1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2020 */
6 /* Copyright (c) The Exim maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
11 #include "appendfile.h"
13 #ifdef SUPPORT_MAILDIR
14 #include "tf_maildir.h"
18 /* Options specific to the appendfile transport. They must be in alphabetic
19 order (note that "_" comes before the lower case letters). Some of them are
20 stored in the publicly visible instance block - these are flagged with the
22 #define LOFF(field) OPT_OFF(appendfile_transport_options_block, field)
24 optionlist appendfile_transport_options[] = {
25 #ifdef SUPPORT_MAILDIR
26 { "*expand_maildir_use_size_file", opt_stringptr, LOFF(expand_maildir_use_size_file) },
28 { "*set_use_fcntl_lock",opt_bool | opt_hidden, LOFF(set_use_fcntl) },
29 { "*set_use_flock_lock",opt_bool | opt_hidden, LOFF(set_use_flock) },
30 { "*set_use_lockfile", opt_bool | opt_hidden, LOFF(set_use_lockfile) },
32 { "*set_use_mbx_lock", opt_bool | opt_hidden, LOFF(set_use_mbx_lock) },
34 { "allow_fifo", opt_bool, LOFF(allow_fifo) },
35 { "allow_symlink", opt_bool, LOFF(allow_symlink) },
36 { "batch_id", opt_stringptr | opt_public, OPT_OFF(transport_instance, batch_id) },
37 { "batch_max", opt_int | opt_public, OPT_OFF(transport_instance, batch_max) },
38 { "check_group", opt_bool, LOFF(check_group) },
39 { "check_owner", opt_bool, LOFF(check_owner) },
40 { "check_string", opt_stringptr, LOFF(check_string) },
41 { "create_directory", opt_bool, LOFF(create_directory) },
42 { "create_file", opt_stringptr, LOFF(create_file_string) },
43 { "directory", opt_stringptr, LOFF(dirname) },
44 { "directory_file", opt_stringptr, LOFF(dirfilename) },
45 { "directory_mode", opt_octint, LOFF(dirmode) },
46 { "escape_string", opt_stringptr, LOFF(escape_string) },
47 { "file", opt_stringptr, LOFF(filename) },
48 { "file_format", opt_stringptr, LOFF(file_format) },
49 { "file_must_exist", opt_bool, LOFF(file_must_exist) },
50 { "lock_fcntl_timeout", opt_time, LOFF(lock_fcntl_timeout) },
51 { "lock_flock_timeout", opt_time, LOFF(lock_flock_timeout) },
52 { "lock_interval", opt_time, LOFF(lock_interval) },
53 { "lock_retries", opt_int, LOFF(lock_retries) },
54 { "lockfile_mode", opt_octint, LOFF(lockfile_mode) },
55 { "lockfile_timeout", opt_time, LOFF(lockfile_timeout) },
56 { "mailbox_filecount", opt_stringptr, LOFF(mailbox_filecount_string) },
57 { "mailbox_size", opt_stringptr, LOFF(mailbox_size_string) },
58 #ifdef SUPPORT_MAILDIR
59 { "maildir_format", opt_bool, LOFF(maildir_format ) } ,
60 { "maildir_quota_directory_regex", opt_stringptr, LOFF(maildir_dir_regex) },
61 { "maildir_retries", opt_int, LOFF(maildir_retries) },
62 { "maildir_tag", opt_stringptr, LOFF(maildir_tag) },
63 { "maildir_use_size_file", opt_expand_bool, LOFF(maildir_use_size_file ) } ,
64 { "maildirfolder_create_regex", opt_stringptr, LOFF(maildirfolder_create_regex ) },
65 #endif /* SUPPORT_MAILDIR */
66 #ifdef SUPPORT_MAILSTORE
67 { "mailstore_format", opt_bool, LOFF(mailstore_format ) },
68 { "mailstore_prefix", opt_stringptr, LOFF(mailstore_prefix ) },
69 { "mailstore_suffix", opt_stringptr, LOFF(mailstore_suffix ) },
70 #endif /* SUPPORT_MAILSTORE */
72 { "mbx_format", opt_bool, LOFF(mbx_format ) } ,
73 #endif /* SUPPORT_MBX */
74 { "message_prefix", opt_stringptr, LOFF(message_prefix) },
75 { "message_suffix", opt_stringptr, LOFF(message_suffix) },
76 { "mode", opt_octint, LOFF(mode) },
77 { "mode_fail_narrower",opt_bool, LOFF(mode_fail_narrower) },
78 { "notify_comsat", opt_bool, LOFF(notify_comsat) },
79 { "quota", opt_stringptr, LOFF(quota) },
80 { "quota_directory", opt_stringptr, LOFF(quota_directory) },
81 { "quota_filecount", opt_stringptr, LOFF(quota_filecount) },
82 { "quota_is_inclusive", opt_bool, LOFF(quota_is_inclusive) },
83 { "quota_size_regex", opt_stringptr, LOFF(quota_size_regex) },
84 { "quota_warn_message", opt_stringptr | opt_public, OPT_OFF(transport_instance, warn_message) },
85 { "quota_warn_threshold", opt_stringptr, LOFF(quota_warn_threshold) },
86 { "use_bsmtp", opt_bool, LOFF(use_bsmtp) },
87 { "use_crlf", opt_bool, LOFF(use_crlf) },
88 { "use_fcntl_lock", opt_bool_set, LOFF(use_fcntl) },
89 { "use_flock_lock", opt_bool_set, LOFF(use_flock) },
90 { "use_lockfile", opt_bool_set, LOFF(use_lockfile) },
92 { "use_mbx_lock", opt_bool_set, LOFF(use_mbx_lock) },
93 #endif /* SUPPORT_MBX */
96 /* Size of the options list. An extern variable has to be used so that its
97 address can appear in the tables drtables.c. */
99 int appendfile_transport_options_count =
100 sizeof(appendfile_transport_options)/sizeof(optionlist);
106 appendfile_transport_options_block appendfile_transport_option_defaults = {0};
107 void appendfile_transport_init(transport_instance *tblock) {}
108 BOOL appendfile_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
110 #else /*!MACRO_PREDEF*/
112 /* Default private options block for the appendfile transport. */
114 appendfile_transport_options_block appendfile_transport_option_defaults = {
115 /* all non-mentioned members zero/null/false */
116 .dirfilename = US"q${base62:$tod_epoch}-$inode",
117 .create_file_string = US"anywhere",
118 .maildir_dir_regex = US"^(?:cur|new|\\..*)$",
119 .mailbox_size_value = -1,
120 .mailbox_filecount_value = -1,
121 .mode = APPENDFILE_MODE,
122 .dirmode = APPENDFILE_DIRECTORY_MODE,
123 .lockfile_mode = APPENDFILE_LOCKFILE_MODE,
124 .lockfile_timeout = 30*60,
127 .maildir_retries = 10,
128 .create_file = create_anywhere,
130 .create_directory = TRUE,
131 .notify_comsat = FALSE,
132 .use_lockfile = TRUE,
134 .mode_fail_narrower = TRUE,
135 .quota_is_inclusive = TRUE,
139 /* Encodings for mailbox formats, and their names. MBX format is actually
140 supported only if SUPPORT_MBX is set. */
142 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
144 static const char *mailbox_formats[] = {
145 "unix", "mbx", "smail", "maildir", "mailstore" };
148 /* Check warn threshold only if quota size set or not a percentage threshold
149 percentage check should only be done if quota > 0 */
151 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
152 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
156 /*************************************************
157 * Setup entry point *
158 *************************************************/
160 /* Called for each delivery in the privileged state, just before the uid/gid
161 are changed and the main entry point is called. We use this function to
162 expand any quota settings, so that it can access files that may not be readable
163 by the user. It is also used to pick up external mailbox size information, if
167 tblock points to the transport instance
168 addrlist addresses about to be delivered (not used)
169 dummy not used (doesn't pass back data)
170 uid the uid that will be set (not used)
171 gid the gid that will be set (not used)
172 errmsg where to put an error message
174 Returns: OK, FAIL, or DEFER
181 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
182 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
184 appendfile_transport_options_block *ob =
185 (appendfile_transport_options_block *)(tblock->options_block);
186 uschar *q = ob->quota;
187 double default_value = 0.0;
189 addrlist = addrlist; /* Keep picky compilers happy */
194 /* we can't wait until we're not privileged anymore */
195 open_logs("appendfile");
197 if (ob->expand_maildir_use_size_file)
198 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
199 US"`maildir_use_size_file` in transport", tblock->name);
201 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
204 for (int i = 0; i < 5; i++)
206 double d = default_value;
208 uschar *which = NULL;
214 if (!(s = expand_string(q)))
216 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
217 "%s", q, tblock->name, expand_string_message);
218 return f.search_find_defer ? DEFER : FAIL;
221 d = Ustrtod(s, &rest);
223 /* Handle following characters K, M, G, %, the latter being permitted
224 for quota_warn_threshold only. A threshold with no quota setting is
227 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
228 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
229 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
230 else if (*rest == '%' && i == 2)
232 if (ob->quota_value <= 0 && !ob->maildir_use_size_file)
234 else if ((int)d < 0 || (int)d > 100)
236 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
237 " for %s transport", (int)d, tblock->name);
240 ob->quota_warn_threshold_is_percent = TRUE;
245 /* For quota and quota_filecount there may be options
246 appended. Currently only "no_check", so we can be lazy parsing it */
247 if (i < 2 && Ustrstr(rest, "/no_check") == rest)
250 rest += sizeof("/no_check") - 1;
253 Uskip_whitespace(&rest);
257 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
258 "in %s transport", s, q, tblock->name);
263 /* Set each value, checking for possible overflow. */
268 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
270 ob->quota_value = (off_t)d;
271 ob->quota_no_check = no_check;
272 q = ob->quota_filecount;
276 if (d >= 2.0*1024.0*1024.0*1024.0)
277 which = US"quota_filecount";
278 ob->quota_filecount_value = (int)d;
279 ob->quota_filecount_no_check = no_check;
280 q = ob->quota_warn_threshold;
284 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
285 which = US"quota_warn_threshold";
286 ob->quota_warn_threshold_value = (off_t)d;
287 q = ob->mailbox_size_string;
288 default_value = -1.0;
292 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
293 which = US"mailbox_size";;
294 ob->mailbox_size_value = (off_t)d;
295 q = ob->mailbox_filecount_string;
299 if (d >= 2.0*1024.0*1024.0*1024.0)
300 which = US"mailbox_filecount";
301 ob->mailbox_filecount_value = (int)d;
307 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
308 "%s transport", which, d, tblock->name);
318 /*************************************************
319 * Initialization entry point *
320 *************************************************/
322 /* Called for each instance, after its options have been read, to
323 enable consistency checks to be done, or anything else that needs
327 appendfile_transport_init(transport_instance *tblock)
329 appendfile_transport_options_block *ob =
330 (appendfile_transport_options_block *)(tblock->options_block);
333 /* Set up the setup entry point, to be called in the privileged state */
335 tblock->setup = appendfile_transport_setup;
337 /* Lock_retries must be greater than zero */
339 if (ob->lock_retries == 0) ob->lock_retries = 1;
341 /* Only one of a file name or directory name must be given. */
343 if (ob->filename && ob->dirname)
344 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
345 "only one of \"file\" or \"directory\" can be specified", tblock->name);
347 /* If a file name was specified, neither quota_filecount nor quota_directory
352 if (ob->quota_filecount)
353 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
354 "quota_filecount must not be set without \"directory\"", tblock->name);
355 if (ob->quota_directory)
356 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
357 "quota_directory must not be set without \"directory\"", tblock->name);
360 /* The default locking depends on whether MBX is set or not. Change the
361 built-in default if none of the lock options has been explicitly set. At least
362 one form of locking is required in all cases, but mbx locking changes the
363 meaning of fcntl and flock locking. */
365 /* Not all operating systems provide flock(). For those that do, if flock is
366 requested, the default for fcntl is FALSE. */
371 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
372 "flock() support was not available in the operating system when this "
373 "binary was built", tblock->name);
374 #endif /* NO_FLOCK */
375 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
380 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
381 !ob->set_use_mbx_lock)
383 ob->use_lockfile = ob->use_flock = FALSE;
384 ob->use_mbx_lock = ob->use_fcntl = TRUE;
386 else if (ob->use_mbx_lock)
388 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
389 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
390 if (!ob->set_use_flock) ob->use_flock = FALSE;
391 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
393 #endif /* SUPPORT_MBX */
395 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
396 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
397 "no locking configured", tblock->name);
399 /* Unset timeouts for non-used locking types */
401 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
402 if (!ob->use_flock) ob->lock_flock_timeout = 0;
404 /* If a directory name was specified, only one of maildir or mailstore may be
405 specified, and if quota_filecount or quota_directory is given, quota must
410 if (ob->maildir_format && ob->mailstore_format)
411 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
412 "only one of maildir and mailstore may be specified", tblock->name);
413 if (ob->quota_filecount != NULL && ob->quota == NULL)
414 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
415 "quota must be set if quota_filecount is set", tblock->name);
416 if (ob->quota_directory != NULL && ob->quota == NULL)
417 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
418 "quota must be set if quota_directory is set", tblock->name);
421 /* If a fixed uid field is set, then a gid field must also be set. */
423 if (tblock->uid_set && !tblock->gid_set && !tblock->expand_gid)
424 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
425 "user set without group for the %s transport", tblock->name);
427 /* If "create_file" is set, check that a valid option is given, and set the
430 if ((s = ob->create_file_string ) && *s)
433 if (Ustrcmp(s, "anywhere") == 0) val = create_anywhere;
434 else if (*s == '/' || Ustrcmp(s, "belowhome") == 0) val = create_belowhome;
435 else if (Ustrcmp(s, "inhome") == 0) val = create_inhome;
437 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
438 "invalid value given for \"file_create\" for the %s transport: '%s'",
440 ob->create_file = val;
443 /* If quota_warn_threshold is set, set up default for warn_message. It may
444 not be used if the actual threshold for a given delivery ends up as zero,
445 of if it's given as a percentage and there's no quota setting. */
447 if (ob->quota_warn_threshold)
449 if (!tblock->warn_message) tblock->warn_message = US
450 "To: $local_part@$domain\n"
451 "Subject: Your mailbox\n\n"
452 "This message is automatically created by mail delivery software (Exim).\n\n"
453 "The size of your mailbox has exceeded a warning threshold that is\n"
454 "set by the system administrator.\n";
457 /* If batch SMTP is set, force the check and escape strings, and arrange that
458 headers are also escaped. */
462 ob->check_string = US".";
463 ob->escape_string = US"..";
464 ob->options |= topt_escape_headers;
467 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
468 insert default values for for the affixes and the check/escape strings. */
470 else if (!ob->dirname && !ob->maildir_format && !ob->mailstore_format)
472 if (!ob->message_prefix) ob->message_prefix =
473 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
474 if (!ob->message_suffix) ob->message_suffix = US"\n";
475 if (!ob->check_string) ob->check_string = US"From ";
476 if (!ob->escape_string) ob->escape_string = US">From ";
480 /* Set up the bitwise options for transport_write_message from the various
481 driver options. Only one of body_only and headers_only can be set. */
484 (tblock->body_only ? topt_no_headers : 0) |
485 (tblock->headers_only ? topt_no_body : 0) |
486 (tblock->return_path_add ? topt_add_return_path : 0) |
487 (tblock->delivery_date_add ? topt_add_delivery_date : 0) |
488 (tblock->envelope_to_add ? topt_add_envelope_to : 0) |
489 ((ob->use_crlf || ob->mbx_format) ? topt_use_crlf : 0);
494 /*************************************************
496 *************************************************/
498 /* The comsat daemon is the thing that provides asynchronous notification of
499 the arrival of local messages, if requested by the user by "biff y". It is a
500 BSD thing that uses a TCP/IP protocol for communication. A message consisting
501 of the text "user@offset" must be sent, where offset is the place in the
502 mailbox where new mail starts. There is no scope for telling it which file to
503 look at, which makes it a less than useful if mail is being delivered into a
504 non-standard place such as the user's home directory. In fact, it doesn't seem
505 to pay much attention to the offset.
509 offset offset in mailbox
515 notify_comsat(uschar *user, off_t offset)
521 DEBUG(D_transport) debug_printf("notify_comsat called\n");
523 s = string_sprintf("%.200s@" OFF_T_FMT "\n", user, offset);
525 if ((sp = getservbyname("biff", "udp")) == NULL)
527 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
531 host.name = US"localhost";
535 /* This code is all set up to look up "localhost" and use all its addresses
536 until one succeeds. However, it appears that at least on some systems, comsat
537 doesn't listen on the ::1 address. So for the moment, just force the address to
538 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
539 can be changed. (But actually, comsat is probably dying out anyway.) */
542 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
544 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
549 host.address = US"127.0.0.1";
552 for (host_item * h = &host; h; h = h->next)
555 int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
557 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
559 if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
561 /* Connect never fails for a UDP socket, so don't set a timeout. */
563 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, NULL);
564 rc = send(sock, s, Ustrlen(s) + 1, 0);
569 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
576 /*************************************************
577 * Check the format of a file *
578 *************************************************/
580 /* This function is called when file_format is set, to check that an existing
581 file has the right format. The format string contains text/transport pairs. The
582 string matching is literal. we just read big_buffer_size bytes, because this is
583 all about the first few bytes of a file.
587 tblock the transport block
588 addr the address block - for inserting error data
590 Returns: pointer to the required transport, or NULL
594 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
596 const uschar *format =
597 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
599 int len = read(cfd, data, sizeof(data));
603 DEBUG(D_transport) debug_printf("checking file format\n");
605 /* An empty file matches the current transport */
607 if (len == 0) return tblock;
609 /* Search the formats for a match */
611 /* not expanded so cannot be tainted */
612 while ((s = string_nextinlist(&format, &sep, big_buffer, big_buffer_size)))
614 int slen = Ustrlen(s);
615 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
616 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
620 for (transport_instance * tt = transports; tt; tt = tt->next)
621 if (Ustrcmp(tp, tt->name) == 0)
624 debug_printf("file format -> %s transport\n", tt->name);
627 addr->basic_errno = ERRNO_BADTRANSPORT;
628 addr->message = string_sprintf("%s transport (for %.*s format) not found",
634 /* Failed to find a match */
636 addr->basic_errno = ERRNO_FORMATUNKNOWN;
637 addr->message = US"mailbox file format unrecognized";
644 /*************************************************
645 * Check directory's files for quota *
646 *************************************************/
648 /* This function is called if quota is set for one of the delivery modes that
649 delivers into a specific directory. It scans the directory and stats all the
650 files in order to get a total size and count. This is an expensive thing to do,
651 but some people are prepared to bear the cost. Alternatively, if size_regex is
652 set, it is used as a regex to try to extract the size from the file name, a
653 strategy that some people use on maildir files on systems where the users have
656 The function is global, because it is also called from tf_maildir.c for maildir
657 folders (which should contain only regular files).
659 Note: Any problems can be written to debugging output, but cannot be written to
660 the log, because we are running as an unprivileged user here.
663 dirname the name of the directory
664 countptr where to add the file count (because this function recurses)
665 regex a compiled regex to get the size from a name
667 Returns: the sum of the sizes of the stattable files
668 zero if the directory cannot be opened
672 check_dir_size(const uschar * dirname, int *countptr, const pcre *regex)
676 int count = *countptr;
678 if (!(dir = exim_opendir(dirname))) return 0;
680 for (struct dirent *ent; ent = readdir(dir); )
682 uschar * path, * name = US ent->d_name;
685 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
689 /* If there's a regex, try to find the size using it */
694 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
697 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
698 if (endptr == name + ovector[3])
702 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
708 debug_printf("check_dir_size: regex did not match %s\n", name);
711 /* No regex or no match for the regex, or captured non-digits */
713 path = string_sprintf("%s/%s", dirname, name);
715 if (Ustat(path, &statbuf) < 0)
718 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, path,
722 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
723 sum += statbuf.st_size / statbuf.st_nlink;
724 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
725 sum += check_dir_size(path, &count, regex);
730 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
740 /*************************************************
741 * Apply a lock to a file descriptor *
742 *************************************************/
744 /* This function applies a lock to a file descriptor, using a blocking or
745 non-blocking lock, depending on the timeout value. It can apply either or
746 both of a fcntl() and a flock() lock. However, not all OS support flock();
747 for those that don't, the use_flock option cannot be set.
750 fd the file descriptor
751 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
752 fcntl() format); the flock() type is deduced if needed
753 dofcntl do fcntl() locking
754 fcntltime non-zero to use blocking fcntl()
755 doflock do flock() locking
756 flocktime non-zero to use blocking flock()
758 Returns: yield of the fcntl() or flock() call, with errno preserved;
759 sigalrm_seen set if there has been a timeout
763 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
768 struct flock lock_data;
769 lock_data.l_type = fcntltype;
770 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
772 sigalrm_seen = FALSE;
779 yield = fcntl(fd, F_SETLKW, &lock_data);
784 else yield = fcntl(fd, F_SETLK, &lock_data);
788 if (doflock && (yield >= 0))
790 int flocktype = (fcntltype == F_WRLCK) ? LOCK_EX : LOCK_SH;
794 yield = flock(fd, flocktype);
799 else yield = flock(fd, flocktype | LOCK_NB);
801 #endif /* NO_FLOCK */
810 /*************************************************
811 * Copy message into MBX mailbox *
812 *************************************************/
814 /* This function is called when a message intended for a MBX mailbox has been
815 written to a temporary file. We can now get the size of the message and then
816 copy it in MBX format to the mailbox.
819 to_fd fd to write to (the real mailbox)
820 from_fd fd to read from (the temporary file)
821 saved_size current size of mailbox
823 Returns: OK if all went well, DEFER otherwise, with errno preserved
824 the number of bytes written are added to transport_count
825 by virtue of calling transport_write_block()
828 /* Values taken from c-client */
830 #define MBX_HDRSIZE 2048
831 #define MBX_NUSERFLAGS 30
834 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
839 transport_ctx tctx = { .u={.fd = to_fd}, .options = topt_not_socket };
841 /* If the current mailbox size is zero, write a header block */
846 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
847 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
848 (long int)time(NULL));
849 for (int i = 0; i < MBX_NUSERFLAGS; i++)
850 sprintf (CS(s += Ustrlen(s)), "\015\012");
851 if (!transport_write_block (&tctx, deliver_out_buffer, MBX_HDRSIZE, FALSE))
855 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
857 /* Now construct the message's header from the time and the RFC822 file
858 size, including CRLFs, which is the size of the input (temporary) file. */
860 if (fstat(from_fd, &statbuf) < 0) return DEFER;
861 size = statbuf.st_size;
863 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
864 tod_stamp(tod_mbx), size, 0L, 0, 0);
865 used = Ustrlen(deliver_out_buffer);
867 /* Rewind the temporary file, and copy it over in chunks. */
869 if (lseek(from_fd, 0 , SEEK_SET) < 0) return DEFER;
873 int len = read(from_fd, deliver_out_buffer + used,
874 DELIVER_OUT_BUFFER_SIZE - used);
877 if (len == 0) errno = ERRNO_MBXLENGTH;
880 if (!transport_write_block(&tctx, deliver_out_buffer, used + len, FALSE))
888 #endif /* SUPPORT_MBX */
892 /*************************************************
893 * Check creation is permitted *
894 *************************************************/
896 /* This function checks whether a given file name is permitted to be created,
897 as controlled by the create_file option. If no home directory is set, however,
898 we can't do any tests.
901 filename the file name
902 create_file the ob->create_file option
903 deliver_dir the delivery directory
905 Returns: TRUE if creation is permitted
909 check_creation(uschar *filename, int create_file, const uschar * deliver_dir)
913 if (deliver_dir && create_file != create_anywhere)
915 int len = Ustrlen(deliver_dir);
916 uschar *file = filename;
918 while (file[0] == '/' && file[1] == '/') file++;
919 if ( Ustrncmp(file, deliver_dir, len) != 0
921 || Ustrchr(file+len+2, '/') != NULL
922 && ( create_file != create_belowhome
923 || Ustrstr(file+len, "/../") != NULL
927 /* If yield is TRUE, the file name starts with the home directory, and does
928 not contain any instances of "/../" in the "belowhome" case. However, it may
929 still contain symbolic links. We can check for this by making use of
930 realpath(), which most Unixes seem to have (but make it possible to cut this
931 out). We can't just use realpath() on the whole file name, because we know
932 the file itself doesn't exist, and intermediate directories may also not
933 exist. What we want to know is the real path of the longest existing part of
934 the path. That must match the home directory's beginning, whichever is the
938 if (yield && create_file == create_belowhome)
942 for (uschar * slash = Ustrrchr(file, '/'); /* There is known to be one */
943 !rp && slash > file; /* Stop if reached beginning */
947 rp = US realpath(CS file, CS big_buffer);
948 next = Ustrrchr(file, '/');
952 /* If rp == NULL it means that none of the relevant directories exist.
953 This is not a problem here - it means that no symbolic links can exist,
954 which is all we are worried about. Otherwise, we must compare it
955 against the start of the home directory. However, that may itself
956 contain symbolic links, so we have to "realpath" it as well, if
961 uschar hdbuffer[PATH_MAX+1];
962 const uschar * rph = deliver_dir;
963 int rlen = Ustrlen(big_buffer);
965 if ((rp = US realpath(CS deliver_dir, CS hdbuffer)))
971 if (rlen > len) rlen = len;
972 if (Ustrncmp(rph, big_buffer, rlen) != 0)
975 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
976 big_buffer, deliver_dir);
980 #endif /* NO_REALPATH */
988 /*************************************************
990 *************************************************/
992 /* See local README for general interface details. This transport always
993 returns FALSE, indicating that the status which has been placed in the first
994 address should be copied to any other addresses in a batch.
996 Appendfile delivery is tricky and has led to various security problems in other
997 mailers. The logic used here is therefore laid out in some detail. When this
998 function is called, we are running in a subprocess which has had its gid and
999 uid set to the appropriate values. Therefore, we cannot write directly to the
1000 exim logs. Any errors must be handled by setting appropriate return codes.
1001 Note that the default setting for addr->transport_return is DEFER, so it need
1002 not be set unless some other value is required.
1004 The code below calls geteuid() rather than getuid() to get the current uid
1005 because in weird configurations not running setuid root there may be a
1006 difference. In the standard configuration, where setuid() has been used in the
1007 delivery process, there will be no difference between the uid and the euid.
1009 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1010 alias expansion. Otherwise, there must be a configured file name or
1013 The following items apply in the case when a file name (as opposed to a
1014 directory name) is given, that is, when appending to a single file:
1016 (2f) Expand the file name.
1018 (3f) If the file name is /dev/null, return success (optimization).
1020 (4f) If the file_format options is set, open the file for reading, and check
1021 that the bytes at the start of the file match one of the given strings.
1022 If the check indicates a transport other than the current one should be
1023 used, pass control to that other transport. Otherwise continue. An empty
1024 or non-existent file matches the current transport. The file is closed
1027 (5f) If a lock file is required, create it (see extensive separate comments
1028 below about the algorithm for doing this). It is important to do this
1029 before opening the mailbox if NFS is in use.
1031 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1032 details of any symbolic link.
1034 (7f) If the file already exists:
1036 Check the owner and group if necessary, and defer if they are wrong.
1038 If it is a symbolic link AND the allow_symlink option is set (NOT the
1039 default), go back to (6f) but this time use stat() instead of lstat().
1041 If it's not a regular file (or FIFO when permitted), defer delivery.
1043 Check permissions. If the required permissions are *less* than the
1044 existing ones, or supplied by the address (often by the user via filter),
1045 chmod() the file. Otherwise, defer.
1047 Save the inode number.
1049 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1051 If open fails because the file does not exist, go to (6f); on any other
1054 Check the inode number hasn't changed - I realize this isn't perfect (an
1055 inode can be reused) but it's cheap and will catch some of the races.
1057 Check it's still a regular file (or FIFO if permitted).
1059 Check that the owner and permissions haven't changed.
1061 If file_format is set, check that the file still matches the format for
1062 the current transport. If not, defer delivery.
1064 (8f) If file does not exist initially:
1066 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1067 this is via a symbolic link (only possible if allow_symlinks is set), in
1068 which case don't use O_EXCL, as it doesn't work.
1070 If open fails because the file already exists, go to (6f). To avoid
1071 looping for ever in a situation where the file is continuously being
1072 created and deleted, all of this happens inside a loop that operates
1073 lock_retries times and includes the fcntl and flock locking. If the
1074 loop completes without the file getting opened, defer and request
1075 freezing, because something really weird is happening.
1077 If open fails for any other reason, defer for subsequent delivery except
1078 when this is a file delivery resulting from an alias or forward expansion
1079 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1080 most likely a user rather than a configuration error.
1082 (9f) We now have the file checked and open for writing. If so configured, lock
1083 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1084 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1085 still fails, give up and defer delivery.
1087 (10f)Save the access time (for subsequent restoration) and the size of the
1088 file, for comsat and for re-setting if delivery fails in the middle -
1089 e.g. for quota exceeded.
1091 The following items apply in the case when a directory name is given:
1093 (2d) Create a new file in the directory using a temporary name, by opening for
1094 writing and with O_CREAT. If maildir format is being used, the file
1095 is created in a temporary subdirectory with a prescribed name. If
1096 mailstore format is being used, the envelope file is first created with a
1097 temporary name, then the data file.
1099 The following items apply in all cases:
1101 (11) We now have the file open for writing, and locked if it was given as a
1102 file name. Write the message and flush the file, unless there is a setting
1103 of the local quota option, in which case we can check for its excession
1104 without doing any writing.
1106 In the case of MBX format mailboxes, the message is first written to a
1107 temporary file, in order to get its correct length. This is then copied to
1108 the real file, preceded by an MBX header.
1110 If there is a quota error on writing, defer the address. Timeout logic
1111 will determine for how long retries are attempted. We restore the mailbox
1112 to its original length if it's a single file. There doesn't seem to be a
1113 uniform error code for quota excession (it even differs between SunOS4
1114 and some versions of SunOS5) so a system-dependent macro called
1115 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1118 For any other error (most commonly disk full), do the same.
1120 The following applies after appending to a file:
1122 (12f)Restore the atime; notify_comsat if required; close the file (which
1123 unlocks it if it was locked). Delete the lock file if it exists.
1125 The following applies after writing a unique file in a directory:
1127 (12d)For maildir format, rename the file into the new directory. For mailstore
1128 format, rename the envelope file to its correct name. Otherwise, generate
1129 a unique name from the directory_file option, and rename to that, possibly
1130 trying a few times if the file exists and re-expanding the name gives a
1133 This transport yields FAIL only when a file name is generated by an alias or
1134 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1135 All other failures return DEFER (in addr->transport_return). */
1139 appendfile_transport_entry(
1140 transport_instance *tblock, /* data for this instantiation */
1141 address_item *addr) /* address we are working on */
1143 appendfile_transport_options_block *ob =
1144 (appendfile_transport_options_block *)(tblock->options_block);
1145 struct stat statbuf;
1146 const uschar * deliver_dir;
1147 uschar *fdname = NULL;
1148 uschar *filename = NULL;
1149 uschar *hitchname = NULL;
1150 uschar *dataname = NULL;
1151 uschar *lockname = NULL;
1152 uschar *newname = NULL;
1153 uschar *nametag = NULL;
1155 uschar *filecount_msg = US"";
1157 struct utimbuf times;
1158 struct timeval msg_tv;
1159 BOOL disable_quota = FALSE;
1160 BOOL isdirectory = FALSE;
1161 BOOL isfifo = FALSE;
1162 BOOL wait_for_tick = FALSE;
1163 uid_t uid = geteuid(); /* See note above */
1164 gid_t gid = getegid();
1166 int mode = (addr->mode > 0) ? addr->mode : ob->mode;
1167 off_t saved_size = -1;
1168 off_t mailbox_size = ob->mailbox_size_value;
1169 int mailbox_filecount = ob->mailbox_filecount_value;
1177 int mbx_lockfd = -1;
1178 uschar mbx_lockname[40];
1179 FILE *temp_file = NULL;
1180 #endif /* SUPPORT_MBX */
1182 #ifdef SUPPORT_MAILDIR
1183 int maildirsize_fd = -1; /* fd for maildirsize file */
1184 int maildir_save_errno;
1188 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1190 /* An "address_file" or "address_directory" transport is used to deliver to
1191 files specified via .forward or an alias file. Prior to release 4.20, the
1192 "file" and "directory" options were ignored in this case. This has been changed
1193 to allow the redirection data to specify what is in effect a folder, whose
1194 location is determined by the options on the transport.
1196 Compatibility with the case when neither option is set is retained by forcing a
1197 value for the file or directory name. A directory delivery is assumed if the
1198 last character of the path from the router is '/'.
1200 The file path is in the local part of the address, but not in the $local_part
1201 variable (that holds the parent local part). It is, however, in the
1202 $address_file variable. Below, we update the local part in the address if it
1203 changes by expansion, so that the final path ends up in the log. */
1205 if (testflag(addr, af_file) && !ob->filename && !ob->dirname)
1207 fdname = US"$address_file";
1208 if (address_file[Ustrlen(address_file)-1] == '/' ||
1209 ob->maildir_format ||
1210 ob->mailstore_format)
1214 /* Handle (a) an "address file" delivery where "file" or "directory" is
1215 explicitly set and (b) a non-address_file delivery, where one of "file" or
1216 "directory" must be set; initialization ensures that they are not both set. */
1220 if (!(fdname = ob->filename))
1222 fdname = ob->dirname;
1227 addr->message = string_sprintf("Mandatory file or directory option "
1228 "missing from %s transport", tblock->name);
1233 /* Maildir and mailstore require a directory */
1235 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1237 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1238 "to be specified for the %s transport",
1239 ob->maildir_format ? "dir" : "store", tblock->name);
1243 if (!(path = expand_string(fdname)))
1245 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1246 "name for %s transport) failed: %s", fdname, tblock->name,
1247 expand_string_message);
1253 addr->message = string_sprintf("appendfile: file or directory name "
1254 "\"%s\" is not absolute", path);
1255 addr->basic_errno = ERRNO_NOTABSOLUTE;
1259 /* For a file delivery, make sure the local part in the address(es) is updated
1260 to the true local part. */
1262 if (testflag(addr, af_file))
1263 for (address_item * addr2 = addr; addr2; addr2 = addr2->next)
1264 addr2->local_part = string_copy(path);
1266 /* The available mailbox formats depend on whether it is a directory or a file
1272 #ifdef SUPPORT_MAILDIR
1273 ob->maildir_format ? mbf_maildir :
1275 #ifdef SUPPORT_MAILSTORE
1276 ob->mailstore_format ? mbf_mailstore :
1284 ob->mbx_format ? mbf_mbx :
1291 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1293 " warning=" OFF_T_FMT "%s\n"
1294 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1295 "maildir_use_size_file=%s\n",
1296 mode, ob->notify_comsat, ob->quota_value,
1297 ob->quota_no_check ? " (no_check)" : "",
1298 ob->quota_filecount_no_check ? " (no_check_filecount)" : "",
1299 ob->quota_warn_threshold_value,
1300 ob->quota_warn_threshold_is_percent ? "%" : "",
1301 isdirectory ? "directory" : "file",
1302 path, mailbox_formats[mbformat],
1303 !ob->message_prefix ? US"null" : string_printing(ob->message_prefix),
1304 !ob->message_suffix ? US"null" : string_printing(ob->message_suffix),
1305 ob->maildir_use_size_file ? "yes" : "no");
1307 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1308 ob->use_lockfile ? "lockfile " : "",
1309 ob->use_mbx_lock ? "mbx locking (" : "",
1310 ob->use_fcntl ? "fcntl " : "",
1311 ob->use_flock ? "flock" : "",
1312 ob->use_mbx_lock ? ")" : "");
1315 /* If the -N option is set, can't do any more. */
1320 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1322 addr->transport_return = OK;
1326 /* If an absolute path was given for create_file the it overrides deliver_home
1327 (here) and de-taints the filename (below, after check_creation() */
1329 deliver_dir = *ob->create_file_string == '/'
1330 ? ob->create_file_string : deliver_home;
1332 /* Handle the case of a file name. If the file name is /dev/null, we can save
1333 ourselves some effort and just give a success return right away. */
1337 BOOL use_lstat = TRUE;
1338 BOOL file_opened = FALSE;
1339 BOOL allow_creation_here = TRUE;
1341 if (Ustrcmp(path, "/dev/null") == 0)
1343 addr->transport_return = OK;
1347 /* Set the name of the file to be opened, and the file to which the data
1348 is written, and find out if we are permitted to create a non-existent file.
1349 If the create_file option is an absolute path and the file was within it,
1350 de-taint. Chaeck for a tainted path. */
1352 if ( (allow_creation_here = check_creation(path, ob->create_file, deliver_dir))
1353 && ob->create_file == create_belowhome)
1354 if (is_tainted(path))
1356 DEBUG(D_transport) debug_printf("de-tainting path '%s'\n", path);
1357 path = string_copy_taint(path, FALSE);
1360 if (is_tainted(path)) goto tainted_ret_panic;
1361 dataname = filename = path;
1363 /* If ob->create_directory is set, attempt to create the directories in
1364 which this mailbox lives, but only if we are permitted to create the file
1365 itself. We know we are dealing with an absolute path, because this was
1368 if (ob->create_directory && allow_creation_here)
1370 uschar *p = Ustrrchr(path, '/');
1372 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1374 addr->basic_errno = errno;
1376 string_sprintf("failed to create directories for %s: %s", path,
1377 exim_errstr(errno));
1378 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1384 /* If file_format is set we must check that any existing file matches one of
1385 the configured formats by checking the bytes it starts with. A match then
1386 indicates a specific transport - if it is not this one, pass control to it.
1387 Otherwise carry on here. An empty or non-existent file matches the current
1388 transport. We don't need to distinguish between non-existence and other open
1389 failures because if an existing file fails to open here, it will also fail
1390 again later when O_RDWR is used. */
1392 if (ob->file_format)
1394 int cfd = Uopen(path, O_RDONLY, 0);
1397 transport_instance *tt = check_file_format(cfd, tblock, addr);
1400 /* If another transport is indicated, call it and return; if no transport
1401 was found, just return - the error data will have been set up.*/
1407 set_process_info("delivering %s to %s using %s", message_id,
1408 addr->local_part, tt->name);
1409 debug_print_string(tt->debug_string);
1410 addr->transport = tt;
1411 (tt->info->code)(tt, addr);
1418 /* The locking of mailbox files is worse than the naming of cats, which is
1419 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1420 three different names, so several different styles of locking are used.
1422 Research in other programs that lock mailboxes shows that there is no
1423 universally standard method. Having mailboxes NFS-mounted on the system that
1424 is delivering mail is not the best thing, but people do run like this,
1425 and so the code must do its best to cope.
1427 Three different locking mechanisms are supported. The initialization function
1428 checks that at least one is configured.
1432 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1433 will work over NFS. Only after that is done do we actually open the mailbox
1434 and apply locks to it (if configured).
1436 Originally, Exim got the file opened before doing anything about locking.
1437 However, a very occasional problem was observed on Solaris 2 when delivering
1438 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1439 gets remembered at open time. If another process on another host (that's
1440 important) has the file open and locked and writes to it and then releases
1441 the lock while the first process is waiting to get the lock, the first
1442 process may fail to write at the new end point of the file - despite the very
1443 definite statement about O_APPEND in the man page for write(). Experiments
1444 have reproduced this problem, but I do not know any way of forcing a host to
1445 update its attribute cache for an open NFS file. It would be nice if it did
1446 so when a lock was taken out, but this does not seem to happen. Anyway, to
1447 reduce the risk of this problem happening, we now create the lock file
1448 (if configured) *before* opening the mailbox. That will prevent two different
1449 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1450 however, but Pine at least seems to operate in the same way.
1452 Lockfiles should normally be used when NFS is involved, because of the above
1455 The logic for creating the lock file is:
1457 . The name of the lock file is <mailbox-name>.lock
1459 . First, create a "hitching post" name by adding the primary host name,
1460 current time and pid to the lock file name. This should be unique.
1462 . Create the hitching post file using WRONLY + CREAT + EXCL.
1464 . If that fails EACCES, we assume it means that the user is unable to create
1465 files in the mail spool directory. Some installations might operate in this
1466 manner, so there is a configuration option to allow this state not to be an
1467 error - we proceed to lock using fcntl only, after the file is open.
1469 . Otherwise, an error causes a deferment of the address.
1471 . Hard link the hitching post to the lock file name.
1473 . If the link succeeds, we have successfully created the lock file. Simply
1474 close and unlink the hitching post file.
1476 . If the link does not succeed, proceed as follows:
1478 o Fstat the hitching post file, and then close and unlink it.
1480 o Now examine the stat data. If the number of links to the file is exactly
1481 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1482 the return never made it back, so the link() function gave a failure
1485 . This method allows for the lock file to be created by some other process
1486 right up to the moment of the attempt to hard link it, and is also robust
1487 against NFS server crash-reboots, which would probably result in timeouts
1488 in the middle of link().
1490 . System crashes may cause lock files to get left lying around, and some means
1491 of flushing them is required. The approach of writing a pid (used by smail
1492 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1493 timeout, which seems a better approach. Since any program that writes to a
1494 mailbox using a lock file should complete its task very quickly, Pine
1495 removes lock files that are older than 5 minutes. We allow the value to be
1496 configurable on the transport.
1500 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1501 mailbox once it is open. This is done by default with a non-blocking lock.
1502 Failures to lock cause retries after a sleep, but only for a certain number
1503 of tries. A blocking lock is deliberately not used so that we don't hold the
1504 mailbox open. This minimizes the possibility of the NFS problem described
1505 under LOCK FILES above, if for some reason NFS deliveries are happening
1506 without lock files. However, the use of a non-blocking lock and sleep, though
1507 the safest approach, does not give the best performance on very busy systems.
1508 A blocking lock plus timeout does better. Therefore Exim has an option to
1509 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1510 enables the use of blocking fcntl() calls.
1514 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1515 same manner as for fcntl locking above. No-blocking/timeout is also set as
1516 above in lock_flock_timeout. Not all operating systems provide or support
1517 flock(). For those that don't (as determined by the definition of LOCK_SH in
1518 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1519 is implemented (not precisely) on top of fcntl(), which means there's no
1520 point in actually using it.
1524 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1525 then the rules used for locking in c-client are used. Exim takes out a shared
1526 lock on the mailbox file, and an exclusive lock on the file whose name is
1527 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1528 any other MBX client from getting an exclusive lock on it and expunging it.
1529 It also stops any other MBX client from unlinking the /tmp lock when it has
1532 The exclusive lock on the /tmp file prevents any other MBX client from
1533 updating the mailbox in any way. When writing is finished, if an exclusive
1534 lock on the mailbox can be obtained, indicating there are no current sharers,
1535 the /tmp file is unlinked.
1537 MBX locking can use either fcntl() or flock() locking. If neither
1538 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1539 The calls for getting these locks are by default non-blocking, as for non-mbx
1540 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1541 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1542 probably makes sense to set timeouts for any MBX deliveries. */
1545 /* Build a lock file if configured to do so - the existence of a lock
1546 file is subsequently checked by looking for a non-negative value of the
1547 file descriptor hd - even though the file is no longer open. */
1549 if (ob->use_lockfile)
1551 /* cf. exim_lock.c */
1552 lockname = string_sprintf("%s.lock", filename);
1553 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1554 (unsigned int)(time(NULL)), (unsigned int)getpid());
1556 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1559 /* Lock file creation retry loop */
1561 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1565 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1568 addr->basic_errno = errno;
1570 string_sprintf("creating lock file hitching post %s "
1571 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1572 (long int)getegid());
1576 /* Attempt to hitch the hitching post to the lock file. If link()
1577 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1578 file, and get rid of the hitching post. If the number of links was 2,
1579 the link was created, despite the failure of link(). If the hitch was
1580 not successful, try again, having unlinked the lock file if it is too
1583 There's a version of Linux (2.0.27) which doesn't update its local cache
1584 of the inode after link() by default - which many think is a bug - but
1585 if the link succeeds, this code will be OK. It just won't work in the
1586 case when link() fails after having actually created the link. The Linux
1587 NFS person is fixing this; a temporary patch is available if anyone is
1588 sufficiently worried. */
1590 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1593 if (rc != 0 && statbuf.st_nlink != 2)
1595 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1596 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1598 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1601 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1605 DEBUG(D_transport) debug_printf("lock file created\n");
1609 /* Check for too many tries at creating the lock file */
1611 if (i >= ob->lock_retries)
1613 addr->basic_errno = ERRNO_LOCKFAILED;
1614 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1621 /* We now have to get the file open. First, stat() it and act on existence or
1622 non-existence. This is in a loop to handle the case of a file's being created
1623 or deleted as we watch, and also to handle retries when the locking fails.
1624 Rather than holding the file open while waiting for the fcntl() and/or
1625 flock() lock, we close and do the whole thing again. This should be safer,
1626 especially for NFS files, which might get altered from other hosts, making
1627 their cached sizes incorrect.
1629 With the default settings, no symlinks are permitted, but there is an option
1630 to permit symlinks for those sysadmins that know what they are doing.
1631 Shudder. However, insist that the initial symlink is owned by the right user.
1632 Thus lstat() is used initially; if a symlink is discovered, the loop is
1633 repeated such that stat() is used, to look at the end file. */
1635 for (i = 0; i < ob->lock_retries; i++)
1637 int sleep_before_retry = TRUE;
1638 file_opened = FALSE;
1640 if ((use_lstat ? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1642 /* Let's hope that failure to stat (other than non-existence) is a
1645 if (errno != ENOENT)
1647 addr->basic_errno = errno;
1648 addr->message = string_sprintf("attempting to stat mailbox %s",
1653 /* File does not exist. If it is required to pre-exist this state is an
1656 if (ob->file_must_exist)
1658 addr->basic_errno = errno;
1659 addr->message = string_sprintf("mailbox %s does not exist, "
1660 "but file_must_exist is set", filename);
1664 /* If not permitted to create this file because it isn't in or below
1665 the home directory, generate an error. */
1667 if (!allow_creation_here)
1669 addr->basic_errno = ERRNO_BADCREATE;
1670 addr->message = string_sprintf("mailbox %s does not exist, "
1671 "but creation outside the home directory is not permitted",
1676 /* Attempt to create and open the file. If open fails because of
1677 pre-existence, go round the loop again. For any other error, defer the
1678 address, except for an alias or forward generated file name with EPERM,
1679 ENOENT, or EACCES, as those are most likely to be user errors rather
1680 than Exim config errors. When a symbolic link is permitted and points
1681 to a non-existent file, we get here with use_lstat = FALSE. In this case
1682 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1683 consistency and because MBX locking requires it in order to be able to
1684 get a shared lock. */
1686 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1687 (use_lstat ? O_EXCL : 0), mode);
1690 if (errno == EEXIST) continue;
1691 addr->basic_errno = errno;
1692 addr->message = string_sprintf("while creating mailbox %s",
1694 if (testflag(addr, af_file) &&
1695 (errno == EPERM || errno == ENOENT || errno == EACCES))
1696 addr->transport_return = FAIL;
1700 /* We have successfully created and opened the file. Ensure that the group
1701 and the mode are correct. */
1703 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
1705 addr->basic_errno = errno;
1706 addr->message = string_sprintf("while setting perms on mailbox %s",
1708 addr->transport_return = FAIL;
1714 /* The file already exists. Test its type, ownership, and permissions, and
1715 save the inode for checking later. If symlinks are permitted (not the
1716 default or recommended state) it may be a symlink that already exists.
1717 Check its ownership and then look for the file at the end of the link(s).
1718 This at least prevents one user creating a symlink for another user in
1719 a sticky directory. */
1723 int oldmode = (int)statbuf.st_mode;
1724 ino_t inode = statbuf.st_ino;
1725 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1727 isfifo = FALSE; /* In case things are changing */
1729 /* Check owner if required - the default. */
1731 if (ob->check_owner && statbuf.st_uid != uid)
1733 addr->basic_errno = ERRNO_BADUGID;
1734 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1735 "(%ld != %ld)", filename,
1736 islink ? " (symlink)" : "",
1737 (long int)(statbuf.st_uid), (long int)uid);
1741 /* Group is checked only if check_group is set. */
1743 if (ob->check_group && statbuf.st_gid != gid)
1745 addr->basic_errno = ERRNO_BADUGID;
1746 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1747 filename, islink ? " (symlink)" : "", statbuf.st_gid, gid);
1751 /* Just in case this is a sticky-bit mail directory, we don't want
1752 users to be able to create hard links to other users' files. */
1754 if (statbuf.st_nlink != 1)
1756 addr->basic_errno = ERRNO_NOTREGULAR;
1757 addr->message = string_sprintf("mailbox %s%s has too many links (%lu)",
1758 filename, islink ? " (symlink)" : "", (unsigned long)statbuf.st_nlink);
1763 /* If symlinks are permitted (not recommended), the lstat() above will
1764 have found the symlink. Its ownership has just been checked; go round
1765 the loop again, using stat() instead of lstat(). That will never yield a
1768 if (islink && ob->allow_symlink)
1771 i--; /* Don't count this time round */
1775 /* An actual file exists. Check that it is a regular file, or FIFO
1778 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1780 else if ((oldmode & S_IFMT) != S_IFREG)
1782 addr->basic_errno = ERRNO_NOTREGULAR;
1783 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1784 filename, ob->allow_fifo ? " or named pipe" : "");
1788 /* If the mode is not what it would be for a newly created file, change
1789 the permissions if the mode is supplied for the address. Otherwise,
1790 reduce but do not extend the permissions. If the newly created
1791 permissions are greater than the existing permissions, don't change
1792 things when the mode is not from the address. */
1794 if ((oldmode &= 07777) != mode)
1796 int diffs = oldmode ^ mode;
1797 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1799 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1800 if (Uchmod(filename, mode) < 0)
1802 addr->basic_errno = errno;
1803 addr->message = string_sprintf("attempting to chmod mailbox %s",
1810 /* Mode not from address, and newly-created permissions are greater
1811 than existing permissions. Default is to complain, but it can be
1812 configured to go ahead and try to deliver anyway if that's what
1813 the administration wants. */
1815 else if (ob->mode_fail_narrower)
1817 addr->basic_errno = ERRNO_BADMODE;
1818 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1819 "(%o expected)", filename, oldmode, mode);
1824 /* We are happy with the existing file. Open it, and then do further
1825 tests to ensure that it is the same file that we were just looking at.
1826 If the file does not now exist, restart this loop, going back to using
1827 lstat again. For an NFS error, just defer; other opening errors are
1828 more serious. The file is opened RDWR so that its format can be checked,
1829 and also MBX locking requires the use of a shared (read) lock. However,
1830 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1831 reading the pipe. */
1833 fd = Uopen(filename, isfifo ? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1837 if (errno == ENOENT)
1842 addr->basic_errno = errno;
1844 addr->message = string_sprintf("while opening named pipe %s "
1845 "(could mean no process is reading it)", filename);
1846 else if (errno != EWOULDBLOCK)
1847 addr->message = string_sprintf("while opening mailbox %s", filename);
1851 /* This fstat really shouldn't fail, as we have an open file! There's a
1852 dilemma here. We use fstat in order to be sure we are peering at the file
1853 we have got open. However, that won't tell us if the file was reached
1854 via a symbolic link. We checked this above, but there is a race exposure
1855 if the link was created between the previous lstat and the open. However,
1856 it would have to be created with the same inode in order to pass the
1857 check below. If ob->allow_symlink is set, causing the use of stat rather
1858 than lstat above, symbolic links may be there anyway, and the checking is
1861 if (fstat(fd, &statbuf) < 0)
1863 addr->basic_errno = errno;
1864 addr->message = string_sprintf("attempting to stat open mailbox %s",
1869 /* Check the inode; this is isn't a perfect check, but gives some
1872 if (inode != statbuf.st_ino)
1874 addr->basic_errno = ERRNO_INODECHANGED;
1875 addr->message = string_sprintf("opened mailbox %s inode number changed "
1876 "from " INO_T_FMT " to " INO_T_FMT, filename, inode, statbuf.st_ino);
1877 addr->special_action = SPECIAL_FREEZE;
1881 /* Check it's still a regular file or FIFO, and the uid, gid, and
1882 permissions have not changed. */
1884 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1885 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1887 addr->basic_errno = ERRNO_NOTREGULAR;
1889 string_sprintf("opened mailbox %s is no longer a %s", filename,
1890 isfifo ? "named pipe" : "regular file");
1891 addr->special_action = SPECIAL_FREEZE;
1895 if ((ob->check_owner && statbuf.st_uid != uid) ||
1896 (ob->check_group && statbuf.st_gid != gid))
1898 addr->basic_errno = ERRNO_BADUGID;
1900 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1901 addr->special_action = SPECIAL_FREEZE;
1905 if ((statbuf.st_mode & 07777) != oldmode)
1907 addr->basic_errno = ERRNO_BADMODE;
1908 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1909 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1910 addr->special_action = SPECIAL_FREEZE;
1914 /* If file_format is set, check that the format of the file has not
1915 changed. Error data is set by the testing function. */
1917 if (ob->file_format && check_file_format(fd, tblock, addr) != tblock)
1919 addr->message = US"open mailbox has changed format";
1923 /* The file is OK. Carry on to do the locking. */
1926 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1927 locking rules if configured to do so. If a lock file is also required, it
1928 was created above and hd was left >= 0. At least one form of locking is
1929 required by the initialization function. If locking fails here, close the
1930 file and go round the loop all over again, after waiting for a bit, unless
1931 blocking locking was used. */
1934 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1935 sleep_before_retry = FALSE;
1937 /* Simple fcntl() and/or flock() locking */
1939 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
1941 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1942 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
1945 /* MBX locking rules */
1948 else if (ob->use_mbx_lock)
1951 struct stat lstatbuf, statbuf2;
1952 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1953 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
1954 fstat(fd, &statbuf) >= 0)
1956 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
1957 (long)statbuf.st_ino);
1960 * 2010-05-29: SECURITY
1961 * Dan Rosenberg reported the presence of a race-condition in the
1962 * original code here. Beware that many systems still allow symlinks
1963 * to be followed in /tmp so an attacker can create a symlink pointing
1964 * elsewhere between a stat and an open, which we should avoid
1967 * It's unfortunate that we can't just use all the heavily debugged
1968 * locking from above.
1970 * Also: remember to mirror changes into exim_lock.c */
1972 /* first leave the old pre-check in place, it provides better
1973 * diagnostics for common cases */
1974 if (Ulstat(mbx_lockname, &statbuf) >= 0)
1976 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
1978 addr->basic_errno = ERRNO_LOCKFAILED;
1979 addr->message = string_sprintf("symbolic link on MBX lock file %s",
1983 if (statbuf.st_nlink > 1)
1985 addr->basic_errno = ERRNO_LOCKFAILED;
1986 addr->message = string_sprintf("hard link to MBX lock file %s",
1992 /* If we could just declare "we must be the ones who create this
1993 * file" then a hitching post in a subdir would work, since a
1994 * subdir directly in /tmp/ which we create wouldn't follow links
1995 * but this isn't our locking logic, so we can't safely change the
1996 * file existence rules. */
1998 /* On systems which support O_NOFOLLOW, it's the easiest and most
1999 * obviously correct security fix */
2000 mbx_tmp_oflags = O_RDWR | O_CREAT;
2002 mbx_tmp_oflags |= O_NOFOLLOW;
2004 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2007 addr->basic_errno = ERRNO_LOCKFAILED;
2008 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2009 mbx_lockname, strerror(errno));
2013 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2015 addr->basic_errno = ERRNO_LOCKFAILED;
2016 addr->message = string_sprintf("attempting to lstat open MBX "
2017 "lock file %s: %s", mbx_lockname, strerror(errno));
2020 if (fstat(mbx_lockfd, &statbuf2) < 0)
2022 addr->basic_errno = ERRNO_LOCKFAILED;
2023 addr->message = string_sprintf("attempting to stat fd of open MBX "
2024 "lock file %s: %s", mbx_lockname, strerror(errno));
2030 * statbuf: if exists, is file which existed prior to opening the
2031 * lockfile, might have been replaced since then
2032 * statbuf2: result of stat'ing the open fd, is what was actually
2034 * lstatbuf: result of lstat'ing the filename immediately after
2035 * the open but there's a race condition again between
2036 * those two steps: before open, symlink to foo, after
2037 * open but before lstat have one of:
2038 * * was no symlink, so is the opened file
2039 * (we created it, no messing possible after that point)
2041 * * symlink elsewhere
2042 * * hardlink elsewhere
2044 * Don't want to compare to device of /tmp because some modern systems
2045 * have regressed to having /tmp be the safe actual filesystem as
2046 * valuable data, so is mostly worthless, unless we assume that *only*
2047 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2048 * for further consideration.
2049 * No point in doing a readlink on the lockfile as that will always be
2050 * at a different point in time from when we open it, so tells us
2051 * nothing; attempts to clean up and delete after ourselves would risk
2052 * deleting a *third* filename.
2054 if ((statbuf2.st_nlink > 1) ||
2055 (lstatbuf.st_nlink > 1) ||
2056 (!S_ISREG(lstatbuf.st_mode)) ||
2057 (lstatbuf.st_dev != statbuf2.st_dev) ||
2058 (lstatbuf.st_ino != statbuf2.st_ino))
2060 addr->basic_errno = ERRNO_LOCKFAILED;
2061 addr->message = string_sprintf("RACE CONDITION detected: "
2062 "mismatch post-initial-checks between \"%s\" and opened "
2063 "fd lead us to abort!", mbx_lockname);
2067 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2069 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2070 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2072 struct stat ostatbuf;
2074 /* This tests for a specific race condition. Ensure that we still
2075 have the same file. */
2077 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2078 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2079 statbuf.st_dev == ostatbuf.st_dev &&
2080 statbuf.st_ino == ostatbuf.st_ino)
2082 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2083 "between creation and locking\n", mbx_lockname);
2086 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2088 (void)close(mbx_lockfd);
2093 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2094 filename, strerror(errno));
2097 #endif /* SUPPORT_MBX */
2099 else break; /* No on-file locking required; break the open/lock loop */
2102 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2106 use_lstat = TRUE; /* Reset to use lstat first */
2109 /* If a blocking call timed out, break the retry loop if the total time
2110 so far is not less than than retries * interval. Use the larger of the
2111 flock() and fcntl() timeouts. */
2114 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2115 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2116 ob->lock_retries * ob->lock_interval)
2117 i = ob->lock_retries;
2119 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2120 flock() that caused the problem. */
2122 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2125 /* Test for exceeding the maximum number of tries. Either the file remains
2126 locked, or, if we haven't got it open, something is terribly wrong... */
2128 if (i >= ob->lock_retries)
2132 addr->basic_errno = ERRNO_EXISTRACE;
2133 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2134 addr->special_action = SPECIAL_FREEZE;
2138 addr->basic_errno = ERRNO_LOCKFAILED;
2139 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2145 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2147 /* Save access time (for subsequent restoration), modification time (for
2148 restoration if updating fails), size of file (for comsat and for re-setting if
2149 delivery fails in the middle - e.g. for quota exceeded). */
2151 if (fstat(fd, &statbuf) < 0)
2153 addr->basic_errno = errno;
2154 addr->message = string_sprintf("while fstatting opened mailbox %s",
2159 times.actime = statbuf.st_atime;
2160 times.modtime = statbuf.st_mtime;
2161 saved_size = statbuf.st_size;
2162 if (mailbox_size < 0) mailbox_size = saved_size;
2163 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2166 /* Prepare for writing to a new file (as opposed to appending to an old one).
2167 There are several different formats, but there is preliminary stuff concerned
2168 with quotas that applies to all of them. Finding the current size by directory
2169 scanning is expensive; for maildirs some fudges have been invented:
2171 (1) A regex can be used to extract a file size from its name;
2172 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2178 uschar *check_path; /* Default quota check path */
2179 const pcre *regex = NULL; /* Regex for file size from file name */
2181 if (!check_creation(string_sprintf("%s/any", path),
2182 ob->create_file, deliver_dir))
2184 addr->basic_errno = ERRNO_BADCREATE;
2185 addr->message = string_sprintf("tried to create file in %s, but "
2186 "file creation outside the home directory is not permitted", path);
2190 /* If the create_file option is an absolute path and the file was within
2191 it, de-taint. Otherwise check for taint. */
2193 if (is_tainted(path))
2194 if (ob->create_file == create_belowhome)
2196 DEBUG(D_transport) debug_printf("de-tainting path '%s'\n", path);
2197 path = string_copy_taint(path, FALSE);
2200 goto tainted_ret_panic;
2204 #ifdef SUPPORT_MAILDIR
2205 /* For a maildir delivery, ensure that all the relevant directories exist,
2206 and a maildirfolder file if necessary. */
2208 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2209 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2211 #endif /* SUPPORT_MAILDIR */
2213 /* If we are going to do a quota check, of if maildir_use_size_file is set
2214 for a maildir delivery, compile the regular expression if there is one. We
2215 may also need to adjust the path that is used. We need to do this for
2216 maildir_use_size_file even if the quota is unset, because we still want to
2217 create the file. When maildir support is not compiled,
2218 ob->maildir_use_size_file is always FALSE. */
2220 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2222 const uschar *error;
2225 /* Compile the regex if there is one. */
2227 if (ob->quota_size_regex)
2229 if (!(regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2230 CCSS &error, &offset, NULL)))
2232 addr->message = string_sprintf("appendfile: regular expression "
2233 "error: %s at offset %d while compiling %s", error, offset,
2234 ob->quota_size_regex);
2237 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2238 ob->quota_size_regex);
2241 /* Use an explicitly configured directory if set */
2243 if (ob->quota_directory)
2245 if (!(check_path = expand_string(ob->quota_directory)))
2247 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2248 "name for %s transport) failed: %s", ob->quota_directory,
2249 tblock->name, expand_string_message);
2253 if (check_path[0] != '/')
2255 addr->message = string_sprintf("appendfile: quota_directory name "
2256 "\"%s\" is not absolute", check_path);
2257 addr->basic_errno = ERRNO_NOTABSOLUTE;
2262 #ifdef SUPPORT_MAILDIR
2263 /* Otherwise, if we are handling a maildir delivery, and the directory
2264 contains a file called maildirfolder, this is a maildir++ feature telling
2265 us that this is a sub-directory of the real inbox. We should therefore do
2266 the quota check on the parent directory. Beware of the special case when
2267 the directory name itself ends in a slash. */
2269 else if (mbformat == mbf_maildir)
2271 struct stat statbuf;
2272 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2274 uschar *new_check_path = string_copy(check_path);
2275 uschar *slash = Ustrrchr(new_check_path, '/');
2281 slash = Ustrrchr(new_check_path, '/');
2286 check_path = new_check_path;
2287 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2288 "quota check directory changed to %s\n", check_path);
2293 #endif /* SUPPORT_MAILDIR */
2296 /* If we are using maildirsize files, we need to ensure that such a file
2297 exists and, if necessary, recalculate its contents. As a byproduct of this,
2298 we obtain the current size of the maildir. If no quota is to be enforced
2299 (ob->quota_value == 0), we still need the size if a threshold check will
2302 Another regular expression is used to determine which directories inside the
2303 maildir are going to be counted. */
2305 #ifdef SUPPORT_MAILDIR
2306 if (ob->maildir_use_size_file)
2308 const pcre *dir_regex = NULL;
2309 const uschar *error;
2312 if (ob->maildir_dir_regex)
2314 int check_path_len = Ustrlen(check_path);
2316 if (!(dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2317 CCSS &error, &offset, NULL)))
2319 addr->message = string_sprintf("appendfile: regular expression "
2320 "error: %s at offset %d while compiling %s", error, offset,
2321 ob->maildir_dir_regex);
2326 debug_printf("using regex for maildir directory selection: %s\n",
2327 ob->maildir_dir_regex);
2329 /* Check to see if we are delivering into an ignored directory, that is,
2330 if the delivery path starts with the quota check path, and the rest
2331 of the deliver path matches the regex; if so, set a flag to disable quota
2332 checking and maildirsize updating. */
2334 if (Ustrncmp(path, check_path, check_path_len) == 0)
2336 uschar *s = path + check_path_len;
2337 while (*s == '/') s++;
2338 s = *s ? string_sprintf("%s/new", s) : US"new";
2339 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2341 disable_quota = TRUE;
2342 DEBUG(D_transport) debug_printf("delivery directory does not match "
2343 "maildir_quota_directory_regex: disabling quota\n");
2348 /* Quota enforcement; create and check the file. There is some discussion
2349 about whether this should happen if the quota is unset. At present, Exim
2350 always creates the file. If we ever want to change this, uncomment
2351 appropriate lines below, possibly doing a check on some option. */
2353 /* if (???? || ob->quota_value > 0) */
2360 if ((maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2361 &size, &filecount)) == -1)
2363 addr->basic_errno = errno;
2364 addr->message = string_sprintf("while opening or reading "
2365 "%s/maildirsize", check_path);
2368 /* can also return -2, which means that the file was removed because of
2369 raciness; but in this case, the size & filecount will still have been
2372 if (mailbox_size < 0) mailbox_size = size;
2373 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2376 /* No quota enforcement; ensure file does *not* exist; calculate size if
2381 * time_t old_latest;
2382 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2383 * if (THRESHOLD_CHECK)
2384 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2385 * regex, dir_regex, FALSE);
2390 #endif /* SUPPORT_MAILDIR */
2392 /* Otherwise if we are going to do a quota check later on, and the mailbox
2393 size is not set, find the current size of the mailbox. Ditto for the file
2394 count. Note that ob->quota_filecount_value cannot be set without
2395 ob->quota_value being set. */
2398 && (ob->quota_value > 0 || THRESHOLD_CHECK)
2399 && ( mailbox_size < 0
2400 || mailbox_filecount < 0 && ob->quota_filecount_value > 0
2406 debug_printf("quota checks on directory %s\n", check_path);
2407 size = check_dir_size(check_path, &filecount, regex);
2408 if (mailbox_size < 0) mailbox_size = size;
2409 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2412 /* Handle the case of creating a unique file in a given directory (not in
2413 maildir or mailstore format - this is how smail did it). A temporary name is
2414 used to create the file. Later, when it is written, the name is changed to a
2415 unique one. There is no need to lock the file. An attempt is made to create
2416 the directory if it does not exist. */
2418 if (mbformat == mbf_smail)
2421 debug_printf("delivering to new file in %s\n", path);
2422 filename = dataname =
2423 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2424 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2425 if (fd < 0 && /* failed to open, and */
2426 (errno != ENOENT || /* either not non-exist */
2427 !ob->create_directory || /* or not allowed to make */
2428 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2429 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2431 addr->basic_errno = errno;
2432 addr->message = string_sprintf("while creating file %s", filename);
2437 #ifdef SUPPORT_MAILDIR
2439 /* Handle the case of a unique file in maildir format. The file is written to
2440 the tmp subdirectory, with a prescribed form of name. */
2442 else if (mbformat == mbf_maildir)
2445 debug_printf("delivering in maildir format in %s\n", path);
2447 nametag = ob->maildir_tag;
2449 /* Check that nametag expands successfully; a hard failure causes a panic
2450 return. The actual expansion for use happens again later, when
2451 $message_size is accurately known. */
2453 if (nametag && !expand_string(nametag) && !f.expand_string_forcedfail)
2455 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2456 "for %s transport) failed: %s", nametag, tblock->name,
2457 expand_string_message);
2461 /* We ensured the existence of all the relevant directories above. Attempt
2462 to open the temporary file a limited number of times. I think this rather
2463 scary-looking for statement is actually OK. If open succeeds, the loop is
2464 broken; if not, there is a test on the value of i. Get the time again
2465 afresh each time round the loop. Its value goes into a variable that is
2466 checked at the end, to make sure we don't release this process until the
2467 clock has ticked. */
2469 for (int i = 1;; i++)
2473 (void)gettimeofday(&msg_tv, NULL);
2474 basename = string_sprintf(TIME_T_FMT ".M%luP" PID_T_FMT ".%s",
2475 msg_tv.tv_sec, msg_tv.tv_usec, getpid(), primary_hostname);
2477 filename = dataname = string_sprintf("tmp/%s", basename);
2478 newname = string_sprintf("new/%s", basename);
2480 if (Ustat(filename, &statbuf) == 0)
2482 else if (errno == ENOENT)
2484 if ((fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode)) >= 0)
2486 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2487 filename, strerror(errno));
2490 /* Too many retries - give up */
2492 if (i >= ob->maildir_retries)
2494 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2495 filename, i, (i == 1) ? "y" : "ies");
2496 addr->basic_errno = errno;
2497 if (errno == errno_quota || errno == ENOSPC)
2498 addr->user_message = US"mailbox is full";
2502 /* Open or stat failed but we haven't tried too many times yet. */
2507 /* Note that we have to ensure the clock has ticked before leaving */
2509 wait_for_tick = TRUE;
2511 /* Why are these here? Put in because they are present in the non-maildir
2512 directory case above. */
2514 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2516 addr->basic_errno = errno;
2517 addr->message = string_sprintf("while setting perms on maildir %s",
2523 #endif /* SUPPORT_MAILDIR */
2525 #ifdef SUPPORT_MAILSTORE
2527 /* Handle the case of a unique file in mailstore format. First write the
2528 envelope to a temporary file, then open the main file. The unique base name
2529 for the files consists of the message id plus the pid of this delivery
2535 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2536 string_base62((long int)getpid()));
2539 debug_printf("delivering in mailstore format in %s\n", path);
2541 filename = string_sprintf("%s.tmp", mailstore_basename);
2542 newname = string_sprintf("%s.env", mailstore_basename);
2543 dataname = string_sprintf("%s.msg", mailstore_basename);
2545 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2546 if ( fd < 0 /* failed to open, and */
2547 && ( errno != ENOENT /* either not non-exist */
2548 || !ob->create_directory /* or not allowed to make */
2549 || !directory_make(NULL, path, ob->dirmode, FALSE) /* or failed to create dir */
2550 || (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0 /* or then failed to open */
2553 addr->basic_errno = errno;
2554 addr->message = string_sprintf("while creating file %s", filename);
2558 /* Why are these here? Put in because they are present in the non-maildir
2559 directory case above. */
2561 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2563 addr->basic_errno = errno;
2564 addr->message = string_sprintf("while setting perms on file %s",
2569 /* Built a C stream from the open file descriptor. */
2571 if (!(env_file = fdopen(fd, "wb")))
2573 addr->basic_errno = errno;
2574 addr->message = string_sprintf("fdopen of %s ("
2575 "for %s transport) failed", filename, tblock->name);
2581 /* Write the envelope file, then close it. */
2583 if (ob->mailstore_prefix)
2585 uschar *s = expand_string(ob->mailstore_prefix);
2588 if (!f.expand_string_forcedfail)
2590 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2591 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2592 tblock->name, expand_string_message);
2593 (void)fclose(env_file);
2601 fprintf(env_file, "%s", CS s);
2602 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2606 fprintf(env_file, "%s\n", sender_address);
2608 for (address_item * taddr = addr; taddr; taddr = taddr->next)
2609 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2611 if (ob->mailstore_suffix)
2613 uschar *s = expand_string(ob->mailstore_suffix);
2616 if (!f.expand_string_forcedfail)
2618 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2619 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2620 tblock->name, expand_string_message);
2621 (void)fclose(env_file);
2629 fprintf(env_file, "%s", CS s);
2630 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2634 if (fclose(env_file) != 0)
2636 addr->basic_errno = errno;
2637 addr->message = string_sprintf("while closing %s", filename);
2642 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2644 /* Now open the data file, and ensure that it has the correct ownership and
2647 if ((fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)
2649 addr->basic_errno = errno;
2650 addr->message = string_sprintf("while creating file %s", dataname);
2654 if (exim_chown(dataname, uid, gid) || Uchmod(dataname, mode))
2656 addr->basic_errno = errno;
2657 addr->message = string_sprintf("while setting perms on file %s",
2663 #endif /* SUPPORT_MAILSTORE */
2666 /* In all cases of writing to a new file, ensure that the file which is
2667 going to be renamed has the correct ownership and mode. */
2669 if (exim_chown(filename, uid, gid) || Uchmod(filename, mode))
2671 addr->basic_errno = errno;
2672 addr->message = string_sprintf("while setting perms on file %s",
2679 /* At last we can write the message to the file, preceded by any configured
2680 prefix line, and followed by any configured suffix line. If there are any
2681 writing errors, we must defer. */
2683 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2688 /* If there is a local quota setting, check that we are not going to exceed it
2689 with this message if quota_is_inclusive is set; if it is not set, the check
2690 is for the mailbox already being over quota (i.e. the current message is not
2691 included in the check). */
2693 if (!disable_quota && ob->quota_value > 0)
2697 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2698 " this message = %d (%sincluded)\n",
2699 ob->quota_value, mailbox_size, message_size,
2700 ob->quota_is_inclusive ? "" : "not ");
2701 debug_printf(" file count quota = %d count = %d\n",
2702 ob->quota_filecount_value, mailbox_filecount);
2705 if (mailbox_size + (ob->quota_is_inclusive ? message_size:0) > ob->quota_value)
2706 if (!ob->quota_no_check)
2708 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2710 errno = ERRNO_EXIMQUOTA;
2713 DEBUG(D_transport) debug_printf("mailbox quota exceeded but ignored\n");
2715 if (ob->quota_filecount_value > 0
2716 && mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2717 ob->quota_filecount_value)
2718 if (!ob->quota_filecount_no_check)
2720 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2722 errno = ERRNO_EXIMQUOTA;
2723 filecount_msg = US" filecount";
2725 else DEBUG(D_transport) if (ob->quota_filecount_no_check)
2726 debug_printf("mailbox file count quota exceeded but ignored\n");
2732 addr->basic_errno = errno;
2733 addr->message = US"Over quota";
2734 addr->transport_return = yield;
2736 debug_printf("appendfile (verify) yields %d with errno=%d more_errno=%d\n",
2737 yield, addr->basic_errno, addr->more_errno);
2742 /* If we are writing in MBX format, what we actually do is to write the message
2743 to a temporary file, and then copy it to the real file once we know its size.
2744 This is the most straightforward way of getting the correct length in the
2745 separator line. So, what we do here is to save the real file descriptor, and
2746 replace it with one for a temporary file. The temporary file gets unlinked once
2747 opened, so that it goes away on closure. */
2750 if (yield == OK && ob->mbx_format)
2752 if (!(temp_file = tmpfile()))
2754 addr->basic_errno = errno;
2755 addr->message = US"while setting up temporary file";
2760 fd = fileno(temp_file);
2761 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2763 #endif /* SUPPORT_MBX */
2765 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2768 transport_count = 0;
2769 transport_newlines = 0;
2771 /* Write any configured prefix text first */
2773 if (yield == OK && ob->message_prefix && *ob->message_prefix)
2775 uschar *prefix = expand_string(ob->message_prefix);
2778 errno = ERRNO_EXPANDFAIL;
2779 addr->transport_return = PANIC;
2780 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2781 "transport) failed", ob->message_prefix, tblock->name);
2784 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2787 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2788 various different values for batching are handled outside; if there is more
2789 than one address available here, all must be included. If any address is a
2790 file, use its parent in the RCPT TO. */
2792 if (yield == OK && ob->use_bsmtp)
2794 transport_count = 0;
2795 transport_newlines = 0;
2796 if (ob->use_crlf) cr = US"\r";
2797 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2801 transport_newlines++;
2802 for (address_item * a = addr; a; a = a->next)
2804 address_item * b = testflag(a, af_pfr) ? a->parent : a;
2805 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2806 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2807 { yield = DEFER; break; }
2808 transport_newlines++;
2810 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2813 transport_newlines++;
2817 /* Now the message itself. The options for transport_write_message were set up
2818 at initialization time. */
2822 transport_ctx tctx = {
2826 .check_string = ob->check_string,
2827 .escape_string = ob->escape_string,
2828 .options = ob->options | topt_not_socket
2830 if (!transport_write_message(&tctx, 0))
2834 /* Now a configured suffix. */
2836 if (yield == OK && ob->message_suffix && *ob->message_suffix)
2838 uschar *suffix = expand_string(ob->message_suffix);
2841 errno = ERRNO_EXPANDFAIL;
2842 addr->transport_return = PANIC;
2843 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2844 "transport) failed", ob->message_suffix, tblock->name);
2847 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2850 /* If batch smtp, write the terminating dot. */
2852 if (yield == OK && ob->use_bsmtp)
2853 if (!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2854 else transport_newlines++;
2856 /* If MBX format is being used, all that writing was to the temporary file.
2857 However, if there was an earlier failure (Exim quota exceeded, for example),
2858 the temporary file won't have got opened - and no writing will have been done.
2859 If writing was OK, we restore the fd, and call a function that copies the
2860 message in MBX format into the real file. Otherwise use the temporary name in
2864 if (temp_file && ob->mbx_format)
2871 transport_count = 0; /* Reset transport count for actual write */
2872 /* No need to reset transport_newlines as we're just using a block copy
2873 * routine so the number won't be affected */
2874 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2876 else if (errno >= 0) dataname = US"temporary file";
2878 /* Preserve errno while closing the temporary file. */
2880 mbx_save_errno = errno;
2881 (void)fclose(temp_file);
2882 errno = mbx_save_errno;
2884 #endif /* SUPPORT_MBX */
2886 /* Force out the remaining data to check for any errors; some OS don't allow
2887 fsync() to be called for a FIFO. */
2889 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2891 /* Update message_size and message_linecount to the accurate count of bytes
2892 written, including added headers. Note; we subtract 1 from message_linecount as
2893 this variable doesn't count the new line between the header and the body of the
2896 message_size = transport_count;
2897 message_linecount = transport_newlines - 1;
2899 /* If using a maildir++ quota file, add this message's size to it, and
2900 close the file descriptor, except when the quota has been disabled because we
2901 are delivering into an uncounted folder. */
2903 #ifdef SUPPORT_MAILDIR
2906 if (yield == OK && maildirsize_fd >= 0)
2907 maildir_record_length(maildirsize_fd, message_size);
2908 maildir_save_errno = errno; /* Preserve errno while closing the file */
2909 if (maildirsize_fd >= 0)
2910 (void)close(maildirsize_fd);
2911 errno = maildir_save_errno;
2913 #endif /* SUPPORT_MAILDIR */
2915 /* If there is a quota warning threshold and we are have crossed it with this
2916 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2919 if (!disable_quota && THRESHOLD_CHECK)
2921 off_t threshold = ob->quota_warn_threshold_value;
2922 if (ob->quota_warn_threshold_is_percent)
2923 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
2925 debug_printf("quota = " OFF_T_FMT
2926 " threshold = " OFF_T_FMT
2927 " old size = " OFF_T_FMT
2928 " message size = %d\n",
2929 ob->quota_value, threshold, mailbox_size,
2931 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2932 addr->special_action = SPECIAL_WARN;
2934 /******* You might think that the test ought to be this:
2936 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2937 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2939 * (indeed, I was sent a patch with that in). However, it is possible to
2940 * have a warning threshold without actually imposing a quota, and I have
2941 * therefore kept Exim backwards compatible.
2946 /* Handle error while writing the file. Control should come here directly after
2947 the error, with the reason in errno. In the case of expansion failure in prefix
2948 or suffix, it will be ERRNO_EXPANDFAIL. */
2952 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2954 /* Save the error number. If positive, it will ultimately cause a strerror()
2955 call to generate some text. */
2957 addr->basic_errno = errno;
2959 /* For system or Exim quota excession, or disk full, set more_errno to the
2960 time since the file was last read. If delivery was into a directory, the
2961 time since last read logic is not relevant, in general. However, for maildir
2962 deliveries we can approximate it by looking at the last modified time of the
2963 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2964 "new" subdirectory implies that an MUA has moved a message from there to the
2967 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2969 addr->more_errno = 0;
2970 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2972 #ifdef SUPPORT_MAILDIR
2973 else if (mbformat == mbf_maildir)
2975 struct stat statbuf;
2976 if (Ustat("new", &statbuf) < 0)
2978 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2979 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2981 else /* Want a repeatable time when in test harness */
2982 addr->more_errno = f.running_in_test_harness ? 10 :
2983 (int)time(NULL) - statbuf.st_mtime;
2986 debug_printf("maildir: time since \"new\" directory modified = %s\n",
2987 readconf_printtime(addr->more_errno));
2989 #endif /* SUPPORT_MAILDIR */
2992 /* Handle system quota excession. Add an explanatory phrase for the error
2993 message, since some systems don't have special quota-excession errors,
2994 and on those that do, "quota" doesn't always mean anything to the user. */
2996 if (errno == errno_quota)
2999 addr->message = string_sprintf("mailbox is full "
3000 "(quota exceeded while writing to file %s)", filename);
3002 addr->message = US"mailbox is full";
3004 addr->user_message = US"mailbox is full";
3005 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3007 isdirectory ? US"" : US": time since file read = ",
3008 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3011 /* Handle Exim's own quota-imposition */
3013 else if (errno == ERRNO_EXIMQUOTA)
3015 addr->message = string_sprintf("mailbox is full "
3016 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3018 addr->user_message = US"mailbox is full";
3019 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3020 filecount_msg, dataname,
3021 isdirectory ? US"" : US": time since file read = ",
3022 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3025 /* Handle a process failure while writing via a filter; the return
3026 from child_close() is in more_errno. */
3028 else if (errno == ERRNO_FILTER_FAIL)
3031 addr->message = string_sprintf("transport filter process failed (%d) "
3032 "while writing to %s%s", addr->more_errno, dataname,
3033 (addr->more_errno == EX_EXECFAILED) ? ": unable to execute command" : "");
3036 /* Handle failure to expand header changes */
3038 else if (errno == ERRNO_CHHEADER_FAIL)
3042 string_sprintf("failed to expand headers_add or headers_remove while "
3043 "writing to %s: %s", dataname, expand_string_message);
3046 /* Handle failure to complete writing of a data block */
3048 else if (errno == ERRNO_WRITEINCOMPLETE)
3049 addr->message = string_sprintf("failed to write data block while "
3050 "writing to %s", dataname);
3052 /* Handle length mismatch on MBX copying */
3055 else if (errno == ERRNO_MBXLENGTH)
3056 addr->message = string_sprintf("length mismatch while copying MBX "
3057 "temporary file to %s", dataname);
3058 #endif /* SUPPORT_MBX */
3060 /* For other errors, a general-purpose explanation, if the message is
3063 else if (addr->message == NULL)
3064 addr->message = string_sprintf("error while writing to %s", dataname);
3066 /* For a file, reset the file size to what it was before we started, leaving
3067 the last modification time unchanged, so it will get reset also. All systems
3068 investigated so far have ftruncate(), whereas not all have the F_FREESP
3069 fcntl() call (BSDI & FreeBSD do not). */
3071 if (!isdirectory && ftruncate(fd, saved_size))
3072 DEBUG(D_transport) debug_printf("Error resetting file size\n");
3075 /* Handle successful writing - we want the modification time to be now for
3076 appended files. Remove the default backstop error number. For a directory, now
3077 is the time to rename the file with a unique name. As soon as such a name
3078 appears it may get used by another process, so we close the file first and
3079 check that all is well. */
3083 times.modtime = time(NULL);
3084 addr->basic_errno = 0;
3086 /* Handle the case of writing to a new file in a directory. This applies
3087 to all single-file formats - maildir, mailstore, and "smail format". */
3091 if (fstat(fd, &statbuf) < 0)
3093 addr->basic_errno = errno;
3094 addr->message = string_sprintf("while fstatting opened message file %s",
3099 else if (close(fd) < 0)
3101 addr->basic_errno = errno;
3102 addr->message = string_sprintf("close() error for %s",
3103 (ob->mailstore_format) ? dataname : filename);
3107 /* File is successfully written and closed. Arrange to rename it. For the
3108 different kinds of single-file delivery, some games can be played with the
3109 name. The message size is by this time set to the accurate value so that
3110 its value can be used in expansions. */
3114 uschar *renamename = newname;
3117 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3119 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3120 situation. The name is built by expanding the directory_file option, and
3121 we make the inode number available for use in this. The expansion was
3122 checked for syntactic validity above, before we wrote the file.
3124 We have to be careful here, in case the file name exists. (In the other
3125 cases, the names used are constructed to be unique.) The rename()
3126 function just replaces an existing file - we don't want that! So instead
3127 of calling rename(), we must use link() and unlink().
3129 In this case, if the link fails because of an existing file, we wait
3130 for one second and try the expansion again, to see if it produces a
3131 different value. Do this up to 5 times unless the name stops changing.
3132 This makes it possible to build values that are based on the time, and
3133 still cope with races from multiple simultaneous deliveries. */
3138 uschar *old_renameleaf = US"";
3140 for (int i = 0; ; sleep(1), i++)
3142 deliver_inode = statbuf.st_ino;
3143 renameleaf = expand_string(ob->dirfilename);
3148 addr->transport_return = PANIC;
3149 addr->message = string_sprintf("Expansion of \"%s\" "
3150 "(directory_file for %s transport) failed: %s",
3151 ob->dirfilename, tblock->name, expand_string_message);
3155 renamename = string_sprintf("%s/%s", path, renameleaf);
3156 if (Ulink(filename, renamename) < 0)
3158 DEBUG(D_transport) debug_printf("link failed: %s\n",
3160 if (errno != EEXIST || i >= 4 ||
3161 Ustrcmp(renameleaf, old_renameleaf) == 0)
3163 addr->basic_errno = errno;
3164 addr->message = string_sprintf("while renaming %s as %s",
3165 filename, renamename);
3169 old_renameleaf = renameleaf;
3170 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3179 } /* re-expand loop */
3180 } /* not mailstore or maildir */
3182 /* For maildir and mailstore formats, the new name was created earlier,
3183 except that for maildir, there is the possibility of adding a "tag" on
3184 the end of the name by expanding the value of nametag. This usually
3185 includes a reference to the message size. The expansion of nametag was
3186 checked above, before the file was opened. It either succeeded, or
3187 provoked a soft failure. So any failure here can be treated as soft.
3188 Ignore non-printing characters and / and put a colon at the start if the
3189 first character is alphanumeric. */
3195 uschar *iptr = expand_string(nametag);
3198 uschar *etag = store_get(Ustrlen(iptr) + 2, is_tainted(iptr));
3199 uschar *optr = etag;
3200 for ( ; *iptr; iptr++)
3201 if (mac_isgraph(*iptr) && *iptr != '/')
3203 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3207 renamename = string_sprintf("%s%s", newname, etag);
3211 /* Do the rename. If the name is too long and a tag exists, try again
3214 if (Urename(filename, renamename) < 0 &&
3215 (nametag == NULL || errno != ENAMETOOLONG ||
3216 (renamename = newname, Urename(filename, renamename) < 0)))
3218 addr->basic_errno = errno;
3219 addr->message = string_sprintf("while renaming %s as %s",
3220 filename, renamename);
3224 /* Rename succeeded */
3228 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3230 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3232 } /* maildir or mailstore */
3233 } /* successful write + close */
3235 } /* write success */
3238 /* For a file, restore the last access time (atime), and set the modification
3239 time as required - changed if write succeeded, unchanged if not. */
3241 if (!isdirectory) utime(CS filename, ×);
3243 /* Notify comsat if configured to do so. It only makes sense if the configured
3244 file is the one that the comsat daemon knows about. */
3246 if (ob->notify_comsat && yield == OK && deliver_localpart)
3247 notify_comsat(deliver_localpart, saved_size);
3249 /* Pass back the final return code in the address structure */
3252 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3253 yield, addr->basic_errno, addr->more_errno);
3255 addr->transport_return = yield;
3257 /* Close the file, which will release the fcntl lock. For a directory write it
3258 is closed above, except in cases of error which goto RETURN, when we also need
3259 to remove the original file(s). For MBX locking, if all has gone well, before
3260 closing the file, see if we can get an exclusive lock on it, in which case we
3261 can unlink the /tmp lock file before closing it. This is always a non-blocking
3262 lock; there's no need to wait if we can't get it. If everything has gone right
3263 but close fails, defer the message. Then unlink the lock file, if present. This
3264 point in the code is jumped to from a number of places when errors are
3265 detected, in order to get the file closed and the lock file tidied away. */
3270 if (mbx_lockfd >= 0)
3272 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3273 ob->use_flock, 0) >= 0)
3276 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3277 Uunlink(mbx_lockname);
3279 (void)close(mbx_lockfd);
3281 #endif /* SUPPORT_MBX */
3283 if (fd >= 0 && close(fd) < 0 && yield == OK)
3285 addr->basic_errno = errno;
3286 addr->message = string_sprintf("while closing %s", filename);
3287 addr->transport_return = DEFER;
3290 if (hd >= 0) Uunlink(lockname);
3292 /* We get here with isdirectory and filename set only in error situations. */
3294 if (isdirectory && filename)
3297 if (dataname != filename) Uunlink(dataname);
3300 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3301 file name relies on time + pid. We must not allow the process to finish until
3302 the clock has move on by at least one microsecond. Usually we expect this
3303 already to be the case, but machines keep getting faster... */
3305 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3307 /* A return of FALSE means that if there was an error, a common error was
3308 put in the first address of a batch. */
3313 addr->message = string_sprintf("Tainted '%s' (file or directory "
3314 "name for %s transport) not permitted", path, tblock->name);
3316 addr->transport_return = PANIC;
3320 #endif /*!MACRO_PREDEF*/
3321 /* End of transport/appendfile.c */