1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
11 #include "appendfile.h"
13 #ifdef SUPPORT_MAILDIR
14 #include "tf_maildir.h"
18 /* Options specific to the appendfile transport. They must be in alphabetic
19 order (note that "_" comes before the lower case letters). Some of them are
20 stored in the publicly visible instance block - these are flagged with the
22 #define LOFF(field) OPT_OFF(appendfile_transport_options_block, field)
24 optionlist appendfile_transport_options[] = {
25 #ifdef SUPPORT_MAILDIR
26 { "*expand_maildir_use_size_file", opt_stringptr, LOFF(expand_maildir_use_size_file) },
28 { "*set_use_fcntl_lock",opt_bool | opt_hidden, LOFF(set_use_fcntl) },
29 { "*set_use_flock_lock",opt_bool | opt_hidden, LOFF(set_use_flock) },
30 { "*set_use_lockfile", opt_bool | opt_hidden, LOFF(set_use_lockfile) },
32 { "*set_use_mbx_lock", opt_bool | opt_hidden, LOFF(set_use_mbx_lock) },
34 { "allow_fifo", opt_bool, LOFF(allow_fifo) },
35 { "allow_symlink", opt_bool, LOFF(allow_symlink) },
36 { "batch_id", opt_stringptr | opt_public, OPT_OFF(transport_instance, batch_id) },
37 { "batch_max", opt_int | opt_public, OPT_OFF(transport_instance, batch_max) },
38 { "check_group", opt_bool, LOFF(check_group) },
39 { "check_owner", opt_bool, LOFF(check_owner) },
40 { "check_string", opt_stringptr, LOFF(check_string) },
41 { "create_directory", opt_bool, LOFF(create_directory) },
42 { "create_file", opt_stringptr, LOFF(create_file_string) },
43 { "directory", opt_stringptr, LOFF(dirname) },
44 { "directory_file", opt_stringptr, LOFF(dirfilename) },
45 { "directory_mode", opt_octint, LOFF(dirmode) },
46 { "escape_string", opt_stringptr, LOFF(escape_string) },
47 { "file", opt_stringptr, LOFF(filename) },
48 { "file_format", opt_stringptr, LOFF(file_format) },
49 { "file_must_exist", opt_bool, LOFF(file_must_exist) },
50 { "lock_fcntl_timeout", opt_time, LOFF(lock_fcntl_timeout) },
51 { "lock_flock_timeout", opt_time, LOFF(lock_flock_timeout) },
52 { "lock_interval", opt_time, LOFF(lock_interval) },
53 { "lock_retries", opt_int, LOFF(lock_retries) },
54 { "lockfile_mode", opt_octint, LOFF(lockfile_mode) },
55 { "lockfile_timeout", opt_time, LOFF(lockfile_timeout) },
56 { "mailbox_filecount", opt_stringptr, LOFF(mailbox_filecount_string) },
57 { "mailbox_size", opt_stringptr, LOFF(mailbox_size_string) },
58 #ifdef SUPPORT_MAILDIR
59 { "maildir_format", opt_bool, LOFF(maildir_format ) } ,
60 { "maildir_quota_directory_regex", opt_stringptr, LOFF(maildir_dir_regex) },
61 { "maildir_retries", opt_int, LOFF(maildir_retries) },
62 { "maildir_tag", opt_stringptr, LOFF(maildir_tag) },
63 { "maildir_use_size_file", opt_expand_bool, LOFF(maildir_use_size_file ) } ,
64 { "maildirfolder_create_regex", opt_stringptr, LOFF(maildirfolder_create_regex ) },
65 #endif /* SUPPORT_MAILDIR */
66 #ifdef SUPPORT_MAILSTORE
67 { "mailstore_format", opt_bool, LOFF(mailstore_format ) },
68 { "mailstore_prefix", opt_stringptr, LOFF(mailstore_prefix ) },
69 { "mailstore_suffix", opt_stringptr, LOFF(mailstore_suffix ) },
70 #endif /* SUPPORT_MAILSTORE */
72 { "mbx_format", opt_bool, LOFF(mbx_format ) } ,
73 #endif /* SUPPORT_MBX */
74 { "message_prefix", opt_stringptr, LOFF(message_prefix) },
75 { "message_suffix", opt_stringptr, LOFF(message_suffix) },
76 { "mode", opt_octint, LOFF(mode) },
77 { "mode_fail_narrower",opt_bool, LOFF(mode_fail_narrower) },
78 { "notify_comsat", opt_bool, LOFF(notify_comsat) },
79 { "quota", opt_stringptr, LOFF(quota) },
80 { "quota_directory", opt_stringptr, LOFF(quota_directory) },
81 { "quota_filecount", opt_stringptr, LOFF(quota_filecount) },
82 { "quota_is_inclusive", opt_bool, LOFF(quota_is_inclusive) },
83 { "quota_size_regex", opt_stringptr, LOFF(quota_size_regex) },
84 { "quota_warn_message", opt_stringptr | opt_public, OPT_OFF(transport_instance, warn_message) },
85 { "quota_warn_threshold", opt_stringptr, LOFF(quota_warn_threshold) },
86 { "use_bsmtp", opt_bool, LOFF(use_bsmtp) },
87 { "use_crlf", opt_bool, LOFF(use_crlf) },
88 { "use_fcntl_lock", opt_bool_set, LOFF(use_fcntl) },
89 { "use_flock_lock", opt_bool_set, LOFF(use_flock) },
90 { "use_lockfile", opt_bool_set, LOFF(use_lockfile) },
92 { "use_mbx_lock", opt_bool_set, LOFF(use_mbx_lock) },
93 #endif /* SUPPORT_MBX */
96 /* Size of the options list. An extern variable has to be used so that its
97 address can appear in the tables drtables.c. */
99 int appendfile_transport_options_count =
100 sizeof(appendfile_transport_options)/sizeof(optionlist);
106 appendfile_transport_options_block appendfile_transport_option_defaults = {0};
107 void appendfile_transport_init(transport_instance *tblock) {}
108 BOOL appendfile_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
110 #else /*!MACRO_PREDEF*/
112 /* Default private options block for the appendfile transport. */
114 appendfile_transport_options_block appendfile_transport_option_defaults = {
115 /* all non-mentioned members zero/null/false */
116 .dirfilename = US"q${base62:$tod_epoch}-$inode",
117 .create_file_string = US"anywhere",
118 .maildir_dir_regex = US"^(?:cur|new|\\..*)$",
119 .mailbox_size_value = -1,
120 .mailbox_filecount_value = -1,
121 .mode = APPENDFILE_MODE,
122 .dirmode = APPENDFILE_DIRECTORY_MODE,
123 .lockfile_mode = APPENDFILE_LOCKFILE_MODE,
124 .lockfile_timeout = 30*60,
127 .maildir_retries = 10,
128 .create_file = create_anywhere,
130 .create_directory = TRUE,
131 .notify_comsat = FALSE,
132 .use_lockfile = TRUE,
134 .mode_fail_narrower = TRUE,
135 .quota_is_inclusive = TRUE,
139 /* Encodings for mailbox formats, and their names. MBX format is actually
140 supported only if SUPPORT_MBX is set. */
142 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
144 static const char *mailbox_formats[] = {
145 "unix", "mbx", "smail", "maildir", "mailstore" };
148 /* Check warn threshold only if quota size set or not a percentage threshold
149 percentage check should only be done if quota > 0 */
151 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
152 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
156 /*************************************************
157 * Setup entry point *
158 *************************************************/
160 /* Called for each delivery in the privileged state, just before the uid/gid
161 are changed and the main entry point is called. We use this function to
162 expand any quota settings, so that it can access files that may not be readable
163 by the user. It is also used to pick up external mailbox size information, if
167 tblock points to the transport instance
168 addrlist addresses about to be delivered (not used)
169 dummy not used (doesn't pass back data)
170 uid the uid that will be set (not used)
171 gid the gid that will be set (not used)
172 errmsg where to put an error message
174 Returns: OK, FAIL, or DEFER
178 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
179 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
181 appendfile_transport_options_block *ob =
182 (appendfile_transport_options_block *)(tblock->options_block);
183 uschar *q = ob->quota;
184 double default_value = 0.0;
186 if (ob->expand_maildir_use_size_file)
187 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
188 US"`maildir_use_size_file` in transport", tblock->name);
190 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
193 for (int i = 0; i < 5; i++)
195 double d = default_value;
197 uschar *which = NULL;
203 if (!(s = expand_string(q)))
205 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
206 "%s", q, tblock->name, expand_string_message);
207 return f.search_find_defer ? DEFER : FAIL;
210 d = Ustrtod(s, &rest);
212 /* Handle following characters K, M, G, %, the latter being permitted
213 for quota_warn_threshold only. A threshold with no quota setting is
216 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
217 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
218 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
219 else if (*rest == '%' && i == 2)
221 if (ob->quota_value <= 0 && !ob->maildir_use_size_file)
223 else if ((int)d < 0 || (int)d > 100)
225 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
226 " for %s transport", (int)d, tblock->name);
229 ob->quota_warn_threshold_is_percent = TRUE;
234 /* For quota and quota_filecount there may be options
235 appended. Currently only "no_check", so we can be lazy parsing it */
236 if (i < 2 && Ustrstr(rest, "/no_check") == rest)
239 rest += sizeof("/no_check") - 1;
242 Uskip_whitespace(&rest);
246 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
247 "in %s transport", s, q, tblock->name);
252 /* Set each value, checking for possible overflow. */
257 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
259 ob->quota_value = (off_t)d;
260 ob->quota_no_check = no_check;
261 q = ob->quota_filecount;
265 if (d >= 2.0*1024.0*1024.0*1024.0)
266 which = US"quota_filecount";
267 ob->quota_filecount_value = (int)d;
268 ob->quota_filecount_no_check = no_check;
269 q = ob->quota_warn_threshold;
273 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
274 which = US"quota_warn_threshold";
275 ob->quota_warn_threshold_value = (off_t)d;
276 q = ob->mailbox_size_string;
277 default_value = -1.0;
281 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
282 which = US"mailbox_size";;
283 ob->mailbox_size_value = (off_t)d;
284 q = ob->mailbox_filecount_string;
288 if (d >= 2.0*1024.0*1024.0*1024.0)
289 which = US"mailbox_filecount";
290 ob->mailbox_filecount_value = (int)d;
296 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
297 "%s transport", which, d, tblock->name);
307 /*************************************************
308 * Initialization entry point *
309 *************************************************/
311 /* Called for each instance, after its options have been read, to
312 enable consistency checks to be done, or anything else that needs
316 appendfile_transport_init(transport_instance *tblock)
318 appendfile_transport_options_block *ob =
319 (appendfile_transport_options_block *)(tblock->options_block);
322 /* Set up the setup entry point, to be called in the privileged state */
324 tblock->setup = appendfile_transport_setup;
326 /* Lock_retries must be greater than zero */
328 if (ob->lock_retries == 0) ob->lock_retries = 1;
330 /* Only one of a file name or directory name must be given. */
332 if (ob->filename && ob->dirname)
333 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
334 "only one of \"file\" or \"directory\" can be specified", tblock->name);
336 /* If a file name was specified, neither quota_filecount nor quota_directory
341 if (ob->quota_filecount)
342 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
343 "quota_filecount must not be set without \"directory\"", tblock->name);
344 if (ob->quota_directory)
345 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
346 "quota_directory must not be set without \"directory\"", tblock->name);
349 /* The default locking depends on whether MBX is set or not. Change the
350 built-in default if none of the lock options has been explicitly set. At least
351 one form of locking is required in all cases, but mbx locking changes the
352 meaning of fcntl and flock locking. */
354 /* Not all operating systems provide flock(). For those that do, if flock is
355 requested, the default for fcntl is FALSE. */
360 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
361 "flock() support was not available in the operating system when this "
362 "binary was built", tblock->name);
363 #endif /* NO_FLOCK */
364 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
369 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
370 !ob->set_use_mbx_lock)
372 ob->use_lockfile = ob->use_flock = FALSE;
373 ob->use_mbx_lock = ob->use_fcntl = TRUE;
375 else if (ob->use_mbx_lock)
377 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
378 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
379 if (!ob->set_use_flock) ob->use_flock = FALSE;
380 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
382 #endif /* SUPPORT_MBX */
384 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
385 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
386 "no locking configured", tblock->name);
388 /* Unset timeouts for non-used locking types */
390 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
391 if (!ob->use_flock) ob->lock_flock_timeout = 0;
393 /* If a directory name was specified, only one of maildir or mailstore may be
394 specified, and if quota_filecount or quota_directory is given, quota must
399 if (ob->maildir_format && ob->mailstore_format)
400 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
401 "only one of maildir and mailstore may be specified", tblock->name);
402 if (ob->quota_filecount != NULL && ob->quota == NULL)
403 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
404 "quota must be set if quota_filecount is set", tblock->name);
405 if (ob->quota_directory != NULL && ob->quota == NULL)
406 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
407 "quota must be set if quota_directory is set", tblock->name);
410 /* If a fixed uid field is set, then a gid field must also be set. */
412 if (tblock->uid_set && !tblock->gid_set && !tblock->expand_gid)
413 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
414 "user set without group for the %s transport", tblock->name);
416 /* If "create_file" is set, check that a valid option is given, and set the
419 if ((s = ob->create_file_string ) && *s)
422 if (Ustrcmp(s, "anywhere") == 0) val = create_anywhere;
423 else if (*s == '/' || Ustrcmp(s, "belowhome") == 0) val = create_belowhome;
424 else if (Ustrcmp(s, "inhome") == 0) val = create_inhome;
426 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
427 "invalid value given for \"create_file\" for the %s transport: '%s'",
429 ob->create_file = val;
432 /* If quota_warn_threshold is set, set up default for warn_message. It may
433 not be used if the actual threshold for a given delivery ends up as zero,
434 of if it's given as a percentage and there's no quota setting. */
436 if (ob->quota_warn_threshold)
438 if (!tblock->warn_message) tblock->warn_message = US
439 "To: $local_part@$domain\n"
440 "Subject: Your mailbox\n\n"
441 "This message is automatically created by mail delivery software (Exim).\n\n"
442 "The size of your mailbox has exceeded a warning threshold that is\n"
443 "set by the system administrator.\n";
446 /* If batch SMTP is set, force the check and escape strings, and arrange that
447 headers are also escaped. */
451 ob->check_string = US".";
452 ob->escape_string = US"..";
453 ob->options |= topt_escape_headers;
456 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
457 insert default values for for the affixes and the check/escape strings. */
459 else if (!ob->dirname && !ob->maildir_format && !ob->mailstore_format)
461 if (!ob->message_prefix) ob->message_prefix =
462 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
463 if (!ob->message_suffix) ob->message_suffix = US"\n";
464 if (!ob->check_string) ob->check_string = US"From ";
465 if (!ob->escape_string) ob->escape_string = US">From ";
469 /* Set up the bitwise options for transport_write_message from the various
470 driver options. Only one of body_only and headers_only can be set. */
473 (tblock->body_only ? topt_no_headers : 0) |
474 (tblock->headers_only ? topt_no_body : 0) |
475 (tblock->return_path_add ? topt_add_return_path : 0) |
476 (tblock->delivery_date_add ? topt_add_delivery_date : 0) |
477 (tblock->envelope_to_add ? topt_add_envelope_to : 0) |
478 ((ob->use_crlf || ob->mbx_format) ? topt_use_crlf : 0);
483 /*************************************************
485 *************************************************/
487 /* The comsat daemon is the thing that provides asynchronous notification of
488 the arrival of local messages, if requested by the user by "biff y". It is a
489 BSD thing that uses a TCP/IP protocol for communication. A message consisting
490 of the text "user@offset" must be sent, where offset is the place in the
491 mailbox where new mail starts. There is no scope for telling it which file to
492 look at, which makes it a less than useful if mail is being delivered into a
493 non-standard place such as the user's home directory. In fact, it doesn't seem
494 to pay much attention to the offset.
498 offset offset in mailbox
504 notify_comsat(uschar *user, off_t offset)
510 DEBUG(D_transport) debug_printf("notify_comsat called\n");
512 s = string_sprintf("%.200s@" OFF_T_FMT "\n", user, offset);
514 if ((sp = getservbyname("biff", "udp")) == NULL)
516 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
520 host.name = US"localhost";
524 /* This code is all set up to look up "localhost" and use all its addresses
525 until one succeeds. However, it appears that at least on some systems, comsat
526 doesn't listen on the ::1 address. So for the moment, just force the address to
527 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
528 can be changed. (But actually, comsat is probably dying out anyway.) */
531 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
533 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
538 host.address = US"127.0.0.1";
541 for (host_item * h = &host; h; h = h->next)
544 int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
546 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
548 if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
550 /* Connect never fails for a UDP socket, so don't set a timeout. */
552 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, NULL);
553 rc = send(sock, s, Ustrlen(s) + 1, 0);
558 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
565 /*************************************************
566 * Check the format of a file *
567 *************************************************/
569 /* This function is called when file_format is set, to check that an existing
570 file has the right format. The format string contains text/transport pairs. The
571 string matching is literal. we just read big_buffer_size bytes, because this is
572 all about the first few bytes of a file.
576 tblock the transport block
577 addr the address block - for inserting error data
579 Returns: pointer to the required transport, or NULL
583 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
585 const uschar *format =
586 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
588 int len = read(cfd, data, sizeof(data));
592 DEBUG(D_transport) debug_printf("checking file format\n");
594 /* An empty file matches the current transport */
596 if (len == 0) return tblock;
598 /* Search the formats for a match */
600 /* not expanded so cannot be tainted */
601 while ((s = string_nextinlist(&format, &sep, big_buffer, big_buffer_size)))
603 int slen = Ustrlen(s);
604 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
605 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
609 for (transport_instance * tt = transports; tt; tt = tt->next)
610 if (Ustrcmp(tp, tt->name) == 0)
613 debug_printf("file format -> %s transport\n", tt->name);
616 addr->basic_errno = ERRNO_BADTRANSPORT;
617 addr->message = string_sprintf("%s transport (for %.*s format) not found",
623 /* Failed to find a match */
625 addr->basic_errno = ERRNO_FORMATUNKNOWN;
626 addr->message = US"mailbox file format unrecognized";
633 /*************************************************
634 * Check directory's files for quota *
635 *************************************************/
637 /* This function is called if quota is set for one of the delivery modes that
638 delivers into a specific directory. It scans the directory and stats all the
639 files in order to get a total size and count. This is an expensive thing to do,
640 but some people are prepared to bear the cost. Alternatively, if size_regex is
641 set, it is used as a regex to try to extract the size from the file name, a
642 strategy that some people use on maildir files on systems where the users have
645 The function is global, because it is also called from tf_maildir.c for maildir
646 folders (which should contain only regular files).
648 Note: Any problems can be written to debugging output, but cannot be written to
649 the log, because we are running as an unprivileged user here.
652 dirname the name of the directory
653 countptr where to add the file count (because this function recurses)
654 re a compiled regex to get the size from a name
656 Returns: the sum of the sizes of the stattable files
657 zero if the directory cannot be opened
661 check_dir_size(const uschar * dirname, int * countptr, const pcre2_code * re)
665 int count = *countptr;
667 if (!(dir = exim_opendir(dirname))) return 0;
669 for (struct dirent *ent; ent = readdir(dir); )
671 uschar * path, * name = US ent->d_name;
674 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
678 /* If there's a regex, try to find the size using it */
682 pcre2_match_data * md = pcre2_match_data_create(2, pcre_gen_ctx);
683 int rc = pcre2_match(re, (PCRE2_SPTR)name, PCRE2_ZERO_TERMINATED,
684 0, 0, md, pcre_gen_mtc_ctx);
685 PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md);
687 && (rc = pcre2_get_ovector_count(md)) >= 2)
690 off_t size = (off_t)Ustrtod(name + ovec[2], &endptr);
691 if (endptr == name + ovec[3])
695 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
697 /* pcre2_match_data_free(md); gen ctx needs no free */
701 /* pcre2_match_data_free(md); gen ctx needs no free */
703 debug_printf("check_dir_size: regex did not match %s\n", name);
706 /* No regex or no match for the regex, or captured non-digits */
708 path = string_sprintf("%s/%s", dirname, name);
710 if (Ustat(path, &statbuf) < 0)
713 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, path,
717 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
718 sum += statbuf.st_size / statbuf.st_nlink;
719 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
720 sum += check_dir_size(path, &count, re);
725 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
735 /*************************************************
736 * Apply a lock to a file descriptor *
737 *************************************************/
739 /* This function applies a lock to a file descriptor, using a blocking or
740 non-blocking lock, depending on the timeout value. It can apply either or
741 both of a fcntl() and a flock() lock. However, not all OS support flock();
742 for those that don't, the use_flock option cannot be set.
745 fd the file descriptor
746 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
747 fcntl() format); the flock() type is deduced if needed
748 dofcntl do fcntl() locking
749 fcntltime non-zero to use blocking fcntl()
750 doflock do flock() locking
751 flocktime non-zero to use blocking flock()
753 Returns: yield of the fcntl() or flock() call, with errno preserved;
754 sigalrm_seen set if there has been a timeout
758 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
763 struct flock lock_data;
764 lock_data.l_type = fcntltype;
765 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
767 sigalrm_seen = FALSE;
774 yield = fcntl(fd, F_SETLKW, &lock_data);
779 else yield = fcntl(fd, F_SETLK, &lock_data);
783 if (doflock && (yield >= 0))
785 int flocktype = (fcntltype == F_WRLCK) ? LOCK_EX : LOCK_SH;
789 yield = flock(fd, flocktype);
794 else yield = flock(fd, flocktype | LOCK_NB);
796 #endif /* NO_FLOCK */
805 /*************************************************
806 * Copy message into MBX mailbox *
807 *************************************************/
809 /* This function is called when a message intended for a MBX mailbox has been
810 written to a temporary file. We can now get the size of the message and then
811 copy it in MBX format to the mailbox.
814 to_fd fd to write to (the real mailbox)
815 from_fd fd to read from (the temporary file)
816 saved_size current size of mailbox
818 Returns: OK if all went well, DEFER otherwise, with errno preserved
819 the number of bytes written are added to transport_count
820 by virtue of calling transport_write_block()
823 /* Values taken from c-client */
825 #define MBX_HDRSIZE 2048
826 #define MBX_NUSERFLAGS 30
829 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
834 transport_ctx tctx = { .u={.fd = to_fd}, .options = topt_not_socket };
836 /* If the current mailbox size is zero, write a header block */
841 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
842 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
843 (long int)time(NULL));
844 for (int i = 0; i < MBX_NUSERFLAGS; i++)
845 sprintf (CS(s += Ustrlen(s)), "\015\012");
846 if (!transport_write_block (&tctx, deliver_out_buffer, MBX_HDRSIZE, FALSE))
850 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
852 /* Now construct the message's header from the time and the RFC822 file
853 size, including CRLFs, which is the size of the input (temporary) file. */
855 if (fstat(from_fd, &statbuf) < 0) return DEFER;
856 size = statbuf.st_size;
858 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
859 tod_stamp(tod_mbx), size, 0L, 0, 0);
860 used = Ustrlen(deliver_out_buffer);
862 /* Rewind the temporary file, and copy it over in chunks. */
864 if (lseek(from_fd, 0 , SEEK_SET) < 0) return DEFER;
868 int len = read(from_fd, deliver_out_buffer + used,
869 DELIVER_OUT_BUFFER_SIZE - used);
872 if (len == 0) errno = ERRNO_MBXLENGTH;
875 if (!transport_write_block(&tctx, deliver_out_buffer, used + len, FALSE))
883 #endif /* SUPPORT_MBX */
887 /*************************************************
888 * Check creation is permitted *
889 *************************************************/
891 /* This function checks whether a given file name is permitted to be created,
892 as controlled by the create_file option. If no home directory is set, however,
893 we can't do any tests.
896 filename the file name
897 create_file the ob->create_file option
898 deliver_dir the delivery directory
900 Returns: TRUE if creation is permitted
904 check_creation(uschar *filename, int create_file, const uschar * deliver_dir)
908 if (deliver_dir && create_file != create_anywhere)
910 int len = Ustrlen(deliver_dir);
911 uschar *file = filename;
913 while (file[0] == '/' && file[1] == '/') file++;
914 if ( Ustrncmp(file, deliver_dir, len) != 0
916 || Ustrchr(file+len+2, '/') != NULL
917 && ( create_file != create_belowhome
918 || Ustrstr(file+len, "/../") != NULL
922 /* If yield is TRUE, the file name starts with the home directory, and does
923 not contain any instances of "/../" in the "belowhome" case. However, it may
924 still contain symbolic links. We can check for this by making use of
925 realpath(), which most Unixes seem to have (but make it possible to cut this
926 out). We can't just use realpath() on the whole file name, because we know
927 the file itself doesn't exist, and intermediate directories may also not
928 exist. What we want to know is the real path of the longest existing part of
929 the path. That must match the home directory's beginning, whichever is the
933 if (yield && create_file == create_belowhome)
937 for (uschar * slash = Ustrrchr(file, '/'); /* There is known to be one */
938 !rp && slash > file; /* Stop if reached beginning */
942 rp = US realpath(CS file, CS big_buffer);
943 next = Ustrrchr(file, '/');
947 /* If rp == NULL it means that none of the relevant directories exist.
948 This is not a problem here - it means that no symbolic links can exist,
949 which is all we are worried about. Otherwise, we must compare it
950 against the start of the home directory. However, that may itself
951 contain symbolic links, so we have to "realpath" it as well, if
956 uschar hdbuffer[PATH_MAX+1];
957 const uschar * rph = deliver_dir;
958 int rlen = Ustrlen(big_buffer);
960 if ((rp = US realpath(CS deliver_dir, CS hdbuffer)))
966 if (rlen > len) rlen = len;
967 if (Ustrncmp(rph, big_buffer, rlen) != 0)
970 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
971 big_buffer, deliver_dir);
975 #endif /* NO_REALPATH */
983 /*************************************************
985 *************************************************/
987 /* See local README for general interface details. This transport always
988 returns FALSE, indicating that the status which has been placed in the first
989 address should be copied to any other addresses in a batch.
991 Appendfile delivery is tricky and has led to various security problems in other
992 mailers. The logic used here is therefore laid out in some detail. When this
993 function is called, we are running in a subprocess which has had its gid and
994 uid set to the appropriate values. Therefore, we cannot write directly to the
995 exim logs. Any errors must be handled by setting appropriate return codes.
996 Note that the default setting for addr->transport_return is DEFER, so it need
997 not be set unless some other value is required.
999 The code below calls geteuid() rather than getuid() to get the current uid
1000 because in weird configurations not running setuid root there may be a
1001 difference. In the standard configuration, where setuid() has been used in the
1002 delivery process, there will be no difference between the uid and the euid.
1004 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1005 alias expansion. Otherwise, there must be a configured file name or
1008 The following items apply in the case when a file name (as opposed to a
1009 directory name) is given, that is, when appending to a single file:
1011 (2f) Expand the file name.
1013 (3f) If the file name is /dev/null, return success (optimization).
1015 (4f) If the file_format options is set, open the file for reading, and check
1016 that the bytes at the start of the file match one of the given strings.
1017 If the check indicates a transport other than the current one should be
1018 used, pass control to that other transport. Otherwise continue. An empty
1019 or non-existent file matches the current transport. The file is closed
1022 (5f) If a lock file is required, create it (see extensive separate comments
1023 below about the algorithm for doing this). It is important to do this
1024 before opening the mailbox if NFS is in use.
1026 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1027 details of any symbolic link.
1029 (7f) If the file already exists:
1031 Check the owner and group if necessary, and defer if they are wrong.
1033 If it is a symbolic link AND the allow_symlink option is set (NOT the
1034 default), go back to (6f) but this time use stat() instead of lstat().
1036 If it's not a regular file (or FIFO when permitted), defer delivery.
1038 Check permissions. If the required permissions are *less* than the
1039 existing ones, or supplied by the address (often by the user via filter),
1040 chmod() the file. Otherwise, defer.
1042 Save the inode number.
1044 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1046 If open fails because the file does not exist, go to (6f); on any other
1049 Check the inode number hasn't changed - I realize this isn't perfect (an
1050 inode can be reused) but it's cheap and will catch some of the races.
1052 Check it's still a regular file (or FIFO if permitted).
1054 Check that the owner and permissions haven't changed.
1056 If file_format is set, check that the file still matches the format for
1057 the current transport. If not, defer delivery.
1059 (8f) If file does not exist initially:
1061 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1062 this is via a symbolic link (only possible if allow_symlinks is set), in
1063 which case don't use O_EXCL, as it doesn't work.
1065 If open fails because the file already exists, go to (6f). To avoid
1066 looping for ever in a situation where the file is continuously being
1067 created and deleted, all of this happens inside a loop that operates
1068 lock_retries times and includes the fcntl and flock locking. If the
1069 loop completes without the file getting opened, defer and request
1070 freezing, because something really weird is happening.
1072 If open fails for any other reason, defer for subsequent delivery except
1073 when this is a file delivery resulting from an alias or forward expansion
1074 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1075 most likely a user rather than a configuration error.
1077 (9f) We now have the file checked and open for writing. If so configured, lock
1078 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1079 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1080 still fails, give up and defer delivery.
1082 (10f)Save the access time (for subsequent restoration) and the size of the
1083 file, for comsat and for re-setting if delivery fails in the middle -
1084 e.g. for quota exceeded.
1086 The following items apply in the case when a directory name is given:
1088 (2d) Create a new file in the directory using a temporary name, by opening for
1089 writing and with O_CREAT. If maildir format is being used, the file
1090 is created in a temporary subdirectory with a prescribed name. If
1091 mailstore format is being used, the envelope file is first created with a
1092 temporary name, then the data file.
1094 The following items apply in all cases:
1096 (11) We now have the file open for writing, and locked if it was given as a
1097 file name. Write the message and flush the file, unless there is a setting
1098 of the local quota option, in which case we can check for its excession
1099 without doing any writing.
1101 In the case of MBX format mailboxes, the message is first written to a
1102 temporary file, in order to get its correct length. This is then copied to
1103 the real file, preceded by an MBX header.
1105 If there is a quota error on writing, defer the address. Timeout logic
1106 will determine for how long retries are attempted. We restore the mailbox
1107 to its original length if it's a single file. There doesn't seem to be a
1108 uniform error code for quota excession (it even differs between SunOS4
1109 and some versions of SunOS5) so a system-dependent macro called
1110 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1113 For any other error (most commonly disk full), do the same.
1115 The following applies after appending to a file:
1117 (12f)Restore the atime; notify_comsat if required; close the file (which
1118 unlocks it if it was locked). Delete the lock file if it exists.
1120 The following applies after writing a unique file in a directory:
1122 (12d)For maildir format, rename the file into the new directory. For mailstore
1123 format, rename the envelope file to its correct name. Otherwise, generate
1124 a unique name from the directory_file option, and rename to that, possibly
1125 trying a few times if the file exists and re-expanding the name gives a
1128 This transport yields FAIL only when a file name is generated by an alias or
1129 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1130 All other failures return DEFER (in addr->transport_return). */
1134 appendfile_transport_entry(
1135 transport_instance *tblock, /* data for this instantiation */
1136 address_item *addr) /* address we are working on */
1138 appendfile_transport_options_block *ob =
1139 (appendfile_transport_options_block *)(tblock->options_block);
1140 struct stat statbuf;
1141 const uschar * deliver_dir;
1142 uschar *fdname = NULL;
1143 uschar *filename = NULL;
1144 uschar *hitchname = NULL;
1145 uschar *dataname = NULL;
1146 uschar *lockname = NULL;
1147 uschar *newname = NULL;
1148 uschar *nametag = NULL;
1150 uschar *filecount_msg = US"";
1152 struct utimbuf times;
1153 struct timeval msg_tv;
1154 BOOL disable_quota = FALSE;
1155 BOOL isdirectory = FALSE;
1156 BOOL isfifo = FALSE;
1157 BOOL wait_for_tick = FALSE;
1158 uid_t uid = geteuid(); /* See note above */
1159 gid_t gid = getegid();
1161 int mode = (addr->mode > 0) ? addr->mode : ob->mode;
1162 off_t saved_size = -1;
1163 off_t mailbox_size = ob->mailbox_size_value;
1164 int mailbox_filecount = ob->mailbox_filecount_value;
1172 int mbx_lockfd = -1;
1173 uschar mbx_lockname[40];
1174 FILE *temp_file = NULL;
1175 #endif /* SUPPORT_MBX */
1177 #ifdef SUPPORT_MAILDIR
1178 int maildirsize_fd = -1; /* fd for maildirsize file */
1179 int maildir_save_errno;
1183 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1185 /* An "address_file" or "address_directory" transport is used to deliver to
1186 files specified via .forward or an alias file. Prior to release 4.20, the
1187 "file" and "directory" options were ignored in this case. This has been changed
1188 to allow the redirection data to specify what is in effect a folder, whose
1189 location is determined by the options on the transport.
1191 Compatibility with the case when neither option is set is retained by forcing a
1192 value for the file or directory name. A directory delivery is assumed if the
1193 last character of the path from the router is '/'.
1195 The file path is in the local part of the address, but not in the $local_part
1196 variable (that holds the parent local part). It is, however, in the
1197 $address_file variable. Below, we update the local part in the address if it
1198 changes by expansion, so that the final path ends up in the log. */
1200 if (testflag(addr, af_file) && !ob->filename && !ob->dirname)
1202 fdname = US"$address_file";
1203 if (address_file[Ustrlen(address_file)-1] == '/' ||
1204 ob->maildir_format ||
1205 ob->mailstore_format)
1209 /* Handle (a) an "address file" delivery where "file" or "directory" is
1210 explicitly set and (b) a non-address_file delivery, where one of "file" or
1211 "directory" must be set; initialization ensures that they are not both set. */
1215 if (!(fdname = ob->filename))
1217 fdname = ob->dirname;
1222 addr->message = string_sprintf("Mandatory file or directory option "
1223 "missing from %s transport", tblock->name);
1228 /* Maildir and mailstore require a directory */
1230 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1232 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1233 "to be specified for the %s transport",
1234 ob->maildir_format ? "dir" : "store", tblock->name);
1238 if (!(path = expand_string(fdname)))
1240 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1241 "name for %s transport) failed: %s", fdname, tblock->name,
1242 expand_string_message);
1248 addr->message = string_sprintf("appendfile: file or directory name "
1249 "\"%s\" is not absolute", path);
1250 addr->basic_errno = ERRNO_NOTABSOLUTE;
1254 /* For a file delivery, make sure the local part in the address(es) is updated
1255 to the true local part. */
1257 if (testflag(addr, af_file))
1258 for (address_item * addr2 = addr; addr2; addr2 = addr2->next)
1259 addr2->local_part = string_copy(path);
1261 /* The available mailbox formats depend on whether it is a directory or a file
1267 #ifdef SUPPORT_MAILDIR
1268 ob->maildir_format ? mbf_maildir :
1270 #ifdef SUPPORT_MAILSTORE
1271 ob->mailstore_format ? mbf_mailstore :
1279 ob->mbx_format ? mbf_mbx :
1286 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1288 " warning=" OFF_T_FMT "%s\n"
1289 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1290 "maildir_use_size_file=%s\n",
1291 mode, ob->notify_comsat, ob->quota_value,
1292 ob->quota_no_check ? " (no_check)" : "",
1293 ob->quota_filecount_no_check ? " (no_check_filecount)" : "",
1294 ob->quota_warn_threshold_value,
1295 ob->quota_warn_threshold_is_percent ? "%" : "",
1296 isdirectory ? "directory" : "file",
1297 path, mailbox_formats[mbformat],
1298 !ob->message_prefix ? US"null" : string_printing(ob->message_prefix),
1299 !ob->message_suffix ? US"null" : string_printing(ob->message_suffix),
1300 ob->maildir_use_size_file ? "yes" : "no");
1302 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1303 ob->use_lockfile ? "lockfile " : "",
1304 ob->use_mbx_lock ? "mbx locking (" : "",
1305 ob->use_fcntl ? "fcntl " : "",
1306 ob->use_flock ? "flock" : "",
1307 ob->use_mbx_lock ? ")" : "");
1310 /* If the -N option is set, can't do any more. */
1315 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1317 addr->transport_return = OK;
1321 /* If an absolute path was given for create_file the it overrides deliver_home
1322 (here) and de-taints the filename (below, after check_creation() */
1324 deliver_dir = *ob->create_file_string == '/'
1325 ? ob->create_file_string : deliver_home;
1327 /* Handle the case of a file name. If the file name is /dev/null, we can save
1328 ourselves some effort and just give a success return right away. */
1332 BOOL use_lstat = TRUE;
1333 BOOL file_opened = FALSE;
1334 BOOL allow_creation_here = TRUE;
1336 if (Ustrcmp(path, "/dev/null") == 0)
1338 addr->transport_return = OK;
1342 /* Set the name of the file to be opened, and the file to which the data
1343 is written, and find out if we are permitted to create a non-existent file.
1344 If the create_file option is an absolute path and the file was within it,
1345 de-taint. Chaeck for a tainted path. */
1347 if ( (allow_creation_here = check_creation(path, ob->create_file, deliver_dir))
1348 && ob->create_file == create_belowhome)
1349 if (is_tainted(path))
1351 DEBUG(D_transport) debug_printf("de-tainting path '%s'\n", path);
1352 path = string_copy_taint(path, GET_UNTAINTED);
1355 if (is_tainted(path)) goto tainted_ret_panic;
1356 dataname = filename = path;
1358 /* If ob->create_directory is set, attempt to create the directories in
1359 which this mailbox lives, but only if we are permitted to create the file
1360 itself. We know we are dealing with an absolute path, because this was
1363 if (ob->create_directory && allow_creation_here)
1365 uschar *p = Ustrrchr(path, '/');
1366 p = string_copyn(path, p - path);
1367 if (!directory_make(NULL, p, ob->dirmode, FALSE))
1369 addr->basic_errno = errno;
1371 string_sprintf("failed to create directories for %s: %s", path,
1372 exim_errstr(errno));
1373 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1378 /* If file_format is set we must check that any existing file matches one of
1379 the configured formats by checking the bytes it starts with. A match then
1380 indicates a specific transport - if it is not this one, pass control to it.
1381 Otherwise carry on here. An empty or non-existent file matches the current
1382 transport. We don't need to distinguish between non-existence and other open
1383 failures because if an existing file fails to open here, it will also fail
1384 again later when O_RDWR is used. */
1386 if (ob->file_format)
1388 int cfd = Uopen(path, O_RDONLY, 0);
1391 transport_instance *tt = check_file_format(cfd, tblock, addr);
1394 /* If another transport is indicated, call it and return; if no transport
1395 was found, just return - the error data will have been set up.*/
1401 set_process_info("delivering %s to %s using %s", message_id,
1402 addr->local_part, tt->name);
1403 debug_print_string(tt->debug_string);
1404 addr->transport = tt;
1405 (tt->info->code)(tt, addr);
1412 /* The locking of mailbox files is worse than the naming of cats, which is
1413 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1414 three different names, so several different styles of locking are used.
1416 Research in other programs that lock mailboxes shows that there is no
1417 universally standard method. Having mailboxes NFS-mounted on the system that
1418 is delivering mail is not the best thing, but people do run like this,
1419 and so the code must do its best to cope.
1421 Three different locking mechanisms are supported. The initialization function
1422 checks that at least one is configured.
1426 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1427 will work over NFS. Only after that is done do we actually open the mailbox
1428 and apply locks to it (if configured).
1430 Originally, Exim got the file opened before doing anything about locking.
1431 However, a very occasional problem was observed on Solaris 2 when delivering
1432 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1433 gets remembered at open time. If another process on another host (that's
1434 important) has the file open and locked and writes to it and then releases
1435 the lock while the first process is waiting to get the lock, the first
1436 process may fail to write at the new end point of the file - despite the very
1437 definite statement about O_APPEND in the man page for write(). Experiments
1438 have reproduced this problem, but I do not know any way of forcing a host to
1439 update its attribute cache for an open NFS file. It would be nice if it did
1440 so when a lock was taken out, but this does not seem to happen. Anyway, to
1441 reduce the risk of this problem happening, we now create the lock file
1442 (if configured) *before* opening the mailbox. That will prevent two different
1443 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1444 however, but Pine at least seems to operate in the same way.
1446 Lockfiles should normally be used when NFS is involved, because of the above
1449 The logic for creating the lock file is:
1451 . The name of the lock file is <mailbox-name>.lock
1453 . First, create a "hitching post" name by adding the primary host name,
1454 current time and pid to the lock file name. This should be unique.
1456 . Create the hitching post file using WRONLY + CREAT + EXCL.
1458 . If that fails EACCES, we assume it means that the user is unable to create
1459 files in the mail spool directory. Some installations might operate in this
1460 manner, so there is a configuration option to allow this state not to be an
1461 error - we proceed to lock using fcntl only, after the file is open.
1463 . Otherwise, an error causes a deferment of the address.
1465 . Hard link the hitching post to the lock file name.
1467 . If the link succeeds, we have successfully created the lock file. Simply
1468 close and unlink the hitching post file.
1470 . If the link does not succeed, proceed as follows:
1472 o Fstat the hitching post file, and then close and unlink it.
1474 o Now examine the stat data. If the number of links to the file is exactly
1475 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1476 the return never made it back, so the link() function gave a failure
1479 . This method allows for the lock file to be created by some other process
1480 right up to the moment of the attempt to hard link it, and is also robust
1481 against NFS server crash-reboots, which would probably result in timeouts
1482 in the middle of link().
1484 . System crashes may cause lock files to get left lying around, and some means
1485 of flushing them is required. The approach of writing a pid (used by smail
1486 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1487 timeout, which seems a better approach. Since any program that writes to a
1488 mailbox using a lock file should complete its task very quickly, Pine
1489 removes lock files that are older than 5 minutes. We allow the value to be
1490 configurable on the transport.
1494 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1495 mailbox once it is open. This is done by default with a non-blocking lock.
1496 Failures to lock cause retries after a sleep, but only for a certain number
1497 of tries. A blocking lock is deliberately not used so that we don't hold the
1498 mailbox open. This minimizes the possibility of the NFS problem described
1499 under LOCK FILES above, if for some reason NFS deliveries are happening
1500 without lock files. However, the use of a non-blocking lock and sleep, though
1501 the safest approach, does not give the best performance on very busy systems.
1502 A blocking lock plus timeout does better. Therefore Exim has an option to
1503 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1504 enables the use of blocking fcntl() calls.
1508 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1509 same manner as for fcntl locking above. No-blocking/timeout is also set as
1510 above in lock_flock_timeout. Not all operating systems provide or support
1511 flock(). For those that don't (as determined by the definition of LOCK_SH in
1512 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1513 is implemented (not precisely) on top of fcntl(), which means there's no
1514 point in actually using it.
1518 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1519 then the rules used for locking in c-client are used. Exim takes out a shared
1520 lock on the mailbox file, and an exclusive lock on the file whose name is
1521 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1522 any other MBX client from getting an exclusive lock on it and expunging it.
1523 It also stops any other MBX client from unlinking the /tmp lock when it has
1526 The exclusive lock on the /tmp file prevents any other MBX client from
1527 updating the mailbox in any way. When writing is finished, if an exclusive
1528 lock on the mailbox can be obtained, indicating there are no current sharers,
1529 the /tmp file is unlinked.
1531 MBX locking can use either fcntl() or flock() locking. If neither
1532 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1533 The calls for getting these locks are by default non-blocking, as for non-mbx
1534 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1535 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1536 probably makes sense to set timeouts for any MBX deliveries. */
1539 /* Build a lock file if configured to do so - the existence of a lock
1540 file is subsequently checked by looking for a non-negative value of the
1541 file descriptor hd - even though the file is no longer open. */
1543 if (ob->use_lockfile)
1545 /* cf. exim_lock.c */
1546 lockname = string_sprintf("%s.lock", filename);
1547 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1548 (unsigned int)(time(NULL)), (unsigned int)getpid());
1550 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1553 /* Lock file creation retry loop */
1555 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1559 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1562 addr->basic_errno = errno;
1564 string_sprintf("creating lock file hitching post %s "
1565 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1566 (long int)getegid());
1570 /* Attempt to hitch the hitching post to the lock file. If link()
1571 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1572 file, and get rid of the hitching post. If the number of links was 2,
1573 the link was created, despite the failure of link(). If the hitch was
1574 not successful, try again, having unlinked the lock file if it is too
1577 There's a version of Linux (2.0.27) which doesn't update its local cache
1578 of the inode after link() by default - which many think is a bug - but
1579 if the link succeeds, this code will be OK. It just won't work in the
1580 case when link() fails after having actually created the link. The Linux
1581 NFS person is fixing this; a temporary patch is available if anyone is
1582 sufficiently worried. */
1584 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1587 if (rc != 0 && statbuf.st_nlink != 2)
1589 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1590 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1592 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1595 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1599 DEBUG(D_transport) debug_printf("lock file created\n");
1603 /* Check for too many tries at creating the lock file */
1605 if (i >= ob->lock_retries)
1607 addr->basic_errno = ERRNO_LOCKFAILED;
1608 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1615 /* We now have to get the file open. First, stat() it and act on existence or
1616 non-existence. This is in a loop to handle the case of a file's being created
1617 or deleted as we watch, and also to handle retries when the locking fails.
1618 Rather than holding the file open while waiting for the fcntl() and/or
1619 flock() lock, we close and do the whole thing again. This should be safer,
1620 especially for NFS files, which might get altered from other hosts, making
1621 their cached sizes incorrect.
1623 With the default settings, no symlinks are permitted, but there is an option
1624 to permit symlinks for those sysadmins that know what they are doing.
1625 Shudder. However, insist that the initial symlink is owned by the right user.
1626 Thus lstat() is used initially; if a symlink is discovered, the loop is
1627 repeated such that stat() is used, to look at the end file. */
1629 for (i = 0; i < ob->lock_retries; i++)
1631 int sleep_before_retry = TRUE;
1632 file_opened = FALSE;
1634 if ((use_lstat ? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1636 /* Let's hope that failure to stat (other than non-existence) is a
1639 if (errno != ENOENT)
1641 addr->basic_errno = errno;
1642 addr->message = string_sprintf("attempting to stat mailbox %s",
1647 /* File does not exist. If it is required to pre-exist this state is an
1650 if (ob->file_must_exist)
1652 addr->basic_errno = errno;
1653 addr->message = string_sprintf("mailbox %s does not exist, "
1654 "but file_must_exist is set", filename);
1658 /* If not permitted to create this file because it isn't in or below
1659 the home directory, generate an error. */
1661 if (!allow_creation_here)
1663 addr->basic_errno = ERRNO_BADCREATE;
1664 addr->message = string_sprintf("mailbox %s does not exist, "
1665 "but creation outside the home directory is not permitted",
1670 /* Attempt to create and open the file. If open fails because of
1671 pre-existence, go round the loop again. For any other error, defer the
1672 address, except for an alias or forward generated file name with EPERM,
1673 ENOENT, or EACCES, as those are most likely to be user errors rather
1674 than Exim config errors. When a symbolic link is permitted and points
1675 to a non-existent file, we get here with use_lstat = FALSE. In this case
1676 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1677 consistency and because MBX locking requires it in order to be able to
1678 get a shared lock. */
1680 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1681 (use_lstat ? O_EXCL : 0), mode);
1684 if (errno == EEXIST) continue;
1685 addr->basic_errno = errno;
1686 addr->message = string_sprintf("while creating mailbox %s",
1688 if (testflag(addr, af_file) &&
1689 (errno == EPERM || errno == ENOENT || errno == EACCES))
1690 addr->transport_return = FAIL;
1694 /* We have successfully created and opened the file. Ensure that the group
1695 and the mode are correct. */
1697 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
1699 addr->basic_errno = errno;
1700 addr->message = string_sprintf("while setting perms on mailbox %s",
1702 addr->transport_return = FAIL;
1708 /* The file already exists. Test its type, ownership, and permissions, and
1709 save the inode for checking later. If symlinks are permitted (not the
1710 default or recommended state) it may be a symlink that already exists.
1711 Check its ownership and then look for the file at the end of the link(s).
1712 This at least prevents one user creating a symlink for another user in
1713 a sticky directory. */
1717 int oldmode = (int)statbuf.st_mode;
1718 ino_t inode = statbuf.st_ino;
1719 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1721 isfifo = FALSE; /* In case things are changing */
1723 /* Check owner if required - the default. */
1725 if (ob->check_owner && statbuf.st_uid != uid)
1727 addr->basic_errno = ERRNO_BADUGID;
1728 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1729 "(%ld != %ld)", filename,
1730 islink ? " (symlink)" : "",
1731 (long int)(statbuf.st_uid), (long int)uid);
1735 /* Group is checked only if check_group is set. */
1737 if (ob->check_group && statbuf.st_gid != gid)
1739 addr->basic_errno = ERRNO_BADUGID;
1740 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1741 filename, islink ? " (symlink)" : "", statbuf.st_gid, gid);
1745 /* Just in case this is a sticky-bit mail directory, we don't want
1746 users to be able to create hard links to other users' files. */
1748 if (statbuf.st_nlink != 1)
1750 addr->basic_errno = ERRNO_NOTREGULAR;
1751 addr->message = string_sprintf("mailbox %s%s has too many links (%lu)",
1752 filename, islink ? " (symlink)" : "", (unsigned long)statbuf.st_nlink);
1757 /* If symlinks are permitted (not recommended), the lstat() above will
1758 have found the symlink. Its ownership has just been checked; go round
1759 the loop again, using stat() instead of lstat(). That will never yield a
1762 if (islink && ob->allow_symlink)
1765 i--; /* Don't count this time round */
1769 /* An actual file exists. Check that it is a regular file, or FIFO
1772 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1774 else if ((oldmode & S_IFMT) != S_IFREG)
1776 addr->basic_errno = ERRNO_NOTREGULAR;
1777 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1778 filename, ob->allow_fifo ? " or named pipe" : "");
1782 /* If the mode is not what it would be for a newly created file, change
1783 the permissions if the mode is supplied for the address. Otherwise,
1784 reduce but do not extend the permissions. If the newly created
1785 permissions are greater than the existing permissions, don't change
1786 things when the mode is not from the address. */
1788 if ((oldmode &= 07777) != mode)
1790 int diffs = oldmode ^ mode;
1791 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1793 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1794 if (Uchmod(filename, mode) < 0)
1796 addr->basic_errno = errno;
1797 addr->message = string_sprintf("attempting to chmod mailbox %s",
1804 /* Mode not from address, and newly-created permissions are greater
1805 than existing permissions. Default is to complain, but it can be
1806 configured to go ahead and try to deliver anyway if that's what
1807 the administration wants. */
1809 else if (ob->mode_fail_narrower)
1811 addr->basic_errno = ERRNO_BADMODE;
1812 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1813 "(%o expected)", filename, oldmode, mode);
1818 /* We are happy with the existing file. Open it, and then do further
1819 tests to ensure that it is the same file that we were just looking at.
1820 If the file does not now exist, restart this loop, going back to using
1821 lstat again. For an NFS error, just defer; other opening errors are
1822 more serious. The file is opened RDWR so that its format can be checked,
1823 and also MBX locking requires the use of a shared (read) lock. However,
1824 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1825 reading the pipe. */
1827 fd = Uopen(filename, isfifo ? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1831 if (errno == ENOENT)
1836 addr->basic_errno = errno;
1838 addr->message = string_sprintf("while opening named pipe %s "
1839 "(could mean no process is reading it)", filename);
1840 else if (errno != EWOULDBLOCK)
1841 addr->message = string_sprintf("while opening mailbox %s", filename);
1845 /* This fstat really shouldn't fail, as we have an open file! There's a
1846 dilemma here. We use fstat in order to be sure we are peering at the file
1847 we have got open. However, that won't tell us if the file was reached
1848 via a symbolic link. We checked this above, but there is a race exposure
1849 if the link was created between the previous lstat and the open. However,
1850 it would have to be created with the same inode in order to pass the
1851 check below. If ob->allow_symlink is set, causing the use of stat rather
1852 than lstat above, symbolic links may be there anyway, and the checking is
1855 if (fstat(fd, &statbuf) < 0)
1857 addr->basic_errno = errno;
1858 addr->message = string_sprintf("attempting to stat open mailbox %s",
1863 /* Check the inode; this is isn't a perfect check, but gives some
1866 if (inode != statbuf.st_ino)
1868 addr->basic_errno = ERRNO_INODECHANGED;
1869 addr->message = string_sprintf("opened mailbox %s inode number changed "
1870 "from " INO_T_FMT " to " INO_T_FMT, filename, inode, statbuf.st_ino);
1871 addr->special_action = SPECIAL_FREEZE;
1875 /* Check it's still a regular file or FIFO, and the uid, gid, and
1876 permissions have not changed. */
1878 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1879 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1881 addr->basic_errno = ERRNO_NOTREGULAR;
1883 string_sprintf("opened mailbox %s is no longer a %s", filename,
1884 isfifo ? "named pipe" : "regular file");
1885 addr->special_action = SPECIAL_FREEZE;
1889 if ((ob->check_owner && statbuf.st_uid != uid) ||
1890 (ob->check_group && statbuf.st_gid != gid))
1892 addr->basic_errno = ERRNO_BADUGID;
1894 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1895 addr->special_action = SPECIAL_FREEZE;
1899 if ((statbuf.st_mode & 07777) != oldmode)
1901 addr->basic_errno = ERRNO_BADMODE;
1902 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1903 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1904 addr->special_action = SPECIAL_FREEZE;
1908 /* If file_format is set, check that the format of the file has not
1909 changed. Error data is set by the testing function. */
1911 if (ob->file_format && check_file_format(fd, tblock, addr) != tblock)
1913 addr->message = US"open mailbox has changed format";
1917 /* The file is OK. Carry on to do the locking. */
1920 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1921 locking rules if configured to do so. If a lock file is also required, it
1922 was created above and hd was left >= 0. At least one form of locking is
1923 required by the initialization function. If locking fails here, close the
1924 file and go round the loop all over again, after waiting for a bit, unless
1925 blocking locking was used. */
1928 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1929 sleep_before_retry = FALSE;
1931 /* Simple fcntl() and/or flock() locking */
1933 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
1935 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1936 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
1939 /* MBX locking rules */
1942 else if (ob->use_mbx_lock)
1945 struct stat lstatbuf, statbuf2;
1946 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1947 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
1948 fstat(fd, &statbuf) >= 0)
1950 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
1951 (long)statbuf.st_ino);
1954 * 2010-05-29: SECURITY
1955 * Dan Rosenberg reported the presence of a race-condition in the
1956 * original code here. Beware that many systems still allow symlinks
1957 * to be followed in /tmp so an attacker can create a symlink pointing
1958 * elsewhere between a stat and an open, which we should avoid
1961 * It's unfortunate that we can't just use all the heavily debugged
1962 * locking from above.
1964 * Also: remember to mirror changes into exim_lock.c */
1966 /* first leave the old pre-check in place, it provides better
1967 * diagnostics for common cases */
1968 if (Ulstat(mbx_lockname, &statbuf) >= 0)
1970 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
1972 addr->basic_errno = ERRNO_LOCKFAILED;
1973 addr->message = string_sprintf("symbolic link on MBX lock file %s",
1977 if (statbuf.st_nlink > 1)
1979 addr->basic_errno = ERRNO_LOCKFAILED;
1980 addr->message = string_sprintf("hard link to MBX lock file %s",
1986 /* If we could just declare "we must be the ones who create this
1987 * file" then a hitching post in a subdir would work, since a
1988 * subdir directly in /tmp/ which we create wouldn't follow links
1989 * but this isn't our locking logic, so we can't safely change the
1990 * file existence rules. */
1992 /* On systems which support O_NOFOLLOW, it's the easiest and most
1993 * obviously correct security fix */
1994 mbx_tmp_oflags = O_RDWR | O_CREAT;
1996 mbx_tmp_oflags |= O_NOFOLLOW;
1998 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2001 addr->basic_errno = ERRNO_LOCKFAILED;
2002 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2003 mbx_lockname, strerror(errno));
2007 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2009 addr->basic_errno = ERRNO_LOCKFAILED;
2010 addr->message = string_sprintf("attempting to lstat open MBX "
2011 "lock file %s: %s", mbx_lockname, strerror(errno));
2014 if (fstat(mbx_lockfd, &statbuf2) < 0)
2016 addr->basic_errno = ERRNO_LOCKFAILED;
2017 addr->message = string_sprintf("attempting to stat fd of open MBX "
2018 "lock file %s: %s", mbx_lockname, strerror(errno));
2024 * statbuf: if exists, is file which existed prior to opening the
2025 * lockfile, might have been replaced since then
2026 * statbuf2: result of stat'ing the open fd, is what was actually
2028 * lstatbuf: result of lstat'ing the filename immediately after
2029 * the open but there's a race condition again between
2030 * those two steps: before open, symlink to foo, after
2031 * open but before lstat have one of:
2032 * * was no symlink, so is the opened file
2033 * (we created it, no messing possible after that point)
2035 * * symlink elsewhere
2036 * * hardlink elsewhere
2038 * Don't want to compare to device of /tmp because some modern systems
2039 * have regressed to having /tmp be the safe actual filesystem as
2040 * valuable data, so is mostly worthless, unless we assume that *only*
2041 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2042 * for further consideration.
2043 * No point in doing a readlink on the lockfile as that will always be
2044 * at a different point in time from when we open it, so tells us
2045 * nothing; attempts to clean up and delete after ourselves would risk
2046 * deleting a *third* filename.
2048 if ((statbuf2.st_nlink > 1) ||
2049 (lstatbuf.st_nlink > 1) ||
2050 (!S_ISREG(lstatbuf.st_mode)) ||
2051 (lstatbuf.st_dev != statbuf2.st_dev) ||
2052 (lstatbuf.st_ino != statbuf2.st_ino))
2054 addr->basic_errno = ERRNO_LOCKFAILED;
2055 addr->message = string_sprintf("RACE CONDITION detected: "
2056 "mismatch post-initial-checks between \"%s\" and opened "
2057 "fd lead us to abort!", mbx_lockname);
2061 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2063 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2064 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2066 struct stat ostatbuf;
2068 /* This tests for a specific race condition. Ensure that we still
2069 have the same file. */
2071 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2072 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2073 statbuf.st_dev == ostatbuf.st_dev &&
2074 statbuf.st_ino == ostatbuf.st_ino)
2076 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2077 "between creation and locking\n", mbx_lockname);
2080 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2082 (void)close(mbx_lockfd);
2087 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2088 filename, strerror(errno));
2091 #endif /* SUPPORT_MBX */
2093 else break; /* No on-file locking required; break the open/lock loop */
2096 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2100 use_lstat = TRUE; /* Reset to use lstat first */
2103 /* If a blocking call timed out, break the retry loop if the total time
2104 so far is not less than than retries * interval. Use the larger of the
2105 flock() and fcntl() timeouts. */
2108 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2109 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2110 ob->lock_retries * ob->lock_interval)
2111 i = ob->lock_retries;
2113 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2114 flock() that caused the problem. */
2116 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2119 /* Test for exceeding the maximum number of tries. Either the file remains
2120 locked, or, if we haven't got it open, something is terribly wrong... */
2122 if (i >= ob->lock_retries)
2126 addr->basic_errno = ERRNO_EXISTRACE;
2127 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2128 addr->special_action = SPECIAL_FREEZE;
2132 addr->basic_errno = ERRNO_LOCKFAILED;
2133 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2139 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2141 /* Save access time (for subsequent restoration), modification time (for
2142 restoration if updating fails), size of file (for comsat and for re-setting if
2143 delivery fails in the middle - e.g. for quota exceeded). */
2145 if (fstat(fd, &statbuf) < 0)
2147 addr->basic_errno = errno;
2148 addr->message = string_sprintf("while fstatting opened mailbox %s",
2153 times.actime = statbuf.st_atime;
2154 times.modtime = statbuf.st_mtime;
2155 saved_size = statbuf.st_size;
2156 if (mailbox_size < 0) mailbox_size = saved_size;
2157 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2160 /* Prepare for writing to a new file (as opposed to appending to an old one).
2161 There are several different formats, but there is preliminary stuff concerned
2162 with quotas that applies to all of them. Finding the current size by directory
2163 scanning is expensive; for maildirs some fudges have been invented:
2165 (1) A regex can be used to extract a file size from its name;
2166 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2172 uschar *check_path; /* Default quota check path */
2173 const pcre2_code * re = NULL; /* Regex for file size from file name */
2175 if (!check_creation(string_sprintf("%s/any", path),
2176 ob->create_file, deliver_dir))
2178 addr->basic_errno = ERRNO_BADCREATE;
2179 addr->message = string_sprintf("tried to create file in %s, but "
2180 "file creation outside the home directory is not permitted", path);
2184 /* If the create_file option is an absolute path and the file was within
2185 it, de-taint. Otherwise check for taint. */
2187 if (is_tainted(path))
2188 if (ob->create_file == create_belowhome)
2190 DEBUG(D_transport) debug_printf("de-tainting path '%s'\n", path);
2191 path = string_copy_taint(path, GET_UNTAINTED);
2194 goto tainted_ret_panic;
2198 #ifdef SUPPORT_MAILDIR
2199 /* For a maildir delivery, ensure that all the relevant directories exist,
2200 and a maildirfolder file if necessary. */
2202 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2203 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2205 #endif /* SUPPORT_MAILDIR */
2207 /* If we are going to do a quota check, of if maildir_use_size_file is set
2208 for a maildir delivery, compile the regular expression if there is one. We
2209 may also need to adjust the path that is used. We need to do this for
2210 maildir_use_size_file even if the quota is unset, because we still want to
2211 create the file. When maildir support is not compiled,
2212 ob->maildir_use_size_file is always FALSE. */
2214 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2219 /* Compile the regex if there is one. */
2221 if (ob->quota_size_regex)
2223 if (!(re = pcre2_compile((PCRE2_SPTR)ob->quota_size_regex,
2224 PCRE2_ZERO_TERMINATED, PCRE_COPT, &err, &offset, pcre_gen_cmp_ctx)))
2227 pcre2_get_error_message(err, errbuf, sizeof(errbuf));
2228 addr->message = string_sprintf("appendfile: regular expression "
2229 "error: %s at offset %ld while compiling %s", errbuf, (long)offset,
2230 ob->quota_size_regex);
2233 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2234 ob->quota_size_regex);
2237 /* Use an explicitly configured directory if set */
2239 if (ob->quota_directory)
2241 if (!(check_path = expand_string(ob->quota_directory)))
2243 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2244 "name for %s transport) failed: %s", ob->quota_directory,
2245 tblock->name, expand_string_message);
2249 if (check_path[0] != '/')
2251 addr->message = string_sprintf("appendfile: quota_directory name "
2252 "\"%s\" is not absolute", check_path);
2253 addr->basic_errno = ERRNO_NOTABSOLUTE;
2258 #ifdef SUPPORT_MAILDIR
2259 /* Otherwise, if we are handling a maildir delivery, and the directory
2260 contains a file called maildirfolder, this is a maildir++ feature telling
2261 us that this is a sub-directory of the real inbox. We should therefore do
2262 the quota check on the parent directory. Beware of the special case when
2263 the directory name itself ends in a slash. */
2265 else if (mbformat == mbf_maildir)
2267 struct stat statbuf;
2268 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2270 uschar *new_check_path = string_copy(check_path);
2271 uschar *slash = Ustrrchr(new_check_path, '/');
2277 slash = Ustrrchr(new_check_path, '/');
2282 check_path = new_check_path;
2283 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2284 "quota check directory changed to %s\n", check_path);
2289 #endif /* SUPPORT_MAILDIR */
2292 /* If we are using maildirsize files, we need to ensure that such a file
2293 exists and, if necessary, recalculate its contents. As a byproduct of this,
2294 we obtain the current size of the maildir. If no quota is to be enforced
2295 (ob->quota_value == 0), we still need the size if a threshold check will
2298 Another regular expression is used to determine which directories inside the
2299 maildir are going to be counted. */
2301 #ifdef SUPPORT_MAILDIR
2302 if (ob->maildir_use_size_file)
2304 const pcre2_code * dir_regex = NULL;
2308 if (ob->maildir_dir_regex)
2310 int check_path_len = Ustrlen(check_path);
2312 if (!(dir_regex = pcre2_compile((PCRE2_SPTR)ob->maildir_dir_regex,
2313 PCRE2_ZERO_TERMINATED, PCRE_COPT, &err, &offset, pcre_gen_cmp_ctx)))
2316 pcre2_get_error_message(err, errbuf, sizeof(errbuf));
2317 addr->message = string_sprintf("appendfile: regular expression "
2318 "error: %s at offset %ld while compiling %s", errbuf, (long)offset,
2319 ob->maildir_dir_regex);
2324 debug_printf("using regex for maildir directory selection: %s\n",
2325 ob->maildir_dir_regex);
2327 /* Check to see if we are delivering into an ignored directory, that is,
2328 if the delivery path starts with the quota check path, and the rest
2329 of the deliver path matches the regex; if so, set a flag to disable quota
2330 checking and maildirsize updating. */
2332 if (Ustrncmp(path, check_path, check_path_len) == 0)
2334 uschar *s = path + check_path_len;
2335 while (*s == '/') s++;
2336 s = *s ? string_sprintf("%s/new", s) : US"new";
2337 if (!regex_match(dir_regex, s, -1, NULL))
2339 disable_quota = TRUE;
2340 DEBUG(D_transport) debug_printf("delivery directory does not match "
2341 "maildir_quota_directory_regex: disabling quota\n");
2346 /* Quota enforcement; create and check the file. There is some discussion
2347 about whether this should happen if the quota is unset. At present, Exim
2348 always creates the file. If we ever want to change this, uncomment
2349 appropriate lines below, possibly doing a check on some option. */
2351 /* if (???? || ob->quota_value > 0) */
2358 if ((maildirsize_fd = maildir_ensure_sizefile(check_path, ob, re, dir_regex,
2359 &size, &filecount)) == -1)
2361 addr->basic_errno = errno;
2362 addr->message = string_sprintf("while opening or reading "
2363 "%s/maildirsize", check_path);
2366 /* can also return -2, which means that the file was removed because of
2367 raciness; but in this case, the size & filecount will still have been
2370 if (mailbox_size < 0) mailbox_size = size;
2371 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2374 /* No quota enforcement; ensure file does *not* exist; calculate size if
2379 * time_t old_latest;
2380 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2381 * if (THRESHOLD_CHECK)
2382 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2383 * re, dir_regex, FALSE);
2388 #endif /* SUPPORT_MAILDIR */
2390 /* Otherwise if we are going to do a quota check later on, and the mailbox
2391 size is not set, find the current size of the mailbox. Ditto for the file
2392 count. Note that ob->quota_filecount_value cannot be set without
2393 ob->quota_value being set. */
2396 && (ob->quota_value > 0 || THRESHOLD_CHECK)
2397 && ( mailbox_size < 0
2398 || mailbox_filecount < 0 && ob->quota_filecount_value > 0
2404 debug_printf("quota checks on directory %s\n", check_path);
2405 size = check_dir_size(check_path, &filecount, re);
2406 if (mailbox_size < 0) mailbox_size = size;
2407 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2410 /* Handle the case of creating a unique file in a given directory (not in
2411 maildir or mailstore format - this is how smail did it). A temporary name is
2412 used to create the file. Later, when it is written, the name is changed to a
2413 unique one. There is no need to lock the file. An attempt is made to create
2414 the directory if it does not exist. */
2416 if (mbformat == mbf_smail)
2419 debug_printf("delivering to new file in %s\n", path);
2420 filename = dataname =
2421 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2422 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2423 if (fd < 0 && /* failed to open, and */
2424 (errno != ENOENT || /* either not non-exist */
2425 !ob->create_directory || /* or not allowed to make */
2426 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2427 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2429 addr->basic_errno = errno;
2430 addr->message = string_sprintf("while creating file %s", filename);
2435 #ifdef SUPPORT_MAILDIR
2437 /* Handle the case of a unique file in maildir format. The file is written to
2438 the tmp subdirectory, with a prescribed form of name. */
2440 else if (mbformat == mbf_maildir)
2443 debug_printf("delivering in maildir format in %s\n", path);
2445 nametag = ob->maildir_tag;
2447 /* Check that nametag expands successfully; a hard failure causes a panic
2448 return. The actual expansion for use happens again later, when
2449 $message_size is accurately known. */
2451 if (nametag && !expand_string(nametag) && !f.expand_string_forcedfail)
2453 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2454 "for %s transport) failed: %s", nametag, tblock->name,
2455 expand_string_message);
2459 /* We ensured the existence of all the relevant directories above. Attempt
2460 to open the temporary file a limited number of times. I think this rather
2461 scary-looking for statement is actually OK. If open succeeds, the loop is
2462 broken; if not, there is a test on the value of i. Get the time again
2463 afresh each time round the loop. Its value goes into a variable that is
2464 checked at the end, to make sure we don't release this process until the
2465 clock has ticked. */
2467 for (int i = 1;; i++)
2471 (void)gettimeofday(&msg_tv, NULL);
2472 basename = string_sprintf(TIME_T_FMT ".M%luP" PID_T_FMT ".%s",
2473 msg_tv.tv_sec, msg_tv.tv_usec, getpid(), primary_hostname);
2475 filename = dataname = string_sprintf("tmp/%s", basename);
2476 newname = string_sprintf("new/%s", basename);
2478 if (Ustat(filename, &statbuf) == 0)
2480 else if (errno == ENOENT)
2482 if ((fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode)) >= 0)
2484 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2485 filename, strerror(errno));
2488 /* Too many retries - give up */
2490 if (i >= ob->maildir_retries)
2492 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2493 filename, i, (i == 1) ? "y" : "ies");
2494 addr->basic_errno = errno;
2495 if (errno == errno_quota || errno == ENOSPC)
2496 addr->user_message = US"mailbox is full";
2500 /* Open or stat failed but we haven't tried too many times yet. */
2505 /* Note that we have to ensure the clock has ticked before leaving */
2507 wait_for_tick = TRUE;
2509 /* Why are these here? Put in because they are present in the non-maildir
2510 directory case above. */
2512 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2514 addr->basic_errno = errno;
2515 addr->message = string_sprintf("while setting perms on maildir %s",
2521 #endif /* SUPPORT_MAILDIR */
2523 #ifdef SUPPORT_MAILSTORE
2525 /* Handle the case of a unique file in mailstore format. First write the
2526 envelope to a temporary file, then open the main file. The unique base name
2527 for the files consists of the message id plus the pid of this delivery
2533 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2534 string_base62((long int)getpid()));
2537 debug_printf("delivering in mailstore format in %s\n", path);
2539 filename = string_sprintf("%s.tmp", mailstore_basename);
2540 newname = string_sprintf("%s.env", mailstore_basename);
2541 dataname = string_sprintf("%s.msg", mailstore_basename);
2543 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2544 if ( fd < 0 /* failed to open, and */
2545 && ( errno != ENOENT /* either not non-exist */
2546 || !ob->create_directory /* or not allowed to make */
2547 || !directory_make(NULL, path, ob->dirmode, FALSE) /* or failed to create dir */
2548 || (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0 /* or then failed to open */
2551 addr->basic_errno = errno;
2552 addr->message = string_sprintf("while creating file %s", filename);
2556 /* Why are these here? Put in because they are present in the non-maildir
2557 directory case above. */
2559 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2561 addr->basic_errno = errno;
2562 addr->message = string_sprintf("while setting perms on file %s",
2567 /* Built a C stream from the open file descriptor. */
2569 if (!(env_file = fdopen(fd, "wb")))
2571 addr->basic_errno = errno;
2572 addr->message = string_sprintf("fdopen of %s ("
2573 "for %s transport) failed", filename, tblock->name);
2579 /* Write the envelope file, then close it. */
2581 if (ob->mailstore_prefix)
2583 uschar *s = expand_string(ob->mailstore_prefix);
2586 if (!f.expand_string_forcedfail)
2588 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2589 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2590 tblock->name, expand_string_message);
2591 (void)fclose(env_file);
2599 fprintf(env_file, "%s", CS s);
2600 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2604 fprintf(env_file, "%s\n", sender_address);
2606 for (address_item * taddr = addr; taddr; taddr = taddr->next)
2607 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2609 if (ob->mailstore_suffix)
2611 uschar *s = expand_string(ob->mailstore_suffix);
2614 if (!f.expand_string_forcedfail)
2616 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2617 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2618 tblock->name, expand_string_message);
2619 (void)fclose(env_file);
2627 fprintf(env_file, "%s", CS s);
2628 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2632 if (fclose(env_file) != 0)
2634 addr->basic_errno = errno;
2635 addr->message = string_sprintf("while closing %s", filename);
2640 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2642 /* Now open the data file, and ensure that it has the correct ownership and
2645 if ((fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)
2647 addr->basic_errno = errno;
2648 addr->message = string_sprintf("while creating file %s", dataname);
2652 if (exim_chown(dataname, uid, gid) || Uchmod(dataname, mode))
2654 addr->basic_errno = errno;
2655 addr->message = string_sprintf("while setting perms on file %s",
2661 #endif /* SUPPORT_MAILSTORE */
2664 /* In all cases of writing to a new file, ensure that the file which is
2665 going to be renamed has the correct ownership and mode. */
2667 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2669 addr->basic_errno = errno;
2670 addr->message = string_sprintf("while setting perms on file %s",
2677 /* At last we can write the message to the file, preceded by any configured
2678 prefix line, and followed by any configured suffix line. If there are any
2679 writing errors, we must defer. */
2681 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2686 /* If there is a local quota setting, check that we are not going to exceed it
2687 with this message if quota_is_inclusive is set; if it is not set, the check
2688 is for the mailbox already being over quota (i.e. the current message is not
2689 included in the check). */
2691 if (!disable_quota && ob->quota_value > 0)
2695 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2696 " this message = %d (%sincluded)\n",
2697 ob->quota_value, mailbox_size, message_size,
2698 ob->quota_is_inclusive ? "" : "not ");
2699 debug_printf(" file count quota = %d count = %d\n",
2700 ob->quota_filecount_value, mailbox_filecount);
2703 if (mailbox_size + (ob->quota_is_inclusive ? message_size:0) > ob->quota_value)
2704 if (!ob->quota_no_check)
2706 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2708 errno = ERRNO_EXIMQUOTA;
2711 DEBUG(D_transport) debug_printf("mailbox quota exceeded but ignored\n");
2713 if (ob->quota_filecount_value > 0
2714 && mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2715 ob->quota_filecount_value)
2716 if (!ob->quota_filecount_no_check)
2718 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2720 errno = ERRNO_EXIMQUOTA;
2721 filecount_msg = US" filecount";
2723 else DEBUG(D_transport) if (ob->quota_filecount_no_check)
2724 debug_printf("mailbox file count quota exceeded but ignored\n");
2730 addr->basic_errno = errno;
2731 addr->message = US"Over quota";
2732 addr->transport_return = yield;
2734 debug_printf("appendfile (verify) yields %d with errno=%d more_errno=%d\n",
2735 yield, addr->basic_errno, addr->more_errno);
2740 /* If we are writing in MBX format, what we actually do is to write the message
2741 to a temporary file, and then copy it to the real file once we know its size.
2742 This is the most straightforward way of getting the correct length in the
2743 separator line. So, what we do here is to save the real file descriptor, and
2744 replace it with one for a temporary file. The temporary file gets unlinked once
2745 opened, so that it goes away on closure. */
2748 if (yield == OK && ob->mbx_format)
2750 if (!(temp_file = tmpfile()))
2752 addr->basic_errno = errno;
2753 addr->message = US"while setting up temporary file";
2758 fd = fileno(temp_file);
2759 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2761 #endif /* SUPPORT_MBX */
2763 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2766 transport_count = 0;
2767 transport_newlines = 0;
2769 /* Write any configured prefix text first */
2771 if (yield == OK && ob->message_prefix && *ob->message_prefix)
2773 uschar *prefix = expand_string(ob->message_prefix);
2776 errno = ERRNO_EXPANDFAIL;
2777 addr->transport_return = PANIC;
2778 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2779 "transport) failed", ob->message_prefix, tblock->name);
2782 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2785 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2786 various different values for batching are handled outside; if there is more
2787 than one address available here, all must be included. If any address is a
2788 file, use its parent in the RCPT TO. */
2790 if (yield == OK && ob->use_bsmtp)
2792 transport_count = 0;
2793 transport_newlines = 0;
2794 if (ob->use_crlf) cr = US"\r";
2795 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2799 transport_newlines++;
2800 for (address_item * a = addr; a; a = a->next)
2802 address_item * b = testflag(a, af_pfr) ? a->parent : a;
2803 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2804 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2805 { yield = DEFER; break; }
2806 transport_newlines++;
2808 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2811 transport_newlines++;
2815 /* Now the message itself. The options for transport_write_message were set up
2816 at initialization time. */
2820 transport_ctx tctx = {
2824 .check_string = ob->check_string,
2825 .escape_string = ob->escape_string,
2826 .options = ob->options | topt_not_socket
2828 if (!transport_write_message(&tctx, 0))
2832 /* Now a configured suffix. */
2834 if (yield == OK && ob->message_suffix && *ob->message_suffix)
2836 uschar *suffix = expand_string(ob->message_suffix);
2839 errno = ERRNO_EXPANDFAIL;
2840 addr->transport_return = PANIC;
2841 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2842 "transport) failed", ob->message_suffix, tblock->name);
2845 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2848 /* If batch smtp, write the terminating dot. */
2850 if (yield == OK && ob->use_bsmtp)
2851 if (!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2852 else transport_newlines++;
2854 /* If MBX format is being used, all that writing was to the temporary file.
2855 However, if there was an earlier failure (Exim quota exceeded, for example),
2856 the temporary file won't have got opened - and no writing will have been done.
2857 If writing was OK, we restore the fd, and call a function that copies the
2858 message in MBX format into the real file. Otherwise use the temporary name in
2862 if (temp_file && ob->mbx_format)
2869 transport_count = 0; /* Reset transport count for actual write */
2870 /* No need to reset transport_newlines as we're just using a block copy
2871 * routine so the number won't be affected */
2872 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2874 else if (errno >= 0) dataname = US"temporary file";
2876 /* Preserve errno while closing the temporary file. */
2878 mbx_save_errno = errno;
2879 (void)fclose(temp_file);
2880 errno = mbx_save_errno;
2882 #endif /* SUPPORT_MBX */
2884 /* Force out the remaining data to check for any errors; some OS don't allow
2885 fsync() to be called for a FIFO. */
2887 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2889 /* Update message_size and message_linecount to the accurate count of bytes
2890 written, including added headers. Note; we subtract 1 from message_linecount as
2891 this variable doesn't count the new line between the header and the body of the
2894 message_size = transport_count;
2895 message_linecount = transport_newlines - 1;
2897 /* If using a maildir++ quota file, add this message's size to it, and
2898 close the file descriptor, except when the quota has been disabled because we
2899 are delivering into an uncounted folder. */
2901 #ifdef SUPPORT_MAILDIR
2904 if (yield == OK && maildirsize_fd >= 0)
2905 maildir_record_length(maildirsize_fd, message_size);
2906 maildir_save_errno = errno; /* Preserve errno while closing the file */
2907 if (maildirsize_fd >= 0)
2908 (void)close(maildirsize_fd);
2909 errno = maildir_save_errno;
2911 #endif /* SUPPORT_MAILDIR */
2913 /* If there is a quota warning threshold and we are have crossed it with this
2914 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2917 if (!disable_quota && THRESHOLD_CHECK)
2919 off_t threshold = ob->quota_warn_threshold_value;
2920 if (ob->quota_warn_threshold_is_percent)
2921 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
2923 debug_printf("quota = " OFF_T_FMT
2924 " threshold = " OFF_T_FMT
2925 " old size = " OFF_T_FMT
2926 " message size = %d\n",
2927 ob->quota_value, threshold, mailbox_size,
2929 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2930 addr->special_action = SPECIAL_WARN;
2932 /******* You might think that the test ought to be this:
2934 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2935 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2937 * (indeed, I was sent a patch with that in). However, it is possible to
2938 * have a warning threshold without actually imposing a quota, and I have
2939 * therefore kept Exim backwards compatible.
2944 /* Handle error while writing the file. Control should come here directly after
2945 the error, with the reason in errno. In the case of expansion failure in prefix
2946 or suffix, it will be ERRNO_EXPANDFAIL. */
2950 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2952 /* Save the error number. If positive, it will ultimately cause a strerror()
2953 call to generate some text. */
2955 addr->basic_errno = errno;
2957 /* For system or Exim quota excession, or disk full, set more_errno to the
2958 time since the file was last read. If delivery was into a directory, the
2959 time since last read logic is not relevant, in general. However, for maildir
2960 deliveries we can approximate it by looking at the last modified time of the
2961 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2962 "new" subdirectory implies that an MUA has moved a message from there to the
2965 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2967 addr->more_errno = 0;
2968 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2970 #ifdef SUPPORT_MAILDIR
2971 else if (mbformat == mbf_maildir)
2973 struct stat statbuf;
2974 if (Ustat("new", &statbuf) < 0)
2976 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2977 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2979 else /* Want a repeatable time when in test harness */
2980 addr->more_errno = f.running_in_test_harness ? 10 :
2981 (int)time(NULL) - statbuf.st_mtime;
2984 debug_printf("maildir: time since \"new\" directory modified = %s\n",
2985 readconf_printtime(addr->more_errno));
2987 #endif /* SUPPORT_MAILDIR */
2990 /* Handle system quota excession. Add an explanatory phrase for the error
2991 message, since some systems don't have special quota-excession errors,
2992 and on those that do, "quota" doesn't always mean anything to the user. */
2994 if (errno == errno_quota)
2997 addr->message = string_sprintf("mailbox is full "
2998 "(quota exceeded while writing to file %s)", filename);
3000 addr->message = US"mailbox is full";
3002 addr->user_message = US"mailbox is full";
3003 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3005 isdirectory ? US"" : US": time since file read = ",
3006 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3009 /* Handle Exim's own quota-imposition */
3011 else if (errno == ERRNO_EXIMQUOTA)
3013 addr->message = string_sprintf("mailbox is full "
3014 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3016 addr->user_message = US"mailbox is full";
3017 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3018 filecount_msg, dataname,
3019 isdirectory ? US"" : US": time since file read = ",
3020 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3023 /* Handle a process failure while writing via a filter; the return
3024 from child_close() is in more_errno. */
3026 else if (errno == ERRNO_FILTER_FAIL)
3029 addr->message = string_sprintf("transport filter process failed (%d) "
3030 "while writing to %s%s", addr->more_errno, dataname,
3031 (addr->more_errno == EX_EXECFAILED) ? ": unable to execute command" : "");
3034 /* Handle failure to expand header changes */
3036 else if (errno == ERRNO_CHHEADER_FAIL)
3040 string_sprintf("failed to expand headers_add or headers_remove while "
3041 "writing to %s: %s", dataname, expand_string_message);
3044 /* Handle failure to complete writing of a data block */
3046 else if (errno == ERRNO_WRITEINCOMPLETE)
3047 addr->message = string_sprintf("failed to write data block while "
3048 "writing to %s", dataname);
3050 /* Handle length mismatch on MBX copying */
3053 else if (errno == ERRNO_MBXLENGTH)
3054 addr->message = string_sprintf("length mismatch while copying MBX "
3055 "temporary file to %s", dataname);
3056 #endif /* SUPPORT_MBX */
3058 /* For other errors, a general-purpose explanation, if the message is
3061 else if (addr->message == NULL)
3062 addr->message = string_sprintf("error while writing to %s", dataname);
3064 /* For a file, reset the file size to what it was before we started, leaving
3065 the last modification time unchanged, so it will get reset also. All systems
3066 investigated so far have ftruncate(), whereas not all have the F_FREESP
3067 fcntl() call (BSDI & FreeBSD do not). */
3069 if (!isdirectory && ftruncate(fd, saved_size))
3070 DEBUG(D_transport) debug_printf("Error resetting file size\n");
3073 /* Handle successful writing - we want the modification time to be now for
3074 appended files. Remove the default backstop error number. For a directory, now
3075 is the time to rename the file with a unique name. As soon as such a name
3076 appears it may get used by another process, so we close the file first and
3077 check that all is well. */
3081 times.modtime = time(NULL);
3082 addr->basic_errno = 0;
3084 /* Handle the case of writing to a new file in a directory. This applies
3085 to all single-file formats - maildir, mailstore, and "smail format". */
3089 if (fstat(fd, &statbuf) < 0)
3091 addr->basic_errno = errno;
3092 addr->message = string_sprintf("while fstatting opened message file %s",
3097 else if (close(fd) < 0)
3099 addr->basic_errno = errno;
3100 addr->message = string_sprintf("close() error for %s",
3101 (ob->mailstore_format) ? dataname : filename);
3105 /* File is successfully written and closed. Arrange to rename it. For the
3106 different kinds of single-file delivery, some games can be played with the
3107 name. The message size is by this time set to the accurate value so that
3108 its value can be used in expansions. */
3112 uschar *renamename = newname;
3115 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3117 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3118 situation. The name is built by expanding the directory_file option, and
3119 we make the inode number available for use in this. The expansion was
3120 checked for syntactic validity above, before we wrote the file.
3122 We have to be careful here, in case the file name exists. (In the other
3123 cases, the names used are constructed to be unique.) The rename()
3124 function just replaces an existing file - we don't want that! So instead
3125 of calling rename(), we must use link() and unlink().
3127 In this case, if the link fails because of an existing file, we wait
3128 for one second and try the expansion again, to see if it produces a
3129 different value. Do this up to 5 times unless the name stops changing.
3130 This makes it possible to build values that are based on the time, and
3131 still cope with races from multiple simultaneous deliveries. */
3136 uschar *old_renameleaf = US"";
3138 for (int i = 0; ; sleep(1), i++)
3140 deliver_inode = statbuf.st_ino;
3141 renameleaf = expand_string(ob->dirfilename);
3146 addr->transport_return = PANIC;
3147 addr->message = string_sprintf("Expansion of \"%s\" "
3148 "(directory_file for %s transport) failed: %s",
3149 ob->dirfilename, tblock->name, expand_string_message);
3153 renamename = string_sprintf("%s/%s", path, renameleaf);
3154 if (Ulink(filename, renamename) < 0)
3156 DEBUG(D_transport) debug_printf("link failed: %s\n",
3158 if (errno != EEXIST || i >= 4 ||
3159 Ustrcmp(renameleaf, old_renameleaf) == 0)
3161 addr->basic_errno = errno;
3162 addr->message = string_sprintf("while renaming %s as %s",
3163 filename, renamename);
3167 old_renameleaf = renameleaf;
3168 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3177 } /* re-expand loop */
3178 } /* not mailstore or maildir */
3180 /* For maildir and mailstore formats, the new name was created earlier,
3181 except that for maildir, there is the possibility of adding a "tag" on
3182 the end of the name by expanding the value of nametag. This usually
3183 includes a reference to the message size. The expansion of nametag was
3184 checked above, before the file was opened. It either succeeded, or
3185 provoked a soft failure. So any failure here can be treated as soft.
3186 Ignore non-printing characters and / and put a colon at the start if the
3187 first character is alphanumeric. */
3193 uschar *iptr = expand_string(nametag);
3196 uschar *etag = store_get(Ustrlen(iptr) + 2, iptr);
3197 uschar *optr = etag;
3198 for ( ; *iptr; iptr++)
3199 if (mac_isgraph(*iptr) && *iptr != '/')
3201 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3205 renamename = string_sprintf("%s%s", newname, etag);
3209 /* Do the rename. If the name is too long and a tag exists, try again
3212 if (Urename(filename, renamename) < 0 &&
3213 (nametag == NULL || errno != ENAMETOOLONG ||
3214 (renamename = newname, Urename(filename, renamename) < 0)))
3216 addr->basic_errno = errno;
3217 addr->message = string_sprintf("while renaming %s as %s",
3218 filename, renamename);
3222 /* Rename succeeded */
3226 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3228 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3230 } /* maildir or mailstore */
3231 } /* successful write + close */
3233 } /* write success */
3236 /* For a file, restore the last access time (atime), and set the modification
3237 time as required - changed if write succeeded, unchanged if not. */
3239 if (!isdirectory) utime(CS filename, ×);
3241 /* Notify comsat if configured to do so. It only makes sense if the configured
3242 file is the one that the comsat daemon knows about. */
3244 if (ob->notify_comsat && yield == OK && deliver_localpart)
3245 notify_comsat(deliver_localpart, saved_size);
3247 /* Pass back the final return code in the address structure */
3250 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3251 yield, addr->basic_errno, addr->more_errno);
3253 addr->transport_return = yield;
3255 /* Close the file, which will release the fcntl lock. For a directory write it
3256 is closed above, except in cases of error which goto RETURN, when we also need
3257 to remove the original file(s). For MBX locking, if all has gone well, before
3258 closing the file, see if we can get an exclusive lock on it, in which case we
3259 can unlink the /tmp lock file before closing it. This is always a non-blocking
3260 lock; there's no need to wait if we can't get it. If everything has gone right
3261 but close fails, defer the message. Then unlink the lock file, if present. This
3262 point in the code is jumped to from a number of places when errors are
3263 detected, in order to get the file closed and the lock file tidied away. */
3268 if (mbx_lockfd >= 0)
3270 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3271 ob->use_flock, 0) >= 0)
3274 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3275 Uunlink(mbx_lockname);
3277 (void)close(mbx_lockfd);
3279 #endif /* SUPPORT_MBX */
3281 if (fd >= 0 && close(fd) < 0 && yield == OK)
3283 addr->basic_errno = errno;
3284 addr->message = string_sprintf("while closing %s", filename);
3285 addr->transport_return = DEFER;
3288 if (hd >= 0) Uunlink(lockname);
3290 /* We get here with isdirectory and filename set only in error situations. */
3292 if (isdirectory && filename)
3295 if (dataname != filename) Uunlink(dataname);
3298 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3299 file name relies on time + pid. We must not allow the process to finish until
3300 the clock has move on by at least one microsecond. Usually we expect this
3301 already to be the case, but machines keep getting faster... */
3303 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3305 /* A return of FALSE means that if there was an error, a common error was
3306 put in the first address of a batch. */
3311 addr->message = string_sprintf("Tainted '%s' (file or directory "
3312 "name for %s transport) not permitted", path, tblock->name);
3314 addr->transport_return = PANIC;
3318 #endif /*!MACRO_PREDEF*/
3319 /* End of transport/appendfile.c */