From fef3bc167b2e9f22011f874a61bac7f89cf857bd Mon Sep 17 00:00:00 2001 From: Wietse Venema Date: Thu, 17 Jun 2010 00:00:00 -0500 Subject: [PATCH] postfix-2.8-20100617 --- postfix/.indent.pro | 2 + postfix/HISTORY | 19 + postfix/README_FILES/AAAREADME | 1 + postfix/README_FILES/DATABASE_README | 11 +- postfix/README_FILES/INSTALL | 36 +- postfix/README_FILES/SQLITE_README | 62 +++ postfix/conf/postfix-files | 4 + postfix/html/DATABASE_README.html | 8 +- postfix/html/INSTALL.html | 3 + postfix/html/Makefile.in | 6 +- postfix/html/SQLITE_README.html | 96 +++++ postfix/html/index.html | 2 + postfix/html/ldap_table.5.html | 593 +++++++++++++-------------- postfix/html/mysql_table.5.html | 188 +++++---- postfix/html/pgsql_table.5.html | 212 +++++----- postfix/html/postconf.1.html | 58 +-- postfix/html/postconf.5.html | 8 +- postfix/html/postfix-manuals.html | 2 + postfix/html/postfix.1.html | 1 + postfix/html/sqlite_table.5.html | 286 +++++++++++++ postfix/man/Makefile.in | 6 +- postfix/man/man1/postconf.1 | 3 + postfix/man/man1/postfix.1 | 1 + postfix/man/man5/ldap_table.5 | 10 +- postfix/man/man5/mysql_table.5 | 19 +- postfix/man/man5/pgsql_table.5 | 21 +- postfix/man/man5/postconf.5 | 8 +- postfix/man/man5/sqlite_table.5 | 304 ++++++++++++++ postfix/mantools/postlink | 1 + postfix/proto/DATABASE_README.html | 8 +- postfix/proto/INSTALL.html | 3 + postfix/proto/Makefile.in | 8 + postfix/proto/SQLITE_README.html | 96 +++++ postfix/proto/ldap_table | 10 +- postfix/proto/mysql_table | 19 +- postfix/proto/pgsql_table | 21 +- postfix/proto/postconf.proto | 8 +- postfix/proto/sqlite_table | 281 +++++++++++++ postfix/src/global/Makefile.in | 14 +- postfix/src/global/db_common.c | 4 +- postfix/src/global/dict_mysql.c | 32 +- postfix/src/global/dict_pgsql.c | 30 +- postfix/src/global/dict_sqlite.c | 303 ++++++++++++++ postfix/src/global/dict_sqlite.h | 32 ++ postfix/src/global/mail_dict.c | 4 + postfix/src/global/mail_version.h | 2 +- postfix/src/master/master.h | 1 + postfix/src/master/master_spawn.c | 21 +- postfix/src/postconf/postconf.c | 3 + postfix/src/postfix/postfix.c | 1 + postfix/src/util/vstring.c | 2 +- 51 files changed, 2198 insertions(+), 676 deletions(-) create mode 100644 postfix/README_FILES/SQLITE_README create mode 100644 postfix/html/SQLITE_README.html create mode 100644 postfix/html/sqlite_table.5.html create mode 100644 postfix/man/man5/sqlite_table.5 create mode 100644 postfix/proto/SQLITE_README.html create mode 100644 postfix/proto/sqlite_table create mode 100644 postfix/src/global/dict_sqlite.c create mode 100644 postfix/src/global/dict_sqlite.h diff --git a/postfix/.indent.pro b/postfix/.indent.pro index 5951928c3..bb92580f8 100644 --- a/postfix/.indent.pro +++ b/postfix/.indent.pro @@ -52,6 +52,7 @@ -TCRYPTO_EX_DATA -TCTABLE -TCTABLE_ENTRY +-TDB_COMMON_CTX -TDELIVERED_HDR_INFO -TDELIVER_ATTR -TDELIVER_REQUEST @@ -92,6 +93,7 @@ -TDICT_REGEXP_PRESCAN_CONTEXT -TDICT_REGEXP_RULE -TDICT_SDBM +-TDICT_SQLITE -TDICT_TCP -TDICT_UNIX -TDNS_FIXED diff --git a/postfix/HISTORY b/postfix/HISTORY index 9b544b285..4d6f411a0 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -15832,3 +15832,22 @@ Apologies for any names omitted. "tls_append_default_CA = yes". Files: tls/tls_certkey.c, tls/tls_misc.c, global/mail_params.h. proto/postconf.proto, mantools/postlink. + +20100615 + + Cleanup: the master no longer logs "process P killed with + signal S" when it shuts down a running service (for example, + the service is removed from master.cf, or the service is + disabled via the main.cf master_service_disable parameter). + File: master/master_spawn.c. + +20100617 + + Feature: read-only sqlite support based on code by Axel + Steiner and documentation by Jesus Garcia Crespo. Files: + conf/postfix-files, mantools/postlink, proto/DATABASE_README.html, + proto/Makefile.in, proto/INSTALL.html, proto/SASL_README.html, + proto/mysql_table, proto/pgsql_table, proto/sqlite_table, + proto/SQLITE_README.html, global/Makefile.in, global/mail_dict.c, + global/dict_sqlite.c, global/dict_sqlite.h, postconf/postconf.c, + postfix/postfix.c. diff --git a/postfix/README_FILES/AAAREADME b/postfix/README_FILES/AAAREADME index 2dd6cac2b..5e026eb6e 100644 --- a/postfix/README_FILES/AAAREADME +++ b/postfix/README_FILES/AAAREADME @@ -50,6 +50,7 @@ LLooookkuupp ttaabblleess ((ddaattaabbaasseess)) * MYSQL_README: MySQL Howto * PCRE_README: PCRE Howto * PGSQL_README: PostgreSQL Howto + * SQLITE_README: SQLite Howto MMaaiilliinngg lliisstt ssuuppppoorrtt diff --git a/postfix/README_FILES/DATABASE_README b/postfix/README_FILES/DATABASE_README index 46655f1b3..77d996a65 100644 --- a/postfix/README_FILES/DATABASE_README +++ b/postfix/README_FILES/DATABASE_README @@ -73,10 +73,10 @@ files have few surprises, and are easy to debug with the postmap(1) command: % ppoossttmmaapp --qq iinnffoo@@eexxaammppllee..ccoomm hhaasshh:://eettcc//ppoossttffiixx//vviirrttuuaall Once you have local files working properly you can follow the instructions in -ldap_table(5), mysql_table(5) or pgsql_table(5) and replace local file lookups -with LDAP or SQL lookups. When you do this, you should use the postmap(1) -command again, to verify that database lookups still produce the exact same -results as local file lookup: +ldap_table(5), mysql_table(5), pgsql_table(5) or sqlite_table(5) and replace +local file lookups with LDAP or SQL lookups. When you do this, you should use +the postmap(1) command again, to verify that database lookups still produce the +exact same results as local file lookup: % ppoossttmmaapp --qq iinnffoo@@eexxaammppllee..ccoomm llddaapp:://eettcc//ppoossttffiixx//vviirrttuuaall..ccff @@ -240,6 +240,9 @@ To find out what database types your Postfix system supports, use the "ppooss with the postmap(1) or postalias(1) command. The lookup table name as used in "sdbm:table" is the database file name without the ".dir" or ".pag" suffix. + ssqqlliittee (read-only) + Perform SQLite database lookups. Configuration details are given in + sqlite_table(5). ssttaattiicc (read-only) Always returns its lookup table name as lookup result. For example, the lookup table "static:foobar" always returns the string "foobar" as diff --git a/postfix/README_FILES/INSTALL b/postfix/README_FILES/INSTALL index 34cecbc9c..fde109409 100644 --- a/postfix/README_FILES/INSTALL +++ b/postfix/README_FILES/INSTALL @@ -157,23 +157,25 @@ whistles. Support for third-party databases etc. must be configured when Postfix is compiled. The following documents describe how to build Postfix with support for extensions: - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - |PPoossttffiixx eexxtteennssiioonn |DDooccuummeenntt |AAvvaaiillaabbiilliittyy| - |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | - |Berkeley DB database |DB_README |Postfix 1.0 | - |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | - |LDAP database |LDAP_README |Postfix 1.0 | - |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | - |MySQL database |MYSQL_README|Postfix 1.0 | - |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | - |Perl compatible regular expression|PCRE_README |Postfix 1.0 | - |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | - |PostgreSQL database |PGSQL_README|Postfix 2.0 | - |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | - |SASL authentication |SASL_README |Postfix 1.0 | - |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | - |STARTTLS session encryption |TLS_README |Postfix 2.2 | - |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ + |PPoossttffiixx eexxtteennssiioonn |DDooccuummeenntt |AAvvaaiillaabbiilliittyy| + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + |Berkeley DB database |DB_README |Postfix 1.0 | + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + |LDAP database |LDAP_README |Postfix 1.0 | + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + |MySQL database |MYSQL_README |Postfix 1.0 | + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + |Perl compatible regular expression|PCRE_README |Postfix 1.0 | + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + |PostgreSQL database |PGSQL_README |Postfix 2.0 | + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + |SASL authentication |SASL_README |Postfix 1.0 | + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + |SQLite database |SQLITE_README|Postfix 2.8 | + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | + |STARTTLS session encryption |TLS_README |Postfix 2.2 | + |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ | Note: IP version 6 support is compiled into Postfix on operating systems that have IPv6 support. See the IPV6_README file for details. diff --git a/postfix/README_FILES/SQLITE_README b/postfix/README_FILES/SQLITE_README new file mode 100644 index 000000000..9895c1f54 --- /dev/null +++ b/postfix/README_FILES/SQLITE_README @@ -0,0 +1,62 @@ +PPoossttffiixx SSQQLLiittee HHoowwttoo + +------------------------------------------------------------------------------- + +IInnttrroodduuccttiioonn + +The Postfix sqlite map type allows you to hook up Postfix to a SQLite database. +This implementation allows for multiple sqlite databases: you can use one for a +virtual(5) table, one for an access(5) table, and one for an aliases(5) table +if you want. + +BBuuiillddiinngg PPoossttffiixx wwiitthh SSQQLLiittee ssuuppppoorrtt + +The Postfix SQLite client utilizes the sqlite3 library, which can be obtained +from: + + http://www.sqlite.org/ + +In order to build Postfix with sqlite map support, you will need to add - +DHAS_SQLITE and -I for the directory containing the sqlite headers, and the +sqlite3 library to AUXLIBS, for example: + + make -f Makefile.init makefiles \ + 'CCARGS=-DHAS_SQLITE -I/usr/local/include' \ + 'AUXLIBS=-L/usr/local/lib -lsqlite3 -lpthread' + +Then, just run 'make'. + +UUssiinngg SSQQLLiittee ttaabblleess + +Once Postfix is built with sqlite support, you can specify a map type in +main.cf like this: + + alias_maps = sqlite:/etc/postfix/sqlite-aliases.cf + +The file /etc/postfix/sqlite-aliases.cf specifies lots of information telling +Postfix how to reference the sqlite database. For a complete description, see +the sqlite_table(5) manual page. + +EExxaammppllee:: llooccaall aalliiaasseess + +# +# sqlite config file for local(8) aliases(5) lookups +# + +# Path to database +dbpath = /some/path/to/sqlite_database + +# See sqlite_table(5) for details. +query = SELECT forw_addr FROM mxaliases WHERE alias='%s' AND status='paid' + +AAddddiittiioonnaall nnootteess + +The SQLite configuration interface setup allows for multiple sqlite databases: +you can use one for a virtual table, one for an access table, and one for an +aliases table if you want. + +CCrreeddiittss + + * Implementation by Axel Steiner + * Documentation by Jesus Garcia Crespo + diff --git a/postfix/conf/postfix-files b/postfix/conf/postfix-files index 3a603bc89..baccc02a6 100644 --- a/postfix/conf/postfix-files +++ b/postfix/conf/postfix-files @@ -166,6 +166,7 @@ $manpage_directory/man5/header_checks.5:f:root:-:644 $manpage_directory/man5/ldap_table.5:f:root:-:644 $manpage_directory/man5/master.5:f:root:-:644 $manpage_directory/man5/mysql_table.5:f:root:-:644 +$manpage_directory/man5/sqlite_table.5:f:root:-:644 $manpage_directory/man5/nisplus_table.5:f:root:-:644 $manpage_directory/man5/pcre_table.5:f:root:-:644 $manpage_directory/man5/pgsql_table.5:f:root:-:644 @@ -264,6 +265,7 @@ $readme_directory/MAILDROP_README:f:root:-:644 $readme_directory/MILTER_README:f:root:-:644 $readme_directory/MULTI_INSTANCE_README:f:root:-:644 $readme_directory/MYSQL_README:f:root:-:644 +$readme_directory/SQLITE_README:f:root:-:644 $readme_directory/NFS_README:f:root:-:644 $readme_directory/OVERVIEW:f:root:-:644 $readme_directory/PACKAGE_README:f:root:-:644 @@ -314,6 +316,7 @@ $html_directory/MAILDROP_README.html:f:root:-:644 $html_directory/MILTER_README.html:f:root:-:644 $html_directory/MULTI_INSTANCE_README.html:f:root:-:644 $html_directory/MYSQL_README.html:f:root:-:644 +$html_directory/SQLITE_README.html:f:root:-:644 $html_directory/NFS_README.html:f:root:-:644 $html_directory/OVERVIEW.html:f:root:-:644 $html_directory/PACKAGE_README.html:f:root:-:644 @@ -361,6 +364,7 @@ $html_directory/mailq.1.html:f:root:-:644 $html_directory/master.5.html:f:root:-:644 $html_directory/master.8.html:f:root:-:644 $html_directory/mysql_table.5.html:f:root:-:644 +$html_directory/sqlite_table.5.html:f:root:-:644 $html_directory/nisplus_table.5.html:f:root:-:644 $html_directory/newaliases.1.html:h:$html_directory/mailq.1.html:-:644 $html_directory/oqmgr.8.html:f:root:-:644 diff --git a/postfix/html/DATABASE_README.html b/postfix/html/DATABASE_README.html index 918ca7b86..ad42264fc 100644 --- a/postfix/html/DATABASE_README.html +++ b/postfix/html/DATABASE_README.html @@ -120,7 +120,8 @@ and are easy to debug with the postmap(1) command:

Once you have local files working properly you can follow the -instructions in ldap_table(5), mysql_table(5) or pgsql_table(5) +instructions in ldap_table(5), mysql_table(5), pgsql_table(5) +or sqlite_table(5) and replace local file lookups with LDAP or SQL lookups. When you do this, you should use the postmap(1) command again, to verify that database lookups still produce the exact same results as local @@ -358,6 +359,11 @@ created with the postmap(1) or +

sqlite (read-only)
+ +
Perform SQLite database lookups. Configuration details are given +in sqlite_table(5).
+
static (read-only)
Always returns its lookup table name as lookup result. For diff --git a/postfix/html/INSTALL.html b/postfix/html/INSTALL.html index 0e139ec9c..c51abab17 100644 --- a/postfix/html/INSTALL.html +++ b/postfix/html/INSTALL.html @@ -261,6 +261,9 @@ Postfix 2.0 SASL authentication SASL_README Postfix 1.0 + SQLite database SQLITE_README Postfix +2.8 + STARTTLS session encryption TLS_README Postfix 2.2 diff --git a/postfix/html/Makefile.in b/postfix/html/Makefile.in index e1d73f93a..cf439d3b6 100644 --- a/postfix/html/Makefile.in +++ b/postfix/html/Makefile.in @@ -21,7 +21,7 @@ CONFIG = access.5.html aliases.5.html canonical.5.html relocated.5.html \ cidr_table.5.html tcp_table.5.html header_checks.5.html \ ldap_table.5.html mysql_table.5.html pgsql_table.5.html \ master.5.html nisplus_table.5.html generic.5.html bounce.5.html \ - postfix-wrapper.5.html + postfix-wrapper.5.html sqlite_table.5.html OTHER = postfix-manuals.html AWK = awk '{ print; if (NR == 2) print ".pl 9999\n.ll 65" }' MAN2HTML = man2html -t "Postfix manual - `IFS=.; set \`echo $@\`; echo \"$$1($$2)\"`" @@ -272,6 +272,10 @@ mysql_table.5.html: ../proto/mysql_table PATH=../mantools:$$PATH; \ srctoman - $? | $(AWK) | nroff -man | uniq | $(MAN2HTML) | postlink >$@ +sqlite_table.5.html: ../proto/sqlite_table + PATH=../mantools:$$PATH; \ + srctoman - $? | $(AWK) | nroff -man | uniq | $(MAN2HTML) | postlink >$@ + nisplus_table.5.html: ../proto/nisplus_table PATH=../mantools:$$PATH; \ srctoman - $? | $(AWK) | nroff -man | uniq | $(MAN2HTML) | postlink >$@ diff --git a/postfix/html/SQLITE_README.html b/postfix/html/SQLITE_README.html new file mode 100644 index 000000000..c9147cef0 --- /dev/null +++ b/postfix/html/SQLITE_README.html @@ -0,0 +1,96 @@ + + + + + + +Postfix SQLite Howto + + + + + + + +

Postfix SQLite Howto

+ +
+ +

Introduction

+ +

The Postfix sqlite map type allows you to hook up Postfix to a +SQLite database. This implementation allows for multiple sqlite +databases: you can use one for a virtual(5) table, one for an +access(5) table, and one for an aliases(5) table if you want.

+ +

Building Postfix with SQLite support

+ +

The Postfix SQLite client utilizes the sqlite3 library, +which can be obtained from:

+ +
+

http://www.sqlite.org/

+
+ +

In order to build Postfix with sqlite map support, you will need to add +-DHAS_SQLITE and -I for the directory containing the sqlite headers, and +the sqlite3 library to AUXLIBS, for example:

+ +
+
+make -f Makefile.init makefiles \
+     'CCARGS=-DHAS_SQLITE -I/usr/local/include' \
+     'AUXLIBS=-L/usr/local/lib -lsqlite3 -lpthread'
+
+
+ +

Then, just run 'make'.

+ +

Using SQLite tables

+ +

Once Postfix is built with sqlite support, you can specify a +map type in main.cf like this:

+ +
+
+alias_maps = sqlite:/etc/postfix/sqlite-aliases.cf
+
+
+ +

The file /etc/postfix/sqlite-aliases.cf specifies lots of +information telling Postfix how to reference the sqlite database. +For a complete description, see the sqlite_table(5) manual page.

+ +

Example: local aliases

+ +
+#
+# sqlite config file for local(8) aliases(5) lookups
+#
+
+# Path to database 
+dbpath = /some/path/to/sqlite_database
+
+# See sqlite_table(5) for details.
+query = SELECT forw_addr FROM mxaliases WHERE alias='%s' AND status='paid'
+
+ +

Additional notes

+ +

The SQLite configuration interface setup allows for multiple +sqlite databases: you can use one for a virtual table, one for an +access table, and one for an aliases table if you want.

+ +

Credits

+ + + + + + diff --git a/postfix/html/index.html b/postfix/html/index.html index 0cd7f6d66..d17f762cd 100644 --- a/postfix/html/index.html +++ b/postfix/html/index.html @@ -136,6 +136,8 @@ Per-client/user/etc. access
  • PostgreSQL Howto +
  • SQLite Howto +

    Mailing list support

    diff --git a/postfix/html/ldap_table.5.html b/postfix/html/ldap_table.5.html index 1948ce898..d7d01d1a4 100644 --- a/postfix/html/ldap_table.5.html +++ b/postfix/html/ldap_table.5.html @@ -55,38 +55,31 @@ LDAP_TABLE(5) LDAP_TABLE(5) Support for this form will be removed in a future Postfix version. - Postfix 2.2 has enhanced query interfaces for MySQL and - PostgreSQL. These include features that were previously - available only in the Postfix LDAP client. This work also - created an opportunity for improvements in the LDAP inter- - face. The primary compatibility issue is that result_fil- - ter (a name that has caused some confusion as to its mean- - ing in the past) has been renamed to result_format. For - backwards compatibility with the pre 2.2 LDAP client, - result_filter can for now be used instead of result_for- - mat, when the latter parameter is not also set. The new - name better reflects the function of the parameter. This - compatibility interface may be removed in a future + For backwards compatibility with the pre 2.2 LDAP clients, + result_filter can for now be used instead of result_for- + mat, when the latter parameter is not also set. The new + name better reflects the function of the parameter. This + compatibility interface may be removed in a future release. LIST MEMBERSHIP - When using LDAP to store lists such as $mynetworks, + When using LDAP to store lists such as $mynetworks, $mydestination, $relay_domains, $local_recipient_maps, - etc., it is important to understand that the table must + etc., it is important to understand that the table must store each list member as a separate key. The table lookup - verifies the *existence* of the key. See "Postfix lists - versus tables" in the DATABASE_README document for a dis- + verifies the *existence* of the key. See "Postfix lists + versus tables" in the DATABASE_README document for a dis- cussion. - Do NOT create tables that return the full list of domains - in $mydestination or $relay_domains etc., or IP addresses + Do NOT create tables that return the full list of domains + in $mydestination or $relay_domains etc., or IP addresses in $mynetworks. DO create tables with each matching item as a key and with an arbitrary value. With LDAP databases it is not uncommon to return the key itself. - For example, NEVER do this in a map defining $mydestina- + For example, NEVER do this in a map defining $mydestina- tion: query_filter = domain=* @@ -98,21 +91,21 @@ LDAP_TABLE(5) LDAP_TABLE(5) result_attribute = domain GENERAL LDAP PARAMETERS - In the text below, default values are given in parenthe- + In the text below, default values are given in parenthe- ses. Note: don't use quotes in these variables; at least, - not until the Postfix configuration routines understand + not until the Postfix configuration routines understand how to deal with quoted strings. server_host (default: localhost) - The name of the host running the LDAP server, e.g. + The name of the host running the LDAP server, e.g. server_host = ldap.example.com - Depending on the LDAP client library you're using, - it should be possible to specify multiple servers - here, with the library trying them in order should - the first one fail. It should also be possible to - give each server in the list a different port + Depending on the LDAP client library you're using, + it should be possible to specify multiple servers + here, with the library trying them in order should + the first one fail. It should also be possible to + give each server in the list a different port (overriding server_port below), by naming them like server_host = ldap.example.com:1444 @@ -123,9 +116,9 @@ LDAP_TABLE(5) LDAP_TABLE(5) server_host = ldap://ldap.example.com:1444 ldap://ldap2.example.com:1444 - All LDAP URLs accepted by the OpenLDAP library are - supported, including connections over UNIX domain - sockets, and LDAP SSL (the last one provided that + All LDAP URLs accepted by the OpenLDAP library are + supported, including connections over UNIX domain + sockets, and LDAP SSL (the last one provided that OpenLDAP was compiled with support for SSL): server_host = ldapi://%2Fsome%2Fpath @@ -148,91 +141,38 @@ LDAP_TABLE(5) LDAP_TABLE(5) search_base = dc=your, dc=com - With Postfix 2.2 and later this parameter supports + With Postfix 2.2 and later this parameter supports the following '%' expansions: %% This is replaced by a literal '%' character. %s This is replaced by the input key. RFC 2253 - quoting is used to make sure that the input - key does not add unexpected metacharacters. + quoting is used to make sure that the input + key does not add unexpected metacharacters. %u When the input key is an address of the form - user@domain, %u is replaced by the (RFC - 2253) quoted local part of the address. - Otherwise, %u is replaced by the entire - search string. If the localpart is empty, - the search is suppressed and returns no + user@domain, %u is replaced by the (RFC + 2253) quoted local part of the address. + Otherwise, %u is replaced by the entire + search string. If the localpart is empty, + the search is suppressed and returns no results. %d When the input key is an address of the form - user@domain, %d is replaced by the (RFC - 2253) quoted domain part of the address. + user@domain, %d is replaced by the (RFC + 2253) quoted domain part of the address. Otherwise, the search is suppressed and returns no results. - %[SUD] For the search_base parameter, the upper- - case equivalents of the above expansions - behave identically to their lower-case + %[SUD] For the search_base parameter, the upper- + case equivalents of the above expansions + behave identically to their lower-case counter-parts. With the result_format param- - eter (previously called result_filter see - the COMPATIBILITY section and below), they - expand to the corresponding components of + eter (previously called result_filter see + the COMPATIBILITY section and below), they + expand to the corresponding components of input key rather than the result value. - %[1-9] The patterns %1, %2, ... %9 are replaced by - the corresponding most significant component - of the input key's domain. If the input key - is user@mail.example.com, then %1 is com, %2 - is example and %3 is mail. If the input key - is unqualified or does not have enough - domain components to satisfy all the speci- - fied patterns, the search is suppressed and - returns no results. - - query_filter (default: mailacceptinggeneralid=%s) - The RFC2254 filter used to search the directory, - where %s is a substitute for the address Postfix is - trying to resolve, e.g. - - query_filter = (&(mail=%s)(paid_up=true)) - - This parameter supports the following '%' expan- - sions: - - %% This is replaced by a literal '%' character. - (Postfix 2.2 and later). - - %s This is replaced by the input key. RFC 2254 - quoting is used to make sure that the input - key does not add unexpected metacharacters. - - %u When the input key is an address of the form - user@domain, %u is replaced by the (RFC - 2254) quoted local part of the address. - Otherwise, %u is replaced by the entire - search string. If the localpart is empty, - the search is suppressed and returns no - results. - - %d When the input key is an address of the form - user@domain, %d is replaced by the (RFC - 2254) quoted domain part of the address. - Otherwise, the search is suppressed and - returns no results. - - %[SUD] The upper-case equivalents of the above - expansions behave in the query_filter param- - eter identically to their lower-case - counter-parts. With the result_format param- - eter (previously called result_filter see - the COMPATIBILITY section and below), they - expand to the corresponding components of - input key rather than the result value. - - The above %S, %U and %D expansions are - available with Postfix 2.2 and later. - %[1-9] The patterns %1, %2, ... %9 are replaced by the corresponding most significant component of the input key's domain. If the input key @@ -243,206 +183,222 @@ LDAP_TABLE(5) LDAP_TABLE(5) fied patterns, the search is suppressed and returns no results. - The above %1, ..., %9 expansions are avail- + query_filter (default: mailacceptinggeneralid=%s) + The RFC2254 filter used to search the directory, + where %s is a substitute for the address Postfix is + trying to resolve, e.g. + + query_filter = (&(mail=%s)(paid_up=true)) + + This parameter supports the following '%' expan- + sions: + + %% This is replaced by a literal '%' character. + (Postfix 2.2 and later). + + %s This is replaced by the input key. RFC 2254 + quoting is used to make sure that the input + key does not add unexpected metacharacters. + + %u When the input key is an address of the form + user@domain, %u is replaced by the (RFC + 2254) quoted local part of the address. + Otherwise, %u is replaced by the entire + search string. If the localpart is empty, + the search is suppressed and returns no + results. + + %d When the input key is an address of the form + user@domain, %d is replaced by the (RFC + 2254) quoted domain part of the address. + Otherwise, the search is suppressed and + returns no results. + + %[SUD] The upper-case equivalents of the above + expansions behave in the query_filter param- + eter identically to their lower-case + counter-parts. With the result_format param- + eter (previously called result_filter see + the COMPATIBILITY section and below), they + expand to the corresponding components of + input key rather than the result value. + + The above %S, %U and %D expansions are + available with Postfix 2.2 and later. + + %[1-9] The patterns %1, %2, ... %9 are replaced by + the corresponding most significant component + of the input key's domain. If the input key + is user@mail.example.com, then %1 is com, %2 + is example and %3 is mail. If the input key + is unqualified or does not have enough + domain components to satisfy all the speci- + fied patterns, the search is suppressed and + returns no results. + + The above %1, ..., %9 expansions are avail- able with Postfix 2.2 and later. - The "domain" parameter described below limits the - input keys to addresses in matching domains. When - the "domain" parameter is non-empty, LDAP queries - for unqualified addresses or addresses in non- + The "domain" parameter described below limits the + input keys to addresses in matching domains. When + the "domain" parameter is non-empty, LDAP queries + for unqualified addresses or addresses in non- matching domains are suppressed and return no results. - NOTE: DO NOT put quotes around the query_filter + NOTE: DO NOT put quotes around the query_filter parameter. result_format (default: %s) - Called result_filter in Postfix releases prior to + Called result_filter in Postfix releases prior to 2.2. Format template applied to result attributes. - Most commonly used to append (or prepend) text to - the result. This parameter supports the following + Most commonly used to append (or prepend) text to + the result. This parameter supports the following '%' expansions: %% This is replaced by a literal '%' character. (Postfix 2.2 and later). - %s This is replaced by the value of the result - attribute. When result is empty it is + %s This is replaced by the value of the result + attribute. When result is empty it is skipped. - %u When the result attribute value is an + %u When the result attribute value is an address of the form user@domain, %u is - replaced by the local part of the address. + replaced by the local part of the address. When the result has an empty localpart it is skipped. - %d When a result attribute value is an address - of the form user@domain, %d is replaced by + %d When a result attribute value is an address + of the form user@domain, %d is replaced by the domain part of the attribute value. When the result is unqualified it is skipped. %[SUD1-9] - The upper-case and decimal digit expansions + The upper-case and decimal digit expansions interpolate the parts of the input key - rather than the result. Their behavior is - identical to that described with query_fil- - ter, and in fact because the input key is + rather than the result. Their behavior is + identical to that described with query_fil- + ter, and in fact because the input key is known in advance, lookups whose key does not contain all the information specified in the result template are suppressed and return no results. - The above %S, %U, %D and %1, ..., %9 expan- - sions are available with Postfix 2.2 and + The above %S, %U, %D and %1, ..., %9 expan- + sions are available with Postfix 2.2 and later. For example, using "result_format = smtp:[%s]" allows one to use a mailHost attribute as the basis - of a transport(5) table. After applying the result - format, multiple values are concatenated as comma - separated strings. The expansion_limit and - size_limit parameters explained below allow one to - restrict the number of values in the result, which - is especially useful for maps that should return a + of a transport(5) table. After applying the result + format, multiple values are concatenated as comma + separated strings. The expansion_limit and + size_limit parameters explained below allow one to + restrict the number of values in the result, which + is especially useful for maps that should return a single value. - The default value %s specifies that each attribute + The default value %s specifies that each attribute value should be used as is. - This parameter was called result_filter in Postfix - releases prior to 2.2. If no "result_format" is - specified, the value of "result_filter" will be + This parameter was called result_filter in Postfix + releases prior to 2.2. If no "result_format" is + specified, the value of "result_filter" will be used instead before resorting to the default value. - This provides compatibility with old configuration + This provides compatibility with old configuration files. NOTE: DO NOT put quotes around the result format! domain (default: no domain list) - This is a list of domain names, paths to files, or - dictionaries. When specified, only fully qualified - search keys with a *non-empty* localpart and a - matching domain are eligible for lookup: 'user' - lookups, bare domain lookups and "@domain" lookups - are not performed. This can significantly reduce + This is a list of domain names, paths to files, or + dictionaries. When specified, only fully qualified + search keys with a *non-empty* localpart and a + matching domain are eligible for lookup: 'user' + lookups, bare domain lookups and "@domain" lookups + are not performed. This can significantly reduce the query load on the LDAP server. domain = postfix.org, hash:/etc/postfix/searchdomains - It is best not to use LDAP to store the domains + It is best not to use LDAP to store the domains eligible for LDAP lookups. - NOTE: DO NOT define this parameter for local(8) + NOTE: DO NOT define this parameter for local(8) aliases. This feature is available in Postfix 1.0 and later. result_attribute (default: maildrop) - The attribute(s) Postfix will read from any direc- + The attribute(s) Postfix will read from any direc- tory entries returned by the lookup, to be resolved to an email address. result_attribute = mailbox, maildrop - Don't rely on the default value ("maildrop"). Set - the result_attribute explicitly in all ldap table - configuration files. This is particularly relevant - when no result_attribute is applicable, e.g. cases - in which leaf_result_attribute and/or termi- - nal_result_attribute are used instead. The default + Don't rely on the default value ("maildrop"). Set + the result_attribute explicitly in all ldap table + configuration files. This is particularly relevant + when no result_attribute is applicable, e.g. cases + in which leaf_result_attribute and/or termi- + nal_result_attribute are used instead. The default value is harmless if "maildrop" is also listed as a - leaf or terminal result attribute, but it is best + leaf or terminal result attribute, but it is best to not leave this to chance. special_result_attribute (default: empty) The attribute(s) of directory entries that can con- - tain DNs or RFC 2255 LDAP URLs. If found, a recur- + tain DNs or RFC 2255 LDAP URLs. If found, a recur- sive search is performed to retrieve the entry ref- - erenced by the DN, or the entries matched by the + erenced by the DN, or the entries matched by the URL query. special_result_attribute = memberdn - DN recursion retrieves the same result_attributes + DN recursion retrieves the same result_attributes as the main query, including the special attributes for further recursion. URL processing retrieves only those attributes that - are included in both the URL definition and as - result attributes (ordinary, special, leaf or ter- + are included in both the URL definition and as + result attributes (ordinary, special, leaf or ter- minal) in the Postfix table definition. If the URL lists any of the table's special result attributes, - these are retrieved and used recursively. A URL - that does not specify any attribute selection, is - equivalent (RFC 2255) to a URL that selects all - attributes, in which case the selected attributes - will be the full set of result attributes in the + these are retrieved and used recursively. A URL + that does not specify any attribute selection, is + equivalent (RFC 2255) to a URL that selects all + attributes, in which case the selected attributes + will be the full set of result attributes in the Postfix table. - If an LDAP URL attribute-descriptor or the corre- - sponding Postfix LDAP table result attribute (but - not both) uses RFC 2255 sub-type options - ("attr;option"), the attribute requested from the - LDAP server will include the sub-type option. In - all other cases, the URL attribute and the table - attribute must match exactly. Attributes with - options in both the URL and the Postfix table are + If an LDAP URL attribute-descriptor or the corre- + sponding Postfix LDAP table result attribute (but + not both) uses RFC 2255 sub-type options + ("attr;option"), the attribute requested from the + LDAP server will include the sub-type option. In + all other cases, the URL attribute and the table + attribute must match exactly. Attributes with + options in both the URL and the Postfix table are requested only when the options are identical. LDAP - attribute-descriptor options are very rarely used, + attribute-descriptor options are very rarely used, most LDAP users will not need to concern themselves with this level of nuanced detail. terminal_result_attribute (default: empty) - When one or more terminal result attributes are + When one or more terminal result attributes are found in an LDAP entry, all other result attributes are ignored and only the terminal result attributes - are returned. This is useful for delegating expan- - sion of group members to a particular host, by - using an optional "maildrop" attribute on selected + are returned. This is useful for delegating expan- + sion of group members to a particular host, by + using an optional "maildrop" attribute on selected groups to route the group to a specific host, where - the group is expanded, possibly via mailing-list + the group is expanded, possibly via mailing-list manager or other special processing. result_attribute = terminal_result_attribute = maildrop - When using terminal and/or leaf result attributes, - the result_attribute is best set to an empty value - when it is not used, or else explicitly set to the - desired value, even if it is the default value - "maildrop". - - This feature is available with Postfix 2.4 or - later. - - leaf_result_attribute (default: empty) - When one or more special result attributes are - found in a non-terminal (see above) LDAP entry, - leaf result attributes are excluded from the expan- - sion of that entry. This is useful when expanding - groups and the desired mail address attribute(s) of - the member objects obtained via DN or URI recursion - are also present in the group object. To only - return the attribute values from the leaf objects - and not the containing group, add the attribute to - the leaf_result_attribute list, and not the - result_attribute list, which is always expanded. - Note, the default value of "result_attribute" is - not empty, you may want to set it explicitly empty - when using "leaf_result_attribute" to expand the - group to a list of member DN addresses. If groups - have both member DN references AND attributes that - hold multiple string valued rfc822 addresses, then - the string attributes go in "result_attribute". - The attributes that represent the email addresses - of objects referenced via a DN (or LDAP URI) go in - "leaf_result_attribute". - - result_attribute = memberaddr - special_result_attribute = memberdn - terminal_result_attribute = maildrop - leaf_result_attribute = mail - When using terminal and/or leaf result attributes, the result_attribute is best set to an empty value when it is not used, or else explicitly set to the @@ -452,39 +408,76 @@ LDAP_TABLE(5) LDAP_TABLE(5) This feature is available with Postfix 2.4 or later. + leaf_result_attribute (default: empty) + When one or more special result attributes are + found in a non-terminal (see above) LDAP entry, + leaf result attributes are excluded from the expan- + sion of that entry. This is useful when expanding + groups and the desired mail address attribute(s) of + the member objects obtained via DN or URI recursion + are also present in the group object. To only + return the attribute values from the leaf objects + and not the containing group, add the attribute to + the leaf_result_attribute list, and not the + result_attribute list, which is always expanded. + Note, the default value of "result_attribute" is + not empty, you may want to set it explicitly empty + when using "leaf_result_attribute" to expand the + group to a list of member DN addresses. If groups + have both member DN references AND attributes that + hold multiple string valued rfc822 addresses, then + the string attributes go in "result_attribute". + The attributes that represent the email addresses + of objects referenced via a DN (or LDAP URI) go in + "leaf_result_attribute". + + result_attribute = memberaddr + special_result_attribute = memberdn + terminal_result_attribute = maildrop + leaf_result_attribute = mail + + When using terminal and/or leaf result attributes, + the result_attribute is best set to an empty value + when it is not used, or else explicitly set to the + desired value, even if it is the default value + "maildrop". + + This feature is available with Postfix 2.4 or + later. + scope (default: sub) - The LDAP search scope: sub, base, or one. These + The LDAP search scope: sub, base, or one. These translate into LDAP_SCOPE_SUBTREE, LDAP_SCOPE_BASE, and LDAP_SCOPE_ONELEVEL. bind (default: yes) - Whether or not to bind to the LDAP server. Newer + Whether or not to bind to the LDAP server. Newer LDAP implementations don't require clients to bind, which saves time. Example: bind = no - If you do need to bind, you might consider config- - uring Postfix to connect to the local machine on a - port that's an SSL tunnel to your LDAP server. If - your LDAP server doesn't natively support SSL, put + If you do need to bind, you might consider config- + uring Postfix to connect to the local machine on a + port that's an SSL tunnel to your LDAP server. If + your LDAP server doesn't natively support SSL, put a tunnel (wrapper, proxy, whatever you want to call - it) on that system too. This should prevent the - password from traversing the network in the clear. + it) on that system too. This should prevent the + password from traversing the network in the clear. bind_dn (default: empty) - If you do have to bind, do it with this distin- + If you do have to bind, do it with this distin- guished name. Example: bind_dn = uid=postfix, dc=your, dc=com bind_pw (default: empty) - The password for the distinguished name above. If + The password for the distinguished name above. If you have to use this, you probably want to make the map configuration file readable only by the Postfix - user. When using the obsolete ldap:ldapsource syn- + user. When using the obsolete ldap:ldapsource syn- tax, with map parameters in main.cf, it is not pos- - sible to securely store the bind password. This is + sible to securely store the bind password. This is because main.cf needs to be world readable to allow local accounts to submit mail via the sendmail com- mand. Example: @@ -496,43 +489,43 @@ LDAP_TABLE(5) LDAP_TABLE(5) cache_expiry (IGNORED with a warning) cache_size (IGNORED with a warning) - The above parameters are NO LONGER SUPPORTED by + The above parameters are NO LONGER SUPPORTED by Postfix. Cache support has been dropped from OpenLDAP as of release 2.1.13. recursion_limit (default: 1000) - A limit on the nesting depth of DN and URL special - result attribute evaluation. The limit must be a + A limit on the nesting depth of DN and URL special + result attribute evaluation. The limit must be a non-zero positive number. expansion_limit (default: 0) - A limit on the total number of result elements - returned (as a comma separated list) by a lookup - against the map. A setting of zero disables the - limit. Lookups fail with a temporary error if the - limit is exceeded. Setting the limit to 1 ensures + A limit on the total number of result elements + returned (as a comma separated list) by a lookup + against the map. A setting of zero disables the + limit. Lookups fail with a temporary error if the + limit is exceeded. Setting the limit to 1 ensures that lookups do not return multiple values. size_limit (default: $expansion_limit) - A limit on the number of LDAP entries returned by - any single LDAP search performed as part of the - lookup. A setting of 0 disables the limit. Expan- - sion of DN and URL references involves nested LDAP - queries, each of which is separately subjected to + A limit on the number of LDAP entries returned by + any single LDAP search performed as part of the + lookup. A setting of 0 disables the limit. Expan- + sion of DN and URL references involves nested LDAP + queries, each of which is separately subjected to this limit. - Note: even a single LDAP entry can generate multi- - ple lookup results, via multiple result attributes - and/or multi-valued result attributes. This limit - caps the per search resource utilization on the - LDAP server, not the final multiplicity of the - lookup result. It is analogous to the "-z" option + Note: even a single LDAP entry can generate multi- + ple lookup results, via multiple result attributes + and/or multi-valued result attributes. This limit + caps the per search resource utilization on the + LDAP server, not the final multiplicity of the + lookup result. It is analogous to the "-z" option of "ldapsearch". dereference (default: 0) - When to dereference LDAP aliases. (Note that this + When to dereference LDAP aliases. (Note that this has nothing do with Postfix aliases.) The permitted - values are those legal for the OpenLDAP/UM LDAP + values are those legal for the OpenLDAP/UM LDAP implementations: 0 never @@ -544,28 +537,28 @@ LDAP_TABLE(5) LDAP_TABLE(5) 3 always See ldap.h or the ldap_open(3) or ldapsearch(1) man - pages for more information. And if you're using an + pages for more information. And if you're using an LDAP package that has other possible values, please - bring it to the attention of the postfix- + bring it to the attention of the postfix- users@postfix.org mailing list. chase_referrals (default: 0) - Sets (or clears) LDAP_OPT_REFERRALS (requires LDAP + Sets (or clears) LDAP_OPT_REFERRALS (requires LDAP version 3 support). version (default: 2) Specifies the LDAP protocol version to use. debuglevel (default: 0) - What level to set for debugging in the OpenLDAP + What level to set for debugging in the OpenLDAP libraries. LDAP SSL AND STARTTLS PARAMETERS - If you're using the OpenLDAP libraries compiled with SSL - support, Postfix can connect to LDAP SSL servers and can + If you're using the OpenLDAP libraries compiled with SSL + support, Postfix can connect to LDAP SSL servers and can issue the STARTTLS command. - LDAP SSL service can be requested by using a LDAP SSL URL + LDAP SSL service can be requested by using a LDAP SSL URL in the server_host parameter: server_host = ldaps://ldap.example.com:636 @@ -574,82 +567,82 @@ LDAP_TABLE(5) LDAP_TABLE(5) start_tls = yes - Both forms require LDAP protocol version 3, which has to + Both forms require LDAP protocol version 3, which has to be set explicitly with: version = 3 If any of the Postfix programs querying the map is config- - ured in master.cf to run chrooted, all the certificates + ured in master.cf to run chrooted, all the certificates and keys involved have to be copied to the chroot jail. Of - course, the private keys should only be readable by the + course, the private keys should only be readable by the user "postfix". - The following parameters are relevant to LDAP SSL and + The following parameters are relevant to LDAP SSL and STARTTLS: start_tls (default: no) Whether or not to issue STARTTLS upon connection to - the server. Don't set this with LDAP SSL (the SSL + the server. Don't set this with LDAP SSL (the SSL session is setup automatically when the TCP connec- tion is opened). - tls_ca_cert_dir (No default; set either this or + tls_ca_cert_dir (No default; set either this or tls_ca_cert_file) Directory containing X509 Certificate Authority - certificates in PEM format which are to be recog- - nized by the client in SSL/TLS connections. The - files each contain one CA certificate. The files - are looked up by the CA subject name hash value, - which must hence be available. If more than one CA - certificate with the same name hash value exist, - the extension must be different (e.g. 9d66eef0.0, - 9d66eef0.1 etc). The search is performed in the - ordering of the extension number, regardless of + certificates in PEM format which are to be recog- + nized by the client in SSL/TLS connections. The + files each contain one CA certificate. The files + are looked up by the CA subject name hash value, + which must hence be available. If more than one CA + certificate with the same name hash value exist, + the extension must be different (e.g. 9d66eef0.0, + 9d66eef0.1 etc). The search is performed in the + ordering of the extension number, regardless of other properties of the certificates. Use the c_rehash utility (from the OpenSSL distribution) to create the necessary links. - tls_ca_cert_file (No default; set either this or + tls_ca_cert_file (No default; set either this or tls_ca_cert_dir) File containing the X509 Certificate Authority cer- - tificates in PEM format which are to be recognized - by the client in SSL/TLS connections. This setting + tificates in PEM format which are to be recognized + by the client in SSL/TLS connections. This setting takes precedence over tls_ca_cert_dir. tls_cert (No default; you must set this) - File containing client's X509 certificate to be + File containing client's X509 certificate to be used by the client in SSL/ TLS connections. tls_key (No default; you must set this) - File containing the private key corresponding to + File containing the private key corresponding to the above tls_cert. tls_require_cert (default: no) Whether or not to request server's X509 certificate - and check its validity when establishing SSL/TLS - connections. The supported values are no and yes. + and check its validity when establishing SSL/TLS + connections. The supported values are no and yes. - With no, the server certificate trust chain is not - checked, but with OpenLDAP prior to 2.1.13, the + With no, the server certificate trust chain is not + checked, but with OpenLDAP prior to 2.1.13, the name in the server certificate must still match the LDAP server name. With OpenLDAP 2.0.0 to 2.0.11 the - server name is not necessarily what you specified, - rather it is determined (by reverse lookup) from - the IP address of the LDAP server connection. With - OpenLDAP prior to 2.0.13, subjectAlternativeName + server name is not necessarily what you specified, + rather it is determined (by reverse lookup) from + the IP address of the LDAP server connection. With + OpenLDAP prior to 2.0.13, subjectAlternativeName extensions in the LDAP server certificate are - ignored: the server name must match the subject + ignored: the server name must match the subject CommonName. The no setting corresponds to the never - value of TLS_REQCERT in LDAP client configuration + value of TLS_REQCERT in LDAP client configuration files. - Don't use TLS with OpenLDAP 2.0.x (and especially + Don't use TLS with OpenLDAP 2.0.x (and especially with x <= 11) if you can avoid it. - With yes, the server certificate must be issued by - a trusted CA, and not be expired. The LDAP server - name must match one of the name(s) found in the + With yes, the server certificate must be issued by + a trusted CA, and not be expired. The LDAP server + name must match one of the name(s) found in the certificate (see above for OpenLDAP library version dependent behavior). The yes setting corresponds to the demand value of TLS_REQCERT in LDAP client con- @@ -657,27 +650,27 @@ LDAP_TABLE(5) LDAP_TABLE(5) The "try" and "never" values of TLS_REQCERT have no equivalents here. They are not available with - OpenLDAP 2.0, and in any case have questionable - security properties. Either you want TLS verified + OpenLDAP 2.0, and in any case have questionable + security properties. Either you want TLS verified LDAP connections, or you don't. The yes value only works correctly with Postfix 2.5 - and later, or with OpenLDAP 2.0. Earlier Postfix - releases or later OpenLDAP releases don't work - together with this setting. Support for LDAP over - TLS was added to Postfix based on the OpenLDAP 2.0 + and later, or with OpenLDAP 2.0. Earlier Postfix + releases or later OpenLDAP releases don't work + together with this setting. Support for LDAP over + TLS was added to Postfix based on the OpenLDAP 2.0 API. tls_random_file (No default) - Path of a file to obtain random bits from when - /dev/[u]random is not available, to be used by the + Path of a file to obtain random bits from when + /dev/[u]random is not available, to be used by the client in SSL/TLS connections. tls_cipher_suite (No default) Cipher suite to use in SSL/TLS negotiations. EXAMPLE - Here's a basic example for using LDAP to look up local(8) + Here's a basic example for using LDAP to look up local(8) aliases. Assume that in main.cf, you have: alias_maps = hash:/etc/aliases, @@ -688,14 +681,14 @@ LDAP_TABLE(5) LDAP_TABLE(5) server_host = ldap.example.com search_base = dc=example, dc=com - Upon receiving mail for a local address "ldapuser" that - isn't found in the /etc/aliases database, Postfix will + Upon receiving mail for a local address "ldapuser" that + isn't found in the /etc/aliases database, Postfix will search the LDAP server listening at port 389 on ldap.exam- - ple.com. It will bind anonymously, search for any direc- - tory entries whose mailacceptinggeneralid attribute is + ple.com. It will bind anonymously, search for any direc- + tory entries whose mailacceptinggeneralid attribute is "ldapuser", read the "maildrop" attributes of those found, and build a list of their maildrops, which will be treated - as RFC822 addresses to which the message will be deliv- + as RFC822 addresses to which the message will be deliv- ered. SEE ALSO @@ -709,13 +702,13 @@ LDAP_TABLE(5) LDAP_TABLE(5) LDAP_README, Postfix LDAP client guide LICENSE - The Secure Mailer license must be distributed with this + The Secure Mailer license must be distributed with this software. AUTHOR(S) - Carsten Hoeger, Hery Rakotoarisoa, John Hensley, Keith - Stevenson, LaMont Jones, Liviu Daia, Manuel Guesdon, Mike - Mattice, Prabhat K Singh, Sami Haahtinen, Samuel Tardieu, + Carsten Hoeger, Hery Rakotoarisoa, John Hensley, Keith + Stevenson, LaMont Jones, Liviu Daia, Manuel Guesdon, Mike + Mattice, Prabhat K Singh, Sami Haahtinen, Samuel Tardieu, Victor Duchovni, and many others. LDAP_TABLE(5) diff --git a/postfix/html/mysql_table.5.html b/postfix/html/mysql_table.5.html index 29a765f35..0093226cb 100644 --- a/postfix/html/mysql_table.5.html +++ b/postfix/html/mysql_table.5.html @@ -44,16 +44,13 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) Support for this form will be removed in a future Postfix version. - Postfix 2.2 has enhanced query interfaces for MySQL and - PostgreSQL; these include features previously available - only in the Postfix LDAP client. In the new interface the - SQL query is specified via a single query parameter - (described in more detail below). When the new query - parameter is not specified in the map definition, Postfix - reverts to the old interface, with the SQL query con- - structed from the select_field, table, where_field and - additional_conditions parameters. The old interface will - be gradually phased out. To migrate to the new interface + Normally, the SQL query is specified via a single query + parameter (described in more detail below). When this + parameter is not specified in the map definition, Postfix + reverts to an older interface, with the SQL query con- + structed from the select_field, table, where_field and + additional_conditions parameters. The old interface will + be gradually phased out. To migrate to the new interface set: query = SELECT [select_field] @@ -61,42 +58,42 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) WHERE [where_field] = '%s' [additional_conditions] - Insert the value, not the name, of each legacy parameter. - Note that the additional_conditions parameter is optional + Insert the value, not the name, of each legacy parameter. + Note that the additional_conditions parameter is optional and if not empty, will always start with AND. LIST MEMBERSHIP When using SQL to store lists such as $mynetworks, $mydes- - tination, $relay_domains, $local_recipient_maps, etc., it - is important to understand that the table must store each - list member as a separate key. The table lookup verifies - the *existence* of the key. See "Postfix lists versus - tables" in the DATABASE_README document for a discussion. + tination, $relay_domains, $local_recipient_maps, etc., it + is important to understand that the table must store each + list member as a separate key. The table lookup verifies + the *existence* of the key. See "Postfix lists versus + tables" in the DATABASE_README document for a discussion. - Do NOT create tables that return the full list of domains - in $mydestination or $relay_domains etc., or IP addresses + Do NOT create tables that return the full list of domains + in $mydestination or $relay_domains etc., or IP addresses in $mynetworks. DO create tables with each matching item as a key and with - an arbitrary value. With SQL databases it is not uncommon + an arbitrary value. With SQL databases it is not uncommon to return the key itself or a constant value. MYSQL PARAMETERS - hosts The hosts that Postfix will try to connect to and + hosts The hosts that Postfix will try to connect to and query from. Specify unix: for UNIX domain sockets, inet: for TCP connections (default). Example: hosts = host1.some.domain host2.some.domain hosts = unix:/file/name - The hosts are tried in random order, with all con- + The hosts are tried in random order, with all con- nections over UNIX domain sockets being tried - before those over TCP. The connections are auto- - matically closed after being idle for about 1 - minute, and are re-opened as necessary. Postfix - versions 2.0 and earlier do not randomize the host + before those over TCP. The connections are auto- + matically closed after being idle for about 1 + minute, and are re-opened as necessary. Postfix + versions 2.0 and earlier do not randomize the host order. - NOTE: if you specify localhost as a hostname (even + NOTE: if you specify localhost as a hostname (even if you prefix it with inet:), MySQL will connect to the default UNIX domain socket. In order to instruct MySQL to connect to localhost over TCP you @@ -104,7 +101,7 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) hosts = 127.0.0.1 user, password - The user name and password to log into the mysql + The user name and password to log into the mysql server. Example: user = someone password = some_password @@ -117,55 +114,55 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) trying to resolve, e.g. query = SELECT replacement FROM aliases WHERE mailbox = '%s' - This parameter supports the following '%' expan- + This parameter supports the following '%' expan- sions: %% This is replaced by a literal '%' character. - %s This is replaced by the input key. SQL - quoting is used to make sure that the input - key does not add unexpected metacharacters. + %s This is replaced by the input key. SQL + quoting is used to make sure that the input + key does not add unexpected metacharacters. %u When the input key is an address of the form user@domain, %u is replaced by the SQL - quoted local part of the address. Other- - wise, %u is replaced by the entire search - string. If the localpart is empty, the - query is suppressed and returns no results. + quoted local part of the address. Other- + wise, %u is replaced by the entire search + string. If the localpart is empty, the + query is suppressed and returns no results. %d When the input key is an address of the form user@domain, %d is replaced by the SQL - quoted domain part of the address. Other- + quoted domain part of the address. Other- wise, the query is suppressed and returns no results. %[SUD] The upper-case equivalents of the above - expansions behave in the query parameter + expansions behave in the query parameter identically to their lower-case counter- parts. With the result_format parameter (see below), they expand the input key rather than the result value. - %[1-9] The patterns %1, %2, ... %9 are replaced by + %[1-9] The patterns %1, %2, ... %9 are replaced by the corresponding most significant component - of the input key's domain. If the input key + of the input key's domain. If the input key is user@mail.example.com, then %1 is com, %2 - is example and %3 is mail. If the input key + is example and %3 is mail. If the input key is unqualified or does not have enough - domain components to satisfy all the speci- - fied patterns, the query is suppressed and + domain components to satisfy all the speci- + fied patterns, the query is suppressed and returns no results. - The domain parameter described below limits the - input keys to addresses in matching domains. When - the domain parameter is non-empty, SQL queries for - unqualified addresses or addresses in non-matching + The domain parameter described below limits the + input keys to addresses in matching domains. When + the domain parameter is non-empty, SQL queries for + unqualified addresses or addresses in non-matching domains are suppressed and return no results. - This parameter is available with Postfix 2.2. In - prior releases the SQL query was built from the - separate parameters: select_field, table, - where_field and additional_conditions. The mapping + This parameter is available with Postfix 2.2. In + prior releases the SQL query was built from the + separate parameters: select_field, table, + where_field and additional_conditions. The mapping from the old parameters to the equivalent query is: SELECT [select_field] @@ -175,99 +172,99 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) The '%s' in the WHERE clause expands to the escaped search string. With Postfix 2.2 these legacy - parameters are used if the query parameter is not + parameters are used if the query parameter is not specified. NOTE: DO NOT put quotes around the query parameter. result_format (default: %s) - Format template applied to result attributes. Most - commonly used to append (or prepend) text to the - result. This parameter supports the following '%' + Format template applied to result attributes. Most + commonly used to append (or prepend) text to the + result. This parameter supports the following '%' expansions: %% This is replaced by a literal '%' character. - %s This is replaced by the value of the result - attribute. When result is empty it is + %s This is replaced by the value of the result + attribute. When result is empty it is skipped. - %u When the result attribute value is an + %u When the result attribute value is an address of the form user@domain, %u is - replaced by the local part of the address. + replaced by the local part of the address. When the result has an empty localpart it is skipped. - %d When a result attribute value is an address - of the form user@domain, %d is replaced by + %d When a result attribute value is an address + of the form user@domain, %d is replaced by the domain part of the attribute value. When the result is unqualified it is skipped. %[SUD1-9] - The upper-case and decimal digit expansions + The upper-case and decimal digit expansions interpolate the parts of the input key - rather than the result. Their behavior is - identical to that described with query, and - in fact because the input key is known in - advance, queries whose key does not contain - all the information specified in the result - template are suppressed and return no + rather than the result. Their behavior is + identical to that described with query, and + in fact because the input key is known in + advance, queries whose key does not contain + all the information specified in the result + template are suppressed and return no results. For example, using "result_format = smtp:[%s]" allows one to use a mailHost attribute as the basis - of a transport(5) table. After applying the result - format, multiple values are concatenated as comma - separated strings. The expansion_limit and parame- + of a transport(5) table. After applying the result + format, multiple values are concatenated as comma + separated strings. The expansion_limit and parame- ter explained below allows one to restrict the num- - ber of values in the result, which is especially + ber of values in the result, which is especially useful for maps that must return at most one value. - The default value %s specifies that each result + The default value %s specifies that each result value should be used as is. - This parameter is available with Postfix 2.2 and + This parameter is available with Postfix 2.2 and later. NOTE: DO NOT put quotes around the result format! domain (default: no domain list) - This is a list of domain names, paths to files, or - dictionaries. When specified, only fully qualified - search keys with a *non-empty* localpart and a - matching domain are eligible for lookup: 'user' - lookups, bare domain lookups and "@domain" lookups - are not performed. This can significantly reduce + This is a list of domain names, paths to files, or + dictionaries. When specified, only fully qualified + search keys with a *non-empty* localpart and a + matching domain are eligible for lookup: 'user' + lookups, bare domain lookups and "@domain" lookups + are not performed. This can significantly reduce the query load on the MySQL server. domain = postfix.org, hash:/etc/postfix/searchdomains It is best not to use SQL to store the domains eli- gible for SQL lookups. - This parameter is available with Postfix 2.2 and + This parameter is available with Postfix 2.2 and later. - NOTE: DO NOT define this parameter for local(8) + NOTE: DO NOT define this parameter for local(8) aliases, because the input keys are always unquali- fied. expansion_limit (default: 0) - A limit on the total number of result elements - returned (as a comma separated list) by a lookup - against the map. A setting of zero disables the - limit. Lookups fail with a temporary error if the - limit is exceeded. Setting the limit to 1 ensures + A limit on the total number of result elements + returned (as a comma separated list) by a lookup + against the map. A setting of zero disables the + limit. Lookups fail with a temporary error if the + limit is exceeded. Setting the limit to 1 ensures that lookups do not return multiple values. OBSOLETE QUERY INTERFACE - This section describes an interface that is deprecated as - of Postfix 2.2. It is replaced by the more general query - interface described above. If the query parameter is - defined, the legacy parameters described here ignored. - Please migrate to the new interface as the legacy inter- + This section describes an interface that is deprecated as + of Postfix 2.2. It is replaced by the more general query + interface described above. If the query parameter is + defined, the legacy parameters described here ignored. + Please migrate to the new interface as the legacy inter- face may be removed in a future release. - The following parameters can be used to fill in a SELECT + The following parameters can be used to fill in a SELECT template statement of the form: SELECT [select_field] @@ -275,7 +272,7 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) WHERE [where_field] = '%s' [additional_conditions] - The specifier %s is replaced by the search string, and is + The specifier %s is replaced by the search string, and is escaped so if it contains single quotes or other odd char- acters, it will not cause a parse error, or worse, a secu- rity problem. @@ -300,13 +297,14 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) postconf(5), configuration parameters ldap_table(5), LDAP lookup tables pgsql_table(5), PostgreSQL lookup tables + sqlite_table(5), SQLite lookup tables README FILES DATABASE_README, Postfix lookup table overview MYSQL_README, Postfix MYSQL client guide LICENSE - The Secure Mailer license must be distributed with this + The Secure Mailer license must be distributed with this software. HISTORY diff --git a/postfix/html/pgsql_table.5.html b/postfix/html/pgsql_table.5.html index dc07cc586..8ec3d2d02 100644 --- a/postfix/html/pgsql_table.5.html +++ b/postfix/html/pgsql_table.5.html @@ -45,23 +45,18 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) readable. Support for this form will be removed in a future Postfix version. - Postfix 2.2 has enhanced query interfaces for MySQL and - PostgreSQL, these include features previously available - only in the Postfix LDAP client. In the new interface the - SQL query is specified via a single query parameter - (described in more detail below). In Postfix 2.1 the - parameter precedence was, from highest to lowest, - select_function, query and finally select_field, ... - - With Postfix 2.2 the query parameter has highest prece- - dence, and is used in preference to the still supported, - but slated to be phased out, select_function, - select_field, table, where_field and additional_conditions - parameters. To migrate to the new interface set: + Normally, the SQL query is specified via a single query + parameter (described in more detail below). When this + parameter is not specified in the map definition, Postfix + reverts to an older interface, with the SQL query con- + structed from the select_function, select_field, table, + where_field and additional_conditions parameters. The old + interface will be gradually phased out. To migrate to the + new interface set: query = SELECT select_function('%s') - or in the absence of select_function, the lower prece- + or in the absence of select_function, the lower prece- dence: query = SELECT select_field @@ -69,48 +64,48 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) WHERE where_field = '%s' additional_conditions - Use the value, not the name, of each legacy parameter. - Note that the additional_conditions parameter is optional + Use the value, not the name, of each legacy parameter. + Note that the additional_conditions parameter is optional and if not empty, will always start with AND. LIST MEMBERSHIP When using SQL to store lists such as $mynetworks, $mydes- - tination, $relay_domains, $local_recipient_maps, etc., it - is important to understand that the table must store each - list member as a separate key. The table lookup verifies - the *existence* of the key. See "Postfix lists versus - tables" in the DATABASE_README document for a discussion. + tination, $relay_domains, $local_recipient_maps, etc., it + is important to understand that the table must store each + list member as a separate key. The table lookup verifies + the *existence* of the key. See "Postfix lists versus + tables" in the DATABASE_README document for a discussion. - Do NOT create tables that return the full list of domains - in $mydestination or $relay_domains etc., or IP addresses + Do NOT create tables that return the full list of domains + in $mydestination or $relay_domains etc., or IP addresses in $mynetworks. DO create tables with each matching item as a key and with - an arbitrary value. With SQL databases it is not uncommon + an arbitrary value. With SQL databases it is not uncommon to return the key itself or a constant value. PGSQL PARAMETERS - hosts The hosts that Postfix will try to connect to and + hosts The hosts that Postfix will try to connect to and query from. Specify unix: for UNIX-domain sockets, inet: for TCP connections (default). Example: hosts = host1.some.domain host2.some.domain hosts = unix:/file/name - The hosts are tried in random order, with all con- + The hosts are tried in random order, with all con- nections over UNIX domain sockets being tried - before those over TCP. The connections are auto- - matically closed after being idle for about 1 + before those over TCP. The connections are auto- + matically closed after being idle for about 1 minute, and are re-opened as necessary. NOTE: the unix: and inet: prefixes are accepted for - backwards compatibility reasons, but are actually + backwards compatibility reasons, but are actually ignored. The PostgreSQL client library will always try to connect to an UNIX socket if the name starts - with a slash, and will try a TCP connection other- + with a slash, and will try a TCP connection other- wise. user, password - The user name and password to log into the pgsql + The user name and password to log into the pgsql server. Example: user = someone password = some_password @@ -123,170 +118,170 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) trying to resolve, e.g. query = SELECT replacement FROM aliases WHERE mailbox = '%s' - This parameter supports the following '%' expan- + This parameter supports the following '%' expan- sions: %% This is replaced by a literal '%' character. (Postfix 2.2 and later) - %s This is replaced by the input key. SQL - quoting is used to make sure that the input - key does not add unexpected metacharacters. + %s This is replaced by the input key. SQL + quoting is used to make sure that the input + key does not add unexpected metacharacters. %u When the input key is an address of the form user@domain, %u is replaced by the SQL - quoted local part of the address. Other- - wise, %u is replaced by the entire search - string. If the localpart is empty, the - query is suppressed and returns no results. + quoted local part of the address. Other- + wise, %u is replaced by the entire search + string. If the localpart is empty, the + query is suppressed and returns no results. %d When the input key is an address of the form user@domain, %d is replaced by the SQL - quoted domain part of the address. Other- + quoted domain part of the address. Other- wise, the query is suppressed and returns no results. %[SUD] The upper-case equivalents of the above - expansions behave in the query parameter + expansions behave in the query parameter identically to their lower-case counter- parts. With the result_format parameter (see below), they expand the input key rather than the result value. - The above %S, %U and %D expansions are + The above %S, %U and %D expansions are available with Postfix 2.2 and later - %[1-9] The patterns %1, %2, ... %9 are replaced by + %[1-9] The patterns %1, %2, ... %9 are replaced by the corresponding most significant component - of the input key's domain. If the input key + of the input key's domain. If the input key is user@mail.example.com, then %1 is com, %2 - is example and %3 is mail. If the input key + is example and %3 is mail. If the input key is unqualified or does not have enough - domain components to satisfy all the speci- - fied patterns, the query is suppressed and + domain components to satisfy all the speci- + fied patterns, the query is suppressed and returns no results. - The above %1, ... %9 expansions are avail- + The above %1, ... %9 expansions are avail- able with Postfix 2.2 and later - The domain parameter described below limits the - input keys to addresses in matching domains. When - the domain parameter is non-empty, SQL queries for - unqualified addresses or addresses in non-matching + The domain parameter described below limits the + input keys to addresses in matching domains. When + the domain parameter is non-empty, SQL queries for + unqualified addresses or addresses in non-matching domains are suppressed and return no results. - The precedence of this parameter has changed with - Postfix 2.2, in prior releases the precedence was, - from highest to lowest, select_function, query, + The precedence of this parameter has changed with + Postfix 2.2, in prior releases the precedence was, + from highest to lowest, select_function, query, select_field, ... - With Postfix 2.2 the query parameter has highest + With Postfix 2.2 the query parameter has highest precedence, see COMPATIBILITY above. NOTE: DO NOT put quotes around the query parameter. result_format (default: %s) - Format template applied to result attributes. Most - commonly used to append (or prepend) text to the - result. This parameter supports the following '%' + Format template applied to result attributes. Most + commonly used to append (or prepend) text to the + result. This parameter supports the following '%' expansions: %% This is replaced by a literal '%' character. - %s This is replaced by the value of the result - attribute. When result is empty it is + %s This is replaced by the value of the result + attribute. When result is empty it is skipped. - %u When the result attribute value is an + %u When the result attribute value is an address of the form user@domain, %u is - replaced by the local part of the address. + replaced by the local part of the address. When the result has an empty localpart it is skipped. - %d When a result attribute value is an address - of the form user@domain, %d is replaced by + %d When a result attribute value is an address + of the form user@domain, %d is replaced by the domain part of the attribute value. When the result is unqualified it is skipped. %[SUD1-9] - The upper-case and decimal digit expansions + The upper-case and decimal digit expansions interpolate the parts of the input key - rather than the result. Their behavior is - identical to that described with query, and - in fact because the input key is known in - advance, queries whose key does not contain - all the information specified in the result - template are suppressed and return no + rather than the result. Their behavior is + identical to that described with query, and + in fact because the input key is known in + advance, queries whose key does not contain + all the information specified in the result + template are suppressed and return no results. For example, using "result_format = smtp:[%s]" allows one to use a mailHost attribute as the basis - of a transport(5) table. After applying the result - format, multiple values are concatenated as comma - separated strings. The expansion_limit and parame- + of a transport(5) table. After applying the result + format, multiple values are concatenated as comma + separated strings. The expansion_limit and parame- ter explained below allows one to restrict the num- - ber of values in the result, which is especially + ber of values in the result, which is especially useful for maps that must return at most one value. - The default value %s specifies that each result + The default value %s specifies that each result value should be used as is. - This parameter is available with Postfix 2.2 and + This parameter is available with Postfix 2.2 and later. NOTE: DO NOT put quotes around the result format! domain (default: no domain list) - This is a list of domain names, paths to files, or - dictionaries. When specified, only fully qualified - search keys with a *non-empty* localpart and a - matching domain are eligible for lookup: 'user' - lookups, bare domain lookups and "@domain" lookups - are not performed. This can significantly reduce + This is a list of domain names, paths to files, or + dictionaries. When specified, only fully qualified + search keys with a *non-empty* localpart and a + matching domain are eligible for lookup: 'user' + lookups, bare domain lookups and "@domain" lookups + are not performed. This can significantly reduce the query load on the PostgreSQL server. domain = postfix.org, hash:/etc/postfix/searchdomains It is best not to use SQL to store the domains eli- gible for SQL lookups. - This parameter is available with Postfix 2.2 and + This parameter is available with Postfix 2.2 and later. - NOTE: DO NOT define this parameter for local(8) + NOTE: DO NOT define this parameter for local(8) aliases, because the input keys are always unquali- fied. expansion_limit (default: 0) - A limit on the total number of result elements - returned (as a comma separated list) by a lookup - against the map. A setting of zero disables the - limit. Lookups fail with a temporary error if the - limit is exceeded. Setting the limit to 1 ensures + A limit on the total number of result elements + returned (as a comma separated list) by a lookup + against the map. A setting of zero disables the + limit. Lookups fail with a temporary error if the + limit is exceeded. Setting the limit to 1 ensures that lookups do not return multiple values. OBSOLETE QUERY INTERFACES - This section describes query interfaces that are depre- - cated as of Postfix 2.2. Please migrate to the new query - interface as the old interfaces are slated to be phased + This section describes query interfaces that are depre- + cated as of Postfix 2.2. Please migrate to the new query + interface as the old interfaces are slated to be phased out. select_function - This parameter specifies a database function name. + This parameter specifies a database function name. Example: select_function = my_lookup_user_alias This is equivalent to: query = SELECT my_lookup_user_alias('%s') - This parameter overrides the legacy table-related - fields (described below). With Postfix versions - prior to 2.2, it also overrides the query parame- + This parameter overrides the legacy table-related + fields (described below). With Postfix versions + prior to 2.2, it also overrides the query parame- ter. Starting with Postfix 2.2, the query parameter - has highest precedence, and the select_function + has highest precedence, and the select_function parameter is deprecated. - The following parameters (with lower precedence than the - select_function interface described above) can be used to + The following parameters (with lower precedence than the + select_function interface described above) can be used to build the SQL select statement as follows: SELECT [select_field] @@ -294,14 +289,14 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) WHERE [where_field] = '%s' [additional_conditions] - The specifier %s is replaced with each lookup by the - lookup key and is escaped so if it contains single quotes - or other odd characters, it will not cause a parse error, + The specifier %s is replaced with each lookup by the + lookup key and is escaped so if it contains single quotes + or other odd characters, it will not cause a parse error, or worse, a security problem. - Starting with Postfix 2.2, this interface is obsoleted by - the more general query interface described above. If - higher precedence the query or select_function parameters + Starting with Postfix 2.2, this interface is obsoleted by + the more general query interface described above. If + higher precedence the query or select_function parameters described above are defined, the parameters described here are ignored. @@ -325,13 +320,14 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) postconf(5), configuration parameters ldap_table(5), LDAP lookup tables mysql_table(5), MySQL lookup tables + sqlite_table(5), SQLite lookup tables README FILES DATABASE_README, Postfix lookup table overview PGSQL_README, Postfix PostgreSQL client guide LICENSE - The Secure Mailer license must be distributed with this + The Secure Mailer license must be distributed with this software. HISTORY diff --git a/postfix/html/postconf.1.html b/postfix/html/postconf.1.html index 8a4041dd3..f9bab489f 100644 --- a/postfix/html/postconf.1.html +++ b/postfix/html/postconf.1.html @@ -175,36 +175,40 @@ POSTCONF(1) POSTCONF(1) is available on systems with support for SDBM databases. + sqlite (read-only) + Perform lookups from SQLite database files. + This is described in sqlite_table(5). + static (read-only) - A table that always returns its name as - lookup result. For example, static:foobar - always returns the string foobar as lookup + A table that always returns its name as + lookup result. For example, static:foobar + always returns the string foobar as lookup result. tcp (read-only) Perform lookups using a simple request-reply - protocol that is described in tcp_table(5). + protocol that is described in tcp_table(5). This feature is not included with the stable Postfix release. unix (read-only) - A limited way to query the UNIX authentica- + A limited way to query the UNIX authentica- tion database. The following tables are implemented: unix:passwd.byname - The table is the UNIX password data- - base. The key is a login name. The - result is a password file entry in + The table is the UNIX password data- + base. The key is a login name. The + result is a password file entry in passwd(5) format. unix:group.byname The table is the UNIX group database. - The key is a group name. The result - is a group file entry in group(5) + The key is a group name. The result + is a group file entry in group(5) format. - Other table types may exist depending on how Post- + Other table types may exist depending on how Post- fix was built. -n Print parameter settings that are not left at their @@ -213,29 +217,29 @@ POSTCONF(1) POSTCONF(1) -t [template_file] Display the templates for delivery status notifica- - tion (DSN) messages. To override the built-in tem- - plates, specify a template file at the end of the + tion (DSN) messages. To override the built-in tem- + plates, specify a template file at the end of the command line, or specify a template file in main.cf - with the bounce_template_file parameter. To force - selection of the built-in templates, specify an + with the bounce_template_file parameter. To force + selection of the built-in templates, specify an empty template file name (in shell language: ""). - This feature is available with Postfix 2.3 and + This feature is available with Postfix 2.3 and later. -v Enable verbose logging for debugging purposes. Mul- - tiple -v options make the software increasingly + tiple -v options make the software increasingly verbose. - -# Edit the main.cf configuration file. The file is + -# Edit the main.cf configuration file. The file is copied to a temporary file then renamed into place. - The parameters specified on the command line are + The parameters specified on the command line are commented-out, so that they revert to their default - values. Specify a list of parameter names, not - name=value pairs. There is no postconf command to + values. Specify a list of parameter names, not + name=value pairs. There is no postconf command to perform the reverse operation. - This feature is available with Postfix 2.6 and + This feature is available with Postfix 2.6 and later. DIAGNOSTICS @@ -246,18 +250,18 @@ POSTCONF(1) POSTCONF(1) Directory with Postfix configuration files. CONFIGURATION PARAMETERS - The following main.cf parameters are especially relevant + The following main.cf parameters are especially relevant to this program. - The text below provides only a parameter summary. See + The text below provides only a parameter summary. See postconf(5) for more details including examples. config_directory (see 'postconf -d' output) - The default location of the Postfix main.cf and + The default location of the Postfix main.cf and master.cf configuration files. bounce_template_file (empty) - Pathname of a configuration file with bounce mes- + Pathname of a configuration file with bounce mes- sage templates. FILES @@ -271,7 +275,7 @@ POSTCONF(1) POSTCONF(1) DATABASE_README, Postfix lookup table overview LICENSE - The Secure Mailer license must be distributed with this + The Secure Mailer license must be distributed with this software. AUTHOR(S) diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 991478f68..37824d458 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -14119,10 +14119,10 @@ The default is "no"; this prevents Postfix from trusting third-party certificates and giving them relay permission with permit_tls_all_clientcerts.

    -

    This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and -later versions. Specify "tls_append_default_CA = yes" for backwards -compatibility, to avoid breaking certificate verification with sites -that don't use permit_tls_all_clientcerts.

    +

    This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8, +2.7.2 and later versions. Specify "tls_append_default_CA = yes" for +backwards compatibility, to avoid breaking certificate verification +with sites that don't use permit_tls_all_clientcerts.

    • diff --git a/postfix/html/postfix-manuals.html b/postfix/html/postfix-manuals.html index 655bc7db6..fd6dca77f 100644 --- a/postfix/html/postfix-manuals.html +++ b/postfix/html/postfix-manuals.html @@ -165,6 +165,8 @@ the following convention:

  • regexp_table(5), Associate POSIX regexp pattern with value +
  • slite_table(5), Postfix SQLite database driver +
  • tcp_table(5), Postfix client-server table lookup diff --git a/postfix/html/postfix.1.html b/postfix/html/postfix.1.html index 8415435d4..fc6e76b35 100644 --- a/postfix/html/postfix.1.html +++ b/postfix/html/postfix.1.html @@ -301,6 +301,7 @@ POSTFIX(1) POSTFIX(1) pcre_table(5), Associate PCRE pattern with value pgsql_table(5), Postfix PostgreSQL client regexp_table(5), Associate POSIX regexp pattern with value + slite_table(5), Postfix SQLite database driver tcp_table(5), Postfix client-server table lookup Daemon processes: diff --git a/postfix/html/sqlite_table.5.html b/postfix/html/sqlite_table.5.html new file mode 100644 index 000000000..dc92a21aa --- /dev/null +++ b/postfix/html/sqlite_table.5.html @@ -0,0 +1,286 @@ + + + + Postfix manual - sqlite_table(5) + 
    +SQLITE_TABLE(5)                                                SQLITE_TABLE(5)
+
+NAME
+       sqlite_table - Postfix SQLite configuration
+
+SYNOPSIS
+       postmap -q "string" sqlite:/etc/postfix/filename
+
+       postmap -q - sqlite:/etc/postfix/filename <inputfile
+
+DESCRIPTION
+       The  Postfix  mail system uses optional tables for address
+       rewriting or mail routing. These tables are usually in dbm
+       or db format.
+
+       Alternatively,  lookup  tables  can be specified as SQLite
+       databases.  In order  to  use  SQLite  lookups,  define  a
+       SQLite source as a lookup table in main.cf, for example:
+           alias_maps = sqlite:/etc/sqlite-aliases.cf
+
+       The  file /etc/postfix/sqlite-aliases.cf has the same for-
+       mat as the Postfix  main.cf  file,  and  can  specify  the
+       parameters described below.
+
+BACKWARDS COMPATIBILITY
+       For compatibility with other Postfix lookup tables, SQLite
+       parameters can also be defined in main.cf.  In order to do
+       that,  specify  as SQLite source a name that doesn't begin
+       with a slash or a dot.  The SQLite parameters will then be
+       accessible as the name you've given the source in its def-
+       inition, an underscore, and the  name  of  the  parameter.
+       For  example,  if  the map is specified as "sqlite:sqlite-
+       name", the parameter "query" below  would  be  defined  in
+       main.cf as "sqlitename_query".
+
+       Normally,  the  SQL  query is specified via a single query
+       parameter (described in more  detail  below).   When  this
+       parameter  is not specified in the map definition, Postfix
+       reverts to an older interface, with  the  SQL  query  con-
+       structed  from  the  select_field,  table, where_field and
+       additional_conditions parameters.  The old interface  will
+       be  gradually  phased out. To migrate to the new interface
+       set:
+
+           query = SELECT [select_field]
+               FROM [table]
+               WHERE [where_field] = '%s'
+                   [additional_conditions]
+
+       Insert the value, not the name, of each legacy  parameter.
+       Note  that the additional_conditions parameter is optional
+       and if not empty, will always start with AND.
+
+LIST MEMBERSHIP
+       When using SQL to store lists such as $mynetworks, $mydes-
+       tination,  $relay_domains, $local_recipient_maps, etc., it
+       is important to understand that the table must store  each
+       list  member  as a separate key. The table lookup verifies
+       the *existence* of the  key.  See  "Postfix  lists  versus
+       tables"  in the DATABASE_README document for a discussion.
+
+       Do NOT create tables that return the full list of  domains
+       in  $mydestination or $relay_domains etc., or IP addresses
+       in $mynetworks.
+
+       DO create tables with each matching item as a key and with
+       an  arbitrary value. With SQL databases it is not uncommon
+       to return the key itself or a constant value.
+
+SQLITE PARAMETERS
+       dbpath The SQLite database file location. Example:
+                  dbpath = customer_database
+
+       query  The SQL query template used to search the database,
+              where %s is a substitute for the address Postfix is
+              trying to resolve, e.g.
+                  query = SELECT replacement FROM aliases WHERE mailbox = '%s'
+
+              This parameter supports the  following  '%'  expan-
+              sions:
+
+              %%     This is replaced by a literal '%' character.
+
+              %s     This is replaced  by  the  input  key.   SQL
+                     quoting  is used to make sure that the input
+                     key does not add unexpected  metacharacters.
+
+              %u     When the input key is an address of the form
+                     user@domain,  %u  is  replaced  by  the  SQL
+                     quoted  local  part  of the address.  Other-
+                     wise, %u is replaced by  the  entire  search
+                     string.   If  the  localpart  is  empty, the
+                     query is suppressed and returns no  results.
+
+              %d     When the input key is an address of the form
+                     user@domain,  %d  is  replaced  by  the  SQL
+                     quoted  domain  part of the address.  Other-
+                     wise, the query is suppressed and returns no
+                     results.
+
+              %[SUD] The  upper-case  equivalents  of  the  above
+                     expansions behave  in  the  query  parameter
+                     identically  to  their  lower-case  counter-
+                     parts.   With  the  result_format  parameter
+                     (see  below),  they  expand  the  input  key
+                     rather than the result value.
+
+              %[1-9] The patterns %1, %2, ... %9 are replaced  by
+                     the corresponding most significant component
+                     of the input key's domain. If the input  key
+                     is user@mail.example.com, then %1 is com, %2
+                     is example and %3 is mail. If the input  key
+                     is  unqualified  or  does  not  have  enough
+                     domain components to satisfy all the  speci-
+                     fied  patterns,  the query is suppressed and
+                     returns no results.
+
+              The domain parameter  described  below  limits  the
+              input  keys  to addresses in matching domains. When
+              the domain parameter is non-empty, SQL queries  for
+              unqualified  addresses or addresses in non-matching
+              domains are suppressed and return no results.
+
+              This parameter is available with  Postfix  2.2.  In
+              prior  releases  the  SQL  query was built from the
+              separate    parameters:    select_field,     table,
+              where_field  and additional_conditions. The mapping
+              from the old parameters to the equivalent query is:
+
+                  SELECT [select_field]
+                  FROM [table]
+                  WHERE [where_field] = '%s'
+                        [additional_conditions]
+
+              The '%s' in the WHERE clause expands to the escaped
+              search  string.   With  Postfix  2.2  these  legacy
+              parameters  are  used if the query parameter is not
+              specified.
+
+              NOTE: DO NOT put quotes around the query parameter.
+
+       result_format (default: %s)
+              Format  template applied to result attributes. Most
+              commonly used to append (or prepend)  text  to  the
+              result.  This  parameter supports the following '%'
+              expansions:
+
+              %%     This is replaced by a literal '%' character.
+
+              %s     This  is replaced by the value of the result
+                     attribute.  When  result  is  empty  it   is
+                     skipped.
+
+              %u     When   the  result  attribute  value  is  an
+                     address  of  the  form  user@domain,  %u  is
+                     replaced  by  the local part of the address.
+                     When the result has an empty localpart it is
+                     skipped.
+
+              %d     When  a result attribute value is an address
+                     of the form user@domain, %d is  replaced  by
+                     the domain part of the attribute value. When
+                     the result is unqualified it is skipped.
+
+              %[SUD1-9]
+                     The upper-case and decimal digit  expansions
+                     interpolate  the  parts  of  the  input  key
+                     rather than the result.  Their  behavior  is
+                     identical  to that described with query, and
+                     in fact because the input key  is  known  in
+                     advance,  queries whose key does not contain
+                     all the information specified in the  result
+                     template   are   suppressed  and  return  no
+                     results.
+
+              For  example,  using  "result_format  =  smtp:[%s]"
+              allows one to use a mailHost attribute as the basis
+              of a transport(5) table. After applying the  result
+              format,  multiple  values are concatenated as comma
+              separated strings. The expansion_limit and  parame-
+              ter explained below allows one to restrict the num-
+              ber of values in the result,  which  is  especially
+              useful for maps that must return at most one value.
+
+              The default value %s  specifies  that  each  result
+              value should be used as is.
+
+              This  parameter  is  available with Postfix 2.2 and
+              later.
+
+              NOTE: DO NOT put quotes around the result format!
+
+       domain (default: no domain list)
+              This is a list of domain names, paths to files,  or
+              dictionaries.  When specified, only fully qualified
+              search keys with  a  *non-empty*  localpart  and  a
+              matching  domain  are  eligible  for lookup: 'user'
+              lookups, bare domain lookups and "@domain"  lookups
+              are  not  performed.  This can significantly reduce
+              the query load on the SQLite server.
+                  domain = postfix.org, hash:/etc/postfix/searchdomains
+
+              It is best not to use SQL to store the domains eli-
+              gible for SQL lookups.
+
+              This  parameter  is  available with Postfix 2.2 and
+              later.
+
+              NOTE: DO NOT define  this  parameter  for  local(8)
+              aliases, because the input keys are always unquali-
+              fied.
+
+       expansion_limit (default: 0)
+              A limit on the  total  number  of  result  elements
+              returned  (as  a  comma separated list) by a lookup
+              against the map.  A setting of  zero  disables  the
+              limit.  Lookups  fail with a temporary error if the
+              limit is exceeded.  Setting the limit to 1  ensures
+              that lookups do not return multiple values.
+
+OBSOLETE QUERY INTERFACE
+       This  section describes an interface that is deprecated as
+       of Postfix 2.2. It is replaced by the more  general  query
+       interface  described  above.   If  the  query parameter is
+       defined, the legacy  parameters  described  here  ignored.
+       Please  migrate  to the new interface as the legacy inter-
+       face may be removed in a future release.
+
+       The following parameters can be used to fill in  a  SELECT
+       template statement of the form:
+
+           SELECT [select_field]
+           FROM [table]
+           WHERE [where_field] = '%s'
+                 [additional_conditions]
+
+       The  specifier %s is replaced by the search string, and is
+       escaped so if it contains single quotes or other odd char-
+       acters, it will not cause a parse error, or worse, a secu-
+       rity problem.
+
+       select_field
+              The SQL "select" parameter. Example:
+                  select_field = forw_addr
+
+       table  The SQL "select .. from" table name. Example:
+                  table = mxaliases
+
+       where_field
+              The SQL "select .. where" parameter. Example:
+                  where_field = alias
+
+       additional_conditions
+              Additional conditions to the SQL query. Example:
+                  additional_conditions = AND status = 'paid'
+
+SEE ALSO
+       postmap(1), Postfix lookup table maintenance
+       postconf(5), configuration parameters
+       ldap_table(5), LDAP lookup tables
+       mysql_table(5), MySQL lookup tables
+       pgsql_table(5), PostgreSQL lookup tables
+
+README FILES
+       DATABASE_README, Postfix lookup table overview
+       SQLITE_README, Postfix SQLITE driver
+
+LICENSE
+       The  Secure  Mailer  license must be distributed with this
+       software.
+
+HISTORY
+       SQLite support was introduced with Postfix version 2.8.
+
+AUTHOR(S)
+       Original implementation by:
+       Axel Steiner
+
+                                                               SQLITE_TABLE(5)
+
    diff --git a/postfix/man/Makefile.in b/postfix/man/Makefile.in index 1e359ea51..4ab5008da 100644 --- a/postfix/man/Makefile.in +++ b/postfix/man/Makefile.in @@ -18,7 +18,8 @@ CONFIG = man5/access.5 man5/aliases.5 man5/canonical.5 man5/relocated.5 \ man5/cidr_table.5 man5/tcp_table.5 man5/header_checks.5 \ man5/body_checks.5 man5/ldap_table.5 man5/mysql_table.5 \ man5/pgsql_table.5 man5/master.5 man5/nisplus_table.5 \ - man5/generic.5 man5/bounce.5 man5/postfix-wrapper.5 + man5/generic.5 man5/bounce.5 man5/postfix-wrapper.5 \ + man5/sqlite_table.5 TOOLS = man1/smtp-sink.1 man1/smtp-source.1 man1/qmqp-sink.1 \ man1/qmqp-source.1 man1/qshape.1 @@ -273,6 +274,9 @@ man5/master.5: ../proto/master man5/mysql_table.5: ../proto/mysql_table ../mantools/srctoman - $? >$@ +man5/sqlite_table.5: ../proto/sqlite_table + ../mantools/srctoman - $? >$@ + man5/nisplus_table.5: ../proto/nisplus_table ../mantools/srctoman - $? >$@ diff --git a/postfix/man/man1/postconf.1 b/postfix/man/man1/postconf.1 index 530aa0677..dfc4780f1 100644 --- a/postfix/man/man1/postconf.1 +++ b/postfix/man/man1/postconf.1 @@ -152,6 +152,9 @@ described in \fBregexp_table\fR(5). .IP \fBsdbm\fR An indexed file type based on hashing. This is available on systems with support for SDBM databases. +.IP "\fBsqlite\fR (read-only)" +Perform lookups from SQLite database files. This is described +in \fBsqlite_table\fR(5). .IP "\fBstatic\fR (read-only)" A table that always returns its name as lookup result. For example, \fBstatic:foobar\fR always returns the string \fBfoobar\fR as lookup diff --git a/postfix/man/man1/postfix.1 b/postfix/man/man1/postfix.1 index c8d601941..2ad778586 100644 --- a/postfix/man/man1/postfix.1 +++ b/postfix/man/man1/postfix.1 @@ -259,6 +259,7 @@ nisplus_table(5), Postfix NIS+ client pcre_table(5), Associate PCRE pattern with value pgsql_table(5), Postfix PostgreSQL client regexp_table(5), Associate POSIX regexp pattern with value +slite_table(5), Postfix SQLite database driver tcp_table(5), Postfix client-server table lookup Daemon processes: diff --git a/postfix/man/man5/ldap_table.5 b/postfix/man/man5/ldap_table.5 index b81421d52..b9169bb5f 100644 --- a/postfix/man/man5/ldap_table.5 +++ b/postfix/man/man5/ldap_table.5 @@ -56,14 +56,8 @@ Note: with this form, the passwords for the LDAP sources are written in main.cf, which is normally world-readable. Support for this form will be removed in a future Postfix version. -Postfix 2.2 has enhanced query interfaces for MySQL and PostgreSQL. -These include features that were previously available only in the -Postfix LDAP client. This work also created an opportunity for -improvements in the LDAP interface. The primary compatibility -issue is that \fBresult_filter\fR (a name that has caused some -confusion as to its meaning in the past) has been renamed to -\fBresult_format\fR. For backwards compatibility with the pre -2.2 LDAP client, \fBresult_filter\fR can for now be used instead +For backwards compatibility with the pre +2.2 LDAP clients, \fBresult_filter\fR can for now be used instead of \fBresult_format\fR, when the latter parameter is not also set. The new name better reflects the function of the parameter. This compatibility interface may be removed in a future release. diff --git a/postfix/man/man5/mysql_table.5 b/postfix/man/man5/mysql_table.5 index 1a4b97d3f..b6f6caf7d 100644 --- a/postfix/man/man5/mysql_table.5 +++ b/postfix/man/man5/mysql_table.5 @@ -46,16 +46,14 @@ Note: with this form, the passwords for the MySQL sources are written in main.cf, which is normally world-readable. Support for this form will be removed in a future Postfix version. -Postfix 2.2 has enhanced query interfaces for MySQL and PostgreSQL; -these include features previously available only in the Postfix -LDAP client. In the new interface the SQL query is specified via -a single \fBquery\fR parameter (described in more detail below). -When the new \fBquery\fR parameter is not specified in the map -definition, Postfix reverts to the old interface, with the SQL -query constructed from the \fBselect_field\fR, \fBtable\fR, -\fBwhere_field\fR and \fBadditional_conditions\fR parameters. -The old interface will be gradually phased out. To migrate to -the new interface set: +Normally, the SQL query is specified via a single \fBquery\fR +parameter (described in more detail below). When this +parameter is not specified in the map definition, Postfix +reverts to an older interface, with the SQL query constructed +from the \fBselect_field\fR, \fBtable\fR, \fBwhere_field\fR +and \fBadditional_conditions\fR parameters. The old interface +will be gradually phased out. To migrate to the new interface +set: .nf \fBquery\fR = SELECT [\fIselect_field\fR] @@ -310,6 +308,7 @@ postmap(1), Postfix lookup table maintenance postconf(5), configuration parameters ldap_table(5), LDAP lookup tables pgsql_table(5), PostgreSQL lookup tables +sqlite_table(5), SQLite lookup tables .SH "README FILES" .na .nf diff --git a/postfix/man/man5/pgsql_table.5 b/postfix/man/man5/pgsql_table.5 index 3ee3b7d80..3c99dc7e6 100644 --- a/postfix/man/man5/pgsql_table.5 +++ b/postfix/man/man5/pgsql_table.5 @@ -48,18 +48,14 @@ are written in main.cf, which is normally world-readable. Support for this form will be removed in a future Postfix version. -Postfix 2.2 has enhanced query interfaces for MySQL and PostgreSQL, -these include features previously available only in the Postfix -LDAP client. In the new interface the SQL query is specified via -a single \fBquery\fR parameter (described in more detail below). -In Postfix 2.1 the parameter precedence was, from highest to lowest, -\fBselect_function\fR, \fBquery\fR and finally \fBselect_field\fR, ... - -With Postfix 2.2 the \fBquery\fR parameter has highest precedence, -and is used in preference to the still supported, but slated to be -phased out, \fBselect_function\fR, \fBselect_field\fR, \fBtable\fR, -\fBwhere_field\fR and \fBadditional_conditions\fR parameters. To -migrate to the new interface set: +Normally, the SQL query is specified via a single \fBquery\fR +parameter (described in more detail below). When this +parameter is not specified in the map definition, Postfix +reverts to an older interface, with the SQL query +constructed from the \fBselect_function\fR, \fBselect_field\fR, +\fBtable\fR, \fBwhere_field\fR and \fBadditional_conditions\fR +parameters. The old interface will be gradually phased +out. To migrate to the new interface set: .nf \fBquery\fR = SELECT \fIselect_function\fR('%s') @@ -334,6 +330,7 @@ postmap(1), Postfix lookup table manager postconf(5), configuration parameters ldap_table(5), LDAP lookup tables mysql_table(5), MySQL lookup tables +sqlite_table(5), SQLite lookup tables .SH "README FILES" .na .nf diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index 24850ce39..a8f09df44 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -8948,10 +8948,10 @@ The default is "no"; this prevents Postfix from trusting third-party certificates and giving them relay permission with permit_tls_all_clientcerts. .PP -This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and -later versions. Specify "tls_append_default_CA = yes" for backwards -compatibility, to avoid breaking certificate verification with sites -that don't use permit_tls_all_clientcerts. +This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8, +2.7.2 and later versions. Specify "tls_append_default_CA = yes" for +backwards compatibility, to avoid breaking certificate verification +with sites that don't use permit_tls_all_clientcerts. .SH tls_daemon_random_bytes (default: 32) The number of pseudo-random bytes that an \fBsmtp\fR(8) or \fBsmtpd\fR(8) process requests from the \fBtlsmgr\fR(8) server in order to seed its diff --git a/postfix/man/man5/sqlite_table.5 b/postfix/man/man5/sqlite_table.5 new file mode 100644 index 000000000..8133f6d51 --- /dev/null +++ b/postfix/man/man5/sqlite_table.5 @@ -0,0 +1,304 @@ +.TH SQLITE_TABLE 5 +.ad +.fi +.SH NAME +sqlite_table +\- +Postfix SQLite configuration +.SH "SYNOPSIS" +.na +.nf +\fBpostmap -q "\fIstring\fB" sqlite:/etc/postfix/filename\fR + +\fBpostmap -q - sqlite:/etc/postfix/\fIfilename\fR <\fIinputfile\fR +.SH DESCRIPTION +.ad +.fi +The Postfix mail system uses optional tables for address +rewriting or mail routing. These tables are usually in +\fBdbm\fR or \fBdb\fR format. + +Alternatively, lookup tables can be specified as SQLite databases. +In order to use SQLite lookups, define a SQLite source as a lookup +table in main.cf, for example: +.nf + alias_maps = sqlite:/etc/sqlite-aliases.cf +.fi + +The file /etc/postfix/sqlite-aliases.cf has the same format as +the Postfix main.cf file, and can specify the parameters +described below. +.SH "BACKWARDS COMPATIBILITY" +.na +.nf +.ad +.fi +For compatibility with other Postfix lookup tables, SQLite +parameters can also be defined in main.cf. In order to do that, +specify as SQLite source a name that doesn't begin with a slash +or a dot. The SQLite parameters will then be accessible as the +name you've given the source in its definition, an underscore, +and the name of the parameter. For example, if the map is +specified as "sqlite:\fIsqlitename\fR", the parameter "query" +below would be defined in main.cf as "\fIsqlitename\fR_query". + +Normally, the SQL query is specified via a single \fBquery\fR +parameter (described in more detail below). When this +parameter is not specified in the map definition, Postfix +reverts to an older interface, with the SQL query constructed +from the \fBselect_field\fR, \fBtable\fR, \fBwhere_field\fR +and \fBadditional_conditions\fR parameters. The old interface +will be gradually phased out. To migrate to the new interface +set: + +.nf + \fBquery\fR = SELECT [\fIselect_field\fR] + FROM [\fItable\fR] + WHERE [\fIwhere_field\fR] = '%s' + [\fIadditional_conditions\fR] +.fi + +Insert the value, not the name, of each legacy parameter. Note +that the \fBadditional_conditions\fR parameter is optional +and if not empty, will always start with \fBAND\fR. +.SH "LIST MEMBERSHIP" +.na +.nf +.ad +.fi +When using SQL to store lists such as $mynetworks, +$mydestination, $relay_domains, $local_recipient_maps, +etc., it is important to understand that the table must +store each list member as a separate key. The table lookup +verifies the *existence* of the key. See "Postfix lists +versus tables" in the DATABASE_README document for a +discussion. + +Do NOT create tables that return the full list of domains +in $mydestination or $relay_domains etc., or IP addresses +in $mynetworks. + +DO create tables with each matching item as a key and with +an arbitrary value. With SQL databases it is not uncommon to +return the key itself or a constant value. +.SH "SQLITE PARAMETERS" +.na +.nf +.ad +.fi +.IP "\fBdbpath\fR" +The SQLite database file location. Example: +.nf + dbpath = customer_database +.fi +.IP "\fBquery\fR" +The SQL query template used to search the database, where \fB%s\fR +is a substitute for the address Postfix is trying to resolve, +e.g. +.nf + query = SELECT replacement FROM aliases WHERE mailbox = '%s' +.fi + +This parameter supports the following '%' expansions: +.RS +.IP "\fB\fB%%\fR\fR" +This is replaced by a literal '%' character. +.IP "\fB\fB%s\fR\fR" +This is replaced by the input key. +SQL quoting is used to make sure that the input key does not +add unexpected metacharacters. +.IP "\fB\fB%u\fR\fR" +When the input key is an address of the form user@domain, \fB%u\fR +is replaced by the SQL quoted local part of the address. +Otherwise, \fB%u\fR is replaced by the entire search string. +If the localpart is empty, the query is suppressed and returns +no results. +.IP "\fB\fB%d\fR\fR" +When the input key is an address of the form user@domain, \fB%d\fR +is replaced by the SQL quoted domain part of the address. +Otherwise, the query is suppressed and returns no results. +.IP "\fB\fB%[SUD]\fR\fR" +The upper-case equivalents of the above expansions behave in the +\fBquery\fR parameter identically to their lower-case counter-parts. +With the \fBresult_format\fR parameter (see below), they expand the +input key rather than the result value. +.IP "\fB\fB%[1-9]\fR\fR" +The patterns %1, %2, ... %9 are replaced by the corresponding +most significant component of the input key's domain. If the +input key is \fIuser@mail.example.com\fR, then %1 is \fBcom\fR, +%2 is \fBexample\fR and %3 is \fBmail\fR. If the input key is +unqualified or does not have enough domain components to satisfy +all the specified patterns, the query is suppressed and returns +no results. +.RE +.IP +The \fBdomain\fR parameter described below limits the input +keys to addresses in matching domains. When the \fBdomain\fR +parameter is non-empty, SQL queries for unqualified addresses +or addresses in non-matching domains are suppressed +and return no results. + +This parameter is available with Postfix 2.2. In prior releases +the SQL query was built from the separate parameters: +\fBselect_field\fR, \fBtable\fR, \fBwhere_field\fR and +\fBadditional_conditions\fR. The mapping from the old parameters +to the equivalent query is: + +.nf + SELECT [\fBselect_field\fR] + FROM [\fBtable\fR] + WHERE [\fBwhere_field\fR] = '%s' + [\fBadditional_conditions\fR] +.fi + +The '%s' in the \fBWHERE\fR clause expands to the escaped search string. +With Postfix 2.2 these legacy parameters are used if the \fBquery\fR +parameter is not specified. + +NOTE: DO NOT put quotes around the query parameter. +.IP "\fBresult_format (default: \fB%s\fR)\fR" +Format template applied to result attributes. Most commonly used +to append (or prepend) text to the result. This parameter supports +the following '%' expansions: +.RS +.IP "\fB\fB%%\fR\fR" +This is replaced by a literal '%' character. +.IP "\fB\fB%s\fR\fR" +This is replaced by the value of the result attribute. When +result is empty it is skipped. +.IP "\fB%u\fR +When the result attribute value is an address of the form +user@domain, \fB%u\fR is replaced by the local part of the +address. When the result has an empty localpart it is skipped. +.IP "\fB\fB%d\fR\fR" +When a result attribute value is an address of the form +user@domain, \fB%d\fR is replaced by the domain part of +the attribute value. When the result is unqualified it +is skipped. +.IP "\fB\fB%[SUD1-9]\fR\fB" +The upper-case and decimal digit expansions interpolate +the parts of the input key rather than the result. Their +behavior is identical to that described with \fBquery\fR, +and in fact because the input key is known in advance, queries +whose key does not contain all the information specified in +the result template are suppressed and return no results. +.RE +.IP +For example, using "result_format = smtp:[%s]" allows one +to use a mailHost attribute as the basis of a transport(5) +table. After applying the result format, multiple values +are concatenated as comma separated strings. The expansion_limit +and parameter explained below allows one to restrict the number +of values in the result, which is especially useful for maps that +must return at most one value. + +The default value \fB%s\fR specifies that each result value should +be used as is. + +This parameter is available with Postfix 2.2 and later. + +NOTE: DO NOT put quotes around the result format! +.IP "\fBdomain (default: no domain list)\fR" +This is a list of domain names, paths to files, or +dictionaries. When specified, only fully qualified search +keys with a *non-empty* localpart and a matching domain +are eligible for lookup: 'user' lookups, bare domain lookups +and "@domain" lookups are not performed. This can significantly +reduce the query load on the SQLite server. +.nf + domain = postfix.org, hash:/etc/postfix/searchdomains +.fi + +It is best not to use SQL to store the domains eligible +for SQL lookups. + +This parameter is available with Postfix 2.2 and later. + +NOTE: DO NOT define this parameter for local(8) aliases, +because the input keys are always unqualified. +.IP "\fBexpansion_limit (default: 0)\fR" +A limit on the total number of result elements returned +(as a comma separated list) by a lookup against the map. +A setting of zero disables the limit. Lookups fail with a +temporary error if the limit is exceeded. Setting the +limit to 1 ensures that lookups do not return multiple +values. +.SH "OBSOLETE QUERY INTERFACE" +.na +.nf +.ad +.fi +This section describes an interface that is deprecated as +of Postfix 2.2. It is replaced by the more general \fBquery\fR +interface described above. If the \fBquery\fR parameter +is defined, the legacy parameters described here ignored. +Please migrate to the new interface as the legacy interface +may be removed in a future release. + +The following parameters can be used to fill in a +SELECT template statement of the form: + +.nf + SELECT [\fBselect_field\fR] + FROM [\fBtable\fR] + WHERE [\fBwhere_field\fR] = '%s' + [\fBadditional_conditions\fR] +.fi + +The specifier %s is replaced by the search string, and is +escaped so if it contains single quotes or other odd characters, +it will not cause a parse error, or worse, a security problem. +.IP "\fBselect_field\fR" +The SQL "select" parameter. Example: +.nf + \fBselect_field\fR = forw_addr +.fi +.IP "\fBtable\fR" +The SQL "select .. from" table name. Example: +.nf + \fBtable\fR = mxaliases +.fi +.IP "\fBwhere_field\fR +The SQL "select .. where" parameter. Example: +.nf + \fBwhere_field\fR = alias +.fi +.IP "\fBadditional_conditions\fR +Additional conditions to the SQL query. Example: +.nf + \fBadditional_conditions\fR = AND status = 'paid' +.fi +.SH "SEE ALSO" +.na +.nf +postmap(1), Postfix lookup table maintenance +postconf(5), configuration parameters +ldap_table(5), LDAP lookup tables +mysql_table(5), MySQL lookup tables +pgsql_table(5), PostgreSQL lookup tables +.SH "README FILES" +.na +.nf +.ad +.fi +Use "\fBpostconf readme_directory\fR" or +"\fBpostconf html_directory\fR" to locate this information. +.na +.nf +DATABASE_README, Postfix lookup table overview +SQLITE_README, Postfix SQLITE driver +.SH "LICENSE" +.na +.nf +.ad +.fi +The Secure Mailer license must be distributed with this software. +.SH "HISTORY" +.na +.nf +SQLite support was introduced with Postfix version 2.8. +.SH "AUTHOR(S)" +.na +.nf +Original implementation by: +Axel Steiner diff --git a/postfix/mantools/postlink b/postfix/mantools/postlink index f7ba92184..587af90e6 100755 --- a/postfix/mantools/postlink +++ b/postfix/mantools/postlink @@ -772,6 +772,7 @@ while (<>) { s/[]*reg[-<\/bB>]*\n*[ ]*exp[<\/bBiI>]*_[<\/iIbB>]*ta[-<\/bB>]*\n*[ ]*ble[<\/bB>]*\(5\)/$&<\/a>/g; s/[]*relocated[<\/bB>]*\(5\)/$&<\/a>/g; s/[]*scache[<\/bB>]*\(8\)/$&<\/a>/g; + s/[]*sqlite[<\/bBiI>]*_[<\/iIbB>]*ta[-<\/bB>]*\n*[ ]*ble[<\/bB>]*\(5\)/$&<\/a>/g; s/[]*trans[-<\/bB>]*\n*[ ]*port[<\/bB>]*\(5\)/$&<\/a>/g; s/[]*verify[<\/bB>]*\(8\)/$&<\/a>/g; s/[]*vir[-<\/bB>]*\n*[ ]*tual[<\/bB>]*\(5\)/$&<\/a>/g; diff --git a/postfix/proto/DATABASE_README.html b/postfix/proto/DATABASE_README.html index 5e5f03bec..965f56ff5 100644 --- a/postfix/proto/DATABASE_README.html +++ b/postfix/proto/DATABASE_README.html @@ -120,7 +120,8 @@ and are easy to debug with the postmap(1) command:

    Once you have local files working properly you can follow the -instructions in ldap_table(5), mysql_table(5) or pgsql_table(5) +instructions in ldap_table(5), mysql_table(5), pgsql_table(5) +or sqlite_table(5) and replace local file lookups with LDAP or SQL lookups. When you do this, you should use the postmap(1) command again, to verify that database lookups still produce the exact same results as local @@ -358,6 +359,11 @@ created with the postmap(1) or postalias(1) command. The lookup table name as used in "sdbm:table" is the database file name without the ".dir" or ".pag" suffix. +

    sqlite (read-only)
    + +
    Perform SQLite database lookups. Configuration details are given +in sqlite_table(5).
    +
    static (read-only)
    Always returns its lookup table name as lookup result. For diff --git a/postfix/proto/INSTALL.html b/postfix/proto/INSTALL.html index bcf1077c2..17b188bab 100644 --- a/postfix/proto/INSTALL.html +++ b/postfix/proto/INSTALL.html @@ -261,6 +261,9 @@ Postfix 2.0 SASL authentication SASL_README Postfix 1.0 + SQLite database SQLITE_README Postfix +2.8 + STARTTLS session encryption TLS_README Postfix 2.2 diff --git a/postfix/proto/Makefile.in b/postfix/proto/Makefile.in index 886e7fc8b..5d41ede94 100644 --- a/postfix/proto/Makefile.in +++ b/postfix/proto/Makefile.in @@ -35,6 +35,7 @@ HTML = ../html/ADDRESS_CLASS_README.html \ ../html/SMTPD_POLICY_README.html \ ../html/SMTPD_PROXY_README.html \ ../html/SOHO_README.html \ + ../html/SQLITE_README.html \ ../html/STANDARD_CONFIGURATION_README.html \ ../html/STRESS_README.html \ ../html/TLS_README.html ../html/TLS_LEGACY_README.html \ @@ -73,6 +74,7 @@ README = ../README_FILES/ADDRESS_CLASS_README \ ../README_FILES/SMTPD_ACCESS_README \ ../README_FILES/SMTPD_POLICY_README ../README_FILES/SMTPD_PROXY_README \ ../README_FILES/SOHO_README \ + ../README_FILES/SQLITE_README \ ../README_FILES/STANDARD_CONFIGURATION_README \ ../README_FILES/STRESS_README \ ../README_FILES/TLS_README ../README_FILES/TLS_LEGACY_README \ @@ -246,6 +248,9 @@ clobber: ../html/SOHO_README.html: $(MAKESOHO) $(DEPSOHO) $(MAKESOHO) | $(POSTLINK) >$@ +../html/SQLITE_README.html: SQLITE_README.html + $(POSTLINK) $? >$@ + ../html/STANDARD_CONFIGURATION_README.html: STANDARD_CONFIGURATION_README.html $(POSTLINK) $? >$@ @@ -396,6 +401,9 @@ clobber: ../README_FILES/SOHO_README: $(MAKESOHO) $(DEPSOHO) $(MAKESOHO) | $(HT2READ) >$@ +../README_FILES/SQLITE_README: SQLITE_README.html + $(HT2READ) $? >$@ + ../README_FILES/STANDARD_CONFIGURATION_README: STANDARD_CONFIGURATION_README.html $(HT2READ) $? >$@ diff --git a/postfix/proto/SQLITE_README.html b/postfix/proto/SQLITE_README.html new file mode 100644 index 000000000..b6294633c --- /dev/null +++ b/postfix/proto/SQLITE_README.html @@ -0,0 +1,96 @@ + + + + + + +Postfix SQLite Howto + + + + + + + +

    Postfix SQLite Howto

    + +
    + +

    Introduction

    + +

    The Postfix sqlite map type allows you to hook up Postfix to a +SQLite database. This implementation allows for multiple sqlite +databases: you can use one for a virtual(5) table, one for an +access(5) table, and one for an aliases(5) table if you want.

    + +

    Building Postfix with SQLite support

    + +

    The Postfix SQLite client utilizes the sqlite3 library, +which can be obtained from:

    + +
    +

    http://www.sqlite.org/

    +
    + +

    In order to build Postfix with sqlite map support, you will need to add +-DHAS_SQLITE and -I for the directory containing the sqlite headers, and +the sqlite3 library to AUXLIBS, for example:

    + +
    +
    +make -f Makefile.init makefiles \
+     'CCARGS=-DHAS_SQLITE -I/usr/local/include' \
+     'AUXLIBS=-L/usr/local/lib -lsqlite3 -lpthread'
+
    +
    + +

    Then, just run 'make'.

    + +

    Using SQLite tables

    + +

    Once Postfix is built with sqlite support, you can specify a +map type in main.cf like this:

    + +
    +
    +alias_maps = sqlite:/etc/postfix/sqlite-aliases.cf
+
    +
    + +

    The file /etc/postfix/sqlite-aliases.cf specifies lots of +information telling Postfix how to reference the sqlite database. +For a complete description, see the sqlite_table(5) manual page.

    + +

    Example: local aliases

    + +
    +#
+# sqlite config file for local(8) aliases(5) lookups
+#
+
+# Path to database 
+dbpath = /some/path/to/sqlite_database
+
+# See sqlite_table(5) for details.
+query = SELECT forw_addr FROM mxaliases WHERE alias='%s' AND status='paid'
+
    + +

    Additional notes

    + +

    The SQLite configuration interface setup allows for multiple +sqlite databases: you can use one for a virtual table, one for an +access table, and one for an aliases table if you want.

    + +

    Credits

    + +
      + +
    • Implementation by Axel Steiner
      • +
    • Documentation by Jesus Garcia Crespo
      • + +
    + + + + diff --git a/postfix/proto/ldap_table b/postfix/proto/ldap_table index 709d06fdf..e9cd373f5 100644 --- a/postfix/proto/ldap_table +++ b/postfix/proto/ldap_table @@ -48,14 +48,8 @@ # written in main.cf, which is normally world-readable. Support # for this form will be removed in a future Postfix version. # -# Postfix 2.2 has enhanced query interfaces for MySQL and PostgreSQL. -# These include features that were previously available only in the -# Postfix LDAP client. This work also created an opportunity for -# improvements in the LDAP interface. The primary compatibility -# issue is that \fBresult_filter\fR (a name that has caused some -# confusion as to its meaning in the past) has been renamed to -# \fBresult_format\fR. For backwards compatibility with the pre -# 2.2 LDAP client, \fBresult_filter\fR can for now be used instead +# For backwards compatibility with the pre +# 2.2 LDAP clients, \fBresult_filter\fR can for now be used instead # of \fBresult_format\fR, when the latter parameter is not also set. # The new name better reflects the function of the parameter. This # compatibility interface may be removed in a future release. diff --git a/postfix/proto/mysql_table b/postfix/proto/mysql_table index 0d7fe9cfb..23bdbb953 100644 --- a/postfix/proto/mysql_table +++ b/postfix/proto/mysql_table @@ -38,16 +38,14 @@ # written in main.cf, which is normally world-readable. Support # for this form will be removed in a future Postfix version. # -# Postfix 2.2 has enhanced query interfaces for MySQL and PostgreSQL; -# these include features previously available only in the Postfix -# LDAP client. In the new interface the SQL query is specified via -# a single \fBquery\fR parameter (described in more detail below). -# When the new \fBquery\fR parameter is not specified in the map -# definition, Postfix reverts to the old interface, with the SQL -# query constructed from the \fBselect_field\fR, \fBtable\fR, -# \fBwhere_field\fR and \fBadditional_conditions\fR parameters. -# The old interface will be gradually phased out. To migrate to -# the new interface set: +# Normally, the SQL query is specified via a single \fBquery\fR +# parameter (described in more detail below). When this +# parameter is not specified in the map definition, Postfix +# reverts to an older interface, with the SQL query constructed +# from the \fBselect_field\fR, \fBtable\fR, \fBwhere_field\fR +# and \fBadditional_conditions\fR parameters. The old interface +# will be gradually phased out. To migrate to the new interface +# set: # # .nf # \fBquery\fR = SELECT [\fIselect_field\fR] @@ -294,6 +292,7 @@ # postconf(5), configuration parameters # ldap_table(5), LDAP lookup tables # pgsql_table(5), PostgreSQL lookup tables +# sqlite_table(5), SQLite lookup tables # README FILES # .ad # .fi diff --git a/postfix/proto/pgsql_table b/postfix/proto/pgsql_table index 383060093..c62190e65 100644 --- a/postfix/proto/pgsql_table +++ b/postfix/proto/pgsql_table @@ -40,18 +40,14 @@ # Support for this form will be removed in a future Postfix # version. # -# Postfix 2.2 has enhanced query interfaces for MySQL and PostgreSQL, -# these include features previously available only in the Postfix -# LDAP client. In the new interface the SQL query is specified via -# a single \fBquery\fR parameter (described in more detail below). -# In Postfix 2.1 the parameter precedence was, from highest to lowest, -# \fBselect_function\fR, \fBquery\fR and finally \fBselect_field\fR, ... -# -# With Postfix 2.2 the \fBquery\fR parameter has highest precedence, -# and is used in preference to the still supported, but slated to be -# phased out, \fBselect_function\fR, \fBselect_field\fR, \fBtable\fR, -# \fBwhere_field\fR and \fBadditional_conditions\fR parameters. To -# migrate to the new interface set: +# Normally, the SQL query is specified via a single \fBquery\fR +# parameter (described in more detail below). When this +# parameter is not specified in the map definition, Postfix +# reverts to an older interface, with the SQL query +# constructed from the \fBselect_function\fR, \fBselect_field\fR, +# \fBtable\fR, \fBwhere_field\fR and \fBadditional_conditions\fR +# parameters. The old interface will be gradually phased +# out. To migrate to the new interface set: # # .nf # \fBquery\fR = SELECT \fIselect_function\fR('%s') @@ -318,6 +314,7 @@ # postconf(5), configuration parameters # ldap_table(5), LDAP lookup tables # mysql_table(5), MySQL lookup tables +# sqlite_table(5), SQLite lookup tables # README FILES # .ad # .fi diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index e41350341..2e28e08d3 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -9404,10 +9404,10 @@ The default is "no"; this prevents Postfix from trusting third-party certificates and giving them relay permission with permit_tls_all_clientcerts.

    -

    This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and -later versions. Specify "tls_append_default_CA = yes" for backwards -compatibility, to avoid breaking certificate verification with sites -that don't use permit_tls_all_clientcerts.

    +

    This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8, +2.7.2 and later versions. Specify "tls_append_default_CA = yes" for +backwards compatibility, to avoid breaking certificate verification +with sites that don't use permit_tls_all_clientcerts.

    %PARAM tls_random_exchange_name see "postconf -d" output diff --git a/postfix/proto/sqlite_table b/postfix/proto/sqlite_table new file mode 100644 index 000000000..f9934d207 --- /dev/null +++ b/postfix/proto/sqlite_table @@ -0,0 +1,281 @@ +#++ +# NAME +# sqlite_table 5 +# SUMMARY +# Postfix SQLite configuration +# SYNOPSIS +# \fBpostmap -q "\fIstring\fB" sqlite:/etc/postfix/filename\fR +# +# \fBpostmap -q - sqlite:/etc/postfix/\fIfilename\fR <\fIinputfile\fR +# DESCRIPTION +# The Postfix mail system uses optional tables for address +# rewriting or mail routing. These tables are usually in +# \fBdbm\fR or \fBdb\fR format. +# +# Alternatively, lookup tables can be specified as SQLite databases. +# In order to use SQLite lookups, define a SQLite source as a lookup +# table in main.cf, for example: +# .nf +# alias_maps = sqlite:/etc/sqlite-aliases.cf +# .fi +# +# The file /etc/postfix/sqlite-aliases.cf has the same format as +# the Postfix main.cf file, and can specify the parameters +# described below. +# BACKWARDS COMPATIBILITY +# .ad +# .fi +# For compatibility with other Postfix lookup tables, SQLite +# parameters can also be defined in main.cf. In order to do that, +# specify as SQLite source a name that doesn't begin with a slash +# or a dot. The SQLite parameters will then be accessible as the +# name you've given the source in its definition, an underscore, +# and the name of the parameter. For example, if the map is +# specified as "sqlite:\fIsqlitename\fR", the parameter "query" +# below would be defined in main.cf as "\fIsqlitename\fR_query". +# +# Normally, the SQL query is specified via a single \fBquery\fR +# parameter (described in more detail below). When this +# parameter is not specified in the map definition, Postfix +# reverts to an older interface, with the SQL query constructed +# from the \fBselect_field\fR, \fBtable\fR, \fBwhere_field\fR +# and \fBadditional_conditions\fR parameters. The old interface +# will be gradually phased out. To migrate to the new interface +# set: +# +# .nf +# \fBquery\fR = SELECT [\fIselect_field\fR] +# FROM [\fItable\fR] +# WHERE [\fIwhere_field\fR] = '%s' +# [\fIadditional_conditions\fR] +# .fi +# +# Insert the value, not the name, of each legacy parameter. Note +# that the \fBadditional_conditions\fR parameter is optional +# and if not empty, will always start with \fBAND\fR. +# LIST MEMBERSHIP +# .ad +# .fi +# When using SQL to store lists such as $mynetworks, +# $mydestination, $relay_domains, $local_recipient_maps, +# etc., it is important to understand that the table must +# store each list member as a separate key. The table lookup +# verifies the *existence* of the key. See "Postfix lists +# versus tables" in the DATABASE_README document for a +# discussion. +# +# Do NOT create tables that return the full list of domains +# in $mydestination or $relay_domains etc., or IP addresses +# in $mynetworks. +# +# DO create tables with each matching item as a key and with +# an arbitrary value. With SQL databases it is not uncommon to +# return the key itself or a constant value. +# SQLITE PARAMETERS +# .ad +# .fi +# .IP "\fBdbpath\fR" +# The SQLite database file location. Example: +# .nf +# dbpath = customer_database +# .fi +# .IP "\fBquery\fR" +# The SQL query template used to search the database, where \fB%s\fR +# is a substitute for the address Postfix is trying to resolve, +# e.g. +# .nf +# query = SELECT replacement FROM aliases WHERE mailbox = '%s' +# .fi +# +# This parameter supports the following '%' expansions: +# .RS +# .IP "\fB\fB%%\fR\fR" +# This is replaced by a literal '%' character. +# .IP "\fB\fB%s\fR\fR" +# This is replaced by the input key. +# SQL quoting is used to make sure that the input key does not +# add unexpected metacharacters. +# .IP "\fB\fB%u\fR\fR" +# When the input key is an address of the form user@domain, \fB%u\fR +# is replaced by the SQL quoted local part of the address. +# Otherwise, \fB%u\fR is replaced by the entire search string. +# If the localpart is empty, the query is suppressed and returns +# no results. +# .IP "\fB\fB%d\fR\fR" +# When the input key is an address of the form user@domain, \fB%d\fR +# is replaced by the SQL quoted domain part of the address. +# Otherwise, the query is suppressed and returns no results. +# .IP "\fB\fB%[SUD]\fR\fR" +# The upper-case equivalents of the above expansions behave in the +# \fBquery\fR parameter identically to their lower-case counter-parts. +# With the \fBresult_format\fR parameter (see below), they expand the +# input key rather than the result value. +# .IP "\fB\fB%[1-9]\fR\fR" +# The patterns %1, %2, ... %9 are replaced by the corresponding +# most significant component of the input key's domain. If the +# input key is \fIuser@mail.example.com\fR, then %1 is \fBcom\fR, +# %2 is \fBexample\fR and %3 is \fBmail\fR. If the input key is +# unqualified or does not have enough domain components to satisfy +# all the specified patterns, the query is suppressed and returns +# no results. +# .RE +# .IP +# The \fBdomain\fR parameter described below limits the input +# keys to addresses in matching domains. When the \fBdomain\fR +# parameter is non-empty, SQL queries for unqualified addresses +# or addresses in non-matching domains are suppressed +# and return no results. +# +# This parameter is available with Postfix 2.2. In prior releases +# the SQL query was built from the separate parameters: +# \fBselect_field\fR, \fBtable\fR, \fBwhere_field\fR and +# \fBadditional_conditions\fR. The mapping from the old parameters +# to the equivalent query is: +# +# .nf +# SELECT [\fBselect_field\fR] +# FROM [\fBtable\fR] +# WHERE [\fBwhere_field\fR] = '%s' +# [\fBadditional_conditions\fR] +# .fi +# +# The '%s' in the \fBWHERE\fR clause expands to the escaped search string. +# With Postfix 2.2 these legacy parameters are used if the \fBquery\fR +# parameter is not specified. +# +# NOTE: DO NOT put quotes around the query parameter. +# .IP "\fBresult_format (default: \fB%s\fR)\fR" +# Format template applied to result attributes. Most commonly used +# to append (or prepend) text to the result. This parameter supports +# the following '%' expansions: +# .RS +# .IP "\fB\fB%%\fR\fR" +# This is replaced by a literal '%' character. +# .IP "\fB\fB%s\fR\fR" +# This is replaced by the value of the result attribute. When +# result is empty it is skipped. +# .IP "\fB%u\fR +# When the result attribute value is an address of the form +# user@domain, \fB%u\fR is replaced by the local part of the +# address. When the result has an empty localpart it is skipped. +# .IP "\fB\fB%d\fR\fR" +# When a result attribute value is an address of the form +# user@domain, \fB%d\fR is replaced by the domain part of +# the attribute value. When the result is unqualified it +# is skipped. +# .IP "\fB\fB%[SUD1-9]\fR\fB" +# The upper-case and decimal digit expansions interpolate +# the parts of the input key rather than the result. Their +# behavior is identical to that described with \fBquery\fR, +# and in fact because the input key is known in advance, queries +# whose key does not contain all the information specified in +# the result template are suppressed and return no results. +# .RE +# .IP +# For example, using "result_format = smtp:[%s]" allows one +# to use a mailHost attribute as the basis of a transport(5) +# table. After applying the result format, multiple values +# are concatenated as comma separated strings. The expansion_limit +# and parameter explained below allows one to restrict the number +# of values in the result, which is especially useful for maps that +# must return at most one value. +# +# The default value \fB%s\fR specifies that each result value should +# be used as is. +# +# This parameter is available with Postfix 2.2 and later. +# +# NOTE: DO NOT put quotes around the result format! +# .IP "\fBdomain (default: no domain list)\fR" +# This is a list of domain names, paths to files, or +# dictionaries. When specified, only fully qualified search +# keys with a *non-empty* localpart and a matching domain +# are eligible for lookup: 'user' lookups, bare domain lookups +# and "@domain" lookups are not performed. This can significantly +# reduce the query load on the SQLite server. +# .nf +# domain = postfix.org, hash:/etc/postfix/searchdomains +# .fi +# +# It is best not to use SQL to store the domains eligible +# for SQL lookups. +# +# This parameter is available with Postfix 2.2 and later. +# +# NOTE: DO NOT define this parameter for local(8) aliases, +# because the input keys are always unqualified. +# .IP "\fBexpansion_limit (default: 0)\fR" +# A limit on the total number of result elements returned +# (as a comma separated list) by a lookup against the map. +# A setting of zero disables the limit. Lookups fail with a +# temporary error if the limit is exceeded. Setting the +# limit to 1 ensures that lookups do not return multiple +# values. +# OBSOLETE QUERY INTERFACE +# .ad +# .fi +# This section describes an interface that is deprecated as +# of Postfix 2.2. It is replaced by the more general \fBquery\fR +# interface described above. If the \fBquery\fR parameter +# is defined, the legacy parameters described here ignored. +# Please migrate to the new interface as the legacy interface +# may be removed in a future release. +# +# The following parameters can be used to fill in a +# SELECT template statement of the form: +# +# .nf +# SELECT [\fBselect_field\fR] +# FROM [\fBtable\fR] +# WHERE [\fBwhere_field\fR] = '%s' +# [\fBadditional_conditions\fR] +# .fi +# +# The specifier %s is replaced by the search string, and is +# escaped so if it contains single quotes or other odd characters, +# it will not cause a parse error, or worse, a security problem. +# .IP "\fBselect_field\fR" +# The SQL "select" parameter. Example: +# .nf +# \fBselect_field\fR = forw_addr +# .fi +# .IP "\fBtable\fR" +# The SQL "select .. from" table name. Example: +# .nf +# \fBtable\fR = mxaliases +# .fi +# .IP "\fBwhere_field\fR +# The SQL "select .. where" parameter. Example: +# .nf +# \fBwhere_field\fR = alias +# .fi +# .IP "\fBadditional_conditions\fR +# Additional conditions to the SQL query. Example: +# .nf +# \fBadditional_conditions\fR = AND status = 'paid' +# .fi +# SEE ALSO +# postmap(1), Postfix lookup table maintenance +# postconf(5), configuration parameters +# ldap_table(5), LDAP lookup tables +# mysql_table(5), MySQL lookup tables +# pgsql_table(5), PostgreSQL lookup tables +# README FILES +# .ad +# .fi +# Use "\fBpostconf readme_directory\fR" or +# "\fBpostconf html_directory\fR" to locate this information. +# .na +# .nf +# DATABASE_README, Postfix lookup table overview +# SQLITE_README, Postfix SQLITE driver +# LICENSE +# .ad +# .fi +# The Secure Mailer license must be distributed with this software. +# HISTORY +# SQLite support was introduced with Postfix version 2.8. +# AUTHOR(S) +# Original implementation by: +# Axel Steiner +#-- diff --git a/postfix/src/global/Makefile.in b/postfix/src/global/Makefile.in index 56c9b6ced..7acea1162 100644 --- a/postfix/src/global/Makefile.in +++ b/postfix/src/global/Makefile.in @@ -4,7 +4,7 @@ SRCS = abounce.c anvil_clnt.c been_here.c bounce.c bounce_log.c \ clnt_stream.c conv_time.c db_common.c debug_peer.c debug_process.c \ defer.c deliver_completed.c deliver_flock.c deliver_pass.c \ deliver_request.c dict_ldap.c dict_mysql.c dict_pgsql.c \ - dict_proxy.c domain_list.c dot_lockfile.c dot_lockfile_as.c \ + dict_proxy.c dict_sqlite.c domain_list.c dot_lockfile.c dot_lockfile_as.c \ dsb_scan.c dsn.c dsn_buf.c dsn_mask.c dsn_print.c dsn_util.c \ ehlo_mask.c ext_prop.c file_id.c flush_clnt.c header_opts.c \ header_token.c input_transp.c int_filt.c is_header.c log_adhoc.c \ @@ -35,7 +35,7 @@ OBJS = abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \ clnt_stream.o conv_time.o db_common.o debug_peer.o debug_process.o \ defer.o deliver_completed.o deliver_flock.o deliver_pass.o \ deliver_request.o dict_ldap.o dict_mysql.o dict_pgsql.o \ - dict_proxy.o domain_list.o dot_lockfile.o dot_lockfile_as.o \ + dict_proxy.o dict_sqlite.o domain_list.o dot_lockfile.o dot_lockfile_as.o \ dsb_scan.o dsn.o dsn_buf.o dsn_mask.o dsn_print.o dsn_util.o \ ehlo_mask.o ext_prop.o file_id.o flush_clnt.o header_opts.o \ header_token.o input_transp.o int_filt.o is_header.o log_adhoc.o \ @@ -65,7 +65,7 @@ HDRS = abounce.h anvil_clnt.h been_here.h bounce.h bounce_log.h \ canon_addr.h cfg_parser.h cleanup_user.h clnt_stream.h config.h \ conv_time.h db_common.h debug_peer.h debug_process.h defer.h \ deliver_completed.h deliver_flock.h deliver_pass.h deliver_request.h \ - dict_ldap.h dict_mysql.h dict_pgsql.h dict_proxy.h domain_list.h \ + dict_ldap.h dict_mysql.h dict_pgsql.h dict_proxy.h dict_sqlite.h domain_list.h \ dot_lockfile.h dot_lockfile_as.h dsb_scan.h dsn.h dsn_buf.h \ dsn_mask.h dsn_print.h dsn_util.h ehlo_mask.h ext_prop.h \ file_id.h flush_clnt.h header_opts.h header_token.h input_transp.h \ @@ -832,6 +832,13 @@ dict_mysql.o: db_common.h dict_mysql.o: dict_mysql.c dict_mysql.o: dict_mysql.h dict_mysql.o: string_list.h +dict_sqlite.o: ../../include/dict.h +dict_sqlite.o: ../../include/msg.h +dict_sqlite.o: ../../include/sys_defs.h +dict_sqlite.o: cfg_parser.h +dict_sqlite.o: db_common.h +dict_sqlite.o: dict_sqlite.c +dict_sqlite.o: dict_sqlite.h dict_pgsql.o: ../../include/argv.h dict_pgsql.o: ../../include/dict.h dict_pgsql.o: ../../include/events.h @@ -1239,6 +1246,7 @@ mail_dict.o: dict_ldap.h mail_dict.o: dict_mysql.h mail_dict.o: dict_pgsql.h mail_dict.o: dict_proxy.h +mail_dict.o: dict_sqlite.h mail_dict.o: mail_dict.c mail_dict.o: mail_dict.h mail_error.o: ../../include/name_mask.h diff --git a/postfix/src/global/db_common.c b/postfix/src/global/db_common.c index 887ceacd4..6a2fa4bec 100644 --- a/postfix/src/global/db_common.c +++ b/postfix/src/global/db_common.c @@ -161,13 +161,13 @@ typedef struct { STRING_LIST *domain; int flags; int nparts; -} DB_COMMON_CTX; +} DB_COMMON_CTX; /* db_common_parse - validate query or result template */ int db_common_parse(DICT *dict, void **ctxPtr, const char *format, int query) { - DB_COMMON_CTX *ctx = (DB_COMMON_CTX *) * ctxPtr; + DB_COMMON_CTX *ctx = (DB_COMMON_CTX *) *ctxPtr; const char *cp; int dynamic = 0; diff --git a/postfix/src/global/dict_mysql.c b/postfix/src/global/dict_mysql.c index 92db68d13..5bbc1c31b 100644 --- a/postfix/src/global/dict_mysql.c +++ b/postfix/src/global/dict_mysql.c @@ -31,7 +31,7 @@ /* main.cf configuration parameters for this search. /* /* In the first case, the configuration parameters below are -/* specified in the file as \fIname\fR=\fBvalue\fR pairs. +/* specified in the file as \fIname\fR=\fIvalue\fR pairs. /* /* In the second case, the configuration parameters are /* prefixed with the value of \fIname\fR and an underscore, @@ -47,29 +47,25 @@ /* See dict_open(3). /* .PP /* Configuration parameters: -/* -/* The parameters encodes a number of pieces of information: -/* username, password, databasename, table, select_field, -/* where_field, and hosts: -/* .IP \fIuser\fR +/* .IP user /* Username for connecting to the database. -/* .IP \fIpassword\fR +/* .IP password /* Password for the above. -/* .IP \fIdbname\fR +/* .IP dbname /* Name of the database. -/* .IP \fIdomain\fR +/* .IP domain /* List of domains the queries should be restricted to. If /* specified, only FQDN addresses whose domain parts matching this /* list will be queried against the SQL database. Lookups for /* partial addresses are also supressed. This can significantly /* reduce the query load on the server. -/* .IP \fIquery\fR +/* .IP query /* Query template, before the query is actually issued, variable /* substitutions are performed. See mysql_table(5) for details. If /* No query is specified, the legacy variables \fItable\fR, /* \fIselect_field\fR, \fIwhere_field\fR and \fIadditional_conditions\fR /* are used to construct the query template. -/* .IP \fIresult_format\fR +/* .IP result_format /* The format used to expand results from queries. Substitutions /* are performed as described in mysql_table(5). Defaults to returning /* the lookup result unchanged. @@ -78,22 +74,22 @@ /* exceed the limit fail with dict_errno=DICT_ERR_RETRY. Note that each /* non-empty (and non-NULL) column of a multi-column result row counts as /* one result. -/* .IP \fItable\fR +/* .IP table /* When \fIquery\fR is not set, name of the table used to construct the /* query string. This provides compatibility with older releases. -/* .IP \fIselect_field\fR +/* .IP select_field /* When \fIquery\fR is not set, name of the result field used to /* construct the query string. This provides compatibility with older /* releases. -/* .IP \fIwhere_field\fR +/* .IP where_field /* When \fIquery\fR is not set, name of the where clause field used to /* construct the query string. This provides compatibility with older /* releases. -/* .IP \fIadditional_conditions\fR +/* .IP additional_conditions /* When \fIquery\fR is not set, additional where clause conditions used /* to construct the query string. This provides compatibility with older /* releases. -/* .IP \fIhosts\fR +/* .IP hosts /* List of hosts to connect to. /* .PP /* For example, if you want the map to reference databases of @@ -117,10 +113,10 @@ /* \fIwhere_field\fR = \fBalias\fR /* .br /* \fIhosts\fR = \fBhost1.some.domain\fR \fBhost2.some.domain\fR -/* .IP \fIadditional_conditions\fR +/* .IP additional_conditions /* Backward compatibility when \fIquery\fR is not set, additional /* conditions to the WHERE clause. -/* .IP \fIhosts\fR +/* .IP hosts /* List of hosts to connect to. /* .PP /* For example, if you want the map to reference databases of diff --git a/postfix/src/global/dict_pgsql.c b/postfix/src/global/dict_pgsql.c index bedc568e3..c01c01097 100644 --- a/postfix/src/global/dict_pgsql.c +++ b/postfix/src/global/dict_pgsql.c @@ -32,7 +32,7 @@ /* obtain main.cf configuration parameters for this search. /* /* In the first case, the configuration parameters below are -/* specified in the file as \fIname\fR=\fBvalue\fR pairs. +/* specified in the file as \fIname\fR=\fIvalue\fR pairs. /* /* In the second case, the configuration parameters are /* prefixed with the value of \fIname\fR and an underscore, @@ -48,29 +48,25 @@ /* /* .PP /* Configuration parameters: -/* -/* The parameters encode a number of pieces of information: -/* username, password, databasename, table, select_field, -/* where_field, and hosts: -/* .IP \fIuser\fR +/* .IP user /* Username for connecting to the database. -/* .IP \fIpassword\fR +/* .IP password /* Password for the above. -/* .IP \fIdbname\fR +/* .IP dbname /* Name of the database. -/* .IP \fIquery\fR +/* .IP query /* Query template. If not defined a default query template is constructed /* from the legacy \fIselect_function\fR or failing that the \fItable\fR, /* \fIselect_field\fR, \fIwhere_field\fR, and \fIadditional_conditions\fR /* parameters. Before the query is issues, variable substitutions are /* performed. See pgsql_table(5). -/* .IP \fIdomain\fR +/* .IP domain /* List of domains the queries should be restricted to. If /* specified, only FQDN addresses whose domain parts matching this /* list will be queried against the SQL database. Lookups for /* partial addresses are also supressed. This can significantly /* reduce the query load on the server. -/* .IP \fIresult_format\fR +/* .IP result_format /* The format used to expand results from queries. Substitutions /* are performed as described in pgsql_table(5). Defaults to returning /* the lookup result unchanged. @@ -79,24 +75,24 @@ /* exceed the limit fail with dict_errno=DICT_ERR_RETRY. Note that each /* non-empty (and non-NULL) column of a multi-column result row counts as /* one result. -/* .IP \fIselect_function\fR +/* .IP select_function /* When \fIquery\fR is not defined, the function to be used instead of /* the default query based on the legacy \fItable\fR, \fIselect_field\fR, /* \fIwhere_field\fR, and \fIadditional_conditions\fR parameters. -/* .IP \fItable\fR +/* .IP table /* When \fIquery\fR and \fIselect_function\fR are not defined, the name of the /* FROM table used to construct the default query template, see pgsql_table(5). -/* .IP \fIselect_field\fR +/* .IP select_field /* When \fIquery\fR and \fIselect_function\fR are not defined, the name of the /* SELECT field used to construct the default query template, see pgsql_table(5). -/* .IP \fIwhere_field\fR +/* .IP where_field /* When \fIquery\fR and \fIselect_function\fR are not defined, the name of the /* WHERE field used to construct the default query template, see pgsql_table(5). -/* .IP \fIadditional_conditions\fR +/* .IP additional_conditions /* When \fIquery\fR and \fIselect_function\fR are not defined, the name of the /* additional text to add to the WHERE field in the default query template (this /* usually begins with "and") see pgsql_table(5). -/* .IP \fIhosts\fR +/* .IP hosts /* List of hosts to connect to. /* .PP /* For example, if you want the map to reference databases of diff --git a/postfix/src/global/dict_sqlite.c b/postfix/src/global/dict_sqlite.c new file mode 100644 index 000000000..1314107c1 --- /dev/null +++ b/postfix/src/global/dict_sqlite.c @@ -0,0 +1,303 @@ +/*++ +/* NAME +/* dict_sqlite 3 +/* SUMMARY +/* dictionary manager interface to SQLite3 databases +/* SYNOPSIS +/* #include +/* +/* DICT *dict_sqlite_open(name, open_flags, dict_flags) +/* const char *name; +/* int open_flags; +/* int dict_flags; +/* DESCRIPTION +/* dict_sqlite_open() creates a dictionary of type 'sqlite'. +/* This dictionary is an interface for the postfix key->value +/* mappings to SQLite. The result is a pointer to the installed +/* dictionary, or a null pointer in case of problems. +/* .PP +/* Arguments: +/* .IP name +/* Either the path to the SQLite configuration file (if it +/* starts with '/' or '.'), or the prefix which will be used +/* to obtain main.cf configuration parameters for this search. +/* +/* In the first case, the configuration parameters below are +/* specified in the file as \fIname\fR=\fIvalue\fR pairs. +/* +/* In the second case, the configuration parameters are prefixed +/* with the value of \fIname\fR and an underscore, and they +/* are specified in main.cf. For example, if this value is +/* \fIsqlitecon\fR, the parameters would look like +/* \fIsqlitecon_dbpath\fR, \fIsqlitecon_query\fR, and so on. +/* .IP open_flags +/* Must be O_RDONLY. +/* .IP dict_flags +/* See dict_open(3). +/* .PP +/* Configuration parameters: +/* .IP dbpath +/* Path to SQLite database +/* .IP query +/* Query template, before the query is actually issued, variable +/* substitutions are performed. See sqlite_table(5) for details. +/* .IP result_format +/* The format used to expand results from queries. Substitutions +/* are performed as described in sqlite_table(5). Defaults to +/* returning the lookup result unchanged. +/* .IP expansion_limit +/* Limit (if any) on the total number of lookup result values. +/* Lookups which exceed the limit fail with dict_errno=DICT_ERR_RETRY. +/* Note that each non-empty (and non-NULL) column of a +/* multi-column result row counts as one result. +/* .IP "select_field, where_field, additional_conditions" +/* Legacy query interface. +/* SEE ALSO +/* dict(3) generic dictionary manager +/* AUTHOR(S) +/* Axel Steiner +/* ast@treibsand.com +/*--*/ + +/* System library. */ + +#include +#include + +#ifdef HAS_SQLITE +#include + +#if !defined(SQLITE_VERSION_NUMBER) || (SQLITE_VERSION_NUMBER < 3005004) +#error "Your SQLite version is too old" +#endif + +/* Utility library. */ + +#include +#include +#include +#include +#include + +/* Global library. */ + +#include +#include + +/* Application-specific. */ + +#include + +typedef struct { + DICT dict; /* generic member */ + CFG_PARSER *parser; /* common parameter parser */ + sqlite3 *db; /* sqlite handle */ + char *query; /* db_common_expand() query */ + char *result_format; /* db_common_expand() result_format */ + void *ctx; /* db_common_parse() context */ + char *dbpath; /* dbpath config attribute */ + int expansion_limit; /* expansion_limit config attribute */ +} DICT_SQLITE; + +/* dict_sqlite_quote - escape SQL metacharacters in input string */ + +static void dict_sqlite_quote(DICT *dict, const char *name, VSTRING *result) +{ + char *q; + + q = sqlite3_mprintf("%q", name); + /* Fix 20100616 */ + if (q == 0) + msg_fatal("dict_sqlite_quote: out of memory"); + vstring_strcat(result, q); + sqlite3_free(q); +} + +/* dict_sqlite_close - close the database */ + +static void dict_sqlite_close(DICT *dict) +{ + const char *myname = "dict_sqlite_close"; + DICT_SQLITE *dict_sqlite = (DICT_SQLITE *) dict; + + if (msg_verbose) + msg_info("%s: %s", myname, dict_sqlite->parser->name); + + if (sqlite3_close(dict_sqlite->db) != SQLITE_OK) + msg_fatal("%s: close %s failed", myname, dict_sqlite->parser->name); + cfg_parser_free(dict_sqlite->parser); + myfree(dict_sqlite->dbpath); + myfree(dict_sqlite->query); + myfree(dict_sqlite->result_format); + if (dict_sqlite->ctx) + db_common_free_ctx(dict_sqlite->ctx); + if (dict->fold_buf) + vstring_free(dict->fold_buf); + dict_free(dict); +} + +/* dict_sqlite_lookup - find database entry */ + +static const char *dict_sqlite_lookup(DICT *dict, const char *name) +{ + const char *myname = "dict_sqlite_lookup"; + DICT_SQLITE *dict_sqlite = (DICT_SQLITE *) dict; + sqlite3_stmt *sql; + const char *zErrMsg; + static VSTRING *query; + static VSTRING *result; + const char *r; + int expansion = 0; + int status; + + /* + * Don't frustrate future attempts to make Postfix UTF-8 transparent. + */ + if (!valid_utf_8(name, strlen(name))) { + if (msg_verbose) + msg_info("%s: %s: Skipping lookup of non-UTF-8 key '%s'", + myname, dict_sqlite->parser->name, name); + return (0); + } + + /* + * Optionally fold the key. + */ + if (dict->flags & DICT_FLAG_FOLD_FIX) { + if (dict->fold_buf == 0) + dict->fold_buf = vstring_alloc(10); + vstring_strcpy(dict->fold_buf, name); + name = lowercase(vstring_str(dict->fold_buf)); + } + + /* + * Domain filter for email address lookups. + */ + if (db_common_check_domain(dict_sqlite->ctx, name) == 0) { + if (msg_verbose) + msg_info("%s: %s: Skipping lookup of '%s'", + myname, dict_sqlite->parser->name, name); + return (0); + } + + /* + * Expand the query and query the database. + */ +#define INIT_VSTR(buf, len) do { \ + if (buf == 0) \ + buf = vstring_alloc(len); \ + VSTRING_RESET(buf); \ + VSTRING_TERMINATE(buf); \ + } while (0) + + INIT_VSTR(query, 10); + + if (!db_common_expand(dict_sqlite->ctx, dict_sqlite->query, + name, 0, query, dict_sqlite_quote)) + return (0); + + if (msg_verbose) + msg_info("%s: %s: Searching with query %s", + myname, dict_sqlite->parser->name, vstring_str(query)); + + if (sqlite3_prepare_v2(dict_sqlite->db, vstring_str(query), -1, + &sql, &zErrMsg) != SQLITE_OK) { + msg_fatal("%s: %s: SQL prepare failed: %s\n", + myname, dict_sqlite->parser->name, + sqlite3_errmsg(dict_sqlite->db)); + } + + /* + * Retrieve and expand the result(s). + */ + INIT_VSTR(result, 10); + while ((status = sqlite3_step(sql)) == SQLITE_ROW) { + if (db_common_expand(dict_sqlite->ctx, dict_sqlite->result_format, + (char *) sqlite3_column_text(sql, 0), + name, result, 0) + && dict_sqlite->expansion_limit > 0 + && ++expansion > dict_sqlite->expansion_limit) { + msg_warn("%s: %s: Expansion limit exceeded for key: '%s'", + myname, dict_sqlite->parser->name, name); + dict_errno = DICT_ERR_RETRY; + break; + } + } + + /* Fix 20100616 */ + if (status != SQLITE_ROW && status != SQLITE_DONE) { + msg_warn("%s: %s: sql step for %s; %s\n", + myname, dict_sqlite->parser->name, + vstring_str(query), sqlite3_errmsg(dict_sqlite->db)); + dict_errno = DICT_ERR_RETRY; + } + + /* + * Clean up. + */ + if (sqlite3_finalize(sql)) + msg_fatal("%s: %s: SQL finalize for %s; %s\n", + myname, dict_sqlite->parser->name, + vstring_str(query), sqlite3_errmsg(dict_sqlite->db)); + + r = vstring_str(result); + return ((dict_errno == 0 && *r) ? r : 0); +} + +/* sqlite_parse_config - parse sqlite configuration file */ + +static void sqlite_parse_config(DICT_SQLITE *dict_sqlite, const char *sqlitecf) +{ + CFG_PARSER *p; + VSTRING *buf; + + p = dict_sqlite->parser = cfg_parser_alloc(sqlitecf); + dict_sqlite->dbpath = cfg_get_str(p, "dbpath", "", 1, 0); + dict_sqlite->result_format = cfg_get_str(p, "result_format", "%s", 1, 0); + + if ((dict_sqlite->query = cfg_get_str(p, "query", NULL, 0, 0)) == 0) { + buf = vstring_alloc(64); + db_common_sql_build_query(buf, p); + dict_sqlite->query = vstring_export(buf); + } + dict_sqlite->expansion_limit = cfg_get_int(p, "expansion_limit", 0, 0, 0); + dict_sqlite->ctx = 0; + + (void) db_common_parse(&dict_sqlite->dict, &dict_sqlite->ctx, dict_sqlite->query, 1); + (void) db_common_parse(0, &dict_sqlite->ctx, dict_sqlite->result_format, 0); + + db_common_parse_domain(p, dict_sqlite->ctx); + + if (dict_sqlite->dict.flags & DICT_FLAG_FOLD_FIX) + dict_sqlite->dict.fold_buf = vstring_alloc(10); +} + +/* dict_sqlite_open - open sqlite database */ + +DICT *dict_sqlite_open(const char *name, int open_flags, int dict_flags) +{ + DICT_SQLITE *dict_sqlite; + + /* + * Sanity checks. + */ + if (open_flags != O_RDONLY) + msg_fatal("%s:%s map requires O_RDONLY access mode", + DICT_TYPE_SQLITE, name); + + dict_sqlite = (DICT_SQLITE *) dict_alloc(DICT_TYPE_SQLITE, name, + sizeof(DICT_SQLITE)); + dict_sqlite->dict.lookup = dict_sqlite_lookup; + dict_sqlite->dict.close = dict_sqlite_close; + dict_sqlite->dict.flags = dict_flags; + dict_sqlite->dict.flags |= DICT_FLAG_FIXED; + sqlite_parse_config(dict_sqlite, name); + + if (sqlite3_open(dict_sqlite->dbpath, &dict_sqlite->db)) { + msg_fatal("Can't open database: %s\n", sqlite3_errmsg(dict_sqlite->db)); + sqlite3_close(dict_sqlite->db); + } + return (DICT_DEBUG (&dict_sqlite->dict)); +} + +#endif diff --git a/postfix/src/global/dict_sqlite.h b/postfix/src/global/dict_sqlite.h new file mode 100644 index 000000000..fb2bdf25f --- /dev/null +++ b/postfix/src/global/dict_sqlite.h @@ -0,0 +1,32 @@ +#ifndef _DICT_SQLITE_H_INCLUDED_ +#define _DICT_SQLITE_H_INCLUDED_ + +/*++ +/* NAME +/* dict_sqlite 3h +/* SUMMARY +/* dictionary manager interface to sqlite databases +/* SYNOPSIS +/* #include +/* DESCRIPTION +/* .nf + + /* + * Utility library. + */ +#include + + /* + * External interface. + */ +#define DICT_TYPE_SQLITE "sqlite" + +extern DICT *dict_sqlite_open(const char *, int, int); + + +/* AUTHOR(S) +/* Axel Steiner +/* ast@treibsand.com +/*--*/ + +#endif diff --git a/postfix/src/global/mail_dict.c b/postfix/src/global/mail_dict.c index 35ecffb88..337861d11 100644 --- a/postfix/src/global/mail_dict.c +++ b/postfix/src/global/mail_dict.c @@ -36,6 +36,7 @@ #include #include #include +#include #include typedef struct { @@ -53,6 +54,9 @@ static const DICT_OPEN_INFO dict_open_info[] = { #endif #ifdef HAS_PGSQL DICT_TYPE_PGSQL, dict_pgsql_open, +#endif +#ifdef HAS_SQLITE + DICT_TYPE_SQLITE, dict_sqlite_open, #endif 0, }; diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index 9d1233f29..157cbcea6 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20100615" +#define MAIL_RELEASE_DATE "20100617" #define MAIL_VERSION_NUMBER "2.8" #ifdef SNAPSHOT diff --git a/postfix/src/master/master.h b/postfix/src/master/master.h index 9c807c381..77c3e73ca 100644 --- a/postfix/src/master/master.h +++ b/postfix/src/master/master.h @@ -66,6 +66,7 @@ typedef struct MASTER_SERV { #define MASTER_FLAG_LOCAL_ONLY (1<<4) /* no remote clients */ #define MASTER_THROTTLED(f) ((f)->flags & MASTER_FLAG_THROTTLE) +#define MASTER_MARKED_FOR_DELETION(f) ((f)->flags & MASTER_FLAG_MARK) #define MASTER_LIMIT_OK(limit, count) ((limit) == 0 || ((count) < (limit))) diff --git a/postfix/src/master/master_spawn.c b/postfix/src/master/master_spawn.c index fadf90f2e..2d92a0d70 100644 --- a/postfix/src/master/master_spawn.c +++ b/postfix/src/master/master_spawn.c @@ -304,18 +304,25 @@ void master_reap_child(void) (char *) &pid, sizeof(pid))) == 0) msg_panic("master_reap: unknown pid: %d", pid); serv = proc->serv; + +#define MASTER_KILL_SIGNAL SIGTERM +#define MASTER_SENT_SIGNAL(serv, status) \ + (MASTER_MARKED_FOR_DELETION(serv) \ + && WTERMSIG(status) == MASTER_KILL_SIGNAL) + if (!NORMAL_EXIT_STATUS(status)) { if (WIFEXITED(status)) msg_warn("process %s pid %d exit status %d", serv->path, pid, WEXITSTATUS(status)); - if (WIFSIGNALED(status)) + if (WIFSIGNALED(status) && !MASTER_SENT_SIGNAL(serv, status)) msg_warn("process %s pid %d killed by signal %d", serv->path, pid, WTERMSIG(status)); - } - if (!NORMAL_EXIT_STATUS(status) && proc->use_count == 0 - && (serv->flags & MASTER_FLAG_THROTTLE) == 0) { - msg_warn("%s: bad command startup -- throttling", serv->path); - master_throttle(serv); + /* master_delete_children() throttles first, then kills. */ + if (proc->use_count == 0 + && (serv->flags & MASTER_FLAG_THROTTLE) == 0) { + msg_warn("%s: bad command startup -- throttling", serv->path); + master_throttle(serv); + } } master_delete_child(proc); } @@ -338,7 +345,7 @@ void master_delete_children(MASTER_SERV *serv) for (info = list = binhash_list(master_child_table); *info; info++) { proc = (MASTER_PROC *) info[0]->value; if (proc->serv == serv) - (void) kill(proc->pid, SIGTERM); + (void) kill(proc->pid, MASTER_KILL_SIGNAL); } while (serv->total_proc > 0) master_reap_child(); diff --git a/postfix/src/postconf/postconf.c b/postfix/src/postconf/postconf.c index d1ae43427..a2c5ce772 100644 --- a/postfix/src/postconf/postconf.c +++ b/postfix/src/postconf/postconf.c @@ -146,6 +146,9 @@ /* .IP \fBsdbm\fR /* An indexed file type based on hashing. /* This is available on systems with support for SDBM databases. +/* .IP "\fBsqlite\fR (read-only)" +/* Perform lookups from SQLite database files. This is described +/* in \fBsqlite_table\fR(5). /* .IP "\fBstatic\fR (read-only)" /* A table that always returns its name as lookup result. For example, /* \fBstatic:foobar\fR always returns the string \fBfoobar\fR as lookup diff --git a/postfix/src/postfix/postfix.c b/postfix/src/postfix/postfix.c index c49a9479c..1a2df97d9 100644 --- a/postfix/src/postfix/postfix.c +++ b/postfix/src/postfix/postfix.c @@ -245,6 +245,7 @@ /* pcre_table(5), Associate PCRE pattern with value /* pgsql_table(5), Postfix PostgreSQL client /* regexp_table(5), Associate POSIX regexp pattern with value +/* slite_table(5), Postfix SQLite database driver /* tcp_table(5), Postfix client-server table lookup /* /* Daemon processes: diff --git a/postfix/src/util/vstring.c b/postfix/src/util/vstring.c index 2a3234397..783730d92 100644 --- a/postfix/src/util/vstring.c +++ b/postfix/src/util/vstring.c @@ -299,7 +299,7 @@ static void vstring_extend(VBUF *bp, ssize_t incr) * negative length parameters). */ new_len = bp->len + (bp->len > incr ? bp->len : incr); - if (new_len < 0) + if (new_len <= bp->len) msg_fatal("vstring_extend: length overflow"); bp->data = (unsigned char *) myrealloc((char *) bp->data, new_len); bp->len = new_len;