From 5884ef624c410d77da2da28c012714b44dca114b Mon Sep 17 00:00:00 2001 From: Wietse Venema Date: Wed, 2 Jul 2003 00:00:00 -0500 Subject: [PATCH] postfix-2.0.13-20030702 --- postfix/.indent.pro | 2 + postfix/HISTORY | 122 +++++- postfix/README_FILES/LDAP_README | 42 +- postfix/README_FILES/SMTPD_PROXY_README | 81 ++++ postfix/README_FILES/VIRTUAL_README | 2 +- postfix/RELEASE_NOTES | 45 ++ postfix/conf/access | 70 ++-- postfix/conf/cidr_table | 77 ++++ postfix/conf/pcre_table | 104 ++--- postfix/conf/postfix-files | 4 + postfix/conf/postfix-script | 2 +- postfix/conf/regexp_table | 9 +- postfix/conf/sample-ldap.cf | 39 +- postfix/conf/sample-misc.cf | 12 + postfix/conf/sample-smtpd.cf | 35 ++ postfix/conf/sample-verify.cf | 50 ++- postfix/conf/tcp_table | 85 ++++ postfix/conf/transport | 153 ++++--- postfix/html/access.5.html | 70 ++-- postfix/html/cleanup.8.html | 30 +- postfix/html/faq.html | 16 +- postfix/html/pcre_table.5.html | 104 ++--- postfix/html/regexp_table.5.html | 9 +- postfix/html/rewrite.html | 4 +- postfix/html/smtp.8.html | 77 ++-- postfix/html/smtpd.8.html | 142 ++++--- postfix/html/transport.5.html | 153 ++++--- postfix/html/verify.8.html | 6 +- postfix/man/Makefile.in | 9 +- postfix/man/man5/access.5 | 6 +- postfix/man/man5/cidr_table.5 | 81 ++++ postfix/man/man5/pcre_table.5 | 19 +- postfix/man/man5/regexp_table.5 | 8 +- postfix/man/man5/tcp_table.5 | 96 +++++ postfix/man/man5/transport.5 | 15 + postfix/man/man8/cleanup.8 | 5 + postfix/man/man8/smtp.8 | 7 +- postfix/man/man8/smtpd.8 | 36 +- postfix/man/man8/verify.8 | 3 +- postfix/proto/Makefile.in | 8 +- postfix/proto/access | 6 +- postfix/proto/cidr_table | 68 +++ postfix/proto/pcre_table | 19 +- postfix/proto/regexp_table | 8 +- postfix/proto/tcp_table | 75 ++++ postfix/proto/transport | 15 + postfix/src/bounce/Makefile.in | 2 + postfix/src/bounce/bounce_notify_util.c | 41 +- postfix/src/bounce/bounce_service.h | 2 + postfix/src/cleanup/cleanup.c | 6 + postfix/src/cleanup/cleanup.h | 1 + postfix/src/cleanup/cleanup_init.c | 8 + postfix/src/cleanup/cleanup_out_recipient.c | 6 + postfix/src/global/Makefile.in | 19 +- postfix/src/global/cleanup_user.h | 1 + postfix/src/global/header_token.c | 13 +- postfix/src/global/log_adhoc.c | 4 +- postfix/src/global/mail_conf_int.c | 4 +- postfix/src/global/mail_conf_str.c | 4 +- postfix/src/global/mail_copy.c | 11 +- postfix/src/global/mail_params.h | 37 ++ postfix/src/global/mail_version.h | 4 +- postfix/src/global/resolve_clnt.c | 4 +- postfix/src/global/verify_clnt.h | 10 +- postfix/src/global/xtext.c | 145 +++++-- postfix/src/global/xtext.h | 12 +- postfix/src/nqmgr/qmgr_message.c | 2 +- postfix/src/postcat/postcat.c | 2 +- postfix/src/qmgr/qmgr_message.c | 2 +- postfix/src/showq/showq.c | 8 +- postfix/src/smtp/smtp.c | 9 +- postfix/src/smtp/smtp_proto.c | 6 +- postfix/src/smtpd/Makefile.in | 26 +- postfix/src/smtpd/smtpd.c | 291 ++++++++----- postfix/src/smtpd/smtpd.h | 2 + postfix/src/smtpd/smtpd_check.c | 39 +- postfix/src/smtpd/smtpd_proxy.c | 437 ++++++++++++++++++++ postfix/src/smtpd/smtpd_proxy.h | 42 ++ postfix/src/smtpd/smtpd_state.c | 4 + postfix/src/util/Makefile.in | 28 +- postfix/src/util/dict_cidr.c | 242 +++++++++++ postfix/src/util/dict_cidr.h | 43 ++ postfix/src/util/dict_cidr.in | 7 + postfix/src/util/dict_cidr.map | 9 + postfix/src/util/dict_cidr.ref | 13 + postfix/src/util/dict_ldap.c | 264 +++++++----- postfix/src/util/dict_open.c | 4 +- postfix/src/util/dict_pcre.c | 78 +++- postfix/src/util/dict_pcre.in | 4 + postfix/src/util/dict_pcre.map | 9 + postfix/src/util/dict_pcre.ref | 5 + postfix/src/util/dict_regexp.c | 10 +- postfix/src/util/dict_regexp.in | 4 + postfix/src/util/dict_regexp.map | 9 + postfix/src/util/dict_regexp.ref | 5 + postfix/src/util/dict_tcp.c | 61 +-- postfix/src/util/hex_quote.c | 5 +- postfix/src/util/match_ops.c | 2 +- postfix/src/util/safe_open.c | 12 +- postfix/src/util/valid_hostname.c | 2 +- postfix/src/verify/verify.c | 3 +- 101 files changed, 3223 insertions(+), 829 deletions(-) create mode 100644 postfix/README_FILES/SMTPD_PROXY_README create mode 100644 postfix/conf/cidr_table create mode 100644 postfix/conf/tcp_table create mode 100644 postfix/man/man5/cidr_table.5 create mode 100644 postfix/man/man5/tcp_table.5 create mode 100644 postfix/proto/cidr_table create mode 100644 postfix/proto/tcp_table create mode 100644 postfix/src/smtpd/smtpd_proxy.c create mode 100644 postfix/src/smtpd/smtpd_proxy.h create mode 100644 postfix/src/util/dict_cidr.c create mode 100644 postfix/src/util/dict_cidr.h create mode 100644 postfix/src/util/dict_cidr.in create mode 100644 postfix/src/util/dict_cidr.map create mode 100644 postfix/src/util/dict_cidr.ref diff --git a/postfix/.indent.pro b/postfix/.indent.pro index c662f44f5..2388a60ed 100644 --- a/postfix/.indent.pro +++ b/postfix/.indent.pro @@ -26,6 +26,8 @@ -TDELIVER_ATTR -TDELIVER_REQUEST -TDICT +-TDICT_CIDR +-TDICT_CIDR_ENTRY -TDICT_DB -TDICT_DBM -TDICT_DEBUG diff --git a/postfix/HISTORY b/postfix/HISTORY index 0984941cc..6f4122a0d 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -8189,8 +8189,8 @@ Apologies for any names omitted. of mail probes, so it will no longer block for in_flow_delay seconds when mail arrives faster than it is delivered. Still need to make mail_stream_finish() asynchronous in - order to avoid blocking for trigger_timeout seconds when - the queue manager is overwhelmed. Files: global/post_mail.c, + order to avoid blocking for trigger_timeout seconds when the + queue manager is overwhelmed. Files: global/post_mail.c, verify/verify.c. Bugfix: removed extraneous sleep() after the last attempt @@ -8201,6 +8201,42 @@ Apologies for any names omitted. Bugfix: the stricter postdrop input filter broke "sendmail -bs". Found by Lutz Jaenicke. File: smtpd/smtpd.c. +20030614 + + Portability: Dropped support for client side LDAP caching. + As of release 2.1.13 OpenLDAP no longer supports client + side caching, it has been deprecated for some time, and + never worked well. Implemented by Victor Duchovni, Morgan + Stanley, and further enhanced by Lamont Jones, HP. Files: + src/util/dict_ldap.c, conf/sample-ldap.cf, + README_FILES/LDAP_README. + + Safety: Given suitable invalid database contents, LDAP + lookups can produce too many results, enter an infinite + loop in the expansion of "special result attributes" (LDAP + DNs and LDAP URLs) or just consume excessive server resources + returning large result sets. Three new (per LDAP map) + configuration parameters enable one to set limits on + recursive nesting, result expansion and the server response + "entry" count. Implemented by Victor Duchovni, Morgan + Stanley, further enanced by Lamont Jones, HP. Files: + src/util/dict_ldap.c, conf/sample-ldap.cf, + README_FILES/LDAP_README. + +20030616 + + Feature: in mail delivery status reports, report the sender + address as X-Postfix-Sender. Matthias Andree. File: + bounce/bounce_notify_util.c. + + Cleanup: in mail delivery status reports, transform the + original recipient into xtext format as required by RFC + 1891. Files: bounce/bounce_notify_util.c, util/xtext.[hc]. + + Cleanup: more accurate "postfix check" warning for files + that miss one or more of the required mode 02111 execute + permission bits. Matthias Andree. File: conf/postfix-script. + 20030618 After "postfix reload", the master daemon now warns when @@ -8208,6 +8244,20 @@ Apologies for any names omitted. of passing incorrect information to the smtp server. File: master/master_ent.c. +20030619 + + Feature: the Postfix SMTP server can send all mail into a + proxy server, for example a real-time SPAM filter. This + proxy is supposed to send the mail into another Postfix + SMTP server process for normal delivery. Files: smtpd/smtpd.c + smtpd/smtpd_proxy.[hc]. + +20030620 + + Bugfix: a cut-and-paste error caused the proxy server's + 354 status code to be reported when a proxy connection + broke during the DATA phase. File: smtpd.c. + 20030620 Bugfix: after the last change to postdrop, postcat no longer @@ -8217,6 +8267,74 @@ Apologies for any names omitted. sendmail, "-t" broke multi-line recipient headers. Victor Duchovni, Morgan Stanley. File: sendmail/sendmail.c. +20030621 + + Workaround: the safe_open(O_CREAT) race condition exploit + avoiding code tries a little harder when it encounters a + race condition. File: util/safe_open.c. + +20030623 + + Non-prod operator precedence bug with detecting end of + DATA. Matthias Andree. File: smtpd/smtpd.c. + +20030624 + + Bugfix: reject_unverified_address() set the defer_if_reject + flag when the verify service was unavailable (which never + happens). Victor Duchovni, Morgan Stanley. File: + smtpd/smtpd_check.c. + + New parameters address_verify_poll_{count,delay} that + control how often to poll the address verification service + for the completion of an address verification request. + Specify address_verify_poll_count=1 to implement a crude + form of greylisting, that is, always defer the first delivery + attempt for an unknown address. File: smtpd/smtpd_check.c. + + Bugfix: after the last change to postdrop, postcat no longer + recognized non-maildrop queue files as valid. File: + postcat/postcat.c. + +20030629 + + Cleanup: replaced references to "simulated virtual domains" + by "virtual alias domains". Victor Duchovni, Morgan Stanley. + +20030630 + + Feature: smtp_quote_rfc821_envelope=(yes|no) to control + RFC 821 style quoting of MAIL FROM and RCPT TO addresses. + Files: global/mail_params.h, smtp/smtp.c, smtp/smtp_proto.c. + +20030701 + + Bugfix: multi-recipient probes triggered a bug in the SMTP + client. File: smtp/smtp_proto.c. + + Feature: enable_original_recipient (default: yes) to control + whether Postfix keeps track of original recipient address + information. Victor Duchovni, Morgan Stanley. Files: + cleanup/cleanup.c, cleanup/cleanup_init.c, + cleanup/cleanup_out_recipient.c, global/log_adhoc.c, + global/mail_copy.c, *qmgr/qmgr_message.c. + + Feature: !/pattern/ support for PCRE lookup tables. Victor + Duchovni, Morgan Stanley. Files: util/dict_pcre.c. + + Cleanup: allow whitespace after patterns in repexp and pcre + tables. Victor Duchovni, Morgan Stanley. Files: + util/dict_pcre.c, util/dict_regexp.c. + +20030702 + + Feature: CIDR lookup table support, very remotely based on + code by Jozsef Kadlecsik. Files: proto/cidr_table, + util/dict_cidr.[hc]. + + Feature: TCP lookup table support, finally finished. Files: + proto/tcp_table, proto/dict_tcp.[hc]. + Open problems: Low: smtp-source may block when sending large test messages. diff --git a/postfix/README_FILES/LDAP_README b/postfix/README_FILES/LDAP_README index 02c152b3c..abf8fd5d9 100644 --- a/postfix/README_FILES/LDAP_README +++ b/postfix/README_FILES/LDAP_README @@ -154,21 +154,41 @@ parameter below, "server_host", would be defined in main.cf as the Postfix user. Example: ldapsource_bind_pw = postfixpw - cache (no) - Whether to use a client-side cache for the LDAP connection. See - ldap_enable_cache(3). It's off by default. + cache (IGNORED with a warning) + cache_expiry (IGNORED with a warning) + cache_size (IGNORED with a warning) + The above parameters are NO LONGER SUPPORTED by Postfix. + Cache support has been dropped from OpenLDAP as of release 2.1.13. - cache_expiry (30 seconds) - If the client-side cache is enabled, cached results will expire - after this many seconds. + recursion_limit (1000) + A limit on the nesting depth of DN and URL special result + attribute evaluation. The limit must be a non-zero positive + number. - cache_size (32768 bytes) - If the client-side cache is enabled, this is its size in bytes. + expansion_limit (0) + A limit on the total number of result elements returned (as a + comma separated list) by a lookup against the map. A setting of + zero disables the limit. Lookups fail with a temporary error + if the limit is exceeded. Setting the limit to 1 ensures that + lookups do not return multiple values. + + size_limit ($expansion_limit) + A limit on the number of LDAP entries returned by any single LDAP + query performed as part of the lookup. A setting of 0 disables + the limit. Expansion of DN and URL references involves nested + LDAP queries, each of which is separately subjected to this + limit. + + Note: even a single LDAP entry can generate multiple lookup + results, via multiple result attributes and/or multi-valued + result attributes. This limit caps the per query resource + utilization on the LDAP server, not the final multiplicity of the + lookup result. It is analogous to the "-z" option of "ldapsearch". dereference (0) - When to dereference LDAP aliases. (Note that this has nothing - do with Postfix aliases.) The permitted values are those - legal for the OpenLDAP/UM LDAP implementations: + When to dereference LDAP aliases. (Note that this has nothing + do with Postfix aliases.) The permitted values are those legal + for the OpenLDAP/UM LDAP implementations: 0 never 1 when searching diff --git a/postfix/README_FILES/SMTPD_PROXY_README b/postfix/README_FILES/SMTPD_PROXY_README new file mode 100644 index 000000000..28e1e9eb5 --- /dev/null +++ b/postfix/README_FILES/SMTPD_PROXY_README @@ -0,0 +1,81 @@ +Purpose of the SMTPD pass-through proxy feature +=============================================== + +The Postfix SMTP server can be configured to forward all mail to +a proxy server, for example, a real-time SPAM filter. The proxy is +supposed to send the mail into another Postfix SMTP server process +for normal delivery. + +The proxy server receives only the commands that the Postfix SMTP +server has approved. The proxy server should accept the same MAIL +FROM and RCPT TO command syntax as Postfix, but does not need to +support ESMTP command pipelining. + +This feature is meant to be used as follows: + + Internet -> smtpd -> proxy -> smtpd -> cleanup -> queue + Postfix Postfix Postfix Postfix + +Limitations +=========== + +When used with a real-time SPAM filter, this approach allows Postfix +to reject mail before the SMTP mail transfer completes, so that +Postfix does not have to send rejected mail back to the sender. +Mail that is not accepted remains the responsibility of the client. + +In all other respects this content filtering approach is inferior +to the existing content filter (see FILTER_README) which processes +mail AFTER it is queued, because that gives you full control over +how many filtering processes can be run in parallel. + +The problem with real-time content filtering is that the remote +SMTP client expects an SMTP reply within a deadline. As the system +load increases, fewer and fewer CPU cycles remain available to +answer within the deadline, and eventually you either have to stop +accepting mail or you have to accept unfiltered mail. + +A possible workaround is to have the proxy take special action when +the deadline is reached: add a distinctive message header that +triggers a Postfix header_checks FILTER action, or send the mail +into Postfix via an alternative Postfix SMTP server that always +turns on content filtering. + +Configuration parameters +======================== + +Parameters that control proxying: + +smtpd_proxy_filter (syntax: host:port) + + The host and TCP port of the SMTP proxy server. When no host + or host: is specified, localhost is assumed. + +smtpd_proxy_timeout (default: 100s) + + Timeout for connecting to the SMTP proxy server and for sending + and receiving data. All proxy errors are logged to the maillog + file, but the client sees "451 Error: queue file write error". + +smtpd_proxy_ehlo (default: $myhostname) + + The hostname to use when sending an EHLO command to the SMTP + proxy server. + +Testing the SMTP pass-through proxy feature +=========================================== + +The following example sets up a null proxy, that is, the Postfix +SMTP server gives the mail directly to another Postfix SMTP server +process. + +/etc/postfix/master.cf + smtp inet n - n - - smtpd + -o smtpd_proxy_filter=26 + 26 inet n - n - - smtpd + +The result is as follows: + + Internet -> smtpd on port 25 -> smtpd on port 26 -> cleanup -> queue + +This configuration is sufficient for stress testing. diff --git a/postfix/README_FILES/VIRTUAL_README b/postfix/README_FILES/VIRTUAL_README index 3a4220e12..44f2e1407 100644 --- a/postfix/README_FILES/VIRTUAL_README +++ b/postfix/README_FILES/VIRTUAL_README @@ -8,7 +8,7 @@ Purpose of this software You can use the virtual delivery agent for mailbox delivery of some or all domains that are handled by a machine. -This mechanism is different from simulated virtual domains. Those +This mechanism is different from virtual alias domains. Those are implemented by translating every recipient address into a different address. For that, see the virtual(5) manual page. diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 5dcc56686..0221d767d 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -22,6 +22,51 @@ snapshot release). Patches change the patchlevel and the release date. Snapshots change only the release date, unless they include the same bugfixes as a patch release. +Incompatible changes with Postfix snapshot 2.0.13-20030702 +========================================================== + +Support for client side LDAP caching is gone. OpenLDAP 2.1.13 and +later no longer support it, and the feature never worked well. +Postfix now ignores cache controlling parameters in an LDAP +configuration file and logs a warning. Credits to Victor Duchovni +and Lamont Jones. + +Major changes with Postfix snapshot 2.0.13-20030702 +=================================================== + +The Postfix SMTP server can be configured to send all mail into a +proxy server, for example a real-time SPAM filter. This proxy is +expected to send the mail into another Postfix SMTP server process +for normal delivery. See the SMTPD_PROXY_README file for details. + +Improved LDAP client robustness. Given suitable invalid database +contents, LDAP lookups can produce too many results, enter an +infinite loop in the expansion of "special result attributes" (LDAP +DNs and LDAP URLs) or can simply consume excessive server resources. +Credits to Victor Duchovni and Lamont Jones. + +New CIDR-based lookup table, remotely based on code by Jozsef +Kadlecsik. For details and examples, see "man cidr_table". + +The TCP-based client-server table lookup protocol is finished. +For details and examples, see "man tcp_table". This will allow you +to implement your own greylisting. + +Support for !/pattern/ (negative matches) in PCRE lookup tables by +Victor Duchovni. See "man pcre_table" for more. + +New enable_original_recipient parameter (default: yes) to control +whether Postfix keeps track of original recipient address information. +If this is turned off Postfix produces no X-Original-To: headers +and ignores the original recipient when eliminating duplicates +after virtual alias expansion. Code by Victor Duchovni. + +Finer control over how long the SMTP server waits for address +verification probes to complete. address_verify_poll_{count,delay} +control how often to query the verify server and how long to wait +between queries. Specify address_verify_poll_count=1 to implement +a crude form of greylisting. + Major changes with Postfix snapshot 2.0.11-20030611 =================================================== diff --git a/postfix/conf/access b/postfix/conf/access index 1f4b38ba7..baacf9c42 100644 --- a/postfix/conf/access +++ b/postfix/conf/access @@ -108,72 +108,75 @@ # A network address is a sequence of one or more # octets separated by ".". # +# NOTE: use the cidr lookup table type if you want to +# specify arbitrary network blocks. +# # ACTIONS # [45]NN text -# Reject the address etc. that matches the pattern, +# Reject the address etc. that matches the pattern, # and respond with the numerical code and text. # # REJECT # # REJECT optional text... -# Reject the address etc. that matches the pattern. -# Reply with $reject_code optional text... when the -# optional text is specified, otherwise reply with a +# Reject the address etc. that matches the pattern. +# Reply with $reject_code optional text... when the +# optional text is specified, otherwise reply with a # generic error response message. # # OK Accept the address etc. that matches the pattern. # # all-numerical # An all-numerical result is treated as OK. This for- -# mat is generated by address-based relay authoriza- +# mat is generated by address-based relay authoriza- # tion schemes. # -# DUNNO Pretend that the lookup key was not found in this +# DUNNO Pretend that the lookup key was not found in this # table. This prevents Postfix from trying substrings -# of the lookup key (such as a subdomain name, or a +# of the lookup key (such as a subdomain name, or a # network address subnetwork). # # HOLD # # HOLD optional text... -# Place the message on the hold queue, where it will -# sit until someone either deletes it or releases it -# for delivery. Log the optional text if specified, +# Place the message on the hold queue, where it will +# sit until someone either deletes it or releases it +# for delivery. Log the optional text if specified, # otherwise log a generic message. # -# Mail that is placed on hold can be examined with -# the postcat(1) command, and can be destroyed or +# Mail that is placed on hold can be examined with +# the postcat(1) command, and can be destroyed or # released with the postsuper(1) command. # -# Note: this action currently affects all recipients +# Note: this action currently affects all recipients # of the message. # # DISCARD # # DISCARD optional text... -# Claim successful delivery and silently discard the -# message. Log the optional text if specified, oth- +# Claim successful delivery and silently discard the +# message. Log the optional text if specified, oth- # erwise log a generic message. # -# Note: this action currently affects all recipients +# Note: this action currently affects all recipients # of the message. # # FILTER transport:destination -# After the message is queued, send the entire mes- -# sage through a content filter. More information +# After the message is queued, send the entire mes- +# sage through a content filter. More information # about content filters is in the Postfix FIL- # TER_README file. # -# Note: this action overrides the main.cf con- +# Note: this action overrides the main.cf con- # tent_filter setting, and currently affects all # recipients of the message. # # REDIRECT user@domain -# After the message is queued, send the message to +# After the message is queued, send the message to # the specified address instead of the intended # recipient(s). # -# Note: this action overrides the FILTER action, and +# Note: this action overrides the FILTER action, and # currently affects all recipients of the message. # # restriction... @@ -181,39 +184,40 @@ # reject_unauth_destination, and so on). # # REGULAR EXPRESSION TABLES -# This section describes how the table lookups change when +# This section describes how the table lookups change when # the table is given in the form of regular expressions. For -# a description of regular expression lookup table syntax, +# a description of regular expression lookup table syntax, # see regexp_table(5) or pcre_table(5). # -# Each pattern is a regular expression that is applied to +# Each pattern is a regular expression that is applied to # the entire string being looked up. Depending on the appli- -# cation, that string is an entire client hostname, an +# cation, that string is an entire client hostname, an # entire client IP address, or an entire mail address. Thus, # no parent domain or parent network search is done, -# user@domain mail addresses are not broken up into their +# user@domain mail addresses are not broken up into their # user@ and domain constituent parts, nor is user+foo broken # up into user and foo. # -# Patterns are applied in the order as specified in the -# table, until a pattern is found that matches the search +# Patterns are applied in the order as specified in the +# table, until a pattern is found that matches the search # string. # -# Actions are the same as with indexed file lookups, with -# the additional feature that parenthesized substrings from +# Actions are the same as with indexed file lookups, with +# the additional feature that parenthesized substrings from # the pattern can be interpolated as $1, $2 and so on. # # BUGS -# The table format does not understand quoting conventions. +# The table format does not understand quoting conventions. # # SEE ALSO -# postmap(1) create mapping table +# postmap(1) create lookup table # smtpd(8) smtp server +# cidr_table(5) format of CIDR tables # pcre_table(5) format of PCRE tables # regexp_table(5) format of POSIX regular expression tables # # LICENSE -# The Secure Mailer license must be distributed with this +# The Secure Mailer license must be distributed with this # software. # # AUTHOR(S) diff --git a/postfix/conf/cidr_table b/postfix/conf/cidr_table new file mode 100644 index 000000000..76b27d484 --- /dev/null +++ b/postfix/conf/cidr_table @@ -0,0 +1,77 @@ +# CIDR_TABLE(5) CIDR_TABLE(5) +# +# NAME +# cidr_table - format of Postfix CIDR tables +# +# SYNOPSIS +# postmap -q "string" cidr:/etc/postfix/filename +# +# postmap -q - cidr:/etc/postfix/filename cidr lookup table type if you want to + specify arbitrary network blocks. + ACTIONS [45]NN text - Reject the address etc. that matches the pattern, + Reject the address etc. that matches the pattern, and respond with the numerical code and text. REJECT REJECT optional text... - Reject the address etc. that matches the pattern. - Reply with $reject_code optional text... when the - optional text is specified, otherwise reply with a + Reject the address etc. that matches the pattern. + Reply with $reject_code optional text... when the + optional text is specified, otherwise reply with a generic error response message. OK Accept the address etc. that matches the pattern. all-numerical An all-numerical result is treated as OK. This for- - mat is generated by address-based relay authoriza- + mat is generated by address-based relay authoriza- tion schemes. - DUNNO Pretend that the lookup key was not found in this + DUNNO Pretend that the lookup key was not found in this table. This prevents Postfix from trying substrings - of the lookup key (such as a subdomain name, or a + of the lookup key (such as a subdomain name, or a network address subnetwork). HOLD HOLD optional text... - Place the message on the hold queue, where it will - sit until someone either deletes it or releases it - for delivery. Log the optional text if specified, + Place the message on the hold queue, where it will + sit until someone either deletes it or releases it + for delivery. Log the optional text if specified, otherwise log a generic message. - Mail that is placed on hold can be examined with - the postcat(1) command, and can be destroyed or + Mail that is placed on hold can be examined with + the postcat(1) command, and can be destroyed or released with the postsuper(1) command. - Note: this action currently affects all recipients + Note: this action currently affects all recipients of the message. DISCARD DISCARD optional text... - Claim successful delivery and silently discard the - message. Log the optional text if specified, oth- + Claim successful delivery and silently discard the + message. Log the optional text if specified, oth- erwise log a generic message. - Note: this action currently affects all recipients + Note: this action currently affects all recipients of the message. FILTER transport:destination - After the message is queued, send the entire mes- - sage through a content filter. More information + After the message is queued, send the entire mes- + sage through a content filter. More information about content filters is in the Postfix FIL- TER_README file. - Note: this action overrides the main.cf con- + Note: this action overrides the main.cf con- tent_filter setting, and currently affects all recipients of the message. REDIRECT user@domain - After the message is queued, send the message to + After the message is queued, send the message to the specified address instead of the intended recipient(s). - Note: this action overrides the FILTER action, and + Note: this action overrides the FILTER action, and currently affects all recipients of the message. restriction... @@ -182,39 +185,40 @@ ACCESS(5) ACCESS(5) reject_unauth_destination, and so on). REGULAR EXPRESSION TABLES - This section describes how the table lookups change when + This section describes how the table lookups change when the table is given in the form of regular expressions. For - a description of regular expression lookup table syntax, + a description of regular expression lookup table syntax, see regexp_table(5) or pcre_table(5). - Each pattern is a regular expression that is applied to + Each pattern is a regular expression that is applied to the entire string being looked up. Depending on the appli- - cation, that string is an entire client hostname, an + cation, that string is an entire client hostname, an entire client IP address, or an entire mail address. Thus, no parent domain or parent network search is done, - user@domain mail addresses are not broken up into their + user@domain mail addresses are not broken up into their user@ and domain constituent parts, nor is user+foo broken up into user and foo. - Patterns are applied in the order as specified in the - table, until a pattern is found that matches the search + Patterns are applied in the order as specified in the + table, until a pattern is found that matches the search string. - Actions are the same as with indexed file lookups, with - the additional feature that parenthesized substrings from + Actions are the same as with indexed file lookups, with + the additional feature that parenthesized substrings from the pattern can be interpolated as $1, $2 and so on. BUGS - The table format does not understand quoting conventions. + The table format does not understand quoting conventions. SEE ALSO - postmap(1) create mapping table + postmap(1) create lookup table smtpd(8) smtp server + cidr_table(5) format of CIDR tables pcre_table(5) format of PCRE tables regexp_table(5) format of POSIX regular expression tables LICENSE - The Secure Mailer license must be distributed with this + The Secure Mailer license must be distributed with this software. AUTHOR(S) diff --git a/postfix/html/cleanup.8.html b/postfix/html/cleanup.8.html index d6a5eecda..50266a5a4 100644 --- a/postfix/html/cleanup.8.html +++ b/postfix/html/cleanup.8.html @@ -171,6 +171,14 @@ CLEANUP(8) CLEANUP(8) Address mapping lookup table for sender and recipi- ent addresses in envelopes and headers. + enable_original_recipient + Enable support for the X-Original-To message + header, which is needed for multi-recipient mail- + boxes. When this is enabled, Postfix performs + duplicate elimination on (original recipient, + rewritten recipient) pairs, instead of looking at + the rewritten recipient only. + recipient_canonical_maps Address mapping lookup table for envelope and header recipient addresses. @@ -180,16 +188,16 @@ CLEANUP(8) CLEANUP(8) header sender addresses. masquerade_classes - List of address classes subject to masquerading: - zero or more of envelope_sender, envelope_recipi- + List of address classes subject to masquerading: + zero or more of envelope_sender, envelope_recipi- ent, header_sender, header_recipient. masquerade_domains - List of domains that hide their subdomain struc- + List of domains that hide their subdomain struc- ture. masquerade_exceptions - List of user names that are not subject to address + List of user names that are not subject to address masquerading. virtual_alias_maps @@ -198,7 +206,7 @@ CLEANUP(8) CLEANUP(8) Resource controls duplicate_filter_limit - Limits the number of envelope recipients that are + Limits the number of envelope recipients that are remembered. header_address_token_limit @@ -206,21 +214,21 @@ CLEANUP(8) CLEANUP(8) a message header. header_size_limit - Limits the amount of memory in bytes used to pro- + Limits the amount of memory in bytes used to pro- cess a message header. in_flow_delay Amount of time to pause before accepting a message, - when the message arrival rate exceeds the message + when the message arrival rate exceeds the message delivery rate. virtual_alias_expansion_limit - Limit the number of actual recipients produced by - virtual alias expansion from each original recipi- + Limit the number of actual recipients produced by + virtual alias expansion from each original recipi- ent. virtual_alias_recursion_limit - Limit the recursion depth of virtual alias expan- + Limit the recursion depth of virtual alias expan- sion. SEE ALSO @@ -235,7 +243,7 @@ CLEANUP(8) CLEANUP(8) /etc/postfix/virtual*, virtual mapping table LICENSE - The Secure Mailer license must be distributed with this + The Secure Mailer license must be distributed with this software. AUTHOR(S) diff --git a/postfix/html/faq.html b/postfix/html/faq.html index dba261f2a..3a81f15ce 100644 --- a/postfix/html/faq.html +++ b/postfix/html/faq.html @@ -2618,8 +2618,9 @@ the virtual_mailbox_maps parameter.

-If you want to deliver the domain as a Postfix simulated virtual(5) domain, then you should list +If you want to deliver the domain as a +virtual(5) alias domain, where each address is aliased to +a real local or remote address, then you should list the virtual domain name in the tables specified with the virtual_alias_domains parameter instead. @@ -2638,7 +2639,7 @@ Solutions: