From: Wietse Venema Date: Sun, 24 Nov 2002 05:00:00 +0000 (-0500) Subject: postfix-1.1.12-20021124 X-Git-Tag: v2.0.0~14 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8c3109103bbdedf354be511e3ba6ce41870c4db1;p=thirdparty%2Fpostfix.git postfix-1.1.12-20021124 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index 979fb9a8c..d9edf263a 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -7226,6 +7226,15 @@ Apologies for any names omitted. code had grown into a monster and needed to be replaced. trivial-rewrite/transport.c. +20021121 + + Bugfix: garbage in "user@garbage"@domain address forms may + cause the SMTP or LMTP client to terminate with a fatal + error exit because garbage/tcp is not an existing service. + This cannot be abused to cause the SMTP or LMTP client to + send data into unauthorized ports. Files: *qmgr/qmgr_message.c, + trivial-rewrite/resolve.c. + Open problems: Low: revise other local delivery agent duplicate filters. diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index 82934d696..042980ca8 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,10 +20,10 @@ * Patches change the patchlevel and the release date. Snapshots change the * release date only, unless they include the same bugfix as a patch release. */ -#define MAIL_RELEASE_DATE "20021115" +#define MAIL_RELEASE_DATE "20021124" #define VAR_MAIL_VERSION "mail_version" -#define DEF_MAIL_VERSION "1.1.11-" MAIL_RELEASE_DATE +#define DEF_MAIL_VERSION "1.1.12-" MAIL_RELEASE_DATE extern char *var_mail_version; /* diff --git a/postfix/src/global/resolve_clnt.c b/postfix/src/global/resolve_clnt.c index c8e6ccca9..75c29ba90 100644 --- a/postfix/src/global/resolve_clnt.c +++ b/postfix/src/global/resolve_clnt.c @@ -48,6 +48,8 @@ /* After address resolution the recipient localpart contains further /* routing information, so the resolved next-hop destination is not /* the final destination. +/* .IP RESOLVE_FLAG_ERROR +/* The address resolved to something that has invalid syntax. /* DIAGNOSTICS /* Warnings: communication failure. Fatal error: mail system is down. /* SEE ALSO diff --git a/postfix/src/global/resolve_clnt.h b/postfix/src/global/resolve_clnt.h index af55d1f4e..80e9aa990 100644 --- a/postfix/src/global/resolve_clnt.h +++ b/postfix/src/global/resolve_clnt.h @@ -23,6 +23,7 @@ #define RESOLVE_FLAG_FINAL (1<<0) /* final delivery */ #define RESOLVE_FLAG_ROUTED (1<<1) /* routed destination */ +#define RESOLVE_FLAG_ERROR (1<<2) /* bad destination */ typedef struct RESOLVE_REPLY { VSTRING *transport; diff --git a/postfix/src/nqmgr/qmgr_message.c b/postfix/src/nqmgr/qmgr_message.c index 609a8b514..ff2c9205f 100644 --- a/postfix/src/nqmgr/qmgr_message.c +++ b/postfix/src/nqmgr/qmgr_message.c @@ -664,8 +664,20 @@ static void qmgr_message_resolve(QMGR_MESSAGE *message) */ if (var_sender_routing == 0) { resolve_clnt_query(recipient->address, &reply); + if (reply.flags & RESOLVE_FLAG_ERROR) { + qmgr_bounce_recipient(message, recipient, + "bad address syntax: \"%s\"", + recipient->address); + continue; + } } else { resolve_clnt_query(message->sender, &reply); + if (reply.flags & RESOLVE_FLAG_ERROR) { + qmgr_bounce_recipient(message, recipient, + "bad address syntax: \"%s\"", + message->sender); + continue; + } vstring_strcpy(reply.recipient, recipient->address); } if (message->filter_xport) { diff --git a/postfix/src/postalias/Makefile.in b/postfix/src/postalias/Makefile.in index 5fd242744..465ba2c38 100644 --- a/postfix/src/postalias/Makefile.in +++ b/postfix/src/postalias/Makefile.in @@ -90,7 +90,6 @@ postalias.o: ../../include/msg_vstream.h postalias.o: ../../include/readlline.h postalias.o: ../../include/stringops.h postalias.o: ../../include/split_at.h -postalias.o: ../../include/get_hostname.h postalias.o: ../../include/vstring_vstream.h postalias.o: ../../include/set_eugid.h postalias.o: ../../include/tok822.h diff --git a/postfix/src/qmgr/qmgr_message.c b/postfix/src/qmgr/qmgr_message.c index 215895054..76a797e83 100644 --- a/postfix/src/qmgr/qmgr_message.c +++ b/postfix/src/qmgr/qmgr_message.c @@ -544,8 +544,20 @@ static void qmgr_message_resolve(QMGR_MESSAGE *message) */ if (var_sender_routing == 0) { resolve_clnt_query(recipient->address, &reply); + if (reply.flags & RESOLVE_FLAG_ERROR) { + qmgr_bounce_recipient(message, recipient, + "bad address syntax: \"%s\"", + recipient->address); + continue; + } } else { resolve_clnt_query(message->sender, &reply); + if (reply.flags & RESOLVE_FLAG_ERROR) { + qmgr_bounce_recipient(message, recipient, + "bad address syntax: \"%s\"", + message->sender); + continue; + } vstring_strcpy(reply.recipient, recipient->address); } if (message->filter_xport) { diff --git a/postfix/src/trivial-rewrite/Makefile.in b/postfix/src/trivial-rewrite/Makefile.in index 01e2166c8..f41bfa562 100644 --- a/postfix/src/trivial-rewrite/Makefile.in +++ b/postfix/src/trivial-rewrite/Makefile.in @@ -69,6 +69,7 @@ resolve.o: ../../include/vbuf.h resolve.o: ../../include/vstream.h resolve.o: ../../include/vstring_vstream.h resolve.o: ../../include/split_at.h +resolve.o: ../../include/valid_hostname.h resolve.o: ../../include/mail_params.h resolve.o: ../../include/mail_proto.h resolve.o: ../../include/iostuff.h diff --git a/postfix/src/trivial-rewrite/resolve.c b/postfix/src/trivial-rewrite/resolve.c index b53d56563..fd47abf5b 100644 --- a/postfix/src/trivial-rewrite/resolve.c +++ b/postfix/src/trivial-rewrite/resolve.c @@ -61,6 +61,7 @@ #include #include #include +#include /* Global library. */ @@ -220,8 +221,12 @@ void resolve_addr(char *addr, VSTRING *channel, VSTRING *nexthop, vstring_strcpy(nexthop, destination); else if (*var_relayhost) vstring_strcpy(nexthop, var_relayhost); - else + else { tok822_internalize(nexthop, domain->next, TOK822_STR_DEFL); + if (STR(nexthop)[strspn(STR(nexthop), "[]0123456789.")] != 0 + && valid_hostname(STR(nexthop), DONT_GRIPE) == 0) + *flags |= RESOLVE_FLAG_ERROR; + } if (*STR(channel) == 0) msg_fatal("null transport is not allowed: %s = %s", VAR_DEF_TRANSPORT, var_def_transport);