1 /* $Cambridge: exim/src/src/transports/appendfile.c,v 1.6 2005/04/27 10:06:00 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2005 */
8 /* See the file NOTICE for conditions of use and distribution. */
12 #include "appendfile.h"
14 #ifdef SUPPORT_MAILDIR
15 #include "tf_maildir.h"
19 /* Encodings for mailbox formats, and their names. MBX format is actually
20 supported only if SUPPORT_MBX is set. */
22 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
24 static char *mailbox_formats[] = {
25 "unix", "mbx", "smail", "maildir", "mailstore" };
28 /* Check warn threshold only if quota size set or not a percentage threshold
29 percentage check should only be done if quota > 0 */
31 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
32 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
35 /* Options specific to the appendfile transport. They must be in alphabetic
36 order (note that "_" comes before the lower case letters). Some of them are
37 stored in the publicly visible instance block - these are flagged with the
40 optionlist appendfile_transport_options[] = {
41 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
42 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
43 { "*set_use_flock_lock",opt_bool | opt_hidden,
44 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
45 { "*set_use_lockfile", opt_bool | opt_hidden,
46 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
48 { "*set_use_mbx_lock", opt_bool | opt_hidden,
49 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
51 { "allow_fifo", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
53 { "allow_symlink", opt_bool,
54 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
55 { "batch_id", opt_stringptr | opt_public,
56 (void *)offsetof(transport_instance, batch_id) },
57 { "batch_max", opt_int | opt_public,
58 (void *)offsetof(transport_instance, batch_max) },
59 { "check_group", opt_bool,
60 (void *)offsetof(appendfile_transport_options_block, check_group) },
61 { "check_owner", opt_bool,
62 (void *)offsetof(appendfile_transport_options_block, check_owner) },
63 { "check_string", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, check_string) },
65 { "create_directory", opt_bool,
66 (void *)offsetof(appendfile_transport_options_block, create_directory) },
67 { "create_file", opt_stringptr,
68 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
69 { "directory", opt_stringptr,
70 (void *)offsetof(appendfile_transport_options_block, dirname) },
71 { "directory_file", opt_stringptr,
72 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
73 { "directory_mode", opt_octint,
74 (void *)offsetof(appendfile_transport_options_block, dirmode) },
75 { "escape_string", opt_stringptr,
76 (void *)offsetof(appendfile_transport_options_block, escape_string) },
77 { "file", opt_stringptr,
78 (void *)offsetof(appendfile_transport_options_block, filename) },
79 { "file_format", opt_stringptr,
80 (void *)offsetof(appendfile_transport_options_block, file_format) },
81 { "file_must_exist", opt_bool,
82 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
83 { "lock_fcntl_timeout", opt_time,
84 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
85 { "lock_flock_timeout", opt_time,
86 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
87 { "lock_interval", opt_time,
88 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
89 { "lock_retries", opt_int,
90 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
91 { "lockfile_mode", opt_octint,
92 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
93 { "lockfile_timeout", opt_time,
94 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
95 { "mailbox_filecount", opt_stringptr,
96 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
97 { "mailbox_size", opt_stringptr,
98 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
99 #ifdef SUPPORT_MAILDIR
100 { "maildir_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
102 { "maildir_quota_directory_regex", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
104 { "maildir_retries", opt_int,
105 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
106 { "maildir_tag", opt_stringptr,
107 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
108 { "maildir_use_size_file", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
110 #endif /* SUPPORT_MAILDIR */
111 #ifdef SUPPORT_MAILSTORE
112 { "mailstore_format", opt_bool,
113 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
114 { "mailstore_prefix", opt_stringptr,
115 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
116 { "mailstore_suffix", opt_stringptr,
117 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
118 #endif /* SUPPORT_MAILSTORE */
120 { "mbx_format", opt_bool,
121 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
122 #endif /* SUPPORT_MBX */
123 { "message_prefix", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
125 { "message_suffix", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
127 { "mode", opt_octint,
128 (void *)offsetof(appendfile_transport_options_block, mode) },
129 { "mode_fail_narrower",opt_bool,
130 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
131 { "notify_comsat", opt_bool,
132 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
133 { "quota", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota) },
135 { "quota_directory", opt_stringptr,
136 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
137 { "quota_filecount", opt_stringptr,
138 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
139 { "quota_is_inclusive", opt_bool,
140 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
141 { "quota_size_regex", opt_stringptr,
142 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
143 { "quota_warn_message", opt_stringptr | opt_public,
144 (void *)offsetof(transport_instance, warn_message) },
145 { "quota_warn_threshold", opt_stringptr,
146 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
147 { "use_bsmtp", opt_bool,
148 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
149 { "use_crlf", opt_bool,
150 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
151 { "use_fcntl_lock", opt_bool_set,
152 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
153 { "use_flock_lock", opt_bool_set,
154 (void *)offsetof(appendfile_transport_options_block, use_flock) },
155 { "use_lockfile", opt_bool_set,
156 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
158 { "use_mbx_lock", opt_bool_set,
159 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
160 #endif /* SUPPORT_MBX */
163 /* Size of the options list. An extern variable has to be used so that its
164 address can appear in the tables drtables.c. */
166 int appendfile_transport_options_count =
167 sizeof(appendfile_transport_options)/sizeof(optionlist);
169 /* Default private options block for the appendfile transport. */
171 appendfile_transport_options_block appendfile_transport_option_defaults = {
174 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
175 NULL, /* message_prefix (default reset in init if not bsmtp) */
176 NULL, /* message_suffix (ditto) */
177 US"anywhere", /* create_file_string (string value for create_file) */
179 NULL, /* quota_directory */
180 NULL, /* quota_filecount */
181 NULL, /* quota_size_regex */
182 NULL, /* quota_warn_threshold */
183 NULL, /* mailbox_size_string */
184 NULL, /* mailbox_filecount_string */
185 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
186 NULL, /* maildir_tag */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
192 -1, /* mailbox_size_value */
193 -1, /* mailbox_filecount_value */
195 0, /* quota_filecount_value */
196 0, /* quota_warn_threshold_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE /* quota_is_inclusive */
236 /*************************************************
237 * Setup entry point *
238 *************************************************/
240 /* Called for each delivery in the privileged state, just before the uid/gid
241 are changed and the main entry point is called. We use this function to
242 expand any quota settings, so that it can access files that may not be readable
243 by the user. It is also used to pick up external mailbox size information, if
247 tblock points to the transport instance
248 addrlist addresses about to be delivered (not used)
249 dummy not used (doesn't pass back data)
250 errmsg where to put an error message
252 Returns: OK, FAIL, or DEFER
256 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
257 transport_feedback *dummy, uschar **errmsg)
259 appendfile_transport_options_block *ob =
260 (appendfile_transport_options_block *)(tblock->options_block);
261 uschar *q = ob->quota;
262 int *v = &(ob->quota_value);
263 int default_value = 0;
266 addrlist = addrlist; /* Keep picky compilers happy */
269 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
272 for (i = 0; i < 5; i++)
274 if (q == NULL) *v = default_value; else
278 uschar *s = expand_string(q);
282 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
283 "%s", q, tblock->name, expand_string_message);
284 return search_find_defer? DEFER : FAIL;
287 d = Ustrtod(s, &rest);
289 /* Handle following characters K, M, G, %, the latter being permitted
290 for quota_warn_threshold only. A threshold with no quota setting is
293 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
294 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
295 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
296 else if (*rest == '%' && i == 2)
298 if (ob->quota_value <= 0 && !ob->maildir_use_size_file) d = 0;
299 else if ((int)d < 0 || (int)d > 100)
301 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
302 " for %s transport", (int)d, tblock->name);
305 ob->quota_warn_threshold_is_percent = TRUE;
309 while (isspace(*rest)) rest++;
313 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
314 "in %s transport", s, q, tblock->name);
324 q = ob->quota_filecount;
325 v = &(ob->quota_filecount_value);
329 q = ob->quota_warn_threshold;
330 v = &(ob->quota_warn_threshold_value);
334 q = ob->mailbox_size_string;
335 v = &(ob->mailbox_size_value);
340 q = ob->mailbox_filecount_string;
341 v = &(ob->mailbox_filecount_value);
351 /*************************************************
352 * Initialization entry point *
353 *************************************************/
355 /* Called for each instance, after its options have been read, to
356 enable consistency checks to be done, or anything else that needs
360 appendfile_transport_init(transport_instance *tblock)
362 appendfile_transport_options_block *ob =
363 (appendfile_transport_options_block *)(tblock->options_block);
365 /* Set up the setup entry point, to be called in the privileged state */
367 tblock->setup = appendfile_transport_setup;
369 /* Lock_retries must be greater than zero */
371 if (ob->lock_retries == 0) ob->lock_retries = 1;
373 /* Only one of a file name or directory name must be given. */
375 if (ob->filename != NULL && ob->dirname != NULL)
376 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
377 "only one of \"file\" or \"directory\" can be specified", tblock->name);
379 /* If a file name was specified, neither quota_filecount nor quota_directory
382 if (ob->filename != NULL)
384 if (ob->quota_filecount != NULL)
385 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
386 "quota_filecount must not be set without \"directory\"", tblock->name);
387 if (ob->quota_directory != NULL)
388 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
389 "quota_directory must not be set without \"directory\"", tblock->name);
392 /* The default locking depends on whether MBX is set or not. Change the
393 built-in default if none of the lock options has been explicitly set. At least
394 one form of locking is required in all cases, but mbx locking changes the
395 meaning of fcntl and flock locking. */
397 /* Not all operating systems provide flock(). For those that do, if flock is
398 requested, the default for fcntl is FALSE. */
403 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
404 "flock() support was not available in the operating system when this "
405 "binary was built", tblock->name);
406 #endif /* NO_FLOCK */
407 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
413 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
414 !ob->set_use_mbx_lock)
416 ob->use_lockfile = ob->use_flock = FALSE;
417 ob->use_mbx_lock = ob->use_fcntl = TRUE;
419 else if (ob->use_mbx_lock)
421 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
422 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
423 if (!ob->set_use_flock) ob->use_flock = FALSE;
424 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
427 #endif /* SUPPORT_MBX */
429 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
430 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
431 "no locking configured", tblock->name);
433 /* Unset timeouts for non-used locking types */
435 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
436 if (!ob->use_flock) ob->lock_flock_timeout = 0;
438 /* If a directory name was specified, only one of maildir or mailstore may be
439 specified, and if quota_filecount or quota_directory is given, quota must
442 if (ob->dirname != NULL)
444 if (ob->maildir_format && ob->mailstore_format)
445 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
446 "only one of maildir and mailstore may be specified", tblock->name);
447 if (ob->quota_filecount != NULL && ob->quota == NULL)
448 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
449 "quota must be set if quota_filecount is set", tblock->name);
450 if (ob->quota_directory != NULL && ob->quota == NULL)
451 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
452 "quota must be set if quota_directory is set", tblock->name);
455 /* If a fixed uid field is set, then a gid field must also be set. */
457 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
458 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
459 "user set without group for the %s transport", tblock->name);
461 /* If "create_file" is set, check that a valid option is given, and set the
464 if (ob->create_file_string != NULL)
467 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
468 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
470 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
471 value = create_inhome;
473 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
474 "invalid value given for \"file_create\" for the %s transport: %s",
475 tblock->name, ob->create_file_string);
476 ob->create_file = value;
479 /* If quota_warn_threshold is set, set up default for warn_message. It may
480 not be used if the actual threshold for a given delivery ends up as zero,
481 of if it's given as a percentage and there's no quota setting. */
483 if (ob->quota_warn_threshold != NULL)
485 if (tblock->warn_message == NULL) tblock->warn_message = US
486 "To: $local_part@$domain\n"
487 "Subject: Your mailbox\n\n"
488 "This message is automatically created by mail delivery software (Exim).\n\n"
489 "The size of your mailbox has exceeded a warning threshold that is\n"
490 "set by the system administrator.\n";
493 /* If batch SMTP is set, force the check and escape strings, and arrange that
494 headers are also escaped. */
498 ob->check_string = US".";
499 ob->escape_string = US"..";
500 ob->options |= topt_escape_headers;
503 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
504 insert default values for for the affixes and the check/escape strings. */
506 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
508 if (ob->message_prefix == NULL) ob->message_prefix =
509 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
510 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
511 if (ob->check_string == NULL) ob->check_string = US"From ";
512 if (ob->escape_string == NULL) ob->escape_string = US">From ";
516 /* Set up the bitwise options for transport_write_message from the various
517 driver options. Only one of body_only and headers_only can be set. */
520 (tblock->body_only? topt_no_headers : 0) |
521 (tblock->headers_only? topt_no_body : 0) |
522 (tblock->return_path_add? topt_add_return_path : 0) |
523 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
524 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
525 ((ob->use_crlf || ob->mbx_format)? topt_use_crlf : 0);
530 /*************************************************
532 *************************************************/
534 /* The comsat daemon is the thing that provides asynchronous notification of
535 the arrival of local messages, if requested by the user by "biff y". It is a
536 BSD thing that uses a TCP/IP protocol for communication. A message consisting
537 of the text "user@offset" must be sent, where offset is the place in the
538 mailbox where new mail starts. There is no scope for telling it which file to
539 look at, which makes it a less than useful if mail is being delivered into a
540 non-standard place such as the user's home directory. In fact, it doesn't seem
541 to pay much attention to the offset.
545 offset offset in mailbox
551 notify_comsat(uschar *user, int offset)
558 DEBUG(D_transport) debug_printf("notify_comsat called\n");
560 sprintf(CS buffer, "%.200s@%d\n", user, offset);
562 if ((sp = getservbyname("biff", "udp")) == NULL)
564 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
568 host.name = US"localhost";
572 /* This code is all set up to look up "localhost" and use all its addresses
573 until one succeeds. However, it appears that at least on some systems, comsat
574 doesn't listen on the ::1 address. So for the moment, just force the address to
575 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
579 if (host_find_byname(&host, NULL, NULL, FALSE) == HOST_FIND_FAILED)
581 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
586 host.address = US"127.0.0.1";
589 for (h = &host; h != NULL; h = h->next)
592 int host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
594 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
596 sock = ip_socket(SOCK_DGRAM, host_af);
597 if (sock < 0) continue;
599 /* Connect never fails for a UDP socket, so don't set a timeout. */
601 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0);
602 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
607 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
614 /*************************************************
615 * Check the format of a file *
616 *************************************************/
618 /* This function is called when file_format is set, to check that an existing
619 file has the right format. The format string contains text/transport pairs. The
620 string matching is literal. we just read big_buffer_size bytes, because this is
621 all about the first few bytes of a file.
625 tblock the transport block
626 addr the address block - for inserting error data
628 Returns: pointer to the required transport, or NULL
632 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
635 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
637 int len = read(cfd, data, sizeof(data));
641 DEBUG(D_transport) debug_printf("checking file format\n");
643 /* An empty file matches the current transport */
645 if (len == 0) return tblock;
647 /* Search the formats for a match */
649 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size))!= NULL)
651 int slen = Ustrlen(s);
652 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
653 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
656 transport_instance *tt;
657 for (tt = transports; tt != NULL; tt = tt->next)
658 if (Ustrcmp(tp, tt->name) == 0)
661 debug_printf("file format -> %s transport\n", tt->name);
664 addr->basic_errno = ERRNO_BADTRANSPORT;
665 addr->message = string_sprintf("%s transport (for %.*s format) not found",
671 /* Failed to find a match */
673 addr->basic_errno = ERRNO_FORMATUNKNOWN;
674 addr->message = US"mailbox file format unrecognized";
681 /*************************************************
682 * Check directory's files for quota *
683 *************************************************/
685 /* This function is called if quota is set for one of the delivery modes that
686 delivers into a specific directory. It scans the directory and stats all the
687 files in order to get a total size and count. This is an expensive thing to do,
688 but some people are prepared to bear the cost. Alternatively, if size_regex is
689 set, it is used as a regex to try to extract the size from the file name, a
690 strategy that some people use on maildir files on systems where the users have
693 The function is global, because it is also called from tf_maildir.c for maildir
694 folders (which should contain only regular files).
696 Note: Any problems can be written to debugging output, but cannot be written to
697 the log, because we are running as an unprivileged user here.
700 dirname the name of the directory
701 countptr where to add the file count (because this function recurses)
702 regex a compiled regex to get the size from a name
704 Returns: the sum of the sizes of the stattable files
705 zero if the directory cannot be opened
709 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
713 int count = *countptr;
717 dir = opendir(CS dirname);
718 if (dir == NULL) return 0;
720 while ((ent = readdir(dir)) != NULL)
722 uschar *name = US ent->d_name;
725 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
729 /* If there's a regex, try to find the size using it */
734 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
737 int size = Ustrtol(name + ovector[2], &endptr, 10);
738 if (endptr == name + ovector[3])
742 debug_printf("check_dir_size: size from %s is %d\n", name, size);
747 debug_printf("check_dir_size: regex did not match %s\n", name);
750 /* No regex or no match for the regex, or captured non-digits */
752 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
755 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
760 if (Ustat(buffer, &statbuf) < 0)
763 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
768 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
769 sum += statbuf.st_size;
770 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
771 sum += check_dir_size(buffer, &count, regex);
776 debug_printf("check_dir_size: dir=%s sum=%d count=%d\n", dirname, sum, count);
784 /*************************************************
785 * Apply a lock to a file descriptor *
786 *************************************************/
788 /* This function applies a lock to a file descriptor, using a blocking or
789 non-blocking lock, depending on the timeout value. It can apply either or
790 both of a fcntl() and a flock() lock. However, not all OS support flock();
791 for those that don't, the use_flock option cannot be set.
794 fd the file descriptor
795 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
796 fcntl() format); the flock() type is deduced if needed
797 dofcntl do fcntl() locking
798 fcntltime non-zero to use blocking fcntl()
799 doflock do flock() locking
800 flocktime non-zero to use blocking flock()
802 Returns: yield of the fcntl() or flock() call, with errno preserved;
803 sigalrm_seen set if there has been a timeout
807 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
812 struct flock lock_data;
813 lock_data.l_type = fcntltype;
814 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
816 sigalrm_seen = FALSE;
823 yield = fcntl(fd, F_SETLKW, &lock_data);
828 else yield = fcntl(fd, F_SETLK, &lock_data);
832 if (doflock && (yield >= 0))
834 int flocktype = (fcntltype == F_WRLCK)? LOCK_EX : LOCK_SH;
838 yield = flock(fd, flocktype);
843 else yield = flock(fd, flocktype | LOCK_NB);
845 #endif /* NO_FLOCK */
854 /*************************************************
855 * Copy message into MBX mailbox *
856 *************************************************/
858 /* This function is called when a message intended for a MBX mailbox has been
859 written to a temporary file. We can now get the size of the message and then
860 copy it in MBX format to the mailbox.
863 to_fd fd to write to (the real mailbox)
864 from_fd fd to read from (the temporary file)
865 saved_size current size of mailbox
867 Returns: OK if all went well, DEFER otherwise, with errno preserved
868 the number of bytes written are added to transport_count
869 by virtue of calling transport_write_block()
872 /* Values taken from c-client */
874 #define MBX_HDRSIZE 2048
875 #define MBX_NUSERFLAGS 30
878 copy_mbx_message(int to_fd, int from_fd, int saved_size)
883 /* If the current mailbox size is zero, write a header block */
889 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
890 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
891 (long int)time(NULL));
892 for (i = 0; i < MBX_NUSERFLAGS; i++)
893 sprintf (CS(s += Ustrlen(s)), "\015\012");
894 if (!transport_write_block (to_fd, deliver_out_buffer, MBX_HDRSIZE))
898 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
900 /* Now construct the message's header from the time and the RFC822 file
901 size, including CRLFs, which is the size of the input (temporary) file. */
903 if (fstat(from_fd, &statbuf) < 0) return DEFER;
904 size = statbuf.st_size;
906 sprintf (CS deliver_out_buffer, "%s,%lu;%08lx%04x-%08x\015\012",
907 tod_stamp(tod_mbx), (long unsigned int)size, 0L, 0, 0);
908 used = Ustrlen(deliver_out_buffer);
910 /* Rewind the temporary file, and copy it over in chunks. */
912 lseek(from_fd, 0 , SEEK_SET);
916 int len = read(from_fd, deliver_out_buffer + used,
917 DELIVER_OUT_BUFFER_SIZE - used);
920 if (len == 0) errno = ERRNO_MBXLENGTH;
923 if (!transport_write_block(to_fd, deliver_out_buffer, used + len))
931 #endif /* SUPPORT_MBX */
935 /*************************************************
936 * Check creation is permitted *
937 *************************************************/
939 /* This function checks whether a given file name is permitted to be created,
940 as controlled by the create_file option. If no home directory is set, however,
941 we can't do any tests.
944 filename the file name
945 create_file the ob->create_file option
947 Returns: TRUE if creation is permitted
951 check_creation(uschar *filename, int create_file)
955 if (deliver_home != NULL && create_file != create_anywhere)
957 int len = Ustrlen(deliver_home);
958 uschar *file = filename;
960 while (file[0] == '/' && file[1] == '/') file++;
961 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
962 ( Ustrchr(file+len+2, '/') != NULL &&
964 create_file != create_belowhome ||
965 Ustrstr(file+len, "/../") != NULL
970 /* If yield is TRUE, the file name starts with the home directory, and does
971 not contain any instances of "/../" in the "belowhome" case. However, it may
972 still contain symbolic links. We can check for this by making use of
973 realpath(), which most Unixes seem to have (but make it possible to cut this
974 out). We can't just use realpath() on the whole file name, because we know
975 the file itself doesn't exist, and intermediate directories may also not
976 exist. What we want to know is the real path of the longest existing part of
977 the path. That must match the home directory's beginning, whichever is the
981 if (yield && create_file == create_belowhome)
983 uschar *slash, *next;
985 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
986 rp == NULL && slash > file; /* Stop if reached beginning */
990 rp = US realpath(CS file, CS big_buffer);
991 next = Ustrrchr(file, '/');
995 /* If rp == NULL it means that none of the relevant directories exist.
996 This is not a problem here - it means that no symbolic links can exist,
997 which is all we are worried about. Otherwise, we must compare it
998 against the start of the home directory. However, that may itself
999 contain symbolic links, so we have to "realpath" it as well, if
1004 uschar hdbuffer[PATH_MAX+1];
1005 uschar *rph = deliver_home;
1006 int rlen = Ustrlen(big_buffer);
1008 rp = US realpath(CS deliver_home, CS hdbuffer);
1015 if (rlen > len) rlen = len;
1016 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1019 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1020 big_buffer, deliver_home);
1024 #endif /* NO_REALPATH */
1032 /*************************************************
1033 * Main entry point *
1034 *************************************************/
1036 /* See local README for general interface details. This transport always
1037 returns FALSE, indicating that the status which has been placed in the first
1038 address should be copied to any other addresses in a batch.
1040 Appendfile delivery is tricky and has led to various security problems in other
1041 mailers. The logic used here is therefore laid out in some detail. When this
1042 function is called, we are running in a subprocess which has had its gid and
1043 uid set to the appropriate values. Therefore, we cannot write directly to the
1044 exim logs. Any errors must be handled by setting appropriate return codes.
1045 Note that the default setting for addr->transport_return is DEFER, so it need
1046 not be set unless some other value is required.
1048 The code below calls geteuid() rather than getuid() to get the current uid
1049 because in weird configurations not running setuid root there may be a
1050 difference. In the standard configuration, where setuid() has been used in the
1051 delivery process, there will be no difference between the uid and the euid.
1053 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1054 alias expansion. Otherwise, there must be a configured file name or
1057 The following items apply in the case when a file name (as opposed to a
1058 directory name) is given, that is, when appending to a single file:
1060 (2f) Expand the file name.
1062 (3f) If the file name is /dev/null, return success (optimization).
1064 (4f) If the file_format options is set, open the file for reading, and check
1065 that the bytes at the start of the file match one of the given strings.
1066 If the check indicates a transport other than the current one should be
1067 used, pass control to that other transport. Otherwise continue. An empty
1068 or non-existent file matches the current transport. The file is closed
1071 (5f) If a lock file is required, create it (see extensive separate comments
1072 below about the algorithm for doing this). It is important to do this
1073 before opening the mailbox if NFS is in use.
1075 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1076 details of any symbolic link.
1078 (7f) If the file already exists:
1080 Check the owner and group if necessary, and defer if they are wrong.
1082 If it is a symbolic link AND the allow_symlink option is set (NOT the
1083 default), go back to (6f) but this time use stat() instead of lstat().
1085 If it's not a regular file (or FIFO when permitted), defer delivery.
1087 Check permissions. If the required permissions are *less* than the
1088 existing ones, or supplied by the address (often by the user via filter),
1089 chmod() the file. Otherwise, defer.
1091 Save the inode number.
1093 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1095 If open fails because the file does not exist, go to (6f); on any other
1098 Check the inode number hasn't changed - I realize this isn't perfect (an
1099 inode can be reused) but it's cheap and will catch some of the races.
1101 Check it's still a regular file (or FIFO if permitted).
1103 Check that the owner and permissions haven't changed.
1105 If file_format is set, check that the file still matches the format for
1106 the current transport. If not, defer delivery.
1108 (8f) If file does not exist initially:
1110 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1111 this is via a symbolic link (only possible if allow_symlinks is set), in
1112 which case don't use O_EXCL, as it dosn't work.
1114 If open fails because the file already exists, go to (6f). To avoid
1115 looping for ever in a situation where the file is continuously being
1116 created and deleted, all of this happens inside a loop that operates
1117 lock_retries times and includes the fcntl and flock locking. If the
1118 loop completes without the file getting opened, defer and request
1119 freezing, because something really weird is happening.
1121 If open fails for any other reason, defer for subsequent delivery except
1122 when this is a file delivery resulting from an alias or forward expansion
1123 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1124 most likely a user rather than a configuration error.
1126 (9f) We now have the file checked and open for writing. If so configured, lock
1127 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1128 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1129 still fails, give up and defer delivery.
1131 (10f)Save the access time (for subsequent restoration) and the size of the
1132 file, for comsat and for re-setting if delivery fails in the middle -
1133 e.g. for quota exceeded.
1135 The following items apply in the case when a directory name is given:
1137 (2d) Create a new file in the directory using a temporary name, by opening for
1138 writing and with O_CREAT. If maildir format is being used, the file
1139 is created in a temporary subdirectory with a prescribed name. If
1140 mailstore format is being used, the envelope file is first created with a
1141 temporary name, then the data file.
1143 The following items apply in all cases:
1145 (11) We now have the file open for writing, and locked if it was given as a
1146 file name. Write the message and flush the file, unless there is a setting
1147 of the local quota option, in which case we can check for its excession
1148 without doing any writing.
1150 In the case of MBX format mailboxes, the message is first written to a
1151 temporary file, in order to get its correct length. This is then copied to
1152 the real file, preceded by an MBX header.
1154 If there is a quota error on writing, defer the address. Timeout logic
1155 will determine for how long retries are attempted. We restore the mailbox
1156 to its original length if it's a single file. There doesn't seem to be a
1157 uniform error code for quota excession (it even differs between SunOS4
1158 and some versions of SunOS5) so a system-dependent macro called
1159 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1162 For any other error (most commonly disk full), do the same.
1164 The following applies after appending to a file:
1166 (12f)Restore the atime; notify_comsat if required; close the file (which
1167 unlocks it if it was locked). Delete the lock file if it exists.
1169 The following applies after writing a unique file in a directory:
1171 (12d)For maildir format, rename the file into the new directory. For mailstore
1172 format, rename the envelope file to its correct name. Otherwise, generate
1173 a unique name from the directory_file option, and rename to that, possibly
1174 trying a few times if the file exists and re-expanding the name gives a
1177 This transport yields FAIL only when a file name is generated by an alias or
1178 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1179 All other failures return DEFER (in addr->transport_return). */
1183 appendfile_transport_entry(
1184 transport_instance *tblock, /* data for this instantiation */
1185 address_item *addr) /* address we are working on */
1187 appendfile_transport_options_block *ob =
1188 (appendfile_transport_options_block *)(tblock->options_block);
1189 struct stat statbuf;
1190 uschar *fdname = NULL;
1191 uschar *filename = NULL;
1192 uschar *hitchname = NULL;
1193 uschar *dataname = NULL;
1194 uschar *lockname = NULL;
1195 uschar *newname = NULL;
1196 uschar *nametag = NULL;
1198 uschar *filecount_msg = US"";
1200 struct utimbuf times;
1201 struct timeval msg_tv;
1202 BOOL isdirectory = FALSE;
1203 BOOL isfifo = FALSE;
1204 BOOL wait_for_tick = FALSE;
1205 uid_t uid = geteuid(); /* See note above */
1206 gid_t gid = getegid();
1208 int mode = (addr->mode > 0)? addr->mode : ob->mode;
1209 int saved_size = -1;
1210 int mailbox_size = ob->mailbox_size_value;
1211 int mailbox_filecount = ob->mailbox_filecount_value;
1219 int mbx_lockfd = -1;
1220 uschar mbx_lockname[40];
1221 FILE *temp_file = NULL;
1222 #endif /* SUPPORT_MBX */
1224 #ifdef SUPPORT_MAILDIR
1225 int maildirsize_fd = -1; /* fd for maildirsize file */
1226 int maildir_save_errno;
1230 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1232 /* An "address_file" or "address_directory" transport is used to deliver to
1233 files specified via .forward or an alias file. Prior to release 4.20, the
1234 "file" and "directory" options were ignored in this case. This has been changed
1235 to allow the redirection data to specify what is in effect a folder, whose
1236 location is determined by the options on the transport.
1238 Compatibility with the case when neither option is set is retained by forcing a
1239 value for the file or directory name. A directory delivery is assumed if the
1240 last character of the path from the router is '/'.
1242 The file path is in the local part of the address, but not in the $local_part
1243 variable (that holds the parent local part). It is, however, in the
1244 $address_file variable. Below, we update the local part in the address if it
1245 changes by expansion, so that the final path ends up in the log. */
1247 if (testflag(addr, af_file) &&
1248 ob->filename == NULL &&
1249 ob->dirname == NULL)
1251 fdname = US"$address_file";
1252 if (address_file[Ustrlen(address_file)-1] == '/' ||
1253 ob->maildir_format ||
1254 ob->mailstore_format)
1258 /* Handle (a) an "address file" delivery where "file" or "directory" is
1259 explicitly set and (b) a non-address_file delivery, where one of "file" or
1260 "directory" must be set; initialization ensures that they are not both set. */
1264 fdname = ob->filename;
1267 fdname = ob->dirname;
1272 addr->transport_return = PANIC;
1273 addr->message = string_sprintf("Mandatory file or directory option "
1274 "missing from %s transport", tblock->name);
1279 /* Maildir and mailstore require a directory */
1281 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1283 addr->transport_return = PANIC;
1284 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1285 "to be specified for the %s transport",
1286 ob->maildir_format? "dir" : "store", tblock->name);
1290 path = expand_string(fdname);
1294 addr->transport_return = PANIC;
1295 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1296 "name for %s transport) failed: %s", fdname, tblock->name,
1297 expand_string_message);
1303 addr->message = string_sprintf("appendfile: file or directory name "
1304 "\"%s\" is not absolute", path);
1305 addr->basic_errno = ERRNO_NOTABSOLUTE;
1309 /* For a file delivery, make sure the local part in the address is updated to
1310 the true local part. */
1312 if (testflag(addr, af_file)) addr->local_part = string_copy(path);
1314 /* The available mailbox formats depend on whether it is a directory or a file
1320 #ifdef SUPPORT_MAILDIR
1321 (ob->maildir_format)? mbf_maildir :
1323 #ifdef SUPPORT_MAILSTORE
1324 (ob->mailstore_format)? mbf_mailstore :
1332 (ob->mbx_format)? mbf_mbx :
1339 debug_printf("appendfile: mode=%o notify_comsat=%d quota=%d warning=%d%s\n"
1340 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1341 "maildir_use_size_file=%s\n",
1342 mode, ob->notify_comsat, ob->quota_value, ob->quota_warn_threshold_value,
1343 ob->quota_warn_threshold_is_percent? "%" : "",
1344 isdirectory? "directory" : "file",
1345 path, mailbox_formats[mbformat],
1346 (ob->message_prefix == NULL)? US"null" : string_printing(ob->message_prefix),
1347 (ob->message_suffix == NULL)? US"null" : string_printing(ob->message_suffix),
1348 (ob->maildir_use_size_file)? "yes" : "no");
1350 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1351 ob->use_lockfile? "lockfile " : "",
1352 ob->use_mbx_lock? "mbx locking (" : "",
1353 ob->use_fcntl? "fcntl " : "",
1354 ob->use_flock? "flock" : "",
1355 ob->use_mbx_lock? ")" : "");
1358 /* If the -N option is set, can't do any more. */
1363 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1365 addr->transport_return = OK;
1369 /* Handle the case of a file name. If the file name is /dev/null, we can save
1370 ourselves some effort and just give a success return right away. */
1374 BOOL use_lstat = TRUE;
1375 BOOL file_opened = FALSE;
1376 BOOL allow_creation_here = TRUE;
1378 if (Ustrcmp(path, "/dev/null") == 0)
1380 addr->transport_return = OK;
1384 /* Set the name of the file to be opened, and the file to which the data
1385 is written, and find out if we are permitted to create a non-existent file. */
1387 dataname = filename = path;
1388 allow_creation_here = check_creation(filename, ob->create_file);
1390 /* If ob->create_directory is set, attempt to create the directories in
1391 which this mailbox lives, but only if we are permitted to create the file
1392 itself. We know we are dealing with an absolute path, because this was
1395 if (ob->create_directory && allow_creation_here)
1397 uschar *p = Ustrrchr(path, '/');
1399 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1401 addr->basic_errno = errno;
1403 string_sprintf("failed to create directories for %s: %s", path,
1405 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1411 /* If file_format is set we must check that any existing file matches one of
1412 the configured formats by checking the bytes it starts with. A match then
1413 indicates a specific transport - if it is not this one, pass control to it.
1414 Otherwise carry on here. An empty or non-existent file matches the current
1415 transport. We don't need to distinguish between non-existence and other open
1416 failures because if an existing file fails to open here, it will also fail
1417 again later when O_RDWR is used. */
1419 if (ob->file_format != NULL)
1421 int cfd = Uopen(path, O_RDONLY, 0);
1424 transport_instance *tt = check_file_format(cfd, tblock, addr);
1427 /* If another transport is indicated, call it and return; if no transport
1428 was found, just return - the error data will have been set up.*/
1434 set_process_info("delivering %s to %s using %s", message_id,
1435 addr->local_part, tt->name);
1436 debug_print_string(tt->debug_string);
1437 addr->transport = tt;
1438 (tt->info->code)(tt, addr);
1445 /* The locking of mailbox files is worse than the naming of cats, which is
1446 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1447 three different names, so several different styles of locking are used.
1449 Research in other programs that lock mailboxes shows that there is no
1450 universally standard method. Having mailboxes NFS-mounted on the system that
1451 is delivering mail is not the best thing, but people do run like this,
1452 and so the code must do its best to cope.
1454 Three different locking mechanisms are supported. The initialization function
1455 checks that at least one is configured.
1459 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1460 will work over NFS. Only after that is done do we actually open the mailbox
1461 and apply locks to it (if configured).
1463 Originally, Exim got the file opened before doing anything about locking.
1464 However, a very occasional problem was observed on Solaris 2 when delivering
1465 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1466 gets remembered at open time. If another process on another host (that's
1467 important) has the file open and locked and writes to it and then releases
1468 the lock while the first process is waiting to get the lock, the first
1469 process may fail to write at the new end point of the file - despite the very
1470 definite statement about O_APPEND in the man page for write(). Experiments
1471 have reproduced this problem, but I do not know any way of forcing a host to
1472 update its attribute cache for an open NFS file. It would be nice if it did
1473 so when a lock was taken out, but this does not seem to happen. Anyway, to
1474 reduce the risk of this problem happening, we now create the lock file
1475 (if configured) *before* opening the mailbox. That will prevent two different
1476 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1477 however, but Pine at least seems to operate in the same way.
1479 Lockfiles should normally be used when NFS is involved, because of the above
1482 The logic for creating the lock file is:
1484 . The name of the lock file is <mailbox-name>.lock
1486 . First, create a "hitching post" name by adding the primary host name,
1487 current time and pid to the lock file name. This should be unique.
1489 . Create the hitching post file using WRONLY + CREAT + EXCL.
1491 . If that fails EACCES, we assume it means that the user is unable to create
1492 files in the mail spool directory. Some installations might operate in this
1493 manner, so there is a configuration option to allow this state not to be an
1494 error - we proceed to lock using fcntl only, after the file is open.
1496 . Otherwise, an error causes a deferment of the address.
1498 . Hard link the hitching post to the lock file name.
1500 . If the link succeeds, we have successfully created the lock file. Simply
1501 close and unlink the hitching post file.
1503 . If the link does not succeed, proceed as follows:
1505 o Fstat the hitching post file, and then close and unlink it.
1507 o Now examine the stat data. If the number of links to the file is exactly
1508 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1509 the return never made it back, so the link() function gave a failure
1512 . This method allows for the lock file to be created by some other process
1513 right up to the moment of the attempt to hard link it, and is also robust
1514 against NFS server crash-reboots, which would probably result in timeouts
1515 in the middle of link().
1517 . System crashes may cause lock files to get left lying around, and some means
1518 of flushing them is required. The approach of writing a pid (used by smail
1519 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1520 timeout, which seems a better approach. Since any program that writes to a
1521 mailbox using a lock file should complete its task very quickly, Pine
1522 removes lock files that are older than 5 minutes. We allow the value to be
1523 configurable on the transport.
1527 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1528 mailbox once it is open. This is done by default with a non-blocking lock.
1529 Failures to lock cause retries after a sleep, but only for a certain number
1530 of tries. A blocking lock is deliberately not used so that we don't hold the
1531 mailbox open. This minimizes the possibility of the NFS problem described
1532 under LOCK FILES above, if for some reason NFS deliveries are happening
1533 without lock files. However, the use of a non-blocking lock and sleep, though
1534 the safest approach, does not give the best performance on very busy systems.
1535 A blocking lock plus timeout does better. Therefore Exim has an option to
1536 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1537 enables the use of blocking fcntl() calls.
1541 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1542 same manner as for fcntl locking above. No-blocking/timeout is also set as
1543 above in lock_flock_timeout. Not all operating systems provide or support
1544 flock(). For those that don't (as determined by the definition of LOCK_SH in
1545 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1546 is implemented (not precisely) on top of fcntl(), which means there's no
1547 point in actually using it.
1551 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1552 then the rules used for locking in c-client are used. Exim takes out a shared
1553 lock on the mailbox file, and an exclusive lock on the file whose name is
1554 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1555 any other MBX client from getting an exclusive lock on it and expunging it.
1556 It also stops any other MBX client from unlinking the /tmp lock when it has
1559 The exclusive lock on the /tmp file prevents any other MBX client from
1560 updating the mailbox in any way. When writing is finished, if an exclusive
1561 lock on the mailbox can be obtained, indicating there are no current sharers,
1562 the /tmp file is unlinked.
1564 MBX locking can use either fcntl() or flock() locking. If neither
1565 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1566 The calls for getting these locks are by default non-blocking, as for non-mbx
1567 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1568 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1569 probably makes sense to set timeouts for any MBX deliveries. */
1572 /* Build a lock file if configured to do so - the existence of a lock
1573 file is subsequently checked by looking for a non-negative value of the
1574 file descriptor hd - even though the file is no longer open. */
1576 if (ob->use_lockfile)
1578 lockname = string_sprintf("%s.lock", filename);
1579 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1580 (unsigned int)(time(NULL)), (unsigned int)getpid());
1582 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1585 /* Lock file creation retry loop */
1587 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1590 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1594 addr->basic_errno = errno;
1596 string_sprintf("creating lock file hitching post %s "
1597 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1598 (long int)getegid());
1602 /* Attempt to hitch the hitching post to the lock file. If link()
1603 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1604 file, and get rid of the hitching post. If the number of links was 2,
1605 the link was created, despite the failure of link(). If the hitch was
1606 not successful, try again, having unlinked the lock file if it is too
1609 There's a version of Linux (2.0.27) which doesn't update its local cache
1610 of the inode after link() by default - which many think is a bug - but
1611 if the link succeeds, this code will be OK. It just won't work in the
1612 case when link() fails after having actually created the link. The Linux
1613 NFS person is fixing this; a temporary patch is available if anyone is
1614 sufficiently worried. */
1616 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1619 if (rc != 0 && statbuf.st_nlink != 2)
1621 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1622 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1624 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1627 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1631 DEBUG(D_transport) debug_printf("lock file created\n");
1635 /* Check for too many tries at creating the lock file */
1637 if (i >= ob->lock_retries)
1639 addr->basic_errno = ERRNO_LOCKFAILED;
1640 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1647 /* We now have to get the file open. First, stat() it and act on existence or
1648 non-existence. This is in a loop to handle the case of a file's being created
1649 or deleted as we watch, and also to handle retries when the locking fails.
1650 Rather than holding the file open while waiting for the fcntl() and/or
1651 flock() lock, we close and do the whole thing again. This should be safer,
1652 especially for NFS files, which might get altered from other hosts, making
1653 their cached sizes incorrect.
1655 With the default settings, no symlinks are permitted, but there is an option
1656 to permit symlinks for those sysadmins that know what they are doing.
1657 Shudder. However, insist that the initial symlink is owned by the right user.
1658 Thus lstat() is used initially; if a symlink is discovered, the loop is
1659 repeated such that stat() is used, to look at the end file. */
1661 for (i = 0; i < ob->lock_retries; i++)
1663 int sleep_before_retry = TRUE;
1664 file_opened = FALSE;
1666 if((use_lstat? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1668 /* Let's hope that failure to stat (other than non-existence) is a
1671 if (errno != ENOENT)
1673 addr->basic_errno = errno;
1674 addr->message = string_sprintf("attempting to stat mailbox %s",
1679 /* File does not exist. If it is required to pre-exist this state is an
1682 if (ob->file_must_exist)
1684 addr->basic_errno = errno;
1685 addr->message = string_sprintf("mailbox %s does not exist, "
1686 "but file_must_exist is set", filename);
1690 /* If not permitted to create this file because it isn't in or below
1691 the home directory, generate an error. */
1693 if (!allow_creation_here)
1695 addr->basic_errno = ERRNO_BADCREATE;
1696 addr->message = string_sprintf("mailbox %s does not exist, "
1697 "but creation outside the home directory is not permitted",
1702 /* Attempt to create and open the file. If open fails because of
1703 pre-existence, go round the loop again. For any other error, defer the
1704 address, except for an alias or forward generated file name with EPERM,
1705 ENOENT, or EACCES, as those are most likely to be user errors rather
1706 than Exim config errors. When a symbolic link is permitted and points
1707 to a non-existent file, we get here with use_lstat = FALSE. In this case
1708 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1709 consistency and because MBX locking requires it in order to be able to
1710 get a shared lock. */
1712 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1713 (use_lstat? O_EXCL : 0), mode);
1716 if (errno == EEXIST) continue;
1717 addr->basic_errno = errno;
1718 addr->message = string_sprintf("while creating mailbox %s",
1720 if (testflag(addr, af_file) &&
1721 (errno == EPERM || errno == ENOENT || errno == EACCES))
1722 addr->transport_return = FAIL;
1726 /* We have successfully created and opened the file. Ensure that the group
1727 and the mode are correct. */
1729 Uchown(filename, uid, gid);
1730 Uchmod(filename, mode);
1734 /* The file already exists. Test its type, ownership, and permissions, and
1735 save the inode for checking later. If symlinks are permitted (not the
1736 default or recommended state) it may be a symlink that already exists.
1737 Check its ownership and then look for the file at the end of the link(s).
1738 This at least prevents one user creating a symlink for another user in
1739 a sticky directory. */
1743 int oldmode = (int)statbuf.st_mode;
1744 ino_t inode = statbuf.st_ino;
1745 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1747 isfifo = FALSE; /* In case things are changing */
1749 /* Check owner if required - the default. */
1751 if (ob->check_owner && statbuf.st_uid != uid)
1753 addr->basic_errno = ERRNO_BADUGID;
1754 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1755 "(%ld != %ld)", filename,
1756 islink? " (symlink)" : "",
1757 (long int)(statbuf.st_uid), (long int)uid);
1761 /* Group is checked only if check_group is set. */
1763 if (ob->check_group && statbuf.st_gid != gid)
1765 addr->basic_errno = ERRNO_BADUGID;
1766 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1767 filename, islink? " (symlink)" : "", statbuf.st_gid, gid);
1771 /* If symlinks are permitted (not recommended), the lstat() above will
1772 have found the symlink. Its ownership has just been checked; go round
1773 the loop again, using stat() instead of lstat(). That will never yield a
1776 if (islink && ob->allow_symlink)
1779 i--; /* Don't count this time round */
1783 /* An actual file exists. Check that it is a regular file, or FIFO
1786 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1788 else if ((oldmode & S_IFMT) != S_IFREG)
1790 addr->basic_errno = ERRNO_NOTREGULAR;
1791 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1792 filename, ob->allow_fifo? " or named pipe" : "");
1796 /* If the mode is not what it would be for a newly created file, change
1797 the permissions if the mode is supplied for the address. Otherwise,
1798 reduce but do not extend the permissions. If the newly created
1799 permissions are greater than the existing permissions, don't change
1800 things when the mode is not from the address. */
1802 if ((oldmode = (oldmode & 07777)) != mode)
1804 int diffs = oldmode ^ mode;
1805 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1807 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1808 if (Uchmod(filename, mode) < 0)
1810 addr->basic_errno = errno;
1811 addr->message = string_sprintf("attempting to chmod mailbox %s",
1818 /* Mode not from address, and newly-created permissions are greater
1819 than existing permissions. Default is to complain, but it can be
1820 configured to go ahead and try to deliver anyway if that's what
1821 the administration wants. */
1823 else if (ob->mode_fail_narrower)
1825 addr->basic_errno = ERRNO_BADMODE;
1826 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1827 "(%o expected)", filename, oldmode, mode);
1832 /* We are happy with the existing file. Open it, and then do further
1833 tests to ensure that it is the same file that we were just looking at.
1834 If the file does not now exist, restart this loop, going back to using
1835 lstat again. For an NFS error, just defer; other opening errors are
1836 more serious. The file is opened RDWR so that its format can be checked,
1837 and also MBX locking requires the use of a shared (read) lock. However,
1838 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1839 reading the pipe. */
1841 fd = Uopen(filename, isfifo? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1845 if (errno == ENOENT)
1850 addr->basic_errno = errno;
1853 addr->message = string_sprintf("while opening named pipe %s "
1854 "(could mean no process is reading it)", filename);
1856 else if (errno != EWOULDBLOCK)
1858 addr->message = string_sprintf("while opening mailbox %s", filename);
1863 /* This fstat really shouldn't fail, as we have an open file! There's a
1864 dilemma here. We use fstat in order to be sure we are peering at the file
1865 we have got open. However, that won't tell us if the file was reached
1866 via a symbolic link. We checked this above, but there is a race exposure
1867 if the link was created between the previous lstat and the open. However,
1868 it would have to be created with the same inode in order to pass the
1869 check below. If ob->allow_symlink is set, causing the use of stat rather
1870 than lstat above, symbolic links may be there anyway, and the checking is
1873 if (fstat(fd, &statbuf) < 0)
1875 addr->basic_errno = errno;
1876 addr->message = string_sprintf("attempting to stat open mailbox %s",
1881 /* Check the inode; this is isn't a perfect check, but gives some
1884 if (inode != statbuf.st_ino)
1886 addr->basic_errno = ERRNO_INODECHANGED;
1887 addr->message = string_sprintf("opened mailbox %s inode number changed "
1888 "from %d to %ld", filename, inode, statbuf.st_ino);
1889 addr->special_action = SPECIAL_FREEZE;
1893 /* Check it's still a regular file or FIFO, and the uid, gid, and
1894 permissions have not changed. */
1896 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1897 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1899 addr->basic_errno = ERRNO_NOTREGULAR;
1901 string_sprintf("opened mailbox %s is no longer a %s", filename,
1902 isfifo? "named pipe" : "regular file");
1903 addr->special_action = SPECIAL_FREEZE;
1907 if ((ob->check_owner && statbuf.st_uid != uid) ||
1908 (ob->check_group && statbuf.st_gid != gid))
1910 addr->basic_errno = ERRNO_BADUGID;
1912 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1913 addr->special_action = SPECIAL_FREEZE;
1917 if ((statbuf.st_mode & 07777) != oldmode)
1919 addr->basic_errno = ERRNO_BADMODE;
1920 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1921 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1922 addr->special_action = SPECIAL_FREEZE;
1926 /* If file_format is set, check that the format of the file has not
1927 changed. Error data is set by the testing function. */
1929 if (ob->file_format != NULL &&
1930 check_file_format(fd, tblock, addr) != tblock)
1932 addr->message = US"open mailbox has changed format";
1936 /* The file is OK. Carry on to do the locking. */
1939 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1940 locking rules if configured to do so. If a lock file is also required, it
1941 was created above and hd was left >= 0. At least one form of locking is
1942 required by the initialization function. If locking fails here, close the
1943 file and go round the loop all over again, after waiting for a bit, unless
1944 blocking locking was used. */
1947 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1948 sleep_before_retry = FALSE;
1950 /* Simple fcntl() and/or flock() locking */
1952 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
1954 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1955 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
1958 /* MBX locking rules */
1961 else if (ob->use_mbx_lock)
1963 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1964 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
1965 fstat(fd, &statbuf) >= 0)
1967 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
1968 (long)statbuf.st_ino);
1970 if (Ulstat(mbx_lockname, &statbuf) >= 0)
1972 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
1974 addr->basic_errno = ERRNO_LOCKFAILED;
1975 addr->message = string_sprintf("symbolic link on MBX lock file %s",
1979 if (statbuf.st_nlink > 1)
1981 addr->basic_errno = ERRNO_LOCKFAILED;
1982 addr->message = string_sprintf("hard link to MBX lock file %s",
1988 mbx_lockfd = Uopen(mbx_lockname, O_RDWR | O_CREAT, 0600);
1991 addr->basic_errno = ERRNO_LOCKFAILED;
1992 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
1993 mbx_lockname, strerror(errno));
1997 Uchmod(mbx_lockname, 0600);
1999 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2000 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2002 struct stat ostatbuf;
2004 /* This tests for a specific race condition. Ensure that we still
2005 have the same file. */
2007 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2008 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2009 statbuf.st_dev == ostatbuf.st_dev &&
2010 statbuf.st_ino == ostatbuf.st_ino)
2012 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2013 "between creation and locking\n", mbx_lockname);
2016 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2023 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2024 filename, strerror(errno));
2027 #endif /* SUPPORT_MBX */
2029 else break; /* No on-file locking required; break the open/lock loop */
2032 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2036 use_lstat = TRUE; /* Reset to use lstat first */
2039 /* If a blocking call timed out, break the retry loop if the total time
2040 so far is not less than than retries * interval. Use the larger of the
2041 flock() and fcntl() timeouts. */
2044 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2045 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2046 ob->lock_retries * ob->lock_interval)
2047 i = ob->lock_retries;
2049 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2050 flock() that caused the problem. */
2052 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2055 /* Test for exceeding the maximum number of tries. Either the file remains
2056 locked, or, if we haven't got it open, something is terribly wrong... */
2058 if (i >= ob->lock_retries)
2062 addr->basic_errno = ERRNO_EXISTRACE;
2063 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2064 addr->special_action = SPECIAL_FREEZE;
2068 addr->basic_errno = ERRNO_LOCKFAILED;
2069 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2075 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2077 /* Save access time (for subsequent restoration), modification time (for
2078 restoration if updating fails), size of file (for comsat and for re-setting if
2079 delivery fails in the middle - e.g. for quota exceeded). */
2081 if (fstat(fd, &statbuf) < 0)
2083 addr->basic_errno = errno;
2084 addr->message = string_sprintf("while fstatting opened mailbox %s",
2089 times.actime = statbuf.st_atime;
2090 times.modtime = statbuf.st_mtime;
2091 saved_size = statbuf.st_size;
2092 if (mailbox_size < 0) mailbox_size = saved_size;
2093 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2096 /* Prepare for writing to a new file (as opposed to appending to an old one).
2097 There are several different formats, but there is preliminary stuff concerned
2098 with quotas that applies to all of them. Finding the current size by directory
2099 scanning is expensive; for maildirs some fudges have been invented:
2101 (1) A regex can be used to extract a file size from its name;
2102 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2108 uschar *check_path = path; /* Default quota check path */
2109 const pcre *regex = NULL; /* Regex for file size from file name */
2111 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2113 addr->basic_errno = ERRNO_BADCREATE;
2114 addr->message = string_sprintf("tried to create file in %s, but "
2115 "file creation outside the home directory is not permitted", path);
2119 #ifdef SUPPORT_MAILDIR
2120 /* For a maildir delivery, ensure that all the relevant directories exist */
2122 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2123 ob->create_directory, ob->dirmode))
2125 #endif /* SUPPORT_MAILDIR */
2127 /* If we are going to do a quota check, of if maildir_use_size_file is set
2128 for a maildir delivery, compile the regular expression if there is one. We
2129 may also need to adjust the path that is used. We need to do this for
2130 maildir_use_size_file even if the quota is unset, because we still want to
2131 create the file. When maildir support is not compiled,
2132 ob->maildir_use_size_file is always FALSE. */
2134 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2136 const uschar *error;
2139 /* Compile the regex if there is one */
2141 if (ob->quota_size_regex != NULL)
2143 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2144 (const char **)&error, &offset, NULL);
2147 addr->message = string_sprintf("appendfile: regular expression "
2148 "error: %s at offset %d while compiling %s", error, offset,
2149 ob->quota_size_regex);
2154 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2155 ob->quota_size_regex);
2159 /* Use an explicitly configured directory if set */
2161 if (ob->quota_directory != NULL)
2163 check_path = expand_string(ob->quota_directory);
2164 if (check_path == NULL)
2166 addr->transport_return = PANIC;
2167 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2168 "name for %s transport) failed: %s", ob->quota_directory,
2169 tblock->name, expand_string_message);
2173 if (check_path[0] != '/')
2175 addr->message = string_sprintf("appendfile: quota_directory name "
2176 "\"%s\" is not absolute", check_path);
2177 addr->basic_errno = ERRNO_NOTABSOLUTE;
2182 #ifdef SUPPORT_MAILDIR
2183 /* Otherwise, if we are handling a maildir delivery, and the directory
2184 contains a file called maildirfolder, this is a maildir++ feature telling
2185 us that this is a sub-directory of the real inbox. We should therefore do
2186 the quota check on the parent directory. Beware of the special case when
2187 the directory name itself ends in a slash. */
2189 else if (mbformat == mbf_maildir)
2191 struct stat statbuf;
2192 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2194 uschar *new_check_path = string_copy(check_path);
2195 uschar *slash = Ustrrchr(new_check_path, '/');
2201 slash = Ustrrchr(new_check_path, '/');
2206 check_path = new_check_path;
2211 #endif /* SUPPORT_MAILDIR */
2214 /* If we are using maildirsize files, we need to ensure that such a file
2215 exists and, if necessary, recalculate its contents. As a byproduct of this,
2216 we obtain the current size of the maildir. If no quota is to be enforced
2217 (ob->quota_value == 0), we still need the size if a threshold check will
2220 Another regular expression is used to determine which directories inside the
2221 maildir are going to be counted. */
2223 #ifdef SUPPORT_MAILDIR
2224 if (ob->maildir_use_size_file)
2226 const pcre *dir_regex = NULL;
2227 const uschar *error;
2230 if (ob->maildir_dir_regex != NULL)
2232 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2233 (const char **)&error, &offset, NULL);
2234 if (dir_regex == NULL)
2236 addr->message = string_sprintf("appendfile: regular expression "
2237 "error: %s at offset %d while compiling %s", error, offset,
2238 ob->maildir_dir_regex);
2244 debug_printf("using regex for maildir directory selection: %s\n",
2245 ob->maildir_dir_regex);
2249 /* Quota enforcement; create and check the file. There is some discussion
2250 about whether this should happen if the quota is unset. At present, Exim
2251 always creates the file. If we ever want to change this, uncomment
2252 appropriate lines below, possibly doing a check on some option. */
2254 /* if (???? || ob->quota_value > 0) */
2257 int size, filecount;
2259 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2262 if (maildirsize_fd == -1)
2264 addr->basic_errno = errno;
2265 addr->message = string_sprintf("while opening or reading "
2266 "%s/maildirsize", check_path);
2270 if (mailbox_size < 0) mailbox_size = size;
2271 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2274 /* No quota enforcement; ensure file does *not* exist; calculate size if
2279 * time_t old_latest;
2280 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2281 * if (THRESHOLD_CHECK)
2282 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2283 * regex, dir_regex, FALSE);
2288 #endif /* SUPPORT_MAILDIR */
2290 /* Otherwise (mailbox_size is not yet set), if we are going to do a quota
2291 check later on, find the current size of the mailbox. (We don't need to check
2292 ob->quota_filecount_value, because it can only be set if ob->quota_value is
2295 if ((mailbox_size < 0 || mailbox_filecount < 0) &&
2296 (ob->quota_value > 0 || THRESHOLD_CHECK))
2301 debug_printf("quota checks on directory %s\n", check_path);
2302 size = check_dir_size(check_path, &filecount, regex);
2303 if (mailbox_size < 0) mailbox_size = size;
2304 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2307 /* Handle the case of creating a unique file in a given directory (not in
2308 maildir or mailstore format - this is how smail did it). A temporary name is
2309 used to create the file. Later, when it is written, the name is changed to a
2310 unique one. There is no need to lock the file. An attempt is made to create
2311 the directory if it does not exist. */
2313 if (mbformat == mbf_smail)
2316 debug_printf("delivering to new file in %s\n", path);
2317 filename = dataname =
2318 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2319 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2320 if (fd < 0 && /* failed to open, and */
2321 (errno != ENOENT || /* either not non-exist */
2322 !ob->create_directory || /* or not allowed to make */
2323 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2324 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2326 addr->basic_errno = errno;
2327 addr->message = string_sprintf("while creating file %s", filename);
2332 #ifdef SUPPORT_MAILDIR
2334 /* Handle the case of a unique file in maildir format. The file is written to
2335 the tmp subdirectory, with a prescribed form of name. */
2337 else if (mbformat == mbf_maildir)
2340 debug_printf("delivering in maildir format in %s\n", path);
2342 nametag = ob->maildir_tag;
2344 /* Check that nametag expands successfully; a hard failure causes a panic
2345 return. The actual expansion for use happens again later, when
2346 $message_size is accurately known. */
2348 if (nametag != NULL && expand_string(nametag) == NULL &&
2349 !expand_string_forcedfail)
2351 addr->transport_return = PANIC;
2352 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2353 "for %s transport) failed: %s", nametag, tblock->name,
2354 expand_string_message);
2358 /* We ensured the existence of all the relevant directories above. Attempt
2359 to open the temporary file a limited number of times. I think this rather
2360 scary-looking for statement is actually OK. If open succeeds, the loop is
2361 broken; if not, there is a test on the value of i. Get the time again
2362 afresh each time round the loop. Its value goes into a variable that is
2363 checked at the end, to make sure we don't release this process until the
2364 clock has ticked. */
2370 (void)gettimeofday(&msg_tv, NULL);
2371 basename = string_sprintf("%lu.H%luP%lu.%s", msg_tv.tv_sec,
2372 msg_tv.tv_usec, getpid(), primary_hostname);
2374 filename = dataname = string_sprintf("tmp/%s", basename);
2375 newname = string_sprintf("new/%s", basename);
2377 if (Ustat(filename, &statbuf) == 0)
2379 else if (errno == ENOENT)
2381 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2383 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2384 filename, strerror(errno));
2387 /* Too many retries - give up */
2389 if (i >= ob->maildir_retries)
2391 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2392 filename, i, (i == 1)? "y" : "ies");
2393 addr->basic_errno = errno;
2397 /* Open or stat failed but we haven't tried too many times yet. */
2402 /* Note that we have to ensure the clock has ticked before leaving */
2404 wait_for_tick = TRUE;
2406 /* Why are these here? Put in because they are present in the non-maildir
2407 directory case above. */
2409 Uchown(filename, uid, gid);
2410 Uchmod(filename, mode);
2413 #endif /* SUPPORT_MAILDIR */
2415 #ifdef SUPPORT_MAILSTORE
2417 /* Handle the case of a unique file in mailstore format. First write the
2418 envelope to a temporary file, then open the main file. The unique base name
2419 for the files consists of the message id plus the pid of this delivery
2425 address_item *taddr;
2426 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2427 string_base62((long int)getpid()));
2430 debug_printf("delivering in mailstore format in %s\n", path);
2432 filename = string_sprintf("%s.tmp", mailstore_basename);
2433 newname = string_sprintf("%s.env", mailstore_basename);
2434 dataname = string_sprintf("%s.msg", mailstore_basename);
2436 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2437 if (fd < 0 && /* failed to open, and */
2438 (errno != ENOENT || /* either not non-exist */
2439 !ob->create_directory || /* or not allowed to make */
2440 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2441 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2443 addr->basic_errno = errno;
2444 addr->message = string_sprintf("while creating file %s", filename);
2448 /* Why are these here? Put in because they are present in the non-maildir
2449 directory case above. */
2451 Uchown(filename, uid, gid);
2452 Uchmod(filename, mode);
2454 /* Built a C stream from the open file descriptor. */
2456 if ((env_file = fdopen(fd, "wb")) == NULL)
2458 addr->basic_errno = errno;
2459 addr->transport_return = PANIC;
2460 addr->message = string_sprintf("fdopen of %s ("
2461 "for %s transport) failed", filename, tblock->name);
2467 /* Write the envelope file, then close it. */
2469 if (ob->mailstore_prefix != NULL)
2471 uschar *s = expand_string(ob->mailstore_prefix);
2474 if (!expand_string_forcedfail)
2476 addr->transport_return = PANIC;
2477 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2478 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2479 tblock->name, expand_string_message);
2488 fprintf(env_file, "%s", CS s);
2489 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2493 fprintf(env_file, "%s\n", sender_address);
2495 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2496 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2498 if (ob->mailstore_suffix != NULL)
2500 uschar *s = expand_string(ob->mailstore_suffix);
2503 if (!expand_string_forcedfail)
2505 addr->transport_return = PANIC;
2506 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2507 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2508 tblock->name, expand_string_message);
2517 fprintf(env_file, "%s", CS s);
2518 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2522 if (fclose(env_file) != 0)
2524 addr->basic_errno = errno;
2525 addr->message = string_sprintf("while closing %s", filename);
2530 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2532 /* Now open the data file, and ensure that it has the correct ownership and
2535 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2538 addr->basic_errno = errno;
2539 addr->message = string_sprintf("while creating file %s", dataname);
2543 Uchown(dataname, uid, gid);
2544 Uchmod(dataname, mode);
2547 #endif /* SUPPORT_MAILSTORE */
2550 /* In all cases of writing to a new file, ensure that the file which is
2551 going to be renamed has the correct ownership and mode. */
2553 Uchown(filename, uid, gid);
2554 Uchmod(filename, mode);
2558 /* At last we can write the message to the file, preceded by any configured
2559 prefix line, and followed by any configured suffix line. If there are any
2560 writing errors, we must defer. */
2562 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2567 /* If there is a local quota setting, check that we are not going to exceed it
2568 with this message if quota_is_inclusive is set; if it is not set, the check
2569 is for the mailbox already being over quota (i.e. the current message is not
2570 included in the check). */
2572 if (ob->quota_value > 0)
2576 debug_printf("Exim quota = %d old size = %d this message = %d "
2577 "(%sincluded)\n", ob->quota_value, mailbox_size, message_size,
2578 ob->quota_is_inclusive? "" : "not ");
2579 debug_printf(" file count quota = %d count = %d\n",
2580 ob->quota_filecount_value, mailbox_filecount);
2582 if (mailbox_size + (ob->quota_is_inclusive? message_size:0) > ob->quota_value)
2584 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2586 errno = ERRNO_EXIMQUOTA;
2588 else if (ob->quota_filecount_value > 0 &&
2589 mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2590 ob->quota_filecount_value)
2592 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2594 errno = ERRNO_EXIMQUOTA;
2595 filecount_msg = US" filecount";
2599 /* If we are writing in MBX format, what we actually do is to write the message
2600 to a temporary file, and then copy it to the real file once we know its size.
2601 This is the most straightforward way of getting the correct length in the
2602 separator line. So, what we do here is to save the real file descriptor, and
2603 replace it with one for a temporary file. The temporary file gets unlinked once
2604 opened, so that it goes away on closure. */
2607 if (yield == OK && ob->mbx_format)
2609 temp_file = tmpfile();
2610 if (temp_file == NULL)
2612 addr->basic_errno = errno;
2613 addr->message = US"while setting up temporary file";
2618 fd = fileno(temp_file);
2619 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2621 #endif /* SUPPORT_MBX */
2623 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2626 transport_count = 0;
2628 /* Write any configured prefix text first */
2630 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2632 uschar *prefix = expand_string(ob->message_prefix);
2635 errno = ERRNO_EXPANDFAIL;
2636 addr->transport_return = PANIC;
2637 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2638 "transport) failed", ob->message_prefix, tblock->name);
2641 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2644 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2645 various different values for batching are handled outside; if there is more
2646 than one address available here, all must be included. If any address is a
2647 file, use its parent in the RCPT TO. */
2649 if (yield == OK && ob->use_bsmtp)
2651 transport_count = 0;
2652 if (ob->use_crlf) cr = US"\r";
2653 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2658 for (a = addr; a != NULL; a = a->next)
2660 address_item *b = testflag(a, af_pfr)? a->parent: a;
2661 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2662 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2663 { yield = DEFER; break; }
2665 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2670 /* Now the message itself. The options for transport_write_message were set up
2671 at initialization time. */
2675 if (!transport_write_message(addr, fd, ob->options, 0, tblock->add_headers,
2676 tblock->remove_headers, ob->check_string, ob->escape_string,
2677 tblock->rewrite_rules, tblock->rewrite_existflags))
2681 /* Now a configured suffix. */
2683 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2685 uschar *suffix = expand_string(ob->message_suffix);
2688 errno = ERRNO_EXPANDFAIL;
2689 addr->transport_return = PANIC;
2690 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2691 "transport) failed", ob->message_suffix, tblock->name);
2694 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2697 /* If batch smtp, write the terminating dot. */
2699 if (yield == OK && ob->use_bsmtp &&
2700 !transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2702 /* If MBX format is being used, all that writing was to the temporary file.
2703 However, if there was an earlier failure (Exim quota exceeded, for example),
2704 the temporary file won't have got opened - and no writing will have been done.
2705 If writing was OK, we restore the fd, and call a function that copies the
2706 message in MBX format into the real file. Otherwise use the temporary name in
2710 if (temp_file != NULL && ob->mbx_format)
2717 transport_count = 0; /* Reset transport count for actual write */
2718 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2720 else if (errno >= 0) dataname = US"temporary file";
2722 /* Preserve errno while closing the temporary file. */
2724 mbx_save_errno = errno;
2726 errno = mbx_save_errno;
2728 #endif /* SUPPORT_MBX */
2730 /* Force out the remaining data to check for any errors; some OS don't allow
2731 fsync() to be called for a FIFO. */
2733 if (yield == OK && !isfifo && fsync(fd) < 0) yield = DEFER;
2735 /* Update message_size to the accurate count of bytes written, including
2738 message_size = transport_count;
2740 /* If using a maildir++ quota file, add this message's size to it, and
2741 close the file descriptor. */
2743 #ifdef SUPPORT_MAILDIR
2744 if (yield == OK && maildirsize_fd >= 0)
2745 maildir_record_length(maildirsize_fd, message_size);
2747 maildir_save_errno = errno; /* Preserve errno while closing the file */
2748 close(maildirsize_fd);
2749 errno = maildir_save_errno;
2750 #endif /* SUPPORT_MAILDIR */
2752 /* If there is a quota warning threshold and we are have crossed it with this
2753 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2756 if (THRESHOLD_CHECK)
2758 int threshold = ob->quota_warn_threshold_value;
2759 if (ob->quota_warn_threshold_is_percent)
2760 threshold = (int)(((double)ob->quota_value * threshold) / 100);
2762 debug_printf("quota = %d threshold = %d old size = %d message size = %d\n",
2763 ob->quota_value, threshold, mailbox_size, message_size);
2764 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2765 addr->special_action = SPECIAL_WARN;
2767 /******* You might think that the test ought to be this:
2769 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2770 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2772 * (indeed, I was sent a patch with that in). However, it is possible to
2773 * have a warning threshold without actually imposing a quota, and I have
2774 * therefore kept Exim backwards compatible.
2779 /* Handle error while writing the file. Control should come here directly after
2780 the error, with the reason in errno. In the case of expansion failure in prefix
2781 or suffix, it will be ERRNO_EXPANDFAIL. */
2785 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2787 /* Save the error number. If positive, it will ultimately cause a strerror()
2788 call to generate some text. */
2790 addr->basic_errno = errno;
2792 /* For system or Exim quota excession, or disk full, set more_errno to the
2793 time since the file was last read. If delivery was into a directory, the
2794 time since last read logic is not relevant, in general. However, for maildir
2795 deliveries we can approximate it by looking at the last modified time of the
2796 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2797 "new" subdirectory implies that an MUA has moved a message from there to the
2800 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2802 addr->more_errno = 0;
2803 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2805 #ifdef SUPPORT_MAILDIR
2806 else if (mbformat == mbf_maildir)
2808 struct stat statbuf;
2809 if (Ustat("new", &statbuf) < 0)
2811 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2812 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2814 else /* Want a repeatable time when in test harness */
2816 addr->more_errno = running_in_test_harness? 10 :
2817 (int)time(NULL) - statbuf.st_mtime;
2820 debug_printf("maildir: time since \"new\" directory modified = %s\n",
2821 readconf_printtime(addr->more_errno));
2823 #endif /* SUPPORT_MAILDIR */
2826 /* Handle system quota excession. Add an explanatory phrase for the error
2827 message, since some systems don't have special quota-excession errors,
2828 and on those that do, "quota" doesn't always mean anything to the user. */
2830 if (errno == errno_quota)
2833 addr->message = string_sprintf("mailbox is full "
2834 "(quota exceeded while writing to file %s)", filename);
2836 addr->message = string_sprintf("mailbox is full");
2838 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
2840 isdirectory? US"" : US": time since file read = ",
2841 isdirectory? US"" : readconf_printtime(addr->more_errno));
2844 /* Handle Exim's own quota-imposition */
2846 else if (errno == ERRNO_EXIMQUOTA)
2848 addr->message = string_sprintf("mailbox is full "
2849 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
2851 addr->user_message = US"mailbox is full";
2852 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
2853 filecount_msg, dataname,
2854 isdirectory? US"" : US": time since file read = ",
2855 isdirectory? US"" : readconf_printtime(addr->more_errno));
2858 /* Handle a process failure while writing via a filter; the return
2859 from child_close() is in more_errno. */
2861 else if (errno == ERRNO_FILTER_FAIL)
2864 addr->message = string_sprintf("transport filter process failed (%d) "
2865 "while writing to %s%s", addr->more_errno, dataname,
2866 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
2869 /* Handle failure to expand header changes */
2871 else if (errno == ERRNO_CHHEADER_FAIL)
2875 string_sprintf("failed to expand headers_add or headers_remove while "
2876 "writing to %s: %s", dataname, expand_string_message);
2879 /* Handle failure to complete writing of a data block */
2881 else if (errno == ERRNO_WRITEINCOMPLETE)
2883 addr->message = string_sprintf("failed to write data block while "
2884 "writing to %s", dataname);
2887 /* Handle length mismatch on MBX copying */
2890 else if (errno == ERRNO_MBXLENGTH)
2892 addr->message = string_sprintf("length mismatch while copying MBX "
2893 "temporary file to %s", dataname);
2895 #endif /* SUPPORT_MBX */
2897 /* For other errors, a general-purpose explanation, if the message is
2900 else if (addr->message == NULL)
2901 addr->message = string_sprintf("error while writing to %s", dataname);
2903 /* For a file, reset the file size to what it was before we started, leaving
2904 the last modification time unchanged, so it will get reset also. All systems
2905 investigated so far have ftruncate(), whereas not all have the F_FREESP
2906 fcntl() call (BSDI & FreeBSD do not). */
2908 if (!isdirectory) ftruncate(fd, saved_size);
2911 /* Handle successful writing - we want the modification time to be now for
2912 appended files. Remove the default backstop error number. For a directory, now
2913 is the time to rename the file with a unique name. As soon as such a name
2914 appears it may get used by another process, so we close the file first and
2915 check that all is well. */
2919 times.modtime = time(NULL);
2920 addr->basic_errno = 0;
2922 /* Handle the case of writing to a new file in a directory. This applies
2923 to all single-file formats - maildir, mailstore, and "smail format". */
2927 if (fstat(fd, &statbuf) < 0)
2929 addr->basic_errno = errno;
2930 addr->message = string_sprintf("while fstatting opened message file %s",
2935 else if (close(fd) < 0)
2937 addr->basic_errno = errno;
2938 addr->message = string_sprintf("close() error for %s",
2939 (ob->mailstore_format)? dataname : filename);
2943 /* File is successfully written and closed. Arrange to rename it. For the
2944 different kinds of single-file delivery, some games can be played with the
2945 name. The message size is by this time set to the accurate value so that
2946 its value can be used in expansions. */
2950 uschar *renamename = newname;
2953 DEBUG(D_transport) debug_printf("renaming temporary file\n");
2955 /* If there is no rename name set, we are in a non-maildir, non-mailstore
2956 situation. The name is built by expanding the directory_file option, and
2957 we make the inode number available for use in this. The expansion was
2958 checked for syntactic validity above, before we wrote the file.
2960 We have to be careful here, in case the file name exists. (In the other
2961 cases, the names used are constructed to be unique.) The rename()
2962 function just replaces an existing file - we don't want that! So instead
2963 of calling rename(), we must use link() and unlink().
2965 In this case, if the link fails because of an existing file, we wait
2966 for one second and try the expansion again, to see if it produces a
2967 different value. Do this up to 5 times unless the name stops changing.
2968 This makes it possible to build values that are based on the time, and
2969 still cope with races from multiple simultaneous deliveries. */
2971 if (newname == NULL)
2975 uschar *old_renameleaf = US"";
2977 for (i = 0; ; sleep(1), i++)
2979 deliver_inode = statbuf.st_ino;
2980 renameleaf = expand_string(ob->dirfilename);
2983 if (renameleaf == NULL)
2985 addr->transport_return = PANIC;
2986 addr->message = string_sprintf("Expansion of \"%s\" "
2987 "(directory_file for %s transport) failed: %s",
2988 ob->dirfilename, tblock->name, expand_string_message);
2992 renamename = string_sprintf("%s/%s", path, renameleaf);
2993 if (Ulink(filename, renamename) < 0)
2995 DEBUG(D_transport) debug_printf("link failed: %s\n",
2997 if (errno != EEXIST || i >= 4 ||
2998 Ustrcmp(renameleaf, old_renameleaf) == 0)
3000 addr->basic_errno = errno;
3001 addr->message = string_sprintf("while renaming %s as %s",
3002 filename, renamename);
3006 old_renameleaf = renameleaf;
3007 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3016 } /* re-expand loop */
3017 } /* not mailstore or maildir */
3019 /* For maildir and mailstore formats, the new name was created earlier,
3020 except that for maildir, there is the possibility of adding a "tag" on
3021 the end of the name by expanding the value of nametag. This usually
3022 includes a reference to the message size. The expansion of nametag was
3023 checked above, before the file was opened. It either succeeded, or
3024 provoked a soft failure. So any failure here can be treated as soft.
3025 Ignore non-printing characters and / and put a colon at the start if the
3026 first character is alphanumeric. */
3030 if (nametag != NULL)
3032 uschar *iptr = expand_string(nametag);
3035 uschar *etag = store_get(Ustrlen(iptr) + 2);
3036 uschar *optr = etag;
3039 if (mac_isgraph(*iptr) && *iptr != '/')
3041 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3047 renamename = string_sprintf("%s%s", newname, etag);
3051 /* Do the rename. If the name is too long and a tag exists, try again
3054 if (Urename(filename, renamename) < 0 &&
3055 (nametag == NULL || errno != ENAMETOOLONG ||
3056 (renamename = newname, Urename(filename, renamename) < 0)))
3058 addr->basic_errno = errno;
3059 addr->message = string_sprintf("while renaming %s as %s",
3060 filename, renamename);
3064 /* Rename succeeded */
3068 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3070 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3072 } /* maildir or mailstore */
3073 } /* successful write + close */
3075 } /* write success */
3078 /* For a file, restore the last access time (atime), and set the modification
3079 time as required - changed if write succeeded, unchanged if not. */
3081 if (!isdirectory) utime(CS filename, ×);
3083 /* Notify comsat if configured to do so. It only makes sense if the configured
3084 file is the one that the comsat daemon knows about. */
3086 if (ob->notify_comsat && yield == OK && deliver_localpart != NULL)
3087 notify_comsat(deliver_localpart, saved_size);
3089 /* Pass back the final return code in the address structure */
3092 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3093 yield, addr->basic_errno, addr->more_errno);
3095 addr->transport_return = yield;
3097 /* Close the file, which will release the fcntl lock. For a directory write it
3098 is closed above, except in cases of error which goto RETURN, when we also need
3099 to remove the original file(s). For MBX locking, if all has gone well, before
3100 closing the file, see if we can get an exclusive lock on it, in which case we
3101 can unlink the /tmp lock file before closing it. This is always a non-blocking
3102 lock; there's no need to wait if we can't get it. If everything has gone right
3103 but close fails, defer the message. Then unlink the lock file, if present. This
3104 point in the code is jumped to from a number of places when errors are
3105 detected, in order to get the file closed and the lock file tidied away. */
3110 if (mbx_lockfd >= 0)
3112 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3113 ob->use_flock, 0) >= 0)
3116 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3117 Uunlink(mbx_lockname);
3121 #endif /* SUPPORT_MBX */
3123 if (fd >= 0 && close(fd) < 0 && yield == OK)
3125 addr->basic_errno = errno;
3126 addr->message = string_sprintf("while closing %s", filename);
3127 addr->transport_return = DEFER;
3130 if (hd >= 0) Uunlink(lockname);
3132 /* We get here with isdirectory and filename set only in error situations. */
3134 if (isdirectory && filename != NULL)
3137 if (dataname != filename) Uunlink(dataname);
3140 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3141 file name relies on time + pid. We must not allow the process to finish until
3142 the clock has move on by at least one microsecond. Usually we expect this
3143 already to be the case, but machines keep getting faster... */
3145 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3147 /* A return of FALSE means that if there was an error, a common error was
3148 put in the first address of a batch. */
3153 /* End of transport/appendfile.c */