1 /* $NetBSD: mail_copy.c,v 1.1.1.3 2013/01/02 18:58:58 tron Exp $ */ 2 3 /*++ 4 /* NAME 5 /* mail_copy 3 6 /* SUMMARY 7 /* copy message with extreme prejudice 8 /* SYNOPSIS 9 /* #include <mail_copy.h> 10 /* 11 /* int mail_copy(sender, orig_to, delivered, src, dst, flags, eol, why) 12 /* const char *sender; 13 /* const char *orig_to; 14 /* const char *delivered; 15 /* VSTREAM *src; 16 /* VSTREAM *dst; 17 /* int flags; 18 /* const char *eol; 19 /* DSN_BUF *why; 20 /* DESCRIPTION 21 /* mail_copy() copies a mail message from record stream to stream-lf 22 /* stream, and attempts to detect all possible I/O errors. 23 /* 24 /* Arguments: 25 /* .IP sender 26 /* The sender envelope address. 27 /* .IP delivered 28 /* Null pointer or delivered-to: header address. 29 /* .IP src 30 /* The source record stream, positioned at the beginning of the 31 /* message contents. 32 /* .IP dst 33 /* The destination byte stream (in stream-lf format). If the message 34 /* ends in an incomplete line, a newline character is appended to 35 /* the output. 36 /* .IP flags 37 /* The binary OR of zero or more of the following: 38 /* .RS 39 /* .IP MAIL_COPY_QUOTE 40 /* Prepend a `>' character to lines beginning with `From '. 41 /* .IP MAIL_COPY_DOT 42 /* Prepend a `.' character to lines beginning with `.'. 43 /* .IP MAIL_COPY_TOFILE 44 /* On systems that support this, use fsync() to flush the 45 /* data to stable storage, and truncate the destination 46 /* file to its original length in case of problems. 47 /* .IP MAIL_COPY_FROM 48 /* Prepend a UNIX-style From_ line to the message. 49 /* .IP MAIL_COPY_BLANK 50 /* Append an empty line to the end of the message. 51 /* .IP MAIL_COPY_DELIVERED 52 /* Prepend a Delivered-To: header with the name of the 53 /* \fIdelivered\fR attribute. 54 /* The address is quoted according to RFC822 rules. 55 /* .IP MAIL_COPY_ORIG_RCPT 56 /* Prepend an X-Original-To: header with the original 57 /* envelope recipient address. 58 /* .IP MAIL_COPY_RETURN_PATH 59 /* Prepend a Return-Path: header with the value of the 60 /* \fIsender\fR attribute. 61 /* .RE 62 /* The manifest constant MAIL_COPY_MBOX is a convenient shorthand for 63 /* all MAIL_COPY_XXX options that are appropriate for mailbox delivery. 64 /* Use MAIL_COPY_NONE to copy a message without any options enabled. 65 /* .IP eol 66 /* Record delimiter, for example, LF or CF LF. 67 /* .IP why 68 /* A null pointer, or storage for the reason of failure in 69 /* the form of a DSN detail code plus free text. 70 /* DIAGNOSTICS 71 /* A non-zero result means the operation failed. Warnings: corrupt 72 /* message file. A corrupt message is marked as corrupt. 73 /* 74 /* The result is the bit-wise OR of zero or more of the following: 75 /* .IP MAIL_COPY_STAT_CORRUPT 76 /* The queue file is marked as corrupt. 77 /* .IP MAIL_COPY_STAT_READ 78 /* A read error was detected; errno specifies the nature of the problem. 79 /* .IP MAIL_COPY_STAT_WRITE 80 /* A write error was detected; errno specifies the nature of the problem. 81 /* SEE ALSO 82 /* mark_corrupt(3), mark queue file as corrupted. 83 /* LICENSE 84 /* .ad 85 /* .fi 86 /* The Secure Mailer license must be distributed with this software. 87 /* AUTHOR(S) 88 /* Wietse Venema 89 /* IBM T.J. Watson Research 90 /* P.O. Box 704 91 /* Yorktown Heights, NY 10598, USA 92 /*--*/ 93 94 /* System library. */ 95 96 #include <sys_defs.h> 97 #include <sys/stat.h> 98 #include <string.h> 99 #include <unistd.h> 100 #include <time.h> 101 #include <errno.h> 102 103 /* Utility library. */ 104 105 #include <msg.h> 106 #include <htable.h> 107 #include <vstream.h> 108 #include <vstring.h> 109 #include <vstring_vstream.h> 110 #include <stringops.h> 111 #include <iostuff.h> 112 #include <warn_stat.h> 113 114 /* Global library. */ 115 116 #include "quote_822_local.h" 117 #include "record.h" 118 #include "rec_type.h" 119 #include "mail_queue.h" 120 #include "mail_addr.h" 121 #include "mark_corrupt.h" 122 #include "mail_params.h" 123 #include "mail_copy.h" 124 #include "mbox_open.h" 125 #include "dsn_buf.h" 126 #include "sys_exits.h" 127 128 /* mail_copy - copy message with extreme prejudice */ 129 130 int mail_copy(const char *sender, 131 const char *orig_rcpt, 132 const char *delivered, 133 VSTREAM *src, VSTREAM *dst, 134 int flags, const char *eol, DSN_BUF *why) 135 { 136 const char *myname = "mail_copy"; 137 VSTRING *buf; 138 char *bp; 139 off_t orig_length; 140 int read_error; 141 int write_error; 142 int corrupt_error = 0; 143 time_t now; 144 int type; 145 int prev_type; 146 struct stat st; 147 off_t size_limit; 148 149 /* 150 * Workaround 20090114. This will hopefully get someone's attention. The 151 * problem with file_size_limit < message_size_limit is that mail will be 152 * delivered again and again until someone removes it from the queue by 153 * hand, because Postfix cannot mark a recipient record as "completed". 154 */ 155 if (fstat(vstream_fileno(src), &st) < 0) 156 msg_fatal("fstat: %m"); 157 if ((size_limit = get_file_limit()) < st.st_size) 158 msg_panic("file size limit %lu < message size %lu. This " 159 "causes large messages to be delivered repeatedly " 160 "after they were submitted with \"sendmail -t\" " 161 "or after recipients were added with the Milter " 162 "SMFIR_ADDRCPT request", 163 (unsigned long) size_limit, 164 (unsigned long) st.st_size); 165 166 /* 167 * Initialize. 168 */ 169 #ifndef NO_TRUNCATE 170 if ((flags & MAIL_COPY_TOFILE) != 0) 171 if ((orig_length = vstream_fseek(dst, (off_t) 0, SEEK_END)) < 0) 172 msg_fatal("seek file %s: %m", VSTREAM_PATH(dst)); 173 #endif 174 buf = vstring_alloc(100); 175 176 /* 177 * Prepend a bunch of headers to the message. 178 */ 179 if (flags & (MAIL_COPY_FROM | MAIL_COPY_RETURN_PATH)) { 180 if (sender == 0) 181 msg_panic("%s: null sender", myname); 182 quote_822_local(buf, sender); 183 if (flags & MAIL_COPY_FROM) { 184 time(&now); 185 vstream_fprintf(dst, "From %s %.24s%s", *sender == 0 ? 186 MAIL_ADDR_MAIL_DAEMON : vstring_str(buf), 187 asctime(localtime(&now)), eol); 188 } 189 if (flags & MAIL_COPY_RETURN_PATH) { 190 vstream_fprintf(dst, "Return-Path: <%s>%s", 191 *sender ? vstring_str(buf) : "", eol); 192 } 193 } 194 if (flags & MAIL_COPY_ORIG_RCPT) { 195 if (orig_rcpt == 0) 196 msg_panic("%s: null orig_rcpt", myname); 197 198 /* 199 * An empty original recipient record almost certainly means that 200 * original recipient processing was disabled. 201 */ 202 if (*orig_rcpt) { 203 quote_822_local(buf, orig_rcpt); 204 vstream_fprintf(dst, "X-Original-To: %s%s", vstring_str(buf), eol); 205 } 206 } 207 if (flags & MAIL_COPY_DELIVERED) { 208 if (delivered == 0) 209 msg_panic("%s: null delivered", myname); 210 quote_822_local(buf, delivered); 211 vstream_fprintf(dst, "Delivered-To: %s%s", vstring_str(buf), eol); 212 } 213 214 /* 215 * Copy the message. Escape lines that could be confused with the ugly 216 * From_ line. Make sure that there is a blank line at the end of the 217 * message so that the next ugly From_ can be found by mail reading 218 * software. 219 * 220 * XXX Rely on the front-end services to enforce record size limits. 221 */ 222 #define VSTREAM_FWRITE_BUF(s,b) \ 223 vstream_fwrite((s),vstring_str(b),VSTRING_LEN(b)) 224 225 prev_type = REC_TYPE_NORM; 226 while ((type = rec_get(src, buf, 0)) > 0) { 227 if (type != REC_TYPE_NORM && type != REC_TYPE_CONT) 228 break; 229 bp = vstring_str(buf); 230 if (prev_type == REC_TYPE_NORM) { 231 if ((flags & MAIL_COPY_QUOTE) && *bp == 'F' && !strncmp(bp, "From ", 5)) 232 VSTREAM_PUTC('>', dst); 233 if ((flags & MAIL_COPY_DOT) && *bp == '.') 234 VSTREAM_PUTC('.', dst); 235 } 236 if (VSTRING_LEN(buf) && VSTREAM_FWRITE_BUF(dst, buf) != VSTRING_LEN(buf)) 237 break; 238 if (type == REC_TYPE_NORM && vstream_fputs(eol, dst) == VSTREAM_EOF) 239 break; 240 prev_type = type; 241 } 242 if (vstream_ferror(dst) == 0) { 243 if (var_fault_inj_code == 1) 244 type = 0; 245 if (type != REC_TYPE_XTRA) { 246 /* XXX Where is the queue ID? */ 247 msg_warn("bad record type: %d in message content", type); 248 corrupt_error = mark_corrupt(src); 249 } 250 if (prev_type != REC_TYPE_NORM) 251 vstream_fputs(eol, dst); 252 if (flags & MAIL_COPY_BLANK) 253 vstream_fputs(eol, dst); 254 } 255 vstring_free(buf); 256 257 /* 258 * Make sure we read and wrote all. Truncate the file to its original 259 * length when the delivery failed. POSIX does not require ftruncate(), 260 * so we may have a portability problem. Note that fclose() may fail even 261 * while fflush and fsync() succeed. Think of remote file systems such as 262 * AFS that copy the file back to the server upon close. Oh well, no 263 * point optimizing the error case. XXX On systems that use flock() 264 * locking, we must truncate the file file before closing it (and losing 265 * the exclusive lock). 266 */ 267 read_error = vstream_ferror(src); 268 write_error = vstream_fflush(dst); 269 #ifdef HAS_FSYNC 270 if ((flags & MAIL_COPY_TOFILE) != 0) 271 write_error |= fsync(vstream_fileno(dst)); 272 #endif 273 if (var_fault_inj_code == 2) { 274 read_error = 1; 275 errno = ENOENT; 276 } 277 if (var_fault_inj_code == 3) { 278 write_error = 1; 279 errno = ENOENT; 280 } 281 #ifndef NO_TRUNCATE 282 if ((flags & MAIL_COPY_TOFILE) != 0) 283 if (corrupt_error || read_error || write_error) 284 /* Complain about ignored "undo" errors? So sue me. */ 285 (void) ftruncate(vstream_fileno(dst), orig_length); 286 #endif 287 write_error |= vstream_fclose(dst); 288 289 /* 290 * Return the optional verbose error description. 291 */ 292 #define TRY_AGAIN_ERROR(errno) \ 293 (errno == EAGAIN || errno == ESTALE) 294 295 if (why && read_error) 296 dsb_unix(why, TRY_AGAIN_ERROR(errno) ? "4.3.0" : "5.3.0", 297 sys_exits_detail(EX_IOERR)->text, 298 "error reading message: %m"); 299 if (why && write_error) 300 dsb_unix(why, mbox_dsn(errno, "5.3.0"), 301 sys_exits_detail(EX_IOERR)->text, 302 "error writing message: %m"); 303 304 /* 305 * Use flag+errno description when the optional verbose description is 306 * not desired. 307 */ 308 return ((corrupt_error ? MAIL_COPY_STAT_CORRUPT : 0) 309 | (read_error ? MAIL_COPY_STAT_READ : 0) 310 | (write_error ? MAIL_COPY_STAT_WRITE : 0)); 311 } 312