustrchr(file+len+2, '/') != NULL &&
967 create_file != create_belowhome ||
968 Ustrstr(file+len, "/../") != NULL
973 /* If yield is TRUE, the file name starts with the home directory, and does
974 not contain any instances of "/../" in the "belowhome" case. However, it may
975 still contain symbolic links. We can check for this by making use of
976 realpath(), which most Unixes seem to have (but make it possible to cut this
977 out). We can't just use realpath() on the whole file name, because we know
978 the file itself doesn't exist, and intermediate directories may also not
979 exist. What we want to know is the real path of the longest existing part of
980 the path. That must match the home directory's beginning, whichever is the
984 if (yield && create_file == create_belowhome)
988 for (uschar * slash = Ustrrchr(file, '/'); /* There is known to be one */
989 !rp && slash > file; /* Stop if reached beginning */
993 rp = US realpath(CS file, CS big_buffer);
994 next = Ustrrchr(file, '/');
998 /* If rp == NULL it means that none of the relevant directories exist.
999 This is not a problem here - it means that no symbolic links can exist,
1000 which is all we are worried about. Otherwise, we must compare it
1001 against the start of the home directory. However, that may itself
1002 contain symbolic links, so we have to "realpath" it as well, if
1007 uschar hdbuffer[PATH_MAX+1];
1008 uschar *rph = deliver_home;
1009 int rlen = Ustrlen(big_buffer);
1011 if ((rp = US realpath(CS deliver_home, CS hdbuffer)))
1017 if (rlen > len) rlen = len;
1018 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1021 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1022 big_buffer, deliver_home);
1026 #endif /* NO_REALPATH */
1034 /*************************************************
1035 * Main entry point *
1036 *************************************************/
1038 /* See local README for general interface details. This transport always
1039 returns FALSE, indicating that the status which has been placed in the first
1040 address should be copied to any other addresses in a batch.
1042 Appendfile delivery is tricky and has led to various security problems in other
1043 mailers. The logic used here is therefore laid out in some detail. When this
1044 function is called, we are running in a subprocess which has had its gid and
1045 uid set to the appropriate values. Therefore, we cannot write directly to the
1046 exim logs. Any errors must be handled by setting appropriate return codes.
1047 Note that the default setting for addr->transport_return is DEFER, so it need
1048 not be set unless some other value is required.
1050 The code below calls geteuid() rather than getuid() to get the current uid
1051 because in weird configurations not running setuid root there may be a
1052 difference. In the standard configuration, where setuid() has been used in the
1053 delivery process, there will be no difference between the uid and the euid.
1055 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1056 alias expansion. Otherwise, there must be a configured file name or
1059 The following items apply in the case when a file name (as opposed to a
1060 directory name) is given, that is, when appending to a single file:
1062 (2f) Expand the file name.
1064 (3f) If the file name is /dev/null, return success (optimization).
1066 (4f) If the file_format options is set, open the file for reading, and check
1067 that the bytes at the start of the file match one of the given strings.
1068 If the check indicates a transport other than the current one should be
1069 used, pass control to that other transport. Otherwise continue. An empty
1070 or non-existent file matches the current transport. The file is closed
1073 (5f) If a lock file is required, create it (see extensive separate comments
1074 below about the algorithm for doing this). It is important to do this
1075 before opening the mailbox if NFS is in use.
1077 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1078 details of any symbolic link.
1080 (7f) If the file already exists:
1082 Check the owner and group if necessary, and defer if they are wrong.
1084 If it is a symbolic link AND the allow_symlink option is set (NOT the
1085 default), go back to (6f) but this time use stat() instead of lstat().
1087 If it's not a regular file (or FIFO when permitted), defer delivery.
1089 Check permissions. If the required permissions are *less* than the
1090 existing ones, or supplied by the address (often by the user via filter),
1091 chmod() the file. Otherwise, defer.
1093 Save the inode number.
1095 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1097 If open fails because the file does not exist, go to (6f); on any other
1100 Check the inode number hasn't changed - I realize this isn't perfect (an
1101 inode can be reused) but it's cheap and will catch some of the races.
1103 Check it's still a regular file (or FIFO if permitted).
1105 Check that the owner and permissions haven't changed.
1107 If file_format is set, check that the file still matches the format for
1108 the current transport. If not, defer delivery.
1110 (8f) If file does not exist initially:
1112 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1113 this is via a symbolic link (only possible if allow_symlinks is set), in
1114 which case don't use O_EXCL, as it doesn't work.
1116 If open fails because the file already exists, go to (6f). To avoid
1117 looping for ever in a situation where the file is continuously being
1118 created and deleted, all of this happens inside a loop that operates
1119 lock_retries times and includes the fcntl and flock locking. If the
1120 loop completes without the file getting opened, defer and request
1121 freezing, because something really weird is happening.
1123 If open fails for any other reason, defer for subsequent delivery except
1124 when this is a file delivery resulting from an alias or forward expansion
1125 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1126 most likely a user rather than a configuration error.
1128 (9f) We now have the file checked and open for writing. If so configured, lock
1129 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1130 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1131 still fails, give up and defer delivery.
1133 (10f)Save the access time (for subsequent restoration) and the size of the
1134 file, for comsat and for re-setting if delivery fails in the middle -
1135 e.g. for quota exceeded.
1137 The following items apply in the case when a directory name is given:
1139 (2d) Create a new file in the directory using a temporary name, by opening for
1140 writing and with O_CREAT. If maildir format is being used, the file
1141 is created in a temporary subdirectory with a prescribed name. If
1142 mailstore format is being used, the envelope file is first created with a
1143 temporary name, then the data file.
1145 The following items apply in all cases:
1147 (11) We now have the file open for writing, and locked if it was given as a
1148 file name. Write the message and flush the file, unless there is a setting
1149 of the local quota option, in which case we can check for its excession
1150 without doing any writing.
1152 In the case of MBX format mailboxes, the message is first written to a
1153 temporary file, in order to get its correct length. This is then copied to
1154 the real file, preceded by an MBX header.
1156 If there is a quota error on writing, defer the address. Timeout logic
1157 will determine for how long retries are attempted. We restore the mailbox
1158 to its original length if it's a single file. There doesn't seem to be a
1159 uniform error code for quota excession (it even differs between SunOS4
1160 and some versions of SunOS5) so a system-dependent macro called
1161 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1164 For any other error (most commonly disk full), do the same.
1166 The following applies after appending to a file:
1168 (12f)Restore the atime; notify_comsat if required; close the file (which
1169 unlocks it if it was locked). Delete the lock file if it exists.
1171 The following applies after writing a unique file in a directory:
1173 (12d)For maildir format, rename the file into the new directory. For mailstore
1174 format, rename the envelope file to its correct name. Otherwise, generate
1175 a unique name from the directory_file option, and rename to that, possibly
1176 trying a few times if the file exists and re-expanding the name gives a
1179 This transport yields FAIL only when a file name is generated by an alias or
1180 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1181 All other failures return DEFER (in addr->transport_return). */
1185 appendfile_transport_entry(
1186 transport_instance *tblock, /* data for this instantiation */
1187 address_item *addr) /* address we are working on */
1189 appendfile_transport_options_block *ob =
1190 (appendfile_transport_options_block *)(tblock->options_block);
1191 struct stat statbuf;
1192 uschar *fdname = NULL;
1193 uschar *filename = NULL;
1194 uschar *hitchname = NULL;
1195 uschar *dataname = NULL;
1196 uschar *lockname = NULL;
1197 uschar *newname = NULL;
1198 uschar *nametag = NULL;
1200 uschar *filecount_msg = US"";
1202 struct utimbuf times;
1203 struct timeval msg_tv;
1204 BOOL disable_quota = FALSE;
1205 BOOL isdirectory = FALSE;
1206 BOOL isfifo = FALSE;
1207 BOOL wait_for_tick = FALSE;
1208 uid_t uid = geteuid(); /* See note above */
1209 gid_t gid = getegid();
1211 int mode = (addr->mode > 0) ? addr->mode : ob->mode;
1212 off_t saved_size = -1;
1213 off_t mailbox_size = ob->mailbox_size_value;
1214 int mailbox_filecount = ob->mailbox_filecount_value;
1222 int mbx_lockfd = -1;
1223 uschar mbx_lockname[40];
1224 FILE *temp_file = NULL;
1225 #endif /* SUPPORT_MBX */
1227 #ifdef SUPPORT_MAILDIR
1228 int maildirsize_fd = -1; /* fd for maildirsize file */
1229 int maildir_save_errno;
1233 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1235 /* An "address_file" or "address_directory" transport is used to deliver to
1236 files specified via .forward or an alias file. Prior to release 4.20, the
1237 "file" and "directory" options were ignored in this case. This has been changed
1238 to allow the redirection data to specify what is in effect a folder, whose
1239 location is determined by the options on the transport.
1241 Compatibility with the case when neither option is set is retained by forcing a
1242 value for the file or directory name. A directory delivery is assumed if the
1243 last character of the path from the router is '/'.
1245 The file path is in the local part of the address, but not in the $local_part
1246 variable (that holds the parent local part). It is, however, in the
1247 $address_file variable. Below, we update the local part in the address if it
1248 changes by expansion, so that the final path ends up in the log. */
1250 if (testflag(addr, af_file) && !ob->filename && !ob->dirname)
1252 fdname = US"$address_file";
1253 if (address_file[Ustrlen(address_file)-1] == '/' ||
1254 ob->maildir_format ||
1255 ob->mailstore_format)
1259 /* Handle (a) an "address file" delivery where "file" or "directory" is
1260 explicitly set and (b) a non-address_file delivery, where one of "file" or
1261 "directory" must be set; initialization ensures that they are not both set. */
1265 if (!(fdname = ob->filename))
1267 fdname = ob->dirname;
1272 addr->message = string_sprintf("Mandatory file or directory option "
1273 "missing from %s transport", tblock->name);
1278 /* Maildir and mailstore require a directory */
1280 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1282 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1283 "to be specified for the %s transport",
1284 ob->maildir_format ? "dir" : "store", tblock->name);
1288 if (!(path = expand_string(fdname)))
1290 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1291 "name for %s transport) failed: %s", fdname, tblock->name,
1292 expand_string_message);
1296 if ((m = is_tainted2(path, 0, "Tainted '%s' (file or directory "
1297 "name for %s transport) not permitted", path, tblock->name)))
1306 addr->message = string_sprintf("appendfile: file or directory name "
1307 "\"%s\" is not absolute", path);
1308 addr->basic_errno = ERRNO_NOTABSOLUTE;
1312 /* For a file delivery, make sure the local part in the address(es) is updated
1313 to the true local part. */
1315 if (testflag(addr, af_file))
1316 for (address_item * addr2 = addr; addr2; addr2 = addr2->next)
1317 addr2->local_part = string_copy(path);
1319 /* The available mailbox formats depend on whether it is a directory or a file
1325 #ifdef SUPPORT_MAILDIR
1326 ob->maildir_format ? mbf_maildir :
1328 #ifdef SUPPORT_MAILSTORE
1329 ob->mailstore_format ? mbf_mailstore :
1337 ob->mbx_format ? mbf_mbx :
1344 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1346 " warning=" OFF_T_FMT "%s\n"
1347 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1348 "maildir_use_size_file=%s\n",
1349 mode, ob->notify_comsat, ob->quota_value,
1350 ob->quota_no_check ? " (no_check)" : "",
1351 ob->quota_filecount_no_check ? " (no_check_filecount)" : "",
1352 ob->quota_warn_threshold_value,
1353 ob->quota_warn_threshold_is_percent ? "%" : "",
1354 isdirectory ? "directory" : "file",
1355 path, mailbox_formats[mbformat],
1356 !ob->message_prefix ? US"null" : string_printing(ob->message_prefix),
1357 !ob->message_suffix ? US"null" : string_printing(ob->message_suffix),
1358 ob->maildir_use_size_file ? "yes" : "no");
1360 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1361 ob->use_lockfile ? "lockfile " : "",
1362 ob->use_mbx_lock ? "mbx locking (" : "",
1363 ob->use_fcntl ? "fcntl " : "",
1364 ob->use_flock ? "flock" : "",
1365 ob->use_mbx_lock ? ")" : "");
1368 /* If the -N option is set, can't do any more. */
1373 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1375 addr->transport_return = OK;
1379 /* Handle the case of a file name. If the file name is /dev/null, we can save
1380 ourselves some effort and just give a success return right away. */
1384 BOOL use_lstat = TRUE;
1385 BOOL file_opened = FALSE;
1386 BOOL allow_creation_here = TRUE;
1388 if (Ustrcmp(path, "/dev/null") == 0)
1390 addr->transport_return = OK;
1394 /* Set the name of the file to be opened, and the file to which the data
1395 is written, and find out if we are permitted to create a non-existent file. */
1397 dataname = filename = path;
1398 allow_creation_here = check_creation(filename, ob->create_file);
1400 /* If ob->create_directory is set, attempt to create the directories in
1401 which this mailbox lives, but only if we are permitted to create the file
1402 itself. We know we are dealing with an absolute path, because this was
1405 if (ob->create_directory && allow_creation_here)
1407 uschar *p = Ustrrchr(path, '/');
1409 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1411 addr->basic_errno = errno;
1413 string_sprintf("failed to create directories for %s: %s", path,
1415 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1421 /* If file_format is set we must check that any existing file matches one of
1422 the configured formats by checking the bytes it starts with. A match then
1423 indicates a specific transport - if it is not this one, pass control to it.
1424 Otherwise carry on here. An empty or non-existent file matches the current
1425 transport. We don't need to distinguish between non-existence and other open
1426 failures because if an existing file fails to open here, it will also fail
1427 again later when O_RDWR is used. */
1429 if (ob->file_format)
1431 int cfd = Uopen(path, O_RDONLY, 0);
1434 transport_instance *tt = check_file_format(cfd, tblock, addr);
1437 /* If another transport is indicated, call it and return; if no transport
1438 was found, just return - the error data will have been set up.*/
1444 set_process_info("delivering %s to %s using %s", message_id,
1445 addr->local_part, tt->name);
1446 debug_print_string(tt->debug_string);
1447 addr->transport = tt;
1448 (tt->info->code)(tt, addr);
1455 /* The locking of mailbox files is worse than the naming of cats, which is
1456 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1457 three different names, so several different styles of locking are used.
1459 Research in other programs that lock mailboxes shows that there is no
1460 universally standard method. Having mailboxes NFS-mounted on the system that
1461 is delivering mail is not the best thing, but people do run like this,
1462 and so the code must do its best to cope.
1464 Three different locking mechanisms are supported. The initialization function
1465 checks that at least one is configured.
1469 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1470 will work over NFS. Only after that is done do we actually open the mailbox
1471 and apply locks to it (if configured).
1473 Originally, Exim got the file opened before doing anything about locking.
1474 However, a very occasional problem was observed on Solaris 2 when delivering
1475 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1476 gets remembered at open time. If another process on another host (that's
1477 important) has the file open and locked and writes to it and then releases
1478 the lock while the first process is waiting to get the lock, the first
1479 process may fail to write at the new end point of the file - despite the very
1480 definite statement about O_APPEND in the man page for write(). Experiments
1481 have reproduced this problem, but I do not know any way of forcing a host to
1482 update its attribute cache for an open NFS file. It would be nice if it did
1483 so when a lock was taken out, but this does not seem to happen. Anyway, to
1484 reduce the risk of this problem happening, we now create the lock file
1485 (if configured) *before* opening the mailbox. That will prevent two different
1486 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1487 however, but Pine at least seems to operate in the same way.
1489 Lockfiles should normally be used when NFS is involved, because of the above
1492 The logic for creating the lock file is:
1494 . The name of the lock file is <mailbox-name>.lock
1496 . First, create a "hitching post" name by adding the primary host name,
1497 current time and pid to the lock file name. This should be unique.
1499 . Create the hitching post file using WRONLY + CREAT + EXCL.
1501 . If that fails EACCES, we assume it means that the user is unable to create
1502 files in the mail spool directory. Some installations might operate in this
1503 manner, so there is a configuration option to allow this state not to be an
1504 error - we proceed to lock using fcntl only, after the file is open.
1506 . Otherwise, an error causes a deferment of the address.
1508 . Hard link the hitching post to the lock file name.
1510 . If the link succeeds, we have successfully created the lock file. Simply
1511 close and unlink the hitching post file.
1513 . If the link does not succeed, proceed as follows:
1515 o Fstat the hitching post file, and then close and unlink it.
1517 o Now examine the stat data. If the number of links to the file is exactly
1518 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1519 the return never made it back, so the link() function gave a failure
1522 . This method allows for the lock file to be created by some other process
1523 right up to the moment of the attempt to hard link it, and is also robust
1524 against NFS server crash-reboots, which would probably result in timeouts
1525 in the middle of link().
1527 . System crashes may cause lock files to get left lying around, and some means
1528 of flushing them is required. The approach of writing a pid (used by smail
1529 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1530 timeout, which seems a better approach. Since any program that writes to a
1531 mailbox using a lock file should complete its task very quickly, Pine
1532 removes lock files that are older than 5 minutes. We allow the value to be
1533 configurable on the transport.
1537 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1538 mailbox once it is open. This is done by default with a non-blocking lock.
1539 Failures to lock cause retries after a sleep, but only for a certain number
1540 of tries. A blocking lock is deliberately not used so that we don't hold the
1541 mailbox open. This minimizes the possibility of the NFS problem described
1542 under LOCK FILES above, if for some reason NFS deliveries are happening
1543 without lock files. However, the use of a non-blocking lock and sleep, though
1544 the safest approach, does not give the best performance on very busy systems.
1545 A blocking lock plus timeout does better. Therefore Exim has an option to
1546 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1547 enables the use of blocking fcntl() calls.
1551 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1552 same manner as for fcntl locking above. No-blocking/timeout is also set as
1553 above in lock_flock_timeout. Not all operating systems provide or support
1554 flock(). For those that don't (as determined by the definition of LOCK_SH in
1555 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1556 is implemented (not precisely) on top of fcntl(), which means there's no
1557 point in actually using it.
1561 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1562 then the rules used for locking in c-client are used. Exim takes out a shared
1563 lock on the mailbox file, and an exclusive lock on the file whose name is
1564 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1565 any other MBX client from getting an exclusive lock on it and expunging it.
1566 It also stops any other MBX client from unlinking the /tmp lock when it has
1569 The exclusive lock on the /tmp file prevents any other MBX client from
1570 updating the mailbox in any way. When writing is finished, if an exclusive
1571 lock on the mailbox can be obtained, indicating there are no current sharers,
1572 the /tmp file is unlinked.
1574 MBX locking can use either fcntl() or flock() locking. If neither
1575 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1576 The calls for getting these locks are by default non-blocking, as for non-mbx
1577 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1578 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1579 probably makes sense to set timeouts for any MBX deliveries. */
1582 /* Build a lock file if configured to do so - the existence of a lock
1583 file is subsequently checked by looking for a non-negative value of the
1584 file descriptor hd - even though the file is no longer open. */
1586 if (ob->use_lockfile)
1588 /* cf. exim_lock.c */
1589 lockname = string_sprintf("%s.lock", filename);
1590 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1591 (unsigned int)(time(NULL)), (unsigned int)getpid());
1593 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1596 /* Lock file creation retry loop */
1598 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1602 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1605 addr->basic_errno = errno;
1607 string_sprintf("creating lock file hitching post %s "
1608 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1609 (long int)getegid());
1613 /* Attempt to hitch the hitching post to the lock file. If link()
1614 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1615 file, and get rid of the hitching post. If the number of links was 2,
1616 the link was created, despite the failure of link(). If the hitch was
1617 not successful, try again, having unlinked the lock file if it is too
1620 There's a version of Linux (2.0.27) which doesn't update its local cache
1621 of the inode after link() by default - which many think is a bug - but
1622 if the link succeeds, this code will be OK. It just won't work in the
1623 case when link() fails after having actually created the link. The Linux
1624 NFS person is fixing this; a temporary patch is available if anyone is
1625 sufficiently worried. */
1627 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1630 if (rc != 0 && statbuf.st_nlink != 2)
1632 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1633 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1635 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1638 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1642 DEBUG(D_transport) debug_printf("lock file created\n");
1646 /* Check for too many tries at creating the lock file */
1648 if (i >= ob->lock_retries)
1650 addr->basic_errno = ERRNO_LOCKFAILED;
1651 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1658 /* We now have to get the file open. First, stat() it and act on existence or
1659 non-existence. This is in a loop to handle the case of a file's being created
1660 or deleted as we watch, and also to handle retries when the locking fails.
1661 Rather than holding the file open while waiting for the fcntl() and/or
1662 flock() lock, we close and do the whole thing again. This should be safer,
1663 especially for NFS files, which might get altered from other hosts, making
1664 their cached sizes incorrect.
1666 With the default settings, no symlinks are permitted, but there is an option
1667 to permit symlinks for those sysadmins that know what they are doing.
1668 Shudder. However, insist that the initial symlink is owned by the right user.
1669 Thus lstat() is used initially; if a symlink is discovered, the loop is
1670 repeated such that stat() is used, to look at the end file. */
1672 for (i = 0; i < ob->lock_retries; i++)
1674 int sleep_before_retry = TRUE;
1675 file_opened = FALSE;
1677 if ((use_lstat ? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1679 /* Let's hope that failure to stat (other than non-existence) is a
1682 if (errno != ENOENT)
1684 addr->basic_errno = errno;
1685 addr->message = string_sprintf("attempting to stat mailbox %s",
1690 /* File does not exist. If it is required to pre-exist this state is an
1693 if (ob->file_must_exist)
1695 addr->basic_errno = errno;
1696 addr->message = string_sprintf("mailbox %s does not exist, "
1697 "but file_must_exist is set", filename);
1701 /* If not permitted to create this file because it isn't in or below
1702 the home directory, generate an error. */
1704 if (!allow_creation_here)
1706 addr->basic_errno = ERRNO_BADCREATE;
1707 addr->message = string_sprintf("mailbox %s does not exist, "
1708 "but creation outside the home directory is not permitted",
1713 /* Attempt to create and open the file. If open fails because of
1714 pre-existence, go round the loop again. For any other error, defer the
1715 address, except for an alias or forward generated file name with EPERM,
1716 ENOENT, or EACCES, as those are most likely to be user errors rather
1717 than Exim config errors. When a symbolic link is permitted and points
1718 to a non-existent file, we get here with use_lstat = FALSE. In this case
1719 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1720 consistency and because MBX locking requires it in order to be able to
1721 get a shared lock. */
1723 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1724 (use_lstat ? O_EXCL : 0), mode);
1727 if (errno == EEXIST) continue;
1728 addr->basic_errno = errno;
1729 addr->message = string_sprintf("while creating mailbox %s",
1731 if (testflag(addr, af_file) &&
1732 (errno == EPERM || errno == ENOENT || errno == EACCES))
1733 addr->transport_return = FAIL;
1737 /* We have successfully created and opened the file. Ensure that the group
1738 and the mode are correct. */
1740 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
1742 addr->basic_errno = errno;
1743 addr->message = string_sprintf("while setting perms on mailbox %s",
1745 addr->transport_return = FAIL;
1751 /* The file already exists. Test its type, ownership, and permissions, and
1752 save the inode for checking later. If symlinks are permitted (not the
1753 default or recommended state) it may be a symlink that already exists.
1754 Check its ownership and then look for the file at the end of the link(s).
1755 This at least prevents one user creating a symlink for another user in
1756 a sticky directory. */
1760 int oldmode = (int)statbuf.st_mode;
1761 ino_t inode = statbuf.st_ino;
1762 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1764 isfifo = FALSE; /* In case things are changing */
1766 /* Check owner if required - the default. */
1768 if (ob->check_owner && statbuf.st_uid != uid)
1770 addr->basic_errno = ERRNO_BADUGID;
1771 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1772 "(%ld != %ld)", filename,
1773 islink ? " (symlink)" : "",
1774 (long int)(statbuf.st_uid), (long int)uid);
1778 /* Group is checked only if check_group is set. */
1780 if (ob->check_group && statbuf.st_gid != gid)
1782 addr->basic_errno = ERRNO_BADUGID;
1783 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1784 filename, islink ? " (symlink)" : "", statbuf.st_gid, gid);
1788 /* Just in case this is a sticky-bit mail directory, we don't want
1789 users to be able to create hard links to other users' files. */
1791 if (statbuf.st_nlink != 1)
1793 addr->basic_errno = ERRNO_NOTREGULAR;
1794 addr->message = string_sprintf("mailbox %s%s has too many links (%lu)",
1795 filename, islink ? " (symlink)" : "", (unsigned long)statbuf.st_nlink);
1800 /* If symlinks are permitted (not recommended), the lstat() above will
1801 have found the symlink. Its ownership has just been checked; go round
1802 the loop again, using stat() instead of lstat(). That will never yield a
1805 if (islink && ob->allow_symlink)
1808 i--; /* Don't count this time round */
1812 /* An actual file exists. Check that it is a regular file, or FIFO
1815 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1817 else if ((oldmode & S_IFMT) != S_IFREG)
1819 addr->basic_errno = ERRNO_NOTREGULAR;
1820 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1821 filename, ob->allow_fifo ? " or named pipe" : "");
1825 /* If the mode is not what it would be for a newly created file, change
1826 the permissions if the mode is supplied for the address. Otherwise,
1827 reduce but do not extend the permissions. If the newly created
1828 permissions are greater than the existing permissions, don't change
1829 things when the mode is not from the address. */
1831 if ((oldmode &= 07777) != mode)
1833 int diffs = oldmode ^ mode;
1834 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1836 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1837 if (Uchmod(filename, mode) < 0)
1839 addr->basic_errno = errno;
1840 addr->message = string_sprintf("attempting to chmod mailbox %s",
1847 /* Mode not from address, and newly-created permissions are greater
1848 than existing permissions. Default is to complain, but it can be
1849 configured to go ahead and try to deliver anyway if that's what
1850 the administration wants. */
1852 else if (ob->mode_fail_narrower)
1854 addr->basic_errno = ERRNO_BADMODE;
1855 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1856 "(%o expected)", filename, oldmode, mode);
1861 /* We are happy with the existing file. Open it, and then do further
1862 tests to ensure that it is the same file that we were just looking at.
1863 If the file does not now exist, restart this loop, going back to using
1864 lstat again. For an NFS error, just defer; other opening errors are
1865 more serious. The file is opened RDWR so that its format can be checked,
1866 and also MBX locking requires the use of a shared (read) lock. However,
1867 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1868 reading the pipe. */
1870 fd = Uopen(filename, isfifo ? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1874 if (errno == ENOENT)
1879 addr->basic_errno = errno;
1881 addr->message = string_sprintf("while opening named pipe %s "
1882 "(could mean no process is reading it)", filename);
1883 else if (errno != EWOULDBLOCK)
1884 addr->message = string_sprintf("while opening mailbox %s", filename);
1888 /* This fstat really shouldn't fail, as we have an open file! There's a
1889 dilemma here. We use fstat in order to be sure we are peering at the file
1890 we have got open. However, that won't tell us if the file was reached
1891 via a symbolic link. We checked this above, but there is a race exposure
1892 if the link was created between the previous lstat and the open. However,
1893 it would have to be created with the same inode in order to pass the
1894 check below. If ob->allow_symlink is set, causing the use of stat rather
1895 than lstat above, symbolic links may be there anyway, and the checking is
1898 if (fstat(fd, &statbuf) < 0)
1900 addr->basic_errno = errno;
1901 addr->message = string_sprintf("attempting to stat open mailbox %s",
1906 /* Check the inode; this is isn't a perfect check, but gives some
1909 if (inode != statbuf.st_ino)
1911 addr->basic_errno = ERRNO_INODECHANGED;
1912 addr->message = string_sprintf("opened mailbox %s inode number changed "
1913 "from " INO_T_FMT " to " INO_T_FMT, filename, inode, statbuf.st_ino);
1914 addr->special_action = SPECIAL_FREEZE;
1918 /* Check it's still a regular file or FIFO, and the uid, gid, and
1919 permissions have not changed. */
1921 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1922 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1924 addr->basic_errno = ERRNO_NOTREGULAR;
1926 string_sprintf("opened mailbox %s is no longer a %s", filename,
1927 isfifo ? "named pipe" : "regular file");
1928 addr->special_action = SPECIAL_FREEZE;
1932 if ((ob->check_owner && statbuf.st_uid != uid) ||
1933 (ob->check_group && statbuf.st_gid != gid))
1935 addr->basic_errno = ERRNO_BADUGID;
1937 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1938 addr->special_action = SPECIAL_FREEZE;
1942 if ((statbuf.st_mode & 07777) != oldmode)
1944 addr->basic_errno = ERRNO_BADMODE;
1945 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1946 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1947 addr->special_action = SPECIAL_FREEZE;
1951 /* If file_format is set, check that the format of the file has not
1952 changed. Error data is set by the testing function. */
1954 if (ob->file_format && check_file_format(fd, tblock, addr) != tblock)
1956 addr->message = US"open mailbox has changed format";
1960 /* The file is OK. Carry on to do the locking. */
1963 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1964 locking rules if configured to do so. If a lock file is also required, it
1965 was created above and hd was left >= 0. At least one form of locking is
1966 required by the initialization function. If locking fails here, close the
1967 file and go round the loop all over again, after waiting for a bit, unless
1968 blocking locking was used. */
1971 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1972 sleep_before_retry = FALSE;
1974 /* Simple fcntl() and/or flock() locking */
1976 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
1978 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1979 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
1982 /* MBX locking rules */
1985 else if (ob->use_mbx_lock)
1988 struct stat lstatbuf, statbuf2;
1989 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1990 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
1991 fstat(fd, &statbuf) >= 0)
1993 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
1994 (long)statbuf.st_ino);
1997 * 2010-05-29: SECURITY
1998 * Dan Rosenberg reported the presence of a race-condition in the
1999 * original code here. Beware that many systems still allow symlinks
2000 * to be followed in /tmp so an attacker can create a symlink pointing
2001 * elsewhere between a stat and an open, which we should avoid
2004 * It's unfortunate that we can't just use all the heavily debugged
2005 * locking from above.
2007 * Also: remember to mirror changes into exim_lock.c */
2009 /* first leave the old pre-check in place, it provides better
2010 * diagnostics for common cases */
2011 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2013 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2015 addr->basic_errno = ERRNO_LOCKFAILED;
2016 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2020 if (statbuf.st_nlink > 1)
2022 addr->basic_errno = ERRNO_LOCKFAILED;
2023 addr->message = string_sprintf("hard link to MBX lock file %s",
2029 /* If we could just declare "we must be the ones who create this
2030 * file" then a hitching post in a subdir would work, since a
2031 * subdir directly in /tmp/ which we create wouldn't follow links
2032 * but this isn't our locking logic, so we can't safely change the
2033 * file existence rules. */
2035 /* On systems which support O_NOFOLLOW, it's the easiest and most
2036 * obviously correct security fix */
2037 mbx_tmp_oflags = O_RDWR | O_CREAT;
2039 mbx_tmp_oflags |= O_NOFOLLOW;
2041 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2044 addr->basic_errno = ERRNO_LOCKFAILED;
2045 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2046 mbx_lockname, strerror(errno));
2050 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2052 addr->basic_errno = ERRNO_LOCKFAILED;
2053 addr->message = string_sprintf("attempting to lstat open MBX "
2054 "lock file %s: %s", mbx_lockname, strerror(errno));
2057 if (fstat(mbx_lockfd, &statbuf2) < 0)
2059 addr->basic_errno = ERRNO_LOCKFAILED;
2060 addr->message = string_sprintf("attempting to stat fd of open MBX "
2061 "lock file %s: %s", mbx_lockname, strerror(errno));
2067 * statbuf: if exists, is file which existed prior to opening the
2068 * lockfile, might have been replaced since then
2069 * statbuf2: result of stat'ing the open fd, is what was actually
2071 * lstatbuf: result of lstat'ing the filename immediately after
2072 * the open but there's a race condition again between
2073 * those two steps: before open, symlink to foo, after
2074 * open but before lstat have one of:
2075 * * was no symlink, so is the opened file
2076 * (we created it, no messing possible after that point)
2078 * * symlink elsewhere
2079 * * hardlink elsewhere
2081 * Don't want to compare to device of /tmp because some modern systems
2082 * have regressed to having /tmp be the safe actual filesystem as
2083 * valuable data, so is mostly worthless, unless we assume that *only*
2084 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2085 * for further consideration.
2086 * No point in doing a readlink on the lockfile as that will always be
2087 * at a different point in time from when we open it, so tells us
2088 * nothing; attempts to clean up and delete after ourselves would risk
2089 * deleting a *third* filename.
2091 if ((statbuf2.st_nlink > 1) ||
2092 (lstatbuf.st_nlink > 1) ||
2093 (!S_ISREG(lstatbuf.st_mode)) ||
2094 (lstatbuf.st_dev != statbuf2.st_dev) ||
2095 (lstatbuf.st_ino != statbuf2.st_ino))
2097 addr->basic_errno = ERRNO_LOCKFAILED;
2098 addr->message = string_sprintf("RACE CONDITION detected: "
2099 "mismatch post-initial-checks between \"%s\" and opened "
2100 "fd lead us to abort!", mbx_lockname);
2104 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2106 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2107 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2109 struct stat ostatbuf;
2111 /* This tests for a specific race condition. Ensure that we still
2112 have the same file. */
2114 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2115 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2116 statbuf.st_dev == ostatbuf.st_dev &&
2117 statbuf.st_ino == ostatbuf.st_ino)
2119 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2120 "between creation and locking\n", mbx_lockname);
2123 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2125 (void)close(mbx_lockfd);
2130 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2131 filename, strerror(errno));
2134 #endif /* SUPPORT_MBX */
2136 else break; /* No on-file locking required; break the open/lock loop */
2139 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2143 use_lstat = TRUE; /* Reset to use lstat first */
2146 /* If a blocking call timed out, break the retry loop if the total time
2147 so far is not less than than retries * interval. Use the larger of the
2148 flock() and fcntl() timeouts. */
2151 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2152 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2153 ob->lock_retries * ob->lock_interval)
2154 i = ob->lock_retries;
2156 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2157 flock() that caused the problem. */
2159 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2162 /* Test for exceeding the maximum number of tries. Either the file remains
2163 locked, or, if we haven't got it open, something is terribly wrong... */
2165 if (i >= ob->lock_retries)
2169 addr->basic_errno = ERRNO_EXISTRACE;
2170 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2171 addr->special_action = SPECIAL_FREEZE;
2175 addr->basic_errno = ERRNO_LOCKFAILED;
2176 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2182 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2184 /* Save access time (for subsequent restoration), modification time (for
2185 restoration if updating fails), size of file (for comsat and for re-setting if
2186 delivery fails in the middle - e.g. for quota exceeded). */
2188 if (fstat(fd, &statbuf) < 0)
2190 addr->basic_errno = errno;
2191 addr->message = string_sprintf("while fstatting opened mailbox %s",
2196 times.actime = statbuf.st_atime;
2197 times.modtime = statbuf.st_mtime;
2198 saved_size = statbuf.st_size;
2199 if (mailbox_size < 0) mailbox_size = saved_size;
2200 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2203 /* Prepare for writing to a new file (as opposed to appending to an old one).
2204 There are several different formats, but there is preliminary stuff concerned
2205 with quotas that applies to all of them. Finding the current size by directory
2206 scanning is expensive; for maildirs some fudges have been invented:
2208 (1) A regex can be used to extract a file size from its name;
2209 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2215 uschar *check_path = path; /* Default quota check path */
2216 const pcre *regex = NULL; /* Regex for file size from file name */
2218 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2220 addr->basic_errno = ERRNO_BADCREATE;
2221 addr->message = string_sprintf("tried to create file in %s, but "
2222 "file creation outside the home directory is not permitted", path);
2226 #ifdef SUPPORT_MAILDIR
2227 /* For a maildir delivery, ensure that all the relevant directories exist,
2228 and a maildirfolder file if necessary. */
2230 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2231 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2233 #endif /* SUPPORT_MAILDIR */
2235 /* If we are going to do a quota check, of if maildir_use_size_file is set
2236 for a maildir delivery, compile the regular expression if there is one. We
2237 may also need to adjust the path that is used. We need to do this for
2238 maildir_use_size_file even if the quota is unset, because we still want to
2239 create the file. When maildir support is not compiled,
2240 ob->maildir_use_size_file is always FALSE. */
2242 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2244 const uschar *error;
2247 /* Compile the regex if there is one. */
2249 if (ob->quota_size_regex)
2251 if (!(regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2252 CCSS &error, &offset, NULL)))
2254 addr->message = string_sprintf("appendfile: regular expression "
2255 "error: %s at offset %d while compiling %s", error, offset,
2256 ob->quota_size_regex);
2259 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2260 ob->quota_size_regex);
2263 /* Use an explicitly configured directory if set */
2265 if (ob->quota_directory)
2267 if (!(check_path = expand_string(ob->quota_directory)))
2269 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2270 "name for %s transport) failed: %s", ob->quota_directory,
2271 tblock->name, expand_string_message);
2275 if (check_path[0] != '/')
2277 addr->message = string_sprintf("appendfile: quota_directory name "
2278 "\"%s\" is not absolute", check_path);
2279 addr->basic_errno = ERRNO_NOTABSOLUTE;
2284 #ifdef SUPPORT_MAILDIR
2285 /* Otherwise, if we are handling a maildir delivery, and the directory
2286 contains a file called maildirfolder, this is a maildir++ feature telling
2287 us that this is a sub-directory of the real inbox. We should therefore do
2288 the quota check on the parent directory. Beware of the special case when
2289 the directory name itself ends in a slash. */
2291 else if (mbformat == mbf_maildir)
2293 struct stat statbuf;
2294 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2296 uschar *new_check_path = string_copy(check_path);
2297 uschar *slash = Ustrrchr(new_check_path, '/');
2303 slash = Ustrrchr(new_check_path, '/');
2308 check_path = new_check_path;
2309 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2310 "quota check directory changed to %s\n", check_path);
2315 #endif /* SUPPORT_MAILDIR */
2318 /* If we are using maildirsize files, we need to ensure that such a file
2319 exists and, if necessary, recalculate its contents. As a byproduct of this,
2320 we obtain the current size of the maildir. If no quota is to be enforced
2321 (ob->quota_value == 0), we still need the size if a threshold check will
2324 Another regular expression is used to determine which directories inside the
2325 maildir are going to be counted. */
2327 #ifdef SUPPORT_MAILDIR
2328 if (ob->maildir_use_size_file)
2330 const pcre *dir_regex = NULL;
2331 const uschar *error;
2334 if (ob->maildir_dir_regex)
2336 int check_path_len = Ustrlen(check_path);
2338 if (!(dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2339 CCSS &error, &offset, NULL)))
2341 addr->message = string_sprintf("appendfile: regular expression "
2342 "error: %s at offset %d while compiling %s", error, offset,
2343 ob->maildir_dir_regex);
2348 debug_printf("using regex for maildir directory selection: %s\n",
2349 ob->maildir_dir_regex);
2351 /* Check to see if we are delivering into an ignored directory, that is,
2352 if the delivery path starts with the quota check path, and the rest
2353 of the deliver path matches the regex; if so, set a flag to disable quota
2354 checking and maildirsize updating. */
2356 if (Ustrncmp(path, check_path, check_path_len) == 0)
2358 uschar *s = path + check_path_len;
2359 while (*s == '/') s++;
2360 s = (*s == 0) ? US "new" : string_sprintf("%s/new", s);
2361 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2363 disable_quota = TRUE;
2364 DEBUG(D_transport) debug_printf("delivery directory does not match "
2365 "maildir_quota_directory_regex: disabling quota\n");
2370 /* Quota enforcement; create and check the file. There is some discussion
2371 about whether this should happen if the quota is unset. At present, Exim
2372 always creates the file. If we ever want to change this, uncomment
2373 appropriate lines below, possibly doing a check on some option. */
2375 /* if (???? || ob->quota_value > 0) */
2382 if ((maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2383 &size, &filecount)) == -1)
2385 addr->basic_errno = errno;
2386 addr->message = string_sprintf("while opening or reading "
2387 "%s/maildirsize", check_path);
2390 /* can also return -2, which means that the file was removed because of
2391 raciness; but in this case, the size & filecount will still have been
2394 if (mailbox_size < 0) mailbox_size = size;
2395 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2398 /* No quota enforcement; ensure file does *not* exist; calculate size if
2403 * time_t old_latest;
2404 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2405 * if (THRESHOLD_CHECK)
2406 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2407 * regex, dir_regex, FALSE);
2412 #endif /* SUPPORT_MAILDIR */
2414 /* Otherwise if we are going to do a quota check later on, and the mailbox
2415 size is not set, find the current size of the mailbox. Ditto for the file
2416 count. Note that ob->quota_filecount_value cannot be set without
2417 ob->quota_value being set. */
2419 if (!disable_quota &&
2420 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2421 (mailbox_size < 0 ||
2422 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2427 debug_printf("quota checks on directory %s\n", check_path);
2428 size = check_dir_size(check_path, &filecount, regex);
2429 if (mailbox_size < 0) mailbox_size = size;
2430 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2433 /* Handle the case of creating a unique file in a given directory (not in
2434 maildir or mailstore format - this is how smail did it). A temporary name is
2435 used to create the file. Later, when it is written, the name is changed to a
2436 unique one. There is no need to lock the file. An attempt is made to create
2437 the directory if it does not exist. */
2439 if (mbformat == mbf_smail)
2442 debug_printf("delivering to new file in %s\n", path);
2443 filename = dataname =
2444 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2445 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2446 if (fd < 0 && /* failed to open, and */
2447 (errno != ENOENT || /* either not non-exist */
2448 !ob->create_directory || /* or not allowed to make */
2449 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2450 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2452 addr->basic_errno = errno;
2453 addr->message = string_sprintf("while creating file %s", filename);
2458 #ifdef SUPPORT_MAILDIR
2460 /* Handle the case of a unique file in maildir format. The file is written to
2461 the tmp subdirectory, with a prescribed form of name. */
2463 else if (mbformat == mbf_maildir)
2466 debug_printf("delivering in maildir format in %s\n", path);
2468 nametag = ob->maildir_tag;
2470 /* Check that nametag expands successfully; a hard failure causes a panic
2471 return. The actual expansion for use happens again later, when
2472 $message_size is accurately known. */
2474 if (nametag && !expand_string(nametag) && !f.expand_string_forcedfail)
2476 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2477 "for %s transport) failed: %s", nametag, tblock->name,
2478 expand_string_message);
2482 /* We ensured the existence of all the relevant directories above. Attempt
2483 to open the temporary file a limited number of times. I think this rather
2484 scary-looking for statement is actually OK. If open succeeds, the loop is
2485 broken; if not, there is a test on the value of i. Get the time again
2486 afresh each time round the loop. Its value goes into a variable that is
2487 checked at the end, to make sure we don't release this process until the
2488 clock has ticked. */
2490 for (int i = 1;; i++)
2494 (void)gettimeofday(&msg_tv, NULL);
2495 basename = string_sprintf(TIME_T_FMT ".H%luP" PID_T_FMT ".%s",
2496 msg_tv.tv_sec, msg_tv.tv_usec, getpid(), primary_hostname);
2498 filename = dataname = string_sprintf("tmp/%s", basename);
2499 newname = string_sprintf("new/%s", basename);
2501 if (Ustat(filename, &statbuf) == 0)
2503 else if (errno == ENOENT)
2505 if ((fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode)) >= 0)
2507 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2508 filename, strerror(errno));
2511 /* Too many retries - give up */
2513 if (i >= ob->maildir_retries)
2515 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2516 filename, i, (i == 1) ? "y" : "ies");
2517 addr->basic_errno = errno;
2518 if (errno == errno_quota || errno == ENOSPC)
2519 addr->user_message = US"mailbox is full";
2523 /* Open or stat failed but we haven't tried too many times yet. */
2528 /* Note that we have to ensure the clock has ticked before leaving */
2530 wait_for_tick = TRUE;
2532 /* Why are these here? Put in because they are present in the non-maildir
2533 directory case above. */
2535 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2537 addr->basic_errno = errno;
2538 addr->message = string_sprintf("while setting perms on maildir %s",
2544 #endif /* SUPPORT_MAILDIR */
2546 #ifdef SUPPORT_MAILSTORE
2548 /* Handle the case of a unique file in mailstore format. First write the
2549 envelope to a temporary file, then open the main file. The unique base name
2550 for the files consists of the message id plus the pid of this delivery
2556 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2557 string_base62((long int)getpid()));
2560 debug_printf("delivering in mailstore format in %s\n", path);
2562 filename = string_sprintf("%s.tmp", mailstore_basename);
2563 newname = string_sprintf("%s.env", mailstore_basename);
2564 dataname = string_sprintf("%s.msg", mailstore_basename);
2566 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2567 if (fd < 0 && /* failed to open, and */
2568 (errno != ENOENT || /* either not non-exist */
2569 !ob->create_directory || /* or not allowed to make */
2570 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2571 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2573 addr->basic_errno = errno;
2574 addr->message = string_sprintf("while creating file %s", filename);
2578 /* Why are these here? Put in because they are present in the non-maildir
2579 directory case above. */
2581 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2583 addr->basic_errno = errno;
2584 addr->message = string_sprintf("while setting perms on file %s",
2589 /* Built a C stream from the open file descriptor. */
2591 if (!(env_file = fdopen(fd, "wb")))
2593 addr->basic_errno = errno;
2594 addr->message = string_sprintf("fdopen of %s ("
2595 "for %s transport) failed", filename, tblock->name);
2601 /* Write the envelope file, then close it. */
2603 if (ob->mailstore_prefix)
2605 uschar *s = expand_string(ob->mailstore_prefix);
2608 if (!f.expand_string_forcedfail)
2610 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2611 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2612 tblock->name, expand_string_message);
2613 (void)fclose(env_file);
2621 fprintf(env_file, "%s", CS s);
2622 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2626 fprintf(env_file, "%s\n", sender_address);
2628 for (address_item * taddr = addr; taddr; taddr = taddr->next)
2629 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2631 if (ob->mailstore_suffix)
2633 uschar *s = expand_string(ob->mailstore_suffix);
2636 if (!f.expand_string_forcedfail)
2638 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2639 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2640 tblock->name, expand_string_message);
2641 (void)fclose(env_file);
2649 fprintf(env_file, "%s", CS s);
2650 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2654 if (fclose(env_file) != 0)
2656 addr->basic_errno = errno;
2657 addr->message = string_sprintf("while closing %s", filename);
2662 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2664 /* Now open the data file, and ensure that it has the correct ownership and
2667 if ((fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)
2669 addr->basic_errno = errno;
2670 addr->message = string_sprintf("while creating file %s", dataname);
2674 if (exim_chown(dataname, uid, gid) || Uchmod(dataname, mode))
2676 addr->basic_errno = errno;
2677 addr->message = string_sprintf("while setting perms on file %s",
2683 #endif /* SUPPORT_MAILSTORE */
2686 /* In all cases of writing to a new file, ensure that the file which is
2687 going to be renamed has the correct ownership and mode. */
2689 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2691 addr->basic_errno = errno;
2692 addr->message = string_sprintf("while setting perms on file %s",
2699 /* At last we can write the message to the file, preceded by any configured
2700 prefix line, and followed by any configured suffix line. If there are any
2701 writing errors, we must defer. */
2703 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2708 /* If there is a local quota setting, check that we are not going to exceed it
2709 with this message if quota_is_inclusive is set; if it is not set, the check
2710 is for the mailbox already being over quota (i.e. the current message is not
2711 included in the check). */
2713 if (!disable_quota && ob->quota_value > 0)
2717 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2718 " this message = %d (%sincluded)\n",
2719 ob->quota_value, mailbox_size, message_size,
2720 ob->quota_is_inclusive ? "" : "not ");
2721 debug_printf(" file count quota = %d count = %d\n",
2722 ob->quota_filecount_value, mailbox_filecount);
2725 if (mailbox_size + (ob->quota_is_inclusive ? message_size:0) > ob->quota_value)
2726 if (!ob->quota_no_check)
2728 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2730 errno = ERRNO_EXIMQUOTA;
2733 DEBUG(D_transport) debug_printf("mailbox quota exceeded but ignored\n");
2735 if (ob->quota_filecount_value > 0
2736 && mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2737 ob->quota_filecount_value)
2738 if (!ob->quota_filecount_no_check)
2740 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2742 errno = ERRNO_EXIMQUOTA;
2743 filecount_msg = US" filecount";
2745 else DEBUG(D_transport) if (ob->quota_filecount_no_check)
2746 debug_printf("mailbox file count quota exceeded but ignored\n");
2750 /* If we are writing in MBX format, what we actually do is to write the message
2751 to a temporary file, and then copy it to the real file once we know its size.
2752 This is the most straightforward way of getting the correct length in the
2753 separator line. So, what we do here is to save the real file descriptor, and
2754 replace it with one for a temporary file. The temporary file gets unlinked once
2755 opened, so that it goes away on closure. */
2758 if (yield == OK && ob->mbx_format)
2760 if (!(temp_file = tmpfile()))
2762 addr->basic_errno = errno;
2763 addr->message = US"while setting up temporary file";
2768 fd = fileno(temp_file);
2769 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2771 #endif /* SUPPORT_MBX */
2773 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2776 transport_count = 0;
2777 transport_newlines = 0;
2779 /* Write any configured prefix text first */
2781 if (yield == OK && ob->message_prefix && *ob->message_prefix)
2783 uschar *prefix = expand_string(ob->message_prefix);
2786 errno = ERRNO_EXPANDFAIL;
2787 addr->transport_return = PANIC;
2788 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2789 "transport) failed", ob->message_prefix, tblock->name);
2792 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2795 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2796 various different values for batching are handled outside; if there is more
2797 than one address available here, all must be included. If any address is a
2798 file, use its parent in the RCPT TO. */
2800 if (yield == OK && ob->use_bsmtp)
2802 transport_count = 0;
2803 transport_newlines = 0;
2804 if (ob->use_crlf) cr = US"\r";
2805 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2809 transport_newlines++;
2810 for (address_item * a = addr; a; a = a->next)
2812 address_item * b = testflag(a, af_pfr) ? a->parent : a;
2813 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2814 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2815 { yield = DEFER; break; }
2816 transport_newlines++;
2818 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2821 transport_newlines++;
2825 /* Now the message itself. The options for transport_write_message were set up
2826 at initialization time. */
2830 transport_ctx tctx = {
2834 .check_string = ob->check_string,
2835 .escape_string = ob->escape_string,
2836 .options = ob->options | topt_not_socket
2838 if (!transport_write_message(&tctx, 0))
2842 /* Now a configured suffix. */
2844 if (yield == OK && ob->message_suffix && *ob->message_suffix)
2846 uschar *suffix = expand_string(ob->message_suffix);
2849 errno = ERRNO_EXPANDFAIL;
2850 addr->transport_return = PANIC;
2851 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2852 "transport) failed", ob->message_suffix, tblock->name);
2855 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2858 /* If batch smtp, write the terminating dot. */
2860 if (yield == OK && ob->use_bsmtp)
2861 if (!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2862 else transport_newlines++;
2864 /* If MBX format is being used, all that writing was to the temporary file.
2865 However, if there was an earlier failure (Exim quota exceeded, for example),
2866 the temporary file won't have got opened - and no writing will have been done.
2867 If writing was OK, we restore the fd, and call a function that copies the
2868 message in MBX format into the real file. Otherwise use the temporary name in
2872 if (temp_file && ob->mbx_format)
2879 transport_count = 0; /* Reset transport count for actual write */
2880 /* No need to reset transport_newlines as we're just using a block copy
2881 * routine so the number won't be affected */
2882 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2884 else if (errno >= 0) dataname = US"temporary file";
2886 /* Preserve errno while closing the temporary file. */
2888 mbx_save_errno = errno;
2889 (void)fclose(temp_file);
2890 errno = mbx_save_errno;
2892 #endif /* SUPPORT_MBX */
2894 /* Force out the remaining data to check for any errors; some OS don't allow
2895 fsync() to be called for a FIFO. */
2897 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2899 /* Update message_size and message_linecount to the accurate count of bytes
2900 written, including added headers. Note; we subtract 1 from message_linecount as
2901 this variable doesn't count the new line between the header and the body of the
2904 message_size = transport_count;
2905 message_linecount = transport_newlines - 1;
2907 /* If using a maildir++ quota file, add this message's size to it, and
2908 close the file descriptor, except when the quota has been disabled because we
2909 are delivering into an uncounted folder. */
2911 #ifdef SUPPORT_MAILDIR
2914 if (yield == OK && maildirsize_fd >= 0)
2915 maildir_record_length(maildirsize_fd, message_size);
2916 maildir_save_errno = errno; /* Preserve errno while closing the file */
2917 if (maildirsize_fd >= 0)
2918 (void)close(maildirsize_fd);
2919 errno = maildir_save_errno;
2921 #endif /* SUPPORT_MAILDIR */
2923 /* If there is a quota warning threshold and we are have crossed it with this
2924 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2927 if (!disable_quota && THRESHOLD_CHECK)
2929 off_t threshold = ob->quota_warn_threshold_value;
2930 if (ob->quota_warn_threshold_is_percent)
2931 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
2933 debug_printf("quota = " OFF_T_FMT
2934 " threshold = " OFF_T_FMT
2935 " old size = " OFF_T_FMT
2936 " message size = %d\n",
2937 ob->quota_value, threshold, mailbox_size,
2939 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2940 addr->special_action = SPECIAL_WARN;
2942 /******* You might think that the test ought to be this:
2944 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2945 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2947 * (indeed, I was sent a patch with that in). However, it is possible to
2948 * have a warning threshold without actually imposing a quota, and I have
2949 * therefore kept Exim backwards compatible.
2954 /* Handle error while writing the file. Control should come here directly after
2955 the error, with the reason in errno. In the case of expansion failure in prefix
2956 or suffix, it will be ERRNO_EXPANDFAIL. */
2960 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2962 /* Save the error number. If positive, it will ultimately cause a strerror()
2963 call to generate some text. */
2965 addr->basic_errno = errno;
2967 /* For system or Exim quota excession, or disk full, set more_errno to the
2968 time since the file was last read. If delivery was into a directory, the
2969 time since last read logic is not relevant, in general. However, for maildir
2970 deliveries we can approximate it by looking at the last modified time of the
2971 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2972 "new" subdirectory implies that an MUA has moved a message from there to the
2975 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2977 addr->more_errno = 0;
2978 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2980 #ifdef SUPPORT_MAILDIR
2981 else if (mbformat == mbf_maildir)
2983 struct stat statbuf;
2984 if (Ustat("new", &statbuf) < 0)
2986 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2987 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2989 else /* Want a repeatable time when in test harness */
2990 addr->more_errno = f.running_in_test_harness ? 10 :
2991 (int)time(NULL) - statbuf.st_mtime;
2994 debug_printf("maildir: time since \"new\" directory modified = %s\n",
2995 readconf_printtime(addr->more_errno));
2997 #endif /* SUPPORT_MAILDIR */
3000 /* Handle system quota excession. Add an explanatory phrase for the error
3001 message, since some systems don't have special quota-excession errors,
3002 and on those that do, "quota" doesn't always mean anything to the user. */
3004 if (errno == errno_quota)
3007 addr->message = string_sprintf("mailbox is full "
3008 "(quota exceeded while writing to file %s)", filename);
3010 addr->message = US"mailbox is full";
3012 addr->user_message = US"mailbox is full";
3013 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3015 isdirectory ? US"" : US": time since file read = ",
3016 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3019 /* Handle Exim's own quota-imposition */
3021 else if (errno == ERRNO_EXIMQUOTA)
3023 addr->message = string_sprintf("mailbox is full "
3024 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3026 addr->user_message = US"mailbox is full";
3027 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3028 filecount_msg, dataname,
3029 isdirectory ? US"" : US": time since file read = ",
3030 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3033 /* Handle a process failure while writing via a filter; the return
3034 from child_close() is in more_errno. */
3036 else if (errno == ERRNO_FILTER_FAIL)
3039 addr->message = string_sprintf("transport filter process failed (%d) "
3040 "while writing to %s%s", addr->more_errno, dataname,
3041 (addr->more_errno == EX_EXECFAILED) ? ": unable to execute command" : "");
3044 /* Handle failure to expand header changes */
3046 else if (errno == ERRNO_CHHEADER_FAIL)
3050 string_sprintf("failed to expand headers_add or headers_remove while "
3051 "writing to %s: %s", dataname, expand_string_message);
3054 /* Handle failure to complete writing of a data block */
3056 else if (errno == ERRNO_WRITEINCOMPLETE)
3057 addr->message = string_sprintf("failed to write data block while "
3058 "writing to %s", dataname);
3060 /* Handle length mismatch on MBX copying */
3063 else if (errno == ERRNO_MBXLENGTH)
3064 addr->message = string_sprintf("length mismatch while copying MBX "
3065 "temporary file to %s", dataname);
3066 #endif /* SUPPORT_MBX */
3068 /* For other errors, a general-purpose explanation, if the message is
3071 else if (addr->message == NULL)
3072 addr->message = string_sprintf("error while writing to %s", dataname);
3074 /* For a file, reset the file size to what it was before we started, leaving
3075 the last modification time unchanged, so it will get reset also. All systems
3076 investigated so far have ftruncate(), whereas not all have the F_FREESP
3077 fcntl() call (BSDI & FreeBSD do not). */
3079 if (!isdirectory && ftruncate(fd, saved_size))
3080 DEBUG(D_transport) debug_printf("Error resetting file size\n");
3083 /* Handle successful writing - we want the modification time to be now for
3084 appended files. Remove the default backstop error number. For a directory, now
3085 is the time to rename the file with a unique name. As soon as such a name
3086 appears it may get used by another process, so we close the file first and
3087 check that all is well. */
3091 times.modtime = time(NULL);
3092 addr->basic_errno = 0;
3094 /* Handle the case of writing to a new file in a directory. This applies
3095 to all single-file formats - maildir, mailstore, and "smail format". */
3099 if (fstat(fd, &statbuf) < 0)
3101 addr->basic_errno = errno;
3102 addr->message = string_sprintf("while fstatting opened message file %s",
3107 else if (close(fd) < 0)
3109 addr->basic_errno = errno;
3110 addr->message = string_sprintf("close() error for %s",
3111 (ob->mailstore_format) ? dataname : filename);
3115 /* File is successfully written and closed. Arrange to rename it. For the
3116 different kinds of single-file delivery, some games can be played with the
3117 name. The message size is by this time set to the accurate value so that
3118 its value can be used in expansions. */
3122 uschar *renamename = newname;
3125 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3127 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3128 situation. The name is built by expanding the directory_file option, and
3129 we make the inode number available for use in this. The expansion was
3130 checked for syntactic validity above, before we wrote the file.
3132 We have to be careful here, in case the file name exists. (In the other
3133 cases, the names used are constructed to be unique.) The rename()
3134 function just replaces an existing file - we don't want that! So instead
3135 of calling rename(), we must use link() and unlink().
3137 In this case, if the link fails because of an existing file, we wait
3138 for one second and try the expansion again, to see if it produces a
3139 different value. Do this up to 5 times unless the name stops changing.
3140 This makes it possible to build values that are based on the time, and
3141 still cope with races from multiple simultaneous deliveries. */
3146 uschar *old_renameleaf = US"";
3148 for (int i = 0; ; sleep(1), i++)
3150 deliver_inode = statbuf.st_ino;
3151 renameleaf = expand_string(ob->dirfilename);
3156 addr->transport_return = PANIC;
3157 addr->message = string_sprintf("Expansion of \"%s\" "
3158 "(directory_file for %s transport) failed: %s",
3159 ob->dirfilename, tblock->name, expand_string_message);
3163 renamename = string_sprintf("%s/%s", path, renameleaf);
3164 if (Ulink(filename, renamename) < 0)
3166 DEBUG(D_transport) debug_printf("link failed: %s\n",
3168 if (errno != EEXIST || i >= 4 ||
3169 Ustrcmp(renameleaf, old_renameleaf) == 0)
3171 addr->basic_errno = errno;
3172 addr->message = string_sprintf("while renaming %s as %s",
3173 filename, renamename);
3177 old_renameleaf = renameleaf;
3178 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3187 } /* re-expand loop */
3188 } /* not mailstore or maildir */
3190 /* For maildir and mailstore formats, the new name was created earlier,
3191 except that for maildir, there is the possibility of adding a "tag" on
3192 the end of the name by expanding the value of nametag. This usually
3193 includes a reference to the message size. The expansion of nametag was
3194 checked above, before the file was opened. It either succeeded, or
3195 provoked a soft failure. So any failure here can be treated as soft.
3196 Ignore non-printing characters and / and put a colon at the start if the
3197 first character is alphanumeric. */
3203 uschar *iptr = expand_string(nametag);
3206 uschar *etag = store_get(Ustrlen(iptr) + 2, is_tainted(iptr));
3207 uschar *optr = etag;
3208 for ( ; *iptr; iptr++)
3209 if (mac_isgraph(*iptr) && *iptr != '/')
3211 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3215 renamename = string_sprintf("%s%s", newname, etag);
3219 /* Do the rename. If the name is too long and a tag exists, try again
3222 if (Urename(filename, renamename) < 0 &&
3223 (nametag == NULL || errno != ENAMETOOLONG ||
3224 (renamename = newname, Urename(filename, renamename) < 0)))
3226 addr->basic_errno = errno;
3227 addr->message = string_sprintf("while renaming %s as %s",
3228 filename, renamename);
3232 /* Rename succeeded */
3236 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3238 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3240 } /* maildir or mailstore */
3241 } /* successful write + close */
3243 } /* write success */
3246 /* For a file, restore the last access time (atime), and set the modification
3247 time as required - changed if write succeeded, unchanged if not. */
3249 if (!isdirectory) utime(CS filename, ×);
3251 /* Notify comsat if configured to do so. It only makes sense if the configured
3252 file is the one that the comsat daemon knows about. */
3254 if (ob->notify_comsat && yield == OK && deliver_localpart)
3255 notify_comsat(deliver_localpart, saved_size);
3257 /* Pass back the final return code in the address structure */
3260 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3261 yield, addr->basic_errno, addr->more_errno);
3263 addr->transport_return = yield;
3265 /* Close the file, which will release the fcntl lock. For a directory write it
3266 is closed above, except in cases of error which goto RETURN, when we also need
3267 to remove the original file(s). For MBX locking, if all has gone well, before
3268 closing the file, see if we can get an exclusive lock on it, in which case we
3269 can unlink the /tmp lock file before closing it. This is always a non-blocking
3270 lock; there's no need to wait if we can't get it. If everything has gone right
3271 but close fails, defer the message. Then unlink the lock file, if present. This
3272 point in the code is jumped to from a number of places when errors are
3273 detected, in order to get the file closed and the lock file tidied away. */
3278 if (mbx_lockfd >= 0)
3280 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3281 ob->use_flock, 0) >= 0)
3284 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3285 Uunlink(mbx_lockname);
3287 (void)close(mbx_lockfd);
3289 #endif /* SUPPORT_MBX */
3291 if (fd >= 0 && close(fd) < 0 && yield == OK)
3293 addr->basic_errno = errno;
3294 addr->message = string_sprintf("while closing %s", filename);
3295 addr->transport_return = DEFER;
3298 if (hd >= 0) Uunlink(lockname);
3300 /* We get here with isdirectory and filename set only in error situations. */
3302 if (isdirectory && filename)
3305 if (dataname != filename) Uunlink(dataname);
3308 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3309 file name relies on time + pid. We must not allow the process to finish until
3310 the clock has move on by at least one microsecond. Usually we expect this
3311 already to be the case, but machines keep getting faster... */
3313 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3315 /* A return of FALSE means that if there was an error, a common error was
3316 put in the first address of a batch. */
3321 addr->transport_return = PANIC;
3325 #endif /*!MACRO_PREDEF*/
3326 /* End of transport/appendfile.c */