Documentation:
+ README_FILES/ Instructions for specific Postfix features
html/ HTML format
man/ UNIX on-line manual page format
src/postlock/ Postfix locking for shell scripts
src/postlog/ Postfix logging for shell scripts
src/postmap/ Postfix lookup table management
+ src/postqueue/ Postfix queue control program
src/postsuper/ Postfix house keeping program
src/sendmail/ Sendmail compatibility interface
Test programs:
src/fsstone/ Measure file system overhead
- src/smtpstone/ SMTP server torture test
+ src/smtpstone/ SMTP and QMQP server torture test
Miscellaneous:
Security: additional run-time checks to discourage sharing
of Postfix user/group ID values with other accounts.
+20020104
+
+ Cleanup: SMTPD access maps now return DUNNO (undetermined)
+ instead of OK when a recipient address contains multiple
+ domains (user@dom1@dom2, etcetera). Victor Duchovny, Morgan
+ Stanley. File: smtpd/smtpd_check.c.
+
+ Bugfix: SMTPD access maps did not handle address extensions.
+ File: smtpd/smtpd_check.c.
+
Open problems:
Low: don't do user@domain and @domain lookups in
Medium: make address rewriting on/off configurable for
envelopes and/or headers.
- Medium: smtpd access maps don't understand the recipient
- delimiter setting.
-
Low: generic showq protocol, to allow for more intelligent
processing than just mailq. Maybe marry this with postsuper.
src/lmtp src/trivial-rewrite src/qmgr src/smtp src/bounce src/pipe \
src/showq src/postalias src/postcat src/postconf src/postdrop \
src/postkick src/postlock src/postlog src/postmap src/postqueue \
- src/postsuper src/nqmgr src/qmqpd src/spawn src/flush src/virtual \
- # proto man html
+ src/postsuper src/nqmgr src/qmqpd src/spawn src/flush src/virtual
+MANDIRS = proto man html
default: update
(set -e; echo "[$$i]"; cd $$i; $(MAKE) $(OPTS) $@ MAKELEVEL=) || exit 1; \
done
+manpages:
+ set -e; for i in $(MANDIRS); do \
+ (set -e; echo "[$$i]"; cd $$i; $(MAKE) -f Makefile.in $(OPTS) MAKELEVEL=) || exit 1; \
+ done
+
printfck: update
install: update
A Postfix content filter receives unfiltered mail from Postfix and
either bounces the mail or re-injects filtered mail back into Postfix.
-It involves an incompatible change to queue file formats. Older
-Postfix versions will reject mail that needs to be content filtered,
-and will move the queue file to the "corrupt" mail queue subdirectory.
-
This document describes two approaches to content filtering.
Simple content filtering example
================================
-The first example is simpler to set up, but is also more resource
-intensive. With the shell script as shown you will lose a factor
-of four in Postfix performance for transit mail that arrives and
-leaves via SMTP. You will lose another factor in transit performance
-for each additional temporary file that is created and deleted in
-the process of content filtering. The performance impact is less
-for mail that is submitted or delivered locally, because such
-deliveries are not as fast as SMTP transit mail.
-
-The example assumes that only mail arriving via SMTP needs to be
-content filtered.
-
- ..................................
- : Postfix :
- ----->smtpd \ /local---->
- : -cleanup->queue- :
- ---->pickup / \smtp----->
- ^ : | :
- | : \pipe-----+
- | .................................. |
- | |
- | |
- +------sendmail<-------filter<---------+
-
-1 - Create a dedicated local user account called "filter". The
- user will never log in, and can be given a "*" password and
- non-existent shell and home directory. This user handles all
- potentially dangerous mail content - that is why it should be
- a separate account.
-
-2 - Create a directory /var/spool/filter that is accessible only
- to the "filter" user. This is where the content filtering will
- store its temporary files.
-
-3 - Define a content filtering entry in the Postfix master file:
-
- /etc/postfix/master.cf:
- filter unix - n n - - pipe
- flags=Rq user=filter argv=/somewhere/filter -f ${sender} -- ${recipient}
+The first example is simple to set up. It uses a shell script that
+receives unfiltered mail from the Postfix pipe delivery agent, and
+that feeds filtered mail back into the Postfix sendmail command.
+Only mail arriving via SMTP will be content filtered.
+
+ ..................................
+ : Postfix :
+Unfiltered mail----->smtpd \ /local---->Filtered mail
+ : -cleanup->queue- :
+ ---->pickup / \smtp----->Filtered mail
+ ^ : | :
+ | : \pipe-----+
+ | .................................. |
+ | |
+ | |
+ +-Postfix sendmail<----filter script<--+
The /some/where/filter program can be a simple shell script like this:
#!/bin/sh
- # Localize these
+ # Localize these.
INSPECT_DIR=/var/spool/filter
SENDMAIL="/usr/sbin/sendmail -i"
sendmail produces.
I suggest that you play with this script for a while until you are
-satisfied with the results. Run it as the filter user, with a real
-message (headers+body) as input:
+satisfied with the results. Run it with a real message (headers+body)
+as input:
% /some/where/filter -f sender recipient... <message-file
-Turn on content filtering for mail arriving via SMTP only, by
-appending "-o content_filter=filter:dummy" to the master.cf
-entry that defines the Postfix SMTP server:
+Once you're satisfied with the content filtering script:
+
+1 - Create a dedicated local user account called "filter". This
+ user handles all potentially dangerous mail content - that is
+ why it should be a separate account. Do not use "nobody", and
+ most certainly do not use "root" or "postfix". The user will
+ never log in, and can be given a "*" password and non-existent
+ shell and home directory.
+
+2 - Create a directory /var/spool/filter that is accessible only
+ to the "filter" user. This is where the content filtering script
+ is supposed to store its temporary files.
+
+3 - Define the content filter in the Postfix master file:
/etc/postfix/master.cf:
- smtp inet ...stuff... smtpd
- -o content_filter=filter:dummy
+ filter unix - n n - - pipe
+ flags=Rq user=filter argv=/somewhere/filter -f ${sender} -- ${recipient}
-The content_filter configuration parameter accepts the same
-syntax as the right-hand side in a Postfix transport table.
+To turn on content filtering for mail arriving via SMTP only, append
+"-o content_filter=filter:" to the master.cf entry that defines
+the Postfix SMTP server:
+
+ /etc/postfix/master.cf:
+ smtp inet ...stuff... smtpd
+ -o content_filter=filter:
+
+Note the ":" at the end!! The content_filter configuration parameter
+accepts the same syntax as the right-hand side in a Postfix transport
+table. Execute "postfix reload" to complete the change.
+
+To turn off content filtering, edit the master.cf file, remove the
+"-o content_filter=filter:" text from the entry that defines the
+Postfix SMTP server, and execute another "postfix reload".
+
+With the shell script as shown above you will lose a factor of four
+in Postfix performance for transit mail that arrives and leaves
+via SMTP. You will lose another factor in transit performance for
+each additional temporary file that is created and deleted in the
+process of content filtering. The performance impact is less for
+mail that is submitted or delivered locally, because such deliveries
+are already slower than SMTP transit mail.
Simple content filter limitations
=================================
-Incompatible changes with snapshot-200201XX
+Incompatible changes with snapshot-20020106
===========================================
Postfix will not run if it detects that the postfix user or group
Otherwise, some Postfix commands will no longer work (namely, the
ones that are now implemented by set-group ID client programs).
-Major changes with snapshot-200201XX
+Postfix SMTP access maps no longer return OK for non-local recipient
+mail addresses that contain multiple domains (user@dom1@dom2,
+user%dom1@dom2, etcetera); the lookup now returns DUNNO (undetermined).
+Non-local multi-domain addresses were already prohibited from
+matching the permit_mx_backup and the relay_domains-based restrictions.
+
+Major changes with snapshot-20020106
====================================
Simplification of the local Postfix security model.
Incompatible changes with snapshot-20011210
===========================================
-Postfix SMTPD access maps no longer match non-local mail addresses
-that contain multiple domains (user@dom1@dom2, user%dom1@dom2,
-etcetera). This change prevents false or spurious matches.
-Non-local multi-domain addresses are already prohibited from matching
-permit_mx_backup and the relay_domains-based restrictions.
-
Stricter checking of Postfix chroot configurations. The Postfix
startup procedure now warns if "system" directories (etc, bin, lib,
usr) under the Postfix top-level queue directory are not owned by
#
# DESCRIPTION
# The optional access table directs the Postfix SMTP server
-# to selectively reject or accept mail from or to specific
-# hosts, domains, networks, host addresses or mail
-# addresses.
+# to selectively reject or accept mail. Access can be
+# allowed or denied for specific host names, domain names,
+# networks, host network addresses or mail addresses.
#
# Normally, the access table is specified as a text file
# that serves as input to the postmap(1) command. The
# When pattern matches a mail address, domain or host
# address, perform the corresponding action.
#
+# blank lines and comments
+# Empty lines and whitespace-only lines are ignored,
+# as are lines whose first non-whitespace character
+# is a `#'.
+#
# multi-line text
-# A line that starts with whitespace (space or tab)
-# is a continuation of the previous line. An empty
-# line terminates the previous line, as does a line
-# that starts with non-whitespace (text or comment).
-# A comment line that starts with whitespace does not
-# terminate multi-line text.
-#
-# comments
-# The # is recognized as the start of a comment, but
-# only when it is the first non-whitespace character
-# on a line. A comment terminates at the end of the
-# line, even when the next line starts with whites-
-# pace.
-#
-# PATTERNS
+# A logical line starts with non-whitespace text. A
+# line that starts with whitespace continues a logi-
+# cal line.
+#
+# EMAIL ADDRESS PATTERNS
# With lookups from indexed files such as DB or DBM, or from
-# networked tables such as NIS, LDAP or SQL, patterns are
-# tried in the order as listed below:
+# networked tables such as NIS, LDAP or SQL, the following
+# lookup patterns are examined in the order as listed:
#
# user@domain
# Matches the specified mail address.
#
# domain.name
-# Matches the domain.name itself and any subdomain
-# thereof, either in hostnames or in mail addresses.
-# Top-level domains will never be matched.
+# Matches domain.name as the domain part of an email
+# address.
+#
+# The pattern domain.name also matches subdomains,
+# but only when the string smtpd_access_maps is
+# listed in the Postfix parent_domain_matches_subdo-
+# mains configuration setting. Otherwise, specify
+# .domain.name (note the initial dot) in order to
+# match subdomains.
#
-# user@ Matches all mail addresses with the specified user
+# user@ Matches all mail addresses with the specified user
# part.
#
+# Note: lookup of the null sender address may not be possi-
+# ble with all supported types of lookup table. A workaround
+# is to specify smtpd_null_access_lookup_key = <> in the
+# Postfix main.cf file, and to specify <> as the left-hand
+# field in the access table.
+#
+# ADDRESS EXTENSION
+# When a mail address localpart contains the optional recip-
+# ient delimiter (e.g., user+foo@domain), the lookup order
+# becomes: user+foo@domain, user@domain, domain, user+foo@,
+# and user@.
+#
+# HOST NAME/ADDRESS PATTERNS
+# With lookups from indexed files such as DB or DBM, or from
+# networked tables such as NIS, LDAP or SQL, the following
+# lookup patterns are examined in the order as listed:
+#
+# domain.name
+# Matches domain.name.
+#
+# The pattern domain.name also matches subdomains,
+# but only when the string smtpd_access_maps is
+# listed in the Postfix parent_domain_matches_subdo-
+# mains configuration setting. Otherwise, specify
+# .domain.name (note the initial dot) in order to
+# match subdomains.
+#
# net.work.addr.ess
#
# net.work.addr
#
# net.work
#
-# net Matches any host address in the specified network.
-# A network address is a sequence of one or more
+# net Matches any host address in the specified network.
+# A network address is a sequence of one or more
# octets separated by ".".
#
# ACTIONS
# [45]NN text
-# Reject the address etc. that matches the pattern,
+# Reject the address etc. that matches the pattern,
# and respond with the numerical code and text.
#
# REJECT Reject the address etc. that matches the pattern. A
# reject_unauth_destination, and so on).
#
# REGULAR EXPRESSION TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# the table is given in the form of regular expressions. For
-# a description of regular expression lookup table syntax,
+# a description of regular expression lookup table syntax,
# see regexp_table(5) or pcre_table(5).
#
-# Each pattern is a regular expression that is applied to
+# Each pattern is a regular expression that is applied to
# the entire string being looked up. Depending on the appli-
-# cation, that string is an entire client hostname, an
+# cation, that string is an entire client hostname, an
# entire client IP address, or an entire mail address. Thus,
-# no parent domain or parent network search is done, and
-# user@domain mail addresses are not broken up into their
-# user@ and domain constituent parts.
+# no parent domain or parent network search is done,
+# user@domain mail addresses are not broken up into their
+# user@ and domain constituent parts, nor is user+foo broken
+# up into user and foo.
#
# Patterns are applied in the order as specified in the
# table, until a pattern is found that matches the search
# string.
#
-# Actions are the same as with normal indexed file lookups,
-# with the additional feature that parenthesized substrings
-# from the pattern can be interpolated as $1, $2 and so on.
+# Actions are the same as with indexed file lookups, with
+# the additional feature that parenthesized substrings from
+# the pattern can be interpolated as $1, $2 and so on.
#
# BUGS
-# The table format does not understand quoting conventions.
+# The table format does not understand quoting conventions.
#
# SEE ALSO
# postmap(1) create mapping table
# regexp_table(5) format of POSIX regular expression tables
#
# LICENSE
-# The Secure Mailer license must be distributed with this
+# The Secure Mailer license must be distributed with this
# software.
#
# AUTHOR(S)
#
# name: value1, value2, ...
#
-# o A line that starts with whitespace (space or tab)
-# is a continuation of the previous line. An empty
-# line terminates the previous line, as does a line
-# that starts with non-whitespace (text or comment).
-# A comment line that starts with whitespace does not
-# terminate multi-line text.
-#
-# o The # is recognized as the start of a comment, but
-# only when it is the first non-whitespace character
-# on a line. A comment terminates at the end of the
-# line, even when the next line starts with whites-
-# pace.
-#
-# The name is a local address (no domain part). Use double
-# quotes when the name contains any special characters such
-# as whitespace, `#', `:', or `@'. The name is folded to
+# o Empty lines and whitespace-only lines are ignored,
+# as are lines whose first non-whitespace character
+# is a `#'.
+#
+# o A logical line starts with non-whitespace text. A
+# line that starts with whitespace continues a logi-
+# cal line.
+#
+# The name is a local address (no domain part). Use double
+# quotes when the name contains any special characters such
+# as whitespace, `#', `:', or `@'. The name is folded to
# lowercase, in order to make database lookups case insensi-
# tive.
#
# In addition, when an alias exists for owner-name, delivery
-# diagnostics are directed to that address, instead of to
+# diagnostics are directed to that address, instead of to
# the originator. This is typically used to direct delivery
-# errors to the owner of a mailing list, who is in a better
-# position to deal with mailing list delivery problems than
+# errors to the owner of a mailing list, who is in a better
+# position to deal with mailing list delivery problems than
# the originator of the undelivered mail.
#
# The value contains one or more of the following:
#
# address
-# Mail is forwarded to address, which is compatible
+# Mail is forwarded to address, which is compatible
# with the RFC 822 standard.
#
# /file/name
-# Mail is appended to /file/name. See local(8) for
-# details of delivery to file. Delivery is not lim-
-# ited to regular files. For example, to dispose of
+# Mail is appended to /file/name. See local(8) for
+# details of delivery to file. Delivery is not lim-
+# ited to regular files. For example, to dispose of
# unwanted mail, deflect it to /dev/null.
#
# |command
-# Mail is piped into command. Commands that contain
-# special characters, such as whitespace, should be
-# enclosed between double quotes. See local(8) for
+# Mail is piped into command. Commands that contain
+# special characters, such as whitespace, should be
+# enclosed between double quotes. See local(8) for
# details of delivery to command.
#
# When the command fails, a limited amount of command
-# output is mailed back to the sender. The file
-# /usr/include/sysexits.h defines the expected exit
-# status codes. For example, use |"exit 67" to simu-
-# late a "user unknown" error, and |"exit 0" to
+# output is mailed back to the sender. The file
+# /usr/include/sysexits.h defines the expected exit
+# status codes. For example, use |"exit 67" to simu-
+# late a "user unknown" error, and |"exit 0" to
# implement an expensive black hole.
#
# :include:/file/name
-# Mail is sent to the destinations listed in the
+# Mail is sent to the destinations listed in the
# named file. Lines in :include: files have the same
# syntax as the right-hand side of alias entries.
#
#
# ADDRESS EXTENSION
# When alias database search fails, and the recipient local-
-# part contains the optional recipient delimiter (e.g.,
-# user+foo), the search is repeated for the unextended
+# part contains the optional recipient delimiter (e.g.,
+# user+foo), the search is repeated for the unextended
# address (e.g., user).
#
# CONFIGURATION PARAMETERS
-# The following main.cf parameters are especially relevant
-# to this topic. See the Postfix main.cf file for syntax
-# details and for default values. Use the postfix reload
+# The following main.cf parameters are especially relevant
+# to this topic. See the Postfix main.cf file for syntax
+# details and for default values. Use the postfix reload
# command after a configuration change.
#
# alias_maps
# List of alias databases.
#
# allow_mail_to_commands
-# Restrict the usage of mail delivery to external
+# Restrict the usage of mail delivery to external
# command.
#
# allow_mail_to_files
-# Restrict the usage of mail delivery to external
+# Restrict the usage of mail delivery to external
# file.
#
# expand_owner_alias
# When delivering to an alias that has an owner- com-
-# panion alias, set the envelope sender address to
-# the right-hand side of the owner alias, instead
+# panion alias, set the envelope sender address to
+# the right-hand side of the owner alias, instead
# using of the left-hand side address.
#
# owner_request_special
# addresses.
#
# recipient_delimiter
-# Delimiter that separates recipients from address
+# Delimiter that separates recipients from address
# extensions.
#
# STANDARDS
# postalias(1) alias database management
#
# LICENSE
-# The Secure Mailer license must be distributed with this
+# The Secure Mailer license must be distributed with this
# software.
#
# AUTHOR(S)
# When pattern matches a mail address, replace it by
# the corresponding result.
#
+# blank lines and comments
+# Empty lines and whitespace-only lines are ignored,
+# as are lines whose first non-whitespace character
+# is a `#'.
+#
# multi-line text
-# A line that starts with whitespace (space or tab)
-# is a continuation of the previous line. An empty
-# line terminates the previous line, as does a line
-# that starts with non-whitespace (text or comment).
-# A comment line that starts with whitespace does not
-# terminate multi-line text.
-#
-# comments
-# The # is recognized as the start of a comment, but
-# only when it is the first non-whitespace character
-# on a line. A comment terminates at the end of the
-# line, even when the next line starts with whites-
-# pace.
+# A logical line starts with non-whitespace text. A
+# line that starts with whitespace continues a logi-
+# cal line.
#
# With lookups from indexed files such as DB or DBM, or from
-# networked tables such as NIS, LDAP or SQL, patterns are
+# networked tables such as NIS, LDAP or SQL, patterns are
# tried in the order as listed below:
#
# user@domain address
-# user@domain is replaced by address. This form has
+# user@domain is replaced by address. This form has
# the highest precedence.
#
-# This form useful to clean up addresses produced by
-# legacy mail systems. It can also be used to pro-
-# duce Firstname.Lastname style addresses, but see
+# This form useful to clean up addresses produced by
+# legacy mail systems. It can also be used to pro-
+# duce Firstname.Lastname style addresses, but see
# below for a simpler solution.
#
# user address
# user@site is replaced by address when site is equal
-# to $myorigin, when site is listed in $mydestina-
+# to $myorigin, when site is listed in $mydestina-
# tion, or when it is listed in $inet_interfaces.
#
-# This form is useful for replacing login names by
+# This form is useful for replacing login names by
# Firstname.Lastname.
#
# @domain address
-# Every address in domain is replaced by address.
+# Every address in domain is replaced by address.
# This form has the lowest precedence.
#
-# In all the above forms, when address has the form @other-
+# In all the above forms, when address has the form @other-
# domain, the result is the same user in otherdomain.
#
# ADDRESS EXTENSION
-# When table lookup fails, and the address localpart con-
-# tains the optional recipient delimiter (e.g.,
-# user+foo@domain), the search is repeated for the unex-
-# tended address (e.g. user@domain), and the unmatched
-# extension is propagated to the result of table lookup. The
-# matching order is: user+foo@domain, user@domain, user+foo,
-# user, and @domain.
+# When a mail address localpart contains the optional recip-
+# ient delimiter (e.g., user+foo@domain), the lookup order
+# becomes: user+foo@domain, user@domain, user+foo, user, and
+# @domain. An unmatched address extension (+foo) is propa-
+# gated to the result of table lookup.
#
# REGULAR EXPRESSION TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# the table is given in the form of regular expressions. For
-# a description of regular expression lookup table syntax,
+# a description of regular expression lookup table syntax,
# see regexp_table(5) or pcre_table(5).
#
-# Each pattern is a regular expression that is applied to
+# Each pattern is a regular expression that is applied to
# the entire address being looked up. Thus, user@domain mail
-# addresses are not broken up into their user and @domain
+# addresses are not broken up into their user and @domain
# constituent parts, nor is user+foo broken up into user and
# foo.
#
-# Patterns are applied in the order as specified in the
-# table, until a pattern is found that matches the search
+# Patterns are applied in the order as specified in the
+# table, until a pattern is found that matches the search
# string.
#
-# Results are the same as with normal indexed file lookups,
-# with the additional feature that parenthesized substrings
-# from the pattern can be interpolated as $1, $2 and so on.
+# Results are the same as with indexed file lookups, with
+# the additional feature that parenthesized substrings from
+# the pattern can be interpolated as $1, $2 and so on.
#
# BUGS
# The table format does not understand quoting conventions.
# When pattern matches a search string, use the cor-
# responding result.
#
+# blank lines and comments
+# Empty lines and whitespace-only lines are ignored,
+# as are lines whose first non-whitespace character
+# is a `#'.
+#
# multi-line text
-# A line that starts with whitespace (space or tab)
-# is a continuation of the previous line. An empty
-# line terminates the previous line, as does a line
-# that starts with non-whitespace (text or comment).
-# A comment line that starts with whitespace does not
-# terminate multi-line text.
-#
-# comments
-# The # is recognized as the start of a comment, but
-# only when it is the first non-whitespace character
-# on a line. A comment terminates at the end of the
-# line, even when the next line starts with whites-
-# pace.
+# A logical line starts with non-whitespace text. A
+# line that starts with whitespace continues a logi-
+# cal line.
#
# Each pattern is a perl-like regular expression. The
-# expression delimiter can be any character, except whites-
-# pace or characters that have special meaning (tradition-
-# ally the forward slash is used). The regular expression
+# expression delimiter can be any character, except whites-
+# pace or characters that have special meaning (tradition-
+# ally the forward slash is used). The regular expression
# can contain whitespace.
#
# By default, matching is case-insensitive, although follow-
-# ing the second slash with an `i' flag will reverse this.
-# Other flags are supported, but the only other useful one
+# ing the second slash with an `i' flag will reverse this.
+# Other flags are supported, but the only other useful one
# is `U', which makes matching ungreedy (see PCRE documenta-
# tion and source for more info).
#
-# Each pattern is applied to the entire lookup key string.
-# Depending on the application, that string is an entire
+# Each pattern is applied to the entire lookup key string.
+# Depending on the application, that string is an entire
# client hostname, an entire client IP address, or an entire
-# mail address. Thus, no parent domain or parent network
-# search is done, and user@domain mail addresses are not
-# broken up into their user and domain constituent parts,
+# mail address. Thus, no parent domain or parent network
+# search is done, and user@domain mail addresses are not
+# broken up into their user and domain constituent parts,
# nor is user+foo broken up into user and foo.
#
-# Patterns are applied in the order as specified in the
-# table, until a pattern is found that matches the search
+# Patterns are applied in the order as specified in the
+# table, until a pattern is found that matches the search
# string.
#
-# Substitution of substrings from the matched expression
-# into the result string is possible using the conventional
-# perl syntax ($1, $2, etc.). The macros in the result
-# string may need to be written as ${n} or $(n) if they
+# Substitution of substrings from the matched expression
+# into the result string is possible using the conventional
+# perl syntax ($1, $2, etc.). The macros in the result
+# string may need to be written as ${n} or $(n) if they
# aren't followed by whitespace.
#
# EXAMPLE SMTPD ACCESS MAP
# When pattern matches a search string, use the cor-
# responding result.
#
+# blank lines and comments
+# Empty lines and whitespace-only lines are ignored,
+# as are lines whose first non-whitespace character
+# is a `#'.
+#
# multi-line text
-# A line that starts with whitespace (space or tab)
-# is a continuation of the previous line. An empty
-# line terminates the previous line, as does a line
-# that starts with non-whitespace (text or comment).
-# A comment line that starts with whitespace does not
-# terminate multi-line text.
-#
-# comments
-# The # is recognized as the start of a comment, but
-# only when it is the first non-whitespace character
-# on a line. A comment terminates at the end of the
-# line, even when the next line starts with whites-
-# pace.
+# A logical line starts with non-whitespace text. A
+# line that starts with whitespace continues a logi-
+# cal line.
#
# pattern1!pattern2 result
# Matches pattern1 but not pattern2.
# Each pattern is a regular expression enclosed by a pair of
# delimiters. The regular expression syntax is described in
# re_format(7). The expression delimiter can be any charac-
-# ter, except whitespace or characters that have special
-# meaning (traditionally the forward slash is used). The
+# ter, except whitespace or characters that have special
+# meaning (traditionally the forward slash is used). The
# regular expression can contain whitespace.
#
# By default, matching is case-insensitive, although follow-
-# ing the second slash with an `i' flag will reverse this.
-# Other flags are `x' (disable extended expression syntax),
+# ing the second slash with an `i' flag will reverse this.
+# Other flags are `x' (disable extended expression syntax),
# and `m' (enable multi-line mode).
#
-# Each pattern is applied to the entire lookup key string.
-# Depending on the application, that string is an entire
+# Each pattern is applied to the entire lookup key string.
+# Depending on the application, that string is an entire
# client hostname, an entire client IP address, or an entire
-# mail address. Thus, no parent domain or parent network
-# search is done, and user@domain mail addresses are not
-# broken up into their user and domain constituent parts,
+# mail address. Thus, no parent domain or parent network
+# search is done, and user@domain mail addresses are not
+# broken up into their user and domain constituent parts,
# nor is user+foo broken up into user and foo.
#
-# Patterns are applied in the order as specified in the
-# table, until a pattern is found that matches the search
+# Patterns are applied in the order as specified in the
+# table, until a pattern is found that matches the search
# string.
#
-# Substitution of substrings from the matched expression
+# Substitution of substrings from the matched expression
# into the result string is possible using $1, $2, etc.. The
# macros in the result string may need to be written as ${n}
# or $(n) if they aren't followed by whitespace.
# such as an email address, or perhaps a street
# address or telephone number.
#
-# o A line that starts with whitespace (space or tab)
-# is a continuation of the previous line. An empty
-# line terminates the previous line, as does a line
-# that starts with non-whitespace (text or comment).
-# A comment line that starts with whitespace does not
-# terminate multi-line text.
-#
-# o The # is recognized as the start of a comment, but
-# only when it is the first non-whitespace character
-# on a line. A comment terminates at the end of the
-# line, even when the next line starts with whites-
-# pace.
+# o Empty lines and whitespace-only lines are ignored,
+# as are lines whose first non-whitespace character
+# is a `#'.
+#
+# o A logical line starts with non-whitespace text. A
+# line that starts with whitespace continues a logi-
+# cal line.
#
# With lookups from indexed files such as DB or DBM, or from
-# networked tables such as NIS, LDAP or SQL, the key field
+# networked tables such as NIS, LDAP or SQL, the key field
# is one of the following:
#
# user@domain
-# Matches user@domain. This form has precedence over
+# Matches user@domain. This form has precedence over
# all other forms.
#
# user Matches user@site when site is $myorigin, when site
# in $inet_interfaces.
#
# @domain
-# Matches every address in domain. This form has the
+# Matches every address in domain. This form has the
# lowest precedence.
#
# ADDRESS EXTENSION
-# When the search fails, and the address localpart contains
-# the optional recipient delimiter (e.g., user+foo@domain),
-# the search is repeated for the unextended address (e.g.
-# user@domain).
+# When a mail address localpart contains the optional recip-
+# ient delimiter (e.g., user+foo@domain), the lookup order
+# becomes: user+foo@domain, user@domain, user+foo, user, and
+# @domain.
#
# REGULAR EXPRESSION TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# the table is given in the form of regular expressions. For
-# a description of regular expression lookup table syntax,
+# a description of regular expression lookup table syntax,
# see regexp_table(5) or pcre_table(5).
#
-# Each pattern is a regular expression that is applied to
+# Each pattern is a regular expression that is applied to
# the entire address being looked up. Thus, user@domain mail
-# addresses are not broken up into their user and @domain
+# addresses are not broken up into their user and @domain
# constituent parts, nor is user+foo broken up into user and
# foo.
#
-# Patterns are applied in the order as specified in the
-# table, until a pattern is found that matches the search
+# Patterns are applied in the order as specified in the
+# table, until a pattern is found that matches the search
# string.
#
-# Results are the same as with normal indexed file lookups,
-# with the additional feature that parenthesized substrings
-# from the pattern can be interpolated as $1, $2 and so on.
+# Results are the same as with indexed file lookups, with
+# the additional feature that parenthesized substrings from
+# the pattern can be interpolated as $1, $2 and so on.
#
# BUGS
# The table format does not understand quoting conventions.
# When pattern matches the domain, use the corre-
# sponding result.
#
+# blank lines and comments
+# Empty lines and whitespace-only lines are ignored,
+# as are lines whose first non-whitespace character
+# is a `#'.
+#
# multi-line text
-# A line that starts with whitespace (space or tab)
-# is a continuation of the previous line. An empty
-# line terminates the previous line, as does a line
-# that starts with non-whitespace (text or comment).
-# A comment line that starts with whitespace does not
-# terminate multi-line text.
-#
-# comments
-# The # is recognized as the start of a comment, but
-# only when it is the first non-whitespace character
-# on a line. A comment terminates at the end of the
-# line, even when the next line starts with whites-
-# pace.
+# A logical line starts with non-whitespace text. A
+# line that starts with whitespace continues a logi-
+# cal line.
#
# With lookups from indexed files such as DB or DBM, or from
-# networked tables such as NIS, LDAP or SQL, patterns are
+# networked tables such as NIS, LDAP or SQL, patterns are
# tried in the order as listed below:
#
# domain transport:nexthop
-# Mail for domain is delivered through transport to
+# Mail for domain is delivered through transport to
# nexthop.
#
# .domain transport:nexthop
-# Mail for any subdomain of domain is delivered
-# through transport to nexthop.
-#
-# Note: transport map entries take precedence over domains
-# specified in the mydestination parameter. If you use the
+# Mail for any subdomain of domain is delivered
+# through transport to nexthop. This applies only
+# when the string transport_maps is not listed in the
+# parent_domain_matches_subdomains configuration set-
+# ting. Otherwise, a domain name matches itself and
+# its subdomains.
+#
+# Note: transport map entries take precedence over domains
+# specified in the mydestination parameter. If you use the
# optional transport map, it may be safer to specify
-# explicit entries for all domains specified in mydestina-
+# explicit entries for all domains specified in mydestina-
# tion, for example:
#
# hostname.my.domain local:
# localhost.my.domain local:
#
-# The interpretation of the nexthop field is transport
+# The interpretation of the nexthop field is transport
# dependent. In the case of SMTP, specify host:service for a
-# non-default server port, and use [host] or [host]:port in
-# order to disable MX (mail exchanger) DNS lookups. The []
-# form can also be used with IP addresses instead of host-
+# non-default server port, and use [host] or [host]:port in
+# order to disable MX (mail exchanger) DNS lookups. The []
+# form can also be used with IP addresses instead of host-
# names.
#
# EXAMPLES
-# In order to send mail for foo.org and its subdomains via
+# In order to send mail for foo.org and its subdomains via
# the uucp transport to the UUCP host named foo:
#
# foo.org uucp:foo
# .foo.org uucp:foo
#
-# When no nexthop host name is specified, the destination
-# domain name is used instead. For example, the following
-# directs mail for user@foo.org via the slow transport to a
-# mail exchanger for foo.org. The slow transport could be
-# something that runs at most one delivery process at a
+# When no nexthop host name is specified, the destination
+# domain name is used instead. For example, the following
+# directs mail for user@foo.org via the slow transport to a
+# mail exchanger for foo.org. The slow transport could be
+# something that runs at most one delivery process at a
# time:
#
# foo.org slow:
#
-# When no transport is specified, the default transport is
+# When no transport is specified, the default transport is
# used, as specified via the default_transport configuration
-# parameter. The following sends all mail for foo.org and
+# parameter. The following sends all mail for foo.org and
# its subdomains to host gateway.foo.org:
#
# foo.org :[gateway.foo.org]
# .foo.org :[gateway.foo.org]
#
-# In the above example, the [] are used to suppress MX
-# lookups. The result would likely point to your local
+# In the above example, the [] are used to suppress MX
+# lookups. The result would likely point to your local
# machine.
#
-# In the case of delivery via SMTP, one may specify host-
+# In the case of delivery via SMTP, one may specify host-
# name:service instead of just a host:
#
# foo.org smtp:bar.org:2025
#
-# This directs mail for user@foo.org to host bar.org port
-# 2025. Instead of a numerical port a symbolic name may be
-# used. Specify [] around the hostname in order to disable
+# This directs mail for user@foo.org to host bar.org port
+# 2025. Instead of a numerical port a symbolic name may be
+# used. Specify [] around the hostname in order to disable
# MX lookups.
#
# The error mailer can be used to bounce mail:
#
-# .foo.org error:mail for *.foo.org is not deliv-
+# .foo.org error:mail for *.foo.org is not deliv-
# erable
#
-# This causes all mail for user@anything.foo.org to be
+# This causes all mail for user@anything.foo.org to be
# bounced.
#
# REGULAR EXPRESSION TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# the table is given in the form of regular expressions. For
-# a description of regular expression lookup table syntax,
+# a description of regular expression lookup table syntax,
# see regexp_table(5) or pcre_table(5).
#
-# Each pattern is a regular expression that is applied to
+# Each pattern is a regular expression that is applied to
# the entire domain being looked up. Thus, some.domain.hier-
# archy is not broken up into parent domains.
#
-# Patterns are applied in the order as specified in the
-# table, until a pattern is found that matches the search
+# Patterns are applied in the order as specified in the
+# table, until a pattern is found that matches the search
# string.
#
-# Results are the same as with normal indexed file lookups,
-# with the additional feature that parenthesized substrings
-# from the pattern can be interpolated as $1, $2 and so on.
+# Results are the same as with indexed file lookups, with
+# the additional feature that parenthesized substrings from
+# the pattern can be interpolated as $1, $2 and so on.
#
# CONFIGURATION PARAMETERS
# The following main.cf parameters are especially relevant
# When pattern matches a mail address, replace it by
# the corresponding result.
#
+# blank lines and comments
+# Empty lines and whitespace-only lines are ignored,
+# as are lines whose first non-whitespace character
+# is a `#'.
+#
# multi-line text
-# A line that starts with whitespace (space or tab)
-# is a continuation of the previous line. An empty
-# line terminates the previous line, as does a line
-# that starts with non-whitespace (text or comment).
-# A comment line that starts with whitespace does not
-# terminate multi-line text.
-#
-# comments
-# The # is recognized as the start of a comment, but
-# only when it is the first non-whitespace character
-# on a line. A comment terminates at the end of the
-# line, even when the next line starts with whites-
-# pace.
+# A logical line starts with non-whitespace text. A
+# line that starts with whitespace continues a logi-
+# cal line.
#
# With lookups from indexed files such as DB or DBM, or from
-# networked tables such as NIS, LDAP or SQL, patterns are
+# networked tables such as NIS, LDAP or SQL, patterns are
# tried in the order as listed below:
#
# user@domain address, address, ...
-# Mail for user@domain is redirected to address.
+# Mail for user@domain is redirected to address.
# This form has the highest precedence.
#
# user address, address, ...
-# Mail for user@site is redirected to address when
-# site is equal to $myorigin, when site is listed in
+# Mail for user@site is redirected to address when
+# site is equal to $myorigin, when site is listed in
# $mydestination, or when it is listed in
# $inet_interfaces.
#
-# This functionality overlaps with functionality of
+# This functionality overlaps with functionality of
# the local alias(5) database. The difference is that
-# virtual mapping can be applied to non-local
+# virtual mapping can be applied to non-local
# addresses.
#
# @domain address, address, ...
-# Mail for any user in domain is redirected to
+# Mail for any user in domain is redirected to
# address. This form has the lowest precedence.
#
-# In all the above forms, when address has the form @other-
-# domain, the result is the same user in otherdomain. This
+# In all the above forms, when address has the form @other-
+# domain, the result is the same user in otherdomain. This
# works for the first address in the expansion only.
#
# ADDRESS EXTENSION
-# When the search fails, and the address localpart contains
-# the optional recipient delimiter (e.g., user+foo@domain),
-# the search is repeated for the unextended address (e.g.
-# user@domain), and the unmatched address extension is prop-
-# agated to the result of expansion. The matching order is:
-# user+foo@domain, user@domain, user+foo, user, and @domain.
+# When a mail address localpart contains the optional recip-
+# ient delimiter (e.g., user+foo@domain), the lookup order
+# becomes: user+foo@domain, user@domain, user+foo, user, and
+# @domain. An unmatched address extension (+foo) is propa-
+# gated to the result of table lookup.
#
# REGULAR EXPRESSION TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# the table is given in the form of regular expressions. For
-# a description of regular expression lookup table syntax,
+# a description of regular expression lookup table syntax,
# see regexp_table(5) or pcre_table(5).
#
-# Each pattern is a regular expression that is applied to
+# Each pattern is a regular expression that is applied to
# the entire address being looked up. Thus, user@domain mail
-# addresses are not broken up into their user and @domain
+# addresses are not broken up into their user and @domain
# constituent parts, nor is user+foo broken up into user and
# foo.
#
-# Patterns are applied in the order as specified in the
-# table, until a pattern is found that matches the search
+# Patterns are applied in the order as specified in the
+# table, until a pattern is found that matches the search
# string.
#
-# Results are the same as with normal indexed file lookups,
-# with the additional feature that parenthesized substrings
-# from the pattern can be interpolated as $1, $2 and so on.
+# Results are the same as with indexed file lookups, with
+# the additional feature that parenthesized substrings from
+# the pattern can be interpolated as $1, $2 and so on.
#
# BUGS
# The table format does not understand quoting conventions.
<b>DESCRIPTION</b>
The optional <b>access</b> table directs the Postfix SMTP server
- to selectively reject or accept mail from or to specific
- hosts, domains, networks, host addresses or mail
- addresses.
+ to selectively reject or accept mail. Access can be
+ allowed or denied for specific host names, domain names,
+ networks, host network addresses or mail addresses.
Normally, the <b>access</b> table is specified as a text file
that serves as input to the <a href="postmap.1.html"><b>postmap</b>(1)</a> command. The
line that starts with whitespace continues a logi-
cal line.
-<b>PATTERNS</b>
+<b>EMAIL</b> <b>ADDRESS</b> <b>PATTERNS</b>
With lookups from indexed files such as DB or DBM, or from
- networked tables such as NIS, LDAP or SQL, patterns are
- tried in the order as listed below:
+ networked tables such as NIS, LDAP or SQL, the following
+ lookup patterns are examined in the order as listed:
<i>user</i>@<i>domain</i>
Matches the specified mail address.
<i>domain.name</i>
- Matches the <i>domain.name</i> itself and any subdomain
- thereof, either in hostnames or in mail addresses.
- Top-level domains will never be matched.
+ Matches <i>domain.name</i> as the domain part of an email
+ address.
+
+ The pattern <i>domain.name</i> also matches subdomains,
+ but only when the string <b>smtpd</b><i>_</i><b>access</b><i>_</i><b>maps</b> is
+ listed in the Postfix <b>parent</b><i>_</i><b>domain</b><i>_</i><b>matches</b><i>_</i><b>subdo-</b>
+ <b>mains</b> configuration setting. Otherwise, specify
+ <i>.domain.name</i> (note the initial dot) in order to
+ match subdomains.
<i>user</i>@ Matches all mail addresses with the specified user
part.
+ Note: lookup of the null sender address may not be possi-
+ ble with all supported types of lookup table. A workaround
+ is to specify <b>smtpd</b><i>_</i><b>null</b><i>_</i><b>access</b><i>_</i><b>lookup</b><i>_</i><b>key</b> <b>=</b> <> in the
+ Postfix <b>main.cf</b> file, and to specify <> as the left-hand
+ field in the access table.
+
+<b>ADDRESS</b> <b>EXTENSION</b>
+ When a mail address localpart contains the optional recip-
+ ient delimiter (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order
+ becomes: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>domain</i>, <i>user+foo</i>@,
+ and <i>user</i>@.
+
+<b>HOST</b> <b>NAME/ADDRESS</b> <b>PATTERNS</b>
+ With lookups from indexed files such as DB or DBM, or from
+ networked tables such as NIS, LDAP or SQL, the following
+ lookup patterns are examined in the order as listed:
+
+ <i>domain.name</i>
+ Matches <i>domain.name</i>.
+
+ The pattern <i>domain.name</i> also matches subdomains,
+ but only when the string <b>smtpd</b><i>_</i><b>access</b><i>_</i><b>maps</b> is
+ listed in the Postfix <b>parent</b><i>_</i><b>domain</b><i>_</i><b>matches</b><i>_</i><b>subdo-</b>
+ <b>mains</b> configuration setting. Otherwise, specify
+ <i>.domain.name</i> (note the initial dot) in order to
+ match subdomains.
+
<i>net.work.addr.ess</i>
<i>net.work.addr</i>
the entire string being looked up. Depending on the appli-
cation, that string is an entire client hostname, an
entire client IP address, or an entire mail address. Thus,
- no parent domain or parent network search is done, and
+ no parent domain or parent network search is done,
<i>user@domain</i> mail addresses are not broken up into their
- <i>user@</i> and <i>domain</i> constituent parts.
+ <i>user@</i> and <i>domain</i> constituent parts, nor is <i>user+foo</i> broken
+ up into <i>user</i> and <i>foo</i>.
- Patterns are applied in the order as specified in the
- table, until a pattern is found that matches the search
+ Patterns are applied in the order as specified in the
+ table, until a pattern is found that matches the search
string.
- Actions are the same as with normal indexed file lookups,
- with the additional feature that parenthesized substrings
- from the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
+ Actions are the same as with indexed file lookups, with
+ the additional feature that parenthesized substrings from
+ the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
<b>BUGS</b>
The table format does not understand quoting conventions.
<i>domain</i>, the result is the same user in <i>otherdomain</i>.
<b>ADDRESS</b> <b>EXTENSION</b>
- When table lookup fails, and the address localpart con-
- tains the optional recipient delimiter (e.g.,
- <i>user+foo</i>@<i>domain</i>), the search is repeated for the unex-
- tended address (e.g. <i>user</i>@<i>domain</i>), and the unmatched
- extension is propagated to the result of table lookup. The
- matching order is: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>,
- <i>user</i>, and @<i>domain</i>.
+ When a mail address localpart contains the optional recip-
+ ient delimiter (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order
+ becomes: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and
+ @<i>domain</i>. An unmatched address extension (<i>+foo</i>) is propa-
+ gated to the result of table lookup.
<b>REGULAR</b> <b>EXPRESSION</b> <b>TABLES</b>
This section describes how the table lookups change when
table, until a pattern is found that matches the search
string.
- Results are the same as with normal indexed file lookups,
- with the additional feature that parenthesized substrings
- from the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
+ Results are the same as with indexed file lookups, with
+ the additional feature that parenthesized substrings from
+ the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
<b>BUGS</b>
- The table format does not understand quoting conventions.
+ The table format does not understand quoting conventions.
<b>CONFIGURATION</b> <b>PARAMETERS</b>
- The following <b>main.cf</b> parameters are especially relevant
- to this topic. See the Postfix <b>main.cf</b> file for syntax
- details and for default values. Use the <b>postfix</b> <b>reload</b>
+ The following <b>main.cf</b> parameters are especially relevant
+ to this topic. See the Postfix <b>main.cf</b> file for syntax
+ details and for default values. Use the <b>postfix</b> <b>reload</b>
command after a configuration change.
<b>canonical</b><i>_</i><b>maps</b>
Other parameters of interest:
<b>inet</b><i>_</i><b>interfaces</b>
- The network interface addresses that this system
+ The network interface addresses that this system
receives mail on.
<b>masquerade</b><i>_</i><b>classes</b>
- List of address classes subject to masquerading:
- zero or more of <b>envelope</b><i>_</i><b>sender</b>, <b>envelope</b><i>_</i><b>recipi-</b>
+ List of address classes subject to masquerading:
+ zero or more of <b>envelope</b><i>_</i><b>sender</b>, <b>envelope</b><i>_</i><b>recipi-</b>
<b>ent</b>, <b>header</b><i>_</i><b>sender</b>, <b>header</b><i>_</i><b>recipient</b>.
<b>masquerade</b><i>_</i><b>domains</b>
- List of domains that hide their subdomain struc-
+ List of domains that hide their subdomain struc-
ture.
<b>masquerade</b><i>_</i><b>exceptions</b>
- List of user names that are not subject to address
+ List of user names that are not subject to address
masquerading.
<b>mydestination</b>
- List of domains that this mail system considers
+ List of domains that this mail system considers
local.
<b>myorigin</b>
<a href="regexp_table.5.html">regexp_table(5)</a> format of POSIX regular expression tables
<b>LICENSE</b>
- The Secure Mailer license must be distributed with this
+ The Secure Mailer license must be distributed with this
software.
<b>AUTHOR(S)</b>
lowest precedence.
<b>ADDRESS</b> <b>EXTENSION</b>
- When the search fails, and the address localpart contains
- the optional recipient delimiter (e.g., <i>user+foo</i>@<i>domain</i>),
- the search is repeated for the unextended address (e.g.
- <i>user</i>@<i>domain</i>).
+ When a mail address localpart contains the optional recip-
+ ient delimiter (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order
+ becomes: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and
+ @<i>domain</i>.
<b>REGULAR</b> <b>EXPRESSION</b> <b>TABLES</b>
This section describes how the table lookups change when
table, until a pattern is found that matches the search
string.
- Results are the same as with normal indexed file lookups,
- with the additional feature that parenthesized substrings
- from the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
+ Results are the same as with indexed file lookups, with
+ the additional feature that parenthesized substrings from
+ the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
<b>BUGS</b>
- The table format does not understand quoting conventions.
+ The table format does not understand quoting conventions.
<b>CONFIGURATION</b> <b>PARAMETERS</b>
- The following <b>main.cf</b> parameters are especially relevant
- to this topic. See the Postfix <b>main.cf</b> file for syntax
- details and for default values. Use the <b>postfix</b> <b>reload</b>
+ The following <b>main.cf</b> parameters are especially relevant
+ to this topic. See the Postfix <b>main.cf</b> file for syntax
+ details and for default values. Use the <b>postfix</b> <b>reload</b>
command after a configuration change.
<b>relocated</b><i>_</i><b>maps</b>
Other parameters of interest:
<b>inet</b><i>_</i><b>interfaces</b>
- The network interface addresses that this system
+ The network interface addresses that this system
receives mail on.
<b>mydestination</b>
- List of domains that this mail system considers
+ List of domains that this mail system considers
local.
<b>myorigin</b>
<a href="regexp_table.5.html">regexp_table(5)</a> format of POSIX regular expression tables
<b>LICENSE</b>
- The Secure Mailer license must be distributed with this
+ The Secure Mailer license must be distributed with this
software.
<b>AUTHOR(S)</b>
<i>.domain</i> <i>transport</i>:<i>nexthop</i>
Mail for any subdomain of <i>domain</i> is delivered
- through <i>transport</i> to <i>nexthop</i>.
+ through <i>transport</i> to <i>nexthop</i>. This applies only
+ when the string <b>transport</b><i>_</i><b>maps</b> is not listed in the
+ <b>parent</b><i>_</i><b>domain</b><i>_</i><b>matches</b><i>_</i><b>subdomains</b> configuration set-
+ ting. Otherwise, a domain name matches itself and
+ its subdomains.
Note: transport map entries take precedence over domains
specified in the <b>mydestination</b> parameter. If you use the
table, until a pattern is found that matches the search
string.
- Results are the same as with normal indexed file lookups,
- with the additional feature that parenthesized substrings
- from the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
+ Results are the same as with indexed file lookups, with
+ the additional feature that parenthesized substrings from
+ the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
<b>CONFIGURATION</b> <b>PARAMETERS</b>
- The following <b>main.cf</b> parameters are especially relevant
- to this topic. See the Postfix <b>main.cf</b> file for syntax
- details and for default values. Use the <b>postfix</b> <b>reload</b>
+ The following <b>main.cf</b> parameters are especially relevant
+ to this topic. See the Postfix <b>main.cf</b> file for syntax
+ details and for default values. Use the <b>postfix</b> <b>reload</b>
command after a configuration change.
<b>parent</b><i>_</i><b>domain</b><i>_</i><b>matches</b><i>_</i><b>subdomains</b> (versions >= 20011119)
- List of Postfix features that use <i>domain.name</i> pat-
+ List of Postfix features that use <i>domain.name</i> pat-
terns to match <i>sub.domain.name</i> (as opposed to
requiring <i>.domain.name</i> patterns).
Other parameters of interest:
<b>default</b><i>_</i><b>transport</b>
- The transport to use when no transport is explic-
+ The transport to use when no transport is explic-
itly specified.
<b>relayhost</b>
<a href="regexp_table.5.html">regexp_table(5)</a> format of POSIX regular expression tables
<b>LICENSE</b>
- The Secure Mailer license must be distributed with this
+ The Secure Mailer license must be distributed with this
software.
<b>AUTHOR(S)</b>
works for the first address in the expansion only.
<b>ADDRESS</b> <b>EXTENSION</b>
- When the search fails, and the address localpart contains
- the optional recipient delimiter (e.g., <i>user+foo</i>@<i>domain</i>),
- the search is repeated for the unextended address (e.g.
- <i>user</i>@<i>domain</i>), and the unmatched address extension is prop-
- agated to the result of expansion. The matching order is:
- <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and @<i>domain</i>.
+ When a mail address localpart contains the optional recip-
+ ient delimiter (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order
+ becomes: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and
+ @<i>domain</i>. An unmatched address extension (<i>+foo</i>) is propa-
+ gated to the result of table lookup.
<b>REGULAR</b> <b>EXPRESSION</b> <b>TABLES</b>
This section describes how the table lookups change when
table, until a pattern is found that matches the search
string.
- Results are the same as with normal indexed file lookups,
- with the additional feature that parenthesized substrings
- from the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
+ Results are the same as with indexed file lookups, with
+ the additional feature that parenthesized substrings from
+ the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
<b>BUGS</b>
- The table format does not understand quoting conventions.
+ The table format does not understand quoting conventions.
<b>CONFIGURATION</b> <b>PARAMETERS</b>
- The following <b>main.cf</b> parameters are especially relevant
- to this topic. See the Postfix <b>main.cf</b> file for syntax
- details and for default values. Use the <b>postfix</b> <b>reload</b>
+ The following <b>main.cf</b> parameters are especially relevant
+ to this topic. See the Postfix <b>main.cf</b> file for syntax
+ details and for default values. Use the <b>postfix</b> <b>reload</b>
command after a configuration change.
<b>virtual</b><i>_</i><b>maps</b>
Other parameters of interest:
<b>inet</b><i>_</i><b>interfaces</b>
- The network interface addresses that this system
+ The network interface addresses that this system
receives mail on.
<b>mydestination</b>
- List of domains that this mail system considers
+ List of domains that this mail system considers
local.
<b>myorigin</b>
<a href="regexp_table.5.html">regexp_table(5)</a> format of POSIX regular expression tables
<b>LICENSE</b>
- The Secure Mailer license must be distributed with this
+ The Secure Mailer license must be distributed with this
software.
<b>AUTHOR(S)</b>
.ad
.fi
The optional \fBaccess\fR table directs the Postfix SMTP server
-to selectively reject or accept mail from or to specific hosts,
-domains, networks, host addresses or mail addresses.
+to selectively reject or accept mail. Access can be allowed or
+denied for specific host names, domain names, networks, host
+network addresses or mail addresses.
Normally, the \fBaccess\fR table is specified as a text file
that serves as input to the \fBpostmap\fR(1) command.
.IP "multi-line text"
A logical line starts with non-whitespace text. A line that
starts with whitespace continues a logical line.
-.SH PATTERNS
+.SH EMAIL ADDRESS PATTERNS
.na
.nf
.ad
.fi
With lookups from indexed files such as DB or DBM, or from networked
-tables such as NIS, LDAP or SQL, patterns are tried in the order as
-listed below:
+tables such as NIS, LDAP or SQL, the following lookup patterns are
+examined in the order as listed:
.IP \fIuser\fR@\fIdomain\fR
Matches the specified mail address.
.IP \fIdomain.name\fR
-Matches the \fIdomain.name\fR itself and any subdomain thereof,
-either in hostnames or in mail addresses. Top-level domains will
-never be matched.
+Matches \fIdomain.name\fR as the domain part of an email address.
+.sp
+The pattern \fIdomain.name\fR also matches subdomains, but only
+when the string \fBsmtpd_access_maps\fR is listed in the Postfix
+\fBparent_domain_matches_subdomains\fR configuration setting.
+Otherwise, specify \fI.domain.name\fR (note the initial dot) in
+order to match subdomains.
.IP \fIuser\fR@
Matches all mail addresses with the specified user part.
+.PP
+Note: lookup of the null sender address may not be possible with
+all supported types of lookup table. A workaround is to specify
+\fBsmtpd_null_access_lookup_key = <>\fR in the Postfix \fBmain.cf\fR
+file, and to specify \fB<>\fR as the left-hand field in the access
+table.
+.SH ADDRESS EXTENSION
+.na
+.nf
+.fi
+.ad
+When a mail address localpart contains the optional recipient delimiter
+(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIdomain\fR,
+\fIuser+foo\fR@, and \fIuser\fR@.
+.SH HOST NAME/ADDRESS PATTERNS
+.na
+.nf
+.ad
+.fi
+With lookups from indexed files such as DB or DBM, or from networked
+tables such as NIS, LDAP or SQL, the following lookup patterns are
+examined in the order as listed:
+.IP \fIdomain.name\fR
+Matches \fIdomain.name\fR.
+.sp
+The pattern \fIdomain.name\fR also matches subdomains, but only
+when the string \fBsmtpd_access_maps\fR is listed in the Postfix
+\fBparent_domain_matches_subdomains\fR configuration setting.
+Otherwise, specify \fI.domain.name\fR (note the initial dot) in
+order to match subdomains.
.IP \fInet.work.addr.ess\fR
.IP \fInet.work.addr\fR
.IP \fInet.work\fR
string being looked up. Depending on the application, that string
is an entire client hostname, an entire client IP address, or an
entire mail address. Thus, no parent domain or parent network search
-is done, and \fIuser@domain\fR mail addresses are not broken up into
-their \fIuser@\fR and \fIdomain\fR constituent parts.
+is done, \fIuser@domain\fR mail addresses are not broken up into
+their \fIuser@\fR and \fIdomain\fR constituent parts, nor is
+\fIuser+foo\fR broken up into \fIuser\fR and \fIfoo\fR.
Patterns are applied in the order as specified in the table, until a
pattern is found that matches the search string.
-Actions are the same as with normal indexed file lookups, with
+Actions are the same as with indexed file lookups, with
the additional feature that parenthesized substrings from the
pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
.SH BUGS
.nf
.fi
.ad
-When table lookup fails, and the address localpart contains the
-optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR), the
-search is repeated for the unextended address (e.g.
-\fIuser\fR@\fIdomain\fR), and the unmatched extension is propagated
-to the result of table lookup. The matching order is:
-\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR,
-\fIuser+foo\fR, \fIuser\fR, and @\fIdomain\fR.
+When a mail address localpart contains the optional recipient delimiter
+(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
+\fIuser\fR, and @\fIdomain\fR. An unmatched address extension
+(\fI+foo\fR) is propagated to the result of table lookup.
.SH REGULAR EXPRESSION TABLES
.na
.nf
Patterns are applied in the order as specified in the table, until a
pattern is found that matches the search string.
-Results are the same as with normal indexed file lookups, with
+Results are the same as with indexed file lookups, with
the additional feature that parenthesized substrings from the
pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
.SH BUGS
.nf
.fi
.ad
-When the search fails, and the address localpart contains the
-optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR),
-the search is repeated for the unextended address (e.g.
-\fIuser\fR@\fIdomain\fR).
+When a mail address localpart contains the optional recipient delimiter
+(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
+\fIuser\fR, and @\fIdomain\fR.
.SH REGULAR EXPRESSION TABLES
.na
.nf
Patterns are applied in the order as specified in the table, until a
pattern is found that matches the search string.
-Results are the same as with normal indexed file lookups, with
+Results are the same as with indexed file lookups, with
the additional feature that parenthesized substrings from the
pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
.SH BUGS
\fInexthop\fR.
.IP "\fI.domain transport\fR:\fInexthop\fR"
Mail for any subdomain of \fIdomain\fR is delivered through
-\fItransport\fR to \fInexthop\fR.
+\fItransport\fR to \fInexthop\fR. This applies only when the
+string \fBtransport_maps\fR is not listed in the
+\fBparent_domain_matches_subdomains\fR configuration setting.
+Otherwise, a domain name matches itself and its subdomains.
.PP
Note: transport map entries take precedence over domains
specified in the \fBmydestination\fR parameter. If you use
Patterns are applied in the order as specified in the table, until a
pattern is found that matches the search string.
-Results are the same as with normal indexed file lookups, with
+Results are the same as with indexed file lookups, with
the additional feature that parenthesized substrings from the
pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
.SH CONFIGURATION PARAMETERS
.nf
.fi
.ad
-When the search fails, and the address localpart contains the
-optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR),
-the search is repeated for the unextended address (e.g.
-\fIuser\fR@\fIdomain\fR), and the unmatched address extension is
-propagated to the result of expansion. The matching order is:
-\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR,
-\fIuser+foo\fR, \fIuser\fR, and @\fIdomain\fR.
+When a mail address localpart contains the optional recipient delimiter
+(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
+\fIuser\fR, and @\fIdomain\fR. An unmatched address extension
+(\fI+foo\fR) is propagated to the result of table lookup.
.SH REGULAR EXPRESSION TABLES
.na
.nf
Patterns are applied in the order as specified in the table, until a
pattern is found that matches the search string.
-Results are the same as with normal indexed file lookups, with
+Results are the same as with indexed file lookups, with
the additional feature that parenthesized substrings from the
pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
.SH BUGS
# \fBpostmap /etc/postfix/access\fR
# DESCRIPTION
# The optional \fBaccess\fR table directs the Postfix SMTP server
-# to selectively reject or accept mail from or to specific hosts,
-# domains, networks, host addresses or mail addresses.
+# to selectively reject or accept mail. Access can be allowed or
+# denied for specific host names, domain names, networks, host
+# network addresses or mail addresses.
#
# Normally, the \fBaccess\fR table is specified as a text file
# that serves as input to the \fBpostmap\fR(1) command.
# .IP "multi-line text"
# A logical line starts with non-whitespace text. A line that
# starts with whitespace continues a logical line.
-# PATTERNS
+# EMAIL ADDRESS PATTERNS
# .ad
# .fi
# With lookups from indexed files such as DB or DBM, or from networked
-# tables such as NIS, LDAP or SQL, patterns are tried in the order as
-# listed below:
+# tables such as NIS, LDAP or SQL, the following lookup patterns are
+# examined in the order as listed:
# .IP \fIuser\fR@\fIdomain\fR
# Matches the specified mail address.
# .IP \fIdomain.name\fR
-# Matches the \fIdomain.name\fR itself and any subdomain thereof,
-# either in hostnames or in mail addresses. Top-level domains will
-# never be matched.
+# Matches \fIdomain.name\fR as the domain part of an email address.
+# .sp
+# The pattern \fIdomain.name\fR also matches subdomains, but only
+# when the string \fBsmtpd_access_maps\fR is listed in the Postfix
+# \fBparent_domain_matches_subdomains\fR configuration setting.
+# Otherwise, specify \fI.domain.name\fR (note the initial dot) in
+# order to match subdomains.
# .IP \fIuser\fR@
# Matches all mail addresses with the specified user part.
+# .PP
+# Note: lookup of the null sender address may not be possible with
+# all supported types of lookup table. A workaround is to specify
+# \fBsmtpd_null_access_lookup_key = <>\fR in the Postfix \fBmain.cf\fR
+# file, and to specify \fB<>\fR as the left-hand field in the access
+# table.
+# ADDRESS EXTENSION
+# .fi
+# .ad
+# When a mail address localpart contains the optional recipient delimiter
+# (e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+# \fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIdomain\fR,
+# \fIuser+foo\fR@, and \fIuser\fR@.
+# HOST NAME/ADDRESS PATTERNS
+# .ad
+# .fi
+# With lookups from indexed files such as DB or DBM, or from networked
+# tables such as NIS, LDAP or SQL, the following lookup patterns are
+# examined in the order as listed:
+# .IP \fIdomain.name\fR
+# Matches \fIdomain.name\fR.
+# .sp
+# The pattern \fIdomain.name\fR also matches subdomains, but only
+# when the string \fBsmtpd_access_maps\fR is listed in the Postfix
+# \fBparent_domain_matches_subdomains\fR configuration setting.
+# Otherwise, specify \fI.domain.name\fR (note the initial dot) in
+# order to match subdomains.
# .IP \fInet.work.addr.ess\fR
# .IP \fInet.work.addr\fR
# .IP \fInet.work\fR
# string being looked up. Depending on the application, that string
# is an entire client hostname, an entire client IP address, or an
# entire mail address. Thus, no parent domain or parent network search
-# is done, and \fIuser@domain\fR mail addresses are not broken up into
-# their \fIuser@\fR and \fIdomain\fR constituent parts.
+# is done, \fIuser@domain\fR mail addresses are not broken up into
+# their \fIuser@\fR and \fIdomain\fR constituent parts, nor is
+# \fIuser+foo\fR broken up into \fIuser\fR and \fIfoo\fR.
#
# Patterns are applied in the order as specified in the table, until a
# pattern is found that matches the search string.
#
-# Actions are the same as with normal indexed file lookups, with
+# Actions are the same as with indexed file lookups, with
# the additional feature that parenthesized substrings from the
# pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
# BUGS
# ADDRESS EXTENSION
# .fi
# .ad
-# When table lookup fails, and the address localpart contains the
-# optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR), the
-# search is repeated for the unextended address (e.g.
-# \fIuser\fR@\fIdomain\fR), and the unmatched extension is propagated
-# to the result of table lookup. The matching order is:
-# \fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR,
-# \fIuser+foo\fR, \fIuser\fR, and @\fIdomain\fR.
+# When a mail address localpart contains the optional recipient delimiter
+# (e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+# \fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
+# \fIuser\fR, and @\fIdomain\fR. An unmatched address extension
+# (\fI+foo\fR) is propagated to the result of table lookup.
# REGULAR EXPRESSION TABLES
# .ad
# .fi
# Patterns are applied in the order as specified in the table, until a
# pattern is found that matches the search string.
#
-# Results are the same as with normal indexed file lookups, with
+# Results are the same as with indexed file lookups, with
# the additional feature that parenthesized substrings from the
# pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
# BUGS
# ADDRESS EXTENSION
# .fi
# .ad
-# When the search fails, and the address localpart contains the
-# optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR),
-# the search is repeated for the unextended address (e.g.
-# \fIuser\fR@\fIdomain\fR).
+# When a mail address localpart contains the optional recipient delimiter
+# (e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+# \fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
+# \fIuser\fR, and @\fIdomain\fR.
# REGULAR EXPRESSION TABLES
# .ad
# .fi
# Patterns are applied in the order as specified in the table, until a
# pattern is found that matches the search string.
#
-# Results are the same as with normal indexed file lookups, with
+# Results are the same as with indexed file lookups, with
# the additional feature that parenthesized substrings from the
# pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
# BUGS
# \fInexthop\fR.
# .IP "\fI.domain transport\fR:\fInexthop\fR"
# Mail for any subdomain of \fIdomain\fR is delivered through
-# \fItransport\fR to \fInexthop\fR.
+# \fItransport\fR to \fInexthop\fR. This applies only when the
+# string \fBtransport_maps\fR is not listed in the
+# \fBparent_domain_matches_subdomains\fR configuration setting.
+# Otherwise, a domain name matches itself and its subdomains.
# .PP
# Note: transport map entries take precedence over domains
# specified in the \fBmydestination\fR parameter. If you use
# Patterns are applied in the order as specified in the table, until a
# pattern is found that matches the search string.
#
-# Results are the same as with normal indexed file lookups, with
+# Results are the same as with indexed file lookups, with
# the additional feature that parenthesized substrings from the
# pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
# CONFIGURATION PARAMETERS
# ADDRESS EXTENSION
# .fi
# .ad
-# When the search fails, and the address localpart contains the
-# optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR),
-# the search is repeated for the unextended address (e.g.
-# \fIuser\fR@\fIdomain\fR), and the unmatched address extension is
-# propagated to the result of expansion. The matching order is:
-# \fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR,
-# \fIuser+foo\fR, \fIuser\fR, and @\fIdomain\fR.
+# When a mail address localpart contains the optional recipient delimiter
+# (e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+# \fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
+# \fIuser\fR, and @\fIdomain\fR. An unmatched address extension
+# (\fI+foo\fR) is propagated to the result of table lookup.
# REGULAR EXPRESSION TABLES
# .ad
# .fi
# Patterns are applied in the order as specified in the table, until a
# pattern is found that matches the search string.
#
-# Results are the same as with normal indexed file lookups, with
+# Results are the same as with indexed file lookups, with
# the additional feature that parenthesized substrings from the
# pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
# BUGS
* Version of this program.
*/
#define VAR_MAIL_VERSION "mail_version"
-#define DEF_MAIL_VERSION "Snapshot-20020104"
+#define DEF_MAIL_VERSION "Snapshot-20020106"
extern char *var_mail_version;
/* LICENSE
#include <maps.h>
#include <mail_addr_find.h>
#include <match_parent_style.h>
+#include <split_addr.h>
/* Application-specific. */
return (result);
}
+/* resolve_final - do we do final delivery for the domain? */
+
+static int resolve_final(SMTPD_STATE *state, const char *reply_name,
+const char *domain)
+{
+
+ /* If matches $mydestination or $inet_interfaces. */
+ if (resolve_local(domain))
+ return (1);
+
+ /* If Postfix-style virtual domain. */
+ if (*var_virtual_maps
+ && check_maps_find(state, reply_name, virtual_maps, domain, 0))
+ return (1);
+
+ /* If virtual mailbox domain. */
+ if (*var_virt_mailbox_maps
+ && check_maps_find(state, reply_name, virt_mailbox_maps, domain, 0))
+ return (1);
+
+ return (0);
+}
+
/* reject_unknown_client - fail if client hostname is unknown */
static int reject_unknown_client(SMTPD_STATE *state)
domain += 1;
/*
- * Permit final delivery: the destination matches mydestination or
- * virtual_maps.
+ * Permit final delivery: the destination matches mydestination,
+ * virtual_maps, or virtual_mailbox_maps.
*/
- if (resolve_local(domain)
- || (*var_virtual_maps
- && check_maps_find(state, recipient, virtual_maps, domain, 0))
- || (*var_virt_mailbox_maps
- && check_maps_find(state, recipient, virt_mailbox_maps, domain, 0)))
+ if (resolve_final(state, recipient, domain))
return (SMTPD_CHECK_OK);
/*
if ((domain = strrchr(CONST_STR(reply->recipient), '@')) == 0)
return (SMTPD_CHECK_OK);
domain += 1;
- if (resolve_local(domain)
- || (*var_virtual_maps
- && check_maps_find(state, recipient, virtual_maps, domain, 0))
- || (*var_virt_mailbox_maps
- && check_maps_find(state, recipient, virt_mailbox_maps, domain, 0)))
+ if (resolve_final(state, recipient, domain))
return (SMTPD_CHECK_OK);
if (msg_verbose)
if ((domain = strrchr(CONST_STR(reply->recipient), '@')) == 0)
return (SMTPD_CHECK_DUNNO);
domain += 1;
- if (resolve_local(domain)
- || (*var_virtual_maps
- && check_maps_find(state, reply_name, virtual_maps, domain, 0))
- || (*var_virt_mailbox_maps
- && check_maps_find(state, reply_name, virt_mailbox_maps, domain, 0)))
+ if (resolve_final(state, reply_name, domain))
return (SMTPD_CHECK_DUNNO);
if (domain[0] == '#')
return (SMTPD_CHECK_DUNNO);
{
char *myname = "check_mail_access";
const RESOLVE_REPLY *reply;
- const char *ratsign;
+ const char *domain;
int status;
char *local_at;
+ char *bare_addr;
+ char *bare_ext;
+ char *bare_at;
if (msg_verbose)
msg_info("%s: %s", myname, addr);
* Garbage in, garbage out. Every address from canon_addr_internal() and
* from resolve_clnt_query() must be fully qualified.
*/
- if ((ratsign = strrchr(CONST_STR(reply->recipient), '@')) == 0) {
- msg_warn("%s: no @domain in address: %s", myname, CONST_STR(reply->recipient));
+ if ((domain = strrchr(CONST_STR(reply->recipient), '@')) == 0) {
+ msg_warn("%s: no @domain in address: %s", myname,
+ CONST_STR(reply->recipient));
return (0);
}
+ domain += 1;
/*
- * Avoid surprise matches with source-routed, non-local addresses.
+ * In case of address extensions.
*/
- if (var_allow_untrust_route == 0
- && (reply->flags & RESOLVE_FLAG_ROUTED)
- && !resolve_local(ratsign + 1))
- return (SMTPD_CHECK_DUNNO);
+ if (*var_rcpt_delim == 0) {
+ bare_addr = 0;
+ } else {
+ bare_addr = mystrdup(addr);
+ if ((bare_at = strrchr(bare_addr, '@')) != 0)
+ *bare_at = 0;
+ if ((bare_ext = split_addr(bare_addr, *var_rcpt_delim)) != 0) {
+ if (bare_at != 0) {
+ *bare_at = '@';
+ memmove(bare_ext - 1, bare_at, strlen(bare_at) + 1);
+ bare_at = bare_ext - 1;
+ }
+ } else {
+ myfree(bare_addr);
+ bare_addr = 0;
+ }
+ }
+
+#define CHECK_MAIL_ACCESS_RETURN(x) \
+ { if (bare_addr) myfree(bare_addr); return(x); }
/*
- * Look up the full address.
+ * Source-routed, non-local, recipient addresses are too suspicious for
+ * returning an "OK" result. The complicated expression below was brought
+ * to you by the keyboard of Victor Duchovny, Morgan Stanley and hacked
+ * up a bit by Wietse.
+ */
+#define SUSPICIOUS(domain, reply, state, reply_name, reply_class) \
+ (var_allow_untrust_route == 0 \
+ && (reply->flags & RESOLVE_FLAG_ROUTED) \
+ && strcmp(reply_class, SMTPD_NAME_RECIPIENT) == 0 \
+ && !resolve_final(state, reply_name, domain))
+
+ /*
+ * Look up user+foo@domain if the address has an extension, user@domain
+ * otherwise.
*/
if ((status = check_access(state, table, CONST_STR(reply->recipient), FULL,
found, reply_name, reply_class, def_acl)) != 0
|| *found)
- return (status);
+ CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+ && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+ SMTPD_CHECK_DUNNO : status);
+
+ /*
+ * Try user@domain if the address has an extension.
+ */
+ if (bare_addr)
+ if ((status = check_access(state, table, bare_addr, PARTIAL,
+ found, reply_name, reply_class, def_acl)) != 0
+ || *found)
+ CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+ && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+ SMTPD_CHECK_DUNNO : status);
/*
* Look up the domain name, or parent domains thereof.
*/
- if ((status = check_domain_access(state, table, ratsign + 1, PARTIAL,
+ if ((status = check_domain_access(state, table, domain, PARTIAL,
found, reply_name, reply_class, def_acl)) != 0
|| *found)
- return (status);
+ CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+ && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+ SMTPD_CHECK_DUNNO : status);
/*
- * Look up localpart@
+ * Look up user+foo@ if the address has an extension, user@ otherwise.
+ * XXX This leaks a little memory if map lookup is aborted.
*/
local_at = mystrndup(CONST_STR(reply->recipient),
- ratsign - CONST_STR(reply->recipient) + 1);
+ domain - CONST_STR(reply->recipient));
status = check_access(state, table, local_at, PARTIAL, found,
reply_name, reply_class, def_acl);
myfree(local_at);
if (status != 0 || *found)
- return (status);
+ CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+ && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+ SMTPD_CHECK_DUNNO : status);
+
+ /*
+ * Look up user@ if the address has an extension. XXX Same problem here.
+ */
+ if (bare_addr) {
+ local_at = (bare_at ? mystrndup(bare_addr, bare_at + 1 - bare_addr) :
+ mystrdup(bare_addr));
+ status = check_access(state, table, local_at, PARTIAL, found,
+ reply_name, reply_class, def_acl);
+ myfree(local_at);
+ if (status != 0 || *found)
+ CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+ && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+ SMTPD_CHECK_DUNNO : status);
+ }
/*
* Undecided when no match found.
*/
- return (SMTPD_CHECK_DUNNO);
+ CHECK_MAIL_ACCESS_RETURN(SMTPD_CHECK_DUNNO);
}
/* reject_maps_rbl - reject if client address in real-time blackhole list */
/* DIAGNOSTICS
/* Warning: a continuation line that does not continue preceding text.
/* The invalid input is ignored, to avoid complicating caller code.
+/* SECURITY
+/* readlline() imposes no logical line length limit therefore it
+/* should be used for reading trusted information only.
/* LICENSE
/* .ad
/* .fi
projects / thirdparty / postfix.git / commitdiff
