1 /* $Cambridge: exim/src/src/transports/appendfile.c,v 1.17 2006/04/25 14:02:30 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2006 */
8 /* See the file NOTICE for conditions of use and distribution. */
12 #include "appendfile.h"
14 #ifdef SUPPORT_MAILDIR
15 #include "tf_maildir.h"
19 /* Encodings for mailbox formats, and their names. MBX format is actually
20 supported only if SUPPORT_MBX is set. */
22 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
24 static char *mailbox_formats[] = {
25 "unix", "mbx", "smail", "maildir", "mailstore" };
28 /* Check warn threshold only if quota size set or not a percentage threshold
29 percentage check should only be done if quota > 0 */
31 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
32 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
35 /* Options specific to the appendfile transport. They must be in alphabetic
36 order (note that "_" comes before the lower case letters). Some of them are
37 stored in the publicly visible instance block - these are flagged with the
40 optionlist appendfile_transport_options[] = {
41 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
42 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
43 { "*set_use_flock_lock",opt_bool | opt_hidden,
44 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
45 { "*set_use_lockfile", opt_bool | opt_hidden,
46 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
48 { "*set_use_mbx_lock", opt_bool | opt_hidden,
49 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
51 { "allow_fifo", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
53 { "allow_symlink", opt_bool,
54 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
55 { "batch_id", opt_stringptr | opt_public,
56 (void *)offsetof(transport_instance, batch_id) },
57 { "batch_max", opt_int | opt_public,
58 (void *)offsetof(transport_instance, batch_max) },
59 { "check_group", opt_bool,
60 (void *)offsetof(appendfile_transport_options_block, check_group) },
61 { "check_owner", opt_bool,
62 (void *)offsetof(appendfile_transport_options_block, check_owner) },
63 { "check_string", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, check_string) },
65 { "create_directory", opt_bool,
66 (void *)offsetof(appendfile_transport_options_block, create_directory) },
67 { "create_file", opt_stringptr,
68 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
69 { "directory", opt_stringptr,
70 (void *)offsetof(appendfile_transport_options_block, dirname) },
71 { "directory_file", opt_stringptr,
72 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
73 { "directory_mode", opt_octint,
74 (void *)offsetof(appendfile_transport_options_block, dirmode) },
75 { "escape_string", opt_stringptr,
76 (void *)offsetof(appendfile_transport_options_block, escape_string) },
77 { "file", opt_stringptr,
78 (void *)offsetof(appendfile_transport_options_block, filename) },
79 { "file_format", opt_stringptr,
80 (void *)offsetof(appendfile_transport_options_block, file_format) },
81 { "file_must_exist", opt_bool,
82 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
83 { "lock_fcntl_timeout", opt_time,
84 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
85 { "lock_flock_timeout", opt_time,
86 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
87 { "lock_interval", opt_time,
88 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
89 { "lock_retries", opt_int,
90 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
91 { "lockfile_mode", opt_octint,
92 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
93 { "lockfile_timeout", opt_time,
94 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
95 { "mailbox_filecount", opt_stringptr,
96 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
97 { "mailbox_size", opt_stringptr,
98 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
99 #ifdef SUPPORT_MAILDIR
100 { "maildir_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
102 { "maildir_quota_directory_regex", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
104 { "maildir_retries", opt_int,
105 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
106 { "maildir_tag", opt_stringptr,
107 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
108 { "maildir_use_size_file", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
110 #endif /* SUPPORT_MAILDIR */
111 #ifdef SUPPORT_MAILSTORE
112 { "mailstore_format", opt_bool,
113 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
114 { "mailstore_prefix", opt_stringptr,
115 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
116 { "mailstore_suffix", opt_stringptr,
117 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
118 #endif /* SUPPORT_MAILSTORE */
120 { "mbx_format", opt_bool,
121 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
122 #endif /* SUPPORT_MBX */
123 { "message_prefix", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
125 { "message_suffix", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
127 { "mode", opt_octint,
128 (void *)offsetof(appendfile_transport_options_block, mode) },
129 { "mode_fail_narrower",opt_bool,
130 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
131 { "notify_comsat", opt_bool,
132 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
133 { "quota", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota) },
135 { "quota_directory", opt_stringptr,
136 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
137 { "quota_filecount", opt_stringptr,
138 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
139 { "quota_is_inclusive", opt_bool,
140 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
141 { "quota_size_regex", opt_stringptr,
142 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
143 { "quota_warn_message", opt_stringptr | opt_public,
144 (void *)offsetof(transport_instance, warn_message) },
145 { "quota_warn_threshold", opt_stringptr,
146 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
147 { "use_bsmtp", opt_bool,
148 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
149 { "use_crlf", opt_bool,
150 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
151 { "use_fcntl_lock", opt_bool_set,
152 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
153 { "use_flock_lock", opt_bool_set,
154 (void *)offsetof(appendfile_transport_options_block, use_flock) },
155 { "use_lockfile", opt_bool_set,
156 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
158 { "use_mbx_lock", opt_bool_set,
159 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
160 #endif /* SUPPORT_MBX */
163 /* Size of the options list. An extern variable has to be used so that its
164 address can appear in the tables drtables.c. */
166 int appendfile_transport_options_count =
167 sizeof(appendfile_transport_options)/sizeof(optionlist);
169 /* Default private options block for the appendfile transport. */
171 appendfile_transport_options_block appendfile_transport_option_defaults = {
174 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
175 NULL, /* message_prefix (default reset in init if not bsmtp) */
176 NULL, /* message_suffix (ditto) */
177 US"anywhere", /* create_file_string (string value for create_file) */
179 NULL, /* quota_directory */
180 NULL, /* quota_filecount */
181 NULL, /* quota_size_regex */
182 NULL, /* quota_warn_threshold */
183 NULL, /* mailbox_size_string */
184 NULL, /* mailbox_filecount_string */
185 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
186 NULL, /* maildir_tag */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
193 0, /* quota_warn_threshold_value */
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
196 0, /* quota_filecount_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE /* quota_is_inclusive */
236 /*************************************************
237 * Setup entry point *
238 *************************************************/
240 /* Called for each delivery in the privileged state, just before the uid/gid
241 are changed and the main entry point is called. We use this function to
242 expand any quota settings, so that it can access files that may not be readable
243 by the user. It is also used to pick up external mailbox size information, if
247 tblock points to the transport instance
248 addrlist addresses about to be delivered (not used)
249 dummy not used (doesn't pass back data)
250 uid the uid that will be set (not used)
251 gid the gid that will be set (not used)
252 errmsg where to put an error message
254 Returns: OK, FAIL, or DEFER
258 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
259 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
261 appendfile_transport_options_block *ob =
262 (appendfile_transport_options_block *)(tblock->options_block);
263 uschar *q = ob->quota;
264 double default_value = 0.0;
267 addrlist = addrlist; /* Keep picky compilers happy */
272 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
275 for (i = 0; i < 5; i++)
278 uschar *which = NULL;
280 if (q == NULL) d = default_value; else
283 uschar *s = expand_string(q);
287 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
288 "%s", q, tblock->name, expand_string_message);
289 return search_find_defer? DEFER : FAIL;
292 d = Ustrtod(s, &rest);
294 /* Handle following characters K, M, G, %, the latter being permitted
295 for quota_warn_threshold only. A threshold with no quota setting is
298 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
299 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
300 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
301 else if (*rest == '%' && i == 2)
303 if (ob->quota_value <= 0 && !ob->maildir_use_size_file) d = 0;
304 else if ((int)d < 0 || (int)d > 100)
306 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
307 " for %s transport", (int)d, tblock->name);
310 ob->quota_warn_threshold_is_percent = TRUE;
314 while (isspace(*rest)) rest++;
318 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
319 "in %s transport", s, q, tblock->name);
324 /* Set each value, checking for possible overflow. */
329 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4) which = US"quota";
330 ob->quota_value = (off_t)d;
331 q = ob->quota_filecount;
335 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"quota_filecount";
336 ob->quota_filecount_value = (int)d;
337 q = ob->quota_warn_threshold;
341 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
342 which = US"quota_warn_threshold";
343 ob->quota_warn_threshold_value = (off_t)d;
344 q = ob->mailbox_size_string;
345 default_value = -1.0;
349 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
350 which = US"mailbox_size";;
351 ob->mailbox_size_value = (off_t)d;
352 q = ob->mailbox_filecount_string;
356 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"mailbox_filecount";
357 ob->mailbox_filecount_value = (int)d;
363 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
364 "%s transport", which, d, tblock->name);
374 /*************************************************
375 * Initialization entry point *
376 *************************************************/
378 /* Called for each instance, after its options have been read, to
379 enable consistency checks to be done, or anything else that needs
383 appendfile_transport_init(transport_instance *tblock)
385 appendfile_transport_options_block *ob =
386 (appendfile_transport_options_block *)(tblock->options_block);
388 /* Set up the setup entry point, to be called in the privileged state */
390 tblock->setup = appendfile_transport_setup;
392 /* Lock_retries must be greater than zero */
394 if (ob->lock_retries == 0) ob->lock_retries = 1;
396 /* Only one of a file name or directory name must be given. */
398 if (ob->filename != NULL && ob->dirname != NULL)
399 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
400 "only one of \"file\" or \"directory\" can be specified", tblock->name);
402 /* If a file name was specified, neither quota_filecount nor quota_directory
405 if (ob->filename != NULL)
407 if (ob->quota_filecount != NULL)
408 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
409 "quota_filecount must not be set without \"directory\"", tblock->name);
410 if (ob->quota_directory != NULL)
411 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
412 "quota_directory must not be set without \"directory\"", tblock->name);
415 /* The default locking depends on whether MBX is set or not. Change the
416 built-in default if none of the lock options has been explicitly set. At least
417 one form of locking is required in all cases, but mbx locking changes the
418 meaning of fcntl and flock locking. */
420 /* Not all operating systems provide flock(). For those that do, if flock is
421 requested, the default for fcntl is FALSE. */
426 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
427 "flock() support was not available in the operating system when this "
428 "binary was built", tblock->name);
429 #endif /* NO_FLOCK */
430 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
436 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
437 !ob->set_use_mbx_lock)
439 ob->use_lockfile = ob->use_flock = FALSE;
440 ob->use_mbx_lock = ob->use_fcntl = TRUE;
442 else if (ob->use_mbx_lock)
444 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
445 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
446 if (!ob->set_use_flock) ob->use_flock = FALSE;
447 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
450 #endif /* SUPPORT_MBX */
452 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
453 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
454 "no locking configured", tblock->name);
456 /* Unset timeouts for non-used locking types */
458 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
459 if (!ob->use_flock) ob->lock_flock_timeout = 0;
461 /* If a directory name was specified, only one of maildir or mailstore may be
462 specified, and if quota_filecount or quota_directory is given, quota must
465 if (ob->dirname != NULL)
467 if (ob->maildir_format && ob->mailstore_format)
468 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
469 "only one of maildir and mailstore may be specified", tblock->name);
470 if (ob->quota_filecount != NULL && ob->quota == NULL)
471 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
472 "quota must be set if quota_filecount is set", tblock->name);
473 if (ob->quota_directory != NULL && ob->quota == NULL)
474 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
475 "quota must be set if quota_directory is set", tblock->name);
478 /* If a fixed uid field is set, then a gid field must also be set. */
480 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
481 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
482 "user set without group for the %s transport", tblock->name);
484 /* If "create_file" is set, check that a valid option is given, and set the
487 if (ob->create_file_string != NULL)
490 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
491 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
493 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
494 value = create_inhome;
496 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
497 "invalid value given for \"file_create\" for the %s transport: %s",
498 tblock->name, ob->create_file_string);
499 ob->create_file = value;
502 /* If quota_warn_threshold is set, set up default for warn_message. It may
503 not be used if the actual threshold for a given delivery ends up as zero,
504 of if it's given as a percentage and there's no quota setting. */
506 if (ob->quota_warn_threshold != NULL)
508 if (tblock->warn_message == NULL) tblock->warn_message = US
509 "To: $local_part@$domain\n"
510 "Subject: Your mailbox\n\n"
511 "This message is automatically created by mail delivery software (Exim).\n\n"
512 "The size of your mailbox has exceeded a warning threshold that is\n"
513 "set by the system administrator.\n";
516 /* If batch SMTP is set, force the check and escape strings, and arrange that
517 headers are also escaped. */
521 ob->check_string = US".";
522 ob->escape_string = US"..";
523 ob->options |= topt_escape_headers;
526 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
527 insert default values for for the affixes and the check/escape strings. */
529 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
531 if (ob->message_prefix == NULL) ob->message_prefix =
532 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
533 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
534 if (ob->check_string == NULL) ob->check_string = US"From ";
535 if (ob->escape_string == NULL) ob->escape_string = US">From ";
539 /* Set up the bitwise options for transport_write_message from the various
540 driver options. Only one of body_only and headers_only can be set. */
543 (tblock->body_only? topt_no_headers : 0) |
544 (tblock->headers_only? topt_no_body : 0) |
545 (tblock->return_path_add? topt_add_return_path : 0) |
546 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
547 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
548 ((ob->use_crlf || ob->mbx_format)? topt_use_crlf : 0);
553 /*************************************************
555 *************************************************/
557 /* The comsat daemon is the thing that provides asynchronous notification of
558 the arrival of local messages, if requested by the user by "biff y". It is a
559 BSD thing that uses a TCP/IP protocol for communication. A message consisting
560 of the text "user@offset" must be sent, where offset is the place in the
561 mailbox where new mail starts. There is no scope for telling it which file to
562 look at, which makes it a less than useful if mail is being delivered into a
563 non-standard place such as the user's home directory. In fact, it doesn't seem
564 to pay much attention to the offset.
568 offset offset in mailbox
574 notify_comsat(uschar *user, off_t offset)
581 DEBUG(D_transport) debug_printf("notify_comsat called\n");
583 sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
585 if ((sp = getservbyname("biff", "udp")) == NULL)
587 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
591 host.name = US"localhost";
595 /* This code is all set up to look up "localhost" and use all its addresses
596 until one succeeds. However, it appears that at least on some systems, comsat
597 doesn't listen on the ::1 address. So for the moment, just force the address to
598 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
602 if (host_find_byname(&host, NULL, NULL, FALSE) == HOST_FIND_FAILED)
604 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
609 host.address = US"127.0.0.1";
612 for (h = &host; h != NULL; h = h->next)
615 int host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
617 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
619 sock = ip_socket(SOCK_DGRAM, host_af);
620 if (sock < 0) continue;
622 /* Connect never fails for a UDP socket, so don't set a timeout. */
624 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0);
625 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
630 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
637 /*************************************************
638 * Check the format of a file *
639 *************************************************/
641 /* This function is called when file_format is set, to check that an existing
642 file has the right format. The format string contains text/transport pairs. The
643 string matching is literal. we just read big_buffer_size bytes, because this is
644 all about the first few bytes of a file.
648 tblock the transport block
649 addr the address block - for inserting error data
651 Returns: pointer to the required transport, or NULL
655 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
658 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
660 int len = read(cfd, data, sizeof(data));
664 DEBUG(D_transport) debug_printf("checking file format\n");
666 /* An empty file matches the current transport */
668 if (len == 0) return tblock;
670 /* Search the formats for a match */
672 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size))!= NULL)
674 int slen = Ustrlen(s);
675 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
676 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
679 transport_instance *tt;
680 for (tt = transports; tt != NULL; tt = tt->next)
681 if (Ustrcmp(tp, tt->name) == 0)
684 debug_printf("file format -> %s transport\n", tt->name);
687 addr->basic_errno = ERRNO_BADTRANSPORT;
688 addr->message = string_sprintf("%s transport (for %.*s format) not found",
694 /* Failed to find a match */
696 addr->basic_errno = ERRNO_FORMATUNKNOWN;
697 addr->message = US"mailbox file format unrecognized";
704 /*************************************************
705 * Check directory's files for quota *
706 *************************************************/
708 /* This function is called if quota is set for one of the delivery modes that
709 delivers into a specific directory. It scans the directory and stats all the
710 files in order to get a total size and count. This is an expensive thing to do,
711 but some people are prepared to bear the cost. Alternatively, if size_regex is
712 set, it is used as a regex to try to extract the size from the file name, a
713 strategy that some people use on maildir files on systems where the users have
716 The function is global, because it is also called from tf_maildir.c for maildir
717 folders (which should contain only regular files).
719 Note: Any problems can be written to debugging output, but cannot be written to
720 the log, because we are running as an unprivileged user here.
723 dirname the name of the directory
724 countptr where to add the file count (because this function recurses)
725 regex a compiled regex to get the size from a name
727 Returns: the sum of the sizes of the stattable files
728 zero if the directory cannot be opened
732 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
736 int count = *countptr;
740 dir = opendir(CS dirname);
741 if (dir == NULL) return 0;
743 while ((ent = readdir(dir)) != NULL)
745 uschar *name = US ent->d_name;
748 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
752 /* If there's a regex, try to find the size using it */
757 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
760 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
761 if (endptr == name + ovector[3])
765 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
771 debug_printf("check_dir_size: regex did not match %s\n", name);
774 /* No regex or no match for the regex, or captured non-digits */
776 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
779 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
784 if (Ustat(buffer, &statbuf) < 0)
787 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
792 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
793 sum += statbuf.st_size;
794 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
795 sum += check_dir_size(buffer, &count, regex);
800 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
810 /*************************************************
811 * Apply a lock to a file descriptor *
812 *************************************************/
814 /* This function applies a lock to a file descriptor, using a blocking or
815 non-blocking lock, depending on the timeout value. It can apply either or
816 both of a fcntl() and a flock() lock. However, not all OS support flock();
817 for those that don't, the use_flock option cannot be set.
820 fd the file descriptor
821 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
822 fcntl() format); the flock() type is deduced if needed
823 dofcntl do fcntl() locking
824 fcntltime non-zero to use blocking fcntl()
825 doflock do flock() locking
826 flocktime non-zero to use blocking flock()
828 Returns: yield of the fcntl() or flock() call, with errno preserved;
829 sigalrm_seen set if there has been a timeout
833 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
838 struct flock lock_data;
839 lock_data.l_type = fcntltype;
840 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
842 sigalrm_seen = FALSE;
849 yield = fcntl(fd, F_SETLKW, &lock_data);
854 else yield = fcntl(fd, F_SETLK, &lock_data);
858 if (doflock && (yield >= 0))
860 int flocktype = (fcntltype == F_WRLCK)? LOCK_EX : LOCK_SH;
864 yield = flock(fd, flocktype);
869 else yield = flock(fd, flocktype | LOCK_NB);
871 #endif /* NO_FLOCK */
880 /*************************************************
881 * Copy message into MBX mailbox *
882 *************************************************/
884 /* This function is called when a message intended for a MBX mailbox has been
885 written to a temporary file. We can now get the size of the message and then
886 copy it in MBX format to the mailbox.
889 to_fd fd to write to (the real mailbox)
890 from_fd fd to read from (the temporary file)
891 saved_size current size of mailbox
893 Returns: OK if all went well, DEFER otherwise, with errno preserved
894 the number of bytes written are added to transport_count
895 by virtue of calling transport_write_block()
898 /* Values taken from c-client */
900 #define MBX_HDRSIZE 2048
901 #define MBX_NUSERFLAGS 30
904 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
910 /* If the current mailbox size is zero, write a header block */
916 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
917 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
918 (long int)time(NULL));
919 for (i = 0; i < MBX_NUSERFLAGS; i++)
920 sprintf (CS(s += Ustrlen(s)), "\015\012");
921 if (!transport_write_block (to_fd, deliver_out_buffer, MBX_HDRSIZE))
925 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
927 /* Now construct the message's header from the time and the RFC822 file
928 size, including CRLFs, which is the size of the input (temporary) file. */
930 if (fstat(from_fd, &statbuf) < 0) return DEFER;
931 size = statbuf.st_size;
933 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
934 tod_stamp(tod_mbx), size, 0L, 0, 0);
935 used = Ustrlen(deliver_out_buffer);
937 /* Rewind the temporary file, and copy it over in chunks. */
939 lseek(from_fd, 0 , SEEK_SET);
943 int len = read(from_fd, deliver_out_buffer + used,
944 DELIVER_OUT_BUFFER_SIZE - used);
947 if (len == 0) errno = ERRNO_MBXLENGTH;
950 if (!transport_write_block(to_fd, deliver_out_buffer, used + len))
958 #endif /* SUPPORT_MBX */
962 /*************************************************
963 * Check creation is permitted *
964 *************************************************/
966 /* This function checks whether a given file name is permitted to be created,
967 as controlled by the create_file option. If no home directory is set, however,
968 we can't do any tests.
971 filename the file name
972 create_file the ob->create_file option
974 Returns: TRUE if creation is permitted
978 check_creation(uschar *filename, int create_file)
982 if (deliver_home != NULL && create_file != create_anywhere)
984 int len = Ustrlen(deliver_home);
985 uschar *file = filename;
987 while (file[0] == '/' && file[1] == '/') file++;
988 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
989 ( Ustrchr(file+len+2, '/') != NULL &&
991 create_file != create_belowhome ||
992 Ustrstr(file+len, "/../") != NULL
997 /* If yield is TRUE, the file name starts with the home directory, and does
998 not contain any instances of "/../" in the "belowhome" case. However, it may
999 still contain symbolic links. We can check for this by making use of
1000 realpath(), which most Unixes seem to have (but make it possible to cut this
1001 out). We can't just use realpath() on the whole file name, because we know
1002 the file itself doesn't exist, and intermediate directories may also not
1003 exist. What we want to know is the real path of the longest existing part of
1004 the path. That must match the home directory's beginning, whichever is the
1008 if (yield && create_file == create_belowhome)
1010 uschar *slash, *next;
1012 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
1013 rp == NULL && slash > file; /* Stop if reached beginning */
1017 rp = US realpath(CS file, CS big_buffer);
1018 next = Ustrrchr(file, '/');
1022 /* If rp == NULL it means that none of the relevant directories exist.
1023 This is not a problem here - it means that no symbolic links can exist,
1024 which is all we are worried about. Otherwise, we must compare it
1025 against the start of the home directory. However, that may itself
1026 contain symbolic links, so we have to "realpath" it as well, if
1031 uschar hdbuffer[PATH_MAX+1];
1032 uschar *rph = deliver_home;
1033 int rlen = Ustrlen(big_buffer);
1035 rp = US realpath(CS deliver_home, CS hdbuffer);
1042 if (rlen > len) rlen = len;
1043 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1046 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1047 big_buffer, deliver_home);
1051 #endif /* NO_REALPATH */
1059 /*************************************************
1060 * Main entry point *
1061 *************************************************/
1063 /* See local README for general interface details. This transport always
1064 returns FALSE, indicating that the status which has been placed in the first
1065 address should be copied to any other addresses in a batch.
1067 Appendfile delivery is tricky and has led to various security problems in other
1068 mailers. The logic used here is therefore laid out in some detail. When this
1069 function is called, we are running in a subprocess which has had its gid and
1070 uid set to the appropriate values. Therefore, we cannot write directly to the
1071 exim logs. Any errors must be handled by setting appropriate return codes.
1072 Note that the default setting for addr->transport_return is DEFER, so it need
1073 not be set unless some other value is required.
1075 The code below calls geteuid() rather than getuid() to get the current uid
1076 because in weird configurations not running setuid root there may be a
1077 difference. In the standard configuration, where setuid() has been used in the
1078 delivery process, there will be no difference between the uid and the euid.
1080 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1081 alias expansion. Otherwise, there must be a configured file name or
1084 The following items apply in the case when a file name (as opposed to a
1085 directory name) is given, that is, when appending to a single file:
1087 (2f) Expand the file name.
1089 (3f) If the file name is /dev/null, return success (optimization).
1091 (4f) If the file_format options is set, open the file for reading, and check
1092 that the bytes at the start of the file match one of the given strings.
1093 If the check indicates a transport other than the current one should be
1094 used, pass control to that other transport. Otherwise continue. An empty
1095 or non-existent file matches the current transport. The file is closed
1098 (5f) If a lock file is required, create it (see extensive separate comments
1099 below about the algorithm for doing this). It is important to do this
1100 before opening the mailbox if NFS is in use.
1102 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1103 details of any symbolic link.
1105 (7f) If the file already exists:
1107 Check the owner and group if necessary, and defer if they are wrong.
1109 If it is a symbolic link AND the allow_symlink option is set (NOT the
1110 default), go back to (6f) but this time use stat() instead of lstat().
1112 If it's not a regular file (or FIFO when permitted), defer delivery.
1114 Check permissions. If the required permissions are *less* than the
1115 existing ones, or supplied by the address (often by the user via filter),
1116 chmod() the file. Otherwise, defer.
1118 Save the inode number.
1120 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1122 If open fails because the file does not exist, go to (6f); on any other
1125 Check the inode number hasn't changed - I realize this isn't perfect (an
1126 inode can be reused) but it's cheap and will catch some of the races.
1128 Check it's still a regular file (or FIFO if permitted).
1130 Check that the owner and permissions haven't changed.
1132 If file_format is set, check that the file still matches the format for
1133 the current transport. If not, defer delivery.
1135 (8f) If file does not exist initially:
1137 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1138 this is via a symbolic link (only possible if allow_symlinks is set), in
1139 which case don't use O_EXCL, as it dosn't work.
1141 If open fails because the file already exists, go to (6f). To avoid
1142 looping for ever in a situation where the file is continuously being
1143 created and deleted, all of this happens inside a loop that operates
1144 lock_retries times and includes the fcntl and flock locking. If the
1145 loop completes without the file getting opened, defer and request
1146 freezing, because something really weird is happening.
1148 If open fails for any other reason, defer for subsequent delivery except
1149 when this is a file delivery resulting from an alias or forward expansion
1150 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1151 most likely a user rather than a configuration error.
1153 (9f) We now have the file checked and open for writing. If so configured, lock
1154 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1155 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1156 still fails, give up and defer delivery.
1158 (10f)Save the access time (for subsequent restoration) and the size of the
1159 file, for comsat and for re-setting if delivery fails in the middle -
1160 e.g. for quota exceeded.
1162 The following items apply in the case when a directory name is given:
1164 (2d) Create a new file in the directory using a temporary name, by opening for
1165 writing and with O_CREAT. If maildir format is being used, the file
1166 is created in a temporary subdirectory with a prescribed name. If
1167 mailstore format is being used, the envelope file is first created with a
1168 temporary name, then the data file.
1170 The following items apply in all cases:
1172 (11) We now have the file open for writing, and locked if it was given as a
1173 file name. Write the message and flush the file, unless there is a setting
1174 of the local quota option, in which case we can check for its excession
1175 without doing any writing.
1177 In the case of MBX format mailboxes, the message is first written to a
1178 temporary file, in order to get its correct length. This is then copied to
1179 the real file, preceded by an MBX header.
1181 If there is a quota error on writing, defer the address. Timeout logic
1182 will determine for how long retries are attempted. We restore the mailbox
1183 to its original length if it's a single file. There doesn't seem to be a
1184 uniform error code for quota excession (it even differs between SunOS4
1185 and some versions of SunOS5) so a system-dependent macro called
1186 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1189 For any other error (most commonly disk full), do the same.
1191 The following applies after appending to a file:
1193 (12f)Restore the atime; notify_comsat if required; close the file (which
1194 unlocks it if it was locked). Delete the lock file if it exists.
1196 The following applies after writing a unique file in a directory:
1198 (12d)For maildir format, rename the file into the new directory. For mailstore
1199 format, rename the envelope file to its correct name. Otherwise, generate
1200 a unique name from the directory_file option, and rename to that, possibly
1201 trying a few times if the file exists and re-expanding the name gives a
1204 This transport yields FAIL only when a file name is generated by an alias or
1205 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1206 All other failures return DEFER (in addr->transport_return). */
1210 appendfile_transport_entry(
1211 transport_instance *tblock, /* data for this instantiation */
1212 address_item *addr) /* address we are working on */
1214 appendfile_transport_options_block *ob =
1215 (appendfile_transport_options_block *)(tblock->options_block);
1216 struct stat statbuf;
1217 uschar *fdname = NULL;
1218 uschar *filename = NULL;
1219 uschar *hitchname = NULL;
1220 uschar *dataname = NULL;
1221 uschar *lockname = NULL;
1222 uschar *newname = NULL;
1223 uschar *nametag = NULL;
1225 uschar *filecount_msg = US"";
1227 struct utimbuf times;
1228 struct timeval msg_tv;
1229 BOOL disable_quota = FALSE;
1230 BOOL isdirectory = FALSE;
1231 BOOL isfifo = FALSE;
1232 BOOL wait_for_tick = FALSE;
1233 uid_t uid = geteuid(); /* See note above */
1234 gid_t gid = getegid();
1236 int mode = (addr->mode > 0)? addr->mode : ob->mode;
1237 off_t saved_size = -1;
1238 off_t mailbox_size = ob->mailbox_size_value;
1239 int mailbox_filecount = ob->mailbox_filecount_value;
1247 int mbx_lockfd = -1;
1248 uschar mbx_lockname[40];
1249 FILE *temp_file = NULL;
1250 #endif /* SUPPORT_MBX */
1252 #ifdef SUPPORT_MAILDIR
1253 int maildirsize_fd = -1; /* fd for maildirsize file */
1254 int maildir_save_errno;
1258 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1260 /* An "address_file" or "address_directory" transport is used to deliver to
1261 files specified via .forward or an alias file. Prior to release 4.20, the
1262 "file" and "directory" options were ignored in this case. This has been changed
1263 to allow the redirection data to specify what is in effect a folder, whose
1264 location is determined by the options on the transport.
1266 Compatibility with the case when neither option is set is retained by forcing a
1267 value for the file or directory name. A directory delivery is assumed if the
1268 last character of the path from the router is '/'.
1270 The file path is in the local part of the address, but not in the $local_part
1271 variable (that holds the parent local part). It is, however, in the
1272 $address_file variable. Below, we update the local part in the address if it
1273 changes by expansion, so that the final path ends up in the log. */
1275 if (testflag(addr, af_file) &&
1276 ob->filename == NULL &&
1277 ob->dirname == NULL)
1279 fdname = US"$address_file";
1280 if (address_file[Ustrlen(address_file)-1] == '/' ||
1281 ob->maildir_format ||
1282 ob->mailstore_format)
1286 /* Handle (a) an "address file" delivery where "file" or "directory" is
1287 explicitly set and (b) a non-address_file delivery, where one of "file" or
1288 "directory" must be set; initialization ensures that they are not both set. */
1292 fdname = ob->filename;
1295 fdname = ob->dirname;
1300 addr->transport_return = PANIC;
1301 addr->message = string_sprintf("Mandatory file or directory option "
1302 "missing from %s transport", tblock->name);
1307 /* Maildir and mailstore require a directory */
1309 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1311 addr->transport_return = PANIC;
1312 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1313 "to be specified for the %s transport",
1314 ob->maildir_format? "dir" : "store", tblock->name);
1318 path = expand_string(fdname);
1322 addr->transport_return = PANIC;
1323 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1324 "name for %s transport) failed: %s", fdname, tblock->name,
1325 expand_string_message);
1331 addr->message = string_sprintf("appendfile: file or directory name "
1332 "\"%s\" is not absolute", path);
1333 addr->basic_errno = ERRNO_NOTABSOLUTE;
1337 /* For a file delivery, make sure the local part in the address(es) is updated
1338 to the true local part. */
1340 if (testflag(addr, af_file))
1342 address_item *addr2;
1343 for (addr2 = addr; addr2 != NULL; addr2 = addr2->next)
1344 addr2->local_part = string_copy(path);
1347 /* The available mailbox formats depend on whether it is a directory or a file
1353 #ifdef SUPPORT_MAILDIR
1354 (ob->maildir_format)? mbf_maildir :
1356 #ifdef SUPPORT_MAILSTORE
1357 (ob->mailstore_format)? mbf_mailstore :
1365 (ob->mbx_format)? mbf_mbx :
1372 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1373 " warning=" OFF_T_FMT "%s\n"
1374 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1375 "maildir_use_size_file=%s\n",
1376 mode, ob->notify_comsat, ob->quota_value,
1377 ob->quota_warn_threshold_value,
1378 ob->quota_warn_threshold_is_percent? "%" : "",
1379 isdirectory? "directory" : "file",
1380 path, mailbox_formats[mbformat],
1381 (ob->message_prefix == NULL)? US"null" : string_printing(ob->message_prefix),
1382 (ob->message_suffix == NULL)? US"null" : string_printing(ob->message_suffix),
1383 (ob->maildir_use_size_file)? "yes" : "no");
1385 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1386 ob->use_lockfile? "lockfile " : "",
1387 ob->use_mbx_lock? "mbx locking (" : "",
1388 ob->use_fcntl? "fcntl " : "",
1389 ob->use_flock? "flock" : "",
1390 ob->use_mbx_lock? ")" : "");
1393 /* If the -N option is set, can't do any more. */
1398 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1400 addr->transport_return = OK;
1404 /* Handle the case of a file name. If the file name is /dev/null, we can save
1405 ourselves some effort and just give a success return right away. */
1409 BOOL use_lstat = TRUE;
1410 BOOL file_opened = FALSE;
1411 BOOL allow_creation_here = TRUE;
1413 if (Ustrcmp(path, "/dev/null") == 0)
1415 addr->transport_return = OK;
1419 /* Set the name of the file to be opened, and the file to which the data
1420 is written, and find out if we are permitted to create a non-existent file. */
1422 dataname = filename = path;
1423 allow_creation_here = check_creation(filename, ob->create_file);
1425 /* If ob->create_directory is set, attempt to create the directories in
1426 which this mailbox lives, but only if we are permitted to create the file
1427 itself. We know we are dealing with an absolute path, because this was
1430 if (ob->create_directory && allow_creation_here)
1432 uschar *p = Ustrrchr(path, '/');
1434 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1436 addr->basic_errno = errno;
1438 string_sprintf("failed to create directories for %s: %s", path,
1440 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1446 /* If file_format is set we must check that any existing file matches one of
1447 the configured formats by checking the bytes it starts with. A match then
1448 indicates a specific transport - if it is not this one, pass control to it.
1449 Otherwise carry on here. An empty or non-existent file matches the current
1450 transport. We don't need to distinguish between non-existence and other open
1451 failures because if an existing file fails to open here, it will also fail
1452 again later when O_RDWR is used. */
1454 if (ob->file_format != NULL)
1456 int cfd = Uopen(path, O_RDONLY, 0);
1459 transport_instance *tt = check_file_format(cfd, tblock, addr);
1462 /* If another transport is indicated, call it and return; if no transport
1463 was found, just return - the error data will have been set up.*/
1469 set_process_info("delivering %s to %s using %s", message_id,
1470 addr->local_part, tt->name);
1471 debug_print_string(tt->debug_string);
1472 addr->transport = tt;
1473 (tt->info->code)(tt, addr);
1480 /* The locking of mailbox files is worse than the naming of cats, which is
1481 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1482 three different names, so several different styles of locking are used.
1484 Research in other programs that lock mailboxes shows that there is no
1485 universally standard method. Having mailboxes NFS-mounted on the system that
1486 is delivering mail is not the best thing, but people do run like this,
1487 and so the code must do its best to cope.
1489 Three different locking mechanisms are supported. The initialization function
1490 checks that at least one is configured.
1494 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1495 will work over NFS. Only after that is done do we actually open the mailbox
1496 and apply locks to it (if configured).
1498 Originally, Exim got the file opened before doing anything about locking.
1499 However, a very occasional problem was observed on Solaris 2 when delivering
1500 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1501 gets remembered at open time. If another process on another host (that's
1502 important) has the file open and locked and writes to it and then releases
1503 the lock while the first process is waiting to get the lock, the first
1504 process may fail to write at the new end point of the file - despite the very
1505 definite statement about O_APPEND in the man page for write(). Experiments
1506 have reproduced this problem, but I do not know any way of forcing a host to
1507 update its attribute cache for an open NFS file. It would be nice if it did
1508 so when a lock was taken out, but this does not seem to happen. Anyway, to
1509 reduce the risk of this problem happening, we now create the lock file
1510 (if configured) *before* opening the mailbox. That will prevent two different
1511 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1512 however, but Pine at least seems to operate in the same way.
1514 Lockfiles should normally be used when NFS is involved, because of the above
1517 The logic for creating the lock file is:
1519 . The name of the lock file is <mailbox-name>.lock
1521 . First, create a "hitching post" name by adding the primary host name,
1522 current time and pid to the lock file name. This should be unique.
1524 . Create the hitching post file using WRONLY + CREAT + EXCL.
1526 . If that fails EACCES, we assume it means that the user is unable to create
1527 files in the mail spool directory. Some installations might operate in this
1528 manner, so there is a configuration option to allow this state not to be an
1529 error - we proceed to lock using fcntl only, after the file is open.
1531 . Otherwise, an error causes a deferment of the address.
1533 . Hard link the hitching post to the lock file name.
1535 . If the link succeeds, we have successfully created the lock file. Simply
1536 close and unlink the hitching post file.
1538 . If the link does not succeed, proceed as follows:
1540 o Fstat the hitching post file, and then close and unlink it.
1542 o Now examine the stat data. If the number of links to the file is exactly
1543 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1544 the return never made it back, so the link() function gave a failure
1547 . This method allows for the lock file to be created by some other process
1548 right up to the moment of the attempt to hard link it, and is also robust
1549 against NFS server crash-reboots, which would probably result in timeouts
1550 in the middle of link().
1552 . System crashes may cause lock files to get left lying around, and some means
1553 of flushing them is required. The approach of writing a pid (used by smail
1554 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1555 timeout, which seems a better approach. Since any program that writes to a
1556 mailbox using a lock file should complete its task very quickly, Pine
1557 removes lock files that are older than 5 minutes. We allow the value to be
1558 configurable on the transport.
1562 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1563 mailbox once it is open. This is done by default with a non-blocking lock.
1564 Failures to lock cause retries after a sleep, but only for a certain number
1565 of tries. A blocking lock is deliberately not used so that we don't hold the
1566 mailbox open. This minimizes the possibility of the NFS problem described
1567 under LOCK FILES above, if for some reason NFS deliveries are happening
1568 without lock files. However, the use of a non-blocking lock and sleep, though
1569 the safest approach, does not give the best performance on very busy systems.
1570 A blocking lock plus timeout does better. Therefore Exim has an option to
1571 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1572 enables the use of blocking fcntl() calls.
1576 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1577 same manner as for fcntl locking above. No-blocking/timeout is also set as
1578 above in lock_flock_timeout. Not all operating systems provide or support
1579 flock(). For those that don't (as determined by the definition of LOCK_SH in
1580 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1581 is implemented (not precisely) on top of fcntl(), which means there's no
1582 point in actually using it.
1586 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1587 then the rules used for locking in c-client are used. Exim takes out a shared
1588 lock on the mailbox file, and an exclusive lock on the file whose name is
1589 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1590 any other MBX client from getting an exclusive lock on it and expunging it.
1591 It also stops any other MBX client from unlinking the /tmp lock when it has
1594 The exclusive lock on the /tmp file prevents any other MBX client from
1595 updating the mailbox in any way. When writing is finished, if an exclusive
1596 lock on the mailbox can be obtained, indicating there are no current sharers,
1597 the /tmp file is unlinked.
1599 MBX locking can use either fcntl() or flock() locking. If neither
1600 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1601 The calls for getting these locks are by default non-blocking, as for non-mbx
1602 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1603 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1604 probably makes sense to set timeouts for any MBX deliveries. */
1607 /* Build a lock file if configured to do so - the existence of a lock
1608 file is subsequently checked by looking for a non-negative value of the
1609 file descriptor hd - even though the file is no longer open. */
1611 if (ob->use_lockfile)
1613 lockname = string_sprintf("%s.lock", filename);
1614 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1615 (unsigned int)(time(NULL)), (unsigned int)getpid());
1617 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1620 /* Lock file creation retry loop */
1622 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1625 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1629 addr->basic_errno = errno;
1631 string_sprintf("creating lock file hitching post %s "
1632 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1633 (long int)getegid());
1637 /* Attempt to hitch the hitching post to the lock file. If link()
1638 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1639 file, and get rid of the hitching post. If the number of links was 2,
1640 the link was created, despite the failure of link(). If the hitch was
1641 not successful, try again, having unlinked the lock file if it is too
1644 There's a version of Linux (2.0.27) which doesn't update its local cache
1645 of the inode after link() by default - which many think is a bug - but
1646 if the link succeeds, this code will be OK. It just won't work in the
1647 case when link() fails after having actually created the link. The Linux
1648 NFS person is fixing this; a temporary patch is available if anyone is
1649 sufficiently worried. */
1651 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1654 if (rc != 0 && statbuf.st_nlink != 2)
1656 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1657 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1659 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1662 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1666 DEBUG(D_transport) debug_printf("lock file created\n");
1670 /* Check for too many tries at creating the lock file */
1672 if (i >= ob->lock_retries)
1674 addr->basic_errno = ERRNO_LOCKFAILED;
1675 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1682 /* We now have to get the file open. First, stat() it and act on existence or
1683 non-existence. This is in a loop to handle the case of a file's being created
1684 or deleted as we watch, and also to handle retries when the locking fails.
1685 Rather than holding the file open while waiting for the fcntl() and/or
1686 flock() lock, we close and do the whole thing again. This should be safer,
1687 especially for NFS files, which might get altered from other hosts, making
1688 their cached sizes incorrect.
1690 With the default settings, no symlinks are permitted, but there is an option
1691 to permit symlinks for those sysadmins that know what they are doing.
1692 Shudder. However, insist that the initial symlink is owned by the right user.
1693 Thus lstat() is used initially; if a symlink is discovered, the loop is
1694 repeated such that stat() is used, to look at the end file. */
1696 for (i = 0; i < ob->lock_retries; i++)
1698 int sleep_before_retry = TRUE;
1699 file_opened = FALSE;
1701 if((use_lstat? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1703 /* Let's hope that failure to stat (other than non-existence) is a
1706 if (errno != ENOENT)
1708 addr->basic_errno = errno;
1709 addr->message = string_sprintf("attempting to stat mailbox %s",
1714 /* File does not exist. If it is required to pre-exist this state is an
1717 if (ob->file_must_exist)
1719 addr->basic_errno = errno;
1720 addr->message = string_sprintf("mailbox %s does not exist, "
1721 "but file_must_exist is set", filename);
1725 /* If not permitted to create this file because it isn't in or below
1726 the home directory, generate an error. */
1728 if (!allow_creation_here)
1730 addr->basic_errno = ERRNO_BADCREATE;
1731 addr->message = string_sprintf("mailbox %s does not exist, "
1732 "but creation outside the home directory is not permitted",
1737 /* Attempt to create and open the file. If open fails because of
1738 pre-existence, go round the loop again. For any other error, defer the
1739 address, except for an alias or forward generated file name with EPERM,
1740 ENOENT, or EACCES, as those are most likely to be user errors rather
1741 than Exim config errors. When a symbolic link is permitted and points
1742 to a non-existent file, we get here with use_lstat = FALSE. In this case
1743 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1744 consistency and because MBX locking requires it in order to be able to
1745 get a shared lock. */
1747 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1748 (use_lstat? O_EXCL : 0), mode);
1751 if (errno == EEXIST) continue;
1752 addr->basic_errno = errno;
1753 addr->message = string_sprintf("while creating mailbox %s",
1755 if (testflag(addr, af_file) &&
1756 (errno == EPERM || errno == ENOENT || errno == EACCES))
1757 addr->transport_return = FAIL;
1761 /* We have successfully created and opened the file. Ensure that the group
1762 and the mode are correct. */
1764 (void)Uchown(filename, uid, gid);
1765 (void)Uchmod(filename, mode);
1769 /* The file already exists. Test its type, ownership, and permissions, and
1770 save the inode for checking later. If symlinks are permitted (not the
1771 default or recommended state) it may be a symlink that already exists.
1772 Check its ownership and then look for the file at the end of the link(s).
1773 This at least prevents one user creating a symlink for another user in
1774 a sticky directory. */
1778 int oldmode = (int)statbuf.st_mode;
1779 ino_t inode = statbuf.st_ino;
1780 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1782 isfifo = FALSE; /* In case things are changing */
1784 /* Check owner if required - the default. */
1786 if (ob->check_owner && statbuf.st_uid != uid)
1788 addr->basic_errno = ERRNO_BADUGID;
1789 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1790 "(%ld != %ld)", filename,
1791 islink? " (symlink)" : "",
1792 (long int)(statbuf.st_uid), (long int)uid);
1796 /* Group is checked only if check_group is set. */
1798 if (ob->check_group && statbuf.st_gid != gid)
1800 addr->basic_errno = ERRNO_BADUGID;
1801 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1802 filename, islink? " (symlink)" : "", statbuf.st_gid, gid);
1806 /* If symlinks are permitted (not recommended), the lstat() above will
1807 have found the symlink. Its ownership has just been checked; go round
1808 the loop again, using stat() instead of lstat(). That will never yield a
1811 if (islink && ob->allow_symlink)
1814 i--; /* Don't count this time round */
1818 /* An actual file exists. Check that it is a regular file, or FIFO
1821 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1823 else if ((oldmode & S_IFMT) != S_IFREG)
1825 addr->basic_errno = ERRNO_NOTREGULAR;
1826 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1827 filename, ob->allow_fifo? " or named pipe" : "");
1831 /* If the mode is not what it would be for a newly created file, change
1832 the permissions if the mode is supplied for the address. Otherwise,
1833 reduce but do not extend the permissions. If the newly created
1834 permissions are greater than the existing permissions, don't change
1835 things when the mode is not from the address. */
1837 if ((oldmode = (oldmode & 07777)) != mode)
1839 int diffs = oldmode ^ mode;
1840 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1842 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1843 if (Uchmod(filename, mode) < 0)
1845 addr->basic_errno = errno;
1846 addr->message = string_sprintf("attempting to chmod mailbox %s",
1853 /* Mode not from address, and newly-created permissions are greater
1854 than existing permissions. Default is to complain, but it can be
1855 configured to go ahead and try to deliver anyway if that's what
1856 the administration wants. */
1858 else if (ob->mode_fail_narrower)
1860 addr->basic_errno = ERRNO_BADMODE;
1861 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1862 "(%o expected)", filename, oldmode, mode);
1867 /* We are happy with the existing file. Open it, and then do further
1868 tests to ensure that it is the same file that we were just looking at.
1869 If the file does not now exist, restart this loop, going back to using
1870 lstat again. For an NFS error, just defer; other opening errors are
1871 more serious. The file is opened RDWR so that its format can be checked,
1872 and also MBX locking requires the use of a shared (read) lock. However,
1873 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1874 reading the pipe. */
1876 fd = Uopen(filename, isfifo? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1880 if (errno == ENOENT)
1885 addr->basic_errno = errno;
1888 addr->message = string_sprintf("while opening named pipe %s "
1889 "(could mean no process is reading it)", filename);
1891 else if (errno != EWOULDBLOCK)
1893 addr->message = string_sprintf("while opening mailbox %s", filename);
1898 /* This fstat really shouldn't fail, as we have an open file! There's a
1899 dilemma here. We use fstat in order to be sure we are peering at the file
1900 we have got open. However, that won't tell us if the file was reached
1901 via a symbolic link. We checked this above, but there is a race exposure
1902 if the link was created between the previous lstat and the open. However,
1903 it would have to be created with the same inode in order to pass the
1904 check below. If ob->allow_symlink is set, causing the use of stat rather
1905 than lstat above, symbolic links may be there anyway, and the checking is
1908 if (fstat(fd, &statbuf) < 0)
1910 addr->basic_errno = errno;
1911 addr->message = string_sprintf("attempting to stat open mailbox %s",
1916 /* Check the inode; this is isn't a perfect check, but gives some
1919 if (inode != statbuf.st_ino)
1921 addr->basic_errno = ERRNO_INODECHANGED;
1922 addr->message = string_sprintf("opened mailbox %s inode number changed "
1923 "from %d to %ld", filename, inode, statbuf.st_ino);
1924 addr->special_action = SPECIAL_FREEZE;
1928 /* Check it's still a regular file or FIFO, and the uid, gid, and
1929 permissions have not changed. */
1931 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1932 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1934 addr->basic_errno = ERRNO_NOTREGULAR;
1936 string_sprintf("opened mailbox %s is no longer a %s", filename,
1937 isfifo? "named pipe" : "regular file");
1938 addr->special_action = SPECIAL_FREEZE;
1942 if ((ob->check_owner && statbuf.st_uid != uid) ||
1943 (ob->check_group && statbuf.st_gid != gid))
1945 addr->basic_errno = ERRNO_BADUGID;
1947 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1948 addr->special_action = SPECIAL_FREEZE;
1952 if ((statbuf.st_mode & 07777) != oldmode)
1954 addr->basic_errno = ERRNO_BADMODE;
1955 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1956 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1957 addr->special_action = SPECIAL_FREEZE;
1961 /* If file_format is set, check that the format of the file has not
1962 changed. Error data is set by the testing function. */
1964 if (ob->file_format != NULL &&
1965 check_file_format(fd, tblock, addr) != tblock)
1967 addr->message = US"open mailbox has changed format";
1971 /* The file is OK. Carry on to do the locking. */
1974 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1975 locking rules if configured to do so. If a lock file is also required, it
1976 was created above and hd was left >= 0. At least one form of locking is
1977 required by the initialization function. If locking fails here, close the
1978 file and go round the loop all over again, after waiting for a bit, unless
1979 blocking locking was used. */
1982 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1983 sleep_before_retry = FALSE;
1985 /* Simple fcntl() and/or flock() locking */
1987 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
1989 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1990 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
1993 /* MBX locking rules */
1996 else if (ob->use_mbx_lock)
1998 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1999 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
2000 fstat(fd, &statbuf) >= 0)
2002 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
2003 (long)statbuf.st_ino);
2005 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2007 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2009 addr->basic_errno = ERRNO_LOCKFAILED;
2010 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2014 if (statbuf.st_nlink > 1)
2016 addr->basic_errno = ERRNO_LOCKFAILED;
2017 addr->message = string_sprintf("hard link to MBX lock file %s",
2023 mbx_lockfd = Uopen(mbx_lockname, O_RDWR | O_CREAT, ob->lockfile_mode);
2026 addr->basic_errno = ERRNO_LOCKFAILED;
2027 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2028 mbx_lockname, strerror(errno));
2032 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2034 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2035 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2037 struct stat ostatbuf;
2039 /* This tests for a specific race condition. Ensure that we still
2040 have the same file. */
2042 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2043 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2044 statbuf.st_dev == ostatbuf.st_dev &&
2045 statbuf.st_ino == ostatbuf.st_ino)
2047 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2048 "between creation and locking\n", mbx_lockname);
2051 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2053 (void)close(mbx_lockfd);
2058 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2059 filename, strerror(errno));
2062 #endif /* SUPPORT_MBX */
2064 else break; /* No on-file locking required; break the open/lock loop */
2067 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2071 use_lstat = TRUE; /* Reset to use lstat first */
2074 /* If a blocking call timed out, break the retry loop if the total time
2075 so far is not less than than retries * interval. Use the larger of the
2076 flock() and fcntl() timeouts. */
2079 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2080 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2081 ob->lock_retries * ob->lock_interval)
2082 i = ob->lock_retries;
2084 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2085 flock() that caused the problem. */
2087 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2090 /* Test for exceeding the maximum number of tries. Either the file remains
2091 locked, or, if we haven't got it open, something is terribly wrong... */
2093 if (i >= ob->lock_retries)
2097 addr->basic_errno = ERRNO_EXISTRACE;
2098 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2099 addr->special_action = SPECIAL_FREEZE;
2103 addr->basic_errno = ERRNO_LOCKFAILED;
2104 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2110 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2112 /* Save access time (for subsequent restoration), modification time (for
2113 restoration if updating fails), size of file (for comsat and for re-setting if
2114 delivery fails in the middle - e.g. for quota exceeded). */
2116 if (fstat(fd, &statbuf) < 0)
2118 addr->basic_errno = errno;
2119 addr->message = string_sprintf("while fstatting opened mailbox %s",
2124 times.actime = statbuf.st_atime;
2125 times.modtime = statbuf.st_mtime;
2126 saved_size = statbuf.st_size;
2127 if (mailbox_size < 0) mailbox_size = saved_size;
2128 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2131 /* Prepare for writing to a new file (as opposed to appending to an old one).
2132 There are several different formats, but there is preliminary stuff concerned
2133 with quotas that applies to all of them. Finding the current size by directory
2134 scanning is expensive; for maildirs some fudges have been invented:
2136 (1) A regex can be used to extract a file size from its name;
2137 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2143 uschar *check_path = path; /* Default quota check path */
2144 const pcre *regex = NULL; /* Regex for file size from file name */
2146 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2148 addr->basic_errno = ERRNO_BADCREATE;
2149 addr->message = string_sprintf("tried to create file in %s, but "
2150 "file creation outside the home directory is not permitted", path);
2154 #ifdef SUPPORT_MAILDIR
2155 /* For a maildir delivery, ensure that all the relevant directories exist */
2157 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2158 ob->create_directory, ob->dirmode))
2160 #endif /* SUPPORT_MAILDIR */
2162 /* If we are going to do a quota check, of if maildir_use_size_file is set
2163 for a maildir delivery, compile the regular expression if there is one. We
2164 may also need to adjust the path that is used. We need to do this for
2165 maildir_use_size_file even if the quota is unset, because we still want to
2166 create the file. When maildir support is not compiled,
2167 ob->maildir_use_size_file is always FALSE. */
2169 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2171 const uschar *error;
2174 /* Compile the regex if there is one. */
2176 if (ob->quota_size_regex != NULL)
2178 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2179 (const char **)&error, &offset, NULL);
2182 addr->message = string_sprintf("appendfile: regular expression "
2183 "error: %s at offset %d while compiling %s", error, offset,
2184 ob->quota_size_regex);
2187 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2188 ob->quota_size_regex);
2191 /* Use an explicitly configured directory if set */
2193 if (ob->quota_directory != NULL)
2195 check_path = expand_string(ob->quota_directory);
2196 if (check_path == NULL)
2198 addr->transport_return = PANIC;
2199 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2200 "name for %s transport) failed: %s", ob->quota_directory,
2201 tblock->name, expand_string_message);
2205 if (check_path[0] != '/')
2207 addr->message = string_sprintf("appendfile: quota_directory name "
2208 "\"%s\" is not absolute", check_path);
2209 addr->basic_errno = ERRNO_NOTABSOLUTE;
2214 #ifdef SUPPORT_MAILDIR
2215 /* Otherwise, if we are handling a maildir delivery, and the directory
2216 contains a file called maildirfolder, this is a maildir++ feature telling
2217 us that this is a sub-directory of the real inbox. We should therefore do
2218 the quota check on the parent directory. Beware of the special case when
2219 the directory name itself ends in a slash. */
2221 else if (mbformat == mbf_maildir)
2223 struct stat statbuf;
2224 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2226 uschar *new_check_path = string_copy(check_path);
2227 uschar *slash = Ustrrchr(new_check_path, '/');
2233 slash = Ustrrchr(new_check_path, '/');
2238 check_path = new_check_path;
2243 #endif /* SUPPORT_MAILDIR */
2246 /* If we are using maildirsize files, we need to ensure that such a file
2247 exists and, if necessary, recalculate its contents. As a byproduct of this,
2248 we obtain the current size of the maildir. If no quota is to be enforced
2249 (ob->quota_value == 0), we still need the size if a threshold check will
2252 Another regular expression is used to determine which directories inside the
2253 maildir are going to be counted. */
2255 #ifdef SUPPORT_MAILDIR
2256 if (ob->maildir_use_size_file)
2258 const pcre *dir_regex = NULL;
2259 const uschar *error;
2262 if (ob->maildir_dir_regex != NULL)
2264 int check_path_len = Ustrlen(check_path);
2266 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2267 (const char **)&error, &offset, NULL);
2268 if (dir_regex == NULL)
2270 addr->message = string_sprintf("appendfile: regular expression "
2271 "error: %s at offset %d while compiling %s", error, offset,
2272 ob->maildir_dir_regex);
2277 debug_printf("using regex for maildir directory selection: %s\n",
2278 ob->maildir_dir_regex);
2280 /* Check to see if we are delivering into an ignored directory, that is,
2281 if the delivery path starts with the quota check path, and the rest
2282 of the deliver path matches the regex; if so, set a flag to disable quota
2283 checking and maildirsize updating. */
2285 if (Ustrncmp(path, check_path, check_path_len) == 0)
2287 uschar *s = path + check_path_len;
2288 while (*s == '/') s++;
2289 s = (*s == 0)? US "new" : string_sprintf("%s/new", s);
2290 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2292 disable_quota = TRUE;
2293 DEBUG(D_transport) debug_printf("delivery directory does not match "
2294 "maildir_quota_directory_regex: disabling quota\n");
2299 /* Quota enforcement; create and check the file. There is some discussion
2300 about whether this should happen if the quota is unset. At present, Exim
2301 always creates the file. If we ever want to change this, uncomment
2302 appropriate lines below, possibly doing a check on some option. */
2304 /* if (???? || ob->quota_value > 0) */
2311 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2314 if (maildirsize_fd == -1)
2316 addr->basic_errno = errno;
2317 addr->message = string_sprintf("while opening or reading "
2318 "%s/maildirsize", check_path);
2322 if (mailbox_size < 0) mailbox_size = size;
2323 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2326 /* No quota enforcement; ensure file does *not* exist; calculate size if
2331 * time_t old_latest;
2332 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2333 * if (THRESHOLD_CHECK)
2334 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2335 * regex, dir_regex, FALSE);
2340 #endif /* SUPPORT_MAILDIR */
2342 /* Otherwise if we are going to do a quota check later on, and the mailbox
2343 size is not set, find the current size of the mailbox. Ditto for the file
2344 count. Note that ob->quota_filecount_value cannot be set without
2345 ob->quota_value being set. */
2347 if (!disable_quota &&
2348 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2349 (mailbox_size < 0 ||
2350 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2355 debug_printf("quota checks on directory %s\n", check_path);
2356 size = check_dir_size(check_path, &filecount, regex);
2357 if (mailbox_size < 0) mailbox_size = size;
2358 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2361 /* Handle the case of creating a unique file in a given directory (not in
2362 maildir or mailstore format - this is how smail did it). A temporary name is
2363 used to create the file. Later, when it is written, the name is changed to a
2364 unique one. There is no need to lock the file. An attempt is made to create
2365 the directory if it does not exist. */
2367 if (mbformat == mbf_smail)
2370 debug_printf("delivering to new file in %s\n", path);
2371 filename = dataname =
2372 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2373 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2374 if (fd < 0 && /* failed to open, and */
2375 (errno != ENOENT || /* either not non-exist */
2376 !ob->create_directory || /* or not allowed to make */
2377 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2378 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2380 addr->basic_errno = errno;
2381 addr->message = string_sprintf("while creating file %s", filename);
2386 #ifdef SUPPORT_MAILDIR
2388 /* Handle the case of a unique file in maildir format. The file is written to
2389 the tmp subdirectory, with a prescribed form of name. */
2391 else if (mbformat == mbf_maildir)
2394 debug_printf("delivering in maildir format in %s\n", path);
2396 nametag = ob->maildir_tag;
2398 /* Check that nametag expands successfully; a hard failure causes a panic
2399 return. The actual expansion for use happens again later, when
2400 $message_size is accurately known. */
2402 if (nametag != NULL && expand_string(nametag) == NULL &&
2403 !expand_string_forcedfail)
2405 addr->transport_return = PANIC;
2406 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2407 "for %s transport) failed: %s", nametag, tblock->name,
2408 expand_string_message);
2412 /* We ensured the existence of all the relevant directories above. Attempt
2413 to open the temporary file a limited number of times. I think this rather
2414 scary-looking for statement is actually OK. If open succeeds, the loop is
2415 broken; if not, there is a test on the value of i. Get the time again
2416 afresh each time round the loop. Its value goes into a variable that is
2417 checked at the end, to make sure we don't release this process until the
2418 clock has ticked. */
2424 (void)gettimeofday(&msg_tv, NULL);
2425 basename = string_sprintf("%lu.H%luP%lu.%s", msg_tv.tv_sec,
2426 msg_tv.tv_usec, getpid(), primary_hostname);
2428 filename = dataname = string_sprintf("tmp/%s", basename);
2429 newname = string_sprintf("new/%s", basename);
2431 if (Ustat(filename, &statbuf) == 0)
2433 else if (errno == ENOENT)
2435 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2437 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2438 filename, strerror(errno));
2441 /* Too many retries - give up */
2443 if (i >= ob->maildir_retries)
2445 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2446 filename, i, (i == 1)? "y" : "ies");
2447 addr->basic_errno = errno;
2451 /* Open or stat failed but we haven't tried too many times yet. */
2456 /* Note that we have to ensure the clock has ticked before leaving */
2458 wait_for_tick = TRUE;
2460 /* Why are these here? Put in because they are present in the non-maildir
2461 directory case above. */
2463 (void)Uchown(filename, uid, gid);
2464 (void)Uchmod(filename, mode);
2467 #endif /* SUPPORT_MAILDIR */
2469 #ifdef SUPPORT_MAILSTORE
2471 /* Handle the case of a unique file in mailstore format. First write the
2472 envelope to a temporary file, then open the main file. The unique base name
2473 for the files consists of the message id plus the pid of this delivery
2479 address_item *taddr;
2480 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2481 string_base62((long int)getpid()));
2484 debug_printf("delivering in mailstore format in %s\n", path);
2486 filename = string_sprintf("%s.tmp", mailstore_basename);
2487 newname = string_sprintf("%s.env", mailstore_basename);
2488 dataname = string_sprintf("%s.msg", mailstore_basename);
2490 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2491 if (fd < 0 && /* failed to open, and */
2492 (errno != ENOENT || /* either not non-exist */
2493 !ob->create_directory || /* or not allowed to make */
2494 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2495 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2497 addr->basic_errno = errno;
2498 addr->message = string_sprintf("while creating file %s", filename);
2502 /* Why are these here? Put in because they are present in the non-maildir
2503 directory case above. */
2505 (void)Uchown(filename, uid, gid);
2506 (void)Uchmod(filename, mode);
2508 /* Built a C stream from the open file descriptor. */
2510 if ((env_file = fdopen(fd, "wb")) == NULL)
2512 addr->basic_errno = errno;
2513 addr->transport_return = PANIC;
2514 addr->message = string_sprintf("fdopen of %s ("
2515 "for %s transport) failed", filename, tblock->name);
2521 /* Write the envelope file, then close it. */
2523 if (ob->mailstore_prefix != NULL)
2525 uschar *s = expand_string(ob->mailstore_prefix);
2528 if (!expand_string_forcedfail)
2530 addr->transport_return = PANIC;
2531 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2532 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2533 tblock->name, expand_string_message);
2534 (void)fclose(env_file);
2542 fprintf(env_file, "%s", CS s);
2543 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2547 fprintf(env_file, "%s\n", sender_address);
2549 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2550 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2552 if (ob->mailstore_suffix != NULL)
2554 uschar *s = expand_string(ob->mailstore_suffix);
2557 if (!expand_string_forcedfail)
2559 addr->transport_return = PANIC;
2560 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2561 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2562 tblock->name, expand_string_message);
2563 (void)fclose(env_file);
2571 fprintf(env_file, "%s", CS s);
2572 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2576 if (fclose(env_file) != 0)
2578 addr->basic_errno = errno;
2579 addr->message = string_sprintf("while closing %s", filename);
2584 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2586 /* Now open the data file, and ensure that it has the correct ownership and
2589 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2592 addr->basic_errno = errno;
2593 addr->message = string_sprintf("while creating file %s", dataname);
2597 (void)Uchown(dataname, uid, gid);
2598 (void)Uchmod(dataname, mode);
2601 #endif /* SUPPORT_MAILSTORE */
2604 /* In all cases of writing to a new file, ensure that the file which is
2605 going to be renamed has the correct ownership and mode. */
2607 (void)Uchown(filename, uid, gid);
2608 (void)Uchmod(filename, mode);
2612 /* At last we can write the message to the file, preceded by any configured
2613 prefix line, and followed by any configured suffix line. If there are any
2614 writing errors, we must defer. */
2616 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2621 /* If there is a local quota setting, check that we are not going to exceed it
2622 with this message if quota_is_inclusive is set; if it is not set, the check
2623 is for the mailbox already being over quota (i.e. the current message is not
2624 included in the check). */
2626 if (!disable_quota && ob->quota_value > 0)
2630 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2631 " this message = %d (%sincluded)\n",
2632 ob->quota_value, mailbox_size, message_size,
2633 ob->quota_is_inclusive? "" : "not ");
2634 debug_printf(" file count quota = %d count = %d\n",
2635 ob->quota_filecount_value, mailbox_filecount);
2637 if (mailbox_size + (ob->quota_is_inclusive? message_size:0) > ob->quota_value)
2639 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2641 errno = ERRNO_EXIMQUOTA;
2643 else if (ob->quota_filecount_value > 0 &&
2644 mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2645 ob->quota_filecount_value)
2647 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2649 errno = ERRNO_EXIMQUOTA;
2650 filecount_msg = US" filecount";
2654 /* If we are writing in MBX format, what we actually do is to write the message
2655 to a temporary file, and then copy it to the real file once we know its size.
2656 This is the most straightforward way of getting the correct length in the
2657 separator line. So, what we do here is to save the real file descriptor, and
2658 replace it with one for a temporary file. The temporary file gets unlinked once
2659 opened, so that it goes away on closure. */
2662 if (yield == OK && ob->mbx_format)
2664 temp_file = tmpfile();
2665 if (temp_file == NULL)
2667 addr->basic_errno = errno;
2668 addr->message = US"while setting up temporary file";
2673 fd = fileno(temp_file);
2674 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2676 #endif /* SUPPORT_MBX */
2678 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2681 transport_count = 0;
2683 /* Write any configured prefix text first */
2685 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2687 uschar *prefix = expand_string(ob->message_prefix);
2690 errno = ERRNO_EXPANDFAIL;
2691 addr->transport_return = PANIC;
2692 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2693 "transport) failed", ob->message_prefix, tblock->name);
2696 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2699 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2700 various different values for batching are handled outside; if there is more
2701 than one address available here, all must be included. If any address is a
2702 file, use its parent in the RCPT TO. */
2704 if (yield == OK && ob->use_bsmtp)
2706 transport_count = 0;
2707 if (ob->use_crlf) cr = US"\r";
2708 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2713 for (a = addr; a != NULL; a = a->next)
2715 address_item *b = testflag(a, af_pfr)? a->parent: a;
2716 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2717 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2718 { yield = DEFER; break; }
2720 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2725 /* Now the message itself. The options for transport_write_message were set up
2726 at initialization time. */
2730 if (!transport_write_message(addr, fd, ob->options, 0, tblock->add_headers,
2731 tblock->remove_headers, ob->check_string, ob->escape_string,
2732 tblock->rewrite_rules, tblock->rewrite_existflags))
2736 /* Now a configured suffix. */
2738 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2740 uschar *suffix = expand_string(ob->message_suffix);
2743 errno = ERRNO_EXPANDFAIL;
2744 addr->transport_return = PANIC;
2745 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2746 "transport) failed", ob->message_suffix, tblock->name);
2749 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2752 /* If batch smtp, write the terminating dot. */
2754 if (yield == OK && ob->use_bsmtp &&
2755 !transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2757 /* If MBX format is being used, all that writing was to the temporary file.
2758 However, if there was an earlier failure (Exim quota exceeded, for example),
2759 the temporary file won't have got opened - and no writing will have been done.
2760 If writing was OK, we restore the fd, and call a function that copies the
2761 message in MBX format into the real file. Otherwise use the temporary name in
2765 if (temp_file != NULL && ob->mbx_format)
2772 transport_count = 0; /* Reset transport count for actual write */
2773 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2775 else if (errno >= 0) dataname = US"temporary file";
2777 /* Preserve errno while closing the temporary file. */
2779 mbx_save_errno = errno;
2780 (void)fclose(temp_file);
2781 errno = mbx_save_errno;
2783 #endif /* SUPPORT_MBX */
2785 /* Force out the remaining data to check for any errors; some OS don't allow
2786 fsync() to be called for a FIFO. */
2788 if (yield == OK && !isfifo && fsync(fd) < 0) yield = DEFER;
2790 /* Update message_size to the accurate count of bytes written, including
2793 message_size = transport_count;
2795 /* If using a maildir++ quota file, add this message's size to it, and
2796 close the file descriptor, except when the quota has been disabled because we
2797 are delivering into an uncounted folder. */
2799 #ifdef SUPPORT_MAILDIR
2802 if (yield == OK && maildirsize_fd >= 0)
2803 maildir_record_length(maildirsize_fd, message_size);
2804 maildir_save_errno = errno; /* Preserve errno while closing the file */
2805 (void)close(maildirsize_fd);
2806 errno = maildir_save_errno;
2808 #endif /* SUPPORT_MAILDIR */
2810 /* If there is a quota warning threshold and we are have crossed it with this
2811 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2814 if (!disable_quota && THRESHOLD_CHECK)
2816 off_t threshold = ob->quota_warn_threshold_value;
2817 if (ob->quota_warn_threshold_is_percent)
2818 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
2820 debug_printf("quota = " OFF_T_FMT
2821 " threshold = " OFF_T_FMT
2822 " old size = " OFF_T_FMT
2823 " message size = %d\n",
2824 ob->quota_value, threshold, mailbox_size,
2826 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2827 addr->special_action = SPECIAL_WARN;
2829 /******* You might think that the test ought to be this:
2831 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2832 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2834 * (indeed, I was sent a patch with that in). However, it is possible to
2835 * have a warning threshold without actually imposing a quota, and I have
2836 * therefore kept Exim backwards compatible.
2841 /* Handle error while writing the file. Control should come here directly after
2842 the error, with the reason in errno. In the case of expansion failure in prefix
2843 or suffix, it will be ERRNO_EXPANDFAIL. */
2847 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2849 /* Save the error number. If positive, it will ultimately cause a strerror()
2850 call to generate some text. */
2852 addr->basic_errno = errno;
2854 /* For system or Exim quota excession, or disk full, set more_errno to the
2855 time since the file was last read. If delivery was into a directory, the
2856 time since last read logic is not relevant, in general. However, for maildir
2857 deliveries we can approximate it by looking at the last modified time of the
2858 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2859 "new" subdirectory implies that an MUA has moved a message from there to the
2862 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2864 addr->more_errno = 0;
2865 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2867 #ifdef SUPPORT_MAILDIR
2868 else if (mbformat == mbf_maildir)
2870 struct stat statbuf;
2871 if (Ustat("new", &statbuf) < 0)
2873 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2874 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2876 else /* Want a repeatable time when in test harness */
2878 addr->more_errno = running_in_test_harness? 10 :
2879 (int)time(NULL) - statbuf.st_mtime;
2882 debug_printf("maildir: time since \"new\" directory modified = %s\n",
2883 readconf_printtime(addr->more_errno));
2885 #endif /* SUPPORT_MAILDIR */
2888 /* Handle system quota excession. Add an explanatory phrase for the error
2889 message, since some systems don't have special quota-excession errors,
2890 and on those that do, "quota" doesn't always mean anything to the user. */
2892 if (errno == errno_quota)
2895 addr->message = string_sprintf("mailbox is full "
2896 "(quota exceeded while writing to file %s)", filename);
2898 addr->message = string_sprintf("mailbox is full");
2900 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
2902 isdirectory? US"" : US": time since file read = ",
2903 isdirectory? US"" : readconf_printtime(addr->more_errno));
2906 /* Handle Exim's own quota-imposition */
2908 else if (errno == ERRNO_EXIMQUOTA)
2910 addr->message = string_sprintf("mailbox is full "
2911 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
2913 addr->user_message = US"mailbox is full";
2914 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
2915 filecount_msg, dataname,
2916 isdirectory? US"" : US": time since file read = ",
2917 isdirectory? US"" : readconf_printtime(addr->more_errno));
2920 /* Handle a process failure while writing via a filter; the return
2921 from child_close() is in more_errno. */
2923 else if (errno == ERRNO_FILTER_FAIL)
2926 addr->message = string_sprintf("transport filter process failed (%d) "
2927 "while writing to %s%s", addr->more_errno, dataname,
2928 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
2931 /* Handle failure to expand header changes */
2933 else if (errno == ERRNO_CHHEADER_FAIL)
2937 string_sprintf("failed to expand headers_add or headers_remove while "
2938 "writing to %s: %s", dataname, expand_string_message);
2941 /* Handle failure to complete writing of a data block */
2943 else if (errno == ERRNO_WRITEINCOMPLETE)
2945 addr->message = string_sprintf("failed to write data block while "
2946 "writing to %s", dataname);
2949 /* Handle length mismatch on MBX copying */
2952 else if (errno == ERRNO_MBXLENGTH)
2954 addr->message = string_sprintf("length mismatch while copying MBX "
2955 "temporary file to %s", dataname);
2957 #endif /* SUPPORT_MBX */
2959 /* For other errors, a general-purpose explanation, if the message is
2962 else if (addr->message == NULL)
2963 addr->message = string_sprintf("error while writing to %s", dataname);
2965 /* For a file, reset the file size to what it was before we started, leaving
2966 the last modification time unchanged, so it will get reset also. All systems
2967 investigated so far have ftruncate(), whereas not all have the F_FREESP
2968 fcntl() call (BSDI & FreeBSD do not). */
2970 if (!isdirectory) (void)ftruncate(fd, saved_size);
2973 /* Handle successful writing - we want the modification time to be now for
2974 appended files. Remove the default backstop error number. For a directory, now
2975 is the time to rename the file with a unique name. As soon as such a name
2976 appears it may get used by another process, so we close the file first and
2977 check that all is well. */
2981 times.modtime = time(NULL);
2982 addr->basic_errno = 0;
2984 /* Handle the case of writing to a new file in a directory. This applies
2985 to all single-file formats - maildir, mailstore, and "smail format". */
2989 if (fstat(fd, &statbuf) < 0)
2991 addr->basic_errno = errno;
2992 addr->message = string_sprintf("while fstatting opened message file %s",
2997 else if (close(fd) < 0)
2999 addr->basic_errno = errno;
3000 addr->message = string_sprintf("close() error for %s",
3001 (ob->mailstore_format)? dataname : filename);
3005 /* File is successfully written and closed. Arrange to rename it. For the
3006 different kinds of single-file delivery, some games can be played with the
3007 name. The message size is by this time set to the accurate value so that
3008 its value can be used in expansions. */
3012 uschar *renamename = newname;
3015 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3017 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3018 situation. The name is built by expanding the directory_file option, and
3019 we make the inode number available for use in this. The expansion was
3020 checked for syntactic validity above, before we wrote the file.
3022 We have to be careful here, in case the file name exists. (In the other
3023 cases, the names used are constructed to be unique.) The rename()
3024 function just replaces an existing file - we don't want that! So instead
3025 of calling rename(), we must use link() and unlink().
3027 In this case, if the link fails because of an existing file, we wait
3028 for one second and try the expansion again, to see if it produces a
3029 different value. Do this up to 5 times unless the name stops changing.
3030 This makes it possible to build values that are based on the time, and
3031 still cope with races from multiple simultaneous deliveries. */
3033 if (newname == NULL)
3037 uschar *old_renameleaf = US"";
3039 for (i = 0; ; sleep(1), i++)
3041 deliver_inode = statbuf.st_ino;
3042 renameleaf = expand_string(ob->dirfilename);
3045 if (renameleaf == NULL)
3047 addr->transport_return = PANIC;
3048 addr->message = string_sprintf("Expansion of \"%s\" "
3049 "(directory_file for %s transport) failed: %s",
3050 ob->dirfilename, tblock->name, expand_string_message);
3054 renamename = string_sprintf("%s/%s", path, renameleaf);
3055 if (Ulink(filename, renamename) < 0)
3057 DEBUG(D_transport) debug_printf("link failed: %s\n",
3059 if (errno != EEXIST || i >= 4 ||
3060 Ustrcmp(renameleaf, old_renameleaf) == 0)
3062 addr->basic_errno = errno;
3063 addr->message = string_sprintf("while renaming %s as %s",
3064 filename, renamename);
3068 old_renameleaf = renameleaf;
3069 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3078 } /* re-expand loop */
3079 } /* not mailstore or maildir */
3081 /* For maildir and mailstore formats, the new name was created earlier,
3082 except that for maildir, there is the possibility of adding a "tag" on
3083 the end of the name by expanding the value of nametag. This usually
3084 includes a reference to the message size. The expansion of nametag was
3085 checked above, before the file was opened. It either succeeded, or
3086 provoked a soft failure. So any failure here can be treated as soft.
3087 Ignore non-printing characters and / and put a colon at the start if the
3088 first character is alphanumeric. */
3092 if (nametag != NULL)
3094 uschar *iptr = expand_string(nametag);
3097 uschar *etag = store_get(Ustrlen(iptr) + 2);
3098 uschar *optr = etag;
3101 if (mac_isgraph(*iptr) && *iptr != '/')
3103 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3109 renamename = string_sprintf("%s%s", newname, etag);
3113 /* Do the rename. If the name is too long and a tag exists, try again
3116 if (Urename(filename, renamename) < 0 &&
3117 (nametag == NULL || errno != ENAMETOOLONG ||
3118 (renamename = newname, Urename(filename, renamename) < 0)))
3120 addr->basic_errno = errno;
3121 addr->message = string_sprintf("while renaming %s as %s",
3122 filename, renamename);
3126 /* Rename succeeded */
3130 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3132 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3134 } /* maildir or mailstore */
3135 } /* successful write + close */
3137 } /* write success */
3140 /* For a file, restore the last access time (atime), and set the modification
3141 time as required - changed if write succeeded, unchanged if not. */
3143 if (!isdirectory) utime(CS filename, ×);
3145 /* Notify comsat if configured to do so. It only makes sense if the configured
3146 file is the one that the comsat daemon knows about. */
3148 if (ob->notify_comsat && yield == OK && deliver_localpart != NULL)
3149 notify_comsat(deliver_localpart, saved_size);
3151 /* Pass back the final return code in the address structure */
3154 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3155 yield, addr->basic_errno, addr->more_errno);
3157 addr->transport_return = yield;
3159 /* Close the file, which will release the fcntl lock. For a directory write it
3160 is closed above, except in cases of error which goto RETURN, when we also need
3161 to remove the original file(s). For MBX locking, if all has gone well, before
3162 closing the file, see if we can get an exclusive lock on it, in which case we
3163 can unlink the /tmp lock file before closing it. This is always a non-blocking
3164 lock; there's no need to wait if we can't get it. If everything has gone right
3165 but close fails, defer the message. Then unlink the lock file, if present. This
3166 point in the code is jumped to from a number of places when errors are
3167 detected, in order to get the file closed and the lock file tidied away. */
3172 if (mbx_lockfd >= 0)
3174 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3175 ob->use_flock, 0) >= 0)
3178 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3179 Uunlink(mbx_lockname);
3181 (void)close(mbx_lockfd);
3183 #endif /* SUPPORT_MBX */
3185 if (fd >= 0 && close(fd) < 0 && yield == OK)
3187 addr->basic_errno = errno;
3188 addr->message = string_sprintf("while closing %s", filename);
3189 addr->transport_return = DEFER;
3192 if (hd >= 0) Uunlink(lockname);
3194 /* We get here with isdirectory and filename set only in error situations. */
3196 if (isdirectory && filename != NULL)
3199 if (dataname != filename) Uunlink(dataname);
3202 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3203 file name relies on time + pid. We must not allow the process to finish until
3204 the clock has move on by at least one microsecond. Usually we expect this
3205 already to be the case, but machines keep getting faster... */
3207 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3209 /* A return of FALSE means that if there was an error, a common error was
3210 put in the first address of a batch. */
3215 /* End of transport/appendfile.c */