mail_open_ok.c

[詳解]

/*++
/* NAME
/*  mail_open_ok 3
/* SUMMARY
/*  scrutinize mail queue file
/* SYNOPSIS
/*  #include <mail_open_ok.h>
/*
/*  int mail_open_ok(queue_name, queue_id, statp, pathp)
/*  const char *queue_name;
/*  const char *queue_id;
/*  struct stat *statp;
/*  char    **pathp
/* DESCRIPTION
/*  mail_open_ok() determines if it is OK to open the specified
/*  queue file.
/*
/*  The queue name and queue id should conform to the syntax
/*  requirements for these names.
/*  Unfortunately, on some systems readdir() etc. can return bogus
/*  file names. For this reason, the code silently ignores invalid
/*  queue file names.
/*
/*  The file should have mode 0700. Files with other permissions
/*  are silently ignored.
/*
/*  The file should be a regular file.
/*  Files that do not satisfy this requirement are skipped with
/*  a warning.
/*
/*  The file link count is not restricted. With a writable maildrop
/*  directory, refusal to deliver linked files is prone to denial of
/*  service attack; it's better to deliver mail too often than not.
/*
/*  Upon return, the \fIstatp\fR argument receives the file
/*  attributes and \fIpathp\fR a copy of the file name. The file
/*  name is volatile. Make a copy if it is to be used for any
/*  appreciable amount of time.
/* DIAGNOSTICS
/*  Warnings: bad file attributes (file type), multiple hard links.
/*  mail_open_ok() returns MAIL_OPEN_YES for good files, MAIL_OPEN_NO
/*  for anything else. It is left up to the system administrator to
/*  deal with non-file objects.
/* BUGS
/*  mail_open_ok() examines a queue file without actually opening
/*  it, and therefore is susceptible to race conditions.
/* LICENSE
/* .ad
/* .fi
/*  The Secure Mailer license must be distributed with this software.
/* AUTHOR(S)
/*  Wietse Venema
/*  IBM T.J. Watson Research
/*  P.O. Box 704
/*  Yorktown Heights, NY 10598, USA
/*--*/

/* System libraries. */

#include <sys_defs.h>
#include <sys/stat.h>
#include <time.h>
#include <errno.h>

/* Utility library. */

#include <msg.h>
#include <warn_stat.h>

/* Global library. */

#include "mail_queue.h"
#include "mail_open_ok.h"

/* mail_open_ok - see if this file is OK to open */

int     mail_open_ok(const char *queue_name, const char *queue_id,
                     struct stat * statp, const char **path)
{
    if (mail_queue_name_ok(queue_name) == 0) {
    msg_warn("bad mail queue name: %s", queue_name);
    return (MAIL_OPEN_NO);
    }
    if (mail_queue_id_ok(queue_id) == 0)
    return (MAIL_OPEN_NO);


    /*
     * I really would like to look up the file attributes *after* opening the
     * file so that we could save one directory traversal on systems without
     * name-to-inode cache. However, we don't necessarily always want to open
     * the file.
     */
    *path = mail_queue_path((VSTRING *) 0, queue_name, queue_id);

    if (lstat(*path, statp) < 0) {
    if (errno != ENOENT)
        msg_warn("%s: %m", *path);
    return (MAIL_OPEN_NO);
    }
    if (!S_ISREG(statp->st_mode)) {
    msg_warn("%s: uid %ld: not a regular file", *path, (long) statp->st_uid);
    return (MAIL_OPEN_NO);
    }
    if ((statp->st_mode & S_IRWXU) != MAIL_QUEUE_STAT_READY)
    return (MAIL_OPEN_NO);

    /*
     * Workaround for spurious "file has 2 links" warnings in showq. As
     * kernels have evolved from non-interruptible system calls towards
     * fine-grained locks, the showq command has become likely to observe a
     * file while the queue manager is in the middle of renaming it, at a
     * time when the file has links to both the old and new name. We now log
     * the warning only when the condition appears to be persistent.
     */
#define MINUTE_SECONDS  60          /* XXX should be centralized */

    if (statp->st_nlink > 1) {
    if (msg_verbose)
        msg_info("%s: uid %ld: file has %d links", *path,
             (long) statp->st_uid, (int) statp->st_nlink);
    else if (statp->st_ctime < time((time_t *) 0) - MINUTE_SECONDS)
        msg_warn("%s: uid %ld: file has %d links", *path,
             (long) statp->st_uid, (int) statp->st_nlink);
    }
    return (MAIL_OPEN_YES);
}