X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/d87df92cd9117c3bee1db7741090a974f3463848..995e599afd3e6468d3396fb351ed0cd0ea212779:/src/src/dbfn.c diff --git a/src/src/dbfn.c b/src/src/dbfn.c index cefa0b323..be6a47afc 100644 --- a/src/src/dbfn.c +++ b/src/src/dbfn.c @@ -1,15 +1,19 @@ -/* $Cambridge: exim/src/src/dbfn.c,v 1.9 2006/04/20 15:05:15 ph10 Exp $ */ - /************************************************* * Exim - an Internet mail transport agent * *************************************************/ -/* Copyright (c) University of Cambridge 1995 - 2006 */ +/* Copyright (c) University of Cambridge 1995 - 2018 */ +/* Copyright (c) The Exim Maintainers 2020 */ /* See the file NOTICE for conditions of use and distribution. */ #include "exim.h" +/* We have buffers holding path names for database files. +PATH_MAX could be used here, but would be wasting memory, as we deal +with database files like $spooldirectory/db/ */ +#define PATHLEN 256 + /* Functions for accessing Exim's hints database, which consists of a number of different DBM files. This module does not contain code for reading DBM files @@ -74,6 +78,7 @@ Arguments: dbblock Points to an open_db block to be filled in. lof If TRUE, write to the log for actual open failures (locking failures are always logged). + panic If TRUE, panic on failure to create the db directory Returns: NULL if the open failed, or the locking failed. After locking failures, errno is zero. @@ -87,13 +92,15 @@ moment I haven't changed them. */ open_db * -dbfn_open(uschar *name, int flags, open_db *dbblock, BOOL lof) +dbfn_open(uschar *name, int flags, open_db *dbblock, BOOL lof, BOOL panic) { int rc, save_errno; BOOL read_only = flags == O_RDONLY; BOOL created = FALSE; flock_t lock_data; -uschar buffer[256]; +uschar dirname[PATHLEN], filename[PATHLEN]; + +DEBUG(D_hints_lookup) acl_level++; /* The first thing to do is to open a separate file on which to lock. This ensures that Exim has exclusive use of the database before it even tries to @@ -108,20 +115,22 @@ make the directory as well, just in case. We won't be doing this many times unnecessarily, because usually the lock file will be there. If the directory exists, there is no error. */ -sprintf(CS buffer, "%s/db/%s.lockfile", spool_directory, name); +snprintf(CS dirname, sizeof(dirname), "%s/db", spool_directory); +snprintf(CS filename, sizeof(filename), "%s/%s.lockfile", dirname, name); -if ((dbblock->lockfd = Uopen(buffer, O_RDWR, EXIMDB_LOCKFILE_MODE)) < 0) +if ((dbblock->lockfd = Uopen(filename, O_RDWR, EXIMDB_LOCKFILE_MODE)) < 0) { created = TRUE; - (void)directory_make(spool_directory, US"db", EXIMDB_DIRECTORY_MODE, TRUE); - dbblock->lockfd = Uopen(buffer, O_RDWR|O_CREAT, EXIMDB_LOCKFILE_MODE); + (void)directory_make(spool_directory, US"db", EXIMDB_DIRECTORY_MODE, panic); + dbblock->lockfd = Uopen(filename, O_RDWR|O_CREAT, EXIMDB_LOCKFILE_MODE); } if (dbblock->lockfd < 0) { log_write(0, LOG_MAIN, "%s", - string_open_failed(errno, "database lock file %s", buffer)); + string_open_failed("database lock file %s", filename)); errno = 0; /* Indicates locking failure */ + DEBUG(D_hints_lookup) acl_level--; return NULL; } @@ -132,25 +141,26 @@ lock_data.l_type = read_only? F_RDLCK : F_WRLCK; lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0; DEBUG(D_hints_lookup|D_retry|D_route|D_deliver) - debug_printf("locking %s\n", buffer); + debug_printf_indent("locking %s\n", filename); sigalrm_seen = FALSE; -alarm(EXIMDB_LOCK_TIMEOUT); +ALARM(EXIMDB_LOCK_TIMEOUT); rc = fcntl(dbblock->lockfd, F_SETLKW, &lock_data); -alarm(0); +ALARM_CLR(0); if (sigalrm_seen) errno = ETIMEDOUT; if (rc < 0) { - log_write(0, LOG_MAIN, "Failed to get %s lock for %s: %s", - read_only? "read" : "write", buffer, - (errno == ETIMEDOUT)? "timed out" : strerror(errno)); + log_write(0, LOG_MAIN|LOG_PANIC, "Failed to get %s lock for %s: %s", + read_only ? "read" : "write", filename, + errno == ETIMEDOUT ? "timed out" : strerror(errno)); (void)close(dbblock->lockfd); errno = 0; /* Indicates locking failure */ + DEBUG(D_hints_lookup) acl_level--; return NULL; } -DEBUG(D_hints_lookup) debug_printf("locked %s\n", buffer); +DEBUG(D_hints_lookup) debug_printf_indent("locked %s\n", filename); /* At this point we have an opened and locked separate lock file, that is, exclusive access to the database, so we can go ahead and open it. If we are @@ -161,18 +171,15 @@ databases - often this is caused by non-matching db.h and the library. To make it easy to pin this down, there are now debug statements on either side of the open call. */ -sprintf(CS buffer, "%s/db/%s", spool_directory, name); -DEBUG(D_hints_lookup) debug_printf("EXIM_DBOPEN(%s)\n", buffer); -EXIM_DBOPEN(buffer, flags, EXIMDB_MODE, &(dbblock->dbptr)); -DEBUG(D_hints_lookup) debug_printf("returned from EXIM_DBOPEN\n"); +snprintf(CS filename, sizeof(filename), "%s/%s", dirname, name); +EXIM_DBOPEN(filename, dirname, flags, EXIMDB_MODE, &(dbblock->dbptr)); -if (dbblock->dbptr == NULL && errno == ENOENT && flags == O_RDWR) +if (!dbblock->dbptr && errno == ENOENT && flags == O_RDWR) { DEBUG(D_hints_lookup) - debug_printf("%s appears not to exist: trying to create\n", buffer); + debug_printf_indent("%s appears not to exist: trying to create\n", filename); created = TRUE; - EXIM_DBOPEN(buffer, flags|O_CREAT, EXIMDB_MODE, &(dbblock->dbptr)); - DEBUG(D_hints_lookup) debug_printf("returned from EXIM_DBOPEN\n"); + EXIM_DBOPEN(filename, dirname, flags|O_CREAT, EXIMDB_MODE, &(dbblock->dbptr)); } save_errno = errno; @@ -193,55 +200,62 @@ but creation of the database file failed. */ if (created && geteuid() == root_uid) { - DIR *dd; - struct dirent *ent; - uschar *lastname = Ustrrchr(buffer, '/') + 1; + DIR * dd; + uschar path[PATHLEN]; + uschar *lastname; int namelen = Ustrlen(name); + Ustrcpy(path, filename); + lastname = Ustrrchr(path, '/') + 1; *lastname = 0; - dd = opendir(CS buffer); - while ((ent = readdir(dd)) != NULL) - { - if (Ustrncmp(ent->d_name, name, namelen) == 0) - { - struct stat statbuf; - Ustrcpy(lastname, ent->d_name); - if (Ustat(buffer, &statbuf) >= 0 && statbuf.st_uid != exim_uid) - { - DEBUG(D_hints_lookup) debug_printf("ensuring %s is owned by exim\n", buffer); - (void)Uchown(buffer, exim_uid, exim_gid); - } - } - } + if ((dd = exim_opendir(path))) + for (struct dirent *ent; ent = readdir(dd); ) + if (Ustrncmp(ent->d_name, name, namelen) == 0) + { + struct stat statbuf; + /* Filenames from readdir() are trusted, + so use a taint-nonchecking copy */ + strcpy(CS lastname, CCS ent->d_name); + if (Ustat(path, &statbuf) >= 0 && statbuf.st_uid != exim_uid) + { + DEBUG(D_hints_lookup) + debug_printf_indent("ensuring %s is owned by exim\n", path); + if (exim_chown(path, exim_uid, exim_gid)) + DEBUG(D_hints_lookup) + debug_printf_indent("failed setting %s to owned by exim\n", path); + } + } closedir(dd); } /* If the open has failed, return NULL, leaving errno set. If lof is TRUE, -log the event - also for debugging - but not if the file just doesn't exist. */ +log the event - also for debugging - but debug only if the file just doesn't +exist. */ -if (dbblock->dbptr == NULL) +if (!dbblock->dbptr) { - if (save_errno != ENOENT) - { - if (lof) - log_write(0, LOG_MAIN, "%s", string_open_failed(save_errno, "DB file %s", - buffer)); - else - DEBUG(D_hints_lookup) - debug_printf("%s", CS string_open_failed(save_errno, "DB file %s\n", - buffer)); - } + errno = save_errno; + if (lof && save_errno != ENOENT) + log_write(0, LOG_MAIN, "%s", string_open_failed("DB file %s", + filename)); + else + DEBUG(D_hints_lookup) + debug_printf_indent("%s\n", CS string_open_failed("DB file %s", + filename)); (void)close(dbblock->lockfd); errno = save_errno; + DEBUG(D_hints_lookup) acl_level--; return NULL; } DEBUG(D_hints_lookup) - debug_printf("opened hints database %s: flags=%s\n", buffer, - (flags == O_RDONLY)? "O_RDONLY" : (flags == O_RDWR)? "O_RDWR" : - (flags == (O_RDWR|O_CREAT))? "O_RDWR|O_CREAT" : "??"); + debug_printf_indent("opened hints database %s: flags=%s\n", filename, + flags == O_RDONLY ? "O_RDONLY" + : flags == O_RDWR ? "O_RDWR" + : flags == (O_RDWR|O_CREAT) ? "O_RDWR|O_CREAT" + : "??"); /* Pass back the block containing the opened database handle and the open fd for the lock. */ @@ -268,6 +282,8 @@ dbfn_close(open_db *dbblock) { EXIM_DBCLOSE(dbblock->dbptr); (void)close(dbblock->lockfd); +DEBUG(D_hints_lookup) + { debug_printf_indent("closed hints database and lockfile\n"); acl_level--; } } @@ -295,21 +311,28 @@ Returns: a pointer to the retrieved record, or */ void * -dbfn_read_with_length(open_db *dbblock, uschar *key, int *length) +dbfn_read_with_length(open_db *dbblock, const uschar *key, int *length) { void *yield; EXIM_DATUM key_datum, result_datum; +int klen = Ustrlen(key) + 1; +uschar * key_copy = store_get(klen, is_tainted(key)); + +memcpy(key_copy, key, klen); -DEBUG(D_hints_lookup) debug_printf("dbfn_read: key=%s\n", key); +DEBUG(D_hints_lookup) debug_printf_indent("dbfn_read: key=%s\n", key); EXIM_DATUM_INIT(key_datum); /* Some DBM libraries require the datum */ EXIM_DATUM_INIT(result_datum); /* to be cleared before use. */ -EXIM_DATUM_DATA(key_datum) = CS key; -EXIM_DATUM_SIZE(key_datum) = Ustrlen(key) + 1; +EXIM_DATUM_DATA(key_datum) = CS key_copy; +EXIM_DATUM_SIZE(key_datum) = klen; if (!EXIM_DBGET(dbblock->dbptr, key_datum, result_datum)) return NULL; -yield = store_get(EXIM_DATUM_SIZE(result_datum)); +/* Assume the data store could have been tainted. Properly, we should +store the taint status with the data. */ + +yield = store_get(EXIM_DATUM_SIZE(result_datum), TRUE); memcpy(yield, EXIM_DATUM_DATA(result_datum), EXIM_DATUM_SIZE(result_datum)); if (length != NULL) *length = EXIM_DATUM_SIZE(result_datum); @@ -318,6 +341,34 @@ return yield; } +/* Read a record. If the length is not as expected then delete it, write +an error log line and return NULL. +Use this for fixed-size records (so not retry or wait records). + +Arguments: + dbblock a pointer to an open database block + key the key of the record to be read + length the expected record length + +Returns: a pointer to the retrieved record, or + NULL if the record is not found/bad +*/ + +void * +dbfn_read_enforce_length(open_db * dbblock, const uschar * key, size_t length) +{ +int rlen; +void * yield = dbfn_read_with_length(dbblock, key, &rlen); + +if (yield) + { + if (rlen == length) return yield; + log_write(0, LOG_MAIN|LOG_PANIC, "Bad db record size for '%s'", key); + dbfn_delete(dbblock, key); + } +return NULL; +} + /************************************************* * Write to database file * @@ -335,18 +386,22 @@ Returns: the yield of the underlying dbm or db "write" function. If this */ int -dbfn_write(open_db *dbblock, uschar *key, void *ptr, int length) +dbfn_write(open_db *dbblock, const uschar *key, void *ptr, int length) { EXIM_DATUM key_datum, value_datum; dbdata_generic *gptr = (dbdata_generic *)ptr; +int klen = Ustrlen(key) + 1; +uschar * key_copy = store_get(klen, is_tainted(key)); + +memcpy(key_copy, key, klen); gptr->time_stamp = time(NULL); -DEBUG(D_hints_lookup) debug_printf("dbfn_write: key=%s\n", key); +DEBUG(D_hints_lookup) debug_printf_indent("dbfn_write: key=%s\n", key); EXIM_DATUM_INIT(key_datum); /* Some DBM libraries require the datum */ EXIM_DATUM_INIT(value_datum); /* to be cleared before use. */ -EXIM_DATUM_DATA(key_datum) = CS key; -EXIM_DATUM_SIZE(key_datum) = Ustrlen(key) + 1; +EXIM_DATUM_DATA(key_datum) = CS key_copy; +EXIM_DATUM_SIZE(key_datum) = klen; EXIM_DATUM_DATA(value_datum) = CS ptr; EXIM_DATUM_SIZE(value_datum) = length; return EXIM_DBPUT(dbblock->dbptr, key_datum, value_datum); @@ -367,12 +422,18 @@ Returns: the yield of the underlying dbm or db "delete" function. */ int -dbfn_delete(open_db *dbblock, uschar *key) +dbfn_delete(open_db *dbblock, const uschar *key) { +int klen = Ustrlen(key) + 1; +uschar * key_copy = store_get(klen, is_tainted(key)); + +DEBUG(D_hints_lookup) debug_printf_indent("dbfn_delete: key=%s\n", key); + +memcpy(key_copy, key, klen); EXIM_DATUM key_datum; EXIM_DATUM_INIT(key_datum); /* Some DBM libraries require clearing */ -EXIM_DATUM_DATA(key_datum) = CS key; -EXIM_DATUM_SIZE(key_datum) = Ustrlen(key) + 1; +EXIM_DATUM_DATA(key_datum) = CS key_copy; +EXIM_DATUM_SIZE(key_datum) = klen; return EXIM_DBDEL(dbblock->dbptr, key_datum); } @@ -399,7 +460,8 @@ dbfn_scan(open_db *dbblock, BOOL start, EXIM_CURSOR **cursor) { EXIM_DATUM key_datum, value_datum; uschar *yield; -value_datum = value_datum; /* dummy; not all db libraries use this */ + +DEBUG(D_hints_lookup) debug_printf_indent("dbfn_scan\n"); /* Some dbm require an initialization */ @@ -518,10 +580,10 @@ while (Ufgets(buffer, 256, stdin) != NULL) } start = clock(); - odb = dbfn_open(s, O_RDWR, dbblock + i, TRUE); + odb = dbfn_open(s, O_RDWR, dbblock + i, TRUE, TRUE); stop = clock(); - if (odb != NULL) + if (odb) { current = i; printf("opened %d\n", current);