Portability: AIX 5.1/GCC.
-20041014-19
+20041014-21
- Message header address rewriting contexts, so that spam
- from badly written software won't look like it came from
- a local user.
+ By default, Postfix no longer appends the local domain to
+ incomplete message header addresses from remote clients.
+ Thus, spam from badly written software no longer looks like
+ it came from a local user.
- The default "local" rewriting context appends "@$myorigin"
- or ".$mydomain" to incomplete message header addresses,
- just like Postfix has always done.
-
- The new "invalid" address context appends "domain.invalid"
- instead (or whatever domain name is specified with the
- invalid_rewrite_context_domain parameter).
-
- The new "none" address rewriting context does not modify
- message header addresses at all.
+ Instead, Postfix either does not rewrite headers from remote
+ clients at all, or it appends the domain name that is
+ specified with the new invalid_rewrite_context_domain
+ parameter.
- Postfix uses the "local" rewriting context for mail posted
- with Postfix sendmail, from clients listed with the
- local_rewrite_context_clients parameter (default: $mynetworks)
- and from SASL authenticated clients.
+ Postfix still appends $@myorigin or .$mydomain to headers
+ in mail from Postfix sendmail, from clients listed with
+ the local_rewrite_context_clients parameter (default:
+ permit_mynetworks, permit_sasl_authenticated).
The context specified with remote_rewrite_context_name is
used for all other clients. The default setting is backwards
compatible to avoid surprises.
- Postfix always uses the "local" rewriting context to update
+ Postfix still appends $@myorigin or .$mydomain when rewriting
incomplete envelope addresses.
20041018
Open problems:
+ High: document master(5) for generic daemon options.
+
+ Low: reject HELO with any domain name that this MTA is
+ final destination for.
+
Low: should the Delivered-To: test in local(8) be configurable?
Low: append a different domain (like, address.invalid) for
<p>
With locally submitted mail, append the string "@$<a href="postconf.5.html#myorigin">myorigin</a>" to mail
addresses without domain information. With remotely submitted mail,
-append the string "@$invalid_domain" instead.
+append the string "@$<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a>" instead.
</p>
<p>
<p>
With locally submitted mail, append the string ".$<a href="postconf.5.html#mydomain">mydomain</a>" to
addresses that have no ".domain" information. With remotely submitted
-mail, append the string ".$invalid_domain" instead.
+mail, append the string ".$<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a>"
+instead.
</p>
<p>
</p>
-</DD>
-
-<DT><b><a name="invalid_header_rewrite_context_domain">invalid_header_rewrite_context_domain</a>
-(default: domain.invalid)</b></DT><DD>
-
-<p> Append this domain to incomplete message header addresses from
-remote clients, when $<a href="postconf.5.html#remote_header_rewrite_context_name">remote_header_rewrite_context_name</a> is set to
-"invalid". This is one way to avoid appending your own domain to
-addresses in spam from poorly written software. </p>
-
-
</DD>
<DT><b><a name="invalid_hostname_reject_code">invalid_hostname_reject_code</a>
</DD>
-<DT><b><a name="local_header_rewrite_context_clients">local_header_rewrite_context_clients</a>
-(default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
+<DT><b><a name="local_header_rewrite_clients">local_header_rewrite_clients</a>
+(default: see "postconf -d" output)</b></DT><DD>
-<p> Append the domain names in $<a href="postconf.5.html#myorigin">myorigin</a> and $<a href="postconf.5.html#mydomain">mydomain</a> to incomplete
-message header addresses from these clients. </p>
+<p> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> to incomplete
+message header addresses from these clients; append
+$<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> for all other clients. </p>
-<p> Specify a list of network addresses or network/netmask patterns,
-separated by comma or whitespace. Continue long lines by starting
-the next line with whitespace. </p>
+<p> Specify a list of zero or more of the following: </p>
-<p> A network mask specifies the number of bits in the network part
-of a host address. You can also specify "/file/name" or "<a href="DATABASE_README.html">type:table</a>"
-patterns. A "/file/name" pattern is replaced by its contents; a
-"<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a client name or address
-matches a lookup key (the lookup result is ignored). </p>
+<dl>
-<p> The list is matched left to right, and the search stops on the
-first match. Specify "!pattern" to exclude an address or network
-block from the list. </p>
+<dt> <b> <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a> </b></dt>
-<p>
-Examples:
-</p>
+<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
+client IP address matches any network or network address listed in
+$<a href="postconf.5.html#mynetworks">mynetworks</a>. This is enabled by default. </dd>
+
+<dt><b> <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a> </b></dt>
+
+<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
+client is successfully authenticated via the <a href="http://www.faqs.org/rfcs/rfc2554.html">RFC 2554</a> (AUTH)
+protocol. This is enabled by default. </dd>
+
+<dt><b> <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> </b></dt>
+
+<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
+client TLS certificate is successfully verified, and the client
+certificate fingerprint is listed on the server. This is enabled
+by default. </dd>
+
+<dt><b> <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a> </b></dt>
+
+<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
+client TLS certificate is successfully verified, regardless of
+whether it is listed on the server, and regardless of the certifying
+authority. </dd>
+
+<dt><b> <a name="check_address_map">check_address_map</a> <i><a
+href="DATABASE_README.html">type:table</a></i> </b></dt>
+
+<dt><b> <i><a href="DATABASE_README.html">type:table</a></i>
+</b></dt>
+
+<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
+client IP address matches the specified lookup table. The lookup
+result is ignored, and no subnet lookup is done. This is suitable
+for pop-before-smtp lookup tables. </dd>
+
+</dl>
+
+<p> Examples: </p>
<pre>
-<a href="postconf.5.html#local_header_rewrite_context_clients">local_header_rewrite_context_clients</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
-<a href="postconf.5.html#local_header_rewrite_context_clients">local_header_rewrite_context_clients</a> = !192.168.0.1 $<a href="postconf.5.html#mynetworks">mynetworks</a>
-<a href="postconf.5.html#local_header_rewrite_context_clients">local_header_rewrite_context_clients</a> = static:all
+<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all
+<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>
</pre>
</DD>
-<DT><b><a name="remote_header_rewrite_context_name">remote_header_rewrite_context_name</a>
-(default: local)</b></DT><DD>
-
-<p> The address rewriting context that should be used for incomplete
-mail header addresses from remote clients. </p>
-
-<ul>
-
-<li> <p> <b>local</b> Append the domains specified with $<a href="postconf.5.html#myorigin">myorigin</a>
-or $<a href="postconf.5.html#mydomain">mydomain</a> to incomplete message header addresses from remote
-clients. </p>
+<DT><b><a name="remote_header_rewrite_domain">remote_header_rewrite_domain</a>
+(default: domain.invalid)</b></DT><DD>
-<li> <p> <b>invalid</b> Append the domain specified with
-$<a href="postconf.5.html#invalid_header_rewrite_context_domain">invalid_header_rewrite_context_domain</a> to incomplete message header
-addresses from remote clients. This is one way to avoid appending
+<p> Append this domain name to incomplete message header addresses
+from remote clients; when this domain name is empty, don't rewrite
+remote message headers at all. Both stop Postfix from appending
your own domain to addresses in spam from poorly written software.
-This is a safe choice for gateways that have no control over
-address rewriting by down-stream systems.
</p>
-<li> <p> <b>none</b> Don't modify message headers from remote
-clients at all. This is another way to avoid appending your own
-domain to addresses in spam from poorly written software. This
-is the preferred choice for purists. </p>
-
-</ul>
-
-<p> Note: Postfix always appends the domains specified with $<a href="postconf.5.html#myorigin">myorigin</a>
-or $<a href="postconf.5.html#mydomain">mydomain</a> to incomplete envelope addresses, because those
-addresses are effectively equivalent to local addresses. </p>
-
</DD>
<dt><b><a name="permit_mynetworks">permit_mynetworks</a></b></dt>
<dd>Permit the request when the client IP address matches any
-network listed in $<a href="postconf.5.html#mynetworks">mynetworks</a>. </dd>
+network or network address listed in $<a href="postconf.5.html#mynetworks">mynetworks</a>. </dd>
+
+<dt><b><a name="permit_sasl_authenticated">permit_sasl_authenticated</a></b></dt>
+
+<dd> Permit the request when the client is successfully
+authenticated via the <a href="http://www.faqs.org/rfcs/rfc2554.html">RFC 2554</a> (AUTH) protocol. </dd>
<dt><b><a name="reject_rbl_client">reject_rbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
</p>
<p>
-If a remote SMTP client is authenticated, the permit_sasl_authenticated
+If a remote SMTP client is authenticated, the <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>
access restriction can be used to permit relay access, like this:
</p>
<pre>
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
- <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, permit_sasl_authenticated, ...
+ <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, ...
</pre>
<p> To reject all SMTP connections from unauthenticated clients,
</p>
<pre>
- <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = permit_sasl_authenticated, reject
+ <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, reject
</pre>
<p>
Available in Postfix version 2.2 and later:
- <b><a href="postconf.5.html#local_header_rewrite_context_clients">local_header_rewrite_context_clients</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b>
- Append the domain names in $<a href="postconf.5.html#myorigin">myorigin</a> and $<a href="postconf.5.html#mydomain">mydomain</a>
- to incomplete message header addresses from these
- clients.
-
- <b><a href="postconf.5.html#remote_header_rewrite_context_name">remote_header_rewrite_context_name</a> (local)</b>
- The address rewriting context that should be used
- for incomplete mail header addresses from remote
- clients.
-
- Implemented by the <a href="trivial-rewrite.8.html">trivial-rewrite(8)</a> server:
-
- <b><a href="postconf.5.html#invalid_header_rewrite_context_domain">invalid_header_rewrite_context_domain</a> (domain.invalid)</b>
- Append this domain to incomplete message header
- addresses from remote clients, when
- $<a href="postconf.5.html#remote_header_rewrite_context_name">remote_header_rewrite_context_name</a> is set to
- "invalid".
+ <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> (see 'postconf -d' output)</b>
+ Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> to
+ incomplete message header addresses from these
+ clients; append $<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> for
+ all other clients.
+
+ <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> (domain.invalid)</b>
+ Append this domain name to incomplete message
+ header addresses from remote clients; when this
+ domain name is empty, don't rewrite remote message
+ headers at all.
<b>AFTER QUEUE EXTERNAL CONTENT INSPECTION CONTROLS</b>
- As of version 1.0, Postfix can be configured to send new
- mail to an external content filter AFTER the mail is
- queued. This content filter is expected to inject mail
- back into a (Postfix or other) MTA for further delivery.
+ As of version 1.0, Postfix can be configured to send new
+ mail to an external content filter AFTER the mail is
+ queued. This content filter is expected to inject mail
+ back into a (Postfix or other) MTA for further delivery.
See the <a href="FILTER_README.html">FILTER_README</a> document for details.
<b><a href="postconf.5.html#content_filter">content_filter</a> (empty)</b>
- The name of a mail delivery transport that filters
+ The name of a mail delivery transport that filters
mail after it is queued.
<b>BEFORE QUEUE EXTERNAL CONTENT INSPECTION CONTROLS</b>
- As of version 2.1, the Postfix SMTP server can be config-
- ured to send incoming mail to a real-time SMTP-based con-
+ As of version 2.1, the Postfix SMTP server can be config-
+ ured to send incoming mail to a real-time SMTP-based con-
tent filter BEFORE mail is queued. This content filter is
- expected to inject mail back into Postfix. See the
- <a href="SMTPD_PROXY_README.html">SMTPD_PROXY_README</a> document for details on how to config-
+ expected to inject mail back into Postfix. See the
+ <a href="SMTPD_PROXY_README.html">SMTPD_PROXY_README</a> document for details on how to config-
ure and operate this feature.
<b><a href="postconf.5.html#smtpd_proxy_filter">smtpd_proxy_filter</a> (empty)</b>
- The hostname and TCP port of the mail filtering
+ The hostname and TCP port of the mail filtering
proxy server.
<b><a href="postconf.5.html#smtpd_proxy_ehlo">smtpd_proxy_ehlo</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
for sending or receiving information.
<b>GENERAL CONTENT INSPECTION CONTROLS</b>
- The following parameters are applicable for both built-in
+ The following parameters are applicable for both built-in
and external content filters.
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#receive_override_options">receive_override_options</a> (empty)</b>
- Enable or disable recipient validation, built-in
+ Enable or disable recipient validation, built-in
content filtering, or address mapping.
<b>EXTERNAL CONTENT INSPECTION CONTROLS</b>
- The following parameters are applicable for both before-
+ The following parameters are applicable for both before-
queue and after-queue content filtering.
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a> (empty)</b>
- What SMTP clients are allowed to use the XFORWARD
+ What SMTP clients are allowed to use the XFORWARD
feature.
<b>SASL AUTHENTICATION CONTROLS</b>
- Postfix SASL support (<a href="http://www.faqs.org/rfcs/rfc2554.html">RFC 2554</a>) can be used to authenti-
- cate remote SMTP clients to the Postfix SMTP server, and
- to authenticate the Postfix SMTP client to a remote SMTP
+ Postfix SASL support (<a href="http://www.faqs.org/rfcs/rfc2554.html">RFC 2554</a>) can be used to authenti-
+ cate remote SMTP clients to the Postfix SMTP server, and
+ to authenticate the Postfix SMTP client to a remote SMTP
server. See the <a href="SASL_README.html">SASL_README</a> document for details.
<b><a href="postconf.5.html#broken_sasl_auth_clients">broken_sasl_auth_clients</a> (no)</b>
- Enable inter-operability with SMTP clients that
- implement an obsolete version of the AUTH command
+ Enable inter-operability with SMTP clients that
+ implement an obsolete version of the AUTH command
(<a href="http://www.faqs.org/rfcs/rfc2554.html">RFC 2554</a>).
<b><a href="postconf.5.html#smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a> (no)</b>
- Enable SASL authentication in the Postfix SMTP
+ Enable SASL authentication in the Postfix SMTP
server.
<b><a href="postconf.5.html#smtpd_sasl_application_name">smtpd_sasl_application_name</a> (smtpd)</b>
- The application name used for SASL server initial-
+ The application name used for SASL server initial-
ization.
<b><a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> (empty)</b>
SMTP server will offer to the client.
<b><a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a> (empty)</b>
- Optional lookup table with the SASL login names
+ Optional lookup table with the SASL login names
that own sender (MAIL FROM) addresses.
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> (empty)</b>
- What SMTP clients Postfix will not offer AUTH sup-
+ What SMTP clients Postfix will not offer AUTH sup-
port to.
<b>VERP SUPPORT CONTROLS</b>
- With VERP style delivery, each recipient of a message
+ With VERP style delivery, each recipient of a message
receives a customized copy of the message with his/her own
- recipient address encoded in the envelope sender address.
+ recipient address encoded in the envelope sender address.
The <a href="VERP_README.html">VERP_README</a> file describes configuration and operation
- details of Postfix support for variable envelope return
+ details of Postfix support for variable envelope return
path addresses. VERP style delivery is requested with the
- SMTP XVERP command or with the "sendmail -V" command-line
- option and is available in Postfix version 1.1 and later.
+ SMTP XVERP command or with the "sendmail -V" command-line
+ option and is available in Postfix version 1.1 and later.
<b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a> (+=)</b>
The two default VERP delimiter characters.
<b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b>
- The characters Postfix accepts as VERP delimiter
- characters on the Postfix <a href="sendmail.1.html">sendmail(1)</a> command line
+ The characters Postfix accepts as VERP delimiter
+ characters on the Postfix <a href="sendmail.1.html">sendmail(1)</a> command line
and in SMTP commands.
Available in Postfix version 1.1 and 2.0:
<b><a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b>
- What SMTP clients are allowed to specify the XVERP
+ What SMTP clients are allowed to specify the XVERP
command.
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> ($<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b>
- What SMTP clients are allowed to specify the XVERP
+ What SMTP clients are allowed to specify the XVERP
command.
<b>TROUBLE SHOOTING CONTROLS</b>
- The <a href="DEBUG_README.html">DEBUG_README</a> document describes how to debug parts of
- the Postfix mail system. The methods vary from making the
- software log a lot of detail, to running some daemon pro-
+ The <a href="DEBUG_README.html">DEBUG_README</a> document describes how to debug parts of
+ the Postfix mail system. The methods vary from making the
+ software log a lot of detail, to running some daemon pro-
cesses under control of a call tracer or debugger.
<b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b>
- The increment in verbose logging level when a
- remote client or server matches a pattern in the
+ The increment in verbose logging level when a
+ remote client or server matches a pattern in the
<a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter.
<b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b>
- Optional list of remote client or server hostname
- or network address patterns that cause the verbose
- logging level to increase by the amount specified
+ Optional list of remote client or server hostname
+ or network address patterns that cause the verbose
+ logging level to increase by the amount specified
in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>.
<b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b>
- The recipient of postmaster notifications about
- mail delivery problems that are caused by policy,
+ The recipient of postmaster notifications about
+ mail delivery problems that are caused by policy,
resource, software or protocol errors.
<b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b>
- The list of error classes that are reported to the
+ The list of error classes that are reported to the
postmaster.
<b><a href="postconf.5.html#soft_bounce">soft_bounce</a> (no)</b>
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a> (empty)</b>
- What SMTP clients are allowed to use the XCLIENT
+ What SMTP clients are allowed to use the XCLIENT
feature.
<b>KNOWN VERSUS UNKNOWN RECIPIENT CONTROLS</b>
- As of Postfix version 2.0, the SMTP server rejects mail
- for unknown recipients. This prevents the mail queue from
- clogging up with undeliverable MAILER-DAEMON messages.
- Additional information on this topic is in the
+ As of Postfix version 2.0, the SMTP server rejects mail
+ for unknown recipients. This prevents the mail queue from
+ clogging up with undeliverable MAILER-DAEMON messages.
+ Additional information on this topic is in the
<a href="LOCAL_RECIPIENT_README.html">LOCAL_RECIPIENT_README</a> and <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> documents.
<b><a href="postconf.5.html#show_user_unknown_table_name">show_user_unknown_table_name</a> (yes)</b>
- Display the name of the recipient table in the
+ Display the name of the recipient table in the
"User unknown" responses.
<b><a href="postconf.5.html#canonical_maps">canonical_maps</a> (empty)</b>
- Optional address mapping lookup tables for message
+ Optional address mapping lookup tables for message
headers and envelopes.
<b><a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> (empty)</b>
<b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, local-</b>
<b>host)</b>
- The list of domains that are delivered via the
+ The list of domains that are delivered via the
$<a href="postconf.5.html#local_transport">local_transport</a> mail delivery transport.
<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b>
<b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b>
The network interface addresses that this mail sys-
- tem receives mail on by way of a proxy or network
+ tem receives mail on by way of a proxy or network
address translation unit.
<b><a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> (<a href="proxymap.8.html">proxy</a>:unix:passwd.byname</b>
<b>$<a href="postconf.5.html#alias_maps">alias_maps</a>)</b>
- Lookup tables with all names or addresses of local
- recipients: a recipient address is local when its
- domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or
+ Lookup tables with all names or addresses of local
+ recipients: a recipient address is local when its
+ domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or
$<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
<b><a href="postconf.5.html#unknown_local_recipient_reject_code">unknown_local_recipient_reject_code</a> (550)</b>
- The numerical Postfix SMTP server response code
- when a recipient address is local, and
- $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> specifies a list of lookup
+ The numerical Postfix SMTP server response code
+ when a recipient address is local, and
+ $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> specifies a list of lookup
tables that does not match the recipient.
- Parameters concerning known/unknown recipients of relay
+ Parameters concerning known/unknown recipients of relay
destinations:
<b><a href="postconf.5.html#relay_domains">relay_domains</a> ($<a href="postconf.5.html#mydestination">mydestination</a>)</b>
- What destination domains (and subdomains thereof)
+ What destination domains (and subdomains thereof)
this system will relay mail to.
<b><a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> (empty)</b>
- Optional lookup tables with all valid addresses in
+ Optional lookup tables with all valid addresses in
the domains that match $<a href="postconf.5.html#relay_domains">relay_domains</a>.
<b><a href="postconf.5.html#unknown_relay_recipient_reject_code">unknown_relay_recipient_reject_code</a> (550)</b>
The numerical Postfix SMTP server reply code when a
- recipient address matches $<a href="postconf.5.html#relay_domains">relay_domains</a>, and
- <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> specifies a list of lookup
+ recipient address matches $<a href="postconf.5.html#relay_domains">relay_domains</a>, and
+ <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> specifies a list of lookup
tables that does not match the recipient address.
- Parameters concerning known/unknown recipients in virtual
+ Parameters concerning known/unknown recipients in virtual
alias domains:
<b><a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> ($<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>)</b>
Postfix is final destination for the specified list
- of virtual alias domains, that is, domains for
- which all addresses are aliased to addresses in
+ of virtual alias domains, that is, domains for
+ which all addresses are aliased to addresses in
other local or remote domains.
<b><a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> ($<a href="postconf.5.html#virtual_maps">virtual_maps</a>)</b>
- Optional lookup tables that alias specific mail
- addresses or domains to other local or remote
+ Optional lookup tables that alias specific mail
+ addresses or domains to other local or remote
address.
<b><a href="postconf.5.html#unknown_virtual_alias_reject_code">unknown_virtual_alias_reject_code</a> (550)</b>
The SMTP server reply code when a recipient address
- matches
$<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">vir</a>-
- <a href="postconf.5.html#virtual_alias_maps">tual_alias_maps</a> specifies a list of lookup tables
+ matches
$<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">vir</a>-
+ <a href="postconf.5.html#virtual_alias_maps">tual_alias_maps</a> specifies a list of lookup tables
that does not match the recipient address.
- Parameters concerning known/unknown recipients in virtual
+ Parameters concerning known/unknown recipients in virtual
mailbox domains:
<b><a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> ($<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>)</b>
Postfix is final destination for the specified list
- of
domains; mail is delivered via the $<a href="postconf.5.html#virtual_transport">vir</a>-
+ of
domains; mail is delivered via the $<a href="postconf.5.html#virtual_transport">vir</a>-
<a href="postconf.5.html#virtual_transport">tual_transport</a> mail delivery transport.
<b><a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> (empty)</b>
- Optional lookup tables with all valid addresses in
+ Optional lookup tables with all valid addresses in
the domains that match $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
<b><a href="postconf.5.html#unknown_virtual_mailbox_reject_code">unknown_virtual_mailbox_reject_code</a> (550)</b>
The SMTP server reply code when a recipient address
- matches
$<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">vir</a>-
+ matches
$<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">vir</a>-
<a href="postconf.5.html#virtual_mailbox_maps">tual_mailbox_maps</a> specifies a list of lookup tables
that does not match the recipient address.
<b>RESOURCE AND RATE CONTROLS</b>
- The following parameters limit resource usage by the SMTP
+ The following parameters limit resource usage by the SMTP
server and/or control client request rates.
<b><a href="postconf.5.html#line_length_limit">line_length_limit</a> (2048)</b>
- Upon input, long lines are chopped up into pieces
- of at most this length; upon delivery, long lines
+ Upon input, long lines are chopped up into pieces
+ of at most this length; upon delivery, long lines
are reconstructed.
<b><a href="postconf.5.html#queue_minfree">queue_minfree</a> (0)</b>
- The minimal amount of free space in bytes in the
+ The minimal amount of free space in bytes in the
queue file system that is needed to receive mail.
<b><a href="postconf.5.html#message_size_limit">message_size_limit</a> (10240000)</b>
- The maximal size in bytes of a message, including
+ The maximal size in bytes of a message, including
envelope information.
<b><a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a> (1000)</b>
- The maximal number of recipients that the Postfix
+ The maximal number of recipients that the Postfix
SMTP server accepts per message delivery request.
<b><a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> (300s)</b>
- The time limit for sending a Postfix SMTP server
- response and for receiving a remote SMTP client
+ The time limit for sending a Postfix SMTP server
+ response and for receiving a remote SMTP client
request.
<b><a href="postconf.5.html#smtpd_history_flush_threshold">smtpd_history_flush_threshold</a> (100)</b>
- The maximal number of lines in the Postfix SMTP
- server command history before it is flushed upon
+ The maximal number of lines in the Postfix SMTP
+ server command history before it is flushed upon
receipt of EHLO, RSET, or end of DATA.
The per SMTP client connection count and request rate lim-
its are implemented in co-operation with the <a href="anvil.8.html">anvil(8)</a> ser-
- vice, and are available in Postfix version 2.2 and later.
+ vice, and are available in Postfix version 2.2 and later.
<b><a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a> (50)</b>
- How many simultaneous connections any client is
+ How many simultaneous connections any client is
allowed to make to this service.
<b><a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> (0)</b>
The maximal number of connection attempts any
- client is allowed to make to this service per time
+ client is allowed to make to this service per time
unit.
<b><a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> (0)</b>
- The maximal number of message delivery requests
- that any client is allowed to make to this service
+ The maximal number of message delivery requests
+ that any client is allowed to make to this service
per time unit, regardless of whether or not Postfix
actually accepts those messages.
<b><a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> (0)</b>
- The maximal number of recipient addresses that any
- client is allowed to send to this service per time
+ The maximal number of recipient addresses that any
+ client is allowed to send to this service per time
unit, regardless of whether or not Postfix actually
accepts those recipients.
<b><a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b>
- Clients that are excluded from connection count,
- connection rate, message rate or recipient rate
+ Clients that are excluded from connection count,
+ connection rate, message rate or recipient rate
restrictions.
<b>TARPIT CONTROLS</b>
- When a remote SMTP client makes errors, the Postfix SMTP
- server can insert delays before responding. This can help
- to slow down run-away software. The behavior is con-
- trolled by an error counter that counts the number of
- errors within an SMTP session that a client makes without
+ When a remote SMTP client makes errors, the Postfix SMTP
+ server can insert delays before responding. This can help
+ to slow down run-away software. The behavior is con-
+ trolled by an error counter that counts the number of
+ errors within an SMTP session that a client makes without
delivering mail.
<b><a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> (1s)</b>
- With Postfix 2.1 and later: the SMTP server
- response delay after a client has made more than
- $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors, and fewer than
- $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without delivering
+ With Postfix 2.1 and later: the SMTP server
+ response delay after a client has made more than
+ $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors, and fewer than
+ $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without delivering
mail.
<b><a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> (10)</b>
- The number of errors a remote SMTP client is
- allowed to make without delivering mail before the
+ The number of errors a remote SMTP client is
+ allowed to make without delivering mail before the
Postfix SMTP server slows down all its responses.
<b><a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> (20)</b>
- The maximal number of errors a remote SMTP client
+ The maximal number of errors a remote SMTP client
is allowed to make without delivering mail.
<b><a href="postconf.5.html#smtpd_junk_command_limit">smtpd_junk_command_limit</a> (100)</b>
- The number of junk commands (NOOP, VRFY, ETRN or
+ The number of junk commands (NOOP, VRFY, ETRN or
RSET) that a remote SMTP client can send before the
- Postfix SMTP server starts to increment the error
+ Postfix SMTP server starts to increment the error
counter with each junk command.
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a> (1000)</b>
- The number of recipients that a remote SMTP client
- can send in excess of the limit specified with
+ The number of recipients that a remote SMTP client
+ can send in excess of the limit specified with
$<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>, before the Postfix SMTP
- server increments the per-session error count for
+ server increments the per-session error count for
each excess recipient.
<b>ACCESS POLICY DELEGATION CONTROLS</b>
- As of version 2.1, Postfix can be configured to delegate
- access policy decisions to an external server that runs
- outside Postfix. See the file <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a> for
+ As of version 2.1, Postfix can be configured to delegate
+ access policy decisions to an external server that runs
+ outside Postfix. See the file <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a> for
more information.
<b><a href="postconf.5.html#smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a> (300s)</b>
- The time after which an idle SMTPD policy service
+ The time after which an idle SMTPD policy service
connection is closed.
<b><a href="postconf.5.html#smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a> (1000s)</b>
connection is closed.
<b><a href="postconf.5.html#smtpd_policy_service_timeout">smtpd_policy_service_timeout</a> (100s)</b>
- The time limit for connecting to, writing to or
+ The time limit for connecting to, writing to or
receiving from a delegated SMTPD policy server.
<b>ACCESS CONTROLS</b>
- The <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a> document gives an introduction to
+ The <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a> document gives an introduction to
all the SMTP server access control features.
<b><a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> (yes)</b>
- Wait until the RCPT TO command before evaluating
+ Wait until the RCPT TO command before evaluating
$<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, $smtpd_helo_restric-
tions and $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, or wait until
- the ETRN command before evaluating
+ the ETRN command before evaluating
$<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and $smtpd_helo_restric-
tions.
- <b><a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> (see 'postconf -d' out-</b>
+ <b><a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> (see 'postconf -d' out-</b>
<b>put)</b>
What Postfix features match subdomains of
"domain.tld" automatically, instead of requiring an
explicit ".domain.tld" pattern.
<b><a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> (empty)</b>
- Optional SMTP server access restrictions in the
+ Optional SMTP server access restrictions in the
context of a client SMTP connection request.
<b><a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> (no)</b>
Require that a remote SMTP client introduces itself
- at the beginning of an SMTP session with the HELO
+ at the beginning of an SMTP session with the HELO
or EHLO command.
<b><a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> (empty)</b>
- Optional restrictions that the Postfix SMTP server
+ Optional restrictions that the Postfix SMTP server
applies in the context of the SMTP HELO command.
<b><a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> (empty)</b>
- Optional restrictions that the Postfix SMTP server
+ Optional restrictions that the Postfix SMTP server
applies in the context of the MAIL FROM command.
<b><a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> (<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,</b>
<b><a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>)</b>
The access restrictions that the Postfix SMTP
- server applies in the context of the RCPT TO com-
+ server applies in the context of the RCPT TO com-
mand.
<b><a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> (empty)</b>
- Optional SMTP server access restrictions in the
+ Optional SMTP server access restrictions in the
context of a client ETRN request.
<b><a href="postconf.5.html#allow_untrusted_routing">allow_untrusted_routing</a> (no)</b>
- Forward mail with sender-specified routing
- (user[@%!]remote[@%!]site) from untrusted clients
+ Forward mail with sender-specified routing
+ (user[@%!]remote[@%!]site) from untrusted clients
to destinations matching $<a href="postconf.5.html#relay_domains">relay_domains</a>.
<b><a href="postconf.5.html#smtpd_restriction_classes">smtpd_restriction_classes</a> (empty)</b>
- User-defined aliases for groups of access restric-
+ User-defined aliases for groups of access restric-
tions.
<b><a href="postconf.5.html#smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a> (</b><><b>)</b>
- The lookup key to be used in SMTP <a href="access.5.html">access(5)</a> tables
+ The lookup key to be used in SMTP <a href="access.5.html">access(5)</a> tables
instead of the null sender address.
<b><a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a> (empty)</b>
Restrict the use of the <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> SMTP
- access feature to only domains whose primary MX
+ access feature to only domains whose primary MX
hosts match the listed networks.
Available in Postfix version 2.0 and later:
<b><a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> (empty)</b>
- Optional access restrictions that the Postfix SMTP
+ Optional access restrictions that the Postfix SMTP
server applies in the context of the SMTP DATA com-
mand.
<b><a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> (see 'postconf -d' output)</b>
- What characters are allowed in $name expansions of
+ What characters are allowed in $name expansions of
RBL reply templates.
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> (no)</b>
- Request that the Postfix SMTP server rejects mail
- from unknown sender addresses, even when no
- explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a> access restriction
+ Request that the Postfix SMTP server rejects mail
+ from unknown sender addresses, even when no
+ explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a> access restriction
is specified.
<b><a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> (yes)</b>
- Request that the Postfix SMTP server rejects mail
+ Request that the Postfix SMTP server rejects mail
for unknown recipient addresses, even when no
- explicit <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a> access restric-
+ explicit <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a> access restric-
tion is specified.
<b>SENDER AND RECIPIENT ADDRESS VERIFICATION CONTROLS</b>
- Postfix version 2.1 introduces sender and recipient
- address verification. This feature is implemented by
- sending probe email messages that are not actually deliv-
- ered.
This feature is requested via the <a href="postconf.5.html#reject_unverified_sender">reject_unveri</a>-
- <a href="postconf.5.html#reject_unverified_sender">fied_sender</a> and <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> access
- restrictions. The status of verification probes is main-
+ Postfix version 2.1 introduces sender and recipient
+ address verification. This feature is implemented by
+ sending probe email messages that are not actually deliv-
+ ered.
This feature is requested via the <a href="postconf.5.html#reject_unverified_sender">reject_unveri</a>-
+ <a href="postconf.5.html#reject_unverified_sender">fied_sender</a> and <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> access
+ restrictions. The status of verification probes is main-
tained by the <a href="verify.8.html">verify(8)</a> server. See the file ADDRESS_VER-
- <a href="IFICATION_README.html">IFICATION_README</a> for information about how to configure
+ <a href="IFICATION_README.html">IFICATION_README</a> for information about how to configure
and operate the Postfix sender/recipient address verifica-
tion service.
<b><a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> (3)</b>
- How many times to query the <a href="verify.8.html">verify(8)</a> service for
- the completion of an address verification request
+ How many times to query the <a href="verify.8.html">verify(8)</a> service for
+ the completion of an address verification request
in progress.
<b><a href="postconf.5.html#address_verify_poll_delay">address_verify_poll_delay</a> (3s)</b>
- The delay between queries for the completion of an
+ The delay between queries for the completion of an
address verification request in progress.
<b><a href="postconf.5.html#address_verify_sender">address_verify_sender</a> (postmaster)</b>
- The sender address to use in address verification
+ The sender address to use in address verification
probes.
<b><a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> (450)</b>
- The numerical Postfix SMTP server response code
- when a recipient address is rejected by the
+ The numerical Postfix SMTP server response code
+ when a recipient address is rejected by the
<a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> restriction.
<b><a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> (450)</b>
- The numerical Postfix SMTP server response when a
+ The numerical Postfix SMTP server response when a
recipient address is rejected by the <a href="postconf.5.html#reject_unverified_recipient">reject_unveri</a>-
<a href="postconf.5.html#reject_unverified_recipient">fied_recipient</a> restriction.
<b>ACCESS CONTROL RESPONSES</b>
- The following parameters control numerical SMTP reply
+ The following parameters control numerical SMTP reply
codes and/or text responses.
<b><a href="postconf.5.html#access_map_reject_code">access_map_reject_code</a> (554)</b>
- The numerical Postfix SMTP server response code
- when a client is rejected by an <a href="access.5.html">access(5)</a> map
+ The numerical Postfix SMTP server response code
+ when a client is rejected by an <a href="access.5.html">access(5)</a> map
restriction.
<b><a href="postconf.5.html#defer_code">defer_code</a> (450)</b>
- The numerical Postfix SMTP server response code
- when a remote SMTP client request is rejected by
+ The numerical Postfix SMTP server response code
+ when a remote SMTP client request is rejected by
the "defer" restriction.
<b><a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> (501)</b>
- The numerical Postfix SMTP server response code
- when the client HELO or EHLO command parameter is
- rejected by the <a href="postconf.5.html#reject_invalid_hostname">reject_invalid_hostname</a> restric-
+ The numerical Postfix SMTP server response code
+ when the client HELO or EHLO command parameter is
+ rejected by the <a href="postconf.5.html#reject_invalid_hostname">reject_invalid_hostname</a> restric-
tion.
<b><a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> (554)</b>
- The numerical Postfix SMTP server response code
+ The numerical Postfix SMTP server response code
when a remote SMTP client request is blocked by the
<a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,
<a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a>
<b><a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> (504)</b>
The numerical Postfix SMTP server reply code when a
- client request is rejected by the
+ client request is rejected by the
<a href="postconf.5.html#reject_non_fqdn_hostname">reject_non_fqdn_hostname</a>, <a href="postconf.5.html#reject_non_fqdn_sender">reject_non_fqdn_sender</a> or
<a href="postconf.5.html#reject_non_fqdn_recipient">reject_non_fqdn_recipient</a> restriction.
<b><a href="postconf.5.html#reject_code">reject_code</a> (554)</b>
- The numerical Postfix SMTP server response code
- when a remote SMTP client request is rejected by
+ The numerical Postfix SMTP server response code
+ when a remote SMTP client request is rejected by
the "<b>reject</b>" restriction.
<b><a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> (554)</b>
- The numerical Postfix SMTP server response code
- when a client request is rejected by the
+ The numerical Postfix SMTP server response code
+ when a client request is rejected by the
<a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient restriction.
<b><a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> (450)</b>
- The numerical Postfix SMTP server response code
- when a sender or recipient address is rejected by
+ The numerical Postfix SMTP server response code
+ when a sender or recipient address is rejected by
the <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a> or
<a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a> restriction.
<b><a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> (450)</b>
- The numerical Postfix SMTP server response code
- when a client without valid address <=> name map-
- ping
is rejected by the <a href="postconf.5.html#reject_unknown_client">reject_unknown_client</a>
+ The numerical Postfix SMTP server response code
+ when a client without valid address <=> name map-
+ ping
is rejected by the <a href="postconf.5.html#reject_unknown_client">reject_unknown_client</a>
restriction.
<b><a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> (450)</b>
- The numerical Postfix SMTP server response code
- when the hostname specified with the HELO or EHLO
- command
is rejected by the <a href="postconf.5.html#reject_unknown_hostname">reject_unknown_hostname</a>
+ The numerical Postfix SMTP server response code
+ when the hostname specified with the HELO or EHLO
+ command
is rejected by the <a href="postconf.5.html#reject_unknown_hostname">reject_unknown_hostname</a>
restriction.
Available in Postfix version 2.0 and later:
<b><a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> (see 'postconf -d' output)</b>
- The default SMTP server response template for a
- request that is rejected by an RBL-based restric-
+ The default SMTP server response template for a
+ request that is rejected by an RBL-based restric-
tion.
<b><a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> (550)</b>
- The numerical Postfix SMTP server response code
+ The numerical Postfix SMTP server response code
when a remote SMTP client request is blocked by the
<a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipient_bounce</a> restriction.
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix main.cf and
+ The default location of the Postfix main.cf and
master.cf configuration files.
<b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b>
- How much time a Postfix daemon process may take to
- handle a request before it is terminated by a
+ How much time a Postfix daemon process may take to
+ handle a request before it is terminated by a
built-in watchdog timer.
<b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b>
- The location of all postfix administrative com-
+ The location of all postfix administrative com-
mands.
<b><a href="postconf.5.html#double_bounce_sender">double_bounce_sender</a> (double-bounce)</b>
and most Postfix daemon processes.
<b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b>
- The maximum amount of time that an idle Postfix
- daemon process waits for the next service request
+ The maximum amount of time that an idle Postfix
+ daemon process waits for the next service request
before exiting.
<b><a href="postconf.5.html#max_use">max_use</a> (100)</b>
- The maximal number of connection requests before a
+ The maximal number of connection requests before a
Postfix daemon process terminates.
<b><a href="postconf.5.html#myhostname">myhostname</a> (see 'postconf -d' output)</b>
The internet hostname of this mail system.
<b><a href="postconf.5.html#mynetworks">mynetworks</a> (see 'postconf -d' output)</b>
- The list of "trusted" SMTP clients that have more
+ The list of "trusted" SMTP clients that have more
privileges than "strangers".
<b><a href="postconf.5.html#myorigin">myorigin</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
The domain name that locally-posted mail appears to
- come from, and that locally posted mail is deliv-
+ come from, and that locally posted mail is deliv-
ered to.
<b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
- The process ID of a Postfix command or daemon pro-
+ The process ID of a Postfix command or daemon pro-
cess.
<b><a href="postconf.5.html#process_name">process_name</a> (read-only)</b>
- The process name of a Postfix command or daemon
+ The process name of a Postfix command or daemon
process.
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
- The location of the Postfix top-level queue direc-
+ The location of the Postfix top-level queue direc-
tory.
<b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b>
sions (user+foo).
<b><a href="postconf.5.html#smtpd_banner">smtpd_banner</a> ($<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b>
- The text that follows the 220 status code in the
+ The text that follows the 220 status code in the
SMTP greeting banner.
<b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (postfix)</b>
- The mail system name that is prepended to the pro-
+ The mail system name that is prepended to the pro-
cess name in syslog records, so that "smtpd"
becomes, for example, "postfix/smtpd".
<a href="XFORWARD_README.html">XFORWARD_README</a>, Postfix XFORWARD extension
<b>LICENSE</b>
- The Secure Mailer license must be distributed with this
+ The Secure Mailer license must be distributed with this
software.
<b>AUTHOR(S)</b>
<b>invalid</b>
Append the domain name specified with
- <b>$<a href="postconf.5.html#invalid_header_rewrite_context_domain">invalid_header_rewrite_context_domain</a></b> to
- incomplete addresses. Otherwise the result
- is identical to that of the <b>local</b> address
- rewriting context. This prevents Postfix
- from appending the <a href="ADDRESS_CLASS_README.html#local_domain_class">local domain</a> to spam from
- poorly written remote clients.
+ <b>$<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a></b> to incomplete
+ addresses. Otherwise the result is identical
+ to that of the <b>local</b> address rewriting con-
+ text. This prevents Postfix from appending
+ the <a href="ADDRESS_CLASS_README.html#local_domain_class">local domain</a> to spam from poorly written
+ remote clients.
<b>resolve</b> <i>address</i>
Resolve an address to a (<i>transport</i>, <i>nexthop</i>, <i>recip-</i>
Available in Postfix 2.2 and later:
- <b><a href="postconf.5.html#invalid_header_rewrite_context_domain">invalid_header_rewrite_context_domain</a> (domain.invalid)</b>
+ <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> (domain.invalid)</b>
Append this domain to incomplete message header
- addresses from remote clients, when
- $<a href="postconf.5.html#remote_header_rewrite_context_name">remote_header_rewrite_context_name</a> is set to
- "invalid".
-
- Implemented by the <a href="smtpd.8.html">smtpd(8)</a> server:
-
- <b><a href="postconf.5.html#remote_header_rewrite_context_name">remote_header_rewrite_context_name</a> (local)</b>
- The address rewriting context that should be used
- for incomplete mail header addresses from remote
- clients.
+ addresses from remote clients; when the domain is
+ empty, don't rewrite remote message headers at all.
<b>ROUTING CONTROLS</b>
The following is applicable to Postfix version 2.0 and
.SH append_at_myorigin (default: yes)
With locally submitted mail, append the string "@$myorigin" to mail
addresses without domain information. With remotely submitted mail,
-append the string "@$invalid_domain" instead.
+append the string "@$remote_header_rewrite_domain" instead.
.PP
This feature is enabled by default and must not be turned off.
Postfix does not support domain-less addresses.
.SH append_dot_mydomain (default: yes)
With locally submitted mail, append the string ".$mydomain" to
addresses that have no ".domain" information. With remotely submitted
-mail, append the string ".$invalid_domain" instead.
+mail, append the string ".$remote_header_rewrite_domain"
+instead.
.PP
This feature is enabled by default. If disabled, users will not be
able to send mail to "user@partialdomainname" but will have to
.PP
Warning: with concurrency of 1, one bad message can be enough to
block all mail to a site.
-.SH invalid_header_rewrite_context_domain (default: domain.invalid)
-Append this domain to incomplete message header addresses from
-remote clients, when $remote_header_rewrite_context_name is set to
-"invalid". This is one way to avoid appending your own domain to
-addresses in spam from poorly written software.
.SH invalid_hostname_reject_code (default: 501)
The numerical Postfix SMTP server response code when the client
HELO or EHLO command parameter is rejected by the reject_invalid_hostname
Setting this parameter to a value > 1 changes the meaning of
local_destination_concurrency_limit from concurrency per recipient
into concurrency per domain.
-.SH local_header_rewrite_context_clients (default: $mynetworks)
-Append the domain names in $myorigin and $mydomain to incomplete
-message header addresses from these clients.
-.PP
-Specify a list of network addresses or network/netmask patterns,
-separated by comma or whitespace. Continue long lines by starting
-the next line with whitespace.
-.PP
-A network mask specifies the number of bits in the network part
-of a host address. You can also specify "/file/name" or "type:table"
-patterns. A "/file/name" pattern is replaced by its contents; a
-"type:table" lookup table is matched when a client name or address
-matches a lookup key (the lookup result is ignored).
-.PP
-The list is matched left to right, and the search stops on the
-first match. Specify "!pattern" to exclude an address or network
-block from the list.
+.SH local_header_rewrite_clients (default: see "postconf -d" output)
+Append the domain name in $myorigin or $mydomain to incomplete
+message header addresses from these clients; append
+$remote_header_rewrite_domain for all other clients.
+.PP
+Specify a list of zero or more of the following:
+.IP "\fB permit_mynetworks \fR"
+Append the domain name in $myorigin or $mydomain when the
+client IP address matches any network or network address listed in
+$mynetworks. This is enabled by default.
+.IP "\fB permit_sasl_authenticated \fR"
+Append the domain name in $myorigin or $mydomain when the
+client is successfully authenticated via the RFC 2554 (AUTH)
+protocol. This is enabled by default.
+.IP "\fB permit_tls_clientcerts \fR"
+Append the domain name in $myorigin or $mydomain when the
+client TLS certificate is successfully verified, and the client
+certificate fingerprint is listed on the server. This is enabled
+by default.
+.IP "\fB permit_tls_all_clientcerts \fR"
+Append the domain name in $myorigin or $mydomain when the
+client TLS certificate is successfully verified, regardless of
+whether it is listed on the server, and regardless of the certifying
+authority.
+.IP "\fB check_address_map \fI<a
+href="DATABASE_README.html">type:table\fR \fR"
+.IP "\fB \fItype:table\fR
+\fR"
+Append the domain name in $myorigin or $mydomain when the
+client IP address matches the specified lookup table. The lookup
+result is ignored, and no subnet lookup is done. This is suitable
+for pop-before-smtp lookup tables.
.PP
Examples:
.PP
.nf
.na
.ft C
-local_header_rewrite_context_clients = $mynetworks
-local_header_rewrite_context_clients = !192.168.0.1 $mynetworks
-local_header_rewrite_context_clients = static:all
+local_header_rewrite_clients = static:all
+local_header_rewrite_clients = permit_mynetworks, permit_sasl_authenticated
.fi
.ad
.ft R
.fi
.ad
.ft R
-.SH remote_header_rewrite_context_name (default: local)
-The address rewriting context that should be used for incomplete
-mail header addresses from remote clients.
-.IP \(bu
-\fBlocal\fR Append the domains specified with $myorigin
-or $mydomain to incomplete message header addresses from remote
-clients.
-.IP \(bu
-\fBinvalid\fR Append the domain specified with
-$invalid_header_rewrite_context_domain to incomplete message header
-addresses from remote clients. This is one way to avoid appending
+.SH remote_header_rewrite_domain (default: domain.invalid)
+Append this domain name to incomplete message header addresses
+from remote clients; when this domain name is empty, don't rewrite
+remote message headers at all. Both stop Postfix from appending
your own domain to addresses in spam from poorly written software.
-This is a safe choice for gateways that have no control over
-address rewriting by down-stream systems.
-.IP \(bu
-\fBnone\fR Don't modify message headers from remote
-clients at all. This is another way to avoid appending your own
-domain to addresses in spam from poorly written software. This
-is the preferred choice for purists.
-.PP
-Note: Postfix always appends the domains specified with $myorigin
-or $mydomain to incomplete envelope addresses, because those
-addresses are effectively equivalent to local addresses.
.SH require_home_directory (default: no)
Whether or not a local(8) recipient's home directory must exist
before mail delivery is attempted. By default this test is disabled.
least significant octets. See the access(5) manual page for details.
.IP "\fBpermit_mynetworks\fR"
Permit the request when the client IP address matches any
-network listed in $mynetworks.
+network or network address listed in $mynetworks.
+.IP "\fBpermit_sasl_authenticated\fR"
+Permit the request when the client is successfully
+authenticated via the RFC 2554 (AUTH) protocol.
.IP "\fBreject_rbl_client \fIrbl_domain=d.d.d.d\fR\fR"
Reject the request when the reversed client network address is
listed with the A record "\fId.d.d.d\fR" under \fIrbl_domain\fR
filtering, or address mapping.
.PP
Available in Postfix version 2.2 and later:
-.IP "\fBlocal_header_rewrite_context_clients ($mynetworks)\fR"
-Append the domain names in $myorigin and $mydomain to incomplete
-message header addresses from these clients.
-.IP "\fBremote_header_rewrite_context_name (local)\fR"
-The address rewriting context that should be used for incomplete
-mail header addresses from remote clients.
-.PP
-Implemented by the trivial-rewrite(8) server:
-.IP "\fBinvalid_header_rewrite_context_domain (domain.invalid)\fR"
-Append this domain to incomplete message header addresses from
-remote clients, when $remote_header_rewrite_context_name is set to
-"invalid".
+.IP "\fBlocal_header_rewrite_clients (see 'postconf -d' output)\fR"
+Append the domain name in $myorigin or $mydomain to incomplete
+message header addresses from these clients; append
+$remote_header_rewrite_domain for all other clients.
+.IP "\fBremote_header_rewrite_domain (domain.invalid)\fR"
+Append this domain name to incomplete message header addresses
+from remote clients; when this domain name is empty, don't rewrite
+remote message headers at all.
.SH "AFTER QUEUE EXTERNAL CONTENT INSPECTION CONTROLS"
.na
.nf
to \fIuser@domain\fR form.
.IP \fBinvalid\fR
Append the domain name specified with
-\fB$invalid_header_rewrite_context_domain\fR to incomplete
+\fB$remote_header_rewrite_domain\fR to incomplete
addresses. Otherwise the result is identical to that of
the \fBlocal\fR address rewriting context. This prevents
Postfix from appending the local domain to spam from poorly
Enable the rewriting of "site!user" into "user@site".
.PP
Available in Postfix 2.2 and later:
-.IP "\fBinvalid_header_rewrite_context_domain (domain.invalid)\fR"
+.IP "\fBremote_header_rewrite_domain (domain.invalid)\fR"
Append this domain to incomplete message header addresses from
-remote clients, when $remote_header_rewrite_context_name is set to
-"invalid".
-.PP
-Implemented by the smtpd(8) server:
-.IP "\fBremote_header_rewrite_context_name (local)\fR"
-The address rewriting context that should be used for incomplete
-mail header addresses from remote clients.
+remote clients; when the domain is empty, don't rewrite remote message
+headers at all.
.SH "ROUTING CONTROLS"
.na
.nf
s;\binet_interfaces\b;<a href="postconf.5.html#inet_interfaces">$&</a>;g;
s;\binitial_destination_concurrency\b;<a href="postconf.5.html#initial_destination_concurrency">$&</a>;g;
s;\binvalid_hostname_reject_code\b;<a href="postconf.5.html#invalid_hostname_reject_code">$&</a>;g;
- s;\binvalid_header_rewrite_con[-</bB>]*\n* *[<bB>]*text_domain\b;<a href="postconf.5.html#invalid_header_rewrite_context_domain">$&</a>;g;
s;\bipc_idle\b;<a href="postconf.5.html#ipc_idle">$&</a>;g;
s;\bipc_timeout\b;<a href="postconf.5.html#ipc_timeout">$&</a>;g;
s;\bipc_ttl\b;<a href="postconf.5.html#ipc_ttl">$&</a>;g;
s;\blocal_recip[-</bB>]*\n* *[<bB>]*ient_maps\b;<a href="postconf.5.html#local_recipient_maps">$&</a>;g;
s;\blocal_transport\b;<a href="postconf.5.html#local_transport">$&</a>;g;
s;\bluser_relay\b;<a href="postconf.5.html#luser_relay">$&</a>;g;
- s;\blocal_header_rewrite_con[-</bB>]*\n* *[<bB>]*text_clients\b;<a href="postconf.5.html#local_header_rewrite_context_clients">$&</a>;g;
+ s;\blocal_header_rewrite_clients\b;<a href="postconf.5.html#local_header_rewrite_clients">$&</a>;g;
s;\bmail_name\b;<a href="postconf.5.html#mail_name">$&</a>;g;
s;\bmail_owner\b;<a href="postconf.5.html#mail_owner">$&</a>;g;
s;\bmail_release_date\b;<a href="postconf.5.html#mail_release_date">$&</a>;g;
s;\brbl_reply_maps\b;<a href="postconf.5.html#rbl_reply_maps">$&</a>;g;
s;\breadme_directory\b;<a href="postconf.5.html#readme_directory">$&</a>;g;
s;\breceive_override_options\b;<a href="postconf.5.html#receive_override_options">$&</a>;g;
- s;\bremote_header_rewrite_con[-</bB>]*\n* *[<bB>]*text_name\b;<a href="postconf.5.html#remote_header_rewrite_context_name">$&</a>;g;
+ s;\bremote_header_rewrite_domain\b;<a href="postconf.5.html#remote_header_rewrite_domain">$&</a>;g;
s;\bno_unknown_recip[-</bB>]*\n* *[<bB>]*ient_checks\b;<a href="postconf.5.html#no_unknown_recipient_checks">$&</a>;g;
s;\bno_address_mappings\b;<a href="postconf.5.html#no_address_mappings">$&</a>;g;
s;\bno_header_body_checks\b;<a href="postconf.5.html#no_header_body_checks">$&</a>;g;
# Access restrictions - generic
+ s;\bcheck_address_map\b;<a href="postconf.5.html#check_address_map">$&</a>;g;
s;\bcheck_policy_service\b;<a href="postconf.5.html#check_policy_service">$&</a>;g;
s;\bdefer_if_permit\b;<a href="postconf.5.html#defer_if_permit">$&</a>;g;
s;\bdefer_if_reject\b;<a href="postconf.5.html#defer_if_reject">$&</a>;g;
s;\bcheck_client_access\b;<a href="postconf.5.html#check_client_access">$&</a>;g;
s;\bpermit_mynetworks\b;<a href="postconf.5.html#permit_mynetworks">$&</a>;g;
+ s;\bpermit_sasl_authenticated\b;<a href="postconf.5.html#permit_sasl_authenticated">$&</a>;g;
+ s;\bpermit_tls_clientcerts\b;<a href="postconf.5.html#permit_tls_clientcerts">$&</a>;g;
+ s;\bpermit_tls_all_clientcerts\b;<a href="postconf.5.html#permit_tls_all_clientcerts">$&</a>;g;
s;\breject_unknown_client\b;<a href="postconf.5.html#reject_unknown_client">$&</a>;g;
s;\breject_rbl_client\b;<a href="postconf.5.html#reject_rbl_client">$&</a>;g;
s;\breject_rhsbl_client\b;<a href="postconf.5.html#reject_rhsbl_client">$&</a>;g;
<dt><b><a name="permit_mynetworks">permit_mynetworks</a></b></dt>
<dd>Permit the request when the client IP address matches any
-network listed in $mynetworks. </dd>
+network or network address listed in $mynetworks. </dd>
+
+<dt><b><a name="permit_sasl_authenticated">permit_sasl_authenticated</a></b></dt>
+
+<dd> Permit the request when the client is successfully
+authenticated via the RFC 2554 (AUTH) protocol. </dd>
+
<dt><b><a name="reject_rbl_client">reject_rbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
<p>
With locally submitted mail, append the string "@$myorigin" to mail
addresses without domain information. With remotely submitted mail,
-append the string "@$invalid_domain" instead.
+append the string "@$remote_header_rewrite_domain" instead.
</p>
<p>
<p>
With locally submitted mail, append the string ".$mydomain" to
addresses that have no ".domain" information. With remotely submitted
-mail, append the string ".$invalid_domain" instead.
+mail, append the string ".$remote_header_rewrite_domain"
+instead.
</p>
<p>
session cache hit and miss rates for logical destinations and for
physical endpoints. </p>
-%PARAM invalid_header_rewrite_context_domain domain.invalid
+%PARAM remote_header_rewrite_domain domain.invalid
-<p> Append this domain to incomplete message header addresses from
-remote clients, when $remote_header_rewrite_context_name is set to
-"invalid". This is one way to avoid appending your own domain to
-addresses in spam from poorly written software. </p>
+<p> Append this domain name to incomplete message header addresses
+from remote clients; when this domain name is empty, don't rewrite
+remote message headers at all. Both stop Postfix from appending
+your own domain to addresses in spam from poorly written software.
+</p>
-%PARAM local_header_rewrite_context_clients $mynetworks
+%PARAM local_header_rewrite_clients see "postconf -d" output
-<p> Append the domain names in $myorigin and $mydomain to incomplete
-message header addresses from these clients. </p>
+<p> Append the domain name in $myorigin or $mydomain to incomplete
+message header addresses from these clients; append
+$remote_header_rewrite_domain for all other clients. </p>
-<p> Specify a list of network addresses or network/netmask patterns,
-separated by comma or whitespace. Continue long lines by starting
-the next line with whitespace. </p>
+<p> Specify a list of zero or more of the following: </p>
-<p> A network mask specifies the number of bits in the network part
-of a host address. You can also specify "/file/name" or "type:table"
-patterns. A "/file/name" pattern is replaced by its contents; a
-"type:table" lookup table is matched when a client name or address
-matches a lookup key (the lookup result is ignored). </p>
+<dl>
-<p> The list is matched left to right, and the search stops on the
-first match. Specify "!pattern" to exclude an address or network
-block from the list. </p>
+<dt> <b> permit_mynetworks </b></dt>
+<dd> Append the domain name in $myorigin or $mydomain when the
+client IP address matches any network or network address listed in
+$mynetworks. This is enabled by default. </dd>
-<p>
-Examples:
-</p>
+<dt><b> permit_sasl_authenticated </b></dt>
-<pre>
-local_header_rewrite_context_clients = $mynetworks
-local_header_rewrite_context_clients = !192.168.0.1 $mynetworks
-local_header_rewrite_context_clients = static:all
-</pre>
+<dd> Append the domain name in $myorigin or $mydomain when the
+client is successfully authenticated via the RFC 2554 (AUTH)
+protocol. This is enabled by default. </dd>
-%PARAM remote_header_rewrite_context_name local
+<dt><b> permit_tls_clientcerts </b></dt>
-<p> The address rewriting context that should be used for incomplete
-mail header addresses from remote clients. </p>
+<dd> Append the domain name in $myorigin or $mydomain when the
+client TLS certificate is successfully verified, and the client
+certificate fingerprint is listed on the server. This is enabled
+by default. </dd>
-<ul>
+<dt><b> permit_tls_all_clientcerts </b></dt>
-<li> <p> <b>local</b> Append the domains specified with $myorigin
-or $mydomain to incomplete message header addresses from remote
-clients. </p>
+<dd> Append the domain name in $myorigin or $mydomain when the
+client TLS certificate is successfully verified, regardless of
+whether it is listed on the server, and regardless of the certifying
+authority. </dd>
-<li> <p> <b>invalid</b> Append the domain specified with
-$invalid_header_rewrite_context_domain to incomplete message header
-addresses from remote clients. This is one way to avoid appending
-your own domain to addresses in spam from poorly written software.
-This is a safe choice for gateways that have no control over
-address rewriting by down-stream systems.
-</p>
+<dt><b> <a name="check_address_map">check_address_map</a> <i><a
+href="DATABASE_README.html">type:table</a></i> </b></dt>
-<li> <p> <b>none</b> Don't modify message headers from remote
-clients at all. This is another way to avoid appending your own
-domain to addresses in spam from poorly written software. This
-is the preferred choice for purists. </p>
+<dt><b> <i><a href="DATABASE_README.html">type:table</a></i>
+</b></dt>
-</ul>
+<dd> Append the domain name in $myorigin or $mydomain when the
+client IP address matches the specified lookup table. The lookup
+result is ignored, and no subnet lookup is done. This is suitable
+for pop-before-smtp lookup tables. </dd>
-<p> Note: Postfix always appends the domains specified with $myorigin
-or $mydomain to incomplete envelope addresses, because those
-addresses are effectively equivalent to local addresses. </p>
+</dl>
+
+<p> Examples: </p>
+
+<pre>
+local_header_rewrite_clients = static:all
+local_header_rewrite_clients = permit_mynetworks, permit_sasl_authenticated
+</pre>
cleanup_addr.o: ../../include/maps.h
cleanup_addr.o: ../../include/dict.h
cleanup_addr.o: ../../include/argv.h
+cleanup_addr.o: ../../include/rewrite_clnt.h
cleanup_addr.o: cleanup.h
cleanup_addr.o: ../../include/nvtable.h
cleanup_addr.o: ../../include/htable.h
cleanup_envelope.o: ../../include/mail_proto.h
cleanup_envelope.o: ../../include/iostuff.h
cleanup_envelope.o: ../../include/attr.h
+cleanup_envelope.o: ../../include/rewrite_clnt.h
cleanup_envelope.o: cleanup.h
cleanup_envelope.o: ../../include/argv.h
cleanup_envelope.o: ../../include/maps.h
cleanup_message.o: ../../include/attr.h
cleanup_message.o: ../../include/mime_state.h
cleanup_message.o: ../../include/lex_822.h
+cleanup_message.o: ../../include/rewrite_clnt.h
cleanup_message.o: cleanup.h
cleanup_message.o: ../../include/maps.h
cleanup_message.o: ../../include/dict.h
cleanup_rewrite.o: ../../include/vbuf.h
cleanup_rewrite.o: ../../include/tok822.h
cleanup_rewrite.o: ../../include/resolve_clnt.h
+cleanup_rewrite.o: ../../include/rewrite_clnt.h
cleanup_rewrite.o: ../../include/quote_822_local.h
cleanup_rewrite.o: ../../include/quote_flags.h
-cleanup_rewrite.o: ../../include/rewrite_clnt.h
-cleanup_rewrite.o: ../../include/mail_params.h
cleanup_rewrite.o: cleanup.h
cleanup_rewrite.o: ../../include/vstream.h
cleanup_rewrite.o: ../../include/argv.h
cleanup_state.o: ../../include/mail_params.h
cleanup_state.o: ../../include/mime_state.h
cleanup_state.o: ../../include/header_opts.h
+cleanup_state.o: ../../include/rewrite_clnt.h
cleanup_state.o: cleanup.h
cleanup_state.o: ../../include/vstream.h
cleanup_state.o: ../../include/argv.h
#include <mail_addr.h>
#include <canon_addr.h>
#include <mail_addr_find.h>
+#include <rewrite_clnt.h>
/* Application-specific. */
#define STR vstring_str
#define IGNORE_EXTENSION (char **) 0
-#define STREQ(x,y) (strcmp((x), (y)) == 0)
/* cleanup_addr_sender - process envelope sender record */
VSTRING *clean_addr = vstring_alloc(100);
const char *bcc;
+ /*
+ * Note: an unqualified username is for all practical purposes equivalent
+ * to a fully qualified local address, if only because a reply to an
+ * incomplete address will be sent to a local recipient. Having to
+ * support both forms is error prone, therefore an incomplete envelope
+ * address is rewritten to fully qualified form in the local domain
+ * context.
+ */
cleanup_rewrite_internal(REWRITE_LOCAL, clean_addr, buf);
if (strncasecmp(STR(clean_addr), MAIL_ADDR_MAIL_DAEMON "@",
sizeof(MAIL_ADDR_MAIL_DAEMON)) == 0) {
VSTRING *clean_addr = vstring_alloc(100);
const char *bcc;
+ /*
+ * Note: an unqualified username is for all practical purposes equivalent
+ * to a fully qualified local address, if only because a reply to an
+ * incomplete address will be sent to a local recipient. Having to
+ * support both forms is error prone, therefore an incomplete envelope
+ * address is rewritten to fully qualified form in the local domain
+ * context.
+ */
cleanup_rewrite_internal(REWRITE_LOCAL,
clean_addr, *buf ? buf : var_empty_addr);
if (state->flags & CLEANUP_FLAG_MAP_OK) {
{
VSTRING *clean_addr = vstring_alloc(100);
+ /*
+ * Note: BCC addresses are supplied locally, andmust be rewritten in the
+ * local address rewriting context.
+ */
cleanup_rewrite_internal(REWRITE_LOCAL, clean_addr, bcc);
if (state->flags & CLEANUP_FLAG_MAP_OK) {
if (cleanup_rcpt_canon_maps
#include <mail_params.h>
#include <verp_sender.h>
#include <mail_proto.h>
+#include <rewrite_clnt.h>
/* Application-specific. */
int extra_opts;
NAME_CODE rewrite_context_names[] = {
REWRITE_LOCAL, 1,
- REWRITE_INVALID, 1,
+ REWRITE_REMOTE, 1,
REWRITE_NONE, 1,
0, 0,
};
#include <mail_proto.h>
#include <mime_state.h>
#include <lex_822.h>
+#include <rewrite_clnt.h>
/* Application-specific. */
/* Global library. */
#include <tok822.h>
-#include <quote_822_local.h>
#include <rewrite_clnt.h>
+#include <quote_822_local.h>
/* Application-specific. */
#include <been_here.h>
#include <mail_params.h>
#include <mime_state.h>
+#include <rewrite_clnt.h>
/* Application-specific. */
canon_addr.o: ../../include/vbuf.h
canon_addr.o: ../../include/mymalloc.h
canon_addr.o: rewrite_clnt.h
-canon_addr.o: mail_params.h
canon_addr.o: canon_addr.h
cfg_parser.o: cfg_parser.c
cfg_parser.o: ../../include/sys_defs.h
tok822_rewrite.o: ../../include/vbuf.h
tok822_rewrite.o: ../../include/msg.h
tok822_rewrite.o: rewrite_clnt.h
-tok822_rewrite.o: mail_params.h
tok822_rewrite.o: tok822.h
tok822_rewrite.o: resolve_clnt.h
tok822_tree.o: tok822_tree.c
request->sasl_method = 0;
request->sasl_username = 0;
request->sasl_sender = 0;
+ request->rewrite_context = 0;
return (request);
}
myfree(request->sasl_username);
if (request->sasl_sender)
myfree(request->sasl_sender);
+ if (request->rewrite_context)
+ myfree(request->rewrite_context);
myfree((char *) request);
}
/*
* What domain names to assume when no valid domain context exists.
*/
-#define VAR_INV_RWR_DOMAIN "invalid_header_rewrite_context_domain"
-#define DEF_INV_RWR_DOMAIN "domain.invalid"
-extern char *var_inv_rwr_domain;
+#define VAR_REM_RWR_DOMAIN "remote_header_rewrite_domain"
+#define DEF_REM_RWR_DOMAIN "domain.invalid"
+extern char *var_remote_rwr_domain;
-#define VAR_REM_RWR_NAME "remote_header_rewrite_context_name"
-#define DEF_REM_RWR_NAME REWRITE_LOCAL
-extern char *var_remote_rwr_name;
+#define CHECK_ADDR_MAP "check_address_map"
-#define REWRITE_LOCAL "local"
-#define REWRITE_INVALID "invalid"
-#define REWRITE_NONE "none"
-
-#define VAR_LOC_RWR_CLIENTS "local_header_rewrite_context_clients"
-#define DEF_LOC_RWR_CLIENTS "$" VAR_MYNETWORKS
+#define VAR_LOC_RWR_CLIENTS "local_header_rewrite_clients"
+#ifdef USE_TLS
+#define DEF_LOC_RWR_CLIENTS PERMIT_MYNETWORKS " " PERMIT_SASL_AUTH \
+ " " PERMIT_TLS_CLIENT
+#else
+#define DEF_LOC_RWR_CLIENTS PERMIT_MYNETWORKS " " PERMIT_SASL_AUTH
+#endif
extern char *var_local_rwr_clients;
/* LICENSE
* Patches change the patchlevel and the release date. Snapshots change the
* release date only.
*/
-#define MAIL_RELEASE_DATE "20041020"
+#define MAIL_RELEASE_DATE "20041021"
#define MAIL_VERSION_NUMBER "2.2"
#define VAR_MAIL_VERSION "mail_version"
* Utility library.
*/
#include <vstring.h>
-#include <mail_params.h>
/*
* External interface.
#define REWRITE_ADDR "rewrite"
#define REWRITE_CANON REWRITE_LOCAL /* backwards compatibility */
+ /*
+ * XXX These should be moved to mail_proto.h because they appear as
+ * attribute values in queue file records and delivery requests.
+ */
+#define REWRITE_LOCAL "local"
+#define REWRITE_REMOTE "remote"
+#define REWRITE_NONE "none"
+
extern VSTRING *rewrite_clnt(const char *, const char *, VSTRING *);
extern VSTRING *rewrite_clnt_internal(const char *, const char *, VSTRING *);
local a@.
local a@b
local a@b.
-invalid !
-invalid a!
-invalid !b
-invalid a!b
-invalid %
-invalid a%
-invalid %b
-invalid a%b
-invalid @
-invalid a@
-invalid a@.
-invalid a@b
-invalid a@b.
+remote !
+remote a!
+remote !b
+remote a!b
+remote %
+remote a%
+remote %b
+remote a%b
+remote @
+remote a@
+remote a@.
+remote a@b
+remote a@b.
address a@b.
result a@b
-rule invalid
+rule remote
address !
result ""@
-rule invalid
+rule remote
address a!
result ""@a.domain.invalid
-rule invalid
+rule remote
address !b
result b@
-rule invalid
+rule remote
address a!b
result b@a.domain.invalid
-rule invalid
+rule remote
address %
result ""@
-rule invalid
+rule remote
address a%
result a@
-rule invalid
+rule remote
address %b
result ""@b.domain.invalid
-rule invalid
+rule remote
address a%b
result a@b.domain.invalid
-rule invalid
+rule remote
address @
result ""
-rule invalid
+rule remote
address a@
result a@
-rule invalid
+rule remote
address a@.
result a@.
-rule invalid
+rule remote
address a@b
result a@b.domain.invalid
-rule invalid
+rule remote
address a@b.
result a@b
#include <mark_corrupt.h>
#include <quote_821_local.h>
#include <mail_proto.h>
+#include <rewrite_clnt.h>
/* Application-specific. */
resolve.o: ../../include/attr.h
resolve.o: ../../include/resolve_clnt.h
resolve.o: ../../include/rewrite_clnt.h
-resolve.o: ../../include/mail_params.h
resolve.o: ../../include/tok822.h
+resolve.o: ../../include/mail_params.h
resolve.o: ../../include/defer.h
resolve.o: ../../include/bounce.h
resolve.o: ../../include/deliver_request.h
myfree(message->sasl_username);
if (message->sasl_sender)
myfree(message->sasl_sender);
+ if (message->rewrite_context)
+ myfree(message->rewrite_context);
qmgr_rcpt_list_free(&message->rcpt_list);
qmgr_message_count--;
myfree((char *) message);
myfree(message->sasl_username);
if (message->sasl_sender)
myfree(message->sasl_sender);
+ if (message->rewrite_context)
+ myfree(message->rewrite_context);
qmgr_rcpt_list_free(&message->rcpt_list);
qmgr_message_count--;
myfree((char *) message);
#include <quote_821_local.h>
#include <mail_proto.h>
#include <mime_state.h>
+#include <rewrite_clnt.h>
/* Application-specific. */
/* filtering, or address mapping.
/* .PP
/* Available in Postfix version 2.2 and later:
-/* .IP "\fBlocal_header_rewrite_context_clients ($mynetworks)\fR"
-/* Append the domain names in $myorigin and $mydomain to incomplete
-/* message header addresses from these clients.
-/* .IP "\fBremote_header_rewrite_context_name (local)\fR"
-/* The address rewriting context that should be used for incomplete
-/* mail header addresses from remote clients.
-/* .PP
-/* Implemented by the trivial-rewrite(8) server:
-/* .IP "\fBinvalid_header_rewrite_context_domain (domain.invalid)\fR"
-/* Append this domain to incomplete message header addresses from
-/* remote clients, when $remote_header_rewrite_context_name is set to
-/* "invalid".
+/* .IP "\fBlocal_header_rewrite_clients (see 'postconf -d' output)\fR"
+/* Append the domain name in $myorigin or $mydomain to incomplete
+/* message header addresses from these clients; append
+/* $remote_header_rewrite_domain for all other clients.
+/* .IP "\fBremote_header_rewrite_domain (domain.invalid)\fR"
+/* Append this domain name to incomplete message header addresses
+/* from remote clients; when this domain name is empty, don't rewrite
+/* remote message headers at all.
/* AFTER QUEUE EXTERNAL CONTENT INSPECTION CONTROLS
/* .ad
/* .fi
#include <anvil_clnt.h>
#endif
#include <flush_clnt.h>
+#include <rewrite_clnt.h>
/* Single-threaded server skeleton. */
#endif
-char *var_remote_rwr_name;
+char *var_remote_rwr_domain;
char *var_local_rwr_clients;
/*
* its own access control.
*/
static NAMADR_LIST *xclient_hosts;
+static int xclient_allowed; /* XXX should be SMTPD_STATE member */
/*
* XFORWARD command. Access control is cached.
*/
static NAMADR_LIST *xforward_hosts;
+static int xforward_allowed; /* XXX should be SMTPD_STATE member */
/*
* Client connection and rate limiting.
if (namadr_list_match(verp_clients, state->name, state->addr))
smtpd_chat_reply(state, "250-%s", VERP_CMD);
/* XCLIENT must not override its own access control. */
- if (state->xclient_allowed)
+ if (xclient_allowed)
smtpd_chat_reply(state, "250-" XCLIENT_CMD
" " XCLIENT_NAME " " XCLIENT_ADDR
" " XCLIENT_PROTO " " XCLIENT_HELO);
- if (state->xforward_allowed)
+ if (xforward_allowed)
smtpd_chat_reply(state, "250-" XFORWARD_CMD
" " XFORWARD_NAME " " XFORWARD_ADDR
" " XFORWARD_PROTO " " XFORWARD_HELO
*/
#ifdef SNAPSHOT
if (SMTPD_STAND_ALONE(state) == 0
- && !state->xclient_allowed
+ && !xclient_allowed
&& anvil_clnt
&& var_smtpd_cmail_limit > 0
&& !namadr_list_match(hogger_list, state->name, state->addr)
*/
#ifdef SNAPSHOT
if (SMTPD_STAND_ALONE(state) == 0
- && !state->xclient_allowed
+ && !xclient_allowed
&& anvil_clnt
&& var_smtpd_crcpt_limit > 0
&& !namadr_list_match(hogger_list, state->name, state->addr)
XCLIENT_CMD);
return (-1);
}
- if (!state->xclient_allowed) {
+ if (!xclient_allowed) {
state->error_mask |= MAIL_ERROR_POLICY;
smtpd_chat_reply(state, "554 Error: insufficient authorization");
return (-1);
XFORWARD_CMD);
return (-1);
}
- if (!state->xforward_allowed) {
+ if (!xforward_allowed) {
state->error_mask |= MAIL_ERROR_POLICY;
smtpd_chat_reply(state, "554 Error: insufficient authorization");
return (-1);
case SMTPD_STATE_XFORWARD_DOMAIN:
if (STREQ(attr_value, XFORWARD_UNAVAILABLE))
attr_value = XFORWARD_DOM_LOCAL;
- context_name[1] = var_remote_rwr_name;
+ context_name[1] = *var_remote_rwr_domain ?
+ REWRITE_REMOTE : REWRITE_NONE;
if ((context_code = name_code(xforward_to_context,
NAME_CODE_FLAG_NONE,
attr_value)) < 0) {
*/
#ifdef SNAPSHOT
if (SMTPD_STAND_ALONE(state) == 0
- && !state->xclient_allowed
+ && !xclient_allowed
&& anvil_clnt
&& !namadr_list_match(hogger_list, state->name, state->addr)
&& anvil_clnt_connect(anvil_clnt, service, state->addr,
*/
#ifdef SNAPSHOT
if (SMTPD_STAND_ALONE(state) == 0
- && !state->xclient_allowed
+ && !xclient_allowed
&& anvil_clnt
&& !namadr_list_match(hogger_list, state->name, state->addr))
anvil_clnt_disconnect(anvil_clnt, service, state->addr);
/*
* XCLIENT must not override its own access control.
*/
- state.xclient_allowed =
+ xclient_allowed =
namadr_list_match(xclient_hosts, state.name, state.addr);
/*
* Overriding XFORWARD access control makes no sense, either.
*/
- state.xforward_allowed =
+ xforward_allowed =
namadr_list_match(xforward_hosts, state.name, state.addr);
/*
static void post_jail_init(char *unused_name, char **unused_argv)
{
- NAME_CODE rewrite_context_names[] = {
- REWRITE_LOCAL, 1,
- REWRITE_INVALID, 1,
- REWRITE_NONE, 1,
- 0, 0,
- };
/*
* Initialize the receive transparency options: do we want unknown
|| var_smtpd_cmail_limit || var_smtpd_crcpt_limit)
anvil_clnt = anvil_clnt_create();
#endif
-
- /*
- * Sanity check.
- */
- if (name_code(rewrite_context_names, NAME_CODE_FLAG_STRICT_CASE,
- var_remote_rwr_name) == 0)
- msg_fatal("parameter %s: invalid value: %s",
- VAR_REM_RWR_NAME, var_remote_rwr_name);
}
/* main - the main program */
#ifdef SNAPSHOT
VAR_SMTPD_HOGGERS, DEF_SMTPD_HOGGERS, &var_smtpd_hoggers, 0, 0,
#endif
- VAR_REM_RWR_NAME, DEF_REM_RWR_NAME, &var_remote_rwr_name, 1, 0,
- VAR_LOC_RWR_CLIENTS, DEF_LOC_RWR_CLIENTS, &var_local_rwr_clients, 1, 0,
+ VAR_REM_RWR_DOMAIN, DEF_REM_RWR_DOMAIN, &var_remote_rwr_domain, 0, 0,
+ VAR_LOC_RWR_CLIENTS, DEF_LOC_RWR_CLIENTS, &var_local_rwr_clients, 0, 0,
0,
};
static CONFIG_RAW_TABLE raw_table[] = {
int junk_cmds; /* counter */
int rcpt_overshoot; /* counter */
char *rewrite_context_name; /* address rewriting context */
- int xclient_allowed; /* permission to use XCLIENT */
- int xforward_allowed; /* permission to use XFORWARD */
/*
* SASL specific.
/* smtpd_check_addr() sanity checks an email address and returns
/* non-zero in case of badness.
/*
-/* smtpd_check_rewrite() shuod be called before opening a queue
+/* smtpd_check_rewrite() should be called before opening a queue
/* file or proxy connection, in order to establish the proper
/* header address rewriting context.
/*
static DOMAIN_LIST *relay_domains;
static NAMADR_LIST *mynetworks;
static NAMADR_LIST *perm_mx_networks;
-static NAMADR_LIST *local_rewrite_clients;
/*
* How to do parent domain wildcard matching, if any.
static HTABLE *smtpd_rest_classes;
static HTABLE *policy_clnt_table;
+static ARGV *local_rewrite_clients;
+
/*
* Pre-parsed expansion filter.
*/
#define SMTPD_NAME_RECIPIENT "Recipient address"
#define SMTPD_NAME_ETRN "Etrn command"
#define SMTPD_NAME_DATA "Data command"
+#define SMTPD_NAME_REWRITE "Local address rewriting"
/*
* YASLM.
/* smtpd_check_parse - pre-parse restrictions */
-static ARGV *smtpd_check_parse(const char *checks)
+static ARGV *smtpd_check_parse(int flags, const char *checks)
{
char *saved_checks = mystrdup(checks);
ARGV *argv = argv_alloc(1);
* encounter. Dictionaries must be opened before entering the chroot
* jail.
*/
+#define SMTPD_CHECK_PARSE_POLICY (1<<0)
+#define SMTPD_CHECK_PARSE_MAPS (1<<1)
+#define SMTPD_CHECK_PARSE_ALL (~0)
+
while ((name = mystrtok(&bp, RESTRICTION_SEPARATORS)) != 0) {
argv_add(argv, name, (char *) 0);
- if (last && strcasecmp(last, CHECK_POLICY_SERVICE) == 0)
+ if ((flags & SMTPD_CHECK_PARSE_POLICY)
+ && last && strcasecmp(last, CHECK_POLICY_SERVICE) == 0)
policy_client_register(name);
- else if (strchr(name, ':') && dict_handle(name) == 0) {
+ else if ((flags & SMTPD_CHECK_PARSE_MAPS)
+ && strchr(name, ':') && dict_handle(name) == 0) {
dict_register(name, dict_open(name, O_RDONLY, DICT_FLAG_LOCK));
}
last = name;
perm_mx_networks =
namadr_list_init(match_parent_style(VAR_PERM_MX_NETWORKS),
var_perm_mx_networks);
- local_rewrite_clients =
- namadr_list_init(MATCH_FLAG_NONE, var_local_rwr_clients);
/*
* Pre-parse and pre-open the recipient maps.
* Pre-parse the restriction lists. At the same time, pre-open tables
* before going to jail.
*/
- client_restrctions = smtpd_check_parse(var_client_checks);
- helo_restrctions = smtpd_check_parse(var_helo_checks);
- mail_restrctions = smtpd_check_parse(var_mail_checks);
- rcpt_restrctions = smtpd_check_parse(var_rcpt_checks);
- etrn_restrctions = smtpd_check_parse(var_etrn_checks);
- data_restrctions = smtpd_check_parse(var_data_checks);
+ client_restrctions = smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ var_client_checks);
+ helo_restrctions = smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ var_helo_checks);
+ mail_restrctions = smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ var_mail_checks);
+ rcpt_restrctions = smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ var_rcpt_checks);
+ etrn_restrctions = smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ var_etrn_checks);
+ data_restrctions = smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ var_data_checks);
/*
* Parse the pre-defined restriction classes.
if ((value = mail_conf_lookup_eval(name)) == 0 || *value == 0)
msg_fatal("restriction class `%s' needs a definition", name);
htable_enter(smtpd_rest_classes, name,
- (char *) smtpd_check_parse(value));
+ (char *) smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ value));
}
myfree(saved_classes);
}
*/
#if 0
htable_enter(smtpd_rest_classes, "check_relay_domains",
- smtpd_check_parse("permit_mydomain reject_unauth_destination"));
+ smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ "permit_mydomain reject_unauth_destination"));
#endif
htable_enter(smtpd_rest_classes, REJECT_SENDER_LOGIN_MISMATCH,
- (char *) smtpd_check_parse(REJECT_AUTH_SENDER_LOGIN_MISMATCH
+ (char *) smtpd_check_parse(SMTPD_CHECK_PARSE_ALL,
+ REJECT_AUTH_SENDER_LOGIN_MISMATCH
" " REJECT_UNAUTH_SENDER_LOGIN_MISMATCH));
/*
*/
expand_filter = vstring_alloc(10);
unescape(expand_filter, var_smtpd_exp_filter);
+
+ /*
+ * Local rewrite policy.
+ */
+ local_rewrite_clients = smtpd_check_parse(SMTPD_CHECK_PARSE_MAPS,
+ var_local_rwr_clients);
}
/* log_whatsup - log as much context as we have */
void smtpd_check_rewrite(SMTPD_STATE *state)
{
+ const char *myname = "smtpd_check_rewrite";
+ int status;
+ char **cpp;
+ DICT *dict;
/*
- * This should be made more configurable.
- */
-#define SASL_AUTHENTICATED 1
-#define NOT_SASL_AUTHENTICATED 0
-
- /*
- * XXX We accept same syntax as mynetwork.
+ * We don't use generic_checks() because it produces results that
+ * aren't applicable such as DEFER or REJECT.
*/
- if (SMTPD_STAND_ALONE(state)
- || namadr_list_match(local_rewrite_clients, state->name, state->addr)
+ for (cpp = local_rewrite_clients->argv; *cpp != 0; cpp++) {
+ if (msg_verbose)
+ msg_info("%s: trying: %s", myname, *cpp);
+ status = SMTPD_CHECK_DUNNO;
+ if (strcasecmp(*cpp, PERMIT_MYNETWORKS) == 0) {
+ status = permit_mynetworks(state);
+ } else if (is_map_command(state, *cpp, CHECK_ADDR_MAP, &cpp)) {
+ if ((dict = dict_handle(*cpp)) == 0)
+ msg_panic("%s: dictionary not found: %s", myname, *cpp);
+ if (dict_get(dict, state->addr) != 0)
+ status = SMTPD_CHECK_OK;
+ } else if (strcasecmp(*cpp, PERMIT_SASL_AUTH) == 0) {
#ifdef USE_SASL_AUTH
- || permit_sasl_auth(state, SASL_AUTHENTICATED,
- NOT_SASL_AUTHENTICATED)
+ status = permit_sasl_auth(state, SMTPD_CHECK_OK,
+ SMTPD_CHECK_DUNNO);
+#else
+ status = SMTPD_CHECK_DUNNO;
#endif
- )
- state->rewrite_context_name = mystrdup(REWRITE_LOCAL);
- else
- state->rewrite_context_name = mystrdup(var_remote_rwr_name);
+#ifdef USE_SSL
+ } else if (strcasecmp(*cpp, PERMIT_TLS_ALL_CLIENTCERTS) == 0) {
+ status = permit_tls_clientcerts(state, 1);
+ } else if (strcasecmp(*cpp, PERMIT_TLS_CLIENTCERTS) == 0) {
+ status = permit_tls_clientcerts(state, 0);
+#endif
+ } else {
+ msg_warn("parameter %s: invalid request: %s",
+ VAR_LOC_RWR_CLIENTS, *cpp);
+ continue;
+ }
+ if (status == SMTPD_CHECK_OK) {
+ state->rewrite_context_name = mystrdup(REWRITE_LOCAL);
+ return;
+ }
+ }
+ state->rewrite_context_name = mystrdup(*var_remote_rwr_domain ?
+ REWRITE_REMOTE : REWRITE_NONE);
}
/* smtpd_check_client - validate client name or address */
for (rp = rest_table; rp->name; rp++) {
if (strcasecmp(rp->name, argv[0]) == 0) {
argv_free(rp->target[0]);
- rp->target[0] = smtpd_check_parse(argv[1]);
+ rp->target[0] = smtpd_check_parse(SMTPD_CHECK_PARSE_ALL, argv[1]);
return (1);
}
}
argv_free((ARGV *) entry->value);
else
entry = htable_enter(smtpd_rest_classes, name, (char *) 0);
- entry->value = (char *) smtpd_check_parse(cp);
+ entry->value = (char *) smtpd_check_parse(SMTPD_CHECK_PARSE_ALL, cp);
}
/* resolve_clnt_init - initialize reply */
#include <mail_params.h>
#include <rec_type.h>
#include <mail_proto.h>
+#include <rewrite_clnt.h>
/* Application-specific. */
state->instance = vstring_alloc(10);
state->seqno = 0;
state->rewrite_context_name = 0;
- state->xclient_allowed = 0;
- state->xforward_allowed = 0;
#ifdef USE_SASL_AUTH
if (SMTPD_STAND_ALONE(state))
rewrite.o: ../../include/tok822.h
rewrite.o: ../../include/resolve_clnt.h
rewrite.o: ../../include/mail_conf.h
+rewrite.o: ../../include/rewrite_clnt.h
rewrite.o: trivial-rewrite.h
transport.o: transport.c
transport.o: ../../include/sys_defs.h
trivial-rewrite.o: ../../include/resolve_local.h
trivial-rewrite.o: ../../include/mail_conf.h
trivial-rewrite.o: ../../include/resolve_clnt.h
+trivial-rewrite.o: ../../include/rewrite_clnt.h
trivial-rewrite.o: ../../include/tok822.h
trivial-rewrite.o: ../../include/mail_addr.h
trivial-rewrite.o: ../../include/mail_server.h
/* TOK822 *tree;
/*
/* RWR_CONTEXT local_context;
-/* RWR_CONTEXT inval_context;
+/* RWR_CONTEXT remote_context;
/* DESCRIPTION
/* This module implements the trivial address rewriting engine.
/*
/* rewrite_tree() rewrites a parse tree with a single address to
/* another tree. A tree is a dummy node on top of a token list.
/*
-/* local_context and inval_context provide domain names for
+/* local_context and remote_context provide domain names for
/* completing incomplete address forms.
/* STANDARDS
/* DIAGNOSTICS
#include <resolve_local.h>
#include <tok822.h>
#include <mail_conf.h>
+#include <rewrite_clnt.h>
/* Application-specific. */
VAR_MYDOMAIN, &var_mydomain,
};
-RWR_CONTEXT inval_context = {
- VAR_INV_RWR_DOMAIN, &var_inv_rwr_domain,
- VAR_INV_RWR_DOMAIN, &var_inv_rwr_domain,
+RWR_CONTEXT remote_context = {
+ VAR_REM_RWR_DOMAIN, &var_remote_rwr_domain,
+ VAR_REM_RWR_DOMAIN, &var_remote_rwr_domain,
};
static VSTRING *ruleset;
ATTR_TYPE_END) != 2)
return (-1);
- /*
- * Note: an unqualified username is for all practical purposes equivalent
- * to a fully qualified local address, if only because a reply to an
- * unqualified address will be sent to a local recipient. Having to
- * support both forms is error prone, therefore an unqualified address is
- * rewritten in the local domain context when no address rewriting
- * context is given.
- */
- if (strcmp(vstring_str(ruleset), REWRITE_LOCAL) == 0
- || strcmp(vstring_str(ruleset), REWRITE_NONE) == 0)
+ if (strcmp(vstring_str(ruleset), REWRITE_LOCAL) == 0)
context = &local_context;
- else if (strcmp(vstring_str(ruleset), REWRITE_INVALID) == 0)
- context = &inval_context;
+ else if (strcmp(vstring_str(ruleset), REWRITE_REMOTE) == 0)
+ context = &remote_context;
else {
msg_warn("unknown context: %s", vstring_str(ruleset));
return (-1);
/* to \fIuser@domain\fR form.
/* .IP \fBinvalid\fR
/* Append the domain name specified with
-/* \fB$invalid_header_rewrite_context_domain\fR to incomplete
+/* \fB$remote_header_rewrite_domain\fR to incomplete
/* addresses. Otherwise the result is identical to that of
/* the \fBlocal\fR address rewriting context. This prevents
/* Postfix from appending the local domain to spam from poorly
/* Enable the rewriting of "site!user" into "user@site".
/* .PP
/* Available in Postfix 2.2 and later:
-/* .IP "\fBinvalid_header_rewrite_context_domain (domain.invalid)\fR"
+/* .IP "\fBremote_header_rewrite_domain (domain.invalid)\fR"
/* Append this domain to incomplete message header addresses from
-/* remote clients, when $remote_header_rewrite_context_name is set to
-/* "invalid".
-/* .PP
-/* Implemented by the smtpd(8) server:
-/* .IP "\fBremote_header_rewrite_context_name (local)\fR"
-/* The address rewriting context that should be used for incomplete
-/* mail header addresses from remote clients.
+/* remote clients; when the domain is empty, don't rewrite remote message
+/* headers at all.
/* ROUTING CONTROLS
/* .ad
/* .fi
char *var_empty_addr;
int var_show_unk_rcpt_table;
int var_resolve_nulldom;
-char *var_inv_rwr_domain;
+char *var_remote_rwr_domain;
/*
* Shadow personality for address verification.
VAR_VRFY_RELAY_XPORT, DEF_VRFY_RELAY_XPORT, &var_vrfy_relay_xport, 1, 0,
VAR_VRFY_DEF_XPORT, DEF_VRFY_DEF_XPORT, &var_vrfy_def_xport, 1, 0,
VAR_VRFY_RELAYHOST, DEF_VRFY_RELAYHOST, &var_vrfy_relayhost, 0, 0,
- VAR_INV_RWR_DOMAIN, DEF_INV_RWR_DOMAIN, &var_inv_rwr_domain, 1, 0,
+ VAR_REM_RWR_DOMAIN, DEF_REM_RWR_DOMAIN, &var_remote_rwr_domain, 0, 0,
0,
};
static CONFIG_BOOL_TABLE bool_table[] = {
projects / thirdparty / postfix.git / commitdiff
