1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2009 */
6 /* See the file NOTICE for conditions of use and distribution. */
10 #include "appendfile.h"
12 #ifdef SUPPORT_MAILDIR
13 #include "tf_maildir.h"
17 /* Encodings for mailbox formats, and their names. MBX format is actually
18 supported only if SUPPORT_MBX is set. */
20 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
22 static const char *mailbox_formats[] = {
23 "unix", "mbx", "smail", "maildir", "mailstore" };
26 /* Check warn threshold only if quota size set or not a percentage threshold
27 percentage check should only be done if quota > 0 */
29 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
30 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
33 /* Options specific to the appendfile transport. They must be in alphabetic
34 order (note that "_" comes before the lower case letters). Some of them are
35 stored in the publicly visible instance block - these are flagged with the
38 optionlist appendfile_transport_options[] = {
39 #ifdef SUPPORT_MAILDIR
40 { "*expand_maildir_use_size_file", opt_stringptr,
41 (void *)offsetof(appendfile_transport_options_block, expand_maildir_use_size_file) },
43 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
44 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
45 { "*set_use_flock_lock",opt_bool | opt_hidden,
46 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
47 { "*set_use_lockfile", opt_bool | opt_hidden,
48 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
50 { "*set_use_mbx_lock", opt_bool | opt_hidden,
51 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
53 { "allow_fifo", opt_bool,
54 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
55 { "allow_symlink", opt_bool,
56 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
57 { "batch_id", opt_stringptr | opt_public,
58 (void *)offsetof(transport_instance, batch_id) },
59 { "batch_max", opt_int | opt_public,
60 (void *)offsetof(transport_instance, batch_max) },
61 { "check_group", opt_bool,
62 (void *)offsetof(appendfile_transport_options_block, check_group) },
63 { "check_owner", opt_bool,
64 (void *)offsetof(appendfile_transport_options_block, check_owner) },
65 { "check_string", opt_stringptr,
66 (void *)offsetof(appendfile_transport_options_block, check_string) },
67 { "create_directory", opt_bool,
68 (void *)offsetof(appendfile_transport_options_block, create_directory) },
69 { "create_file", opt_stringptr,
70 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
71 { "directory", opt_stringptr,
72 (void *)offsetof(appendfile_transport_options_block, dirname) },
73 { "directory_file", opt_stringptr,
74 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
75 { "directory_mode", opt_octint,
76 (void *)offsetof(appendfile_transport_options_block, dirmode) },
77 { "escape_string", opt_stringptr,
78 (void *)offsetof(appendfile_transport_options_block, escape_string) },
79 { "file", opt_stringptr,
80 (void *)offsetof(appendfile_transport_options_block, filename) },
81 { "file_format", opt_stringptr,
82 (void *)offsetof(appendfile_transport_options_block, file_format) },
83 { "file_must_exist", opt_bool,
84 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
85 { "lock_fcntl_timeout", opt_time,
86 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
87 { "lock_flock_timeout", opt_time,
88 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
89 { "lock_interval", opt_time,
90 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
91 { "lock_retries", opt_int,
92 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
93 { "lockfile_mode", opt_octint,
94 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
95 { "lockfile_timeout", opt_time,
96 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
97 { "mailbox_filecount", opt_stringptr,
98 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
99 { "mailbox_size", opt_stringptr,
100 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
101 #ifdef SUPPORT_MAILDIR
102 { "maildir_format", opt_bool,
103 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
104 { "maildir_quota_directory_regex", opt_stringptr,
105 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
106 { "maildir_retries", opt_int,
107 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
108 { "maildir_tag", opt_stringptr,
109 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
110 { "maildir_use_size_file", opt_expand_bool,
111 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
112 { "maildirfolder_create_regex", opt_stringptr,
113 (void *)offsetof(appendfile_transport_options_block, maildirfolder_create_regex ) },
114 #endif /* SUPPORT_MAILDIR */
115 #ifdef SUPPORT_MAILSTORE
116 { "mailstore_format", opt_bool,
117 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
118 { "mailstore_prefix", opt_stringptr,
119 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
120 { "mailstore_suffix", opt_stringptr,
121 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
122 #endif /* SUPPORT_MAILSTORE */
124 { "mbx_format", opt_bool,
125 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
126 #endif /* SUPPORT_MBX */
127 { "message_prefix", opt_stringptr,
128 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
129 { "message_suffix", opt_stringptr,
130 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
131 { "mode", opt_octint,
132 (void *)offsetof(appendfile_transport_options_block, mode) },
133 { "mode_fail_narrower",opt_bool,
134 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
135 { "notify_comsat", opt_bool,
136 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
137 { "quota", opt_stringptr,
138 (void *)offsetof(appendfile_transport_options_block, quota) },
139 { "quota_directory", opt_stringptr,
140 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
141 { "quota_filecount", opt_stringptr,
142 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
143 { "quota_is_inclusive", opt_bool,
144 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
145 { "quota_size_regex", opt_stringptr,
146 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
147 { "quota_warn_message", opt_stringptr | opt_public,
148 (void *)offsetof(transport_instance, warn_message) },
149 { "quota_warn_threshold", opt_stringptr,
150 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
151 { "use_bsmtp", opt_bool,
152 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
153 { "use_crlf", opt_bool,
154 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
155 { "use_fcntl_lock", opt_bool_set,
156 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
157 { "use_flock_lock", opt_bool_set,
158 (void *)offsetof(appendfile_transport_options_block, use_flock) },
159 { "use_lockfile", opt_bool_set,
160 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
162 { "use_mbx_lock", opt_bool_set,
163 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
164 #endif /* SUPPORT_MBX */
167 /* Size of the options list. An extern variable has to be used so that its
168 address can appear in the tables drtables.c. */
170 int appendfile_transport_options_count =
171 sizeof(appendfile_transport_options)/sizeof(optionlist);
173 /* Default private options block for the appendfile transport. */
175 appendfile_transport_options_block appendfile_transport_option_defaults = {
178 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
179 NULL, /* message_prefix (default reset in init if not bsmtp) */
180 NULL, /* message_suffix (ditto) */
181 US"anywhere", /* create_file_string (string value for create_file) */
183 NULL, /* quota_directory */
184 NULL, /* quota_filecount */
185 NULL, /* quota_size_regex */
186 NULL, /* quota_warn_threshold */
187 NULL, /* mailbox_size_string */
188 NULL, /* mailbox_filecount_string */
189 NULL, /* expand_maildir_use_size_file */
190 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
191 NULL, /* maildir_tag */
192 NULL, /* maildirfolder_create_regex */
193 NULL, /* mailstore_prefix */
194 NULL, /* mailstore_suffix */
195 NULL, /* check_string (default changed for non-bsmtp file)*/
196 NULL, /* escape_string (ditto) */
197 NULL, /* file_format */
199 0, /* quota_warn_threshold_value */
200 -1, /* mailbox_size_value */
201 -1, /* mailbox_filecount_value */
202 0, /* quota_filecount_value */
203 APPENDFILE_MODE, /* mode */
204 APPENDFILE_DIRECTORY_MODE, /* dirmode */
205 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
206 30*60, /* lockfile_timeout */
207 0, /* lock_fcntl_timeout */
208 0, /* lock_flock_timeout */
209 10, /* lock_retries */
210 3, /* lock_interval */
211 10, /* maildir_retries */
212 create_anywhere,/* create_file */
214 FALSE, /* allow_fifo */
215 FALSE, /* allow_symlink */
216 FALSE, /* check_group */
217 TRUE, /* check_owner */
218 TRUE, /* create_directory */
219 FALSE, /* notify_comsat */
220 TRUE, /* use_lockfile */
221 FALSE, /* set_use_lockfile */
222 TRUE, /* use_fcntl */
223 FALSE, /* set_use_fcntl */
224 FALSE, /* use_flock */
225 FALSE, /* set_use_flock */
226 FALSE, /* use_mbx_lock */
227 FALSE, /* set_use_mbx_lock */
228 FALSE, /* use_bsmtp */
229 FALSE, /* use_crlf */
230 FALSE, /* file_must_exist */
231 TRUE, /* mode_fail_narrower */
232 FALSE, /* maildir_format */
233 FALSE, /* maildir_use_size_file */
234 FALSE, /* mailstore_format */
235 FALSE, /* mbx_format */
236 FALSE, /* quota_warn_threshold_is_percent */
237 TRUE /* quota_is_inclusive */
242 /*************************************************
243 * Setup entry point *
244 *************************************************/
246 /* Called for each delivery in the privileged state, just before the uid/gid
247 are changed and the main entry point is called. We use this function to
248 expand any quota settings, so that it can access files that may not be readable
249 by the user. It is also used to pick up external mailbox size information, if
253 tblock points to the transport instance
254 addrlist addresses about to be delivered (not used)
255 dummy not used (doesn't pass back data)
256 uid the uid that will be set (not used)
257 gid the gid that will be set (not used)
258 errmsg where to put an error message
260 Returns: OK, FAIL, or DEFER
264 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
265 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
267 appendfile_transport_options_block *ob =
268 (appendfile_transport_options_block *)(tblock->options_block);
269 uschar *q = ob->quota;
270 double default_value = 0.0;
273 addrlist = addrlist; /* Keep picky compilers happy */
278 if (ob->expand_maildir_use_size_file)
279 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
280 US"`maildir_use_size_file` in transport", tblock->name);
282 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
285 for (i = 0; i < 5; i++)
288 uschar *which = NULL;
290 if (q == NULL) d = default_value; else
293 uschar *s = expand_string(q);
297 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
298 "%s", q, tblock->name, expand_string_message);
299 return search_find_defer? DEFER : FAIL;
302 d = Ustrtod(s, &rest);
304 /* Handle following characters K, M, G, %, the latter being permitted
305 for quota_warn_threshold only. A threshold with no quota setting is
308 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
309 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
310 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
311 else if (*rest == '%' && i == 2)
313 if (ob->quota_value <= 0 && !ob->maildir_use_size_file) d = 0;
314 else if ((int)d < 0 || (int)d > 100)
316 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
317 " for %s transport", (int)d, tblock->name);
320 ob->quota_warn_threshold_is_percent = TRUE;
324 while (isspace(*rest)) rest++;
328 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
329 "in %s transport", s, q, tblock->name);
334 /* Set each value, checking for possible overflow. */
339 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4) which = US"quota";
340 ob->quota_value = (off_t)d;
341 q = ob->quota_filecount;
345 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"quota_filecount";
346 ob->quota_filecount_value = (int)d;
347 q = ob->quota_warn_threshold;
351 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
352 which = US"quota_warn_threshold";
353 ob->quota_warn_threshold_value = (off_t)d;
354 q = ob->mailbox_size_string;
355 default_value = -1.0;
359 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
360 which = US"mailbox_size";;
361 ob->mailbox_size_value = (off_t)d;
362 q = ob->mailbox_filecount_string;
366 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"mailbox_filecount";
367 ob->mailbox_filecount_value = (int)d;
373 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
374 "%s transport", which, d, tblock->name);
384 /*************************************************
385 * Initialization entry point *
386 *************************************************/
388 /* Called for each instance, after its options have been read, to
389 enable consistency checks to be done, or anything else that needs
393 appendfile_transport_init(transport_instance *tblock)
395 appendfile_transport_options_block *ob =
396 (appendfile_transport_options_block *)(tblock->options_block);
398 /* Set up the setup entry point, to be called in the privileged state */
400 tblock->setup = appendfile_transport_setup;
402 /* Lock_retries must be greater than zero */
404 if (ob->lock_retries == 0) ob->lock_retries = 1;
406 /* Only one of a file name or directory name must be given. */
408 if (ob->filename != NULL && ob->dirname != NULL)
409 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
410 "only one of \"file\" or \"directory\" can be specified", tblock->name);
412 /* If a file name was specified, neither quota_filecount nor quota_directory
415 if (ob->filename != NULL)
417 if (ob->quota_filecount != NULL)
418 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
419 "quota_filecount must not be set without \"directory\"", tblock->name);
420 if (ob->quota_directory != NULL)
421 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
422 "quota_directory must not be set without \"directory\"", tblock->name);
425 /* The default locking depends on whether MBX is set or not. Change the
426 built-in default if none of the lock options has been explicitly set. At least
427 one form of locking is required in all cases, but mbx locking changes the
428 meaning of fcntl and flock locking. */
430 /* Not all operating systems provide flock(). For those that do, if flock is
431 requested, the default for fcntl is FALSE. */
436 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
437 "flock() support was not available in the operating system when this "
438 "binary was built", tblock->name);
439 #endif /* NO_FLOCK */
440 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
446 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
447 !ob->set_use_mbx_lock)
449 ob->use_lockfile = ob->use_flock = FALSE;
450 ob->use_mbx_lock = ob->use_fcntl = TRUE;
452 else if (ob->use_mbx_lock)
454 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
455 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
456 if (!ob->set_use_flock) ob->use_flock = FALSE;
457 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
460 #endif /* SUPPORT_MBX */
462 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
463 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
464 "no locking configured", tblock->name);
466 /* Unset timeouts for non-used locking types */
468 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
469 if (!ob->use_flock) ob->lock_flock_timeout = 0;
471 /* If a directory name was specified, only one of maildir or mailstore may be
472 specified, and if quota_filecount or quota_directory is given, quota must
475 if (ob->dirname != NULL)
477 if (ob->maildir_format && ob->mailstore_format)
478 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
479 "only one of maildir and mailstore may be specified", tblock->name);
480 if (ob->quota_filecount != NULL && ob->quota == NULL)
481 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
482 "quota must be set if quota_filecount is set", tblock->name);
483 if (ob->quota_directory != NULL && ob->quota == NULL)
484 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
485 "quota must be set if quota_directory is set", tblock->name);
488 /* If a fixed uid field is set, then a gid field must also be set. */
490 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
491 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
492 "user set without group for the %s transport", tblock->name);
494 /* If "create_file" is set, check that a valid option is given, and set the
497 if (ob->create_file_string != NULL)
500 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
501 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
503 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
504 value = create_inhome;
506 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
507 "invalid value given for \"file_create\" for the %s transport: %s",
508 tblock->name, ob->create_file_string);
509 ob->create_file = value;
512 /* If quota_warn_threshold is set, set up default for warn_message. It may
513 not be used if the actual threshold for a given delivery ends up as zero,
514 of if it's given as a percentage and there's no quota setting. */
516 if (ob->quota_warn_threshold != NULL)
518 if (tblock->warn_message == NULL) tblock->warn_message = US
519 "To: $local_part@$domain\n"
520 "Subject: Your mailbox\n\n"
521 "This message is automatically created by mail delivery software (Exim).\n\n"
522 "The size of your mailbox has exceeded a warning threshold that is\n"
523 "set by the system administrator.\n";
526 /* If batch SMTP is set, force the check and escape strings, and arrange that
527 headers are also escaped. */
531 ob->check_string = US".";
532 ob->escape_string = US"..";
533 ob->options |= topt_escape_headers;
536 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
537 insert default values for for the affixes and the check/escape strings. */
539 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
541 if (ob->message_prefix == NULL) ob->message_prefix =
542 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
543 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
544 if (ob->check_string == NULL) ob->check_string = US"From ";
545 if (ob->escape_string == NULL) ob->escape_string = US">From ";
549 /* Set up the bitwise options for transport_write_message from the various
550 driver options. Only one of body_only and headers_only can be set. */
553 (tblock->body_only? topt_no_headers : 0) |
554 (tblock->headers_only? topt_no_body : 0) |
555 (tblock->return_path_add? topt_add_return_path : 0) |
556 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
557 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
558 ((ob->use_crlf || ob->mbx_format)? topt_use_crlf : 0);
563 /*************************************************
565 *************************************************/
567 /* The comsat daemon is the thing that provides asynchronous notification of
568 the arrival of local messages, if requested by the user by "biff y". It is a
569 BSD thing that uses a TCP/IP protocol for communication. A message consisting
570 of the text "user@offset" must be sent, where offset is the place in the
571 mailbox where new mail starts. There is no scope for telling it which file to
572 look at, which makes it a less than useful if mail is being delivered into a
573 non-standard place such as the user's home directory. In fact, it doesn't seem
574 to pay much attention to the offset.
578 offset offset in mailbox
584 notify_comsat(uschar *user, off_t offset)
591 DEBUG(D_transport) debug_printf("notify_comsat called\n");
593 sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
595 if ((sp = getservbyname("biff", "udp")) == NULL)
597 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
601 host.name = US"localhost";
605 /* This code is all set up to look up "localhost" and use all its addresses
606 until one succeeds. However, it appears that at least on some systems, comsat
607 doesn't listen on the ::1 address. So for the moment, just force the address to
608 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
609 can be changed. (But actually, comsat is probably dying out anyway.) */
612 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
614 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
619 host.address = US"127.0.0.1";
622 for (h = &host; h != NULL; h = h->next)
625 int host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
627 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
629 sock = ip_socket(SOCK_DGRAM, host_af);
630 if (sock < 0) continue;
632 /* Connect never fails for a UDP socket, so don't set a timeout. */
634 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0);
635 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
640 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
647 /*************************************************
648 * Check the format of a file *
649 *************************************************/
651 /* This function is called when file_format is set, to check that an existing
652 file has the right format. The format string contains text/transport pairs. The
653 string matching is literal. we just read big_buffer_size bytes, because this is
654 all about the first few bytes of a file.
658 tblock the transport block
659 addr the address block - for inserting error data
661 Returns: pointer to the required transport, or NULL
665 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
668 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
670 int len = read(cfd, data, sizeof(data));
674 DEBUG(D_transport) debug_printf("checking file format\n");
676 /* An empty file matches the current transport */
678 if (len == 0) return tblock;
680 /* Search the formats for a match */
682 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size))!= NULL)
684 int slen = Ustrlen(s);
685 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
686 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
689 transport_instance *tt;
690 for (tt = transports; tt != NULL; tt = tt->next)
691 if (Ustrcmp(tp, tt->name) == 0)
694 debug_printf("file format -> %s transport\n", tt->name);
697 addr->basic_errno = ERRNO_BADTRANSPORT;
698 addr->message = string_sprintf("%s transport (for %.*s format) not found",
704 /* Failed to find a match */
706 addr->basic_errno = ERRNO_FORMATUNKNOWN;
707 addr->message = US"mailbox file format unrecognized";
714 /*************************************************
715 * Check directory's files for quota *
716 *************************************************/
718 /* This function is called if quota is set for one of the delivery modes that
719 delivers into a specific directory. It scans the directory and stats all the
720 files in order to get a total size and count. This is an expensive thing to do,
721 but some people are prepared to bear the cost. Alternatively, if size_regex is
722 set, it is used as a regex to try to extract the size from the file name, a
723 strategy that some people use on maildir files on systems where the users have
726 The function is global, because it is also called from tf_maildir.c for maildir
727 folders (which should contain only regular files).
729 Note: Any problems can be written to debugging output, but cannot be written to
730 the log, because we are running as an unprivileged user here.
733 dirname the name of the directory
734 countptr where to add the file count (because this function recurses)
735 regex a compiled regex to get the size from a name
737 Returns: the sum of the sizes of the stattable files
738 zero if the directory cannot be opened
742 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
746 int count = *countptr;
750 dir = opendir(CS dirname);
751 if (dir == NULL) return 0;
753 while ((ent = readdir(dir)) != NULL)
755 uschar *name = US ent->d_name;
758 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
762 /* If there's a regex, try to find the size using it */
767 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
770 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
771 if (endptr == name + ovector[3])
775 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
781 debug_printf("check_dir_size: regex did not match %s\n", name);
784 /* No regex or no match for the regex, or captured non-digits */
786 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
789 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
794 if (Ustat(buffer, &statbuf) < 0)
797 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
802 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
803 sum += statbuf.st_size;
804 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
805 sum += check_dir_size(buffer, &count, regex);
810 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
820 /*************************************************
821 * Apply a lock to a file descriptor *
822 *************************************************/
824 /* This function applies a lock to a file descriptor, using a blocking or
825 non-blocking lock, depending on the timeout value. It can apply either or
826 both of a fcntl() and a flock() lock. However, not all OS support flock();
827 for those that don't, the use_flock option cannot be set.
830 fd the file descriptor
831 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
832 fcntl() format); the flock() type is deduced if needed
833 dofcntl do fcntl() locking
834 fcntltime non-zero to use blocking fcntl()
835 doflock do flock() locking
836 flocktime non-zero to use blocking flock()
838 Returns: yield of the fcntl() or flock() call, with errno preserved;
839 sigalrm_seen set if there has been a timeout
843 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
848 struct flock lock_data;
849 lock_data.l_type = fcntltype;
850 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
852 sigalrm_seen = FALSE;
859 yield = fcntl(fd, F_SETLKW, &lock_data);
864 else yield = fcntl(fd, F_SETLK, &lock_data);
868 if (doflock && (yield >= 0))
870 int flocktype = (fcntltype == F_WRLCK)? LOCK_EX : LOCK_SH;
874 yield = flock(fd, flocktype);
879 else yield = flock(fd, flocktype | LOCK_NB);
881 #endif /* NO_FLOCK */
890 /*************************************************
891 * Copy message into MBX mailbox *
892 *************************************************/
894 /* This function is called when a message intended for a MBX mailbox has been
895 written to a temporary file. We can now get the size of the message and then
896 copy it in MBX format to the mailbox.
899 to_fd fd to write to (the real mailbox)
900 from_fd fd to read from (the temporary file)
901 saved_size current size of mailbox
903 Returns: OK if all went well, DEFER otherwise, with errno preserved
904 the number of bytes written are added to transport_count
905 by virtue of calling transport_write_block()
908 /* Values taken from c-client */
910 #define MBX_HDRSIZE 2048
911 #define MBX_NUSERFLAGS 30
914 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
920 /* If the current mailbox size is zero, write a header block */
926 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
927 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
928 (long int)time(NULL));
929 for (i = 0; i < MBX_NUSERFLAGS; i++)
930 sprintf (CS(s += Ustrlen(s)), "\015\012");
931 if (!transport_write_block (to_fd, deliver_out_buffer, MBX_HDRSIZE))
935 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
937 /* Now construct the message's header from the time and the RFC822 file
938 size, including CRLFs, which is the size of the input (temporary) file. */
940 if (fstat(from_fd, &statbuf) < 0) return DEFER;
941 size = statbuf.st_size;
943 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
944 tod_stamp(tod_mbx), size, 0L, 0, 0);
945 used = Ustrlen(deliver_out_buffer);
947 /* Rewind the temporary file, and copy it over in chunks. */
949 lseek(from_fd, 0 , SEEK_SET);
953 int len = read(from_fd, deliver_out_buffer + used,
954 DELIVER_OUT_BUFFER_SIZE - used);
957 if (len == 0) errno = ERRNO_MBXLENGTH;
960 if (!transport_write_block(to_fd, deliver_out_buffer, used + len))
968 #endif /* SUPPORT_MBX */
972 /*************************************************
973 * Check creation is permitted *
974 *************************************************/
976 /* This function checks whether a given file name is permitted to be created,
977 as controlled by the create_file option. If no home directory is set, however,
978 we can't do any tests.
981 filename the file name
982 create_file the ob->create_file option
984 Returns: TRUE if creation is permitted
988 check_creation(uschar *filename, int create_file)
992 if (deliver_home != NULL && create_file != create_anywhere)
994 int len = Ustrlen(deliver_home);
995 uschar *file = filename;
997 while (file[0] == '/' && file[1] == '/') file++;
998 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
999 ( Ustrchr(file+len+2, '/') != NULL &&
1001 create_file != create_belowhome ||
1002 Ustrstr(file+len, "/../") != NULL
1007 /* If yield is TRUE, the file name starts with the home directory, and does
1008 not contain any instances of "/../" in the "belowhome" case. However, it may
1009 still contain symbolic links. We can check for this by making use of
1010 realpath(), which most Unixes seem to have (but make it possible to cut this
1011 out). We can't just use realpath() on the whole file name, because we know
1012 the file itself doesn't exist, and intermediate directories may also not
1013 exist. What we want to know is the real path of the longest existing part of
1014 the path. That must match the home directory's beginning, whichever is the
1018 if (yield && create_file == create_belowhome)
1020 uschar *slash, *next;
1022 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
1023 rp == NULL && slash > file; /* Stop if reached beginning */
1027 rp = US realpath(CS file, CS big_buffer);
1028 next = Ustrrchr(file, '/');
1032 /* If rp == NULL it means that none of the relevant directories exist.
1033 This is not a problem here - it means that no symbolic links can exist,
1034 which is all we are worried about. Otherwise, we must compare it
1035 against the start of the home directory. However, that may itself
1036 contain symbolic links, so we have to "realpath" it as well, if
1041 uschar hdbuffer[PATH_MAX+1];
1042 uschar *rph = deliver_home;
1043 int rlen = Ustrlen(big_buffer);
1045 rp = US realpath(CS deliver_home, CS hdbuffer);
1052 if (rlen > len) rlen = len;
1053 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1056 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1057 big_buffer, deliver_home);
1061 #endif /* NO_REALPATH */
1069 /*************************************************
1070 * Main entry point *
1071 *************************************************/
1073 /* See local README for general interface details. This transport always
1074 returns FALSE, indicating that the status which has been placed in the first
1075 address should be copied to any other addresses in a batch.
1077 Appendfile delivery is tricky and has led to various security problems in other
1078 mailers. The logic used here is therefore laid out in some detail. When this
1079 function is called, we are running in a subprocess which has had its gid and
1080 uid set to the appropriate values. Therefore, we cannot write directly to the
1081 exim logs. Any errors must be handled by setting appropriate return codes.
1082 Note that the default setting for addr->transport_return is DEFER, so it need
1083 not be set unless some other value is required.
1085 The code below calls geteuid() rather than getuid() to get the current uid
1086 because in weird configurations not running setuid root there may be a
1087 difference. In the standard configuration, where setuid() has been used in the
1088 delivery process, there will be no difference between the uid and the euid.
1090 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1091 alias expansion. Otherwise, there must be a configured file name or
1094 The following items apply in the case when a file name (as opposed to a
1095 directory name) is given, that is, when appending to a single file:
1097 (2f) Expand the file name.
1099 (3f) If the file name is /dev/null, return success (optimization).
1101 (4f) If the file_format options is set, open the file for reading, and check
1102 that the bytes at the start of the file match one of the given strings.
1103 If the check indicates a transport other than the current one should be
1104 used, pass control to that other transport. Otherwise continue. An empty
1105 or non-existent file matches the current transport. The file is closed
1108 (5f) If a lock file is required, create it (see extensive separate comments
1109 below about the algorithm for doing this). It is important to do this
1110 before opening the mailbox if NFS is in use.
1112 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1113 details of any symbolic link.
1115 (7f) If the file already exists:
1117 Check the owner and group if necessary, and defer if they are wrong.
1119 If it is a symbolic link AND the allow_symlink option is set (NOT the
1120 default), go back to (6f) but this time use stat() instead of lstat().
1122 If it's not a regular file (or FIFO when permitted), defer delivery.
1124 Check permissions. If the required permissions are *less* than the
1125 existing ones, or supplied by the address (often by the user via filter),
1126 chmod() the file. Otherwise, defer.
1128 Save the inode number.
1130 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1132 If open fails because the file does not exist, go to (6f); on any other
1135 Check the inode number hasn't changed - I realize this isn't perfect (an
1136 inode can be reused) but it's cheap and will catch some of the races.
1138 Check it's still a regular file (or FIFO if permitted).
1140 Check that the owner and permissions haven't changed.
1142 If file_format is set, check that the file still matches the format for
1143 the current transport. If not, defer delivery.
1145 (8f) If file does not exist initially:
1147 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1148 this is via a symbolic link (only possible if allow_symlinks is set), in
1149 which case don't use O_EXCL, as it dosn't work.
1151 If open fails because the file already exists, go to (6f). To avoid
1152 looping for ever in a situation where the file is continuously being
1153 created and deleted, all of this happens inside a loop that operates
1154 lock_retries times and includes the fcntl and flock locking. If the
1155 loop completes without the file getting opened, defer and request
1156 freezing, because something really weird is happening.
1158 If open fails for any other reason, defer for subsequent delivery except
1159 when this is a file delivery resulting from an alias or forward expansion
1160 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1161 most likely a user rather than a configuration error.
1163 (9f) We now have the file checked and open for writing. If so configured, lock
1164 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1165 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1166 still fails, give up and defer delivery.
1168 (10f)Save the access time (for subsequent restoration) and the size of the
1169 file, for comsat and for re-setting if delivery fails in the middle -
1170 e.g. for quota exceeded.
1172 The following items apply in the case when a directory name is given:
1174 (2d) Create a new file in the directory using a temporary name, by opening for
1175 writing and with O_CREAT. If maildir format is being used, the file
1176 is created in a temporary subdirectory with a prescribed name. If
1177 mailstore format is being used, the envelope file is first created with a
1178 temporary name, then the data file.
1180 The following items apply in all cases:
1182 (11) We now have the file open for writing, and locked if it was given as a
1183 file name. Write the message and flush the file, unless there is a setting
1184 of the local quota option, in which case we can check for its excession
1185 without doing any writing.
1187 In the case of MBX format mailboxes, the message is first written to a
1188 temporary file, in order to get its correct length. This is then copied to
1189 the real file, preceded by an MBX header.
1191 If there is a quota error on writing, defer the address. Timeout logic
1192 will determine for how long retries are attempted. We restore the mailbox
1193 to its original length if it's a single file. There doesn't seem to be a
1194 uniform error code for quota excession (it even differs between SunOS4
1195 and some versions of SunOS5) so a system-dependent macro called
1196 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1199 For any other error (most commonly disk full), do the same.
1201 The following applies after appending to a file:
1203 (12f)Restore the atime; notify_comsat if required; close the file (which
1204 unlocks it if it was locked). Delete the lock file if it exists.
1206 The following applies after writing a unique file in a directory:
1208 (12d)For maildir format, rename the file into the new directory. For mailstore
1209 format, rename the envelope file to its correct name. Otherwise, generate
1210 a unique name from the directory_file option, and rename to that, possibly
1211 trying a few times if the file exists and re-expanding the name gives a
1214 This transport yields FAIL only when a file name is generated by an alias or
1215 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1216 All other failures return DEFER (in addr->transport_return). */
1220 appendfile_transport_entry(
1221 transport_instance *tblock, /* data for this instantiation */
1222 address_item *addr) /* address we are working on */
1224 appendfile_transport_options_block *ob =
1225 (appendfile_transport_options_block *)(tblock->options_block);
1226 struct stat statbuf;
1227 uschar *fdname = NULL;
1228 uschar *filename = NULL;
1229 uschar *hitchname = NULL;
1230 uschar *dataname = NULL;
1231 uschar *lockname = NULL;
1232 uschar *newname = NULL;
1233 uschar *nametag = NULL;
1235 uschar *filecount_msg = US"";
1237 struct utimbuf times;
1238 struct timeval msg_tv;
1239 BOOL disable_quota = FALSE;
1240 BOOL isdirectory = FALSE;
1241 BOOL isfifo = FALSE;
1242 BOOL wait_for_tick = FALSE;
1243 uid_t uid = geteuid(); /* See note above */
1244 gid_t gid = getegid();
1246 int mode = (addr->mode > 0)? addr->mode : ob->mode;
1247 off_t saved_size = -1;
1248 off_t mailbox_size = ob->mailbox_size_value;
1249 int mailbox_filecount = ob->mailbox_filecount_value;
1257 int mbx_lockfd = -1;
1258 uschar mbx_lockname[40];
1259 FILE *temp_file = NULL;
1260 #endif /* SUPPORT_MBX */
1262 #ifdef SUPPORT_MAILDIR
1263 int maildirsize_fd = -1; /* fd for maildirsize file */
1264 int maildir_save_errno;
1268 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1270 /* An "address_file" or "address_directory" transport is used to deliver to
1271 files specified via .forward or an alias file. Prior to release 4.20, the
1272 "file" and "directory" options were ignored in this case. This has been changed
1273 to allow the redirection data to specify what is in effect a folder, whose
1274 location is determined by the options on the transport.
1276 Compatibility with the case when neither option is set is retained by forcing a
1277 value for the file or directory name. A directory delivery is assumed if the
1278 last character of the path from the router is '/'.
1280 The file path is in the local part of the address, but not in the $local_part
1281 variable (that holds the parent local part). It is, however, in the
1282 $address_file variable. Below, we update the local part in the address if it
1283 changes by expansion, so that the final path ends up in the log. */
1285 if (testflag(addr, af_file) &&
1286 ob->filename == NULL &&
1287 ob->dirname == NULL)
1289 fdname = US"$address_file";
1290 if (address_file[Ustrlen(address_file)-1] == '/' ||
1291 ob->maildir_format ||
1292 ob->mailstore_format)
1296 /* Handle (a) an "address file" delivery where "file" or "directory" is
1297 explicitly set and (b) a non-address_file delivery, where one of "file" or
1298 "directory" must be set; initialization ensures that they are not both set. */
1302 fdname = ob->filename;
1305 fdname = ob->dirname;
1310 addr->transport_return = PANIC;
1311 addr->message = string_sprintf("Mandatory file or directory option "
1312 "missing from %s transport", tblock->name);
1317 /* Maildir and mailstore require a directory */
1319 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1321 addr->transport_return = PANIC;
1322 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1323 "to be specified for the %s transport",
1324 ob->maildir_format? "dir" : "store", tblock->name);
1328 path = expand_string(fdname);
1332 addr->transport_return = PANIC;
1333 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1334 "name for %s transport) failed: %s", fdname, tblock->name,
1335 expand_string_message);
1341 addr->message = string_sprintf("appendfile: file or directory name "
1342 "\"%s\" is not absolute", path);
1343 addr->basic_errno = ERRNO_NOTABSOLUTE;
1347 /* For a file delivery, make sure the local part in the address(es) is updated
1348 to the true local part. */
1350 if (testflag(addr, af_file))
1352 address_item *addr2;
1353 for (addr2 = addr; addr2 != NULL; addr2 = addr2->next)
1354 addr2->local_part = string_copy(path);
1357 /* The available mailbox formats depend on whether it is a directory or a file
1363 #ifdef SUPPORT_MAILDIR
1364 (ob->maildir_format)? mbf_maildir :
1366 #ifdef SUPPORT_MAILSTORE
1367 (ob->mailstore_format)? mbf_mailstore :
1375 (ob->mbx_format)? mbf_mbx :
1382 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1383 " warning=" OFF_T_FMT "%s\n"
1384 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1385 "maildir_use_size_file=%s\n",
1386 mode, ob->notify_comsat, ob->quota_value,
1387 ob->quota_warn_threshold_value,
1388 ob->quota_warn_threshold_is_percent? "%" : "",
1389 isdirectory? "directory" : "file",
1390 path, mailbox_formats[mbformat],
1391 (ob->message_prefix == NULL)? US"null" : string_printing(ob->message_prefix),
1392 (ob->message_suffix == NULL)? US"null" : string_printing(ob->message_suffix),
1393 (ob->maildir_use_size_file)? "yes" : "no");
1395 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1396 ob->use_lockfile? "lockfile " : "",
1397 ob->use_mbx_lock? "mbx locking (" : "",
1398 ob->use_fcntl? "fcntl " : "",
1399 ob->use_flock? "flock" : "",
1400 ob->use_mbx_lock? ")" : "");
1403 /* If the -N option is set, can't do any more. */
1408 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1410 addr->transport_return = OK;
1414 /* Handle the case of a file name. If the file name is /dev/null, we can save
1415 ourselves some effort and just give a success return right away. */
1419 BOOL use_lstat = TRUE;
1420 BOOL file_opened = FALSE;
1421 BOOL allow_creation_here = TRUE;
1423 if (Ustrcmp(path, "/dev/null") == 0)
1425 addr->transport_return = OK;
1429 /* Set the name of the file to be opened, and the file to which the data
1430 is written, and find out if we are permitted to create a non-existent file. */
1432 dataname = filename = path;
1433 allow_creation_here = check_creation(filename, ob->create_file);
1435 /* If ob->create_directory is set, attempt to create the directories in
1436 which this mailbox lives, but only if we are permitted to create the file
1437 itself. We know we are dealing with an absolute path, because this was
1440 if (ob->create_directory && allow_creation_here)
1442 uschar *p = Ustrrchr(path, '/');
1444 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1446 addr->basic_errno = errno;
1448 string_sprintf("failed to create directories for %s: %s", path,
1450 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1456 /* If file_format is set we must check that any existing file matches one of
1457 the configured formats by checking the bytes it starts with. A match then
1458 indicates a specific transport - if it is not this one, pass control to it.
1459 Otherwise carry on here. An empty or non-existent file matches the current
1460 transport. We don't need to distinguish between non-existence and other open
1461 failures because if an existing file fails to open here, it will also fail
1462 again later when O_RDWR is used. */
1464 if (ob->file_format != NULL)
1466 int cfd = Uopen(path, O_RDONLY, 0);
1469 transport_instance *tt = check_file_format(cfd, tblock, addr);
1472 /* If another transport is indicated, call it and return; if no transport
1473 was found, just return - the error data will have been set up.*/
1479 set_process_info("delivering %s to %s using %s", message_id,
1480 addr->local_part, tt->name);
1481 debug_print_string(tt->debug_string);
1482 addr->transport = tt;
1483 (tt->info->code)(tt, addr);
1490 /* The locking of mailbox files is worse than the naming of cats, which is
1491 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1492 three different names, so several different styles of locking are used.
1494 Research in other programs that lock mailboxes shows that there is no
1495 universally standard method. Having mailboxes NFS-mounted on the system that
1496 is delivering mail is not the best thing, but people do run like this,
1497 and so the code must do its best to cope.
1499 Three different locking mechanisms are supported. The initialization function
1500 checks that at least one is configured.
1504 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1505 will work over NFS. Only after that is done do we actually open the mailbox
1506 and apply locks to it (if configured).
1508 Originally, Exim got the file opened before doing anything about locking.
1509 However, a very occasional problem was observed on Solaris 2 when delivering
1510 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1511 gets remembered at open time. If another process on another host (that's
1512 important) has the file open and locked and writes to it and then releases
1513 the lock while the first process is waiting to get the lock, the first
1514 process may fail to write at the new end point of the file - despite the very
1515 definite statement about O_APPEND in the man page for write(). Experiments
1516 have reproduced this problem, but I do not know any way of forcing a host to
1517 update its attribute cache for an open NFS file. It would be nice if it did
1518 so when a lock was taken out, but this does not seem to happen. Anyway, to
1519 reduce the risk of this problem happening, we now create the lock file
1520 (if configured) *before* opening the mailbox. That will prevent two different
1521 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1522 however, but Pine at least seems to operate in the same way.
1524 Lockfiles should normally be used when NFS is involved, because of the above
1527 The logic for creating the lock file is:
1529 . The name of the lock file is <mailbox-name>.lock
1531 . First, create a "hitching post" name by adding the primary host name,
1532 current time and pid to the lock file name. This should be unique.
1534 . Create the hitching post file using WRONLY + CREAT + EXCL.
1536 . If that fails EACCES, we assume it means that the user is unable to create
1537 files in the mail spool directory. Some installations might operate in this
1538 manner, so there is a configuration option to allow this state not to be an
1539 error - we proceed to lock using fcntl only, after the file is open.
1541 . Otherwise, an error causes a deferment of the address.
1543 . Hard link the hitching post to the lock file name.
1545 . If the link succeeds, we have successfully created the lock file. Simply
1546 close and unlink the hitching post file.
1548 . If the link does not succeed, proceed as follows:
1550 o Fstat the hitching post file, and then close and unlink it.
1552 o Now examine the stat data. If the number of links to the file is exactly
1553 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1554 the return never made it back, so the link() function gave a failure
1557 . This method allows for the lock file to be created by some other process
1558 right up to the moment of the attempt to hard link it, and is also robust
1559 against NFS server crash-reboots, which would probably result in timeouts
1560 in the middle of link().
1562 . System crashes may cause lock files to get left lying around, and some means
1563 of flushing them is required. The approach of writing a pid (used by smail
1564 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1565 timeout, which seems a better approach. Since any program that writes to a
1566 mailbox using a lock file should complete its task very quickly, Pine
1567 removes lock files that are older than 5 minutes. We allow the value to be
1568 configurable on the transport.
1572 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1573 mailbox once it is open. This is done by default with a non-blocking lock.
1574 Failures to lock cause retries after a sleep, but only for a certain number
1575 of tries. A blocking lock is deliberately not used so that we don't hold the
1576 mailbox open. This minimizes the possibility of the NFS problem described
1577 under LOCK FILES above, if for some reason NFS deliveries are happening
1578 without lock files. However, the use of a non-blocking lock and sleep, though
1579 the safest approach, does not give the best performance on very busy systems.
1580 A blocking lock plus timeout does better. Therefore Exim has an option to
1581 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1582 enables the use of blocking fcntl() calls.
1586 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1587 same manner as for fcntl locking above. No-blocking/timeout is also set as
1588 above in lock_flock_timeout. Not all operating systems provide or support
1589 flock(). For those that don't (as determined by the definition of LOCK_SH in
1590 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1591 is implemented (not precisely) on top of fcntl(), which means there's no
1592 point in actually using it.
1596 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1597 then the rules used for locking in c-client are used. Exim takes out a shared
1598 lock on the mailbox file, and an exclusive lock on the file whose name is
1599 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1600 any other MBX client from getting an exclusive lock on it and expunging it.
1601 It also stops any other MBX client from unlinking the /tmp lock when it has
1604 The exclusive lock on the /tmp file prevents any other MBX client from
1605 updating the mailbox in any way. When writing is finished, if an exclusive
1606 lock on the mailbox can be obtained, indicating there are no current sharers,
1607 the /tmp file is unlinked.
1609 MBX locking can use either fcntl() or flock() locking. If neither
1610 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1611 The calls for getting these locks are by default non-blocking, as for non-mbx
1612 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1613 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1614 probably makes sense to set timeouts for any MBX deliveries. */
1617 /* Build a lock file if configured to do so - the existence of a lock
1618 file is subsequently checked by looking for a non-negative value of the
1619 file descriptor hd - even though the file is no longer open. */
1621 if (ob->use_lockfile)
1623 lockname = string_sprintf("%s.lock", filename);
1624 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1625 (unsigned int)(time(NULL)), (unsigned int)getpid());
1627 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1630 /* Lock file creation retry loop */
1632 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1635 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1639 addr->basic_errno = errno;
1641 string_sprintf("creating lock file hitching post %s "
1642 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1643 (long int)getegid());
1647 /* Attempt to hitch the hitching post to the lock file. If link()
1648 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1649 file, and get rid of the hitching post. If the number of links was 2,
1650 the link was created, despite the failure of link(). If the hitch was
1651 not successful, try again, having unlinked the lock file if it is too
1654 There's a version of Linux (2.0.27) which doesn't update its local cache
1655 of the inode after link() by default - which many think is a bug - but
1656 if the link succeeds, this code will be OK. It just won't work in the
1657 case when link() fails after having actually created the link. The Linux
1658 NFS person is fixing this; a temporary patch is available if anyone is
1659 sufficiently worried. */
1661 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1664 if (rc != 0 && statbuf.st_nlink != 2)
1666 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1667 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1669 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1672 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1676 DEBUG(D_transport) debug_printf("lock file created\n");
1680 /* Check for too many tries at creating the lock file */
1682 if (i >= ob->lock_retries)
1684 addr->basic_errno = ERRNO_LOCKFAILED;
1685 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1692 /* We now have to get the file open. First, stat() it and act on existence or
1693 non-existence. This is in a loop to handle the case of a file's being created
1694 or deleted as we watch, and also to handle retries when the locking fails.
1695 Rather than holding the file open while waiting for the fcntl() and/or
1696 flock() lock, we close and do the whole thing again. This should be safer,
1697 especially for NFS files, which might get altered from other hosts, making
1698 their cached sizes incorrect.
1700 With the default settings, no symlinks are permitted, but there is an option
1701 to permit symlinks for those sysadmins that know what they are doing.
1702 Shudder. However, insist that the initial symlink is owned by the right user.
1703 Thus lstat() is used initially; if a symlink is discovered, the loop is
1704 repeated such that stat() is used, to look at the end file. */
1706 for (i = 0; i < ob->lock_retries; i++)
1708 int sleep_before_retry = TRUE;
1709 file_opened = FALSE;
1711 if((use_lstat? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1713 /* Let's hope that failure to stat (other than non-existence) is a
1716 if (errno != ENOENT)
1718 addr->basic_errno = errno;
1719 addr->message = string_sprintf("attempting to stat mailbox %s",
1724 /* File does not exist. If it is required to pre-exist this state is an
1727 if (ob->file_must_exist)
1729 addr->basic_errno = errno;
1730 addr->message = string_sprintf("mailbox %s does not exist, "
1731 "but file_must_exist is set", filename);
1735 /* If not permitted to create this file because it isn't in or below
1736 the home directory, generate an error. */
1738 if (!allow_creation_here)
1740 addr->basic_errno = ERRNO_BADCREATE;
1741 addr->message = string_sprintf("mailbox %s does not exist, "
1742 "but creation outside the home directory is not permitted",
1747 /* Attempt to create and open the file. If open fails because of
1748 pre-existence, go round the loop again. For any other error, defer the
1749 address, except for an alias or forward generated file name with EPERM,
1750 ENOENT, or EACCES, as those are most likely to be user errors rather
1751 than Exim config errors. When a symbolic link is permitted and points
1752 to a non-existent file, we get here with use_lstat = FALSE. In this case
1753 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1754 consistency and because MBX locking requires it in order to be able to
1755 get a shared lock. */
1757 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1758 (use_lstat? O_EXCL : 0), mode);
1761 if (errno == EEXIST) continue;
1762 addr->basic_errno = errno;
1763 addr->message = string_sprintf("while creating mailbox %s",
1765 if (testflag(addr, af_file) &&
1766 (errno == EPERM || errno == ENOENT || errno == EACCES))
1767 addr->transport_return = FAIL;
1771 /* We have successfully created and opened the file. Ensure that the group
1772 and the mode are correct. */
1774 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
1776 addr->basic_errno = errno;
1777 addr->message = string_sprintf("while setting perms on mailbox %s",
1779 addr->transport_return = FAIL;
1785 /* The file already exists. Test its type, ownership, and permissions, and
1786 save the inode for checking later. If symlinks are permitted (not the
1787 default or recommended state) it may be a symlink that already exists.
1788 Check its ownership and then look for the file at the end of the link(s).
1789 This at least prevents one user creating a symlink for another user in
1790 a sticky directory. */
1794 int oldmode = (int)statbuf.st_mode;
1795 ino_t inode = statbuf.st_ino;
1796 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1798 isfifo = FALSE; /* In case things are changing */
1800 /* Check owner if required - the default. */
1802 if (ob->check_owner && statbuf.st_uid != uid)
1804 addr->basic_errno = ERRNO_BADUGID;
1805 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1806 "(%ld != %ld)", filename,
1807 islink? " (symlink)" : "",
1808 (long int)(statbuf.st_uid), (long int)uid);
1812 /* Group is checked only if check_group is set. */
1814 if (ob->check_group && statbuf.st_gid != gid)
1816 addr->basic_errno = ERRNO_BADUGID;
1817 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1818 filename, islink? " (symlink)" : "", statbuf.st_gid, gid);
1822 /* Just in case this is a sticky-bit mail directory, we don't want
1823 users to be able to create hard links to other users' files. */
1825 if (statbuf.st_nlink != 1)
1827 addr->basic_errno = ERRNO_NOTREGULAR;
1828 addr->message = string_sprintf("mailbox %s%s has too many links (%d)",
1829 filename, islink? " (symlink)" : "", statbuf.st_nlink);
1834 /* If symlinks are permitted (not recommended), the lstat() above will
1835 have found the symlink. Its ownership has just been checked; go round
1836 the loop again, using stat() instead of lstat(). That will never yield a
1839 if (islink && ob->allow_symlink)
1842 i--; /* Don't count this time round */
1846 /* An actual file exists. Check that it is a regular file, or FIFO
1849 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1851 else if ((oldmode & S_IFMT) != S_IFREG)
1853 addr->basic_errno = ERRNO_NOTREGULAR;
1854 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1855 filename, ob->allow_fifo? " or named pipe" : "");
1859 /* If the mode is not what it would be for a newly created file, change
1860 the permissions if the mode is supplied for the address. Otherwise,
1861 reduce but do not extend the permissions. If the newly created
1862 permissions are greater than the existing permissions, don't change
1863 things when the mode is not from the address. */
1865 if ((oldmode = (oldmode & 07777)) != mode)
1867 int diffs = oldmode ^ mode;
1868 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1870 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1871 if (Uchmod(filename, mode) < 0)
1873 addr->basic_errno = errno;
1874 addr->message = string_sprintf("attempting to chmod mailbox %s",
1881 /* Mode not from address, and newly-created permissions are greater
1882 than existing permissions. Default is to complain, but it can be
1883 configured to go ahead and try to deliver anyway if that's what
1884 the administration wants. */
1886 else if (ob->mode_fail_narrower)
1888 addr->basic_errno = ERRNO_BADMODE;
1889 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1890 "(%o expected)", filename, oldmode, mode);
1895 /* We are happy with the existing file. Open it, and then do further
1896 tests to ensure that it is the same file that we were just looking at.
1897 If the file does not now exist, restart this loop, going back to using
1898 lstat again. For an NFS error, just defer; other opening errors are
1899 more serious. The file is opened RDWR so that its format can be checked,
1900 and also MBX locking requires the use of a shared (read) lock. However,
1901 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1902 reading the pipe. */
1904 fd = Uopen(filename, isfifo? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1908 if (errno == ENOENT)
1913 addr->basic_errno = errno;
1916 addr->message = string_sprintf("while opening named pipe %s "
1917 "(could mean no process is reading it)", filename);
1919 else if (errno != EWOULDBLOCK)
1921 addr->message = string_sprintf("while opening mailbox %s", filename);
1926 /* This fstat really shouldn't fail, as we have an open file! There's a
1927 dilemma here. We use fstat in order to be sure we are peering at the file
1928 we have got open. However, that won't tell us if the file was reached
1929 via a symbolic link. We checked this above, but there is a race exposure
1930 if the link was created between the previous lstat and the open. However,
1931 it would have to be created with the same inode in order to pass the
1932 check below. If ob->allow_symlink is set, causing the use of stat rather
1933 than lstat above, symbolic links may be there anyway, and the checking is
1936 if (fstat(fd, &statbuf) < 0)
1938 addr->basic_errno = errno;
1939 addr->message = string_sprintf("attempting to stat open mailbox %s",
1944 /* Check the inode; this is isn't a perfect check, but gives some
1947 if (inode != statbuf.st_ino)
1949 addr->basic_errno = ERRNO_INODECHANGED;
1950 addr->message = string_sprintf("opened mailbox %s inode number changed "
1951 "from %d to %ld", filename, inode, statbuf.st_ino);
1952 addr->special_action = SPECIAL_FREEZE;
1956 /* Check it's still a regular file or FIFO, and the uid, gid, and
1957 permissions have not changed. */
1959 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1960 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1962 addr->basic_errno = ERRNO_NOTREGULAR;
1964 string_sprintf("opened mailbox %s is no longer a %s", filename,
1965 isfifo? "named pipe" : "regular file");
1966 addr->special_action = SPECIAL_FREEZE;
1970 if ((ob->check_owner && statbuf.st_uid != uid) ||
1971 (ob->check_group && statbuf.st_gid != gid))
1973 addr->basic_errno = ERRNO_BADUGID;
1975 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1976 addr->special_action = SPECIAL_FREEZE;
1980 if ((statbuf.st_mode & 07777) != oldmode)
1982 addr->basic_errno = ERRNO_BADMODE;
1983 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1984 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1985 addr->special_action = SPECIAL_FREEZE;
1989 /* If file_format is set, check that the format of the file has not
1990 changed. Error data is set by the testing function. */
1992 if (ob->file_format != NULL &&
1993 check_file_format(fd, tblock, addr) != tblock)
1995 addr->message = US"open mailbox has changed format";
1999 /* The file is OK. Carry on to do the locking. */
2002 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
2003 locking rules if configured to do so. If a lock file is also required, it
2004 was created above and hd was left >= 0. At least one form of locking is
2005 required by the initialization function. If locking fails here, close the
2006 file and go round the loop all over again, after waiting for a bit, unless
2007 blocking locking was used. */
2010 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
2011 sleep_before_retry = FALSE;
2013 /* Simple fcntl() and/or flock() locking */
2015 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
2017 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2018 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
2021 /* MBX locking rules */
2024 else if (ob->use_mbx_lock)
2027 struct stat lstatbuf, statbuf2;
2028 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2029 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
2030 fstat(fd, &statbuf) >= 0)
2032 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
2033 (long)statbuf.st_ino);
2036 * 2010-05-29: SECURITY
2037 * Dan Rosenberg reported the presence of a race-condition in the
2038 * original code here. Beware that many systems still allow symlinks
2039 * to be followed in /tmp so an attacker can create a symlink pointing
2040 * elsewhere between a stat and an open, which we should avoid
2043 * It's unfortunate that we can't just use all the heavily debugged
2044 * locking from above.
2046 * Also: remember to mirror changes into exim_lock.c */
2048 /* first leave the old pre-check in place, it provides better
2049 * diagnostics for common cases */
2050 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2052 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2054 addr->basic_errno = ERRNO_LOCKFAILED;
2055 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2059 if (statbuf.st_nlink > 1)
2061 addr->basic_errno = ERRNO_LOCKFAILED;
2062 addr->message = string_sprintf("hard link to MBX lock file %s",
2068 /* If we could just declare "we must be the ones who create this
2069 * file" then a hitching post in a subdir would work, since a
2070 * subdir directly in /tmp/ which we create wouldn't follow links
2071 * but this isn't our locking logic, so we can't safely change the
2072 * file existence rules. */
2074 /* On systems which support O_NOFOLLOW, it's the easiest and most
2075 * obviously correct security fix */
2076 mbx_tmp_oflags = O_RDWR | O_CREAT;
2078 mbx_tmp_oflags |= O_NOFOLLOW;
2080 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2083 addr->basic_errno = ERRNO_LOCKFAILED;
2084 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2085 mbx_lockname, strerror(errno));
2089 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2091 addr->basic_errno = ERRNO_LOCKFAILED;
2092 addr->message = string_sprintf("attempting to lstat open MBX "
2093 "lock file %s: %s", mbx_lockname, strerror(errno));
2096 if (fstat(mbx_lockfd, &statbuf2) < 0)
2098 addr->basic_errno = ERRNO_LOCKFAILED;
2099 addr->message = string_sprintf("attempting to stat fd of open MBX "
2100 "lock file %s: %s", mbx_lockname, strerror(errno));
2106 * statbuf: if exists, is file which existed prior to opening the
2107 * lockfile, might have been replaced since then
2108 * statbuf2: result of stat'ing the open fd, is what was actually
2110 * lstatbuf: result of lstat'ing the filename immediately after
2111 * the open but there's a race condition again between
2112 * those two steps: before open, symlink to foo, after
2113 * open but before lstat have one of:
2114 * * was no symlink, so is the opened file
2115 * (we created it, no messing possible after that point)
2117 * * symlink elsewhere
2118 * * hardlink elsewhere
2120 * Don't want to compare to device of /tmp because some modern systems
2121 * have regressed to having /tmp be the safe actual filesystem as
2122 * valuable data, so is mostly worthless, unless we assume that *only*
2123 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2124 * for further consideration.
2125 * No point in doing a readlink on the lockfile as that will always be
2126 * at a different point in time from when we open it, so tells us
2127 * nothing; attempts to clean up and delete after ourselves would risk
2128 * deleting a *third* filename.
2130 if ((statbuf2.st_nlink > 1) ||
2131 (lstatbuf.st_nlink > 1) ||
2132 (!S_ISREG(lstatbuf.st_mode)) ||
2133 (lstatbuf.st_dev != statbuf2.st_dev) ||
2134 (lstatbuf.st_ino != statbuf2.st_ino))
2136 addr->basic_errno = ERRNO_LOCKFAILED;
2137 addr->message = string_sprintf("RACE CONDITION detected: "
2138 "mismatch post-initial-checks between \"%s\" and opened "
2139 "fd lead us to abort!", mbx_lockname);
2143 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2145 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2146 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2148 struct stat ostatbuf;
2150 /* This tests for a specific race condition. Ensure that we still
2151 have the same file. */
2153 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2154 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2155 statbuf.st_dev == ostatbuf.st_dev &&
2156 statbuf.st_ino == ostatbuf.st_ino)
2158 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2159 "between creation and locking\n", mbx_lockname);
2162 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2164 (void)close(mbx_lockfd);
2169 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2170 filename, strerror(errno));
2173 #endif /* SUPPORT_MBX */
2175 else break; /* No on-file locking required; break the open/lock loop */
2178 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2182 use_lstat = TRUE; /* Reset to use lstat first */
2185 /* If a blocking call timed out, break the retry loop if the total time
2186 so far is not less than than retries * interval. Use the larger of the
2187 flock() and fcntl() timeouts. */
2190 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2191 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2192 ob->lock_retries * ob->lock_interval)
2193 i = ob->lock_retries;
2195 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2196 flock() that caused the problem. */
2198 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2201 /* Test for exceeding the maximum number of tries. Either the file remains
2202 locked, or, if we haven't got it open, something is terribly wrong... */
2204 if (i >= ob->lock_retries)
2208 addr->basic_errno = ERRNO_EXISTRACE;
2209 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2210 addr->special_action = SPECIAL_FREEZE;
2214 addr->basic_errno = ERRNO_LOCKFAILED;
2215 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2221 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2223 /* Save access time (for subsequent restoration), modification time (for
2224 restoration if updating fails), size of file (for comsat and for re-setting if
2225 delivery fails in the middle - e.g. for quota exceeded). */
2227 if (fstat(fd, &statbuf) < 0)
2229 addr->basic_errno = errno;
2230 addr->message = string_sprintf("while fstatting opened mailbox %s",
2235 times.actime = statbuf.st_atime;
2236 times.modtime = statbuf.st_mtime;
2237 saved_size = statbuf.st_size;
2238 if (mailbox_size < 0) mailbox_size = saved_size;
2239 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2242 /* Prepare for writing to a new file (as opposed to appending to an old one).
2243 There are several different formats, but there is preliminary stuff concerned
2244 with quotas that applies to all of them. Finding the current size by directory
2245 scanning is expensive; for maildirs some fudges have been invented:
2247 (1) A regex can be used to extract a file size from its name;
2248 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2254 uschar *check_path = path; /* Default quota check path */
2255 const pcre *regex = NULL; /* Regex for file size from file name */
2257 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2259 addr->basic_errno = ERRNO_BADCREATE;
2260 addr->message = string_sprintf("tried to create file in %s, but "
2261 "file creation outside the home directory is not permitted", path);
2265 #ifdef SUPPORT_MAILDIR
2266 /* For a maildir delivery, ensure that all the relevant directories exist,
2267 and a maildirfolder file if necessary. */
2269 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2270 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2272 #endif /* SUPPORT_MAILDIR */
2274 /* If we are going to do a quota check, of if maildir_use_size_file is set
2275 for a maildir delivery, compile the regular expression if there is one. We
2276 may also need to adjust the path that is used. We need to do this for
2277 maildir_use_size_file even if the quota is unset, because we still want to
2278 create the file. When maildir support is not compiled,
2279 ob->maildir_use_size_file is always FALSE. */
2281 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2283 const uschar *error;
2286 /* Compile the regex if there is one. */
2288 if (ob->quota_size_regex != NULL)
2290 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2291 (const char **)&error, &offset, NULL);
2294 addr->message = string_sprintf("appendfile: regular expression "
2295 "error: %s at offset %d while compiling %s", error, offset,
2296 ob->quota_size_regex);
2299 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2300 ob->quota_size_regex);
2303 /* Use an explicitly configured directory if set */
2305 if (ob->quota_directory != NULL)
2307 check_path = expand_string(ob->quota_directory);
2308 if (check_path == NULL)
2310 addr->transport_return = PANIC;
2311 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2312 "name for %s transport) failed: %s", ob->quota_directory,
2313 tblock->name, expand_string_message);
2317 if (check_path[0] != '/')
2319 addr->message = string_sprintf("appendfile: quota_directory name "
2320 "\"%s\" is not absolute", check_path);
2321 addr->basic_errno = ERRNO_NOTABSOLUTE;
2326 #ifdef SUPPORT_MAILDIR
2327 /* Otherwise, if we are handling a maildir delivery, and the directory
2328 contains a file called maildirfolder, this is a maildir++ feature telling
2329 us that this is a sub-directory of the real inbox. We should therefore do
2330 the quota check on the parent directory. Beware of the special case when
2331 the directory name itself ends in a slash. */
2333 else if (mbformat == mbf_maildir)
2335 struct stat statbuf;
2336 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2338 uschar *new_check_path = string_copy(check_path);
2339 uschar *slash = Ustrrchr(new_check_path, '/');
2345 slash = Ustrrchr(new_check_path, '/');
2350 check_path = new_check_path;
2351 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2352 "quota check directory changed to %s\n", check_path);
2357 #endif /* SUPPORT_MAILDIR */
2360 /* If we are using maildirsize files, we need to ensure that such a file
2361 exists and, if necessary, recalculate its contents. As a byproduct of this,
2362 we obtain the current size of the maildir. If no quota is to be enforced
2363 (ob->quota_value == 0), we still need the size if a threshold check will
2366 Another regular expression is used to determine which directories inside the
2367 maildir are going to be counted. */
2369 #ifdef SUPPORT_MAILDIR
2370 if (ob->maildir_use_size_file)
2372 const pcre *dir_regex = NULL;
2373 const uschar *error;
2376 if (ob->maildir_dir_regex != NULL)
2378 int check_path_len = Ustrlen(check_path);
2380 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2381 (const char **)&error, &offset, NULL);
2382 if (dir_regex == NULL)
2384 addr->message = string_sprintf("appendfile: regular expression "
2385 "error: %s at offset %d while compiling %s", error, offset,
2386 ob->maildir_dir_regex);
2391 debug_printf("using regex for maildir directory selection: %s\n",
2392 ob->maildir_dir_regex);
2394 /* Check to see if we are delivering into an ignored directory, that is,
2395 if the delivery path starts with the quota check path, and the rest
2396 of the deliver path matches the regex; if so, set a flag to disable quota
2397 checking and maildirsize updating. */
2399 if (Ustrncmp(path, check_path, check_path_len) == 0)
2401 uschar *s = path + check_path_len;
2402 while (*s == '/') s++;
2403 s = (*s == 0)? US "new" : string_sprintf("%s/new", s);
2404 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2406 disable_quota = TRUE;
2407 DEBUG(D_transport) debug_printf("delivery directory does not match "
2408 "maildir_quota_directory_regex: disabling quota\n");
2413 /* Quota enforcement; create and check the file. There is some discussion
2414 about whether this should happen if the quota is unset. At present, Exim
2415 always creates the file. If we ever want to change this, uncomment
2416 appropriate lines below, possibly doing a check on some option. */
2418 /* if (???? || ob->quota_value > 0) */
2425 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2428 if (maildirsize_fd == -1)
2430 addr->basic_errno = errno;
2431 addr->message = string_sprintf("while opening or reading "
2432 "%s/maildirsize", check_path);
2435 /* can also return -2, which means that the file was removed because of
2436 raciness; but in this case, the size & filecount will still have been
2439 if (mailbox_size < 0) mailbox_size = size;
2440 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2443 /* No quota enforcement; ensure file does *not* exist; calculate size if
2448 * time_t old_latest;
2449 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2450 * if (THRESHOLD_CHECK)
2451 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2452 * regex, dir_regex, FALSE);
2457 #endif /* SUPPORT_MAILDIR */
2459 /* Otherwise if we are going to do a quota check later on, and the mailbox
2460 size is not set, find the current size of the mailbox. Ditto for the file
2461 count. Note that ob->quota_filecount_value cannot be set without
2462 ob->quota_value being set. */
2464 if (!disable_quota &&
2465 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2466 (mailbox_size < 0 ||
2467 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2472 debug_printf("quota checks on directory %s\n", check_path);
2473 size = check_dir_size(check_path, &filecount, regex);
2474 if (mailbox_size < 0) mailbox_size = size;
2475 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2478 /* Handle the case of creating a unique file in a given directory (not in
2479 maildir or mailstore format - this is how smail did it). A temporary name is
2480 used to create the file. Later, when it is written, the name is changed to a
2481 unique one. There is no need to lock the file. An attempt is made to create
2482 the directory if it does not exist. */
2484 if (mbformat == mbf_smail)
2487 debug_printf("delivering to new file in %s\n", path);
2488 filename = dataname =
2489 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2490 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2491 if (fd < 0 && /* failed to open, and */
2492 (errno != ENOENT || /* either not non-exist */
2493 !ob->create_directory || /* or not allowed to make */
2494 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2495 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2497 addr->basic_errno = errno;
2498 addr->message = string_sprintf("while creating file %s", filename);
2503 #ifdef SUPPORT_MAILDIR
2505 /* Handle the case of a unique file in maildir format. The file is written to
2506 the tmp subdirectory, with a prescribed form of name. */
2508 else if (mbformat == mbf_maildir)
2511 debug_printf("delivering in maildir format in %s\n", path);
2513 nametag = ob->maildir_tag;
2515 /* Check that nametag expands successfully; a hard failure causes a panic
2516 return. The actual expansion for use happens again later, when
2517 $message_size is accurately known. */
2519 if (nametag != NULL && expand_string(nametag) == NULL &&
2520 !expand_string_forcedfail)
2522 addr->transport_return = PANIC;
2523 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2524 "for %s transport) failed: %s", nametag, tblock->name,
2525 expand_string_message);
2529 /* We ensured the existence of all the relevant directories above. Attempt
2530 to open the temporary file a limited number of times. I think this rather
2531 scary-looking for statement is actually OK. If open succeeds, the loop is
2532 broken; if not, there is a test on the value of i. Get the time again
2533 afresh each time round the loop. Its value goes into a variable that is
2534 checked at the end, to make sure we don't release this process until the
2535 clock has ticked. */
2541 (void)gettimeofday(&msg_tv, NULL);
2542 basename = string_sprintf("%lu.H%luP%lu.%s", msg_tv.tv_sec,
2543 msg_tv.tv_usec, getpid(), primary_hostname);
2545 filename = dataname = string_sprintf("tmp/%s", basename);
2546 newname = string_sprintf("new/%s", basename);
2548 if (Ustat(filename, &statbuf) == 0)
2550 else if (errno == ENOENT)
2552 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2554 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2555 filename, strerror(errno));
2558 /* Too many retries - give up */
2560 if (i >= ob->maildir_retries)
2562 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2563 filename, i, (i == 1)? "y" : "ies");
2564 addr->basic_errno = errno;
2565 if (errno == errno_quota || errno == ENOSPC)
2566 addr->user_message = US"mailbox is full";
2570 /* Open or stat failed but we haven't tried too many times yet. */
2575 /* Note that we have to ensure the clock has ticked before leaving */
2577 wait_for_tick = TRUE;
2579 /* Why are these here? Put in because they are present in the non-maildir
2580 directory case above. */
2582 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2584 addr->basic_errno = errno;
2585 addr->message = string_sprintf("while setting perms on maildir %s",
2591 #endif /* SUPPORT_MAILDIR */
2593 #ifdef SUPPORT_MAILSTORE
2595 /* Handle the case of a unique file in mailstore format. First write the
2596 envelope to a temporary file, then open the main file. The unique base name
2597 for the files consists of the message id plus the pid of this delivery
2603 address_item *taddr;
2604 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2605 string_base62((long int)getpid()));
2608 debug_printf("delivering in mailstore format in %s\n", path);
2610 filename = string_sprintf("%s.tmp", mailstore_basename);
2611 newname = string_sprintf("%s.env", mailstore_basename);
2612 dataname = string_sprintf("%s.msg", mailstore_basename);
2614 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2615 if (fd < 0 && /* failed to open, and */
2616 (errno != ENOENT || /* either not non-exist */
2617 !ob->create_directory || /* or not allowed to make */
2618 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2619 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2621 addr->basic_errno = errno;
2622 addr->message = string_sprintf("while creating file %s", filename);
2626 /* Why are these here? Put in because they are present in the non-maildir
2627 directory case above. */
2629 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2631 addr->basic_errno = errno;
2632 addr->message = string_sprintf("while setting perms on file %s",
2637 /* Built a C stream from the open file descriptor. */
2639 if ((env_file = fdopen(fd, "wb")) == NULL)
2641 addr->basic_errno = errno;
2642 addr->transport_return = PANIC;
2643 addr->message = string_sprintf("fdopen of %s ("
2644 "for %s transport) failed", filename, tblock->name);
2650 /* Write the envelope file, then close it. */
2652 if (ob->mailstore_prefix != NULL)
2654 uschar *s = expand_string(ob->mailstore_prefix);
2657 if (!expand_string_forcedfail)
2659 addr->transport_return = PANIC;
2660 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2661 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2662 tblock->name, expand_string_message);
2663 (void)fclose(env_file);
2671 fprintf(env_file, "%s", CS s);
2672 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2676 fprintf(env_file, "%s\n", sender_address);
2678 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2679 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2681 if (ob->mailstore_suffix != NULL)
2683 uschar *s = expand_string(ob->mailstore_suffix);
2686 if (!expand_string_forcedfail)
2688 addr->transport_return = PANIC;
2689 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2690 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2691 tblock->name, expand_string_message);
2692 (void)fclose(env_file);
2700 fprintf(env_file, "%s", CS s);
2701 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2705 if (fclose(env_file) != 0)
2707 addr->basic_errno = errno;
2708 addr->message = string_sprintf("while closing %s", filename);
2713 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2715 /* Now open the data file, and ensure that it has the correct ownership and
2718 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2721 addr->basic_errno = errno;
2722 addr->message = string_sprintf("while creating file %s", dataname);
2726 if(Uchown(dataname, uid, gid) || Uchmod(dataname, mode))
2728 addr->basic_errno = errno;
2729 addr->message = string_sprintf("while setting perms on file %s",
2735 #endif /* SUPPORT_MAILSTORE */
2738 /* In all cases of writing to a new file, ensure that the file which is
2739 going to be renamed has the correct ownership and mode. */
2741 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2743 addr->basic_errno = errno;
2744 addr->message = string_sprintf("while setting perms on file %s",
2751 /* At last we can write the message to the file, preceded by any configured
2752 prefix line, and followed by any configured suffix line. If there are any
2753 writing errors, we must defer. */
2755 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2760 /* If there is a local quota setting, check that we are not going to exceed it
2761 with this message if quota_is_inclusive is set; if it is not set, the check
2762 is for the mailbox already being over quota (i.e. the current message is not
2763 included in the check). */
2765 if (!disable_quota && ob->quota_value > 0)
2769 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2770 " this message = %d (%sincluded)\n",
2771 ob->quota_value, mailbox_size, message_size,
2772 ob->quota_is_inclusive? "" : "not ");
2773 debug_printf(" file count quota = %d count = %d\n",
2774 ob->quota_filecount_value, mailbox_filecount);
2776 if (mailbox_size + (ob->quota_is_inclusive? message_size:0) > ob->quota_value)
2778 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2780 errno = ERRNO_EXIMQUOTA;
2782 else if (ob->quota_filecount_value > 0 &&
2783 mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2784 ob->quota_filecount_value)
2786 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2788 errno = ERRNO_EXIMQUOTA;
2789 filecount_msg = US" filecount";
2793 /* If we are writing in MBX format, what we actually do is to write the message
2794 to a temporary file, and then copy it to the real file once we know its size.
2795 This is the most straightforward way of getting the correct length in the
2796 separator line. So, what we do here is to save the real file descriptor, and
2797 replace it with one for a temporary file. The temporary file gets unlinked once
2798 opened, so that it goes away on closure. */
2801 if (yield == OK && ob->mbx_format)
2803 temp_file = tmpfile();
2804 if (temp_file == NULL)
2806 addr->basic_errno = errno;
2807 addr->message = US"while setting up temporary file";
2812 fd = fileno(temp_file);
2813 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2815 #endif /* SUPPORT_MBX */
2817 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2820 transport_count = 0;
2821 transport_newlines = 0;
2823 /* Write any configured prefix text first */
2825 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2827 uschar *prefix = expand_string(ob->message_prefix);
2830 errno = ERRNO_EXPANDFAIL;
2831 addr->transport_return = PANIC;
2832 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2833 "transport) failed", ob->message_prefix, tblock->name);
2836 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2839 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2840 various different values for batching are handled outside; if there is more
2841 than one address available here, all must be included. If any address is a
2842 file, use its parent in the RCPT TO. */
2844 if (yield == OK && ob->use_bsmtp)
2846 transport_count = 0;
2847 transport_newlines = 0;
2848 if (ob->use_crlf) cr = US"\r";
2849 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2854 transport_newlines++;
2855 for (a = addr; a != NULL; a = a->next)
2857 address_item *b = testflag(a, af_pfr)? a->parent: a;
2858 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2859 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2860 { yield = DEFER; break; }
2861 transport_newlines++;
2863 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2866 transport_newlines++;
2870 /* Now the message itself. The options for transport_write_message were set up
2871 at initialization time. */
2875 if (!transport_write_message(addr, fd, ob->options, 0, tblock->add_headers,
2876 tblock->remove_headers, ob->check_string, ob->escape_string,
2877 tblock->rewrite_rules, tblock->rewrite_existflags))
2881 /* Now a configured suffix. */
2883 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2885 uschar *suffix = expand_string(ob->message_suffix);
2888 errno = ERRNO_EXPANDFAIL;
2889 addr->transport_return = PANIC;
2890 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2891 "transport) failed", ob->message_suffix, tblock->name);
2894 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2897 /* If batch smtp, write the terminating dot. */
2899 if (yield == OK && ob->use_bsmtp ) {
2900 if(!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2901 else transport_newlines++;
2904 /* If MBX format is being used, all that writing was to the temporary file.
2905 However, if there was an earlier failure (Exim quota exceeded, for example),
2906 the temporary file won't have got opened - and no writing will have been done.
2907 If writing was OK, we restore the fd, and call a function that copies the
2908 message in MBX format into the real file. Otherwise use the temporary name in
2912 if (temp_file != NULL && ob->mbx_format)
2919 transport_count = 0; /* Reset transport count for actual write */
2920 /* No need to reset transport_newlines as we're just using a block copy
2921 * routine so the number won't be affected */
2922 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2924 else if (errno >= 0) dataname = US"temporary file";
2926 /* Preserve errno while closing the temporary file. */
2928 mbx_save_errno = errno;
2929 (void)fclose(temp_file);
2930 errno = mbx_save_errno;
2932 #endif /* SUPPORT_MBX */
2934 /* Force out the remaining data to check for any errors; some OS don't allow
2935 fsync() to be called for a FIFO. */
2937 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2939 /* Update message_size and message_linecount to the accurate count of bytes
2940 written, including added headers. Note; we subtract 1 from message_linecount as
2941 this variable doesn't count the new line between the header and the body of the
2944 message_size = transport_count;
2945 message_linecount = transport_newlines - 1;
2947 /* If using a maildir++ quota file, add this message's size to it, and
2948 close the file descriptor, except when the quota has been disabled because we
2949 are delivering into an uncounted folder. */
2951 #ifdef SUPPORT_MAILDIR
2954 if (yield == OK && maildirsize_fd >= 0)
2955 maildir_record_length(maildirsize_fd, message_size);
2956 maildir_save_errno = errno; /* Preserve errno while closing the file */
2957 if (maildirsize_fd >= 0)
2958 (void)close(maildirsize_fd);
2959 errno = maildir_save_errno;
2961 #endif /* SUPPORT_MAILDIR */
2963 /* If there is a quota warning threshold and we are have crossed it with this
2964 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2967 if (!disable_quota && THRESHOLD_CHECK)
2969 off_t threshold = ob->quota_warn_threshold_value;
2970 if (ob->quota_warn_threshold_is_percent)
2971 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
2973 debug_printf("quota = " OFF_T_FMT
2974 " threshold = " OFF_T_FMT
2975 " old size = " OFF_T_FMT
2976 " message size = %d\n",
2977 ob->quota_value, threshold, mailbox_size,
2979 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2980 addr->special_action = SPECIAL_WARN;
2982 /******* You might think that the test ought to be this:
2984 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2985 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2987 * (indeed, I was sent a patch with that in). However, it is possible to
2988 * have a warning threshold without actually imposing a quota, and I have
2989 * therefore kept Exim backwards compatible.
2994 /* Handle error while writing the file. Control should come here directly after
2995 the error, with the reason in errno. In the case of expansion failure in prefix
2996 or suffix, it will be ERRNO_EXPANDFAIL. */
3000 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
3002 /* Save the error number. If positive, it will ultimately cause a strerror()
3003 call to generate some text. */
3005 addr->basic_errno = errno;
3007 /* For system or Exim quota excession, or disk full, set more_errno to the
3008 time since the file was last read. If delivery was into a directory, the
3009 time since last read logic is not relevant, in general. However, for maildir
3010 deliveries we can approximate it by looking at the last modified time of the
3011 "new" subdirectory. Since Exim won't be adding new messages, a change to the
3012 "new" subdirectory implies that an MUA has moved a message from there to the
3015 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
3017 addr->more_errno = 0;
3018 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
3020 #ifdef SUPPORT_MAILDIR
3021 else if (mbformat == mbf_maildir)
3023 struct stat statbuf;
3024 if (Ustat("new", &statbuf) < 0)
3026 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
3027 "stat error %d for \"new\": %s\n", errno, strerror(errno));
3029 else /* Want a repeatable time when in test harness */
3031 addr->more_errno = running_in_test_harness? 10 :
3032 (int)time(NULL) - statbuf.st_mtime;
3035 debug_printf("maildir: time since \"new\" directory modified = %s\n",
3036 readconf_printtime(addr->more_errno));
3038 #endif /* SUPPORT_MAILDIR */
3041 /* Handle system quota excession. Add an explanatory phrase for the error
3042 message, since some systems don't have special quota-excession errors,
3043 and on those that do, "quota" doesn't always mean anything to the user. */
3045 if (errno == errno_quota)
3048 addr->message = string_sprintf("mailbox is full "
3049 "(quota exceeded while writing to file %s)", filename);
3051 addr->message = string_sprintf("mailbox is full");
3053 addr->user_message = US"mailbox is full";
3054 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3056 isdirectory? US"" : US": time since file read = ",
3057 isdirectory? US"" : readconf_printtime(addr->more_errno));
3060 /* Handle Exim's own quota-imposition */
3062 else if (errno == ERRNO_EXIMQUOTA)
3064 addr->message = string_sprintf("mailbox is full "
3065 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3067 addr->user_message = US"mailbox is full";
3068 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3069 filecount_msg, dataname,
3070 isdirectory? US"" : US": time since file read = ",
3071 isdirectory? US"" : readconf_printtime(addr->more_errno));
3074 /* Handle a process failure while writing via a filter; the return
3075 from child_close() is in more_errno. */
3077 else if (errno == ERRNO_FILTER_FAIL)
3080 addr->message = string_sprintf("transport filter process failed (%d) "
3081 "while writing to %s%s", addr->more_errno, dataname,
3082 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
3085 /* Handle failure to expand header changes */
3087 else if (errno == ERRNO_CHHEADER_FAIL)
3091 string_sprintf("failed to expand headers_add or headers_remove while "
3092 "writing to %s: %s", dataname, expand_string_message);
3095 /* Handle failure to complete writing of a data block */
3097 else if (errno == ERRNO_WRITEINCOMPLETE)
3099 addr->message = string_sprintf("failed to write data block while "
3100 "writing to %s", dataname);
3103 /* Handle length mismatch on MBX copying */
3106 else if (errno == ERRNO_MBXLENGTH)
3108 addr->message = string_sprintf("length mismatch while copying MBX "
3109 "temporary file to %s", dataname);
3111 #endif /* SUPPORT_MBX */
3113 /* For other errors, a general-purpose explanation, if the message is
3116 else if (addr->message == NULL)
3117 addr->message = string_sprintf("error while writing to %s", dataname);
3119 /* For a file, reset the file size to what it was before we started, leaving
3120 the last modification time unchanged, so it will get reset also. All systems
3121 investigated so far have ftruncate(), whereas not all have the F_FREESP
3122 fcntl() call (BSDI & FreeBSD do not). */
3124 if (!isdirectory && ftruncate(fd, saved_size))
3125 DEBUG(D_transport) debug_printf("Error restting file size\n");
3128 /* Handle successful writing - we want the modification time to be now for
3129 appended files. Remove the default backstop error number. For a directory, now
3130 is the time to rename the file with a unique name. As soon as such a name
3131 appears it may get used by another process, so we close the file first and
3132 check that all is well. */
3136 times.modtime = time(NULL);
3137 addr->basic_errno = 0;
3139 /* Handle the case of writing to a new file in a directory. This applies
3140 to all single-file formats - maildir, mailstore, and "smail format". */
3144 if (fstat(fd, &statbuf) < 0)
3146 addr->basic_errno = errno;
3147 addr->message = string_sprintf("while fstatting opened message file %s",
3152 else if (close(fd) < 0)
3154 addr->basic_errno = errno;
3155 addr->message = string_sprintf("close() error for %s",
3156 (ob->mailstore_format)? dataname : filename);
3160 /* File is successfully written and closed. Arrange to rename it. For the
3161 different kinds of single-file delivery, some games can be played with the
3162 name. The message size is by this time set to the accurate value so that
3163 its value can be used in expansions. */
3167 uschar *renamename = newname;
3170 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3172 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3173 situation. The name is built by expanding the directory_file option, and
3174 we make the inode number available for use in this. The expansion was
3175 checked for syntactic validity above, before we wrote the file.
3177 We have to be careful here, in case the file name exists. (In the other
3178 cases, the names used are constructed to be unique.) The rename()
3179 function just replaces an existing file - we don't want that! So instead
3180 of calling rename(), we must use link() and unlink().
3182 In this case, if the link fails because of an existing file, we wait
3183 for one second and try the expansion again, to see if it produces a
3184 different value. Do this up to 5 times unless the name stops changing.
3185 This makes it possible to build values that are based on the time, and
3186 still cope with races from multiple simultaneous deliveries. */
3188 if (newname == NULL)
3192 uschar *old_renameleaf = US"";
3194 for (i = 0; ; sleep(1), i++)
3196 deliver_inode = statbuf.st_ino;
3197 renameleaf = expand_string(ob->dirfilename);
3200 if (renameleaf == NULL)
3202 addr->transport_return = PANIC;
3203 addr->message = string_sprintf("Expansion of \"%s\" "
3204 "(directory_file for %s transport) failed: %s",
3205 ob->dirfilename, tblock->name, expand_string_message);
3209 renamename = string_sprintf("%s/%s", path, renameleaf);
3210 if (Ulink(filename, renamename) < 0)
3212 DEBUG(D_transport) debug_printf("link failed: %s\n",
3214 if (errno != EEXIST || i >= 4 ||
3215 Ustrcmp(renameleaf, old_renameleaf) == 0)
3217 addr->basic_errno = errno;
3218 addr->message = string_sprintf("while renaming %s as %s",
3219 filename, renamename);
3223 old_renameleaf = renameleaf;
3224 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3233 } /* re-expand loop */
3234 } /* not mailstore or maildir */
3236 /* For maildir and mailstore formats, the new name was created earlier,
3237 except that for maildir, there is the possibility of adding a "tag" on
3238 the end of the name by expanding the value of nametag. This usually
3239 includes a reference to the message size. The expansion of nametag was
3240 checked above, before the file was opened. It either succeeded, or
3241 provoked a soft failure. So any failure here can be treated as soft.
3242 Ignore non-printing characters and / and put a colon at the start if the
3243 first character is alphanumeric. */
3247 if (nametag != NULL)
3249 uschar *iptr = expand_string(nametag);
3252 uschar *etag = store_get(Ustrlen(iptr) + 2);
3253 uschar *optr = etag;
3256 if (mac_isgraph(*iptr) && *iptr != '/')
3258 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3264 renamename = string_sprintf("%s%s", newname, etag);
3268 /* Do the rename. If the name is too long and a tag exists, try again
3271 if (Urename(filename, renamename) < 0 &&
3272 (nametag == NULL || errno != ENAMETOOLONG ||
3273 (renamename = newname, Urename(filename, renamename) < 0)))
3275 addr->basic_errno = errno;
3276 addr->message = string_sprintf("while renaming %s as %s",
3277 filename, renamename);
3281 /* Rename succeeded */
3285 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3287 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3289 } /* maildir or mailstore */
3290 } /* successful write + close */
3292 } /* write success */
3295 /* For a file, restore the last access time (atime), and set the modification
3296 time as required - changed if write succeeded, unchanged if not. */
3298 if (!isdirectory) utime(CS filename, ×);
3300 /* Notify comsat if configured to do so. It only makes sense if the configured
3301 file is the one that the comsat daemon knows about. */
3303 if (ob->notify_comsat && yield == OK && deliver_localpart != NULL)
3304 notify_comsat(deliver_localpart, saved_size);
3306 /* Pass back the final return code in the address structure */
3309 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3310 yield, addr->basic_errno, addr->more_errno);
3312 addr->transport_return = yield;
3314 /* Close the file, which will release the fcntl lock. For a directory write it
3315 is closed above, except in cases of error which goto RETURN, when we also need
3316 to remove the original file(s). For MBX locking, if all has gone well, before
3317 closing the file, see if we can get an exclusive lock on it, in which case we
3318 can unlink the /tmp lock file before closing it. This is always a non-blocking
3319 lock; there's no need to wait if we can't get it. If everything has gone right
3320 but close fails, defer the message. Then unlink the lock file, if present. This
3321 point in the code is jumped to from a number of places when errors are
3322 detected, in order to get the file closed and the lock file tidied away. */
3327 if (mbx_lockfd >= 0)
3329 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3330 ob->use_flock, 0) >= 0)
3333 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3334 Uunlink(mbx_lockname);
3336 (void)close(mbx_lockfd);
3338 #endif /* SUPPORT_MBX */
3340 if (fd >= 0 && close(fd) < 0 && yield == OK)
3342 addr->basic_errno = errno;
3343 addr->message = string_sprintf("while closing %s", filename);
3344 addr->transport_return = DEFER;
3347 if (hd >= 0) Uunlink(lockname);
3349 /* We get here with isdirectory and filename set only in error situations. */
3351 if (isdirectory && filename != NULL)
3354 if (dataname != filename) Uunlink(dataname);
3357 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3358 file name relies on time + pid. We must not allow the process to finish until
3359 the clock has move on by at least one microsecond. Usually we expect this
3360 already to be the case, but machines keep getting faster... */
3362 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3364 /* A return of FALSE means that if there was an error, a common error was
3365 put in the first address of a batch. */
3370 /* End of transport/appendfile.c */