postfix-2.12-20141119

postfix/HISTORY

@@ -20778,3 +20778,24 @@ Apologies for any names omitted.
 	Cleanup: use more meaningful name for global variable so
 	that it isn't shadowed by a local variable. Based on
 	complaints from the BEAM static analyzer. smtpstone/smtp-sink.c.
+
+20141119
+
+	Cleanup: base64 test driver. File: base64_code.c.
+
+	Cleanup: make the CONST_CHAR_STAR typedef project-wide.
+	Files: global/attr_override.h, util/sys_defs.h.
+
+	Feature: BCC action in header/body_checks and milter_header_checks.
+	Files: proto/header_checks, cleanup/cleanup.h,
+	cleanup/cleanup_extracted.c, cleanup/cleanup_message.c,
+	cleanup/cleanup_milter.c, cleanup/cleanup_milter.in16a,
+	cleanup/cleanup_milter.ref16a1, cleanup/cleanup_milter.ref16a2,
+	cleanup/cleanup_milter.reg16a, cleanup/cleanup_state.c,
+	cleanup/test-queue-file16, global/attr_override.h,
+	global/cleanup_strflags.c, global/cleanup_user.h,
+	util/sys_defs.h.
+
+	Cleanup: don't write back-to-back queue file pointer records
+	when the "add recipient" action was a NOOP (e.g., because
+	the recipient was a duplicate). File: cleanup/cleanup_milter.c.

postfix/WISHLIST

@@ -8,6 +8,8 @@ Wish list:
 
 	Things to do after the stable release:
 
+	Make the access map BCC action consistent with header_checks.
+
 	Find a way to show non-default OPT, DEBUG etc. settings at
 	the top of the makedefs.out file.
 

postfix/conf/header_checks

@@ -175,6 +175,27 @@
 #        Action names are case insensitive. They are shown in upper
 #        case for consistency with other Postfix documentation.
 # 
+#        BCC user@domain
+#               Add the specified address as a BCC  recipient.  The
+#               address must have a local part and domain part. The
+#               number of BCC addresses that can be added  is  lim-
+#               ited only by the amount of available storage space.
+# 
+#               Note 1: the BCC address is added as if it was spec-
+#               ified  with  NOTIFY=NONE.  The  sender  will not be
+#               notified when the BCC address is undeliverable,  as
+#               long  as  all  down-stream  software implements RFC
+#               3461.
+# 
+#               Note 2: this ignores duplicate addresses (with  the
+#               same delivery status notification options).
+# 
+#               This  feature  is  available  in  Postfix  2.12 and
+#               later.
+# 
+#               This feature is not supported with smtp header/body
+#               checks.
+# 
 #        DISCARD optional text...
 #               Claim  successful delivery and silently discard the
 #               message.  Log the optional text if specified,  oth-

postfix/html/header_checks.5.html

@@ -164,6 +164,24 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
        Action  names  are  case  insensitive. They are shown in upper case for
        consistency with other Postfix documentation.
 
+       <b>BCC</b> <i>user@domain</i>
+              Add the specified address as a BCC recipient. The  address  must
+              have  a  local part and domain part. The number of BCC addresses
+              that can be added is limited only by  the  amount  of  available
+              storage space.
+
+              Note  1:  the  BCC  address is added as if it was specified with
+              NOTIFY=NONE. The sender  will  not  be  notified  when  the  BCC
+              address  is  undeliverable,  as long as all down-stream software
+              implements <a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a>.
+
+              Note 2: this ignores duplicate addresses (with the same delivery
+              status notification options).
+
+              This feature is available in Postfix 2.12 and later.
+
+              This feature is not supported with smtp header/body checks.
+
        <b>DISCARD</b> <i>optional text...</i>
               Claim successful delivery and silently discard the message.  Log
               the optional text if specified, otherwise log a generic message.

postfix/man/man5/header_checks.5

@@ -184,6 +184,23 @@ available for negated patterns.
 .fi
 Action names are case insensitive. They are shown in upper case
 for consistency with other Postfix documentation.
+.IP "\fBBCC \fIuser@domain\fR"
+Add the specified address as a BCC recipient. The address
+must have a local part and domain part. The number of BCC
+addresses that can be added is limited only by the amount
+of available storage space.
+
+Note 1: the BCC address is added as if it was specified with
+NOTIFY=NONE. The sender will not be notified when the BCC
+address is undeliverable, as long as all down-stream software
+implements RFC 3461.
+
+Note 2: this ignores duplicate addresses (with the same
+delivery status notification options).
+.sp
+This feature is available in Postfix 2.12 and later.
+.sp
+This feature is not supported with smtp header/body checks.
 .IP "\fBDISCARD \fIoptional text...\fR"
 Claim successful delivery and silently discard the message.
 Log the optional text if specified, otherwise log a generic

postfix/proto/header_checks

@@ -162,6 +162,23 @@
 # .fi
 #	Action names are case insensitive. They are shown in upper case
 #	for consistency with other Postfix documentation.
+# .IP "\fBBCC \fIuser@domain\fR"
+#	Add the specified address as a BCC recipient. The address
+#	must have a local part and domain part. The number of BCC
+#	addresses that can be added is limited only by the amount
+#	of available storage space.
+#
+#	Note 1: the BCC address is added as if it was specified with
+#	NOTIFY=NONE. The sender will not be notified when the BCC
+#	address is undeliverable, as long as all down-stream software
+#	implements RFC 3461.
+#
+#	Note 2: this ignores duplicate addresses (with the same
+#	delivery status notification options).
+# .sp
+#	This feature is available in Postfix 2.12 and later.
+# .sp
+#	This feature is not supported with smtp header/body checks.
 # \" .IP "\fBDELAY \fItime\fR"
 # \"	Place the message into the deferred queue, and delay the
 # \"	initial delivery attempt by \fItime\fR. The time value may

postfix/src/cleanup/Makefile.in

@@ -84,7 +84,8 @@ milter_tests: cleanup_milter_test bug_tests \
 	cleanup_milter_test14g \
 	cleanup_milter_test15a cleanup_milter_test15b cleanup_milter_test15c \
 	cleanup_milter_test15d cleanup_milter_test15e cleanup_milter_test15f \
-	cleanup_milter_test15g cleanup_milter_test15h cleanup_milter_test15i
+	cleanup_milter_test15g cleanup_milter_test15h cleanup_milter_test15i \
+	cleanup_milter_test16a cleanup_milter_test16b
 
 root_tests:
 
@@ -355,7 +356,8 @@ cleanup_milter_test13d: cleanup_milter test-queue-file13d cleanup_milter.in13d \
 	rm -f test-queue-file13d.tmp cleanup_milter.tmp
 
 cleanup_milter_test14a: cleanup_milter test-queue-file14 cleanup_milter.in14a \
-	cleanup_milter.ref14a1 ../postcat/postcat cleanup_milter.ref14a2
+	cleanup_milter.ref14a1 ../postcat/postcat cleanup_milter.ref14a2 \
+	cleanup_milter.reg14a
 	cp test-queue-file14 test-queue-file14a.tmp
 	chmod u+w test-queue-file14a.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14a 2>cleanup_milter.tmp1
@@ -365,7 +367,8 @@ cleanup_milter_test14a: cleanup_milter test-queue-file14 cleanup_milter.in14a \
 	rm -f test-queue-file14a.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test14b: cleanup_milter test-queue-file14 cleanup_milter.in14b \
-	cleanup_milter.ref14b1 ../postcat/postcat cleanup_milter.ref14b2
+	cleanup_milter.ref14b1 ../postcat/postcat cleanup_milter.ref14b2 \
+	cleanup_milter.reg14b
 	cp test-queue-file14 test-queue-file14b.tmp
 	chmod u+w test-queue-file14b.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14b 2>cleanup_milter.tmp1
@@ -375,7 +378,8 @@ cleanup_milter_test14b: cleanup_milter test-queue-file14 cleanup_milter.in14b \
 	rm -f test-queue-file14b.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test14c: cleanup_milter test-queue-file14 cleanup_milter.in14c \
-	cleanup_milter.ref14c1 ../postcat/postcat cleanup_milter.ref14c2
+	cleanup_milter.ref14c1 ../postcat/postcat cleanup_milter.ref14c2 \
+	cleanup_milter.reg14c
 	cp test-queue-file14 test-queue-file14c.tmp
 	chmod u+w test-queue-file14c.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14c 2>cleanup_milter.tmp1
@@ -385,7 +389,8 @@ cleanup_milter_test14c: cleanup_milter test-queue-file14 cleanup_milter.in14c \
 	rm -f test-queue-file14c.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test14d: cleanup_milter test-queue-file14 cleanup_milter.in14d \
-	cleanup_milter.ref14d1 ../postcat/postcat cleanup_milter.ref14d2
+	cleanup_milter.ref14d1 ../postcat/postcat cleanup_milter.ref14d2 \
+	cleanup_milter.reg14d
 	cp test-queue-file14 test-queue-file14d.tmp
 	chmod u+w test-queue-file14d.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14d 2>cleanup_milter.tmp1
@@ -395,7 +400,8 @@ cleanup_milter_test14d: cleanup_milter test-queue-file14 cleanup_milter.in14d \
 	rm -f test-queue-file14d.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test14e: cleanup_milter test-queue-file14 cleanup_milter.in14e \
-	cleanup_milter.ref14e1 ../postcat/postcat cleanup_milter.ref14e2
+	cleanup_milter.ref14e1 ../postcat/postcat cleanup_milter.ref14e2 \
+	cleanup_milter.reg14e
 	cp test-queue-file14 test-queue-file14e.tmp
 	chmod u+w test-queue-file14e.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14e 2>cleanup_milter.tmp1
@@ -405,7 +411,8 @@ cleanup_milter_test14e: cleanup_milter test-queue-file14 cleanup_milter.in14e \
 	rm -f test-queue-file14e.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test14f: cleanup_milter test-queue-file14 cleanup_milter.in14f \
-	cleanup_milter.ref14f1 ../postcat/postcat cleanup_milter.ref14f2
+	cleanup_milter.ref14f1 ../postcat/postcat cleanup_milter.ref14f2 \
+	cleanup_milter.reg14f
 	cp test-queue-file14 test-queue-file14f.tmp
 	chmod u+w test-queue-file14f.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14f 2>cleanup_milter.tmp1
@@ -415,7 +422,8 @@ cleanup_milter_test14f: cleanup_milter test-queue-file14 cleanup_milter.in14f \
 	rm -f test-queue-file14f.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test14g: cleanup_milter test-queue-file14 cleanup_milter.in14g \
-	cleanup_milter.ref14g1 ../postcat/postcat cleanup_milter.ref14g2
+	cleanup_milter.ref14g1 ../postcat/postcat cleanup_milter.ref14g2 \
+	cleanup_milter.reg14g
 	cp test-queue-file14 test-queue-file14g.tmp
 	chmod u+w test-queue-file14g.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14g 2>cleanup_milter.tmp1
@@ -425,7 +433,8 @@ cleanup_milter_test14g: cleanup_milter test-queue-file14 cleanup_milter.in14g \
 	rm -f test-queue-file14g.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15a: cleanup_milter test-queue-file15 cleanup_milter.in15a \
-	cleanup_milter.ref15a1 ../postcat/postcat cleanup_milter.ref15a2
+	cleanup_milter.ref15a1 ../postcat/postcat cleanup_milter.ref15a2 \
+	cleanup_milter.reg15a
 	cp test-queue-file15 test-queue-file15a.tmp
 	chmod u+w test-queue-file15a.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15a 2>cleanup_milter.tmp1
@@ -435,7 +444,8 @@ cleanup_milter_test15a: cleanup_milter test-queue-file15 cleanup_milter.in15a \
 	rm -f test-queue-file15a.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15b: cleanup_milter test-queue-file15 cleanup_milter.in15b \
-	cleanup_milter.ref15b1 ../postcat/postcat cleanup_milter.ref15b2
+	cleanup_milter.ref15b1 ../postcat/postcat cleanup_milter.ref15b2 \
+	cleanup_milter.reg15b
 	cp test-queue-file15 test-queue-file15b.tmp
 	chmod u+w test-queue-file15b.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15b 2>cleanup_milter.tmp1
@@ -445,7 +455,8 @@ cleanup_milter_test15b: cleanup_milter test-queue-file15 cleanup_milter.in15b \
 	rm -f test-queue-file15b.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15c: cleanup_milter test-queue-file15 cleanup_milter.in15c \
-	cleanup_milter.ref15c1 ../postcat/postcat cleanup_milter.ref15c2
+	cleanup_milter.ref15c1 ../postcat/postcat cleanup_milter.ref15c2 \
+	cleanup_milter.reg15c
 	cp test-queue-file15 test-queue-file15c.tmp
 	chmod u+w test-queue-file15c.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15c 2>cleanup_milter.tmp1
@@ -455,7 +466,8 @@ cleanup_milter_test15c: cleanup_milter test-queue-file15 cleanup_milter.in15c \
 	rm -f test-queue-file15c.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15d: cleanup_milter test-queue-file15 cleanup_milter.in15d \
-	cleanup_milter.ref15d1 ../postcat/postcat cleanup_milter.ref15d2
+	cleanup_milter.ref15d1 ../postcat/postcat cleanup_milter.ref15d2 \
+	cleanup_milter.reg15d
 	cp test-queue-file15 test-queue-file15d.tmp
 	chmod u+w test-queue-file15d.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15d 2>cleanup_milter.tmp1
@@ -465,7 +477,8 @@ cleanup_milter_test15d: cleanup_milter test-queue-file15 cleanup_milter.in15d \
 	rm -f test-queue-file15d.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15e: cleanup_milter test-queue-file15 cleanup_milter.in15e \
-	cleanup_milter.ref15e1 ../postcat/postcat cleanup_milter.ref15e2
+	cleanup_milter.ref15e1 ../postcat/postcat cleanup_milter.ref15e2 \
+	cleanup_milter.reg15e
 	cp test-queue-file15 test-queue-file15e.tmp
 	chmod u+w test-queue-file15e.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15e 2>cleanup_milter.tmp1
@@ -475,7 +488,8 @@ cleanup_milter_test15e: cleanup_milter test-queue-file15 cleanup_milter.in15e \
 	rm -f test-queue-file15e.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15f: cleanup_milter test-queue-file15 cleanup_milter.in15f \
-	cleanup_milter.ref15f1 ../postcat/postcat cleanup_milter.ref15f2
+	cleanup_milter.ref15f1 ../postcat/postcat cleanup_milter.ref15f2 \
+	cleanup_milter.reg15f
 	cp test-queue-file15 test-queue-file15f.tmp
 	chmod u+w test-queue-file15f.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15f 2>cleanup_milter.tmp1
@@ -485,7 +499,8 @@ cleanup_milter_test15f: cleanup_milter test-queue-file15 cleanup_milter.in15f \
 	rm -f test-queue-file15f.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15g: cleanup_milter test-queue-file15 cleanup_milter.in15g \
-	cleanup_milter.ref15g1 ../postcat/postcat cleanup_milter.ref15g2
+	cleanup_milter.ref15g1 ../postcat/postcat cleanup_milter.ref15g2 \
+	cleanup_milter.reg15g
 	cp test-queue-file15 test-queue-file15g.tmp
 	chmod u+w test-queue-file15g.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15g 2>cleanup_milter.tmp1
@@ -495,7 +510,8 @@ cleanup_milter_test15g: cleanup_milter test-queue-file15 cleanup_milter.in15g \
 	rm -f test-queue-file15g.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15h: cleanup_milter test-queue-file15 cleanup_milter.in15h \
-	cleanup_milter.ref15h1 ../postcat/postcat cleanup_milter.ref15h2
+	cleanup_milter.ref15h1 ../postcat/postcat cleanup_milter.ref15h2 \
+	cleanup_milter.reg15h
 	cp test-queue-file15 test-queue-file15h.tmp
 	chmod u+w test-queue-file15h.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15h 2>cleanup_milter.tmp1
@@ -505,7 +521,8 @@ cleanup_milter_test15h: cleanup_milter test-queue-file15 cleanup_milter.in15h \
 	rm -f test-queue-file15h.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
 cleanup_milter_test15i: cleanup_milter test-queue-file15 cleanup_milter.in15i \
-	cleanup_milter.ref15i1 ../postcat/postcat cleanup_milter.ref15i2
+	cleanup_milter.ref15i1 ../postcat/postcat cleanup_milter.ref15i2 \
+	cleanup_milter.reg15i
 	cp test-queue-file15 test-queue-file15i.tmp
 	chmod u+w test-queue-file15i.tmp
 	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15i 2>cleanup_milter.tmp1
@@ -514,6 +531,26 @@ cleanup_milter_test15i: cleanup_milter test-queue-file15 cleanup_milter.in15i \
 	diff cleanup_milter.ref15i2 cleanup_milter.tmp2
 	rm -f test-queue-file15i.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
 
+cleanup_milter_test16a: cleanup_milter test-queue-file16 cleanup_milter.in16a \
+	cleanup_milter.ref16a1 ../postcat/postcat cleanup_milter.ref16a2
+	cp test-queue-file16 test-queue-file16a.tmp
+	chmod u+w test-queue-file16a.tmp
+	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in16a 2>cleanup_milter.tmp1
+	diff cleanup_milter.ref16a1 cleanup_milter.tmp1
+	$(SHLIB_ENV) ../postcat/postcat -ov test-queue-file16a.tmp 2>/dev/null >cleanup_milter.tmp2
+	diff cleanup_milter.ref16a2 cleanup_milter.tmp2
+	rm -f test-queue-file16a.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
+
+cleanup_milter_test16b: cleanup_milter test-queue-file16 cleanup_milter.in16b \
+	cleanup_milter.ref16b1 ../postcat/postcat cleanup_milter.ref16b2
+	cp test-queue-file16 test-queue-file16b.tmp
+	chmod u+w test-queue-file16b.tmp
+	$(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in16b 2>cleanup_milter.tmp1
+	diff cleanup_milter.ref16b1 cleanup_milter.tmp1
+	$(SHLIB_ENV) ../postcat/postcat -ov test-queue-file16b.tmp 2>/dev/null >cleanup_milter.tmp2
+	diff cleanup_milter.ref16b2 cleanup_milter.tmp2
+	rm -f test-queue-file16b.tmp cleanup_milter.tmp1 cleanup_milter.tmp2
+
 depend: $(MAKES)
 	(sed '1,/^# do not edit/!d' Makefile.in; \
 	set -e; for i in [a-z][a-z0-9]*.c; do \

postfix/src/cleanup/cleanup.h

@@ -62,6 +62,7 @@ typedef struct CLEANUP_STATE {
     char   *return_receipt;		/* return-receipt address */
     char   *errors_to;			/* errors-to address */
     ARGV   *auto_hdrs;			/* MTA's own header(s) */
+    ARGV   *hbc_rcpt;			/* header/body checks BCC addresses */
     int     flags;			/* processing options, status flags */
     int     qmgr_opts;			/* qmgr processing options */
     int     errs;			/* any badness experienced */
@@ -115,7 +116,6 @@ typedef struct CLEANUP_STATE {
     VSTRING *milter_err_text;		/* milter call-back reply */
     HBC_CHECKS *milter_hbc_checks;	/* Milter header checks */
     VSTRING *milter_hbc_reply;		/* Milter header checks reply */
-    VSTRING *milter_orcpt_buf;		/* add_rcpt_par() orcpt */
 
     /*
      * Support for Milter body replacement requests.

postfix/src/cleanup/cleanup_extracted.c

@@ -306,6 +306,21 @@ void    cleanup_extracted_finish(CLEANUP_STATE *state)
 	&& state->recip != 0 && *var_always_bcc)
 	cleanup_addr_bcc(state, var_always_bcc);
 
+    /*
+     * Flush non-Milter header/body_checks BCC recipients. Clear hbc_rcpt
+     * so that it can be used for other purposes.
+     */
+    if (state->hbc_rcpt) {
+	if (CLEANUP_OUT_OK(state) && state->recip != 0) {
+	    char  **cpp;
+
+	    for (cpp = state->hbc_rcpt->argv; *cpp; cpp++)
+		cleanup_addr_bcc(state, *cpp);
+	}
+	argv_free(state->hbc_rcpt);
+	state->hbc_rcpt = 0;
+    }
+
     /*
      * Terminate the extracted segment.
      */

postfix/src/cleanup/cleanup_message.c

@@ -425,6 +425,19 @@ static const char *cleanup_act(CLEANUP_STATE *state, char *context,
 	}
 	return (buf);
     }
+    if (STREQUAL(value, "BCC", command_len)) {
+	if (strchr(optional_text, '@') == 0) {
+	    msg_warn("bad BCC address \"%s\" in %s map -- "
+		     "need user@domain",
+		     optional_text, map_class);
+	} else {
+	    if (state->hbc_rcpt == 0)
+		state->hbc_rcpt = argv_alloc(1);
+	    argv_add(state->hbc_rcpt, optional_text, (char *) 0);
+	    cleanup_act_log(state, "bcc", context, buf, optional_text);
+	}
+	return (buf);
+    }
     /* Allow and ignore optional text after the action. */
 
     if (STREQUAL(value, "IGNORE", command_len))

postfix/src/cleanup/cleanup_milter.c

@@ -216,6 +216,7 @@
 /*#define msg_verbose	2*/
 
 static void cleanup_milter_set_error(CLEANUP_STATE *, int);
+static const char *cleanup_add_rcpt_par(void *, const char *, const char *);
 
 #define STR(x)		vstring_str(x)
 #define LEN(x)		VSTRING_LEN(x)
@@ -301,6 +302,18 @@ static char *cleanup_milter_hbc_extend(void *context, const char *command,
     if ((state->flags & CLEANUP_FLAG_FILTER_ALL) == 0)
 	return ((char *) buf);
 
+    if (STREQUAL(command, "BCC", cmd_len)) {
+	if (strchr(optional_text, '@') == 0) {
+	    msg_warn("bad BCC address \"%s\" in %s map -- "
+		     "need user@domain",
+		     optional_text, VAR_MILT_HEAD_CHECKS);
+	} else {
+	    cleanup_milter_hbc_log(context, "bcc", where, buf, optional_text);
+	    /* Caller checks state error flags. */
+	    (void) cleanup_add_rcpt_par(state, optional_text, "");
+	}
+	return ((char *) buf);
+    }
     if (STREQUAL(command, "REJECT", cmd_len)) {
 	const CLEANUP_STAT_DETAIL *detail;
 
@@ -616,15 +629,23 @@ static const char *cleanup_add_header(void *context, const char *name,
 
     /*
      * Return early when Milter header checks request that this header record
-     * be dropped.
+     * be dropped, or that the message is discarded. Note: CLEANUP_OUT_OK()
+     * tests CLEANUP_FLAG_DISCARD. We don't want to report the latter as an
+     * error.
      */
     buf = vstring_alloc(100);
     vstring_sprintf(buf, "%s:%s%s", name, space, value);
-    if (state->milter_hbc_checks
+    if (state->milter_hbc_checks) {
-	&& cleanup_milter_header_checks(state, buf) == 0) {
+	if (cleanup_milter_header_checks(state, buf) == 0
+	    || (state->flags & CLEANUP_FLAG_DISCARD)) {
 	    vstring_free(buf);
 	    return (0);
 	}
+	if (CLEANUP_OUT_OK(state) == 0) {
+	    vstring_free(buf);
+	    return (cleanup_milter_error(state, 0));
+	}
+    }
 
     /*
      * Allocate space after the end of the queue file, and write the header
@@ -1394,7 +1415,7 @@ static const char *cleanup_chg_from(void *context, const char *ext_from,
 static const char *cleanup_add_rcpt_par(void *context, const char *ext_rcpt,
 					        const char *esmtp_args)
 {
-    const char *myname = "cleanup_add_rcpt";
+    const char *myname = "cleanup_add_rcpt_par";
     CLEANUP_STATE *state = (CLEANUP_STATE *) context;
     off_t   new_rcpt_offset;
     off_t   reverse_ptr_offset;
@@ -1402,6 +1423,7 @@ static const char *cleanup_add_rcpt_par(void *context, const char *ext_rcpt,
     TOK822 *tree;
     TOK822 *tp;
     VSTRING *int_rcpt_buf;
+    VSTRING *orcpt_buf = 0;
     ARGV   *esmtp_argv;
     int     dsn_notify = 0;
     const char *dsn_orcpt_info = 0;
@@ -1410,39 +1432,8 @@ static const char *cleanup_add_rcpt_par(void *context, const char *ext_rcpt,
     const char *arg;
     const char *arg_val;
 
-    if (esmtp_args[0]) {
-	esmtp_argv = argv_split(esmtp_args, " ");
-	for (i = 0; i < esmtp_argv->argc; ++i) {
-	    arg = esmtp_argv->argv[i];
-	    if (strncasecmp(arg, "NOTIFY=", 7) == 0) {	/* RFC 3461 */
-		if (dsn_notify || (dsn_notify = dsn_notify_mask(arg + 7)) == 0)
-		    msg_warn("%s: Bad NOTIFY parameter from MILTER: \"%.100s\"",
-			     state->queue_id, arg);
-	    } else if (strncasecmp(arg, "ORCPT=", 6) == 0) {	/* RFC 3461 */
-		if (state->milter_orcpt_buf == 0)
-		    state->milter_orcpt_buf = vstring_alloc(100);
-		if (dsn_orcpt_info
-		    || (type_len = strcspn(arg_val = arg + 6, ";")) == 0
-		    || (arg_val)[type_len] != ';'
-		    || xtext_unquote_append(
-				    vstring_sprintf(state->milter_orcpt_buf,
-						    "%.*s;", (int) type_len,
-						    arg_val),
-					    arg_val + type_len + 1) == 0) {
-		    msg_warn("%s: Bad ORCPT parameter from MILTER: \"%.100s\"",
-			     state->queue_id, arg);
-		} else {
-		    dsn_orcpt_info = STR(state->milter_orcpt_buf);
-		}
-	    } else {
-		msg_warn("%s: ignoring ESMTP argument from MILTER: \"%.100s\"",
-			 state->queue_id, arg);
-	    }
-	}
-	argv_free(esmtp_argv);
-    }
     if (msg_verbose)
-	msg_info("%s: \"%s\"", myname, ext_rcpt);
+	msg_info("%s: \"%s\" \"%s\"", myname, ext_rcpt, esmtp_args);
 
     /*
      * To simplify implementation, the cleanup server writes a dummy
@@ -1471,6 +1462,43 @@ static const char *cleanup_add_rcpt_par(void *context, const char *ext_rcpt,
 	return (cleanup_milter_error(state, errno));
     }
 
+    /*
+     * Parse ESMTP parameters. XXX UTF8SMTP don't assume ORCPT is xtext.
+     */
+    if (esmtp_args[0]) {
+	esmtp_argv = argv_split(esmtp_args, " ");
+	for (i = 0; i < esmtp_argv->argc; ++i) {
+	    arg = esmtp_argv->argv[i];
+	    if (strncasecmp(arg, "NOTIFY=", 7) == 0) {	/* RFC 3461 */
+		if (dsn_notify || (dsn_notify = dsn_notify_mask(arg + 7)) == 0)
+		    msg_warn("%s: Bad NOTIFY parameter from Milter or "
+			     "header/body_checks: \"%.100s\"",
+			     state->queue_id, arg);
+	    } else if (strncasecmp(arg, "ORCPT=", 6) == 0) {	/* RFC 3461 */
+		if (orcpt_buf == 0)
+		    orcpt_buf = vstring_alloc(100);
+		if (dsn_orcpt_info
+		    || (type_len = strcspn(arg_val = arg + 6, ";")) == 0
+		    || (arg_val)[type_len] != ';'
+		    || xtext_unquote_append(vstring_sprintf(orcpt_buf,
+						    "%.*s;", (int) type_len,
+							    arg_val),
+					    arg_val + type_len + 1) == 0) {
+		    msg_warn("%s: Bad ORCPT parameter from Milter or "
+			     "header/body_checks: \"%.100s\"",
+			     state->queue_id, arg);
+		} else {
+		    dsn_orcpt_info = STR(orcpt_buf);
+		}
+	    } else {
+		msg_warn("%s: ignoring ESMTP argument from Milter or "
+			 "header/body_checks: \"%.100s\"",
+			 state->queue_id, arg);
+	    }
+	}
+	argv_free(esmtp_argv);
+    }
+
     /*
      * Transform recipient from external form to internal form. This also
      * removes the enclosing <>, if present.
@@ -1485,21 +1513,35 @@ static const char *cleanup_add_rcpt_par(void *context, const char *ext_rcpt,
 		tok822_internalize(int_rcpt_buf, tp->head, TOK822_STR_DEFL);
 		addr_count += 1;
 	    } else {
-		msg_warn("%s: Milter request to add multi-recipient: \"%s\"",
+		msg_warn("%s: Milter or header/body_checks request to "
+			 "add multi-recipient: \"%s\"",
 			 state->queue_id, ext_rcpt);
 		break;
 	    }
 	}
     }
     tok822_free_tree(tree);
+    if (addr_count != 0)
 	cleanup_addr_bcc_dsn(state, STR(int_rcpt_buf), dsn_orcpt_info,
 			     dsn_notify ? dsn_notify : DEF_DSN_NOTIFY);
-    vstring_free(int_rcpt_buf);
+    else
-    if (addr_count == 0) {
 	msg_warn("%s: ignoring attempt from Milter to add null recipient",
 		 state->queue_id);
+    vstring_free(int_rcpt_buf);
+    if (orcpt_buf)
+	vstring_free(orcpt_buf);
+
+    /*
+     * Don't update the queue file when we did not write a recipient record
+     * (malformed or duplicate BCC recipient).
+     */
+    if (vstream_ftell(state->dst) == new_rcpt_offset)
 	return (CLEANUP_OUT_OK(state) ? 0 : cleanup_milter_error(state, 0));
-    }
+
+    /*
+     * Follow the recipient with a "reverse" pointer to the old recipient
+     * append target.
+     */
     if ((reverse_ptr_offset = vstream_ftell(state->dst)) < 0) {
 	msg_warn("%s: vstream_ftell file %s: %m", myname, cleanup_path);
 	return (cleanup_milter_error(state, errno));
@@ -2431,7 +2473,6 @@ int     main(int unused_argc, char **argv)
 	    msg_info("ignoring: %s %s %s", argv->argv[0],
 		     argv->argc > 1 ? argv->argv[1] : "",
 		     argv->argc > 2 ? argv->argv[2] : "");
-	    continue;
 	} else if (strcmp(argv->argv[0], "add_header") == 0) {
 	    if (argv->argc < 2) {
 		msg_warn("bad add_header argument count: %d", argv->argc);
@@ -2533,6 +2574,8 @@ int     main(int unused_argc, char **argv)
 	    msg_info("errs = %s", cleanup_strerror(state->errs));
     }
     cleanup_state_free(state);
+    if (*var_milt_head_checks)
+	myfree(var_milt_head_checks);
 
     return (0);
 }

postfix/src/cleanup/cleanup_milter.in16a

@@ -0,0 +1,10 @@
+#verbose on
+open test-queue-file16a.tmp
+
+# Test the BCC action in milter_header_checks.
+
+header_checks regexp:cleanup_milter.reg16a
+add_header X-SPAM-FLAG NO
+add_header X-SPAM-FLAG YES
+
+close

postfix/src/cleanup/cleanup_milter.in16b

@@ -0,0 +1,12 @@
+#verbose on
+open test-queue-file16b.tmp
+
+# Test the add_rcpt_par action
+
+add_rcpt_par foo@example.com notify=never
+add_rcpt_par foo@example.com notify=never
+add_rcpt bar@example.com
+add_rcpt_par bar@example.com orcpt=rfc822;orig-bar@example.com
+add_rcpt_par bar@example.com notify=delay
+
+close

postfix/src/cleanup/cleanup_milter.ref16a1

@@ -0,0 +1,3 @@
+./cleanup_milter: NOQUEUE: milter-header-bcc: header X-SPAM-FLAG: NO from client_name[client_addr]; from=<sender> to=<recipient>: bar@example.com
+./cleanup_milter: NOQUEUE: milter-header-bcc: header X-SPAM-FLAG: YES from client_name[client_addr]; from=<sender> to=<recipient>: foo@example.com
+./cleanup_milter: flags = enable_header_body_filter enable_milters

postfix/src/cleanup/cleanup_milter.ref16a2

@@ -0,0 +1,37 @@
+*** ENVELOPE RECORDS test-queue-file16a.tmp ***
+        0 message_size:             343             215               1               0             343               0
+       97 message_arrival_time: Tue Nov 18 16:43:29 2014
+      116 create_time: Tue Nov 18 16:43:29 2014
+      140 named_attribute: rewrite_context=local
+      163 sender_fullname: Wietse Venema
+      178 sender: user@example.com
+      196 pointer_record:             654
+      654 original_recipient: bar@example.com
+      671 recipient: bar@example.com
+      688 pointer_record:             739
+      739 original_recipient: foo@example.com
+      756 recipient: foo@example.com
+      773 pointer_record:             213
+      213 *** MESSAGE CONTENTS test-queue-file16a.tmp ***
+      215 regular_text: Received: by host.example.com (Postfix, from userid 1001)
+      274 regular_text: 	id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST)
+      331 regular_text: To: user@example.com
+      353 regular_text: Subject: test
+      368 padding: 0
+      371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com>
+      431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST)
+      476 regular_text: From: user@example.com (Wietse Venema)
+      516 pointer_record:             705
+      705 regular_text: X-SPAM-FLAG: NO
+      722 pointer_record:             790
+      790 regular_text: X-SPAM-FLAG: YES
+      808 pointer_record:             533
+      533 regular_text: 
+      535 regular_text: test
+      541 pointer_record:               0
+      558 *** HEADER EXTRACTED test-queue-file16a.tmp ***
+      560 pointer_record:               0
+      577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com
+      616 original_recipient: user@example.com
+      634 recipient: user@example.com
+      652 *** MESSAGE FILE END test-queue-file16a.tmp ***

postfix/src/cleanup/cleanup_milter.ref16b1

@@ -0,0 +1 @@
+./cleanup_milter: flags = enable_header_body_filter enable_milters

postfix/src/cleanup/cleanup_milter.ref16b2

@@ -0,0 +1,42 @@
+*** ENVELOPE RECORDS test-queue-file16b.tmp ***
+        0 message_size:             343             215               1               0             343               0
+       97 message_arrival_time: Tue Nov 18 16:43:29 2014
+      116 create_time: Tue Nov 18 16:43:29 2014
+      140 named_attribute: rewrite_context=local
+      163 sender_fullname: Wietse Venema
+      178 sender: user@example.com
+      196 pointer_record:             654
+      654 named_attribute: notify_flags=1
+      670 original_recipient: foo@example.com
+      687 recipient: foo@example.com
+      704 pointer_record:             721
+      721 original_recipient: bar@example.com
+      738 recipient: bar@example.com
+      755 pointer_record:             772
+      772 named_attribute: dsn_orig_rcpt=rfc822;orig-bar@example.com
+      815 original_recipient: bar@example.com
+      832 recipient: bar@example.com
+      849 pointer_record:             866
+      866 named_attribute: notify_flags=8
+      882 original_recipient: bar@example.com
+      899 recipient: bar@example.com
+      916 pointer_record:             213
+      213 *** MESSAGE CONTENTS test-queue-file16b.tmp ***
+      215 regular_text: Received: by host.example.com (Postfix, from userid 1001)
+      274 regular_text: 	id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST)
+      331 regular_text: To: user@example.com
+      353 regular_text: Subject: test
+      368 padding: 0
+      371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com>
+      431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST)
+      476 regular_text: From: user@example.com (Wietse Venema)
+      516 pointer_record:               0
+      533 regular_text: 
+      535 regular_text: test
+      541 pointer_record:               0
+      558 *** HEADER EXTRACTED test-queue-file16b.tmp ***
+      560 pointer_record:               0
+      577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com
+      616 original_recipient: user@example.com
+      634 recipient: user@example.com
+      652 *** MESSAGE FILE END test-queue-file16b.tmp ***

postfix/src/cleanup/cleanup_milter.reg16a

@@ -0,0 +1,2 @@
+/YES/ bcc foo@example.com
+/NO/  bcc bar@example.com

postfix/src/cleanup/cleanup_state.c

@@ -79,6 +79,7 @@ CLEANUP_STATE *cleanup_state_alloc(VSTREAM *src)
     state->return_receipt = 0;
     state->errors_to = 0;
     state->auto_hdrs = argv_alloc(1);
+    state->hbc_rcpt = 0;
     state->flags = 0;
     state->qmgr_opts = 0;
     state->errs = 0;
@@ -102,7 +103,6 @@ CLEANUP_STATE *cleanup_state_alloc(VSTREAM *src)
     state->append_meta_pt_target = -1;
     state->milter_hbc_checks = 0;
     state->milter_hbc_reply = 0;
-    state->milter_orcpt_buf = 0;
     state->rcpt_count = 0;
     state->reason = 0;
     state->smtp_reply = 0;
@@ -154,6 +154,8 @@ void    cleanup_state_free(CLEANUP_STATE *state)
     if (state->errors_to)
 	myfree(state->errors_to);
     argv_free(state->auto_hdrs);
+    if (state->hbc_rcpt)
+	argv_free(state->hbc_rcpt);
     if (state->queue_name)
 	myfree(state->queue_name);
     if (state->queue_id)
@@ -163,8 +165,6 @@ void    cleanup_state_free(CLEANUP_STATE *state)
 	myfree(state->reason);
     if (state->smtp_reply)
 	myfree(state->smtp_reply);
-    if (state->milter_orcpt_buf)
-	vstring_free(state->milter_orcpt_buf);
     nvtable_free(state->attr);
     if (state->mime_state)
 	mime_state_free(state->mime_state);

postfix/src/global/attr_override.h

@@ -16,8 +16,6 @@
   */
 extern void attr_override(char *, const char *, const char *,...);
 
-typedef const char *CONST_CHAR_STAR;
-
 typedef struct {
     const char *name;
     CONST_CHAR_STAR *target;

postfix/src/global/mail_version.h

@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20141118"
+#define MAIL_RELEASE_DATE	"20141119"
 #define MAIL_VERSION_NUMBER	"2.12"
 
 #ifdef SNAPSHOT

postfix/src/util/base64_code.c

@@ -201,55 +201,25 @@ VSTRING *base64_decode_opt(VSTRING *result, const char *in, ssize_t len,
 #define STR(x)	vstring_str(x)
 #define LEN(x)	VSTRING_LEN(x)
 
-#define TESXT 	"this is a test!"
-
 int     main(int unused_argc, char **unused_argv)
 {
     VSTRING *b1 = vstring_alloc(1);
     VSTRING *b2 = vstring_alloc(1);
-    char   *test = TESXT;
+    char    test[256];
-    char   *test2 = TESXT TESXT;
+    int     n;
 
-#define DECODE(b,x,l) { \
+    for (n = 0; n < sizeof(test); n++)
-	if (base64_decode((b),(x),(l)) == 0) \
+	test[n] = n;
-	    msg_panic("bad base64: %s", (x)); \
+    base64_encode(b1, test, sizeof(test));
-    }
+    if (base64_decode(b2, STR(b1), LEN(b1)) == 0)
-#define VERIFY(b,t) { \
+	msg_panic("bad base64: %s", STR(b1));
-	if (strcmp((b), (t)) != 0) \
+    if (LEN(b2) != sizeof(test))
-	    msg_panic("bad test: %s", (b)); \
+	msg_panic("bad decode length: %ld != %ld",
-    }
+		  (long) LEN(b2), (long) sizeof(test));
-
+    for (n = 0; n < sizeof(test); n++)
-    base64_encode(b1, test, strlen(test));
+	if (STR(b2)[n] != test[n])
-    DECODE(b2, STR(b1), LEN(b1));
+	    msg_panic("bad decode value %d != %d",
-    VERIFY(STR(b2), test);
+		      (unsigned char) STR(b2)[n], (unsigned char) test[n]);
-
-    base64_encode(b1, test, strlen(test));
-    base64_encode(b2, STR(b1), LEN(b1));
-    base64_encode(b1, STR(b2), LEN(b2));
-    DECODE(b2, STR(b1), LEN(b1));
-    DECODE(b1, STR(b2), LEN(b2));
-    DECODE(b2, STR(b1), LEN(b1));
-    VERIFY(STR(b2), test);
-
-    base64_encode(b1, test, strlen(test));
-    base64_encode(b2, STR(b1), LEN(b1));
-    base64_encode(b1, STR(b2), LEN(b2));
-    base64_encode(b2, STR(b1), LEN(b1));
-    base64_encode(b1, STR(b2), LEN(b2));
-    DECODE(b2, STR(b1), LEN(b1));
-    DECODE(b1, STR(b2), LEN(b2));
-    DECODE(b2, STR(b1), LEN(b1));
-    DECODE(b1, STR(b2), LEN(b2));
-    DECODE(b2, STR(b1), LEN(b1));
-    VERIFY(STR(b2), test);
-
-    base64_encode(b1, test, strlen(test));
-    base64_encode_opt(b1, test, strlen(test), BASE64_FLAG_APPEND);
-    DECODE(b2, STR(b1), LEN(b1));
-    VERIFY(STR(b2), test2);
-
-    vstring_free(b1);
-    vstring_free(b2);
     return (0);
 }
 

postfix/src/util/sys_defs.h

@@ -1693,6 +1693,14 @@ typedef int pid_t;
 #define UINT32_SIZE	4
 #define UINT16_SIZE	2
 
+ /*
+  * For the sake of clarity.
+  */
+#ifndef HAVE_CONST_CHAR_STAR
+typedef const char *CONST_CHAR_STAR;
+
+#endif
+
  /*
   * Safety. On some systems, ctype.h misbehaves with non-ASCII or negative
   * characters. More importantly, Postfix uses the ISXXX() macros to ensure