1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 /* Functions for writing spool files, and moving them about. */
10
11
12 #include "exim.h"
13
14
15
16 /*************************************************
17 * Deal with header writing errors *
18 *************************************************/
19
20 /* This function is called immediately after errors in writing the spool, with
21 errno still set. It creates an error message, depending on the circumstances.
22 If errmsg is NULL, it logs the message and panic-dies. Otherwise errmsg is set
23 to point to the message, and -1 is returned. This function makes the code of
24 spool_write_header() a bit neater.
25
26 Arguments:
27 where SW_RECEIVING, SW_DELIVERING, or SW_MODIFYING
28 errmsg where to put the message; NULL => panic-die
29 s text to add to log string
30 temp_name name of temp file to unlink
31 f FILE to close, if not NULL
32
33 Returns: -1 if errmsg is not NULL; otherwise doesn't return
34 */
35
36 static int
spool_write_error(int where,uschar ** errmsg,uschar * s,uschar * temp_name,FILE * f)37 spool_write_error(int where, uschar **errmsg, uschar *s, uschar *temp_name,
38 FILE *f)
39 {
40 uschar *msg = where == SW_RECEIVING
41 ? string_sprintf("spool file %s error while receiving from %s: %s", s,
42 sender_fullhost ? sender_fullhost : sender_ident,
43 strerror(errno))
44 : string_sprintf("spool file %s error while %s: %s", s,
45 where == SW_DELIVERING ? "delivering" : "modifying",
46 strerror(errno));
47
48 if (temp_name) Uunlink(temp_name);
49 if (f) (void)fclose(f);
50
51 if (errmsg)
52 *errmsg = msg;
53 else
54 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", msg);
55
56 return -1;
57 }
58
59
60
61 /*************************************************
62 * Open file under temporary name *
63 *************************************************/
64
65 /* This is used for opening spool files under a temporary name,
66 with a single attempt at deleting if they already exist.
67
68 Argument: temporary name for spool header file
69 Returns: file descriptor of open file, or < 0 on failure, with errno unchanged
70 */
71
72 int
spool_open_temp(uschar * temp_name)73 spool_open_temp(uschar *temp_name)
74 {
75 int fd = Uopen(temp_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
76
77 /* If the file already exists, something has gone wrong. This process may well
78 have previously created the file if it is delivering more than one address, but
79 it should have renamed it almost immediately. A file could, however, be left
80 around as a result of a system crash, and by coincidence this process might
81 have the same pid. We therefore have one go at unlinking it before giving up.
82 */
83
84 if (fd < 0 && errno == EEXIST)
85 {
86 DEBUG(D_any) debug_printf("%s exists: unlinking\n", temp_name);
87 Uunlink(temp_name);
88 fd = Uopen(temp_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
89 }
90
91 /* If the file has been opened, make sure the file's group is the Exim gid, and
92 double-check the mode because the group setting doesn't always get set
93 automatically. */
94
95 if (fd >= 0)
96 if (exim_fchown(fd, exim_uid, exim_gid, temp_name) || fchmod(fd, SPOOL_MODE))
97 {
98 DEBUG(D_any) debug_printf("failed setting perms on %s\n", temp_name);
99 (void) close(fd); fd = -1;
100 Uunlink(temp_name);
101 }
102
103 return fd;
104 }
105
106
107
108 static const uschar *
zap_newlines(const uschar * s)109 zap_newlines(const uschar *s)
110 {
111 uschar *z, *p;
112
113 if (Ustrchr(s, '\n') == NULL) return s;
114
115 p = z = string_copy(s);
116 while ((p = Ustrchr(p, '\n')) != NULL) *p++ = ' ';
117 return z;
118 }
119
120 static void
spool_var_write(FILE * fp,const uschar * name,const uschar * val)121 spool_var_write(FILE * fp, const uschar * name, const uschar * val)
122 {
123 if (is_tainted(val)) putc('-', fp);
124 fprintf(fp, "-%s %s\n", name, val);
125 }
126
127 /*************************************************
128 * Write the header spool file *
129 *************************************************/
130
131 /* Returns the size of the file for success; zero for failure. The file is
132 written under a temporary name, and then renamed. It's done this way so that it
133 works with re-writing the file on message deferral as well as for the initial
134 write. Whenever this function is called, the data file for the message should
135 be open and locked, thus preventing any other exim process from working on this
136 message.
137
138 Argument:
139 id the message id
140 where SW_RECEIVING, SW_DELIVERING, or SW_MODIFYING
141 errmsg where to put an error message; if NULL, panic-die on error
142
143 Returns: the size of the header texts on success;
144 negative on writing failure, unless errmsg == NULL
145 */
146
147 int
spool_write_header(uschar * id,int where,uschar ** errmsg)148 spool_write_header(uschar *id, int where, uschar **errmsg)
149 {
150 int fd;
151 int size_correction;
152 FILE * fp;
153 struct stat statbuf;
154 uschar * tname;
155 uschar * fname;
156
157 tname = spool_fname(US"input", message_subdir, US"hdr.", message_id);
158
159 if ((fd = spool_open_temp(tname)) < 0)
160 return spool_write_error(where, errmsg, US"open", NULL, NULL);
161 fp = fdopen(fd, "wb");
162 DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file: %s\n", tname);
163
164 /* We now have an open file to which the header data is to be written. Start
165 with the file's leaf name, to make the file self-identifying. Continue with the
166 identity of the submitting user, followed by the sender's address. The sender's
167 address is enclosed in <> because it might be the null address. Then write the
168 received time and the number of warning messages that have been sent. */
169
170 fprintf(fp, "%s-H\n", message_id);
171 fprintf(fp, "%.63s %ld %ld\n", originator_login, (long int)originator_uid,
172 (long int)originator_gid);
173 fprintf(fp, "<%s>\n", sender_address);
174 fprintf(fp, "%d %d\n", (int)received_time.tv_sec, warning_count);
175
176 fprintf(fp, "-received_time_usec .%06d\n", (int)received_time.tv_usec);
177 fprintf(fp, "-received_time_complete %d.%06d\n",
178 (int)received_time_complete.tv_sec, (int)received_time_complete.tv_usec);
179
180 /* If there is information about a sending host, remember it. The HELO
181 data can be set for local SMTP as well as remote. */
182
183 if (sender_helo_name) spool_var_write(fp, US"helo_name", sender_helo_name);
184
185 if (sender_host_address)
186 {
187 if (is_tainted(sender_host_address)) putc('-', fp);
188 fprintf(fp, "-host_address %s.%d\n", sender_host_address, sender_host_port);
189 if (sender_host_name)
190 spool_var_write(fp, US"host_name", sender_host_name);
191 }
192 if (sender_host_authenticated)
193 spool_var_write(fp, US"host_auth", sender_host_authenticated);
194 if (sender_host_auth_pubname)
195 spool_var_write(fp, US"host_auth_pubname", sender_host_auth_pubname);
196
197 /* Also about the interface a message came in on */
198
199 if (interface_address)
200 {
201 if (is_tainted(interface_address)) putc('-', fp);
202 fprintf(fp, "-interface_address %s.%d\n", interface_address, interface_port);
203 }
204
205 if (smtp_active_hostname != primary_hostname)
206 spool_var_write(fp, US"active_hostname", smtp_active_hostname);
207
208 /* Likewise for any ident information; for local messages this is
209 likely to be the same as originator_login, but will be different if
210 the originator was root, forcing a different ident. */
211
212 if (sender_ident)
213 spool_var_write(fp, US"ident", sender_ident);
214
215 /* Ditto for the received protocol */
216
217 if (received_protocol)
218 spool_var_write(fp, US"received_protocol", received_protocol);
219
220 /* Preserve any ACL variables that are set. */
221
222 tree_walk(acl_var_c, &acl_var_write, fp);
223 tree_walk(acl_var_m, &acl_var_write, fp);
224
225 /* Now any other data that needs to be remembered. */
226
227 if (f.spool_file_wireformat)
228 fprintf(fp, "-spool_file_wireformat\n");
229 else
230 fprintf(fp, "-body_linecount %d\n", body_linecount);
231 fprintf(fp, "-max_received_linelength %d\n", max_received_linelength);
232
233 if (body_zerocount > 0) fprintf(fp, "-body_zerocount %d\n", body_zerocount);
234
235 if (authenticated_id)
236 spool_var_write(fp, US"auth_id", authenticated_id);
237 if (authenticated_sender)
238 spool_var_write(fp, US"auth_sender", zap_newlines(authenticated_sender));
239
240 if (f.allow_unqualified_recipient) fprintf(fp, "-allow_unqualified_recipient\n");
241 if (f.allow_unqualified_sender) fprintf(fp, "-allow_unqualified_sender\n");
242 if (f.deliver_firsttime) fprintf(fp, "-deliver_firsttime\n");
243 if (f.deliver_freeze) fprintf(fp, "-frozen " TIME_T_FMT "\n", deliver_frozen_at);
244 if (f.dont_deliver) fprintf(fp, "-N\n");
245 if (host_lookup_deferred) fprintf(fp, "-host_lookup_deferred\n");
246 if (host_lookup_failed) fprintf(fp, "-host_lookup_failed\n");
247 if (f.sender_local) fprintf(fp, "-local\n");
248 if (f.local_error_message) fprintf(fp, "-localerror\n");
249 #ifdef HAVE_LOCAL_SCAN
250 if (local_scan_data) spool_var_write(fp, US"local_scan", local_scan_data);
251 #endif
252 #ifdef WITH_CONTENT_SCAN
253 if (spam_bar) spool_var_write(fp, US"spam_bar", spam_bar);
254 if (spam_score) spool_var_write(fp, US"spam_score", spam_score);
255 if (spam_score_int) spool_var_write(fp, US"spam_score_int", spam_score_int);
256 #endif
257 if (f.deliver_manual_thaw) fprintf(fp, "-manual_thaw\n");
258 if (f.sender_set_untrusted) fprintf(fp, "-sender_set_untrusted\n");
259
260 #ifdef EXPERIMENTAL_BRIGHTMAIL
261 if (bmi_verdicts) spool_var_write(fp, US"bmi_verdicts", bmi_verdicts);
262 #endif
263
264 #ifndef DISABLE_TLS
265 if (tls_in.certificate_verified) fprintf(fp, "-tls_certificate_verified\n");
266 if (tls_in.cipher) spool_var_write(fp, US"tls_cipher", tls_in.cipher);
267 if (tls_in.peercert)
268 {
269 if (tls_export_cert(big_buffer, big_buffer_size, tls_in.peercert))
270 fprintf(fp, "--tls_peercert %s\n", CS big_buffer);
271 }
272 if (tls_in.peerdn) spool_var_write(fp, US"tls_peerdn", string_printing(tls_in.peerdn));
273 if (tls_in.sni) spool_var_write(fp, US"tls_sni", string_printing(tls_in.sni));
274 if (tls_in.ourcert)
275 {
276 if (tls_export_cert(big_buffer, big_buffer_size, tls_in.ourcert))
277 fprintf(fp, "-tls_ourcert %s\n", CS big_buffer);
278 }
279 if (tls_in.ocsp) fprintf(fp, "-tls_ocsp %d\n", tls_in.ocsp);
280 # ifndef DISABLE_TLS_RESUME
281 fprintf(fp, "-tls_resumption %c\n", 'A' + tls_in.resumption);
282 # endif
283 if (tls_in.ver) spool_var_write(fp, US"tls_ver", tls_in.ver);
284 #endif
285
286 #ifdef SUPPORT_I18N
287 if (message_smtputf8)
288 {
289 fprintf(fp, "-smtputf8\n");
290 if (message_utf8_downconvert)
291 fprintf(fp, "-utf8_%sdowncvt\n", message_utf8_downconvert < 0 ? "opt" : "");
292 }
293 #endif
294
295 /* Write the dsn flags to the spool header file */
296 /* DEBUG(D_deliver) debug_printf("DSN: Write SPOOL: -dsn_envid %s\n", dsn_envid); */
297 if (dsn_envid) fprintf(fp, "-dsn_envid %s\n", dsn_envid);
298 /* DEBUG(D_deliver) debug_printf("DSN: Write SPOOL: -dsn_ret %d\n", dsn_ret); */
299 if (dsn_ret) fprintf(fp, "-dsn_ret %d\n", dsn_ret);
300
301 /* To complete the envelope, write out the tree of non-recipients, followed by
302 the list of recipients. These won't be disjoint the first time, when no
303 checking has been done. If a recipient is a "one-time" alias, it is followed by
304 a space and its parent address number (pno). */
305
306 tree_write(tree_nonrecipients, fp);
307 fprintf(fp, "%d\n", recipients_count);
308 for (int i = 0; i < recipients_count; i++)
309 {
310 recipient_item *r = recipients_list + i;
311 const uschar *address = zap_newlines(r->address);
312
313 /* DEBUG(D_deliver) debug_printf("DSN: Flags: 0x%x\n", r->dsn_flags); */
314
315 if (r->pno < 0 && !r->errors_to && r->dsn_flags == 0)
316 fprintf(fp, "%s\n", address);
317 else
318 {
319 const uschar *errors_to = r->errors_to ? zap_newlines(r->errors_to) : CUS"";
320 /* for DSN SUPPORT extend exim 4 spool in a compatible way by
321 adding new values upfront and add flag 0x02 */
322 const uschar *orcpt = r->orcpt ? zap_newlines(r->orcpt) : CUS"";
323
324 fprintf(fp, "%s %s %d,%d %s %d,%d#3\n", address, orcpt, Ustrlen(orcpt),
325 r->dsn_flags, errors_to, Ustrlen(errors_to), r->pno);
326 }
327
328 DEBUG(D_deliver) debug_printf("DSN: **** SPOOL_OUT - "
329 "address: <%s> errorsto: <%s> orcpt: <%s> dsn_flags: 0x%x\n",
330 r->address, r->errors_to, r->orcpt, r->dsn_flags);
331 }
332
333 /* Put a blank line before the headers */
334
335 fprintf(fp, "\n");
336
337 /* Save the size of the file so far so we can subtract it from the final length
338 to get the actual size of the headers. */
339
340 fflush(fp);
341 if (fstat(fd, &statbuf))
342 return spool_write_error(where, errmsg, US"fstat", tname, fp);
343 size_correction = statbuf.st_size;
344
345 /* Finally, write out the message's headers. To make it easier to read them
346 in again, precede each one with the count of its length. Make the count fixed
347 length to aid human eyes when debugging and arrange for it not be included in
348 the size. It is followed by a space for normal headers, a flagging letter for
349 various other headers, or an asterisk for old headers that have been rewritten.
350 These are saved as a record for debugging. Don't included them in the message's
351 size. */
352
353 for (header_line * h = header_list; h; h = h->next)
354 {
355 fprintf(fp, "%03d%c %s", h->slen, h->type, h->text);
356 size_correction += 5;
357 if (h->type == '*') size_correction += h->slen;
358 }
359
360 /* Flush and check for any errors while writing */
361
362 if (fflush(fp) != 0 || ferror(fp))
363 return spool_write_error(where, errmsg, US"write", tname, fp);
364
365 /* Force the file's contents to be written to disk. Note that fflush()
366 just pushes it out of C, and fclose() doesn't guarantee to do the write
367 either. That's just the way Unix works... */
368
369 if (EXIMfsync(fileno(fp)) < 0)
370 return spool_write_error(where, errmsg, US"sync", tname, fp);
371
372 /* Get the size of the file, and close it. */
373
374 if (fstat(fd, &statbuf) != 0)
375 return spool_write_error(where, errmsg, US"fstat", tname, NULL);
376 if (fclose(fp) != 0)
377 return spool_write_error(where, errmsg, US"close", tname, NULL);
378
379 /* Rename the file to its correct name, thereby replacing any previous
380 incarnation. */
381
382 fname = spool_fname(US"input", message_subdir, id, US"-H");
383 DEBUG(D_receive|D_deliver) debug_printf("Renaming spool header file: %s\n", fname);
384
385 if (Urename(tname, fname) < 0)
386 return spool_write_error(where, errmsg, US"rename", tname, NULL);
387
388 /* Linux (and maybe other OS?) does not automatically sync a directory after
389 an operation like rename. We therefore have to do it forcibly ourselves in
390 these cases, to make sure the file is actually accessible on disk, as opposed
391 to just the data being accessible from a file in lost+found. Linux also has
392 O_DIRECTORY, for opening a directory.
393
394 However, it turns out that some file systems (some versions of NFS?) do not
395 support directory syncing. It seems safe enough to ignore EINVAL to cope with
396 these cases. One hack on top of another... but that's life. */
397
398 #ifdef NEED_SYNC_DIRECTORY
399
400 tname = spool_fname(US"input", message_subdir, US".", US"");
401
402 # ifndef O_DIRECTORY
403 # define O_DIRECTORY 0
404 # endif
405
406 if ((fd = Uopen(tname, O_RDONLY|O_DIRECTORY, 0)) < 0)
407 return spool_write_error(where, errmsg, US"directory open", fname, NULL);
408
409 if (EXIMfsync(fd) < 0 && errno != EINVAL)
410 return spool_write_error(where, errmsg, US"directory sync", fname, NULL);
411
412 if (close(fd) < 0)
413 return spool_write_error(where, errmsg, US"directory close", fname, NULL);
414
415 #endif /* NEED_SYNC_DIRECTORY */
416
417 /* Return the number of characters in the headers, which is the file size, less
418 the preliminary stuff, less the additional count fields on the headers. */
419
420 DEBUG(D_receive) debug_printf("Size of headers = %d\n",
421 (int)(statbuf.st_size - size_correction));
422
423 return statbuf.st_size - size_correction;
424 }
425
426
427 /************************************************
428 * Make a hard link *
429 ************************************************/
430
431 /* Used by spool_move_message() below. Note re the use of sprintf(): the value
432 of spool_directory is checked to ensure that it is less than 200 characters at
433 start-up time.
434
435 Arguments:
436 dir base directory name
437 dq destiinationqueue name
438 subdir subdirectory name
439 id message id
440 suffix suffix to add to id
441 from source directory prefix
442 to destination directory prefix
443 noentok if TRUE, absence of file is not an error
444
445 Returns: TRUE if all went well
446 FALSE, having panic logged if not
447 */
448
449 static BOOL
make_link(uschar * dir,uschar * dq,uschar * subdir,uschar * id,uschar * suffix,uschar * from,uschar * to,BOOL noentok)450 make_link(uschar *dir, uschar * dq, uschar *subdir, uschar *id, uschar *suffix,
451 uschar *from, uschar *to, BOOL noentok)
452 {
453 uschar * fname = spool_fname(string_sprintf("%s%s", from, dir), subdir, id, suffix);
454 uschar * tname = spool_q_fname(string_sprintf("%s%s", to, dir), dq, subdir, id, suffix);
455 if (Ulink(fname, tname) < 0 && (!noentok || errno != ENOENT))
456 {
457 log_write(0, LOG_MAIN|LOG_PANIC, "link(\"%s\", \"%s\") failed while moving "
458 "message: %s", fname, tname, strerror(errno));
459 return FALSE;
460 }
461 return TRUE;
462 }
463
464
465
466 /************************************************
467 * Break a link *
468 ************************************************/
469
470 /* Used by spool_move_message() below. Note re the use of sprintf(): the value
471 of spool_directory is checked to ensure that it is less than 200 characters at
472 start-up time.
473
474 Arguments:
475 dir base directory name
476 subdir subdirectory name
477 id message id
478 suffix suffix to add to id
479 from source directory prefix
480 noentok if TRUE, absence of file is not an error
481
482 Returns: TRUE if all went well
483 FALSE, having panic logged if not
484 */
485
486 static BOOL
break_link(uschar * dir,uschar * subdir,uschar * id,uschar * suffix,uschar * from,BOOL noentok)487 break_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
488 BOOL noentok)
489 {
490 uschar * fname = spool_fname(string_sprintf("%s%s", from, dir), subdir, id, suffix);
491 if (Uunlink(fname) < 0 && (!noentok || errno != ENOENT))
492 {
493 log_write(0, LOG_MAIN|LOG_PANIC, "unlink(\"%s\") failed while moving "
494 "message: %s", fname, strerror(errno));
495 return FALSE;
496 }
497 return TRUE;
498 }
499
500
501
502 /************************************************
503 * Move message files *
504 ************************************************/
505
506 /* Move the files for a message (-H, -D, and msglog) from one directory (or
507 hierarchy) to another. It is assume that there is no -J file in existence when
508 this is done.
509
510 Arguments:
511 id the id of the message to be delivered
512 subdir the subdirectory name, or an empty string
513 from a prefix for "input" or "msglog" for where the message is now
514 to a prefix for "input" or "msglog" for where the message is to go
515
516 Returns: TRUE if all is well
517 FALSE if not, with error logged in panic and main logs
518 */
519
520 BOOL
spool_move_message(uschar * id,uschar * subdir,uschar * from,uschar * to)521 spool_move_message(uschar *id, uschar *subdir, uschar *from, uschar *to)
522 {
523 uschar * dest_qname = queue_name_dest ? queue_name_dest : queue_name;
524
525 /* Since we are working within the spool, de-taint the dest queue name */
526 dest_qname = string_copy_taint(dest_qname, FALSE);
527
528 /* Create any output directories that do not exist. */
529
530 (void) directory_make(spool_directory,
531 spool_q_sname(string_sprintf("%sinput", to), dest_qname, subdir),
532 INPUT_DIRECTORY_MODE, TRUE);
533 (void) directory_make(spool_directory,
534 spool_q_sname(string_sprintf("%smsglog", to), dest_qname, subdir),
535 INPUT_DIRECTORY_MODE, TRUE);
536
537 /* Move the message by first creating new hard links for all the files, and
538 then removing the old links. When moving messages onto the main spool, the -H
539 file should be set up last, because that's the one that tells Exim there is a
540 message to be delivered, so we create its new link last and remove its old link
541 first. Programs that look at the alternate directories should follow the same
542 rule of waiting for a -H file before doing anything. When moving messages off
543 the mail spool, the -D file should be open and locked at the time, thus keeping
544 Exim's hands off. */
545
546 if (!make_link(US"msglog", dest_qname, subdir, id, US"", from, to, TRUE) ||
547 !make_link(US"input", dest_qname, subdir, id, US"-D", from, to, FALSE) ||
548 !make_link(US"input", dest_qname, subdir, id, US"-H", from, to, FALSE))
549 return FALSE;
550
551 if (!break_link(US"input", subdir, id, US"-H", from, FALSE) ||
552 !break_link(US"input", subdir, id, US"-D", from, FALSE) ||
553 !break_link(US"msglog", subdir, id, US"", from, TRUE))
554 return FALSE;
555
556 log_write(0, LOG_MAIN, "moved from %s%s%s%sinput, %smsglog to %s%s%s%sinput, %smsglog",
557 *queue_name?"(":"", *queue_name?queue_name:US"", *queue_name?") ":"",
558 from, from,
559 *dest_qname?"(":"", *dest_qname?dest_qname:US"", *dest_qname?") ":"",
560 to, to);
561
562 return TRUE;
563 }
564
565
566 /* End of spool_out.c */
567 /* vi: aw ai sw=2
568 */
569