build: use pkg-config for i18n

[exim.git] / src / src / dbfn.c

diff --git a/src/src/dbfn.c b/src/src/dbfn.c
index 5f39af2205f01930965bfaa427b7d2297c1e34e8..98aebe0165024d3d9458aa15e3e4f7795528e349 100644 (file)
--- a/src/src/dbfn.c
+++ b/src/src/dbfn.c
@@ -2,18 +2,25 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 

+/* Copyright (c) The Exim Maintainers 2020 - 2024 */

 /* Copyright (c) University of Cambridge 1995 - 2018 */
 /* See the file NOTICE for conditions of use and distribution. */
 /* Copyright (c) University of Cambridge 1995 - 2018 */
 /* See the file NOTICE for conditions of use and distribution. */

+/* SPDX-License-Identifier: GPL-2.0-or-later */

 
 
 #include "exim.h"
 
 
 
 #include "exim.h"
 

+/* We have buffers holding path names for database files.
+PATH_MAX could be used here, but would be wasting memory, as we deal
+with database files like $spooldirectory/db/<name> */
+#define PATHLEN 256
+

 
 /* Functions for accessing Exim's hints database, which consists of a number of
 different DBM files. This module does not contain code for reading DBM files
 for (e.g.) alias expansion. That is all contained within the general search
 functions. As Exim now has support for several DBM interfaces, all the relevant
 
 /* Functions for accessing Exim's hints database, which consists of a number of
 different DBM files. This module does not contain code for reading DBM files
 for (e.g.) alias expansion. That is all contained within the general search
 functions. As Exim now has support for several DBM interfaces, all the relevant

-functions are called as macros.
+functions are called as inlinable functions from an included file.

 
 All the data in Exim's database is in the nature of *hints*. Therefore it
 doesn't matter if it gets destroyed by accident. These functions are not
 
 All the data in Exim's database is in the nature of *hints*. Therefore it
 doesn't matter if it gets destroyed by accident. These functions are not


@@ -28,70 +35,145 @@ means of locking on independent lock files. (Earlier attempts to lock on the
 DBM files themselves were never completely successful.) Since callers may in
 general want to do more than one read or write while holding the lock, there
 are separate open and close functions. However, the calling modules should
 DBM files themselves were never completely successful.) Since callers may in
 general want to do more than one read or write while holding the lock, there
 are separate open and close functions. However, the calling modules should

-arrange to hold the locks for the bare minimum of time. */
+arrange to hold the locks for the bare minimum of time.
+
+API:
+  exim_lockfile_needed                 facilities predicate
+  dbfn_open_path                       full pathname; no lock taken, readonly
+  dbfn_open                            takes lockfile or opens transaction
+  dbfn_open_multi                      only if transactions supported;
+                                       no lock or transaction taken
+  dbfn_close                           release lockfile or transaction
+  dbfn_close_multi
+  dbfn_transaction_start               only if transactions supported
+  dbfn_transaction_commit
+  dbfn_read_klen                       explicit key length; embedded NUL ok
+  dbfn_read_with_length
+  dbfn_read_enforce_length
+  dbfn_write
+  dbfn_delete
+  dbfn_scan                            unused; ifdeffout out
+
+Users:
+  ACL ratelimit & seen conditions
+  delivery retry handling
+  delivery serialization
+  TLS session resumption
+  peer capability cache
+  callout & quota cache
+  DBM lookup type
+*/

 
 
 
 /*************************************************
 
 
 
 /*************************************************

-*         Berkeley DB error callback             *
+*          Open and lock a database file         *

 *************************************************/
 
 *************************************************/
 

-/* For Berkeley DB >= 2, we can define a function to be called in case of DB
-errors. This should help with debugging strange DB problems, e.g. getting "File
-exists" when you try to open a db file. The API for this function was changed
-at DB release 4.3. */
+/* Used by DBM lookups:
+full pathname for DB file rather than hintsdb name, readonly, no locking. */

 
 

-#if defined(USE_DB) && defined(DB_VERSION_STRING)
-void
-#if DB_VERSION_MAJOR > 4 || (DB_VERSION_MAJOR == 4 && DB_VERSION_MINOR >= 3)
-dbfn_bdb_error_callback(const DB_ENV *dbenv, const char *pfx, const char *msg)
+open_db *
+dbfn_open_path(const uschar * path, open_db * dbblock)

 {
 {

-dbenv = dbenv;
-#else
-dbfn_bdb_error_callback(const char *pfx, char *msg)
+uschar * dirname = string_copy(path);
+
+dbblock->readonly = TRUE;
+dbblock->lockfd = -1;
+dbblock->dbptr = !exim_lockfile_needed()
+  ? exim_dbopen_multi(path, dirname, O_RDONLY, 0)
+  : exim_dbopen(path, dirname, O_RDONLY, 0);
+return dbblock->dbptr ? dbblock : NULL;;
+}
+
+/* Ensure the directory for the DB is present */
+
+static inline void
+db_dir_make(BOOL panic)

 {
 {

-#endif
-pfx = pfx;
-log_write(0, LOG_MAIN, "Berkeley DB error: %s", msg);
+(void) directory_make(spool_directory, US"db", EXIMDB_DIRECTORY_MODE, panic);

 }
 }

-#endif

 
 
 
 

+/* Lock a file to protect the DB.  Return TRUE for success */

 
 

+static inline BOOL
+lockfile_take(open_db * dbblock, const uschar * filename, BOOL rdonly, BOOL panic)
+{
+flock_t lock_data;
+int rc, * fdp = &dbblock->lockfd;

 
 

-/*************************************************
-*          Open and lock a database file         *
-*************************************************/
+priv_drop_temp(exim_uid, exim_gid);
+if ((*fdp = Uopen(filename, O_RDWR, EXIMDB_LOCKFILE_MODE)) < 0)
+  {
+  db_dir_make(panic);
+  *fdp = Uopen(filename, O_RDWR|O_CREAT, EXIMDB_LOCKFILE_MODE);
+  }
+priv_restore();
+
+if (*fdp < 0)
+  {
+  log_write(0, LOG_MAIN, "%s",
+    string_open_failed("database lock file %s", filename));
+  errno = 0;      /* Indicates locking failure */
+  return FALSE;
+  }
+
+/* Now we must get a lock on the opened lock file; do this with a blocking
+lock that times out. */
+
+lock_data.l_type = rdonly ? F_RDLCK : F_WRLCK;
+lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
+
+DEBUG(D_hints_lookup|D_retry|D_route|D_deliver)
+  debug_printf_indent("locking %s\n", filename);
+
+sigalrm_seen = FALSE;
+ALARM(EXIMDB_LOCK_TIMEOUT);
+rc = fcntl(*fdp, F_SETLKW, &lock_data);
+ALARM_CLR(0);
+
+if (sigalrm_seen) errno = ETIMEDOUT;
+if (rc < 0)
+  {
+  log_write(0, LOG_MAIN|LOG_PANIC, "Failed to get %s lock for %s: %s",
+    rdonly ? "read" : "write", filename,
+    errno == ETIMEDOUT ? "timed out" : strerror(errno));
+  (void)close(*fdp); *fdp = -1;
+  errno = 0;       /* Indicates locking failure */
+  return FALSE;
+  }
+
+DEBUG(D_hints_lookup) debug_printf_indent("locked  %s\n", filename);
+return TRUE;
+}

 
 /* Used for accessing Exim's hints databases.
 
 Arguments:
   name     The single-component name of one of Exim's database files.
   flags    Either O_RDONLY or O_RDWR, indicating the type of open required;
 
 /* Used for accessing Exim's hints databases.
 
 Arguments:
   name     The single-component name of one of Exim's database files.
   flags    Either O_RDONLY or O_RDWR, indicating the type of open required;

-             O_RDWR implies "create if necessary"
+             optionally O_CREAT

   dbblock  Points to an open_db block to be filled in.
   lof      If TRUE, write to the log for actual open failures (locking failures
            are always logged).
   dbblock  Points to an open_db block to be filled in.
   lof      If TRUE, write to the log for actual open failures (locking failures
            are always logged).

+  panic           If TRUE, panic on failure to create the db directory

 
 Returns:   NULL if the open failed, or the locking failed. After locking
            failures, errno is zero.
 
            On success, dbblock is returned. This contains the dbm pointer and
            the fd of the locked lock file.
 
 Returns:   NULL if the open failed, or the locking failed. After locking
            failures, errno is zero.
 
            On success, dbblock is returned. This contains the dbm pointer and
            the fd of the locked lock file.

-
-There are some calls that use O_RDWR|O_CREAT for the flags. Having discovered
-this in December 2005, I'm not sure if this is correct or not, but for the
-moment I haven't changed them.

 */
 
 open_db *
 */
 
 open_db *

-dbfn_open(uschar *name, int flags, open_db *dbblock, BOOL lof)
+dbfn_open(const uschar * name, int flags, open_db * dbblock,
+  BOOL lof, BOOL panic)

 {
 {

-int rc, save_errno;
-BOOL read_only = flags == O_RDONLY;
-BOOL created = FALSE;
-flock_t lock_data;
-uschar dirname[256], filename[256];
+int save_errno, dlen, flen;
+uschar dirname[PATHLEN], filename[PATHLEN];
+
+DEBUG(D_hints_lookup) acl_level++;

 
 /* The first thing to do is to open a separate file on which to lock. This
 ensures that Exim has exclusive use of the database before it even tries to
 
 /* The first thing to do is to open a separate file on which to lock. This
 ensures that Exim has exclusive use of the database before it even tries to


@@ -106,51 +188,25 @@ make the directory as well, just in case. We won't be doing this many times
 unnecessarily, because usually the lock file will be there. If the directory
 exists, there is no error. */
 
 unnecessarily, because usually the lock file will be there. If the directory
 exists, there is no error. */
 

-snprintf(CS dirname, sizeof(dirname), "%s/db", spool_directory);
-snprintf(CS filename, sizeof(filename), "%s/%s.lockfile", dirname, name);
-
-if ((dbblock->lockfd = Uopen(filename, O_RDWR, EXIMDB_LOCKFILE_MODE)) < 0)
-  {
-  created = TRUE;
-  (void)directory_make(spool_directory, US"db", EXIMDB_DIRECTORY_MODE, TRUE);
-  dbblock->lockfd = Uopen(filename, O_RDWR|O_CREAT, EXIMDB_LOCKFILE_MODE);
-  }
+dlen = snprintf(CS dirname, sizeof(dirname), "%s/db", spool_directory);

 
 

-if (dbblock->lockfd < 0)
+dbblock->readonly = (flags & O_ACCMODE) == O_RDONLY;
+dbblock->lockfd = -1;
+if (!exim_lockfile_needed())
+  db_dir_make(panic);
+else

   {
   {

-  log_write(0, LOG_MAIN, "%s",
-    string_open_failed(errno, "database lock file %s", filename));
-  errno = 0;      /* Indicates locking failure */
-  return NULL;
-  }
-
-/* Now we must get a lock on the opened lock file; do this with a blocking
-lock that times out. */
-
-lock_data.l_type = read_only? F_RDLCK : F_WRLCK;
-lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
-
-DEBUG(D_hints_lookup|D_retry|D_route|D_deliver)
-  debug_printf("locking %s\n", filename);
-
-sigalrm_seen = FALSE;
-alarm(EXIMDB_LOCK_TIMEOUT);
-rc = fcntl(dbblock->lockfd, F_SETLKW, &lock_data);
-alarm(0);
-
-if (sigalrm_seen) errno = ETIMEDOUT;
-if (rc < 0)
-  {
-  log_write(0, LOG_MAIN|LOG_PANIC, "Failed to get %s lock for %s: %s",
-    read_only ? "read" : "write", filename,
-    errno == ETIMEDOUT ? "timed out" : strerror(errno));
-  (void)close(dbblock->lockfd);
-  errno = 0;       /* Indicates locking failure */
-  return NULL;
+  flen = Ustrlen(name);
+  snprintf(CS filename, sizeof(filename), "%.*s/%.*s.lockfile",
+           (int)sizeof(filename) - dlen - flen - 11, dirname,
+           flen, name);
+  if (!lockfile_take(dbblock, filename, flags == O_RDONLY, panic))
+    {
+    DEBUG(D_hints_lookup) acl_level--;
+    return NULL;
+    }

   }
 
   }
 

-DEBUG(D_hints_lookup) debug_printf("locked  %s\n", filename);
-

 /* At this point we have an opened and locked separate lock file, that is,
 exclusive access to the database, so we can go ahead and open it. If we are
 expected to create it, don't do so at first, again so that we can detect
 /* At this point we have an opened and locked separate lock file, that is,
 exclusive access to the database, so we can go ahead and open it. If we are
 expected to create it, don't do so at first, again so that we can detect


@@ -160,58 +216,79 @@ databases - often this is caused by non-matching db.h and the library. To make
 it easy to pin this down, there are now debug statements on either side of the
 open call. */
 
 it easy to pin this down, there are now debug statements on either side of the
 open call. */
 

-snprintf(CS filename, sizeof(filename), "%s/%s", dirname, name);
-EXIM_DBOPEN(filename, dirname, flags, EXIMDB_MODE, &(dbblock->dbptr));
+snprintf(CS filename, sizeof(filename), "%.*s/%s", dlen, dirname, name);
+
+priv_drop_temp(exim_uid, exim_gid);
+dbblock->dbptr = dbblock->readonly && !exim_lockfile_needed()
+  ? exim_dbopen_multi(filename, dirname, flags & O_ACCMODE, EXIMDB_MODE)
+  : exim_dbopen(filename, dirname, flags & O_ACCMODE, EXIMDB_MODE);

 
 

-if (!dbblock->dbptr && errno == ENOENT && flags == O_RDWR)
+if (!dbblock->dbptr && errno == ENOENT && flags & O_CREAT)

   {
   DEBUG(D_hints_lookup)
   {
   DEBUG(D_hints_lookup)

-    debug_printf("%s appears not to exist: trying to create\n", filename);
-  created = TRUE;
-  EXIM_DBOPEN(filename, dirname, flags|O_CREAT, EXIMDB_MODE, &(dbblock->dbptr));
+    debug_printf_indent("%s appears not to exist: trying to create\n", filename);
+  dbblock->dbptr = exim_dbopen(filename, dirname, flags, EXIMDB_MODE);

   }
   }

-

 save_errno = errno;
 save_errno = errno;

+priv_restore();

 
 

-/* If we are running as root and this is the first access to the database, its
-files will be owned by root. We want them to be owned by exim. We detect this
-situation by noting above when we had to create the lock file or the database
-itself. Because the different dbm libraries use different extensions for their
-files, I don't know of any easier way of arranging this than scanning the
-directory for files with the appropriate base name. At least this deals with
-the lock file at the same time. Also, the directory will typically have only
-half a dozen files, so the scan will be quick.
-
-This code is placed here, before the test for successful opening, because there
-was a case when a file was created, but the DBM library still returned NULL
-because of some problem. It also sorts out the lock file if that was created
-but creation of the database file failed. */
-
-if (created && geteuid() == root_uid)
+/* If the open has failed, return NULL, leaving errno set. If lof is TRUE,
+log the event - also for debugging - but debug only if the file just doesn't
+exist. */
+
+if (!dbblock->dbptr)

   {
   {

-  DIR *dd;
-  struct dirent *ent;
-  uschar *lastname = Ustrrchr(filename, '/') + 1;
-  int namelen = Ustrlen(name);
+  errno = save_errno;
+  if (lof && save_errno != ENOENT)
+    log_write(0, LOG_MAIN, "%s", string_open_failed("DB file %s",
+        filename));
+  else
+    DEBUG(D_hints_lookup)
+      debug_printf_indent("%s\n", CS string_open_failed("DB file %s",
+          filename));
+  (void)close(dbblock->lockfd);
+  dbblock->lockfd = -1;
+  dbblock = NULL;
+  }

 
 

-  *lastname = 0;
-  dd = opendir(CS filename);
+/* Pass back the block containing the opened database handle and the open fd
+for the lock. */

 
 

-  while ((ent = readdir(dd)))
-    if (Ustrncmp(ent->d_name, name, namelen) == 0)
-      {
-      struct stat statbuf;
-      Ustrcpy(lastname, ent->d_name);
-      if (Ustat(filename, &statbuf) >= 0 && statbuf.st_uid != exim_uid)
-        {
-        DEBUG(D_hints_lookup) debug_printf("ensuring %s is owned by exim\n", filename);
-        if (Uchown(filename, exim_uid, exim_gid))
-          DEBUG(D_hints_lookup) debug_printf("failed setting %s to owned by exim\n", filename);
-        }
-      }
+DEBUG(D_hints_lookup) acl_level--;
+return dbblock;
+}
+
+
+
+/* Only for transaction-capable DB types.  Open without locking or
+starting a transaction.  "lof" and "panic" always true; read/write mode.
+*/
+
+open_db *
+dbfn_open_multi(const uschar * name, int flags, open_db * dbblock)
+{
+int save_errno, dlen;
+uschar dirname[PATHLEN], filename[PATHLEN];
+
+DEBUG(D_hints_lookup) acl_level++;
+
+dbblock->lockfd = -1;
+dbblock->readonly = (flags & O_ACCMODE) == O_RDONLY;
+db_dir_make(TRUE);
+
+dlen = snprintf(CS dirname, sizeof(dirname), "%s/db", spool_directory);
+snprintf(CS filename, sizeof(filename), "%.*s/%s", dlen, dirname, name);

 
 

-  closedir(dd);
+priv_drop_temp(exim_uid, exim_gid);
+dbblock->dbptr = exim_dbopen_multi(filename, dirname, flags & O_ACCMODE, EXIMDB_MODE);
+if (!dbblock->dbptr && errno == ENOENT && flags & O_CREAT)
+  {
+  DEBUG(D_hints_lookup)
+    debug_printf_indent("%s appears not to exist: trying to create\n", filename);
+  dbblock->dbptr = exim_dbopen_multi(filename, dirname, flags, EXIMDB_MODE);

   }
   }

+save_errno = errno;
+priv_restore();

 
 /* If the open has failed, return NULL, leaving errno set. If lof is TRUE,
 log the event - also for debugging - but debug only if the file just doesn't
 
 /* If the open has failed, return NULL, leaving errno set. If lof is TRUE,
 log the event - also for debugging - but debug only if the file just doesn't


@@ -219,32 +296,38 @@ exist. */
 
 if (!dbblock->dbptr)
   {
 
 if (!dbblock->dbptr)
   {

-  if (lof && save_errno != ENOENT)
-    log_write(0, LOG_MAIN, "%s", string_open_failed(save_errno, "DB file %s",
+  errno = save_errno;
+  if (save_errno != ENOENT)
+    log_write(0, LOG_MAIN, "%s", string_open_failed("DB file %s",

         filename));
   else
     DEBUG(D_hints_lookup)
         filename));
   else
     DEBUG(D_hints_lookup)

-      debug_printf("%s\n", CS string_open_failed(save_errno, "DB file %s",
+      debug_printf_indent("%s\n", CS string_open_failed("DB file %s",

           filename));
           filename));

-  (void)close(dbblock->lockfd);
-  errno = save_errno;
-  return NULL;
+  dbblock =  NULL;

   }
 
   }
 

-DEBUG(D_hints_lookup)
-  debug_printf("opened hints database %s: flags=%s\n", filename,
-    flags == O_RDONLY ? "O_RDONLY"
-    : flags == O_RDWR ? "O_RDWR"
-    : flags == (O_RDWR|O_CREAT) ? "O_RDWR|O_CREAT"
-    : "??");
-
-/* Pass back the block containing the opened database handle and the open fd
-for the lock. */
-
+/* Pass back the block containing the opened database handle */
+DEBUG(D_hints_lookup) acl_level--;

 return dbblock;
 }
 
 
 return dbblock;
 }
 
 

+/* Return: boolean success */
+BOOL
+dbfn_transaction_start(open_db * dbp)
+{
+DEBUG(D_hints_lookup) debug_printf_indent("dbfn_transaction_start\n");
+if (!dbp->readonly) return exim_dbtransaction_start(dbp->dbptr);
+return FALSE;
+}
+void
+dbfn_transaction_commit(open_db * dbp)
+{
+DEBUG(D_hints_lookup) debug_printf_indent("dbfn_transaction_commit\n");
+if (!dbp->readonly) exim_dbtransaction_commit(dbp->dbptr);
+}
+

 
 
 /*************************************************
 
 
 /*************************************************


@@ -252,18 +335,36 @@ return dbblock;
 *************************************************/
 
 /* Closing a file automatically unlocks it, so after closing the database, just
 *************************************************/
 
 /* Closing a file automatically unlocks it, so after closing the database, just

-close the lock file.
+close the lock file if there was one.

 
 Argument: a pointer to an open database block
 Returns:  nothing
 */
 
 void
 
 Argument: a pointer to an open database block
 Returns:  nothing
 */
 
 void

-dbfn_close(open_db *dbblock)
+dbfn_close(open_db * dbp)

 {
 {

-EXIM_DBCLOSE(dbblock->dbptr);
-(void)close(dbblock->lockfd);
-DEBUG(D_hints_lookup) debug_printf("closed hints database and lockfile\n");
+int * fdp = &dbp->lockfd;
+
+if (dbp->readonly && !exim_lockfile_needed())
+  exim_dbclose_multi(dbp->dbptr);
+else
+  exim_dbclose(dbp->dbptr);
+
+if (*fdp >= 0) (void)close(*fdp);
+DEBUG(D_hints_lookup)
+  debug_printf_indent("closed hints database%s\n",
+                     *fdp < 0 ? "" : " and lockfile");
+*fdp = -1;
+}
+
+
+void
+dbfn_close_multi(open_db * dbp)
+{
+exim_dbclose_multi(dbp->dbptr);
+DEBUG(D_hints_lookup)
+  debug_printf_indent("closed hints database\n");

 }
 
 
 }
 
 


@@ -273,17 +374,17 @@ DEBUG(D_hints_lookup) debug_printf("closed hints database and lockfile\n");
 *             Read from database file            *
 *************************************************/
 
 *             Read from database file            *
 *************************************************/
 

-/* Passing back the pointer unchanged is useless, because there is
+/* Read, using a defined-length key (permitting embedded NULs).
+
+Passing back the pointer unchanged is useless, because there is

 no guarantee of alignment. Since all the records used by Exim need
 to be properly aligned to pick out the timestamps, etc., we might as
 well do the copying centrally here.
 
 no guarantee of alignment. Since all the records used by Exim need
 to be properly aligned to pick out the timestamps, etc., we might as
 well do the copying centrally here.
 

-Most calls don't need the length, so there is a macro called dbfn_read which
-has two arguments; it calls this function adding NULL as the third.
-

 Arguments:
   dbblock   a pointer to an open database block
   key       the key of the record to be read
 Arguments:
   dbblock   a pointer to an open database block
   key       the key of the record to be read

+  klen     length of key including a terminating NUL (if present)

   length    a pointer to an int into which to return the length, if not NULL
 
 Returns: a pointer to the retrieved record, or
   length    a pointer to an int into which to return the length, if not NULL
 
 Returns: a pointer to the retrieved record, or


@@ -291,33 +392,94 @@ Returns: a pointer to the retrieved record, or
 */
 
 void *
 */
 
 void *

-dbfn_read_with_length(open_db *dbblock, const uschar *key, int *length)
+dbfn_read_klen(open_db * dbblock, const uschar * key, int klen, int * length)

 {
 {

-void *yield;
+void * yield;

 EXIM_DATUM key_datum, result_datum;
 EXIM_DATUM key_datum, result_datum;

-int klen = Ustrlen(key) + 1;
-uschar * key_copy = store_get(klen);
+uschar * key_copy = store_get(klen, key);
+unsigned dlen;

 
 memcpy(key_copy, key, klen);
 
 
 memcpy(key_copy, key, klen);
 

-DEBUG(D_hints_lookup) debug_printf("dbfn_read: key=%s\n", key);
+DEBUG(D_hints_lookup) debug_printf_indent("dbfn_read: key=%.*s\n", klen, key);
+
+exim_datum_init(&key_datum);         /* Some DBM libraries require the datum */
+exim_datum_init(&result_datum);      /* to be cleared before use. */
+exim_datum_data_set(&key_datum, key_copy);
+exim_datum_size_set(&key_datum, klen);

 
 

-EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require the datum */
-EXIM_DATUM_INIT(result_datum);      /* to be cleared before use. */
-EXIM_DATUM_DATA(key_datum) = CS key_copy;
-EXIM_DATUM_SIZE(key_datum) = klen;
+if (!exim_dbget(dbblock->dbptr, &key_datum, &result_datum))
+  {
+  DEBUG(D_hints_lookup) debug_printf_indent("dbfn_read: null return\n");
+  return NULL;
+  }

 
 

-if (!EXIM_DBGET(dbblock->dbptr, key_datum, result_datum)) return NULL;
+/* Assume the data store could have been tainted.  Properly, we should
+store the taint status with the data. */

 
 

-yield = store_get(EXIM_DATUM_SIZE(result_datum));
-memcpy(yield, EXIM_DATUM_DATA(result_datum), EXIM_DATUM_SIZE(result_datum));
-if (length != NULL) *length = EXIM_DATUM_SIZE(result_datum);
+dlen = exim_datum_size_get(&result_datum);
+DEBUG(D_hints_lookup) debug_printf_indent("dbfn_read: size %u return\n", dlen);

 
 

-EXIM_DATUM_FREE(result_datum);    /* Some DBM libs require freeing */
+yield = store_get(dlen+1, GET_TAINTED);
+memcpy(yield, exim_datum_data_get(&result_datum), dlen);
+((uschar *)yield)[dlen] = '\0';
+if (length) *length = dlen;
+
+exim_datum_free(&result_datum);    /* Some DBM libs require freeing */

 return yield;
 }
 
 
 return yield;
 }
 
 

+/* Read, using a NUL-terminated key.
+
+Most calls don't need the length, so there is a macro called dbfn_read which
+has two arguments; it calls this function adding NULL as the third.
+
+Arguments:
+  dbblock   a pointer to an open database block
+  key       the key of the record to be read (NUL-terminated)
+  lenp      a pointer to an int into which to return the data length,
+           if not NULL
+
+Returns: a pointer to the retrieved record, or
+         NULL if the record is not found
+*/
+
+void *
+dbfn_read_with_length(open_db * dbblock, const uschar * key, int * lenp)
+{
+return dbfn_read_klen(dbblock, key, Ustrlen(key)+1, lenp);
+}
+
+
+
+/* Read a record.  If the length is not as expected then delete it, write
+an error log line, delete the record and return NULL.
+Use this for fixed-size records (so not retry or wait records).
+
+Arguments:
+  dbblock   a pointer to an open database block
+  key       the key of the record to be read
+  length    the expected record length
+
+Returns: a pointer to the retrieved record, or
+         NULL if the record is not found/bad
+*/
+
+void *
+dbfn_read_enforce_length(open_db * dbblock, const uschar * key, size_t length)
+{
+int rlen;
+void * yield = dbfn_read_with_length(dbblock, key, &rlen);
+
+if (yield)
+  {
+  if (rlen == length) return yield;
+  log_write(0, LOG_MAIN|LOG_PANIC, "Bad db record size for '%s'", key);
+  dbfn_delete(dbblock, key);
+  }
+return NULL;
+}

 
 /*************************************************
 *             Write to database file             *
 
 /*************************************************
 *             Write to database file             *


@@ -340,20 +502,21 @@ dbfn_write(open_db *dbblock, const uschar *key, void *ptr, int length)
 EXIM_DATUM key_datum, value_datum;
 dbdata_generic *gptr = (dbdata_generic *)ptr;
 int klen = Ustrlen(key) + 1;
 EXIM_DATUM key_datum, value_datum;
 dbdata_generic *gptr = (dbdata_generic *)ptr;
 int klen = Ustrlen(key) + 1;

-uschar * key_copy = store_get(klen);
+uschar * key_copy = store_get(klen, key);

 
 memcpy(key_copy, key, klen);
 gptr->time_stamp = time(NULL);
 
 
 memcpy(key_copy, key, klen);
 gptr->time_stamp = time(NULL);
 

-DEBUG(D_hints_lookup) debug_printf("dbfn_write: key=%s\n", key);
-
-EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require the datum */
-EXIM_DATUM_INIT(value_datum);       /* to be cleared before use. */
-EXIM_DATUM_DATA(key_datum) = CS key_copy;
-EXIM_DATUM_SIZE(key_datum) = klen;
-EXIM_DATUM_DATA(value_datum) = CS ptr;
-EXIM_DATUM_SIZE(value_datum) = length;
-return EXIM_DBPUT(dbblock->dbptr, key_datum, value_datum);
+DEBUG(D_hints_lookup)
+  debug_printf_indent("dbfn_write: key=%s datalen %d\n", key, length);
+
+exim_datum_init(&key_datum);         /* Some DBM libraries require the datum */
+exim_datum_init(&value_datum);       /* to be cleared before use. */
+exim_datum_data_set(&key_datum, key_copy);
+exim_datum_size_set(&key_datum, klen);
+exim_datum_data_set(&value_datum, ptr);
+exim_datum_size_set(&value_datum, length);
+return exim_dbput(dbblock->dbptr, &key_datum, &value_datum);

 }
 
 
 }
 
 


@@ -373,19 +536,29 @@ Returns: the yield of the underlying dbm or db "delete" function.
 int
 dbfn_delete(open_db *dbblock, const uschar *key)
 {
 int
 dbfn_delete(open_db *dbblock, const uschar *key)
 {

-int klen = Ustrlen(key) + 1;
-uschar * key_copy = store_get(klen);
+int klen = Ustrlen(key) + 1, rc;
+uschar * key_copy = store_get(klen, key);
+EXIM_DATUM key_datum;
+
+DEBUG(D_hints_lookup) debug_printf_indent("dbfn_delete: key=%s\n", key);

 
 memcpy(key_copy, key, klen);
 
 memcpy(key_copy, key, klen);

-EXIM_DATUM key_datum;
-EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require clearing */
-EXIM_DATUM_DATA(key_datum) = CS key_copy;
-EXIM_DATUM_SIZE(key_datum) = klen;
-return EXIM_DBDEL(dbblock->dbptr, key_datum);
+exim_datum_init(&key_datum);         /* Some DBM libraries require clearing */
+exim_datum_data_set(&key_datum, key_copy);
+exim_datum_size_set(&key_datum, klen);
+rc = exim_dbdel(dbblock->dbptr, &key_datum);
+DEBUG(D_hints_lookup) if (rc != EXIM_DBPUTB_OK)
+  debug_printf_indent(" exim_dbdel: fail\n");
+return rc;

 }
 
 
 
 }
 
 
 

+#ifdef notdef
+/* XXX This appears to be unused.  There's a separate implementation
+in dbutils.c for dumpdb and fixdb, using the same underlying support.
+*/
+

 /*************************************************
 *         Scan the keys of a database file       *
 *************************************************/
 /*************************************************
 *         Scan the keys of a database file       *
 *************************************************/


@@ -407,23 +580,25 @@ dbfn_scan(open_db *dbblock, BOOL start, EXIM_CURSOR **cursor)
 {
 EXIM_DATUM key_datum, value_datum;
 uschar *yield;
 {
 EXIM_DATUM key_datum, value_datum;
 uschar *yield;

-value_datum = value_datum;    /* dummy; not all db libraries use this */
+
+DEBUG(D_hints_lookup) debug_printf_indent("dbfn_scan\n");

 
 /* Some dbm require an initialization */
 
 
 /* Some dbm require an initialization */
 

-if (start) EXIM_DBCREATE_CURSOR(dbblock->dbptr, cursor);
+if (start) *cursor = exim_dbcreate_cursor(dbblock->dbptr);

 
 

-EXIM_DATUM_INIT(key_datum);         /* Some DBM libraries require the datum */
-EXIM_DATUM_INIT(value_datum);       /* to be cleared before use. */
+exim_datum_init(&key_datum);         /* Some DBM libraries require the datum */
+exim_datum_init(&value_datum);       /* to be cleared before use. */

 
 

-yield = (EXIM_DBSCAN(dbblock->dbptr, key_datum, value_datum, start, *cursor))?
-  US EXIM_DATUM_DATA(key_datum) : NULL;
+yield = exim_dbscan(dbblock->dbptr, &key_datum, &value_datum, start, *cursor)
+  ? US exim_datum_data_get(&key_datum) : NULL;

 
 /* Some dbm require a termination */
 
 
 /* Some dbm require a termination */
 

-if (!yield) EXIM_DBDELETE_CURSOR(*cursor);
+if (!yield) exim_dbdelete_cursor(*cursor);

 return yield;
 }
 return yield;
 }

+#endif /*notdef*/

 
 
 
 
 
 


@@ -506,7 +681,7 @@ while (Ufgets(buffer, 256, stdin) != NULL)
     {
     count = Uatoi(cmd);
     while (isdigit((uschar)*cmd)) cmd++;
     {
     count = Uatoi(cmd);
     while (isdigit((uschar)*cmd)) cmd++;

-    while (isspace((uschar)*cmd)) cmd++;
+    Uskip_whitespace(&cmd);

     }
 
   if (Ustrncmp(cmd, "open", 4) == 0)
     }
 
   if (Ustrncmp(cmd, "open", 4) == 0)


@@ -514,7 +689,7 @@ while (Ufgets(buffer, 256, stdin) != NULL)
     int i;
     open_db *odb;
     uschar *s = cmd + 4;
     int i;
     open_db *odb;
     uschar *s = cmd + 4;

-    while (isspace((uschar)*s)) s++;
+    Uskip_whitespace(&s);

 
     for (i = 0; i < max_db; i++)
       if (dbblock[i].dbptr == NULL) break;
 
     for (i = 0; i < max_db; i++)
       if (dbblock[i].dbptr == NULL) break;


@@ -526,7 +701,7 @@ while (Ufgets(buffer, 256, stdin) != NULL)
       }
 
     start = clock();
       }
 
     start = clock();

-    odb = dbfn_open(s, O_RDWR, dbblock + i, TRUE);
+    odb = dbfn_open(s, O_RDWR|O_CREAT, dbblock + i, TRUE, TRUE);

     stop = clock();
 
     if (odb)
     stop = clock();
 
     if (odb)


@@ -550,8 +725,7 @@ while (Ufgets(buffer, 256, stdin) != NULL)
   else if (Ustrncmp(cmd, "write", 5) == 0)
     {
     int rc = 0;
   else if (Ustrncmp(cmd, "write", 5) == 0)
     {
     int rc = 0;

-    uschar *key = cmd + 5;
-    uschar *data;
+    uschar * key = cmd + 5, * data;

 
     if (current < 0)
       {
 
     if (current < 0)
       {


@@ -559,11 +733,11 @@ while (Ufgets(buffer, 256, stdin) != NULL)
       continue;
       }
 
       continue;
       }
 

-    while (isspace((uschar)*key)) key++;
+    Uskip_whitespace(&key);

     data = key;
     data = key;

-    while (*data != 0 && !isspace((uschar)*data)) data++;
-    *data++ = 0;
-    while (isspace((uschar)*data)) data++;
+    Uskip_nonwhite(&data);
+    *data++ = '\0';
+    Uskip_whitespace(&data);

 
     dbwait = (dbdata_wait *)(&structbuffer);
     Ustrcpy(dbwait->text, data);
 
     dbwait = (dbdata_wait *)(&structbuffer);
     Ustrcpy(dbwait->text, data);


@@ -578,13 +752,13 @@ while (Ufgets(buffer, 256, stdin) != NULL)
 
   else if (Ustrncmp(cmd, "read", 4) == 0)
     {
 
   else if (Ustrncmp(cmd, "read", 4) == 0)
     {

-    uschar *key = cmd + 4;
+    uschar * key = cmd + 4;

     if (current < 0)
       {
       printf("No current database\n");
       continue;
       }
     if (current < 0)
       {
       printf("No current database\n");
       continue;
       }

-    while (isspace((uschar)*key)) key++;
+    Uskip_whitespace(&key);

     start = clock();
     while (count-- > 0)
       dbwait = (dbdata_wait *)dbfn_read_with_length(dbblock+ current, key, NULL);
     start = clock();
     while (count-- > 0)
       dbwait = (dbdata_wait *)dbfn_read_with_length(dbblock+ current, key, NULL);


@@ -594,13 +768,13 @@ while (Ufgets(buffer, 256, stdin) != NULL)
 
   else if (Ustrncmp(cmd, "delete", 6) == 0)
     {
 
   else if (Ustrncmp(cmd, "delete", 6) == 0)
     {

-    uschar *key = cmd + 6;
+    uschar * key = cmd + 6;

     if (current < 0)
       {
       printf("No current database\n");
       continue;
       }
     if (current < 0)
       {
       printf("No current database\n");
       continue;
       }

-    while (isspace((uschar)*key)) key++;
+    Uskip_whitespace(&key);

     dbfn_delete(dbblock + current, key);
     }
 
     dbfn_delete(dbblock + current, key);
     }
 


@@ -630,8 +804,8 @@ while (Ufgets(buffer, 256, stdin) != NULL)
 
   else if (Ustrncmp(cmd, "close", 5) == 0)
     {
 
   else if (Ustrncmp(cmd, "close", 5) == 0)
     {

-    uschar *s = cmd + 5;
-    while (isspace((uschar)*s)) s++;
+    uschar * s = cmd + 5;
+    Uskip_whitespace(&s);

     i = Uatoi(s);
     if (i >= max_db || dbblock[i].dbptr == NULL) printf("Not open\n"); else
       {
     i = Uatoi(s);
     if (i >= max_db || dbblock[i].dbptr == NULL) printf("Not open\n"); else
       {


@@ -645,8 +819,8 @@ while (Ufgets(buffer, 256, stdin) != NULL)
 
   else if (Ustrncmp(cmd, "file", 4) == 0)
     {
 
   else if (Ustrncmp(cmd, "file", 4) == 0)
     {

-    uschar *s = cmd + 4;
-    while (isspace((uschar)*s)) s++;
+    uschar * s = cmd + 4;
+    Uskip_whitespace(&s);

     i = Uatoi(s);
     if (i >= max_db || dbblock[i].dbptr == NULL) printf("Not open\n");
       else current = i;
     i = Uatoi(s);
     if (i >= max_db || dbblock[i].dbptr == NULL) printf("Not open\n");
       else current = i;


@@ -698,3 +872,5 @@ return 0;
 #endif
 
 /* End of dbfn.c */
 #endif
 
 /* End of dbfn.c */

+/* vi: aw ai sw=2
+*/