+
+
+/****************************************************
+ Verify a local user account for quota sufficiency
+****************************************************/
+
+/* The real work, done via a re-exec for privs, calls
+down to the transport for the quota check.
+
+Route and transport (in recipient-verify mode) the
+given recipient.
+
+A routing result indicating any transport type other than appendfile
+results in a fail.
+
+Return, on stdout, a result string containing:
+- highlevel result code (OK, DEFER, FAIL)
+- errno
+- where string
+- message string
+*/
+
+void
+verify_quota(uschar * address)
+{
+address_item vaddr = {.address = address};
+BOOL routed;
+uschar * msg = US"\0";
+int rc, len = 1;
+
+if ((rc = verify_address(&vaddr, NULL, vopt_is_recipient | vopt_quota,
+ 1, 0, 0, NULL, NULL, &routed)) != OK)
+ {
+ uschar * where = recipient_verify_failure;
+ msg = acl_verify_message ? acl_verify_message : vaddr.message;
+ if (!msg) msg = US"";
+ if (rc == DEFER && vaddr.basic_errno == ERRNO_EXIMQUOTA)
+ {
+ rc = FAIL; /* DEFER -> FAIL */
+ where = US"quota";
+ vaddr.basic_errno = 0;
+ }
+ else if (!where) where = US"";
+
+ len = 5 + Ustrlen(msg) + 1 + Ustrlen(where);
+ msg = string_sprintf("%c%c%c%c%c%s%c%s", (uschar)rc,
+ (vaddr.basic_errno >> 24) && 0xff, (vaddr.basic_errno >> 16) && 0xff,
+ (vaddr.basic_errno >> 8) && 0xff, vaddr.basic_errno && 0xff,
+ where, '\0', msg);
+ }
+
+DEBUG(D_verify) debug_printf_indent("verify_quota: len %d\n", len);
+write(1, msg, len);
+return;
+}
+
+
+/******************************************************************************/
+
+/* Quota cache lookup. We use the callout hints db also for the quota cache.
+Return TRUE if a nonexpired record was found, having filled in the yield
+argument.
+*/
+
+static BOOL
+cached_quota_lookup(const uschar * rcpt, int * yield,
+ int pos_cache, int neg_cache)
+{
+open_db dbblock, *dbm_file = NULL;
+dbdata_callout_cache_address * cache_address_record;
+
+if (!pos_cache && !neg_cache)
+ return FALSE;
+if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
+ {
+ HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
+ return FALSE;
+ }
+if (!(cache_address_record = (dbdata_callout_cache_address *)
+ get_callout_cache_record(dbm_file, rcpt, US"address",
+ pos_cache, neg_cache)))
+ {
+ dbfn_close(dbm_file);
+ return FALSE;
+ }
+if (cache_address_record->result == ccache_accept)
+ *yield = OK;
+dbfn_close(dbm_file);
+return TRUE;
+}
+
+/* Quota cache write */
+
+static void
+cache_quota_write(const uschar * rcpt, int yield, int pos_cache, int neg_cache)
+{
+open_db dbblock, *dbm_file = NULL;
+dbdata_callout_cache_address cache_address_record;
+
+if (!pos_cache && !neg_cache)
+ return;
+if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
+ {
+ HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
+ return;
+ }
+
+cache_address_record.result = yield == OK ? ccache_accept : ccache_reject;
+
+(void)dbfn_write(dbm_file, rcpt, &cache_address_record,
+ (int)sizeof(dbdata_callout_cache_address));
+HDEBUG(D_verify) debug_printf_indent("wrote %s quota cache record for %s\n",
+ yield == OK ? "positive" : "negative", rcpt);
+
+dbfn_close(dbm_file);
+return;
+}
+
+
+/* To evaluate a local user's quota, starting in ACL, we need to
+fork & exec to regain privileges, to that we can change to the user's
+identity for access to their files.
+
+Arguments:
+ rcpt Recipient account
+ pos_cache Number of seconds to cache a positive result (delivery
+ to be accepted). Zero to disable caching.
+ neg_cache Number of seconds to cache a negative result. Zero to disable.
+ msg Pointer to result string pointer
+
+Return: OK/DEFER/FAIL code
+*/
+
+int
+verify_quota_call(const uschar * rcpt, int pos_cache, int neg_cache,
+ uschar ** msg)
+{
+int pfd[2], pid, save_errno, yield = FAIL;
+void (*oldsignal)(int);
+const uschar * where = US"socketpair";
+
+*msg = NULL;
+
+if (cached_quota_lookup(rcpt, &yield, pos_cache, neg_cache))
+ {
+ HDEBUG(D_verify) debug_printf_indent("quota cache: address record is %d\n",
+ yield == OK ? "positive" : "negative");
+ if (yield != OK)
+ {
+ recipient_verify_failure = US"quota";
+ acl_verify_message = *msg =
+ US"Previous (cached) quota verification failure";
+ }
+ return yield;
+ }
+
+if (pipe(pfd) != 0)
+ goto fail;
+
+where = US"fork";
+oldsignal = signal(SIGCHLD, SIG_DFL);
+if ((pid = exim_fork(US"quota-verify")) < 0)
+ {
+ save_errno = errno;
+ close(pfd[pipe_write]);
+ close(pfd[pipe_read]);
+ errno = save_errno;
+ goto fail;
+ }
+
+if (pid == 0) /* child */
+ {
+ close(pfd[pipe_read]);
+ force_fd(pfd[pipe_write], 1); /* stdout to pipe */
+ close(pfd[pipe_write]);
+ dup2(1, 0);
+ if (debug_fd > 0) force_fd(debug_fd, 2);
+
+ child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 3,
+ US"-MCq", string_sprintf("%d", message_size), rcpt);
+ /*NOTREACHED*/
+ }
+
+save_errno = errno;
+close(pfd[pipe_write]);
+
+if (pid < 0)
+ {
+ DEBUG(D_verify) debug_printf_indent(" fork: %s\n", strerror(save_errno));
+ }
+else
+ {
+ uschar buf[128];
+ int n = read(pfd[pipe_read], buf, sizeof(buf));
+ int status;
+
+ waitpid(pid, &status, 0);
+ if (status == 0)
+ {
+ uschar * s;
+
+ if (n > 0) yield = buf[0];
+ if (n > 4)
+ save_errno = (buf[1] << 24) | (buf[2] << 16) | (buf[3] << 8) | buf[4];
+ if ((recipient_verify_failure = n > 5
+ ? string_copyn_taint(buf+5, n-5, FALSE) : NULL))
+ {
+ int m;
+ s = buf + 5 + Ustrlen(recipient_verify_failure) + 1;
+ m = n - (s - buf);
+ acl_verify_message = *msg =
+ m > 0 ? string_copyn_taint(s, m, FALSE) : NULL;
+ }
+
+ DEBUG(D_verify) debug_printf_indent("verify call response:"
+ " len %d yield %s errno '%s' where '%s' msg '%s'\n",
+ n, rc_names[yield], strerror(save_errno), recipient_verify_failure, *msg);
+
+ if ( yield == OK
+ || save_errno == 0 && Ustrcmp(recipient_verify_failure, "quota") == 0)
+ cache_quota_write(rcpt, yield, pos_cache, neg_cache);
+ else DEBUG(D_verify)
+ debug_printf_indent("result not cacheable\n");
+ }
+ else
+ {
+ DEBUG(D_verify)
+ debug_printf_indent("verify call response: waitpid status 0x%04x\n", status);
+ }
+ }
+
+close(pfd[pipe_read]);
+errno = save_errno;
+
+fail:
+
+return yield;
+}
+
+
git://git.exim.org / exim.git / blobdiff