+ *errstr = US"Internal error";
+ log_write(0, LOG_MAIN|LOG_PANIC, "expansion of %s failed: %s", name,
+ expand_string_message);
+ return FALSE;
+ }
+return TRUE;
+}
+
+
+#if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
+/* Add the directory for a filename to the inotify handle, creating that if
+needed. This is enough to see changes to files in that dir.
+Return boolean success.
+
+The word "system" fails, which is on the safe side as we don't know what
+directory it implies nor if the TLS library handles a watch for us.
+
+The string "system,cache" is recognised and explicitly accepted without
+setting a watch. This permits the system CA bundle to be cached even though
+we have no way to tell when it gets modified by an update.
+The call chain for OpenSSL uses a (undocumented) call into the library
+to discover the actual file. We don't know what GnuTLS uses.
+
+A full set of caching including the CAs takes 35ms output off of the
+server tls_init() (GnuTLS, Fedora 32, 2018-class x86_64 laptop hardware).
+*/
+static BOOL
+tls_set_one_watch(const uschar * filename)
+# ifdef EXIM_HAVE_INOTIFY
+{
+uschar * s;
+
+if (Ustrcmp(filename, "system,cache") == 0) return TRUE;
+
+if (!(s = Ustrrchr(filename, '/'))) return FALSE;
+s = string_copyn(filename, s - filename); /* mem released by tls_set_watch */
+DEBUG(D_tls) debug_printf("watch dir '%s'\n", s);
+
+/*XXX unclear what effect symlinked files will have for inotify */
+
+if (inotify_add_watch(tls_watch_fd, CCS s,
+ IN_ONESHOT | IN_CLOSE_WRITE | IN_DELETE | IN_DELETE_SELF
+ | IN_MOVED_FROM | IN_MOVED_TO | IN_MOVE_SELF) >= 0)
+ return TRUE;
+DEBUG(D_tls) debug_printf("notify_add_watch: %s\n", strerror(errno));
+return FALSE;
+}
+# endif
+# ifdef EXIM_HAVE_KEVENT
+{
+uschar * s, * t;
+int fd1, fd2, i, j, cnt = 0;
+struct stat sb;
+#ifdef OpenBSD
+struct kevent k_dummy;
+struct timespec ts = {0};
+#endif
+
+errno = 0;
+if (Ustrcmp(filename, "system,cache") == 0) return TRUE;
+
+for (;;)
+ {
+ if (kev_used > KEV_SIZE-2) { s = US"out of kev space"; goto bad; }
+ if (!(s = Ustrrchr(filename, '/'))) return FALSE;
+ s = string_copyn(filename, s - filename); /* mem released by tls_set_watch */
+
+ /* The dir open will fail if there is a symlink on the path. Fine; it's too
+ much effort to handle all possible cases; just refuse the preload. */
+
+ if ((fd2 = open(CCS s, O_RDONLY | O_NOFOLLOW)) < 0) { s = US"open dir"; goto bad; }
+
+ if ((lstat(CCS filename, &sb)) < 0) { s = US"lstat"; goto bad; }
+ if (!S_ISLNK(sb.st_mode))
+ {
+ if ((fd1 = open(CCS filename, O_RDONLY | O_NOFOLLOW)) < 0)
+ { s = US"open file"; goto bad; }
+ DEBUG(D_tls) debug_printf("watch file '%s':\t%d\n", filename, fd1);
+ EV_SET(&kev[kev_used++],
+ (uintptr_t)fd1,
+ EVFILT_VNODE,
+ EV_ADD | EV_ENABLE | EV_ONESHOT,
+ NOTE_DELETE | NOTE_WRITE | NOTE_EXTEND
+ | NOTE_ATTRIB | NOTE_RENAME | NOTE_REVOKE,
+ 0,
+ NULL);
+ cnt++;
+ }
+ DEBUG(D_tls) debug_printf("watch dir '%s':\t%d\n", s, fd2);
+ EV_SET(&kev[kev_used++],
+ (uintptr_t)fd2,
+ EVFILT_VNODE,
+ EV_ADD | EV_ENABLE | EV_ONESHOT,
+ NOTE_DELETE | NOTE_WRITE | NOTE_EXTEND
+ | NOTE_ATTRIB | NOTE_RENAME | NOTE_REVOKE,
+ 0,
+ NULL);
+ cnt++;
+
+ if (!(S_ISLNK(sb.st_mode))) break;
+
+ t = store_get(1024, GET_UNTAINTED);
+ Ustrncpy(t, s, 1022);
+ j = Ustrlen(s);
+ t[j++] = '/';
+ if ((i = readlink(CCS filename, (void *)(t+j), 1023-j)) < 0) { s = US"readlink"; goto bad; }
+ filename = t;
+ *(t += i+j) = '\0';
+ store_release_above(t+1);
+ }
+
+#ifdef OpenBSD
+if (kevent(tls_watch_fd, &kev[kev_used-cnt], cnt, &k_dummy, 1, &ts) >= 0)
+ return TRUE;
+#else
+if (kevent(tls_watch_fd, &kev[kev_used-cnt], cnt, NULL, 0, NULL) >= 0)
+ return TRUE;
+#endif
+s = US"kevent";
+
+bad:
+DEBUG(D_tls)
+ if (errno)
+ debug_printf("%s: %s: %s\n", __FUNCTION__, s, strerror(errno));
+ else
+ debug_printf("%s: %s\n", __FUNCTION__, s);
+return FALSE;
+}
+# endif /*EXIM_HAVE_KEVENT*/
+
+
+/* Create an inotify facility if needed.
+Then set watches on the dir containing the given file or (optionally)
+list of files. Return boolean success. */
+
+static BOOL
+tls_set_watch(const uschar * filename, BOOL list)
+{
+rmark r;
+BOOL rc = FALSE;
+
+if (!filename || !*filename) return TRUE;
+if (Ustrncmp(filename, "system", 6) == 0) return TRUE;
+
+DEBUG(D_tls) debug_printf("tls_set_watch: '%s'\n", filename);
+
+if ( tls_watch_fd < 0
+# ifdef EXIM_HAVE_INOTIFY
+ && (tls_watch_fd = inotify_init1(O_CLOEXEC)) < 0
+# endif
+# ifdef EXIM_HAVE_KEVENT
+ && (tls_watch_fd = kqueue()) < 0
+# endif
+ )