1 /* $Cambridge: exim/src/src/transports/appendfile.c,v 1.5 2005/02/17 11:58:27 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2005 */
8 /* See the file NOTICE for conditions of use and distribution. */
12 #include "appendfile.h"
14 #ifdef SUPPORT_MAILDIR
15 #include "tf_maildir.h"
19 /* Encodings for mailbox formats, and their names. MBX format is actually
20 supported only if SUPPORT_MBX is set. */
22 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
24 static char *mailbox_formats[] = {
25 "unix", "mbx", "smail", "maildir", "mailstore" };
28 /* Check warn threshold only if quota size set or not a percentage threshold
29 percentage check should only be done if quota > 0 */
31 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
32 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
35 /* Options specific to the appendfile transport. They must be in alphabetic
36 order (note that "_" comes before the lower case letters). Some of them are
37 stored in the publicly visible instance block - these are flagged with the
40 optionlist appendfile_transport_options[] = {
41 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
42 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
43 { "*set_use_flock_lock",opt_bool | opt_hidden,
44 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
45 { "*set_use_lockfile", opt_bool | opt_hidden,
46 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
48 { "*set_use_mbx_lock", opt_bool | opt_hidden,
49 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
51 { "allow_fifo", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
53 { "allow_symlink", opt_bool,
54 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
55 { "batch_id", opt_stringptr | opt_public,
56 (void *)offsetof(transport_instance, batch_id) },
57 { "batch_max", opt_int | opt_public,
58 (void *)offsetof(transport_instance, batch_max) },
59 { "check_group", opt_bool,
60 (void *)offsetof(appendfile_transport_options_block, check_group) },
61 { "check_owner", opt_bool,
62 (void *)offsetof(appendfile_transport_options_block, check_owner) },
63 { "check_string", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, check_string) },
65 { "create_directory", opt_bool,
66 (void *)offsetof(appendfile_transport_options_block, create_directory) },
67 { "create_file", opt_stringptr,
68 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
69 { "directory", opt_stringptr,
70 (void *)offsetof(appendfile_transport_options_block, dirname) },
71 { "directory_file", opt_stringptr,
72 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
73 { "directory_mode", opt_octint,
74 (void *)offsetof(appendfile_transport_options_block, dirmode) },
75 { "escape_string", opt_stringptr,
76 (void *)offsetof(appendfile_transport_options_block, escape_string) },
77 { "file", opt_stringptr,
78 (void *)offsetof(appendfile_transport_options_block, filename) },
79 { "file_format", opt_stringptr,
80 (void *)offsetof(appendfile_transport_options_block, file_format) },
81 { "file_must_exist", opt_bool,
82 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
83 { "lock_fcntl_timeout", opt_time,
84 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
85 { "lock_flock_timeout", opt_time,
86 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
87 { "lock_interval", opt_time,
88 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
89 { "lock_retries", opt_int,
90 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
91 { "lockfile_mode", opt_octint,
92 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
93 { "lockfile_timeout", opt_time,
94 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
95 { "mailbox_filecount", opt_stringptr,
96 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
97 { "mailbox_size", opt_stringptr,
98 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
99 #ifdef SUPPORT_MAILDIR
100 { "maildir_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
102 { "maildir_quota_directory_regex", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
104 { "maildir_retries", opt_int,
105 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
106 { "maildir_tag", opt_stringptr,
107 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
108 { "maildir_use_size_file", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
110 #endif /* SUPPORT_MAILDIR */
111 #ifdef SUPPORT_MAILSTORE
112 { "mailstore_format", opt_bool,
113 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
114 { "mailstore_prefix", opt_stringptr,
115 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
116 { "mailstore_suffix", opt_stringptr,
117 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
118 #endif /* SUPPORT_MAILSTORE */
120 { "mbx_format", opt_bool,
121 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
122 #endif /* SUPPORT_MBX */
123 { "message_prefix", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
125 { "message_suffix", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
127 { "mode", opt_octint,
128 (void *)offsetof(appendfile_transport_options_block, mode) },
129 { "mode_fail_narrower",opt_bool,
130 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
131 { "notify_comsat", opt_bool,
132 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
133 { "quota", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota) },
135 { "quota_directory", opt_stringptr,
136 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
137 { "quota_filecount", opt_stringptr,
138 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
139 { "quota_is_inclusive", opt_bool,
140 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
141 { "quota_size_regex", opt_stringptr,
142 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
143 { "quota_warn_message", opt_stringptr | opt_public,
144 (void *)offsetof(transport_instance, warn_message) },
145 { "quota_warn_threshold", opt_stringptr,
146 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
147 { "use_bsmtp", opt_bool,
148 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
149 { "use_crlf", opt_bool,
150 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
151 { "use_fcntl_lock", opt_bool_set,
152 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
153 { "use_flock_lock", opt_bool_set,
154 (void *)offsetof(appendfile_transport_options_block, use_flock) },
155 { "use_lockfile", opt_bool_set,
156 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
158 { "use_mbx_lock", opt_bool_set,
159 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
160 #endif /* SUPPORT_MBX */
163 /* Size of the options list. An extern variable has to be used so that its
164 address can appear in the tables drtables.c. */
166 int appendfile_transport_options_count =
167 sizeof(appendfile_transport_options)/sizeof(optionlist);
169 /* Default private options block for the appendfile transport. */
171 appendfile_transport_options_block appendfile_transport_option_defaults = {
174 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
175 NULL, /* message_prefix (default reset in init if not bsmtp) */
176 NULL, /* message_suffix (ditto) */
177 US"anywhere", /* create_file_string (string value for create_file) */
179 NULL, /* quota_directory */
180 NULL, /* quota_filecount */
181 NULL, /* quota_size_regex */
182 NULL, /* quota_warn_threshold */
183 NULL, /* mailbox_size_string */
184 NULL, /* mailbox_filecount_string */
185 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
186 NULL, /* maildir_tag */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
192 -1, /* mailbox_size_value */
193 -1, /* mailbox_filecount_value */
195 0, /* quota_filecount_value */
196 0, /* quota_warn_threshold_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE /* quota_is_inclusive */
236 /*************************************************
237 * Setup entry point *
238 *************************************************/
240 /* Called for each delivery in the privileged state, just before the uid/gid
241 are changed and the main entry point is called. We use this function to
242 expand any quota settings, so that it can access files that may not be readable
243 by the user. It is also used to pick up external mailbox size information, if
247 tblock points to the transport instance
248 addrlist addresses about to be delivered (not used)
249 dummy not used (doesn't pass back data)
250 errmsg where to put an error message
252 Returns: OK, FAIL, or DEFER
256 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
257 transport_feedback *dummy, uschar **errmsg)
259 appendfile_transport_options_block *ob =
260 (appendfile_transport_options_block *)(tblock->options_block);
261 uschar *q = ob->quota;
262 int *v = &(ob->quota_value);
263 int default_value = 0;
266 addrlist = addrlist; /* Keep picky compilers happy */
269 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
272 for (i = 0; i < 5; i++)
274 if (q == NULL) *v = default_value; else
278 uschar *s = expand_string(q);
282 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
283 "%s", q, tblock->name, expand_string_message);
284 return search_find_defer? DEFER : FAIL;
287 d = Ustrtod(s, &rest);
289 /* Handle following characters K, M, %, the latter being permitted
290 for quota_warn_threshold only. A threshold with no quota setting is
293 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
294 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
295 else if (*rest == '%' && i == 2)
297 if (ob->quota_value <= 0 && !ob->maildir_use_size_file) d = 0;
298 else if ((int)d < 0 || (int)d > 100)
300 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
301 " for %s transport", (int)d, tblock->name);
304 ob->quota_warn_threshold_is_percent = TRUE;
308 while (isspace(*rest)) rest++;
312 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
313 "in %s transport", s, q, tblock->name);
323 q = ob->quota_filecount;
324 v = &(ob->quota_filecount_value);
328 q = ob->quota_warn_threshold;
329 v = &(ob->quota_warn_threshold_value);
333 q = ob->mailbox_size_string;
334 v = &(ob->mailbox_size_value);
339 q = ob->mailbox_filecount_string;
340 v = &(ob->mailbox_filecount_value);
350 /*************************************************
351 * Initialization entry point *
352 *************************************************/
354 /* Called for each instance, after its options have been read, to
355 enable consistency checks to be done, or anything else that needs
359 appendfile_transport_init(transport_instance *tblock)
361 appendfile_transport_options_block *ob =
362 (appendfile_transport_options_block *)(tblock->options_block);
364 /* Set up the setup entry point, to be called in the privileged state */
366 tblock->setup = appendfile_transport_setup;
368 /* Lock_retries must be greater than zero */
370 if (ob->lock_retries == 0) ob->lock_retries = 1;
372 /* Only one of a file name or directory name must be given. */
374 if (ob->filename != NULL && ob->dirname != NULL)
375 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
376 "only one of \"file\" or \"directory\" can be specified", tblock->name);
378 /* If a file name was specified, neither quota_filecount nor quota_directory
381 if (ob->filename != NULL)
383 if (ob->quota_filecount != NULL)
384 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
385 "quota_filecount must not be set without \"directory\"", tblock->name);
386 if (ob->quota_directory != NULL)
387 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
388 "quota_directory must not be set without \"directory\"", tblock->name);
391 /* The default locking depends on whether MBX is set or not. Change the
392 built-in default if none of the lock options has been explicitly set. At least
393 one form of locking is required in all cases, but mbx locking changes the
394 meaning of fcntl and flock locking. */
396 /* Not all operating systems provide flock(). For those that do, if flock is
397 requested, the default for fcntl is FALSE. */
402 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
403 "flock() support was not available in the operating system when this "
404 "binary was built", tblock->name);
405 #endif /* NO_FLOCK */
406 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
412 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
413 !ob->set_use_mbx_lock)
415 ob->use_lockfile = ob->use_flock = FALSE;
416 ob->use_mbx_lock = ob->use_fcntl = TRUE;
418 else if (ob->use_mbx_lock)
420 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
421 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
422 if (!ob->set_use_flock) ob->use_flock = FALSE;
423 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
426 #endif /* SUPPORT_MBX */
428 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
429 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
430 "no locking configured", tblock->name);
432 /* Unset timeouts for non-used locking types */
434 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
435 if (!ob->use_flock) ob->lock_flock_timeout = 0;
437 /* If a directory name was specified, only one of maildir or mailstore may be
438 specified, and if quota_filecount or quota_directory is given, quota must
441 if (ob->dirname != NULL)
443 if (ob->maildir_format && ob->mailstore_format)
444 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
445 "only one of maildir and mailstore may be specified", tblock->name);
446 if (ob->quota_filecount != NULL && ob->quota == NULL)
447 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
448 "quota must be set if quota_filecount is set", tblock->name);
449 if (ob->quota_directory != NULL && ob->quota == NULL)
450 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
451 "quota must be set if quota_directory is set", tblock->name);
454 /* If a fixed uid field is set, then a gid field must also be set. */
456 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
457 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
458 "user set without group for the %s transport", tblock->name);
460 /* If "create_file" is set, check that a valid option is given, and set the
463 if (ob->create_file_string != NULL)
466 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
467 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
469 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
470 value = create_inhome;
472 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
473 "invalid value given for \"file_create\" for the %s transport: %s",
474 tblock->name, ob->create_file_string);
475 ob->create_file = value;
478 /* If quota_warn_threshold is set, set up default for warn_message. It may
479 not be used if the actual threshold for a given delivery ends up as zero,
480 of if it's given as a percentage and there's no quota setting. */
482 if (ob->quota_warn_threshold != NULL)
484 if (tblock->warn_message == NULL) tblock->warn_message = US
485 "To: $local_part@$domain\n"
486 "Subject: Your mailbox\n\n"
487 "This message is automatically created by mail delivery software (Exim).\n\n"
488 "The size of your mailbox has exceeded a warning threshold that is\n"
489 "set by the system administrator.\n";
492 /* If batch SMTP is set, force the check and escape strings, and arrange that
493 headers are also escaped. */
497 ob->check_string = US".";
498 ob->escape_string = US"..";
499 ob->options |= topt_escape_headers;
502 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
503 insert default values for for the affixes and the check/escape strings. */
505 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
507 if (ob->message_prefix == NULL) ob->message_prefix =
508 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
509 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
510 if (ob->check_string == NULL) ob->check_string = US"From ";
511 if (ob->escape_string == NULL) ob->escape_string = US">From ";
515 /* Set up the bitwise options for transport_write_message from the various
516 driver options. Only one of body_only and headers_only can be set. */
519 (tblock->body_only? topt_no_headers : 0) |
520 (tblock->headers_only? topt_no_body : 0) |
521 (tblock->return_path_add? topt_add_return_path : 0) |
522 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
523 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
524 ((ob->use_crlf || ob->mbx_format)? topt_use_crlf : 0);
529 /*************************************************
531 *************************************************/
533 /* The comsat daemon is the thing that provides asynchronous notification of
534 the arrival of local messages, if requested by the user by "biff y". It is a
535 BSD thing that uses a TCP/IP protocol for communication. A message consisting
536 of the text "user@offset" must be sent, where offset is the place in the
537 mailbox where new mail starts. There is no scope for telling it which file to
538 look at, which makes it a less than useful if mail is being delivered into a
539 non-standard place such as the user's home directory. In fact, it doesn't seem
540 to pay much attention to the offset.
544 offset offset in mailbox
550 notify_comsat(uschar *user, int offset)
557 DEBUG(D_transport) debug_printf("notify_comsat called\n");
559 sprintf(CS buffer, "%.200s@%d\n", user, offset);
561 if ((sp = getservbyname("biff", "udp")) == NULL)
563 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
567 host.name = US"localhost";
571 /* This code is all set up to look up "localhost" and use all its addresses
572 until one succeeds. However, it appears that at least on some systems, comsat
573 doesn't listen on the ::1 address. So for the moment, just force the address to
574 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
578 if (host_find_byname(&host, NULL, NULL, FALSE) == HOST_FIND_FAILED)
580 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
585 host.address = US"127.0.0.1";
588 for (h = &host; h != NULL; h = h->next)
591 int host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
593 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
595 sock = ip_socket(SOCK_DGRAM, host_af);
596 if (sock < 0) continue;
598 /* Connect never fails for a UDP socket, so don't set a timeout. */
600 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0);
601 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
606 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
613 /*************************************************
614 * Check the format of a file *
615 *************************************************/
617 /* This function is called when file_format is set, to check that an existing
618 file has the right format. The format string contains text/transport pairs. The
619 string matching is literal. we just read big_buffer_size bytes, because this is
620 all about the first few bytes of a file.
624 tblock the transport block
625 addr the address block - for inserting error data
627 Returns: pointer to the required transport, or NULL
631 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
634 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
636 int len = read(cfd, data, sizeof(data));
640 DEBUG(D_transport) debug_printf("checking file format\n");
642 /* An empty file matches the current transport */
644 if (len == 0) return tblock;
646 /* Search the formats for a match */
648 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size))!= NULL)
650 int slen = Ustrlen(s);
651 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
652 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
655 transport_instance *tt;
656 for (tt = transports; tt != NULL; tt = tt->next)
657 if (Ustrcmp(tp, tt->name) == 0)
660 debug_printf("file format -> %s transport\n", tt->name);
663 addr->basic_errno = ERRNO_BADTRANSPORT;
664 addr->message = string_sprintf("%s transport (for %.*s format) not found",
670 /* Failed to find a match */
672 addr->basic_errno = ERRNO_FORMATUNKNOWN;
673 addr->message = US"mailbox file format unrecognized";
680 /*************************************************
681 * Check directory's files for quota *
682 *************************************************/
684 /* This function is called if quota is set for one of the delivery modes that
685 delivers into a specific directory. It scans the directory and stats all the
686 files in order to get a total size and count. This is an expensive thing to do,
687 but some people are prepared to bear the cost. Alternatively, if size_regex is
688 set, it is used as a regex to try to extract the size from the file name, a
689 strategy that some people use on maildir files on systems where the users have
692 The function is global, because it is also called from tf_maildir.c for maildir
693 folders (which should contain only regular files).
695 Note: Any problems can be written to debugging output, but cannot be written to
696 the log, because we are running as an unprivileged user here.
699 dirname the name of the directory
700 countptr where to add the file count (because this function recurses)
701 regex a compiled regex to get the size from a name
703 Returns: the sum of the sizes of the stattable files
704 zero if the directory cannot be opened
708 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
712 int count = *countptr;
716 dir = opendir(CS dirname);
717 if (dir == NULL) return 0;
719 while ((ent = readdir(dir)) != NULL)
721 uschar *name = US ent->d_name;
724 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
728 /* If there's a regex, try to find the size using it */
733 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
736 int size = Ustrtol(name + ovector[2], &endptr, 10);
737 if (endptr == name + ovector[3])
741 debug_printf("check_dir_size: size from %s is %d\n", name, size);
746 debug_printf("check_dir_size: regex did not match %s\n", name);
749 /* No regex or no match for the regex, or captured non-digits */
751 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
754 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
759 if (Ustat(buffer, &statbuf) < 0)
762 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
767 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
768 sum += statbuf.st_size;
769 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
770 sum += check_dir_size(buffer, &count, regex);
775 debug_printf("check_dir_size: dir=%s sum=%d count=%d\n", dirname, sum, count);
783 /*************************************************
784 * Apply a lock to a file descriptor *
785 *************************************************/
787 /* This function applies a lock to a file descriptor, using a blocking or
788 non-blocking lock, depending on the timeout value. It can apply either or
789 both of a fcntl() and a flock() lock. However, not all OS support flock();
790 for those that don't, the use_flock option cannot be set.
793 fd the file descriptor
794 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
795 fcntl() format); the flock() type is deduced if needed
796 dofcntl do fcntl() locking
797 fcntltime non-zero to use blocking fcntl()
798 doflock do flock() locking
799 flocktime non-zero to use blocking flock()
801 Returns: yield of the fcntl() or flock() call, with errno preserved;
802 sigalrm_seen set if there has been a timeout
806 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
811 struct flock lock_data;
812 lock_data.l_type = fcntltype;
813 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
815 sigalrm_seen = FALSE;
822 yield = fcntl(fd, F_SETLKW, &lock_data);
827 else yield = fcntl(fd, F_SETLK, &lock_data);
831 if (doflock && (yield >= 0))
833 int flocktype = (fcntltype == F_WRLCK)? LOCK_EX : LOCK_SH;
837 yield = flock(fd, flocktype);
842 else yield = flock(fd, flocktype | LOCK_NB);
844 #endif /* NO_FLOCK */
853 /*************************************************
854 * Copy message into MBX mailbox *
855 *************************************************/
857 /* This function is called when a message intended for a MBX mailbox has been
858 written to a temporary file. We can now get the size of the message and then
859 copy it in MBX format to the mailbox.
862 to_fd fd to write to (the real mailbox)
863 from_fd fd to read from (the temporary file)
864 saved_size current size of mailbox
866 Returns: OK if all went well, DEFER otherwise, with errno preserved
867 the number of bytes written are added to transport_count
868 by virtue of calling transport_write_block()
871 /* Values taken from c-client */
873 #define MBX_HDRSIZE 2048
874 #define MBX_NUSERFLAGS 30
877 copy_mbx_message(int to_fd, int from_fd, int saved_size)
882 /* If the current mailbox size is zero, write a header block */
888 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
889 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
890 (long int)time(NULL));
891 for (i = 0; i < MBX_NUSERFLAGS; i++)
892 sprintf (CS(s += Ustrlen(s)), "\015\012");
893 if (!transport_write_block (to_fd, deliver_out_buffer, MBX_HDRSIZE))
897 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
899 /* Now construct the message's header from the time and the RFC822 file
900 size, including CRLFs, which is the size of the input (temporary) file. */
902 if (fstat(from_fd, &statbuf) < 0) return DEFER;
903 size = statbuf.st_size;
905 sprintf (CS deliver_out_buffer, "%s,%lu;%08lx%04x-%08x\015\012",
906 tod_stamp(tod_mbx), (long unsigned int)size, 0L, 0, 0);
907 used = Ustrlen(deliver_out_buffer);
909 /* Rewind the temporary file, and copy it over in chunks. */
911 lseek(from_fd, 0 , SEEK_SET);
915 int len = read(from_fd, deliver_out_buffer + used,
916 DELIVER_OUT_BUFFER_SIZE - used);
919 if (len == 0) errno = ERRNO_MBXLENGTH;
922 if (!transport_write_block(to_fd, deliver_out_buffer, used + len))
930 #endif /* SUPPORT_MBX */
934 /*************************************************
935 * Check creation is permitted *
936 *************************************************/
938 /* This function checks whether a given file name is permitted to be created,
939 as controlled by the create_file option. If no home directory is set, however,
940 we can't do any tests.
943 filename the file name
944 create_file the ob->create_file option
946 Returns: TRUE if creation is permitted
950 check_creation(uschar *filename, int create_file)
954 if (deliver_home != NULL && create_file != create_anywhere)
956 int len = Ustrlen(deliver_home);
957 uschar *file = filename;
959 while (file[0] == '/' && file[1] == '/') file++;
960 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
961 ( Ustrchr(file+len+2, '/') != NULL &&
963 create_file != create_belowhome ||
964 Ustrstr(file+len, "/../") != NULL
969 /* If yield is TRUE, the file name starts with the home directory, and does
970 not contain any instances of "/../" in the "belowhome" case. However, it may
971 still contain symbolic links. We can check for this by making use of
972 realpath(), which most Unixes seem to have (but make it possible to cut this
973 out). We can't just use realpath() on the whole file name, because we know
974 the file itself doesn't exist, and intermediate directories may also not
975 exist. What we want to know is the real path of the longest existing part of
976 the path. That must match the home directory's beginning, whichever is the
980 if (yield && create_file == create_belowhome)
982 uschar *slash, *next;
984 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
985 rp == NULL && slash > file; /* Stop if reached beginning */
989 rp = US realpath(CS file, CS big_buffer);
990 next = Ustrrchr(file, '/');
994 /* If rp == NULL it means that none of the relevant directories exist.
995 This is not a problem here - it means that no symbolic links can exist,
996 which is all we are worried about. Otherwise, we must compare it
997 against the start of the home directory. However, that may itself
998 contain symbolic links, so we have to "realpath" it as well, if
1003 uschar hdbuffer[PATH_MAX+1];
1004 uschar *rph = deliver_home;
1005 int rlen = Ustrlen(big_buffer);
1007 rp = US realpath(CS deliver_home, CS hdbuffer);
1014 if (rlen > len) rlen = len;
1015 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1018 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1019 big_buffer, deliver_home);
1023 #endif /* NO_REALPATH */
1031 /*************************************************
1032 * Main entry point *
1033 *************************************************/
1035 /* See local README for general interface details. This transport always
1036 returns FALSE, indicating that the status which has been placed in the first
1037 address should be copied to any other addresses in a batch.
1039 Appendfile delivery is tricky and has led to various security problems in other
1040 mailers. The logic used here is therefore laid out in some detail. When this
1041 function is called, we are running in a subprocess which has had its gid and
1042 uid set to the appropriate values. Therefore, we cannot write directly to the
1043 exim logs. Any errors must be handled by setting appropriate return codes.
1044 Note that the default setting for addr->transport_return is DEFER, so it need
1045 not be set unless some other value is required.
1047 The code below calls geteuid() rather than getuid() to get the current uid
1048 because in weird configurations not running setuid root there may be a
1049 difference. In the standard configuration, where setuid() has been used in the
1050 delivery process, there will be no difference between the uid and the euid.
1052 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1053 alias expansion. Otherwise, there must be a configured file name or
1056 The following items apply in the case when a file name (as opposed to a
1057 directory name) is given, that is, when appending to a single file:
1059 (2f) Expand the file name.
1061 (3f) If the file name is /dev/null, return success (optimization).
1063 (4f) If the file_format options is set, open the file for reading, and check
1064 that the bytes at the start of the file match one of the given strings.
1065 If the check indicates a transport other than the current one should be
1066 used, pass control to that other transport. Otherwise continue. An empty
1067 or non-existent file matches the current transport. The file is closed
1070 (5f) If a lock file is required, create it (see extensive separate comments
1071 below about the algorithm for doing this). It is important to do this
1072 before opening the mailbox if NFS is in use.
1074 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1075 details of any symbolic link.
1077 (7f) If the file already exists:
1079 Check the owner and group if necessary, and defer if they are wrong.
1081 If it is a symbolic link AND the allow_symlink option is set (NOT the
1082 default), go back to (6f) but this time use stat() instead of lstat().
1084 If it's not a regular file (or FIFO when permitted), defer delivery.
1086 Check permissions. If the required permissions are *less* than the
1087 existing ones, or supplied by the address (often by the user via filter),
1088 chmod() the file. Otherwise, defer.
1090 Save the inode number.
1092 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1094 If open fails because the file does not exist, go to (6f); on any other
1097 Check the inode number hasn't changed - I realize this isn't perfect (an
1098 inode can be reused) but it's cheap and will catch some of the races.
1100 Check it's still a regular file (or FIFO if permitted).
1102 Check that the owner and permissions haven't changed.
1104 If file_format is set, check that the file still matches the format for
1105 the current transport. If not, defer delivery.
1107 (8f) If file does not exist initially:
1109 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1110 this is via a symbolic link (only possible if allow_symlinks is set), in
1111 which case don't use O_EXCL, as it dosn't work.
1113 If open fails because the file already exists, go to (6f). To avoid
1114 looping for ever in a situation where the file is continuously being
1115 created and deleted, all of this happens inside a loop that operates
1116 lock_retries times and includes the fcntl and flock locking. If the
1117 loop completes without the file getting opened, defer and request
1118 freezing, because something really weird is happening.
1120 If open fails for any other reason, defer for subsequent delivery except
1121 when this is a file delivery resulting from an alias or forward expansion
1122 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1123 most likely a user rather than a configuration error.
1125 (9f) We now have the file checked and open for writing. If so configured, lock
1126 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1127 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1128 still fails, give up and defer delivery.
1130 (10f)Save the access time (for subsequent restoration) and the size of the
1131 file, for comsat and for re-setting if delivery fails in the middle -
1132 e.g. for quota exceeded.
1134 The following items apply in the case when a directory name is given:
1136 (2d) Create a new file in the directory using a temporary name, by opening for
1137 writing and with O_CREAT. If maildir format is being used, the file
1138 is created in a temporary subdirectory with a prescribed name. If
1139 mailstore format is being used, the envelope file is first created with a
1140 temporary name, then the data file.
1142 The following items apply in all cases:
1144 (11) We now have the file open for writing, and locked if it was given as a
1145 file name. Write the message and flush the file, unless there is a setting
1146 of the local quota option, in which case we can check for its excession
1147 without doing any writing.
1149 In the case of MBX format mailboxes, the message is first written to a
1150 temporary file, in order to get its correct length. This is then copied to
1151 the real file, preceded by an MBX header.
1153 If there is a quota error on writing, defer the address. Timeout logic
1154 will determine for how long retries are attempted. We restore the mailbox
1155 to its original length if it's a single file. There doesn't seem to be a
1156 uniform error code for quota excession (it even differs between SunOS4
1157 and some versions of SunOS5) so a system-dependent macro called
1158 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1161 For any other error (most commonly disk full), do the same.
1163 The following applies after appending to a file:
1165 (12f)Restore the atime; notify_comsat if required; close the file (which
1166 unlocks it if it was locked). Delete the lock file if it exists.
1168 The following applies after writing a unique file in a directory:
1170 (12d)For maildir format, rename the file into the new directory. For mailstore
1171 format, rename the envelope file to its correct name. Otherwise, generate
1172 a unique name from the directory_file option, and rename to that, possibly
1173 trying a few times if the file exists and re-expanding the name gives a
1176 This transport yields FAIL only when a file name is generated by an alias or
1177 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1178 All other failures return DEFER (in addr->transport_return). */
1182 appendfile_transport_entry(
1183 transport_instance *tblock, /* data for this instantiation */
1184 address_item *addr) /* address we are working on */
1186 appendfile_transport_options_block *ob =
1187 (appendfile_transport_options_block *)(tblock->options_block);
1188 struct stat statbuf;
1189 uschar *fdname = NULL;
1190 uschar *filename = NULL;
1191 uschar *hitchname = NULL;
1192 uschar *dataname = NULL;
1193 uschar *lockname = NULL;
1194 uschar *newname = NULL;
1195 uschar *nametag = NULL;
1197 uschar *filecount_msg = US"";
1199 struct utimbuf times;
1200 struct timeval msg_tv;
1201 BOOL isdirectory = FALSE;
1202 BOOL isfifo = FALSE;
1203 BOOL wait_for_tick = FALSE;
1204 uid_t uid = geteuid(); /* See note above */
1205 gid_t gid = getegid();
1207 int mode = (addr->mode > 0)? addr->mode : ob->mode;
1208 int saved_size = -1;
1209 int mailbox_size = ob->mailbox_size_value;
1210 int mailbox_filecount = ob->mailbox_filecount_value;
1218 int mbx_lockfd = -1;
1219 uschar mbx_lockname[40];
1220 FILE *temp_file = NULL;
1221 #endif /* SUPPORT_MBX */
1223 #ifdef SUPPORT_MAILDIR
1224 int maildirsize_fd = -1; /* fd for maildirsize file */
1225 int maildir_save_errno;
1229 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1231 /* An "address_file" or "address_directory" transport is used to deliver to
1232 files specified via .forward or an alias file. Prior to release 4.20, the
1233 "file" and "directory" options were ignored in this case. This has been changed
1234 to allow the redirection data to specify what is in effect a folder, whose
1235 location is determined by the options on the transport.
1237 Compatibility with the case when neither option is set is retained by forcing a
1238 value for the file or directory name. A directory delivery is assumed if the
1239 last character of the path from the router is '/'.
1241 The file path is in the local part of the address, but not in the $local_part
1242 variable (that holds the parent local part). It is, however, in the
1243 $address_file variable. Below, we update the local part in the address if it
1244 changes by expansion, so that the final path ends up in the log. */
1246 if (testflag(addr, af_file) &&
1247 ob->filename == NULL &&
1248 ob->dirname == NULL)
1250 fdname = US"$address_file";
1251 if (address_file[Ustrlen(address_file)-1] == '/' ||
1252 ob->maildir_format ||
1253 ob->mailstore_format)
1257 /* Handle (a) an "address file" delivery where "file" or "directory" is
1258 explicitly set and (b) a non-address_file delivery, where one of "file" or
1259 "directory" must be set; initialization ensures that they are not both set. */
1263 fdname = ob->filename;
1266 fdname = ob->dirname;
1271 addr->transport_return = PANIC;
1272 addr->message = string_sprintf("Mandatory file or directory option "
1273 "missing from %s transport", tblock->name);
1278 /* Maildir and mailstore require a directory */
1280 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1282 addr->transport_return = PANIC;
1283 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1284 "to be specified for the %s transport",
1285 ob->maildir_format? "dir" : "store", tblock->name);
1289 path = expand_string(fdname);
1293 addr->transport_return = PANIC;
1294 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1295 "name for %s transport) failed: %s", fdname, tblock->name,
1296 expand_string_message);
1302 addr->message = string_sprintf("appendfile: file or directory name "
1303 "\"%s\" is not absolute", path);
1304 addr->basic_errno = ERRNO_NOTABSOLUTE;
1308 /* For a file delivery, make sure the local part in the address is updated to
1309 the true local part. */
1311 if (testflag(addr, af_file)) addr->local_part = string_copy(path);
1313 /* The available mailbox formats depend on whether it is a directory or a file
1319 #ifdef SUPPORT_MAILDIR
1320 (ob->maildir_format)? mbf_maildir :
1322 #ifdef SUPPORT_MAILSTORE
1323 (ob->mailstore_format)? mbf_mailstore :
1331 (ob->mbx_format)? mbf_mbx :
1338 debug_printf("appendfile: mode=%o notify_comsat=%d quota=%d warning=%d%s\n"
1339 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1340 "maildir_use_size_file=%s\n",
1341 mode, ob->notify_comsat, ob->quota_value, ob->quota_warn_threshold_value,
1342 ob->quota_warn_threshold_is_percent? "%" : "",
1343 isdirectory? "directory" : "file",
1344 path, mailbox_formats[mbformat],
1345 (ob->message_prefix == NULL)? US"null" : string_printing(ob->message_prefix),
1346 (ob->message_suffix == NULL)? US"null" : string_printing(ob->message_suffix),
1347 (ob->maildir_use_size_file)? "yes" : "no");
1349 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1350 ob->use_lockfile? "lockfile " : "",
1351 ob->use_mbx_lock? "mbx locking (" : "",
1352 ob->use_fcntl? "fcntl " : "",
1353 ob->use_flock? "flock" : "",
1354 ob->use_mbx_lock? ")" : "");
1357 /* If the -N option is set, can't do any more. */
1362 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1364 addr->transport_return = OK;
1368 /* Handle the case of a file name. If the file name is /dev/null, we can save
1369 ourselves some effort and just give a success return right away. */
1373 BOOL use_lstat = TRUE;
1374 BOOL file_opened = FALSE;
1375 BOOL allow_creation_here = TRUE;
1377 if (Ustrcmp(path, "/dev/null") == 0)
1379 addr->transport_return = OK;
1383 /* Set the name of the file to be opened, and the file to which the data
1384 is written, and find out if we are permitted to create a non-existent file. */
1386 dataname = filename = path;
1387 allow_creation_here = check_creation(filename, ob->create_file);
1389 /* If ob->create_directory is set, attempt to create the directories in
1390 which this mailbox lives, but only if we are permitted to create the file
1391 itself. We know we are dealing with an absolute path, because this was
1394 if (ob->create_directory && allow_creation_here)
1396 uschar *p = Ustrrchr(path, '/');
1398 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1400 addr->basic_errno = errno;
1402 string_sprintf("failed to create directories for %s: %s", path,
1404 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1410 /* If file_format is set we must check that any existing file matches one of
1411 the configured formats by checking the bytes it starts with. A match then
1412 indicates a specific transport - if it is not this one, pass control to it.
1413 Otherwise carry on here. An empty or non-existent file matches the current
1414 transport. We don't need to distinguish between non-existence and other open
1415 failures because if an existing file fails to open here, it will also fail
1416 again later when O_RDWR is used. */
1418 if (ob->file_format != NULL)
1420 int cfd = Uopen(path, O_RDONLY, 0);
1423 transport_instance *tt = check_file_format(cfd, tblock, addr);
1426 /* If another transport is indicated, call it and return; if no transport
1427 was found, just return - the error data will have been set up.*/
1433 set_process_info("delivering %s to %s using %s", message_id,
1434 addr->local_part, tt->name);
1435 debug_print_string(tt->debug_string);
1436 addr->transport = tt;
1437 (tt->info->code)(tt, addr);
1444 /* The locking of mailbox files is worse than the naming of cats, which is
1445 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1446 three different names, so several different styles of locking are used.
1448 Research in other programs that lock mailboxes shows that there is no
1449 universally standard method. Having mailboxes NFS-mounted on the system that
1450 is delivering mail is not the best thing, but people do run like this,
1451 and so the code must do its best to cope.
1453 Three different locking mechanisms are supported. The initialization function
1454 checks that at least one is configured.
1458 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1459 will work over NFS. Only after that is done do we actually open the mailbox
1460 and apply locks to it (if configured).
1462 Originally, Exim got the file opened before doing anything about locking.
1463 However, a very occasional problem was observed on Solaris 2 when delivering
1464 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1465 gets remembered at open time. If another process on another host (that's
1466 important) has the file open and locked and writes to it and then releases
1467 the lock while the first process is waiting to get the lock, the first
1468 process may fail to write at the new end point of the file - despite the very
1469 definite statement about O_APPEND in the man page for write(). Experiments
1470 have reproduced this problem, but I do not know any way of forcing a host to
1471 update its attribute cache for an open NFS file. It would be nice if it did
1472 so when a lock was taken out, but this does not seem to happen. Anyway, to
1473 reduce the risk of this problem happening, we now create the lock file
1474 (if configured) *before* opening the mailbox. That will prevent two different
1475 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1476 however, but Pine at least seems to operate in the same way.
1478 Lockfiles should normally be used when NFS is involved, because of the above
1481 The logic for creating the lock file is:
1483 . The name of the lock file is <mailbox-name>.lock
1485 . First, create a "hitching post" name by adding the primary host name,
1486 current time and pid to the lock file name. This should be unique.
1488 . Create the hitching post file using WRONLY + CREAT + EXCL.
1490 . If that fails EACCES, we assume it means that the user is unable to create
1491 files in the mail spool directory. Some installations might operate in this
1492 manner, so there is a configuration option to allow this state not to be an
1493 error - we proceed to lock using fcntl only, after the file is open.
1495 . Otherwise, an error causes a deferment of the address.
1497 . Hard link the hitching post to the lock file name.
1499 . If the link succeeds, we have successfully created the lock file. Simply
1500 close and unlink the hitching post file.
1502 . If the link does not succeed, proceed as follows:
1504 o Fstat the hitching post file, and then close and unlink it.
1506 o Now examine the stat data. If the number of links to the file is exactly
1507 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1508 the return never made it back, so the link() function gave a failure
1511 . This method allows for the lock file to be created by some other process
1512 right up to the moment of the attempt to hard link it, and is also robust
1513 against NFS server crash-reboots, which would probably result in timeouts
1514 in the middle of link().
1516 . System crashes may cause lock files to get left lying around, and some means
1517 of flushing them is required. The approach of writing a pid (used by smail
1518 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1519 timeout, which seems a better approach. Since any program that writes to a
1520 mailbox using a lock file should complete its task very quickly, Pine
1521 removes lock files that are older than 5 minutes. We allow the value to be
1522 configurable on the transport.
1526 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1527 mailbox once it is open. This is done by default with a non-blocking lock.
1528 Failures to lock cause retries after a sleep, but only for a certain number
1529 of tries. A blocking lock is deliberately not used so that we don't hold the
1530 mailbox open. This minimizes the possibility of the NFS problem described
1531 under LOCK FILES above, if for some reason NFS deliveries are happening
1532 without lock files. However, the use of a non-blocking lock and sleep, though
1533 the safest approach, does not give the best performance on very busy systems.
1534 A blocking lock plus timeout does better. Therefore Exim has an option to
1535 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1536 enables the use of blocking fcntl() calls.
1540 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1541 same manner as for fcntl locking above. No-blocking/timeout is also set as
1542 above in lock_flock_timeout. Not all operating systems provide or support
1543 flock(). For those that don't (as determined by the definition of LOCK_SH in
1544 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1545 is implemented (not precisely) on top of fcntl(), which means there's no
1546 point in actually using it.
1550 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1551 then the rules used for locking in c-client are used. Exim takes out a shared
1552 lock on the mailbox file, and an exclusive lock on the file whose name is
1553 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1554 any other MBX client from getting an exclusive lock on it and expunging it.
1555 It also stops any other MBX client from unlinking the /tmp lock when it has
1558 The exclusive lock on the /tmp file prevents any other MBX client from
1559 updating the mailbox in any way. When writing is finished, if an exclusive
1560 lock on the mailbox can be obtained, indicating there are no current sharers,
1561 the /tmp file is unlinked.
1563 MBX locking can use either fcntl() or flock() locking. If neither
1564 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1565 The calls for getting these locks are by default non-blocking, as for non-mbx
1566 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1567 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1568 probably makes sense to set timeouts for any MBX deliveries. */
1571 /* Build a lock file if configured to do so - the existence of a lock
1572 file is subsequently checked by looking for a non-negative value of the
1573 file descriptor hd - even though the file is no longer open. */
1575 if (ob->use_lockfile)
1577 lockname = string_sprintf("%s.lock", filename);
1578 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1579 (unsigned int)(time(NULL)), (unsigned int)getpid());
1581 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1584 /* Lock file creation retry loop */
1586 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1589 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1593 addr->basic_errno = errno;
1595 string_sprintf("creating lock file hitching post %s "
1596 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1597 (long int)getegid());
1601 /* Attempt to hitch the hitching post to the lock file. If link()
1602 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1603 file, and get rid of the hitching post. If the number of links was 2,
1604 the link was created, despite the failure of link(). If the hitch was
1605 not successful, try again, having unlinked the lock file if it is too
1608 There's a version of Linux (2.0.27) which doesn't update its local cache
1609 of the inode after link() by default - which many think is a bug - but
1610 if the link succeeds, this code will be OK. It just won't work in the
1611 case when link() fails after having actually created the link. The Linux
1612 NFS person is fixing this; a temporary patch is available if anyone is
1613 sufficiently worried. */
1615 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1618 if (rc != 0 && statbuf.st_nlink != 2)
1620 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1621 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1623 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1626 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1630 DEBUG(D_transport) debug_printf("lock file created\n");
1634 /* Check for too many tries at creating the lock file */
1636 if (i >= ob->lock_retries)
1638 addr->basic_errno = ERRNO_LOCKFAILED;
1639 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1646 /* We now have to get the file open. First, stat() it and act on existence or
1647 non-existence. This is in a loop to handle the case of a file's being created
1648 or deleted as we watch, and also to handle retries when the locking fails.
1649 Rather than holding the file open while waiting for the fcntl() and/or
1650 flock() lock, we close and do the whole thing again. This should be safer,
1651 especially for NFS files, which might get altered from other hosts, making
1652 their cached sizes incorrect.
1654 With the default settings, no symlinks are permitted, but there is an option
1655 to permit symlinks for those sysadmins that know what they are doing.
1656 Shudder. However, insist that the initial symlink is owned by the right user.
1657 Thus lstat() is used initially; if a symlink is discovered, the loop is
1658 repeated such that stat() is used, to look at the end file. */
1660 for (i = 0; i < ob->lock_retries; i++)
1662 int sleep_before_retry = TRUE;
1663 file_opened = FALSE;
1665 if((use_lstat? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1667 /* Let's hope that failure to stat (other than non-existence) is a
1670 if (errno != ENOENT)
1672 addr->basic_errno = errno;
1673 addr->message = string_sprintf("attempting to stat mailbox %s",
1678 /* File does not exist. If it is required to pre-exist this state is an
1681 if (ob->file_must_exist)
1683 addr->basic_errno = errno;
1684 addr->message = string_sprintf("mailbox %s does not exist, "
1685 "but file_must_exist is set", filename);
1689 /* If not permitted to create this file because it isn't in or below
1690 the home directory, generate an error. */
1692 if (!allow_creation_here)
1694 addr->basic_errno = ERRNO_BADCREATE;
1695 addr->message = string_sprintf("mailbox %s does not exist, "
1696 "but creation outside the home directory is not permitted",
1701 /* Attempt to create and open the file. If open fails because of
1702 pre-existence, go round the loop again. For any other error, defer the
1703 address, except for an alias or forward generated file name with EPERM,
1704 ENOENT, or EACCES, as those are most likely to be user errors rather
1705 than Exim config errors. When a symbolic link is permitted and points
1706 to a non-existent file, we get here with use_lstat = FALSE. In this case
1707 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1708 consistency and because MBX locking requires it in order to be able to
1709 get a shared lock. */
1711 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1712 (use_lstat? O_EXCL : 0), mode);
1715 if (errno == EEXIST) continue;
1716 addr->basic_errno = errno;
1717 addr->message = string_sprintf("while creating mailbox %s",
1719 if (testflag(addr, af_file) &&
1720 (errno == EPERM || errno == ENOENT || errno == EACCES))
1721 addr->transport_return = FAIL;
1725 /* We have successfully created and opened the file. Ensure that the group
1726 and the mode are correct. */
1728 Uchown(filename, uid, gid);
1729 Uchmod(filename, mode);
1733 /* The file already exists. Test its type, ownership, and permissions, and
1734 save the inode for checking later. If symlinks are permitted (not the
1735 default or recommended state) it may be a symlink that already exists.
1736 Check its ownership and then look for the file at the end of the link(s).
1737 This at least prevents one user creating a symlink for another user in
1738 a sticky directory. */
1742 int oldmode = (int)statbuf.st_mode;
1743 ino_t inode = statbuf.st_ino;
1744 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1746 isfifo = FALSE; /* In case things are changing */
1748 /* Check owner if required - the default. */
1750 if (ob->check_owner && statbuf.st_uid != uid)
1752 addr->basic_errno = ERRNO_BADUGID;
1753 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1754 "(%ld != %ld)", filename,
1755 islink? " (symlink)" : "",
1756 (long int)(statbuf.st_uid), (long int)uid);
1760 /* Group is checked only if check_group is set. */
1762 if (ob->check_group && statbuf.st_gid != gid)
1764 addr->basic_errno = ERRNO_BADUGID;
1765 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1766 filename, islink? " (symlink)" : "", statbuf.st_gid, gid);
1770 /* If symlinks are permitted (not recommended), the lstat() above will
1771 have found the symlink. Its ownership has just been checked; go round
1772 the loop again, using stat() instead of lstat(). That will never yield a
1775 if (islink && ob->allow_symlink)
1778 i--; /* Don't count this time round */
1782 /* An actual file exists. Check that it is a regular file, or FIFO
1785 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1787 else if ((oldmode & S_IFMT) != S_IFREG)
1789 addr->basic_errno = ERRNO_NOTREGULAR;
1790 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1791 filename, ob->allow_fifo? " or named pipe" : "");
1795 /* If the mode is not what it would be for a newly created file, change
1796 the permissions if the mode is supplied for the address. Otherwise,
1797 reduce but do not extend the permissions. If the newly created
1798 permissions are greater than the existing permissions, don't change
1799 things when the mode is not from the address. */
1801 if ((oldmode = (oldmode & 07777)) != mode)
1803 int diffs = oldmode ^ mode;
1804 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1806 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1807 if (Uchmod(filename, mode) < 0)
1809 addr->basic_errno = errno;
1810 addr->message = string_sprintf("attempting to chmod mailbox %s",
1817 /* Mode not from address, and newly-created permissions are greater
1818 than existing permissions. Default is to complain, but it can be
1819 configured to go ahead and try to deliver anyway if that's what
1820 the administration wants. */
1822 else if (ob->mode_fail_narrower)
1824 addr->basic_errno = ERRNO_BADMODE;
1825 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1826 "(%o expected)", filename, oldmode, mode);
1831 /* We are happy with the existing file. Open it, and then do further
1832 tests to ensure that it is the same file that we were just looking at.
1833 If the file does not now exist, restart this loop, going back to using
1834 lstat again. For an NFS error, just defer; other opening errors are
1835 more serious. The file is opened RDWR so that its format can be checked,
1836 and also MBX locking requires the use of a shared (read) lock. However,
1837 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1838 reading the pipe. */
1840 fd = Uopen(filename, isfifo? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1844 if (errno == ENOENT)
1849 addr->basic_errno = errno;
1852 addr->message = string_sprintf("while opening named pipe %s "
1853 "(could mean no process is reading it)", filename);
1855 else if (errno != EWOULDBLOCK)
1857 addr->message = string_sprintf("while opening mailbox %s", filename);
1862 /* This fstat really shouldn't fail, as we have an open file! There's a
1863 dilemma here. We use fstat in order to be sure we are peering at the file
1864 we have got open. However, that won't tell us if the file was reached
1865 via a symbolic link. We checked this above, but there is a race exposure
1866 if the link was created between the previous lstat and the open. However,
1867 it would have to be created with the same inode in order to pass the
1868 check below. If ob->allow_symlink is set, causing the use of stat rather
1869 than lstat above, symbolic links may be there anyway, and the checking is
1872 if (fstat(fd, &statbuf) < 0)
1874 addr->basic_errno = errno;
1875 addr->message = string_sprintf("attempting to stat open mailbox %s",
1880 /* Check the inode; this is isn't a perfect check, but gives some
1883 if (inode != statbuf.st_ino)
1885 addr->basic_errno = ERRNO_INODECHANGED;
1886 addr->message = string_sprintf("opened mailbox %s inode number changed "
1887 "from %d to %ld", filename, inode, statbuf.st_ino);
1888 addr->special_action = SPECIAL_FREEZE;
1892 /* Check it's still a regular file or FIFO, and the uid, gid, and
1893 permissions have not changed. */
1895 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1896 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1898 addr->basic_errno = ERRNO_NOTREGULAR;
1900 string_sprintf("opened mailbox %s is no longer a %s", filename,
1901 isfifo? "named pipe" : "regular file");
1902 addr->special_action = SPECIAL_FREEZE;
1906 if ((ob->check_owner && statbuf.st_uid != uid) ||
1907 (ob->check_group && statbuf.st_gid != gid))
1909 addr->basic_errno = ERRNO_BADUGID;
1911 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1912 addr->special_action = SPECIAL_FREEZE;
1916 if ((statbuf.st_mode & 07777) != oldmode)
1918 addr->basic_errno = ERRNO_BADMODE;
1919 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1920 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1921 addr->special_action = SPECIAL_FREEZE;
1925 /* If file_format is set, check that the format of the file has not
1926 changed. Error data is set by the testing function. */
1928 if (ob->file_format != NULL &&
1929 check_file_format(fd, tblock, addr) != tblock)
1931 addr->message = US"open mailbox has changed format";
1935 /* The file is OK. Carry on to do the locking. */
1938 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1939 locking rules if configured to do so. If a lock file is also required, it
1940 was created above and hd was left >= 0. At least one form of locking is
1941 required by the initialization function. If locking fails here, close the
1942 file and go round the loop all over again, after waiting for a bit, unless
1943 blocking locking was used. */
1946 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1947 sleep_before_retry = FALSE;
1949 /* Simple fcntl() and/or flock() locking */
1951 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
1953 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1954 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
1957 /* MBX locking rules */
1960 else if (ob->use_mbx_lock)
1962 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1963 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
1964 fstat(fd, &statbuf) >= 0)
1966 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
1967 (long)statbuf.st_ino);
1969 if (Ulstat(mbx_lockname, &statbuf) >= 0)
1971 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
1973 addr->basic_errno = ERRNO_LOCKFAILED;
1974 addr->message = string_sprintf("symbolic link on MBX lock file %s",
1978 if (statbuf.st_nlink > 1)
1980 addr->basic_errno = ERRNO_LOCKFAILED;
1981 addr->message = string_sprintf("hard link to MBX lock file %s",
1987 mbx_lockfd = Uopen(mbx_lockname, O_RDWR | O_CREAT, 0600);
1990 addr->basic_errno = ERRNO_LOCKFAILED;
1991 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
1992 mbx_lockname, strerror(errno));
1996 Uchmod(mbx_lockname, 0600);
1998 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
1999 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2001 struct stat ostatbuf;
2003 /* This tests for a specific race condition. Ensure that we still
2004 have the same file. */
2006 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2007 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2008 statbuf.st_dev == ostatbuf.st_dev &&
2009 statbuf.st_ino == ostatbuf.st_ino)
2011 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2012 "between creation and locking\n", mbx_lockname);
2015 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2022 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2023 filename, strerror(errno));
2026 #endif /* SUPPORT_MBX */
2028 else break; /* No on-file locking required; break the open/lock loop */
2031 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2035 use_lstat = TRUE; /* Reset to use lstat first */
2038 /* If a blocking call timed out, break the retry loop if the total time
2039 so far is not less than than retries * interval. Use the larger of the
2040 flock() and fcntl() timeouts. */
2043 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2044 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2045 ob->lock_retries * ob->lock_interval)
2046 i = ob->lock_retries;
2048 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2049 flock() that caused the problem. */
2051 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2054 /* Test for exceeding the maximum number of tries. Either the file remains
2055 locked, or, if we haven't got it open, something is terribly wrong... */
2057 if (i >= ob->lock_retries)
2061 addr->basic_errno = ERRNO_EXISTRACE;
2062 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2063 addr->special_action = SPECIAL_FREEZE;
2067 addr->basic_errno = ERRNO_LOCKFAILED;
2068 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2074 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2076 /* Save access time (for subsequent restoration), modification time (for
2077 restoration if updating fails), size of file (for comsat and for re-setting if
2078 delivery fails in the middle - e.g. for quota exceeded). */
2080 if (fstat(fd, &statbuf) < 0)
2082 addr->basic_errno = errno;
2083 addr->message = string_sprintf("while fstatting opened mailbox %s",
2088 times.actime = statbuf.st_atime;
2089 times.modtime = statbuf.st_mtime;
2090 saved_size = statbuf.st_size;
2091 if (mailbox_size < 0) mailbox_size = saved_size;
2092 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2095 /* Prepare for writing to a new file (as opposed to appending to an old one).
2096 There are several different formats, but there is preliminary stuff concerned
2097 with quotas that applies to all of them. Finding the current size by directory
2098 scanning is expensive; for maildirs some fudges have been invented:
2100 (1) A regex can be used to extract a file size from its name;
2101 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2107 uschar *check_path = path; /* Default quota check path */
2108 const pcre *regex = NULL; /* Regex for file size from file name */
2110 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2112 addr->basic_errno = ERRNO_BADCREATE;
2113 addr->message = string_sprintf("tried to create file in %s, but "
2114 "file creation outside the home directory is not permitted", path);
2118 #ifdef SUPPORT_MAILDIR
2119 /* For a maildir delivery, ensure that all the relevant directories exist */
2121 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2122 ob->create_directory, ob->dirmode))
2124 #endif /* SUPPORT_MAILDIR */
2126 /* If we are going to do a quota check, of if maildir_use_size_file is set
2127 for a maildir delivery, compile the regular expression if there is one. We
2128 may also need to adjust the path that is used. We need to do this for
2129 maildir_use_size_file even if the quota is unset, because we still want to
2130 create the file. When maildir support is not compiled,
2131 ob->maildir_use_size_file is always FALSE. */
2133 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2135 const uschar *error;
2138 /* Compile the regex if there is one */
2140 if (ob->quota_size_regex != NULL)
2142 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2143 (const char **)&error, &offset, NULL);
2146 addr->message = string_sprintf("appendfile: regular expression "
2147 "error: %s at offset %d while compiling %s", error, offset,
2148 ob->quota_size_regex);
2153 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2154 ob->quota_size_regex);
2158 /* Use an explicitly configured directory if set */
2160 if (ob->quota_directory != NULL)
2162 check_path = expand_string(ob->quota_directory);
2163 if (check_path == NULL)
2165 addr->transport_return = PANIC;
2166 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2167 "name for %s transport) failed: %s", ob->quota_directory,
2168 tblock->name, expand_string_message);
2172 if (check_path[0] != '/')
2174 addr->message = string_sprintf("appendfile: quota_directory name "
2175 "\"%s\" is not absolute", check_path);
2176 addr->basic_errno = ERRNO_NOTABSOLUTE;
2181 #ifdef SUPPORT_MAILDIR
2182 /* Otherwise, if we are handling a maildir delivery, and the directory
2183 contains a file called maildirfolder, this is a maildir++ feature telling
2184 us that this is a sub-directory of the real inbox. We should therefore do
2185 the quota check on the parent directory. Beware of the special case when
2186 the directory name itself ends in a slash. */
2188 else if (mbformat == mbf_maildir)
2190 struct stat statbuf;
2191 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2193 uschar *new_check_path = string_copy(check_path);
2194 uschar *slash = Ustrrchr(new_check_path, '/');
2200 slash = Ustrrchr(new_check_path, '/');
2205 check_path = new_check_path;
2210 #endif /* SUPPORT_MAILDIR */
2213 /* If we are using maildirsize files, we need to ensure that such a file
2214 exists and, if necessary, recalculate its contents. As a byproduct of this,
2215 we obtain the current size of the maildir. If no quota is to be enforced
2216 (ob->quota_value == 0), we still need the size if a threshold check will
2219 Another regular expression is used to determine which directories inside the
2220 maildir are going to be counted. */
2222 #ifdef SUPPORT_MAILDIR
2223 if (ob->maildir_use_size_file)
2225 const pcre *dir_regex = NULL;
2226 const uschar *error;
2229 if (ob->maildir_dir_regex != NULL)
2231 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2232 (const char **)&error, &offset, NULL);
2233 if (dir_regex == NULL)
2235 addr->message = string_sprintf("appendfile: regular expression "
2236 "error: %s at offset %d while compiling %s", error, offset,
2237 ob->maildir_dir_regex);
2243 debug_printf("using regex for maildir directory selection: %s\n",
2244 ob->maildir_dir_regex);
2248 /* Quota enforcement; create and check the file. There is some discussion
2249 about whether this should happen if the quota is unset. At present, Exim
2250 always creates the file. If we ever want to change this, uncomment
2251 appropriate lines below, possibly doing a check on some option. */
2253 /* if (???? || ob->quota_value > 0) */
2256 int size, filecount;
2258 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2261 if (maildirsize_fd == -1)
2263 addr->basic_errno = errno;
2264 addr->message = string_sprintf("while opening or reading "
2265 "%s/maildirsize", check_path);
2269 if (mailbox_size < 0) mailbox_size = size;
2270 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2273 /* No quota enforcement; ensure file does *not* exist; calculate size if
2278 * time_t old_latest;
2279 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2280 * if (THRESHOLD_CHECK)
2281 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2282 * regex, dir_regex, FALSE);
2287 #endif /* SUPPORT_MAILDIR */
2289 /* Otherwise (mailbox_size is not yet set), if we are going to do a quota
2290 check later on, find the current size of the mailbox. (We don't need to check
2291 ob->quota_filecount_value, because it can only be set if ob->quota_value is
2294 if ((mailbox_size < 0 || mailbox_filecount < 0) &&
2295 (ob->quota_value > 0 || THRESHOLD_CHECK))
2300 debug_printf("quota checks on directory %s\n", check_path);
2301 size = check_dir_size(check_path, &filecount, regex);
2302 if (mailbox_size < 0) mailbox_size = size;
2303 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2306 /* Handle the case of creating a unique file in a given directory (not in
2307 maildir or mailstore format - this is how smail did it). A temporary name is
2308 used to create the file. Later, when it is written, the name is changed to a
2309 unique one. There is no need to lock the file. An attempt is made to create
2310 the directory if it does not exist. */
2312 if (mbformat == mbf_smail)
2315 debug_printf("delivering to new file in %s\n", path);
2316 filename = dataname =
2317 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2318 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2319 if (fd < 0 && /* failed to open, and */
2320 (errno != ENOENT || /* either not non-exist */
2321 !ob->create_directory || /* or not allowed to make */
2322 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2323 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2325 addr->basic_errno = errno;
2326 addr->message = string_sprintf("while creating file %s", filename);
2331 #ifdef SUPPORT_MAILDIR
2333 /* Handle the case of a unique file in maildir format. The file is written to
2334 the tmp subdirectory, with a prescribed form of name. */
2336 else if (mbformat == mbf_maildir)
2339 debug_printf("delivering in maildir format in %s\n", path);
2341 nametag = ob->maildir_tag;
2343 /* Check that nametag expands successfully; a hard failure causes a panic
2344 return. The actual expansion for use happens again later, when
2345 $message_size is accurately known. */
2347 if (nametag != NULL && expand_string(nametag) == NULL &&
2348 !expand_string_forcedfail)
2350 addr->transport_return = PANIC;
2351 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2352 "for %s transport) failed: %s", nametag, tblock->name,
2353 expand_string_message);
2357 /* We ensured the existence of all the relevant directories above. Attempt
2358 to open the temporary file a limited number of times. I think this rather
2359 scary-looking for statement is actually OK. If open succeeds, the loop is
2360 broken; if not, there is a test on the value of i. Get the time again
2361 afresh each time round the loop. Its value goes into a variable that is
2362 checked at the end, to make sure we don't release this process until the
2363 clock has ticked. */
2369 (void)gettimeofday(&msg_tv, NULL);
2370 basename = string_sprintf("%lu.H%luP%lu.%s", msg_tv.tv_sec,
2371 msg_tv.tv_usec, getpid(), primary_hostname);
2373 filename = dataname = string_sprintf("tmp/%s", basename);
2374 newname = string_sprintf("new/%s", basename);
2376 if (Ustat(filename, &statbuf) == 0)
2378 else if (errno == ENOENT)
2380 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2382 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2383 filename, strerror(errno));
2386 /* Too many retries - give up */
2388 if (i >= ob->maildir_retries)
2390 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2391 filename, i, (i == 1)? "y" : "ies");
2392 addr->basic_errno = errno;
2396 /* Open or stat failed but we haven't tried too many times yet. */
2401 /* Note that we have to ensure the clock has ticked before leaving */
2403 wait_for_tick = TRUE;
2405 /* Why are these here? Put in because they are present in the non-maildir
2406 directory case above. */
2408 Uchown(filename, uid, gid);
2409 Uchmod(filename, mode);
2412 #endif /* SUPPORT_MAILDIR */
2414 #ifdef SUPPORT_MAILSTORE
2416 /* Handle the case of a unique file in mailstore format. First write the
2417 envelope to a temporary file, then open the main file. The unique base name
2418 for the files consists of the message id plus the pid of this delivery
2424 address_item *taddr;
2425 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2426 string_base62((long int)getpid()));
2429 debug_printf("delivering in mailstore format in %s\n", path);
2431 filename = string_sprintf("%s.tmp", mailstore_basename);
2432 newname = string_sprintf("%s.env", mailstore_basename);
2433 dataname = string_sprintf("%s.msg", mailstore_basename);
2435 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2436 if (fd < 0 && /* failed to open, and */
2437 (errno != ENOENT || /* either not non-exist */
2438 !ob->create_directory || /* or not allowed to make */
2439 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2440 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2442 addr->basic_errno = errno;
2443 addr->message = string_sprintf("while creating file %s", filename);
2447 /* Why are these here? Put in because they are present in the non-maildir
2448 directory case above. */
2450 Uchown(filename, uid, gid);
2451 Uchmod(filename, mode);
2453 /* Built a C stream from the open file descriptor. */
2455 if ((env_file = fdopen(fd, "wb")) == NULL)
2457 addr->basic_errno = errno;
2458 addr->transport_return = PANIC;
2459 addr->message = string_sprintf("fdopen of %s ("
2460 "for %s transport) failed", filename, tblock->name);
2466 /* Write the envelope file, then close it. */
2468 if (ob->mailstore_prefix != NULL)
2470 uschar *s = expand_string(ob->mailstore_prefix);
2473 if (!expand_string_forcedfail)
2475 addr->transport_return = PANIC;
2476 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2477 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2478 tblock->name, expand_string_message);
2487 fprintf(env_file, "%s", CS s);
2488 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2492 fprintf(env_file, "%s\n", sender_address);
2494 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2495 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2497 if (ob->mailstore_suffix != NULL)
2499 uschar *s = expand_string(ob->mailstore_suffix);
2502 if (!expand_string_forcedfail)
2504 addr->transport_return = PANIC;
2505 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2506 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2507 tblock->name, expand_string_message);
2516 fprintf(env_file, "%s", CS s);
2517 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2521 if (fclose(env_file) != 0)
2523 addr->basic_errno = errno;
2524 addr->message = string_sprintf("while closing %s", filename);
2529 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2531 /* Now open the data file, and ensure that it has the correct ownership and
2534 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2537 addr->basic_errno = errno;
2538 addr->message = string_sprintf("while creating file %s", dataname);
2542 Uchown(dataname, uid, gid);
2543 Uchmod(dataname, mode);
2546 #endif /* SUPPORT_MAILSTORE */
2549 /* In all cases of writing to a new file, ensure that the file which is
2550 going to be renamed has the correct ownership and mode. */
2552 Uchown(filename, uid, gid);
2553 Uchmod(filename, mode);
2557 /* At last we can write the message to the file, preceded by any configured
2558 prefix line, and followed by any configured suffix line. If there are any
2559 writing errors, we must defer. */
2561 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2566 /* If there is a local quota setting, check that we are not going to exceed it
2567 with this message if quota_is_inclusive is set; if it is not set, the check
2568 is for the mailbox already being over quota (i.e. the current message is not
2569 included in the check). */
2571 if (ob->quota_value > 0)
2575 debug_printf("Exim quota = %d old size = %d this message = %d "
2576 "(%sincluded)\n", ob->quota_value, mailbox_size, message_size,
2577 ob->quota_is_inclusive? "" : "not ");
2578 debug_printf(" file count quota = %d count = %d\n",
2579 ob->quota_filecount_value, mailbox_filecount);
2581 if (mailbox_size + (ob->quota_is_inclusive? message_size:0) > ob->quota_value)
2583 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2585 errno = ERRNO_EXIMQUOTA;
2587 else if (ob->quota_filecount_value > 0 &&
2588 mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2589 ob->quota_filecount_value)
2591 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2593 errno = ERRNO_EXIMQUOTA;
2594 filecount_msg = US" filecount";
2598 /* If we are writing in MBX format, what we actually do is to write the message
2599 to a temporary file, and then copy it to the real file once we know its size.
2600 This is the most straightforward way of getting the correct length in the
2601 separator line. So, what we do here is to save the real file descriptor, and
2602 replace it with one for a temporary file. The temporary file gets unlinked once
2603 opened, so that it goes away on closure. */
2606 if (yield == OK && ob->mbx_format)
2608 temp_file = tmpfile();
2609 if (temp_file == NULL)
2611 addr->basic_errno = errno;
2612 addr->message = US"while setting up temporary file";
2617 fd = fileno(temp_file);
2618 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2620 #endif /* SUPPORT_MBX */
2622 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2625 transport_count = 0;
2627 /* Write any configured prefix text first */
2629 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2631 uschar *prefix = expand_string(ob->message_prefix);
2634 errno = ERRNO_EXPANDFAIL;
2635 addr->transport_return = PANIC;
2636 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2637 "transport) failed", ob->message_prefix, tblock->name);
2640 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2643 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2644 various different values for batching are handled outside; if there is more
2645 than one address available here, all must be included. If any address is a
2646 file, use its parent in the RCPT TO. */
2648 if (yield == OK && ob->use_bsmtp)
2650 transport_count = 0;
2651 if (ob->use_crlf) cr = US"\r";
2652 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2657 for (a = addr; a != NULL; a = a->next)
2659 address_item *b = testflag(a, af_pfr)? a->parent: a;
2660 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2661 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2662 { yield = DEFER; break; }
2664 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2669 /* Now the message itself. The options for transport_write_message were set up
2670 at initialization time. */
2674 if (!transport_write_message(addr, fd, ob->options, 0, tblock->add_headers,
2675 tblock->remove_headers, ob->check_string, ob->escape_string,
2676 tblock->rewrite_rules, tblock->rewrite_existflags))
2680 /* Now a configured suffix. */
2682 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2684 uschar *suffix = expand_string(ob->message_suffix);
2687 errno = ERRNO_EXPANDFAIL;
2688 addr->transport_return = PANIC;
2689 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2690 "transport) failed", ob->message_suffix, tblock->name);
2693 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2696 /* If batch smtp, write the terminating dot. */
2698 if (yield == OK && ob->use_bsmtp &&
2699 !transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2701 /* If MBX format is being used, all that writing was to the temporary file.
2702 However, if there was an earlier failure (Exim quota exceeded, for example),
2703 the temporary file won't have got opened - and no writing will have been done.
2704 If writing was OK, we restore the fd, and call a function that copies the
2705 message in MBX format into the real file. Otherwise use the temporary name in
2709 if (temp_file != NULL && ob->mbx_format)
2716 transport_count = 0; /* Reset transport count for actual write */
2717 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2719 else if (errno >= 0) dataname = US"temporary file";
2721 /* Preserve errno while closing the temporary file. */
2723 mbx_save_errno = errno;
2725 errno = mbx_save_errno;
2727 #endif /* SUPPORT_MBX */
2729 /* Force out the remaining data to check for any errors; some OS don't allow
2730 fsync() to be called for a FIFO. */
2732 if (yield == OK && !isfifo && fsync(fd) < 0) yield = DEFER;
2734 /* Update message_size to the accurate count of bytes written, including
2737 message_size = transport_count;
2739 /* If using a maildir++ quota file, add this message's size to it, and
2740 close the file descriptor. */
2742 #ifdef SUPPORT_MAILDIR
2743 if (yield == OK && maildirsize_fd >= 0)
2744 maildir_record_length(maildirsize_fd, message_size);
2746 maildir_save_errno = errno; /* Preserve errno while closing the file */
2747 close(maildirsize_fd);
2748 errno = maildir_save_errno;
2749 #endif /* SUPPORT_MAILDIR */
2751 /* If there is a quota warning threshold and we are have crossed it with this
2752 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2755 if (THRESHOLD_CHECK)
2757 int threshold = ob->quota_warn_threshold_value;
2758 if (ob->quota_warn_threshold_is_percent)
2759 threshold = (int)(((double)ob->quota_value * threshold) / 100);
2761 debug_printf("quota = %d threshold = %d old size = %d message size = %d\n",
2762 ob->quota_value, threshold, mailbox_size, message_size);
2763 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2764 addr->special_action = SPECIAL_WARN;
2766 /******* You might think that the test ought to be this:
2768 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2769 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2771 * (indeed, I was sent a patch with that in). However, it is possible to
2772 * have a warning threshold without actually imposing a quota, and I have
2773 * therefore kept Exim backwards compatible.
2778 /* Handle error while writing the file. Control should come here directly after
2779 the error, with the reason in errno. In the case of expansion failure in prefix
2780 or suffix, it will be ERRNO_EXPANDFAIL. */
2784 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2786 /* Save the error number. If positive, it will ultimately cause a strerror()
2787 call to generate some text. */
2789 addr->basic_errno = errno;
2791 /* For system or Exim quota excession, or disk full, set more_errno to the
2792 time since the file was last read. If delivery was into a directory, the
2793 time since last read logic is not relevant, in general. However, for maildir
2794 deliveries we can approximate it by looking at the last modified time of the
2795 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2796 "new" subdirectory implies that an MUA has moved a message from there to the
2799 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2801 addr->more_errno = 0;
2802 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2804 #ifdef SUPPORT_MAILDIR
2805 else if (mbformat == mbf_maildir)
2807 struct stat statbuf;
2808 if (Ustat("new", &statbuf) < 0)
2810 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2811 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2813 else /* Want a repeatable time when in test harness */
2815 addr->more_errno = running_in_test_harness? 10 :
2816 (int)time(NULL) - statbuf.st_mtime;
2819 debug_printf("maildir: time since \"new\" directory modified = %s\n",
2820 readconf_printtime(addr->more_errno));
2822 #endif /* SUPPORT_MAILDIR */
2825 /* Handle system quota excession. Add an explanatory phrase for the error
2826 message, since some systems don't have special quota-excession errors,
2827 and on those that do, "quota" doesn't always mean anything to the user. */
2829 if (errno == errno_quota)
2832 addr->message = string_sprintf("mailbox is full "
2833 "(quota exceeded while writing to file %s)", filename);
2835 addr->message = string_sprintf("mailbox is full");
2837 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
2839 isdirectory? US"" : US": time since file read = ",
2840 isdirectory? US"" : readconf_printtime(addr->more_errno));
2843 /* Handle Exim's own quota-imposition */
2845 else if (errno == ERRNO_EXIMQUOTA)
2847 addr->message = string_sprintf("mailbox is full "
2848 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
2850 addr->user_message = US"mailbox is full";
2851 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
2852 filecount_msg, dataname,
2853 isdirectory? US"" : US": time since file read = ",
2854 isdirectory? US"" : readconf_printtime(addr->more_errno));
2857 /* Handle a process failure while writing via a filter; the return
2858 from child_close() is in more_errno. */
2860 else if (errno == ERRNO_FILTER_FAIL)
2863 addr->message = string_sprintf("transport filter process failed (%d) "
2864 "while writing to %s%s", addr->more_errno, dataname,
2865 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
2868 /* Handle failure to expand header changes */
2870 else if (errno == ERRNO_CHHEADER_FAIL)
2874 string_sprintf("failed to expand headers_add or headers_remove while "
2875 "writing to %s: %s", dataname, expand_string_message);
2878 /* Handle failure to complete writing of a data block */
2880 else if (errno == ERRNO_WRITEINCOMPLETE)
2882 addr->message = string_sprintf("failed to write data block while "
2883 "writing to %s", dataname);
2886 /* Handle length mismatch on MBX copying */
2889 else if (errno == ERRNO_MBXLENGTH)
2891 addr->message = string_sprintf("length mismatch while copying MBX "
2892 "temporary file to %s", dataname);
2894 #endif /* SUPPORT_MBX */
2896 /* For other errors, a general-purpose explanation, if the message is
2899 else if (addr->message == NULL)
2900 addr->message = string_sprintf("error while writing to %s", dataname);
2902 /* For a file, reset the file size to what it was before we started, leaving
2903 the last modification time unchanged, so it will get reset also. All systems
2904 investigated so far have ftruncate(), whereas not all have the F_FREESP
2905 fcntl() call (BSDI & FreeBSD do not). */
2907 if (!isdirectory) ftruncate(fd, saved_size);
2910 /* Handle successful writing - we want the modification time to be now for
2911 appended files. Remove the default backstop error number. For a directory, now
2912 is the time to rename the file with a unique name. As soon as such a name
2913 appears it may get used by another process, so we close the file first and
2914 check that all is well. */
2918 times.modtime = time(NULL);
2919 addr->basic_errno = 0;
2921 /* Handle the case of writing to a new file in a directory. This applies
2922 to all single-file formats - maildir, mailstore, and "smail format". */
2926 if (fstat(fd, &statbuf) < 0)
2928 addr->basic_errno = errno;
2929 addr->message = string_sprintf("while fstatting opened message file %s",
2934 else if (close(fd) < 0)
2936 addr->basic_errno = errno;
2937 addr->message = string_sprintf("close() error for %s",
2938 (ob->mailstore_format)? dataname : filename);
2942 /* File is successfully written and closed. Arrange to rename it. For the
2943 different kinds of single-file delivery, some games can be played with the
2944 name. The message size is by this time set to the accurate value so that
2945 its value can be used in expansions. */
2949 uschar *renamename = newname;
2952 DEBUG(D_transport) debug_printf("renaming temporary file\n");
2954 /* If there is no rename name set, we are in a non-maildir, non-mailstore
2955 situation. The name is built by expanding the directory_file option, and
2956 we make the inode number available for use in this. The expansion was
2957 checked for syntactic validity above, before we wrote the file.
2959 We have to be careful here, in case the file name exists. (In the other
2960 cases, the names used are constructed to be unique.) The rename()
2961 function just replaces an existing file - we don't want that! So instead
2962 of calling rename(), we must use link() and unlink().
2964 In this case, if the link fails because of an existing file, we wait
2965 for one second and try the expansion again, to see if it produces a
2966 different value. Do this up to 5 times unless the name stops changing.
2967 This makes it possible to build values that are based on the time, and
2968 still cope with races from multiple simultaneous deliveries. */
2970 if (newname == NULL)
2974 uschar *old_renameleaf = US"";
2976 for (i = 0; ; sleep(1), i++)
2978 deliver_inode = statbuf.st_ino;
2979 renameleaf = expand_string(ob->dirfilename);
2982 if (renameleaf == NULL)
2984 addr->transport_return = PANIC;
2985 addr->message = string_sprintf("Expansion of \"%s\" "
2986 "(directory_file for %s transport) failed: %s",
2987 ob->dirfilename, tblock->name, expand_string_message);
2991 renamename = string_sprintf("%s/%s", path, renameleaf);
2992 if (Ulink(filename, renamename) < 0)
2994 DEBUG(D_transport) debug_printf("link failed: %s\n",
2996 if (errno != EEXIST || i >= 4 ||
2997 Ustrcmp(renameleaf, old_renameleaf) == 0)
2999 addr->basic_errno = errno;
3000 addr->message = string_sprintf("while renaming %s as %s",
3001 filename, renamename);
3005 old_renameleaf = renameleaf;
3006 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3015 } /* re-expand loop */
3016 } /* not mailstore or maildir */
3018 /* For maildir and mailstore formats, the new name was created earlier,
3019 except that for maildir, there is the possibility of adding a "tag" on
3020 the end of the name by expanding the value of nametag. This usually
3021 includes a reference to the message size. The expansion of nametag was
3022 checked above, before the file was opened. It either succeeded, or
3023 provoked a soft failure. So any failure here can be treated as soft.
3024 Ignore non-printing characters and / and put a colon at the start if the
3025 first character is alphanumeric. */
3029 if (nametag != NULL)
3031 uschar *iptr = expand_string(nametag);
3034 uschar *etag = store_get(Ustrlen(iptr) + 2);
3035 uschar *optr = etag;
3038 if (mac_isgraph(*iptr) && *iptr != '/')
3040 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3046 renamename = string_sprintf("%s%s", newname, etag);
3050 /* Do the rename. If the name is too long and a tag exists, try again
3053 if (Urename(filename, renamename) < 0 &&
3054 (nametag == NULL || errno != ENAMETOOLONG ||
3055 (renamename = newname, Urename(filename, renamename) < 0)))
3057 addr->basic_errno = errno;
3058 addr->message = string_sprintf("while renaming %s as %s",
3059 filename, renamename);
3063 /* Rename succeeded */
3067 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3069 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3071 } /* maildir or mailstore */
3072 } /* successful write + close */
3074 } /* write success */
3077 /* For a file, restore the last access time (atime), and set the modification
3078 time as required - changed if write succeeded, unchanged if not. */
3080 if (!isdirectory) utime(CS filename, ×);
3082 /* Notify comsat if configured to do so. It only makes sense if the configured
3083 file is the one that the comsat daemon knows about. */
3085 if (ob->notify_comsat && yield == OK && deliver_localpart != NULL)
3086 notify_comsat(deliver_localpart, saved_size);
3088 /* Pass back the final return code in the address structure */
3091 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3092 yield, addr->basic_errno, addr->more_errno);
3094 addr->transport_return = yield;
3096 /* Close the file, which will release the fcntl lock. For a directory write it
3097 is closed above, except in cases of error which goto RETURN, when we also need
3098 to remove the original file(s). For MBX locking, if all has gone well, before
3099 closing the file, see if we can get an exclusive lock on it, in which case we
3100 can unlink the /tmp lock file before closing it. This is always a non-blocking
3101 lock; there's no need to wait if we can't get it. If everything has gone right
3102 but close fails, defer the message. Then unlink the lock file, if present. This
3103 point in the code is jumped to from a number of places when errors are
3104 detected, in order to get the file closed and the lock file tidied away. */
3109 if (mbx_lockfd >= 0)
3111 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3112 ob->use_flock, 0) >= 0)
3115 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3116 Uunlink(mbx_lockname);
3120 #endif /* SUPPORT_MBX */
3122 if (fd >= 0 && close(fd) < 0 && yield == OK)
3124 addr->basic_errno = errno;
3125 addr->message = string_sprintf("while closing %s", filename);
3126 addr->transport_return = DEFER;
3129 if (hd >= 0) Uunlink(lockname);
3131 /* We get here with isdirectory and filename set only in error situations. */
3133 if (isdirectory && filename != NULL)
3136 if (dataname != filename) Uunlink(dataname);
3139 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3140 file name relies on time + pid. We must not allow the process to finish until
3141 the clock has move on by at least one microsecond. Usually we expect this
3142 already to be the case, but machines keep getting faster... */
3144 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3146 /* A return of FALSE means that if there was an error, a common error was
3147 put in the first address of a batch. */
3152 /* End of transport/appendfile.c */