postfix-2.0.0-20030109

postfix/HISTORY

@@ -7690,7 +7690,7 @@ Apologies for any names omitted.
 	It should not try to open any user/domain/uce related tables
 	at all. File:  smtpd/smtpd.c.
 
-20020106
+20030106
 
 	Bugfix: bouncing to owner-alias was broken, i.e. the mail
 	kept being deferred, and when that was fixed, another buglet
@@ -7702,8 +7702,32 @@ Apologies for any names omitted.
 	specifies a hostname for which the same IP address is listed
 	multiple times. File: master/master_ent.c.
 
+20030107
+
+	Robustness: check that FILTER actions in SMTPD access maps
+	or cleanup header/body_checks have plausible syntax. Files:
+	smtpd/smtpd_check.c, cleanup/cleanup_message.c.
+
+20030109
+
+	Cleanup: unnecessary "premature end of file on xxx while
+	reading yyy" warnings became exposed after some code
+	simplification. Files" global/*_clnt.c, global/dict_proxy.c
+
+	Robustness: undo the change that causes a multi-server
+	process to stop accepting new connections while it still
+	services existing clients for an extended amount of time.
+	We need a better process retirement strategy. File:
+	master/multi_server.c.
+
 Open problems:
 
+	Med: make qmgr recipient bounce/defer activity asynchronous
+	or add a multi-recipient operation that reduces overhead.
+
+	Low: postmap/postalias should not try to open a bogus file
+	when given an unsupported dictionary type.
+
 	Med: do not postpone rejected "MAIL FROM" size information,
 	and find a way to log the sender address in the rejected
 	command.

postfix/conf/regexp_table

@@ -89,7 +89,9 @@
 #        /^postmaster@/       OK
 # 
 #        # Protect your outgoing majordomo exploders
-#        /^(.*)-outgoing@(.*)$/!/^owner-/         550 Use ${1}@${2} instead
+#        if !/^owner-/
+#        /^(.*)-outgoing@(.*)$/   550 Use ${1}@${2} instead
+#        endif
 # 
 # EXAMPLE HEADER FILTER MAP
 #        # These were once common in junk mail.

postfix/conf/sample-pcre-header.cf

@@ -3,8 +3,8 @@
 #	message header filtering. See pcre_table(5) for syntax description.
 #
 #	Message headers are filtered one at a time. This filter understands
-#	multi-line message headers. However, the message header filter has
+#	multi-line message headers, including MIME headers in the message
-#	no knowledge of MIME headers that are embedded in the message body.
+#	body.
 #
 #	The first field is a perl-like regular expression. The expression
 #	delimiter can be any character except whitespace, or characters

postfix/conf/sample-regexp-header.cf

@@ -2,8 +2,7 @@
 # for a description of the syntax.
 #
 # Message headers are filtered one at a time. This filter understands
-# multi-line mail headers. However, the message header filter has no
+# multi-line mail headers, including MIME headers in the message body.
-# knowledge of MIME headers that are embedded in the message body.
 #
 # The general format of a table entry is PATTERN RESULT. 
 #

postfix/html/postqueue.1.html

@@ -11,9 +11,11 @@ POSTQUEUE(1)                                         POSTQUEUE(1)
 
 <b>DESCRIPTION</b>
        The  <b>postqueue</b>  program implements the Postfix user inter-
-       face for queue management. It implements  all  the  opera-
+       face for queue management. It implements  operations  that
-       tions that are traditionally available via the <a href="sendmail.1.html"><b>sendmail</b>(1)</a>
+       are  traditionally  available via the <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command.
-       command.
+       See the <a href="postsuper.1.html"><b>postsuper</b>(1)</a> command  for  queue  operations  that
+       require  super-user  privileges such as deleting a message
+       from the queue or changing the status of a message.
 
        The following options are recognized:
 
@@ -109,7 +111,8 @@ POSTQUEUE(1)                                         POSTQUEUE(1)
               request and in the <b>sendmail</b> <b>-qR</b> command.
 
 <b>SEE</b> <b>ALSO</b>
-       sendmail(8) sendmail-compatible user interface
+       <a href="sendmail.1.html">sendmail(1)</a> sendmail-compatible user interface
+       <a href="postsuper.1.html">postsuper(1)</a> privileged queue operations
        <a href="qmgr.8.html">qmgr(8)</a> queue manager
        <a href="showq.8.html">showq(8)</a> list mail queue
        <a href="flushd.8.html">flush(8)</a> fast flush service

postfix/html/postsuper.1.html

@@ -11,6 +11,8 @@ POSTSUPER(1)                                         POSTSUPER(1)
 <b>DESCRIPTION</b>
        The <b>postsuper</b> command does maintenance jobs on the Postfix
        queue.  Use of the command is restricted to the superuser.
+       See the <b>postqueue</b> command for  unprivileged  queue  opera-
+       tions such as listing or flushing the mail queue.
 
        By  default,  <b>postsuper</b>  performs the operations requested
        with the <b>-s</b> and <b>-p</b> command-line  options  on  all  Postfix
@@ -172,6 +174,10 @@ POSTSUPER(1)                                         POSTSUPER(1)
               The  names of queues that are organized into multi-
               ple levels of subdirectories.
 
+<b>SEE</b> <b>ALSO</b>
+       <a href="sendmail.1.html">sendmail(1)</a> sendmail-compatible user interface
+       <a href="postqueue.1.html">postqueue(1)</a> unprivileged queue operations
+
 <b>LICENSE</b>
        The Secure Mailer license must be  distributed  with  this
        software.

postfix/html/proxymap.8.html

@@ -80,9 +80,9 @@ PROXYMAP(8)                                           PROXYMAP(8)
        connections.  When all servers are  busy  while  a  client
        connects,  the  master  creates a new proxymap server pro-
        cess, provided that the proxymap server process  limit  is
-       not  exceeded.   Each  proxymap server stops accepting new
+       not exceeded.  Each proxymap server terminates after serv-
-       connections after serving <b>$max</b><i>_</i><b>use</b> clients  or  terminates
+       ing at least <b>$max</b><i>_</i><b>use</b> clients or after  <b>$max</b><i>_</i><b>idle</b>  seconds
-       after <b>$max</b><i>_</i><b>idle</b> seconds of idle time.
+       of idle time.
 
 <b>SECURITY</b>
        The  proxymap  server  opens only tables that are approved

postfix/html/regexp_table.5.html

@@ -90,7 +90,9 @@ REGEXP_TABLE(5)                                   REGEXP_TABLE(5)
        /^postmaster@/       OK
 
        # Protect your outgoing majordomo exploders
-       /^(.*)-outgoing@(.*)$/!/^owner-/         550 Use ${1}@${2} instead
+       if !/^owner-/
+       /^(.*)-outgoing@(.*)$/   550 Use ${1}@${2} instead
+       endif
 
 <b>EXAMPLE</b> <b>HEADER</b> <b>FILTER</b> <b>MAP</b>
        # These were once common in junk mail.

postfix/html/trivial-rewrite.8.html

@@ -81,9 +81,9 @@ TRIVIAL-REWRITE(8)                             TRIVIAL-REWRITE(8)
        taneous connections.  When all servers are  busy  while  a
        client  connects, the master creates a new server process,
        provided that the trivial-rewrite server process limit  is
-       not exceeded.  Each trivial-rewrite server stops accepting
+       not  exceeded.   Each  trivial-rewrite  server  terminates
-       new connections after serving <b>$max</b><i>_</i><b>use</b> clients  or  termi-
+       after serving at least <b>$max</b><i>_</i><b>use</b> clients of after <b>$max</b><i>_</i><b>idle</b>
-       nates after <b>$max</b><i>_</i><b>idle</b> seconds of idle time.
+       seconds of idle time.
 
 <b>STANDARDS</b>
        None.  The  command  does  not  interact  with the outside

postfix/man/man1/postqueue.1

@@ -17,8 +17,11 @@ Postfix queue control
 .ad
 .fi
 The \fBpostqueue\fR program implements the Postfix user interface
-for queue management. It implements all the operations that are
+for queue management. It implements operations that are
 traditionally available via the \fBsendmail\fR(1) command.
+See the \fBpostsuper\fR(1) command for queue operations
+that require super-user privileges such as deleting a message
+from the queue or changing the status of a message.
 
 The following options are recognized:
 .IP "\fB-c \fIconfig_dir\fR"
@@ -112,7 +115,8 @@ request and in the \fBsendmail -qR\fR command.
 .SH SEE ALSO
 .na
 .nf
-sendmail(8) sendmail-compatible user interface
+sendmail(1) sendmail-compatible user interface
+postsuper(1) privileged queue operations
 qmgr(8) queue manager
 showq(8) list mail queue
 flush(8) fast flush service

postfix/man/man1/postsuper.1

@@ -18,6 +18,8 @@ Postfix superintendent
 .fi
 The \fBpostsuper\fR command does maintenance jobs on the Postfix
 queue. Use of the command is restricted to the superuser.
+See the \fBpostqueue\fR command for unprivileged queue operations
+such as listing or flushing the mail queue.
 
 By default, \fBpostsuper\fR performs the operations requested with the
 \fB-s\fR and \fB-p\fR command-line options on all Postfix queue
@@ -176,6 +178,11 @@ Number of subdirectory levels for hashed queues.
 .IP \fBhash_queue_names\fR
 The names of queues that are organized into multiple levels of
 subdirectories.
+.SH SEE ALSO
+.na
+.nf
+sendmail(1) sendmail-compatible user interface
+postqueue(1) unprivileged queue operations
 .SH LICENSE
 .na
 .nf

postfix/man/man5/regexp_table.5

@@ -84,7 +84,9 @@ by whitespace.
 /^postmaster@/       OK
 
 # Protect your outgoing majordomo exploders
-/^(.*)-outgoing@(.*)$/!/^owner-/         550 Use ${1}@${2} instead
+if !/^owner-/
+/^(.*)-outgoing@(.*)$/   550 Use ${1}@${2} instead
+endif
 .SH EXAMPLE HEADER FILTER MAP
 .na
 .nf

postfix/man/man8/proxymap.8

@@ -77,8 +77,8 @@ server.  Each server can handle multiple simultaneous connections.
 When all servers are busy while a client connects, the master
 creates a new proxymap server process, provided that the proxymap
 server process limit is not exceeded.
-Each proxymap server stops accepting new connections after serving
+Each proxymap server terminates after serving
-\fB$max_use\fR clients or terminates after \fB$max_idle\fR seconds
+at least \fB$max_use\fR clients or after \fB$max_idle\fR seconds
 of idle time.
 .SH SECURITY
 .na

postfix/man/man8/trivial-rewrite.8

@@ -75,8 +75,8 @@ server.  Each server can handle multiple simultaneous connections.
 When all servers are busy while a client connects, the master
 creates a new server process, provided that the trivial-rewrite
 server process limit is not exceeded.
-Each trivial-rewrite server stops accepting new connections after
+Each trivial-rewrite server terminates after
-serving \fB$max_use\fR clients or terminates after \fB$max_idle\fR
+serving at least \fB$max_use\fR clients of after \fB$max_idle\fR
 seconds of idle time.
 .SH STANDARDS
 .na

postfix/proto/regexp_table

@@ -76,7 +76,9 @@
 #	/^postmaster@/	     OK
 #
 #	# Protect your outgoing majordomo exploders
-#	/^(.*)-outgoing@(.*)$/!/^owner-/	 550 Use ${1}@${2} instead
+#	if !/^owner-/
+#	/^(.*)-outgoing@(.*)$/	 550 Use ${1}@${2} instead
+#	endif
 # EXAMPLE HEADER FILTER MAP
 #	# These were once common in junk mail.
 #	/^Subject: make money fast/     REJECT

postfix/src/cleanup/cleanup_message.c

@@ -316,6 +316,9 @@ static int cleanup_act(CLEANUP_STATE *state, char *context, const char *buf,
     if (STREQUAL(value, "FILTER", command_len)) {
 	if (*optional_text == 0) {
 	    msg_warn("missing FILTER command argument in %s map", map_class);
+	} else if (strchr(optional_text, ':') == 0) {
+	    msg_warn("bad FILTER command %s in %s, need transport:destination",
+		     optional_text, map_class);
 	} else {
 	    if (state->filter)
 		myfree(state->filter);

postfix/src/global/dict_proxy.c

@@ -110,6 +110,7 @@ static const char *dict_proxy_lookup(DICT *dict, const char *key)
 		       ATTR_TYPE_NUM, MAIL_ATTR_FLAGS, dict_proxy->in_flags,
 		       ATTR_TYPE_STR, MAIL_ATTR_KEY, key,
 		       ATTR_TYPE_END) != 0
+	    || vstream_fflush(stream)
 	    || attr_scan(stream, ATTR_FLAG_STRICT,
 			 ATTR_TYPE_NUM, MAIL_ATTR_STATUS, &status,
 			 ATTR_TYPE_STR, MAIL_ATTR_VALUE, dict_proxy->result,

postfix/src/global/mail_version.h

@@ -20,7 +20,7 @@
   * Patches change the patchlevel and the release date. Snapshots change the
   * release date only, unless they include the same bugfix as a patch release.
   */
-#define MAIL_RELEASE_DATE	"20030107"
+#define MAIL_RELEASE_DATE	"20030109"
 
 #define VAR_MAIL_VERSION	"mail_version"
 #define DEF_MAIL_VERSION	"2.0.0-" MAIL_RELEASE_DATE

postfix/src/global/resolve_clnt.c

@@ -189,6 +189,7 @@ void    resolve_clnt_query(const char *addr, RESOLVE_REPLY *reply)
 		       ATTR_TYPE_STR, MAIL_ATTR_REQ, RESOLVE_ADDR,
 		       ATTR_TYPE_STR, MAIL_ATTR_ADDR, addr,
 		       ATTR_TYPE_END) != 0
+	    || vstream_fflush(stream)
 	    || attr_scan(stream, ATTR_FLAG_STRICT,
 		       ATTR_TYPE_STR, MAIL_ATTR_TRANSPORT, reply->transport,
 			 ATTR_TYPE_STR, MAIL_ATTR_NEXTHOP, reply->nexthop,

postfix/src/global/rewrite_clnt.c

@@ -131,6 +131,7 @@ VSTRING *rewrite_clnt(const char *rule, const char *addr, VSTRING *result)
 		       ATTR_TYPE_STR, MAIL_ATTR_RULE, rule,
 		       ATTR_TYPE_STR, MAIL_ATTR_ADDR, addr,
 		       ATTR_TYPE_END) != 0
+	    || vstream_fflush(stream)
 	    || attr_scan(stream, ATTR_FLAG_STRICT,
 			 ATTR_TYPE_STR, MAIL_ATTR_ADDR, result,
 			 ATTR_TYPE_END) != 1) {

postfix/src/global/verify_clnt.c

@@ -122,6 +122,7 @@ int     verify_clnt_query(const char *addr, int *addr_status, VSTRING *why)
 		       ATTR_TYPE_STR, MAIL_ATTR_REQ, VRFY_REQ_QUERY,
 		       ATTR_TYPE_STR, MAIL_ATTR_ADDR, addr,
 		       ATTR_TYPE_END) != 0
+	    || vstream_fflush(stream)
 	    || attr_scan(stream, ATTR_FLAG_MISSING,
 			 ATTR_TYPE_NUM, MAIL_ATTR_STATUS, &request_status,
 			 ATTR_TYPE_NUM, MAIL_ATTR_ADDR_STATUS, addr_status,

postfix/src/master/multi_server.c

@@ -111,10 +111,6 @@
 /*	This value is taken from the global \fBmain.cf\fR configuration
 /*	file. Setting \fBvar_use_limit\fR to zero disables the client limit.
 /*
-/*	When the use count reaches the use limit, the process no longer
-/*	accepts new connections.  Once all existing clients disconnect the
-/*	process terminates.
-/*
 /*	The var_idle_limit variable limits the time that a service
 /*	receives no client connection requests before it commits suicide.
 /*	This value is taken from the global \fBmain.cf\fR configuration
@@ -241,6 +237,7 @@ void    multi_server_disconnect(VSTREAM *stream)
     event_disable_readwrite(vstream_fileno(stream));
     (void) vstream_fclose(stream);
     client_count--;
+    use_count++;
 }
 
 /* multi_server_execute - in case (char *) != (struct *) */
@@ -258,10 +255,10 @@ static void multi_server_execute(int unused_event, char *context)
      * Do not bother the application when the client disconnected.
      */
     if (peekfd(vstream_fileno(stream)) > 0) {
-	if (var_use_limit >= 0 && master_notify(var_pid, MASTER_STAT_TAKEN) < 0)
+	if (master_notify(var_pid, MASTER_STAT_TAKEN) < 0)
 	    multi_server_abort(EVENT_NULL_TYPE, EVENT_NULL_CONTEXT);
 	multi_server_service(stream, multi_server_name, multi_server_argv);
-	if (var_use_limit >= 0 && master_notify(var_pid, MASTER_STAT_AVAIL) < 0)
+	if (master_notify(var_pid, MASTER_STAT_AVAIL) < 0)
 	    multi_server_abort(EVENT_NULL_TYPE, EVENT_NULL_CONTEXT);
     } else {
 	multi_server_disconnect(stream);
@@ -291,7 +288,6 @@ static void multi_server_wakeup(int fd)
     non_blocking(fd, BLOCKING);
     close_on_exec(fd, CLOSE_ON_EXEC);
     client_count++;
-    use_count++;
     stream = vstream_fdopen(fd, O_RDWR);
     tmp = concatenate(multi_server_name, " socket", (char *) 0);
     vstream_control(stream, VSTREAM_CTL_PATH, tmp, VSTREAM_CTL_END);
@@ -682,43 +678,7 @@ NORETURN multi_server_main(int argc, char **argv, MULTI_SERVER_FN service,...)
     /*
      * The event loop, at last.
      */
-    for (;;) {
+    while (var_use_limit == 0 || use_count < var_use_limit || client_count > 0) {
-
-	/*
-	 * When the use count reaches the use limit, notify the master daemon
-	 * that we are no longer listening, close the listen sockets, and
-	 * dispose of the accept lock if any. A use_limit < 0 indicates that
-	 * the client limit was reached.
-	 */
-	if (var_use_limit > 0 && use_count >= var_use_limit) {
-	    if (msg_verbose)
-		msg_info("use limit reached -- closing listen socket");
-	    if (master_notify(var_pid, MASTER_STAT_TAKEN) < 0)
-		multi_server_abort(EVENT_NULL_TYPE, EVENT_NULL_CONTEXT);
-	    for (fd = MASTER_LISTEN_FD; fd < MASTER_LISTEN_FD + socket_count; fd++) {
-		event_disable_readwrite(fd);
-		(void) close(fd);
-	    }
-	    if (multi_server_lock != 0) {
-		(void) vstream_fclose(multi_server_lock);
-		multi_server_lock = 0;
-	    }
-	    var_use_limit = -1;
-	}
-
-	/*
-	 * Terminate if the client limit was reached and no connections remain.
-	 */
-	if (var_use_limit < 0 && client_count == 0) {
-	    if (msg_verbose)
-		msg_info("all clients disconnected -- exiting");
-	    break;
-	}
-
-	/*
-	 * Grab the optional accept lock, do some optional idle processing,
-	 * and wait for the next event.
-	 */
 	if (multi_server_lock != 0) {
 	    watchdog_stop(watchdog);
 	    if (myflock(vstream_fileno(multi_server_lock), INTERNAL_LOCK,

postfix/src/postqueue/postqueue.c

@@ -11,8 +11,11 @@
 /*	\fBpostqueue\fR [\fB-c \fIconfig_dir\fR] \fB-s \fIsite\fR
 /* DESCRIPTION
 /*	The \fBpostqueue\fR program implements the Postfix user interface
-/*	for queue management. It implements all the operations that are
+/*	for queue management. It implements operations that are
 /*	traditionally available via the \fBsendmail\fR(1) command.
+/*	See the \fBpostsuper\fR(1) command for queue operations
+/*	that require super-user privileges such as deleting a message
+/*	from the queue or changing the status of a message.
 /*
 /*	The following options are recognized:
 /* .IP "\fB-c \fIconfig_dir\fR"
@@ -94,7 +97,8 @@
 /*	specifies the domains that Postfix accepts in the SMTP \fBETRN\fR
 /*	request and in the \fBsendmail -qR\fR command.
 /* SEE ALSO
-/*	sendmail(8) sendmail-compatible user interface
+/*	sendmail(1) sendmail-compatible user interface
+/*	postsuper(1) privileged queue operations
 /*	qmgr(8) queue manager
 /*	showq(8) list mail queue
 /*	flush(8) fast flush service

postfix/src/postsuper/postsuper.c

@@ -12,6 +12,8 @@
 /* DESCRIPTION
 /*	The \fBpostsuper\fR command does maintenance jobs on the Postfix
 /*	queue. Use of the command is restricted to the superuser.
+/*	See the \fBpostqueue\fR command for unprivileged queue operations
+/*	such as listing or flushing the mail queue.
 /*
 /*	By default, \fBpostsuper\fR performs the operations requested with the
 /*	\fB-s\fR and \fB-p\fR command-line options on all Postfix queue
@@ -162,6 +164,9 @@
 /* .IP \fBhash_queue_names\fR
 /*	The names of queues that are organized into multiple levels of
 /*	subdirectories.
+/* SEE ALSO
+/*	sendmail(1) sendmail-compatible user interface
+/*	postqueue(1) unprivileged queue operations
 /* LICENSE
 /* .ad
 /* .fi

postfix/src/proxymap/proxymap.c

@@ -69,8 +69,8 @@
 /*	When all servers are busy while a client connects, the master
 /*	creates a new proxymap server process, provided that the proxymap
 /*	server process limit is not exceeded.
-/*	Each proxymap server stops accepting new connections after serving
+/*	Each proxymap server terminates after serving
-/*	\fB$max_use\fR clients or terminates after \fB$max_idle\fR seconds
+/*	at least \fB$max_use\fR clients or after \fB$max_idle\fR seconds
 /*	of idle time.
 /* SECURITY
 /* .ad
@@ -359,7 +359,8 @@ static void post_jail_init(char *unused_name, char **unused_argv)
 	do {
 	    type_name += PROXY_COLON_LEN;
 	} while (!strncmp(type_name, PROXY_COLON, PROXY_COLON_LEN));
-	if (htable_locate(proxy_read_maps, type_name) == 0)
+	if (strchr(type_name, ':') != 0
+	    && htable_locate(proxy_read_maps, type_name) == 0)
 	    (void) htable_enter(proxy_read_maps, type_name, (char *) 0);
     }
     myfree(saved_filter);

postfix/src/smtpd/smtpd_check.c

@@ -1758,6 +1758,10 @@ static int check_table_result(SMTPD_STATE *state, const char *table,
 	    msg_warn("access map %s entry %s has FILTER entry without value",
 		     table, datum);
 	    return (SMTPD_CHECK_DUNNO);
+	} else if (strchr(cmd_text, ':') == 0) {
+	    msg_warn("access map %s entry %s requires transport:destination",
+		     table, datum);
+	    return (SMTPD_CHECK_DUNNO);
 	} else {
 	    vstring_sprintf(error_text, "<%s>: %s triggers FILTER %s",
 			    reply_name, reply_class, cmd_text);

postfix/src/trivial-rewrite/transport.c

@@ -294,6 +294,8 @@ int     transport_lookup(const char *addr, const char *rcpt_domain,
     /*
      * Fall back to the wild-card entry.
      */
+    if (transport_errno) 
+	transport_wildcard_init();
     if (transport_errno) {
 	dict_errno = transport_errno;
 	RETURN_FREE(NOTFOUND);

postfix/src/trivial-rewrite/trivial-rewrite.c

@@ -65,8 +65,8 @@
 /*	When all servers are busy while a client connects, the master
 /*	creates a new server process, provided that the trivial-rewrite
 /*	server process limit is not exceeded.
-/*	Each trivial-rewrite server stops accepting new connections after
+/*	Each trivial-rewrite server terminates after
-/*	serving \fB$max_use\fR clients or terminates after \fB$max_idle\fR
+/*	serving at least \fB$max_use\fR clients of after \fB$max_idle\fR
 /*	seconds of idle time.
 /* STANDARDS
 /* .ad