postfix-2.6.4-RC1

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 5ccc72003472c4c3879616566289542d25f2a06a..7067bd124ce9454bde2a2cf02a90e09970823dee 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -15269,3 +15269,14 @@ Apologies for any names omitted.
        Documentation: as of Postfix 2.6, the reject_unauth_pipelining
        feature can be used meaningfully at any protocol stage.
        File: proto/postconf.proto.
+
+20090803
+
+       Workaround: with some local DNS servers including BIND, it
+       is possible that A or MX lookups succeed, while NS lookups
+       for the same domains time out.  Spammers use this to avoid
+       access restrictions.  To deal with future variations of
+       this, check_{client,helo,sender,etc}_{mx,ns,etc}_access no
+       longer tolerate any lookup failures. Instead, they reply
+       with $access_map_defer_code or $access_map_reject_code as
+       appropriate. File: smtpd/smtpd_check.c.

diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES
index 0a926aa3895d2340a8b845d683660dc071a6ad4d..8c720bbef9f3ef8483621a2852076863a7c4b774 100644 (file)
--- a/postfix/RELEASE_NOTES
+++ b/postfix/RELEASE_NOTES
@@ -14,6 +14,22 @@ specifies the release date of a stable release or snapshot release.
 If you upgrade from Postfix 2.4 or earlier, read RELEASE_NOTES-2.5
 before proceeding.
 
+Incompatibility with Postfix 2.6.4
+==================================
+
+The check_{client,helo,sender,etc}_{mx,ns,etc}_access features no
+longer tolerate any lookup failures. Instead, they now reply with
+$access_map_defer_code or $access_map_reject_code as appropriate.
+
+The reason for this change is that spammers are using tricks where
+A or MX lookups succeed while NS lookups for the same domains fail,
+depending local DNS infrastructure details.  The change deals with
+future variants of this anomalous behavior.
+
+As a side effect, non-existent domain names in HELO commands will
+now trigger a REJECT action with check_helo_{mx,ns}_access, where
+previously such commands were silently permitted.
+
 Major changes - multi-instance support
 --------------------------------------
 

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index f80a7c53af1d8943a359f6b65c54a4ab07625829..dce91ae4b006dbfd6d8e6a96c1fe20f3297f04a4 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20090802"
-#define MAIL_VERSION_NUMBER    "2.6.3"
+#define MAIL_RELEASE_DATE      "20090803"
+#define MAIL_VERSION_NUMBER    "2.6.4-RC1"
 
 #ifdef SNAPSHOT
 # define MAIL_VERSION_DATE     "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/smtpd/smtpd_check.c b/postfix/src/smtpd/smtpd_check.c
index ea3dfbf9c77589103e6206b49a9d9d748bc84353..74d86ec4782cd335aa1855a17521a6b447270134 100644 (file)
--- a/postfix/src/smtpd/smtpd_check.c
+++ b/postfix/src/smtpd/smtpd_check.c
@@ -2575,7 +2575,14 @@ static int check_server_access(SMTPD_STATE *state, const char *table,
     if (dns_status != DNS_OK) {
        msg_warn("Unable to look up %s host for %s: %s", dns_strtype(type),
                 domain && domain[1] ? domain : name, dns_strerror(h_errno));
-       return (SMTPD_CHECK_DUNNO);
+       /* No mercy for DNS failure. */
+       return (smtpd_check_reject(state, MAIL_ERROR_POLICY,
+                                  dns_status == DNS_NOTFOUND ?
+                                  var_map_reject_code : var_map_defer_code,
+                                  smtpd_dsn_fix("4.1.8", reply_class),
+                                  "<%s>: %s rejected: %s",
+                                  reply_name, reply_class,
+                                  "Domain not found"));
     }
 
     /*
@@ -2600,7 +2607,16 @@ static int check_server_access(SMTPD_STATE *state, const char *table,
            msg_warn("Unable to look up %s host %s for %s %s: %s",
                     dns_strtype(type), (char *) server->data,
                     reply_class, reply_name, MAI_STRERROR(aierr));
-           continue;
+           /* No mercy for DNS failure. */
+           status = smtpd_check_reject(state,
+                                       MAIL_ERROR_POLICY,
+                                       aierr == EAI_NONAME ?
+                                  var_map_reject_code : var_map_defer_code,
+                                       smtpd_dsn_fix("4.1.8", reply_class),
+                                       "<%s>: %s rejected: %s",
+                                       reply_name, reply_class,
+                                       "Domain not found");
+           CHECK_SERVER_RETURN(status);
        }
        /* Now we must also free the addrinfo result. */
        if (msg_verbose)