1c2aa98e2SPeter Wemmdivert(-1) 2c2aa98e2SPeter Wemm# 3605302a5SGregory Neil Shapiro# Copyright (c) 1998-2002 Sendmail, Inc. and its suppliers. 406f25ae9SGregory Neil Shapiro# All rights reserved. 5c2aa98e2SPeter Wemm# Copyright (c) 1983, 1995 Eric P. Allman. All rights reserved. 6c2aa98e2SPeter Wemm# Copyright (c) 1988, 1993 7c2aa98e2SPeter Wemm# The Regents of the University of California. All rights reserved. 8c2aa98e2SPeter Wemm# 9c2aa98e2SPeter Wemm# By using this file, you agree to the terms and conditions set 10c2aa98e2SPeter Wemm# forth in the LICENSE file which can be found at the top level of 11c2aa98e2SPeter Wemm# the sendmail distribution. 12c2aa98e2SPeter Wemm# 13c2aa98e2SPeter Wemm# 14c2aa98e2SPeter Wemmdivert(0) 15c2aa98e2SPeter Wemm 1613bd1963SGregory Neil ShapiroVERSIONID(`$Id: proto.m4,v 8.649.2.13 2002/12/04 00:12:18 ca Exp $') 17c2aa98e2SPeter Wemm 1806f25ae9SGregory Neil Shapiro# level CF_LEVEL config file format 1906f25ae9SGregory Neil ShapiroV`'CF_LEVEL/ifdef(`VENDOR_NAME', `VENDOR_NAME', `Berkeley') 20c2aa98e2SPeter Wemmdivert(-1) 21c2aa98e2SPeter Wemm 2240266059SGregory Neil Shapirodnl if MAILER(`local') not defined: do it ourself; be nice 2340266059SGregory Neil Shapirodnl maybe we should issue a warning? 2440266059SGregory Neil Shapiroifdef(`_MAILER_local_',`', `MAILER(local)') 2540266059SGregory Neil Shapiro 26c2aa98e2SPeter Wemm# do some sanity checking 27c2aa98e2SPeter Wemmifdef(`__OSTYPE__',, 2806f25ae9SGregory Neil Shapiro `errprint(`*** ERROR: No system type defined (use OSTYPE macro) 2906f25ae9SGregory Neil Shapiro')') 30c2aa98e2SPeter Wemm 31c2aa98e2SPeter Wemm# pick our default mailers 32c2aa98e2SPeter Wemmifdef(`confSMTP_MAILER',, `define(`confSMTP_MAILER', `esmtp')') 33c2aa98e2SPeter Wemmifdef(`confLOCAL_MAILER',, `define(`confLOCAL_MAILER', `local')') 34c2aa98e2SPeter Wemmifdef(`confRELAY_MAILER',, 35c2aa98e2SPeter Wemm `define(`confRELAY_MAILER', 36c2aa98e2SPeter Wemm `ifdef(`_MAILER_smtp_', `relay', 37c2aa98e2SPeter Wemm `ifdef(`_MAILER_uucp', `uucp-new', `unknown')')')') 38c2aa98e2SPeter Wemmifdef(`confUUCP_MAILER',, `define(`confUUCP_MAILER', `uucp-old')') 39c2aa98e2SPeter Wemmdefine(`_SMTP_', `confSMTP_MAILER')dnl for readability only 40c2aa98e2SPeter Wemmdefine(`_LOCAL_', `confLOCAL_MAILER')dnl for readability only 41c2aa98e2SPeter Wemmdefine(`_RELAY_', `confRELAY_MAILER')dnl for readability only 42c2aa98e2SPeter Wemmdefine(`_UUCP_', `confUUCP_MAILER')dnl for readability only 43c2aa98e2SPeter Wemm 44c2aa98e2SPeter Wemm# back compatibility with old config files 45c2aa98e2SPeter Wemmifdef(`confDEF_GROUP_ID', 4606f25ae9SGregory Neil Shapiro`errprint(`*** confDEF_GROUP_ID is obsolete. 4706f25ae9SGregory Neil Shapiro Use confDEF_USER_ID with a colon in the value instead. 4806f25ae9SGregory Neil Shapiro')') 49c2aa98e2SPeter Wemmifdef(`confREAD_TIMEOUT', 5006f25ae9SGregory Neil Shapiro`errprint(`*** confREAD_TIMEOUT is obsolete. 5106f25ae9SGregory Neil Shapiro Use individual confTO_<timeout> parameters instead. 5206f25ae9SGregory Neil Shapiro')') 53c2aa98e2SPeter Wemmifdef(`confMESSAGE_TIMEOUT', 54c2aa98e2SPeter Wemm `define(`_ARG_', index(confMESSAGE_TIMEOUT, /)) 55c2aa98e2SPeter Wemm ifelse(_ARG_, -1, 56c2aa98e2SPeter Wemm `define(`confTO_QUEUERETURN', confMESSAGE_TIMEOUT)', 57c2aa98e2SPeter Wemm `define(`confTO_QUEUERETURN', 58c2aa98e2SPeter Wemm substr(confMESSAGE_TIMEOUT, 0, _ARG_)) 59c2aa98e2SPeter Wemm define(`confTO_QUEUEWARN', 60c2aa98e2SPeter Wemm substr(confMESSAGE_TIMEOUT, eval(_ARG_+1)))')') 61c2aa98e2SPeter Wemmifdef(`confMIN_FREE_BLOCKS', `ifelse(index(confMIN_FREE_BLOCKS, /), -1,, 6206f25ae9SGregory Neil Shapiro`errprint(`*** compound confMIN_FREE_BLOCKS is obsolete. 6306f25ae9SGregory Neil Shapiro Use confMAX_MESSAGE_SIZE for the second part of the value. 6406f25ae9SGregory Neil Shapiro')')') 6506f25ae9SGregory Neil Shapiro 6606f25ae9SGregory Neil Shapiro 6706f25ae9SGregory Neil Shapiro# Sanity check on ldap_routing feature 6806f25ae9SGregory Neil Shapiro# If the user doesn't specify a new map, they better have given as a 6906f25ae9SGregory Neil Shapiro# default LDAP specification which has the LDAP base (and most likely the host) 7006f25ae9SGregory Neil Shapiroifdef(`confLDAP_DEFAULT_SPEC',, `ifdef(`_LDAP_ROUTING_WARN_', `errprint(` 7106f25ae9SGregory Neil ShapiroWARNING: Using default FEATURE(ldap_routing) map definition(s) 7206f25ae9SGregory Neil Shapirowithout setting confLDAP_DEFAULT_SPEC option. 7306f25ae9SGregory Neil Shapiro')')')dnl 74c2aa98e2SPeter Wemm 75c2aa98e2SPeter Wemm# clean option definitions below.... 7606f25ae9SGregory Neil Shapirodefine(`_OPTION', `ifdef(`$2', `O $1`'ifelse(defn(`$2'), `',, `=$2')', `#O $1`'ifelse(`$3', `',,`=$3')')')dnl 77c2aa98e2SPeter Wemm 7806f25ae9SGregory Neil Shapirodnl required to "rename" the check_* rulesets... 7906f25ae9SGregory Neil Shapirodefine(`_U_',ifdef(`_DELAY_CHECKS_',`',`_')) 8006f25ae9SGregory Neil Shapirodnl default relaying denied message 8140266059SGregory Neil Shapiroifdef(`confRELAY_MSG', `', `define(`confRELAY_MSG', 8240266059SGregory Neil Shapiroifdef(`_USE_AUTH_', `"550 Relaying denied. Proper authentication required."', `"550 Relaying denied"'))') 8340266059SGregory Neil Shapiroifdef(`confRCPTREJ_MSG', `', `define(`confRCPTREJ_MSG', `"550 Mailbox disabled for this recipient"')') 8440266059SGregory Neil Shapirodefine(`_CODE553', `553') 85c2aa98e2SPeter Wemmdivert(0)dnl 86c2aa98e2SPeter Wemm 8706f25ae9SGregory Neil Shapiro# override file safeties - setting this option compromises system security, 8806f25ae9SGregory Neil Shapiro# addressing the actual file configuration problem is preferred 8906f25ae9SGregory Neil Shapiro# need to set this before any file actions are encountered in the cf file 9006f25ae9SGregory Neil Shapiro_OPTION(DontBlameSendmail, `confDONT_BLAME_SENDMAIL', `safe') 9106f25ae9SGregory Neil Shapiro 9206f25ae9SGregory Neil Shapiro# default LDAP map specification 9306f25ae9SGregory Neil Shapiro# need to set this now before any LDAP maps are defined 9406f25ae9SGregory Neil Shapiro_OPTION(LDAPDefaultSpec, `confLDAP_DEFAULT_SPEC', `-h localhost') 95c2aa98e2SPeter Wemm 96c2aa98e2SPeter Wemm################## 97c2aa98e2SPeter Wemm# local info # 98c2aa98e2SPeter Wemm################## 99c2aa98e2SPeter Wemm 10040266059SGregory Neil Shapiro# my LDAP cluster 10140266059SGregory Neil Shapiro# need to set this before any LDAP lookups are done (including classes) 10240266059SGregory Neil Shapiroifdef(`confLDAP_CLUSTER', `D{sendmailMTACluster}`'confLDAP_CLUSTER', `#D{sendmailMTACluster}$m') 10340266059SGregory Neil Shapiro 104c2aa98e2SPeter WemmCwlocalhost 105c2aa98e2SPeter Wemmifdef(`USE_CW_FILE', 106c2aa98e2SPeter Wemm`# file containing names of hosts for which we receive email 107c2aa98e2SPeter WemmFw`'confCW_FILE', 108c2aa98e2SPeter Wemm `dnl') 109c2aa98e2SPeter Wemm 110c2aa98e2SPeter Wemm# my official domain name 111c2aa98e2SPeter Wemm# ... `define' this only if sendmail cannot automatically determine your domain 112c2aa98e2SPeter Wemmifdef(`confDOMAIN_NAME', `Dj`'confDOMAIN_NAME', `#Dj$w.Foo.COM') 113c2aa98e2SPeter Wemm 114c2aa98e2SPeter WemmCP. 115c2aa98e2SPeter Wemm 116c2aa98e2SPeter Wemmifdef(`UUCP_RELAY', 117c2aa98e2SPeter Wemm`# UUCP relay host 118c2aa98e2SPeter WemmDY`'UUCP_RELAY 119c2aa98e2SPeter WemmCPUUCP 120c2aa98e2SPeter Wemm 121c2aa98e2SPeter Wemm')dnl 122c2aa98e2SPeter Wemmifdef(`BITNET_RELAY', 123c2aa98e2SPeter Wemm`# BITNET relay host 124c2aa98e2SPeter WemmDB`'BITNET_RELAY 125c2aa98e2SPeter WemmCPBITNET 126c2aa98e2SPeter Wemm 127c2aa98e2SPeter Wemm')dnl 128c2aa98e2SPeter Wemmifdef(`DECNET_RELAY', 129c2aa98e2SPeter Wemm`define(`_USE_DECNET_SYNTAX_', 1)dnl 130c2aa98e2SPeter Wemm# DECnet relay host 131c2aa98e2SPeter WemmDC`'DECNET_RELAY 132c2aa98e2SPeter WemmCPDECNET 133c2aa98e2SPeter Wemm 134c2aa98e2SPeter Wemm')dnl 135c2aa98e2SPeter Wemmifdef(`FAX_RELAY', 136c2aa98e2SPeter Wemm`# FAX relay host 137c2aa98e2SPeter WemmDF`'FAX_RELAY 138c2aa98e2SPeter WemmCPFAX 139c2aa98e2SPeter Wemm 140c2aa98e2SPeter Wemm')dnl 141c2aa98e2SPeter Wemm# "Smart" relay host (may be null) 14240266059SGregory Neil ShapiroDS`'ifdef(`SMART_HOST', `SMART_HOST') 143c2aa98e2SPeter Wemm 144c2aa98e2SPeter Wemmifdef(`LUSER_RELAY', `dnl 145c2aa98e2SPeter Wemm# place to which unknown users should be forwarded 146c2aa98e2SPeter WemmKuser user -m -a<> 147c2aa98e2SPeter WemmDL`'LUSER_RELAY', 148c2aa98e2SPeter Wemm`dnl') 149c2aa98e2SPeter Wemm 150c2aa98e2SPeter Wemm# operators that cannot be in local usernames (i.e., network indicators) 151c2aa98e2SPeter WemmCO @ % ifdef(`_NO_UUCP_', `', `!') 152c2aa98e2SPeter Wemm 153c2aa98e2SPeter Wemm# a class with just dot (for identifying canonical names) 154c2aa98e2SPeter WemmC.. 155c2aa98e2SPeter Wemm 156c2aa98e2SPeter Wemm# a class with just a left bracket (for identifying domain literals) 157c2aa98e2SPeter WemmC[[ 158c2aa98e2SPeter Wemm 15906f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 16006f25ae9SGregory Neil Shapiro# access_db acceptance class 16106f25ae9SGregory Neil ShapiroC{Accept}OK RELAY 16240266059SGregory Neil Shapiroifdef(`_DELAY_COMPAT_8_10_',`dnl 16306f25ae9SGregory Neil Shapiroifdef(`_BLACKLIST_RCPT_',`dnl 16406f25ae9SGregory Neil Shapiro# possible access_db RHS for spam friends/haters 16506f25ae9SGregory Neil ShapiroC{SpamTag}SPAMFRIEND SPAMHATER')')', 166c2aa98e2SPeter Wemm`dnl') 167c2aa98e2SPeter Wemm 16840266059SGregory Neil Shapirodnl mark for "domain is ok" (resolved or accepted anyway) 16940266059SGregory Neil Shapirodefine(`_RES_OK_', `OKR')dnl 170c2aa98e2SPeter Wemmifdef(`_ACCEPT_UNRESOLVABLE_DOMAINS_',`dnl',`dnl 171c2aa98e2SPeter Wemm# Resolve map (to check if a host exists in check_mail) 17240266059SGregory Neil ShapiroKresolve host -a<_RES_OK_> -T<TEMP>') 17340266059SGregory Neil ShapiroC{ResOk}_RES_OK_ 174c2aa98e2SPeter Wemm 17513058a91SGregory Neil Shapiroifdef(`_NEED_MACRO_MAP_', `dnl 17613058a91SGregory Neil Shapiroifdef(`_MACRO_MAP_', `', `# macro storage map 17713058a91SGregory Neil Shapirodefine(`_MACRO_MAP_', `1')dnl 17813058a91SGregory Neil ShapiroKmacro macro')', `dnl') 17942e5d165SGregory Neil Shapiro 180c2aa98e2SPeter Wemmifdef(`confCR_FILE', `dnl 18142e5d165SGregory Neil Shapiro# Hosts for which relaying is permitted ($=R) 182c2aa98e2SPeter WemmFR`'confCR_FILE', 183c2aa98e2SPeter Wemm`dnl') 184c2aa98e2SPeter Wemm 18540266059SGregory Neil Shapirodefine(`TLS_SRV_TAG', `"TLS_Srv"')dnl 18640266059SGregory Neil Shapirodefine(`TLS_CLT_TAG', `"TLS_Clt"')dnl 18740266059SGregory Neil Shapirodefine(`TLS_RCPT_TAG', `"TLS_Rcpt"')dnl 18840266059SGregory Neil Shapirodefine(`TLS_TRY_TAG', `"Try_TLS"')dnl 18940266059SGregory Neil Shapirodefine(`SRV_FEAT_TAG', `"Srv_Features"')dnl 19006f25ae9SGregory Neil Shapirodnl this may be useful in other contexts too 19106f25ae9SGregory Neil Shapiroifdef(`_ARITH_MAP_', `', `# arithmetic map 19206f25ae9SGregory Neil Shapirodefine(`_ARITH_MAP_', `1')dnl 19306f25ae9SGregory Neil ShapiroKarith arith') 19406f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 19540266059SGregory Neil Shapiroifdef(`_MACRO_MAP_', `', `# macro storage map 19640266059SGregory Neil Shapirodefine(`_MACRO_MAP_', `1')dnl 19740266059SGregory Neil ShapiroKmacro macro') 19840266059SGregory Neil Shapiro# possible values for TLS_connection in access map 19906f25ae9SGregory Neil ShapiroC{tls}VERIFY ENCR', `dnl') 20006f25ae9SGregory Neil Shapiroifdef(`_CERT_REGEX_ISSUER_', `dnl 20106f25ae9SGregory Neil Shapiro# extract relevant part from cert issuer 20206f25ae9SGregory Neil ShapiroKCERTIssuer regex _CERT_REGEX_ISSUER_', `dnl') 20306f25ae9SGregory Neil Shapiroifdef(`_CERT_REGEX_SUBJECT_', `dnl 20406f25ae9SGregory Neil Shapiro# extract relevant part from cert subject 20506f25ae9SGregory Neil ShapiroKCERTSubject regex _CERT_REGEX_SUBJECT_', `dnl') 20606f25ae9SGregory Neil Shapiro 20740266059SGregory Neil Shapiroifdef(`LOCAL_RELAY', `dnl 20813bd1963SGregory Neil Shapiro# who I send unqualified names to if FEATURE(stickyhost) is used 20913bd1963SGregory Neil Shapiro# (null means deliver locally) 21040266059SGregory Neil ShapiroDR`'LOCAL_RELAY') 211c2aa98e2SPeter Wemm 21240266059SGregory Neil Shapiroifdef(`MAIL_HUB', `dnl 21313bd1963SGregory Neil Shapiro# who gets all local email traffic 21413bd1963SGregory Neil Shapiro# ($R has precedence for unqualified names if FEATURE(stickyhost) is used) 21540266059SGregory Neil ShapiroDH`'MAIL_HUB') 216c2aa98e2SPeter Wemm 217c2aa98e2SPeter Wemm# dequoting map 21840266059SGregory Neil ShapiroKdequote dequote`'ifdef(`confDEQUOTE_OPTS', ` confDEQUOTE_OPTS', `') 219c2aa98e2SPeter Wemm 220c2aa98e2SPeter Wemmdivert(0)dnl # end of nullclient diversion 221c2aa98e2SPeter Wemm# class E: names that should be exposed as from this host, even if we masquerade 22206f25ae9SGregory Neil Shapiro# class L: names that should be delivered locally, even if we have a relay 223c2aa98e2SPeter Wemm# class M: domains that should be converted to $M 22406f25ae9SGregory Neil Shapiro# class N: domains that should not be converted to $M 225c2aa98e2SPeter Wemm#CL root 226c2aa98e2SPeter Wemmundivert(5)dnl 22706f25ae9SGregory Neil Shapiroifdef(`_VIRTHOSTS_', `CR$={VirtHost}', `dnl') 228c2aa98e2SPeter Wemm 22940266059SGregory Neil Shapiroifdef(`MASQUERADE_NAME', `dnl 230c2aa98e2SPeter Wemm# who I masquerade as (null for no masquerading) (see also $=M) 23140266059SGregory Neil ShapiroDM`'MASQUERADE_NAME') 232c2aa98e2SPeter Wemm 233c2aa98e2SPeter Wemm# my name for error messages 234c2aa98e2SPeter Wemmifdef(`confMAILER_NAME', `Dn`'confMAILER_NAME', `#DnMAILER-DAEMON') 235c2aa98e2SPeter Wemm 23606f25ae9SGregory Neil Shapiroundivert(6)dnl LOCAL_CONFIG 237c2aa98e2SPeter Wemminclude(_CF_DIR_`m4/version.m4') 238c2aa98e2SPeter Wemm 239c2aa98e2SPeter Wemm############### 240c2aa98e2SPeter Wemm# Options # 241c2aa98e2SPeter Wemm############### 24240266059SGregory Neil Shapiroifdef(`confAUTO_REBUILD', 24340266059SGregory Neil Shapiro`errprint(WARNING: `confAUTO_REBUILD' is no longer valid. 24440266059SGregory Neil Shapiro There was a potential for a denial of service attack if this is set. 24540266059SGregory Neil Shapiro)')dnl 246c2aa98e2SPeter Wemm 247c2aa98e2SPeter Wemm# strip message body to 7 bits on input? 24806f25ae9SGregory Neil Shapiro_OPTION(SevenBitInput, `confSEVEN_BIT_INPUT', `False') 249c2aa98e2SPeter Wemm 250c2aa98e2SPeter Wemm# 8-bit data handling 2518774250cSGregory Neil Shapiro_OPTION(EightBitMode, `confEIGHT_BIT_HANDLING', `pass8') 252c2aa98e2SPeter Wemm 253c2aa98e2SPeter Wemm# wait for alias file rebuild (default units: minutes) 25406f25ae9SGregory Neil Shapiro_OPTION(AliasWait, `confALIAS_WAIT', `5m') 255c2aa98e2SPeter Wemm 256c2aa98e2SPeter Wemm# location of alias file 25706f25ae9SGregory Neil Shapiro_OPTION(AliasFile, `ALIAS_FILE', `MAIL_SETTINGS_DIR`'aliases') 25806f25ae9SGregory Neil Shapiro 259c2aa98e2SPeter Wemm# minimum number of free blocks on filesystem 26006f25ae9SGregory Neil Shapiro_OPTION(MinFreeBlocks, `confMIN_FREE_BLOCKS', `100') 261c2aa98e2SPeter Wemm 262c2aa98e2SPeter Wemm# maximum message size 26306f25ae9SGregory Neil Shapiro_OPTION(MaxMessageSize, `confMAX_MESSAGE_SIZE', `1000000') 264c2aa98e2SPeter Wemm 265c2aa98e2SPeter Wemm# substitution for space (blank) characters 26606f25ae9SGregory Neil Shapiro_OPTION(BlankSub, `confBLANK_SUB', `_') 267c2aa98e2SPeter Wemm 268c2aa98e2SPeter Wemm# avoid connecting to "expensive" mailers on initial submission? 26906f25ae9SGregory Neil Shapiro_OPTION(HoldExpensive, `confCON_EXPENSIVE', `False') 270c2aa98e2SPeter Wemm 271c2aa98e2SPeter Wemm# checkpoint queue runs after every N successful deliveries 27206f25ae9SGregory Neil Shapiro_OPTION(CheckpointInterval, `confCHECKPOINT_INTERVAL', `10') 273c2aa98e2SPeter Wemm 274c2aa98e2SPeter Wemm# default delivery mode 27506f25ae9SGregory Neil Shapiro_OPTION(DeliveryMode, `confDELIVERY_MODE', `background') 276c2aa98e2SPeter Wemm 277c2aa98e2SPeter Wemm# error message header/file 27806f25ae9SGregory Neil Shapiro_OPTION(ErrorHeader, `confERROR_MESSAGE', `MAIL_SETTINGS_DIR`'error-header') 279c2aa98e2SPeter Wemm 280c2aa98e2SPeter Wemm# error mode 28106f25ae9SGregory Neil Shapiro_OPTION(ErrorMode, `confERROR_MODE', `print') 282c2aa98e2SPeter Wemm 283c2aa98e2SPeter Wemm# save Unix-style "From_" lines at top of header? 28406f25ae9SGregory Neil Shapiro_OPTION(SaveFromLine, `confSAVE_FROM_LINES', `False') 285c2aa98e2SPeter Wemm 28640266059SGregory Neil Shapiro# queue file mode (qf files) 28740266059SGregory Neil Shapiro_OPTION(QueueFileMode, `confQUEUE_FILE_MODE', `0600') 28840266059SGregory Neil Shapiro 289c2aa98e2SPeter Wemm# temporary file mode 29006f25ae9SGregory Neil Shapiro_OPTION(TempFileMode, `confTEMP_FILE_MODE', `0600') 291c2aa98e2SPeter Wemm 292c2aa98e2SPeter Wemm# match recipients against GECOS field? 29306f25ae9SGregory Neil Shapiro_OPTION(MatchGECOS, `confMATCH_GECOS', `False') 294c2aa98e2SPeter Wemm 295c2aa98e2SPeter Wemm# maximum hop count 29640266059SGregory Neil Shapiro_OPTION(MaxHopCount, `confMAX_HOP', `25') 297c2aa98e2SPeter Wemm 298c2aa98e2SPeter Wemm# location of help file 29906f25ae9SGregory Neil ShapiroO HelpFile=ifdef(`HELP_FILE', HELP_FILE, `MAIL_SETTINGS_DIR`'helpfile') 300c2aa98e2SPeter Wemm 301c2aa98e2SPeter Wemm# ignore dots as terminators in incoming messages? 30206f25ae9SGregory Neil Shapiro_OPTION(IgnoreDots, `confIGNORE_DOTS', `False') 303c2aa98e2SPeter Wemm 304c2aa98e2SPeter Wemm# name resolver options 30506f25ae9SGregory Neil Shapiro_OPTION(ResolverOptions, `confBIND_OPTS', `+AAONLY') 306c2aa98e2SPeter Wemm 307c2aa98e2SPeter Wemm# deliver MIME-encapsulated error messages? 30806f25ae9SGregory Neil Shapiro_OPTION(SendMimeErrors, `confMIME_FORMAT_ERRORS', `True') 309c2aa98e2SPeter Wemm 310c2aa98e2SPeter Wemm# Forward file search path 31106f25ae9SGregory Neil Shapiro_OPTION(ForwardPath, `confFORWARD_PATH', `/var/forward/$u:$z/.forward.$w:$z/.forward') 312c2aa98e2SPeter Wemm 313c2aa98e2SPeter Wemm# open connection cache size 31406f25ae9SGregory Neil Shapiro_OPTION(ConnectionCacheSize, `confMCI_CACHE_SIZE', `2') 315c2aa98e2SPeter Wemm 316c2aa98e2SPeter Wemm# open connection cache timeout 31706f25ae9SGregory Neil Shapiro_OPTION(ConnectionCacheTimeout, `confMCI_CACHE_TIMEOUT', `5m') 318c2aa98e2SPeter Wemm 319c2aa98e2SPeter Wemm# persistent host status directory 32006f25ae9SGregory Neil Shapiro_OPTION(HostStatusDirectory, `confHOST_STATUS_DIRECTORY', `.hoststat') 321c2aa98e2SPeter Wemm 322c2aa98e2SPeter Wemm# single thread deliveries (requires HostStatusDirectory)? 32306f25ae9SGregory Neil Shapiro_OPTION(SingleThreadDelivery, `confSINGLE_THREAD_DELIVERY', `False') 324c2aa98e2SPeter Wemm 325c2aa98e2SPeter Wemm# use Errors-To: header? 32606f25ae9SGregory Neil Shapiro_OPTION(UseErrorsTo, `confUSE_ERRORS_TO', `False') 327c2aa98e2SPeter Wemm 328c2aa98e2SPeter Wemm# log level 32906f25ae9SGregory Neil Shapiro_OPTION(LogLevel, `confLOG_LEVEL', `10') 330c2aa98e2SPeter Wemm 331c2aa98e2SPeter Wemm# send to me too, even in an alias expansion? 33206f25ae9SGregory Neil Shapiro_OPTION(MeToo, `confME_TOO', `True') 333c2aa98e2SPeter Wemm 334c2aa98e2SPeter Wemm# verify RHS in newaliases? 33506f25ae9SGregory Neil Shapiro_OPTION(CheckAliases, `confCHECK_ALIASES', `False') 336c2aa98e2SPeter Wemm 337c2aa98e2SPeter Wemm# default messages to old style headers if no special punctuation? 33806f25ae9SGregory Neil Shapiro_OPTION(OldStyleHeaders, `confOLD_STYLE_HEADERS', `False') 339c2aa98e2SPeter Wemm 340c2aa98e2SPeter Wemm# SMTP daemon options 34106f25ae9SGregory Neil Shapiroifelse(defn(`confDAEMON_OPTIONS'), `', `dnl', 342605302a5SGregory Neil Shapiro`errprint(WARNING: `confDAEMON_OPTIONS' is no longer valid. 343605302a5SGregory Neil Shapiro Use `DAEMON_OPTIONS()'; see cf/README. 34406f25ae9SGregory Neil Shapiro)'dnl 34506f25ae9SGregory Neil Shapiro`DAEMON_OPTIONS(`confDAEMON_OPTIONS')') 34642e5d165SGregory Neil Shapiroifelse(defn(`_DPO_'), `', 34740266059SGregory Neil Shapiro`ifdef(`_NETINET6_', `O DaemonPortOptions=Name=MTA-v4, Family=inet 34840266059SGregory Neil ShapiroO DaemonPortOptions=Name=MTA-v6, Family=inet6',`O DaemonPortOptions=Name=MTA')', `_DPO_') 34906f25ae9SGregory Neil Shapiroifdef(`_NO_MSA_', `dnl', `O DaemonPortOptions=Port=587, Name=MSA, M=E') 35006f25ae9SGregory Neil Shapiro 35106f25ae9SGregory Neil Shapiro# SMTP client options 35240266059SGregory Neil Shapiroifelse(defn(`confCLIENT_OPTIONS'), `', `dnl', 35340266059SGregory Neil Shapiro`errprint(WARNING: `confCLIENT_OPTIONS' is no longer valid. See cf/README for more information. 35440266059SGregory Neil Shapiro)'dnl 35540266059SGregory Neil Shapiro`CLIENT_OPTIONS(`confCLIENT_OPTIONS')') 35640266059SGregory Neil Shapiroifelse(defn(`_CPO_'), `', 35740266059SGregory Neil Shapiro`#O ClientPortOptions=Family=inet, Address=0.0.0.0', `_CPO_') 35840266059SGregory Neil Shapiro 35940266059SGregory Neil Shapiro# Modifiers to `define' {daemon_flags} for direct submissions 36040266059SGregory Neil Shapiro_OPTION(DirectSubmissionModifiers, `confDIRECT_SUBMISSION_MODIFIERS', `') 36140266059SGregory Neil Shapiro 36240266059SGregory Neil Shapiro# Use as mail submission program? See sendmail/SECURITY 36340266059SGregory Neil Shapiro_OPTION(UseMSP, `confUSE_MSP', `') 364c2aa98e2SPeter Wemm 365c2aa98e2SPeter Wemm# privacy flags 36606f25ae9SGregory Neil Shapiro_OPTION(PrivacyOptions, `confPRIVACY_FLAGS', `authwarnings') 367c2aa98e2SPeter Wemm 368c2aa98e2SPeter Wemm# who (if anyone) should get extra copies of error messages 36906f25ae9SGregory Neil Shapiro_OPTION(PostmasterCopy, `confCOPY_ERRORS_TO', `Postmaster') 370c2aa98e2SPeter Wemm 371c2aa98e2SPeter Wemm# slope of queue-only function 37206f25ae9SGregory Neil Shapiro_OPTION(QueueFactor, `confQUEUE_FACTOR', `600000') 373c2aa98e2SPeter Wemm 37440266059SGregory Neil Shapiro# limit on number of concurrent queue runners 37540266059SGregory Neil Shapiro_OPTION(MaxQueueChildren, `confMAX_QUEUE_CHILDREN', `') 37640266059SGregory Neil Shapiro 37740266059SGregory Neil Shapiro# maximum number of queue-runners per queue-grouping with multiple queues 37840266059SGregory Neil Shapiro_OPTION(MaxRunnersPerQueue, `confMAX_RUNNERS_PER_QUEUE', `1') 37940266059SGregory Neil Shapiro 38040266059SGregory Neil Shapiro# priority of queue runners (nice(3)) 38140266059SGregory Neil Shapiro_OPTION(NiceQueueRun, `confNICE_QUEUE_RUN', `') 38240266059SGregory Neil Shapiro 38340266059SGregory Neil Shapiro# shall we sort the queue by hostname first? 38440266059SGregory Neil Shapiro_OPTION(QueueSortOrder, `confQUEUE_SORT_ORDER', `priority') 38540266059SGregory Neil Shapiro 38640266059SGregory Neil Shapiro# minimum time in queue before retry 38740266059SGregory Neil Shapiro_OPTION(MinQueueAge, `confMIN_QUEUE_AGE', `30m') 38840266059SGregory Neil Shapiro 38940266059SGregory Neil Shapiro# how many jobs can you process in the queue? 39040266059SGregory Neil Shapiro_OPTION(MaxQueueRunSize, `confMAX_QUEUE_RUN_SIZE', `10000') 39140266059SGregory Neil Shapiro 39240266059SGregory Neil Shapiro# perform initial split of envelope without checking MX records 39340266059SGregory Neil Shapiro_OPTION(FastSplit, `confFAST_SPLIT', `1') 39440266059SGregory Neil Shapiro 395c2aa98e2SPeter Wemm# queue directory 39606f25ae9SGregory Neil ShapiroO QueueDirectory=ifdef(`QUEUE_DIR', QUEUE_DIR, `/var/spool/mqueue') 397c2aa98e2SPeter Wemm 39840266059SGregory Neil Shapiro# key for shared memory; 0 to turn off 39940266059SGregory Neil Shapiro_OPTION(SharedMemoryKey, `confSHARED_MEMORY_KEY', `0') 40040266059SGregory Neil Shapiro 401605302a5SGregory Neil Shapiroifdef(`confSHARED_MEMORY_KEY_FILE', `dnl 402605302a5SGregory Neil Shapiro# file to store key for shared memory (if SharedMemoryKey = -1) 403605302a5SGregory Neil ShapiroO SharedMemoryKeyFile=confSHARED_MEMORY_KEY_FILE') 404605302a5SGregory Neil Shapiro 405c2aa98e2SPeter Wemm# timeouts (many of these) 40606f25ae9SGregory Neil Shapiro_OPTION(Timeout.initial, `confTO_INITIAL', `5m') 40706f25ae9SGregory Neil Shapiro_OPTION(Timeout.connect, `confTO_CONNECT', `5m') 40840266059SGregory Neil Shapiro_OPTION(Timeout.aconnect, `confTO_ACONNECT', `0s') 40906f25ae9SGregory Neil Shapiro_OPTION(Timeout.iconnect, `confTO_ICONNECT', `5m') 41006f25ae9SGregory Neil Shapiro_OPTION(Timeout.helo, `confTO_HELO', `5m') 41106f25ae9SGregory Neil Shapiro_OPTION(Timeout.mail, `confTO_MAIL', `10m') 41206f25ae9SGregory Neil Shapiro_OPTION(Timeout.rcpt, `confTO_RCPT', `1h') 41306f25ae9SGregory Neil Shapiro_OPTION(Timeout.datainit, `confTO_DATAINIT', `5m') 41406f25ae9SGregory Neil Shapiro_OPTION(Timeout.datablock, `confTO_DATABLOCK', `1h') 41506f25ae9SGregory Neil Shapiro_OPTION(Timeout.datafinal, `confTO_DATAFINAL', `1h') 41606f25ae9SGregory Neil Shapiro_OPTION(Timeout.rset, `confTO_RSET', `5m') 41706f25ae9SGregory Neil Shapiro_OPTION(Timeout.quit, `confTO_QUIT', `2m') 41806f25ae9SGregory Neil Shapiro_OPTION(Timeout.misc, `confTO_MISC', `2m') 41906f25ae9SGregory Neil Shapiro_OPTION(Timeout.command, `confTO_COMMAND', `1h') 42006f25ae9SGregory Neil Shapiro_OPTION(Timeout.ident, `confTO_IDENT', `5s') 42106f25ae9SGregory Neil Shapiro_OPTION(Timeout.fileopen, `confTO_FILEOPEN', `60s') 42206f25ae9SGregory Neil Shapiro_OPTION(Timeout.control, `confTO_CONTROL', `2m') 42306f25ae9SGregory Neil Shapiro_OPTION(Timeout.queuereturn, `confTO_QUEUERETURN', `5d') 42406f25ae9SGregory Neil Shapiro_OPTION(Timeout.queuereturn.normal, `confTO_QUEUERETURN_NORMAL', `5d') 42506f25ae9SGregory Neil Shapiro_OPTION(Timeout.queuereturn.urgent, `confTO_QUEUERETURN_URGENT', `2d') 42606f25ae9SGregory Neil Shapiro_OPTION(Timeout.queuereturn.non-urgent, `confTO_QUEUERETURN_NONURGENT', `7d') 42706f25ae9SGregory Neil Shapiro_OPTION(Timeout.queuewarn, `confTO_QUEUEWARN', `4h') 42806f25ae9SGregory Neil Shapiro_OPTION(Timeout.queuewarn.normal, `confTO_QUEUEWARN_NORMAL', `4h') 42906f25ae9SGregory Neil Shapiro_OPTION(Timeout.queuewarn.urgent, `confTO_QUEUEWARN_URGENT', `1h') 43006f25ae9SGregory Neil Shapiro_OPTION(Timeout.queuewarn.non-urgent, `confTO_QUEUEWARN_NONURGENT', `12h') 43106f25ae9SGregory Neil Shapiro_OPTION(Timeout.hoststatus, `confTO_HOSTSTATUS', `30m') 43206f25ae9SGregory Neil Shapiro_OPTION(Timeout.resolver.retrans, `confTO_RESOLVER_RETRANS', `5s') 43306f25ae9SGregory Neil Shapiro_OPTION(Timeout.resolver.retrans.first, `confTO_RESOLVER_RETRANS_FIRST', `5s') 43406f25ae9SGregory Neil Shapiro_OPTION(Timeout.resolver.retrans.normal, `confTO_RESOLVER_RETRANS_NORMAL', `5s') 43506f25ae9SGregory Neil Shapiro_OPTION(Timeout.resolver.retry, `confTO_RESOLVER_RETRY', `4') 43606f25ae9SGregory Neil Shapiro_OPTION(Timeout.resolver.retry.first, `confTO_RESOLVER_RETRY_FIRST', `4') 43706f25ae9SGregory Neil Shapiro_OPTION(Timeout.resolver.retry.normal, `confTO_RESOLVER_RETRY_NORMAL', `4') 43840266059SGregory Neil Shapiro_OPTION(Timeout.lhlo, `confTO_LHLO', `2m') 43940266059SGregory Neil Shapiro_OPTION(Timeout.auth, `confTO_AUTH', `10m') 44040266059SGregory Neil Shapiro_OPTION(Timeout.starttls, `confTO_STARTTLS', `1h') 44140266059SGregory Neil Shapiro 44240266059SGregory Neil Shapiro# time for DeliverBy; extension disabled if less than 0 44340266059SGregory Neil Shapiro_OPTION(DeliverByMin, `confDELIVER_BY_MIN', `0') 444c2aa98e2SPeter Wemm 445c2aa98e2SPeter Wemm# should we not prune routes in route-addr syntax addresses? 44606f25ae9SGregory Neil Shapiro_OPTION(DontPruneRoutes, `confDONT_PRUNE_ROUTES', `False') 447c2aa98e2SPeter Wemm 448c2aa98e2SPeter Wemm# queue up everything before forking? 44906f25ae9SGregory Neil Shapiro_OPTION(SuperSafe, `confSAFE_QUEUE', `True') 450c2aa98e2SPeter Wemm 451c2aa98e2SPeter Wemm# status file 45206f25ae9SGregory Neil ShapiroO StatusFile=ifdef(`STATUS_FILE', `STATUS_FILE', `MAIL_SETTINGS_DIR`'statistics') 453c2aa98e2SPeter Wemm 454c2aa98e2SPeter Wemm# time zone handling: 455c2aa98e2SPeter Wemm# if undefined, use system default 456c2aa98e2SPeter Wemm# if defined but null, use TZ envariable passed in 457c2aa98e2SPeter Wemm# if defined and non-null, use that info 458c2aa98e2SPeter Wemmifelse(confTIME_ZONE, `USE_SYSTEM', `#O TimeZoneSpec=', 459c2aa98e2SPeter Wemm confTIME_ZONE, `USE_TZ', `O TimeZoneSpec=', 460c2aa98e2SPeter Wemm `O TimeZoneSpec=confTIME_ZONE') 461c2aa98e2SPeter Wemm 462c2aa98e2SPeter Wemm# default UID (can be username or userid:groupid) 46306f25ae9SGregory Neil Shapiro_OPTION(DefaultUser, `confDEF_USER_ID', `mailnull') 464c2aa98e2SPeter Wemm 465c2aa98e2SPeter Wemm# list of locations of user database file (null means no lookup) 46606f25ae9SGregory Neil Shapiro_OPTION(UserDatabaseSpec, `confUSERDB_SPEC', `MAIL_SETTINGS_DIR`'userdb') 467c2aa98e2SPeter Wemm 468c2aa98e2SPeter Wemm# fallback MX host 46906f25ae9SGregory Neil Shapiro_OPTION(FallbackMXhost, `confFALLBACK_MX', `fall.back.host.net') 470c2aa98e2SPeter Wemm 471c2aa98e2SPeter Wemm# if we are the best MX host for a site, try it directly instead of config err 47206f25ae9SGregory Neil Shapiro_OPTION(TryNullMXList, `confTRY_NULL_MX_LIST', `False') 473c2aa98e2SPeter Wemm 474c2aa98e2SPeter Wemm# load average at which we just queue messages 47506f25ae9SGregory Neil Shapiro_OPTION(QueueLA, `confQUEUE_LA', `8') 476c2aa98e2SPeter Wemm 477c2aa98e2SPeter Wemm# load average at which we refuse connections 47806f25ae9SGregory Neil Shapiro_OPTION(RefuseLA, `confREFUSE_LA', `12') 479c2aa98e2SPeter Wemm 48040266059SGregory Neil Shapiro# load average at which we delay connections; 0 means no limit 48140266059SGregory Neil Shapiro_OPTION(DelayLA, `confDELAY_LA', `0') 48240266059SGregory Neil Shapiro 483c2aa98e2SPeter Wemm# maximum number of children we allow at one time 484739ac4d4SGregory Neil Shapiro_OPTION(MaxDaemonChildren, `confMAX_DAEMON_CHILDREN', `0') 485c2aa98e2SPeter Wemm 486c2aa98e2SPeter Wemm# maximum number of new connections per second 487193538b7SGregory Neil Shapiro_OPTION(ConnectionRateThrottle, `confCONNECTION_RATE_THROTTLE', `0') 488c2aa98e2SPeter Wemm 489c2aa98e2SPeter Wemm# work recipient factor 49006f25ae9SGregory Neil Shapiro_OPTION(RecipientFactor, `confWORK_RECIPIENT_FACTOR', `30000') 491c2aa98e2SPeter Wemm 492c2aa98e2SPeter Wemm# deliver each queued job in a separate process? 49306f25ae9SGregory Neil Shapiro_OPTION(ForkEachJob, `confSEPARATE_PROC', `False') 494c2aa98e2SPeter Wemm 495c2aa98e2SPeter Wemm# work class factor 49606f25ae9SGregory Neil Shapiro_OPTION(ClassFactor, `confWORK_CLASS_FACTOR', `1800') 497c2aa98e2SPeter Wemm 498c2aa98e2SPeter Wemm# work time factor 49906f25ae9SGregory Neil Shapiro_OPTION(RetryFactor, `confWORK_TIME_FACTOR', `90000') 500c2aa98e2SPeter Wemm 501c2aa98e2SPeter Wemm# default character set 50206f25ae9SGregory Neil Shapiro_OPTION(DefaultCharSet, `confDEF_CHAR_SET', `iso-8859-1') 503c2aa98e2SPeter Wemm 50440266059SGregory Neil Shapiro# service switch file (name hardwired on Solaris, Ultrix, OSF/1, others) 50506f25ae9SGregory Neil Shapiro_OPTION(ServiceSwitchFile, `confSERVICE_SWITCH_FILE', `MAIL_SETTINGS_DIR`'service.switch') 506c2aa98e2SPeter Wemm 507c2aa98e2SPeter Wemm# hosts file (normally /etc/hosts) 50806f25ae9SGregory Neil Shapiro_OPTION(HostsFile, `confHOSTS_FILE', `/etc/hosts') 509c2aa98e2SPeter Wemm 510c2aa98e2SPeter Wemm# dialup line delay on connection failure 51106f25ae9SGregory Neil Shapiro_OPTION(DialDelay, `confDIAL_DELAY', `10s') 512c2aa98e2SPeter Wemm 513c2aa98e2SPeter Wemm# action to take if there are no recipients in the message 51406f25ae9SGregory Neil Shapiro_OPTION(NoRecipientAction, `confNO_RCPT_ACTION', `add-to-undisclosed') 515c2aa98e2SPeter Wemm 516c2aa98e2SPeter Wemm# chrooted environment for writing to files 51706f25ae9SGregory Neil Shapiro_OPTION(SafeFileEnvironment, `confSAFE_FILE_ENV', `/arch') 518c2aa98e2SPeter Wemm 519c2aa98e2SPeter Wemm# are colons OK in addresses? 52006f25ae9SGregory Neil Shapiro_OPTION(ColonOkInAddr, `confCOLON_OK_IN_ADDR', `True') 521c2aa98e2SPeter Wemm 522c2aa98e2SPeter Wemm# shall I avoid expanding CNAMEs (violates protocols)? 52306f25ae9SGregory Neil Shapiro_OPTION(DontExpandCnames, `confDONT_EXPAND_CNAMES', `False') 524c2aa98e2SPeter Wemm 525c2aa98e2SPeter Wemm# SMTP initial login message (old $e macro) 52606f25ae9SGregory Neil Shapiro_OPTION(SmtpGreetingMessage, `confSMTP_LOGIN_MSG', `$j Sendmail $v ready at $b') 527c2aa98e2SPeter Wemm 528c2aa98e2SPeter Wemm# UNIX initial From header format (old $l macro) 52906f25ae9SGregory Neil Shapiro_OPTION(UnixFromLine, `confFROM_LINE', `From $g $d') 530c2aa98e2SPeter Wemm 531c2aa98e2SPeter Wemm# From: lines that have embedded newlines are unwrapped onto one line 53206f25ae9SGregory Neil Shapiro_OPTION(SingleLineFromHeader, `confSINGLE_LINE_FROM_HEADER', `False') 533c2aa98e2SPeter Wemm 534c2aa98e2SPeter Wemm# Allow HELO SMTP command that does not `include' a host name 53506f25ae9SGregory Neil Shapiro_OPTION(AllowBogusHELO, `confALLOW_BOGUS_HELO', `False') 536c2aa98e2SPeter Wemm 537c2aa98e2SPeter Wemm# Characters to be quoted in a full name phrase (@,;:\()[] are automatic) 53806f25ae9SGregory Neil Shapiro_OPTION(MustQuoteChars, `confMUST_QUOTE_CHARS', `.') 539c2aa98e2SPeter Wemm 540c2aa98e2SPeter Wemm# delimiter (operator) characters (old $o macro) 54106f25ae9SGregory Neil Shapiro_OPTION(OperatorChars, `confOPERATORS', `.:@[]') 542c2aa98e2SPeter Wemm 543c2aa98e2SPeter Wemm# shall I avoid calling initgroups(3) because of high NIS costs? 54406f25ae9SGregory Neil Shapiro_OPTION(DontInitGroups, `confDONT_INIT_GROUPS', `False') 545c2aa98e2SPeter Wemm 546c2aa98e2SPeter Wemm# are group-writable `:include:' and .forward files (un)trustworthy? 54740266059SGregory Neil Shapiro# True (the default) means they are not trustworthy. 54806f25ae9SGregory Neil Shapiro_OPTION(UnsafeGroupWrites, `confUNSAFE_GROUP_WRITES', `True') 54940266059SGregory Neil Shapiroifdef(`confUNSAFE_GROUP_WRITES', 55040266059SGregory Neil Shapiro`errprint(`WARNING: confUNSAFE_GROUP_WRITES is deprecated; use confDONT_BLAME_SENDMAIL. 55140266059SGregory Neil Shapiro')') 552c2aa98e2SPeter Wemm 553c2aa98e2SPeter Wemm# where do errors that occur when sending errors get sent? 55406f25ae9SGregory Neil Shapiro_OPTION(DoubleBounceAddress, `confDOUBLE_BOUNCE_ADDRESS', `postmaster') 55506f25ae9SGregory Neil Shapiro 55606f25ae9SGregory Neil Shapiro# where to save bounces if all else fails 55706f25ae9SGregory Neil Shapiro_OPTION(DeadLetterDrop, `confDEAD_LETTER_DROP', `/var/tmp/dead.letter') 558c2aa98e2SPeter Wemm 559c2aa98e2SPeter Wemm# what user id do we assume for the majority of the processing? 56006f25ae9SGregory Neil Shapiro_OPTION(RunAsUser, `confRUN_AS_USER', `sendmail') 561c2aa98e2SPeter Wemm 562c2aa98e2SPeter Wemm# maximum number of recipients per SMTP envelope 56306f25ae9SGregory Neil Shapiro_OPTION(MaxRecipientsPerMessage, `confMAX_RCPTS_PER_MESSAGE', `100') 564c2aa98e2SPeter Wemm 56540266059SGregory Neil Shapiro# limit the rate recipients per SMTP envelope are accepted 56640266059SGregory Neil Shapiro# once the threshold number of recipients have been rejected 56740266059SGregory Neil Shapiro_OPTION(BadRcptThrottle, `confBAD_RCPT_THROTTLE', `20') 56840266059SGregory Neil Shapiro 569c2aa98e2SPeter Wemm# shall we get local names from our installed interfaces? 57006f25ae9SGregory Neil Shapiro_OPTION(DontProbeInterfaces, `confDONT_PROBE_INTERFACES', `False') 571c2aa98e2SPeter Wemm 57206f25ae9SGregory Neil Shapiro# Return-Receipt-To: header implies DSN request 57306f25ae9SGregory Neil Shapiro_OPTION(RrtImpliesDsn, `confRRT_IMPLIES_DSN', `False') 57406f25ae9SGregory Neil Shapiro 57506f25ae9SGregory Neil Shapiro# override connection address (for testing) 57606f25ae9SGregory Neil Shapiro_OPTION(ConnectOnlyTo, `confCONNECT_ONLY_TO', `0.0.0.0') 57706f25ae9SGregory Neil Shapiro 57806f25ae9SGregory Neil Shapiro# Trusted user for file ownership and starting the daemon 57906f25ae9SGregory Neil Shapiro_OPTION(TrustedUser, `confTRUSTED_USER', `root') 58006f25ae9SGregory Neil Shapiro 58106f25ae9SGregory Neil Shapiro# Control socket for daemon management 58206f25ae9SGregory Neil Shapiro_OPTION(ControlSocketName, `confCONTROL_SOCKET_NAME', `/var/spool/mqueue/.control') 58306f25ae9SGregory Neil Shapiro 58406f25ae9SGregory Neil Shapiro# Maximum MIME header length to protect MUAs 58506f25ae9SGregory Neil Shapiro_OPTION(MaxMimeHeaderLength, `confMAX_MIME_HEADER_LENGTH', `0/0') 58606f25ae9SGregory Neil Shapiro 58706f25ae9SGregory Neil Shapiro# Maximum length of the sum of all headers 58806f25ae9SGregory Neil Shapiro_OPTION(MaxHeadersLength, `confMAX_HEADERS_LENGTH', `32768') 58906f25ae9SGregory Neil Shapiro 59006f25ae9SGregory Neil Shapiro# Maximum depth of alias recursion 59106f25ae9SGregory Neil Shapiro_OPTION(MaxAliasRecursion, `confMAX_ALIAS_RECURSION', `10') 59206f25ae9SGregory Neil Shapiro 59306f25ae9SGregory Neil Shapiro# location of pid file 59406f25ae9SGregory Neil Shapiro_OPTION(PidFile, `confPID_FILE', `/var/run/sendmail.pid') 59506f25ae9SGregory Neil Shapiro 59606f25ae9SGregory Neil Shapiro# Prefix string for the process title shown on 'ps' listings 59706f25ae9SGregory Neil Shapiro_OPTION(ProcessTitlePrefix, `confPROCESS_TITLE_PREFIX', `prefix') 59806f25ae9SGregory Neil Shapiro 59906f25ae9SGregory Neil Shapiro# Data file (df) memory-buffer file maximum size 60006f25ae9SGregory Neil Shapiro_OPTION(DataFileBufferSize, `confDF_BUFFER_SIZE', `4096') 60106f25ae9SGregory Neil Shapiro 60206f25ae9SGregory Neil Shapiro# Transcript file (xf) memory-buffer file maximum size 60306f25ae9SGregory Neil Shapiro_OPTION(XscriptFileBufferSize, `confXF_BUFFER_SIZE', `4096') 60406f25ae9SGregory Neil Shapiro 60540266059SGregory Neil Shapiro# lookup type to find information about local mailboxes 60640266059SGregory Neil Shapiro_OPTION(MailboxDatabase, `confMAILBOX_DATABASE', `pw') 60740266059SGregory Neil Shapiro 60806f25ae9SGregory Neil Shapiro# list of authentication mechanisms 60940266059SGregory Neil Shapiro_OPTION(AuthMechanisms, `confAUTH_MECHANISMS', `EXTERNAL GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5') 61006f25ae9SGregory Neil Shapiro 61106f25ae9SGregory Neil Shapiro# default authentication information for outgoing connections 61206f25ae9SGregory Neil Shapiro_OPTION(DefaultAuthInfo, `confDEF_AUTH_INFO', `MAIL_SETTINGS_DIR`'default-auth-info') 61306f25ae9SGregory Neil Shapiro 61406f25ae9SGregory Neil Shapiro# SMTP AUTH flags 61506f25ae9SGregory Neil Shapiro_OPTION(AuthOptions, `confAUTH_OPTIONS', `') 61606f25ae9SGregory Neil Shapiro 61740266059SGregory Neil Shapiro# SMTP AUTH maximum encryption strength 61840266059SGregory Neil Shapiro_OPTION(AuthMaxBits, `confAUTH_MAX_BITS', `') 61940266059SGregory Neil Shapiro 62040266059SGregory Neil Shapiro# SMTP STARTTLS server options 62140266059SGregory Neil Shapiro_OPTION(TLSSrvOptions, `confTLS_SRV_OPTIONS', `') 62240266059SGregory Neil Shapiro 62306f25ae9SGregory Neil Shapiro# Input mail filters 62406f25ae9SGregory Neil Shapiro_OPTION(InputMailFilters, `confINPUT_MAIL_FILTERS', `') 62506f25ae9SGregory Neil Shapiro 626739ac4d4SGregory Neil Shapiroifelse(len(X`'_MAIL_FILTERS_DEF), `1', `dnl', `dnl 62706f25ae9SGregory Neil Shapiro# Milter options 62840266059SGregory Neil Shapiro_OPTION(Milter.LogLevel, `confMILTER_LOG_LEVEL', `') 62906f25ae9SGregory Neil Shapiro_OPTION(Milter.macros.connect, `confMILTER_MACROS_CONNECT', `') 63006f25ae9SGregory Neil Shapiro_OPTION(Milter.macros.helo, `confMILTER_MACROS_HELO', `') 63106f25ae9SGregory Neil Shapiro_OPTION(Milter.macros.envfrom, `confMILTER_MACROS_ENVFROM', `') 63206f25ae9SGregory Neil Shapiro_OPTION(Milter.macros.envrcpt, `confMILTER_MACROS_ENVRCPT', `')') 63306f25ae9SGregory Neil Shapiro 63406f25ae9SGregory Neil Shapiro# CA directory 63513bd1963SGregory Neil Shapiro_OPTION(CACertPath, `confCACERT_PATH', `') 63606f25ae9SGregory Neil Shapiro# CA file 63713bd1963SGregory Neil Shapiro_OPTION(CACertFile, `confCACERT', `') 63806f25ae9SGregory Neil Shapiro# Server Cert 63906f25ae9SGregory Neil Shapiro_OPTION(ServerCertFile, `confSERVER_CERT', `') 64006f25ae9SGregory Neil Shapiro# Server private key 64106f25ae9SGregory Neil Shapiro_OPTION(ServerKeyFile, `confSERVER_KEY', `') 64206f25ae9SGregory Neil Shapiro# Client Cert 64306f25ae9SGregory Neil Shapiro_OPTION(ClientCertFile, `confCLIENT_CERT', `') 64406f25ae9SGregory Neil Shapiro# Client private key 64506f25ae9SGregory Neil Shapiro_OPTION(ClientKeyFile, `confCLIENT_KEY', `') 64606f25ae9SGregory Neil Shapiro# DHParameters (only required if DSA/DH is used) 64706f25ae9SGregory Neil Shapiro_OPTION(DHParameters, `confDH_PARAMETERS', `') 64806f25ae9SGregory Neil Shapiro# Random data source (required for systems without /dev/urandom under OpenSSL) 64906f25ae9SGregory Neil Shapiro_OPTION(RandFile, `confRAND_FILE', `') 65006f25ae9SGregory Neil Shapiro 65140266059SGregory Neil Shapiro############################ 65240266059SGregory Neil Shapiro`# QUEUE GROUP DEFINITIONS #' 65340266059SGregory Neil Shapiro############################ 65440266059SGregory Neil Shapiro_QUEUE_GROUP_ 655065a643dSPeter Wemm 656c2aa98e2SPeter Wemm########################### 657c2aa98e2SPeter Wemm# Message precedences # 658c2aa98e2SPeter Wemm########################### 659c2aa98e2SPeter Wemm 660c2aa98e2SPeter WemmPfirst-class=0 661c2aa98e2SPeter WemmPspecial-delivery=100 662c2aa98e2SPeter WemmPlist=-30 663c2aa98e2SPeter WemmPbulk=-60 664c2aa98e2SPeter WemmPjunk=-100 665c2aa98e2SPeter Wemm 666c2aa98e2SPeter Wemm##################### 667c2aa98e2SPeter Wemm# Trusted users # 668c2aa98e2SPeter Wemm##################### 669c2aa98e2SPeter Wemm 670c2aa98e2SPeter Wemm# this is equivalent to setting class "t" 67106f25ae9SGregory Neil Shapiroifdef(`_USE_CT_FILE_', `', `#')Ft`'ifdef(`confCT_FILE', confCT_FILE, `MAIL_SETTINGS_DIR`'trusted-users') 672c2aa98e2SPeter WemmTroot 673c2aa98e2SPeter WemmTdaemon 674c2aa98e2SPeter Wemmifdef(`_NO_UUCP_', `dnl', `Tuucp') 675c2aa98e2SPeter Wemmifdef(`confTRUSTED_USERS', `T`'confTRUSTED_USERS', `dnl') 676c2aa98e2SPeter Wemm 677c2aa98e2SPeter Wemm######################### 678c2aa98e2SPeter Wemm# Format of headers # 679c2aa98e2SPeter Wemm######################### 680c2aa98e2SPeter Wemm 681c2aa98e2SPeter Wemmifdef(`confFROM_HEADER',, `define(`confFROM_HEADER', `$?x$x <$g>$|$g$.')')dnl 682c2aa98e2SPeter WemmH?P?Return-Path: <$g> 683c2aa98e2SPeter WemmHReceived: confRECEIVED_HEADER 684c2aa98e2SPeter WemmH?D?Resent-Date: $a 685c2aa98e2SPeter WemmH?D?Date: $a 686c2aa98e2SPeter WemmH?F?Resent-From: confFROM_HEADER 687c2aa98e2SPeter WemmH?F?From: confFROM_HEADER 688c2aa98e2SPeter WemmH?x?Full-Name: $x 689c2aa98e2SPeter Wemm# HPosted-Date: $a 690c2aa98e2SPeter Wemm# H?l?Received-Date: $b 691c2aa98e2SPeter WemmH?M?Resent-Message-Id: <$t.$i@$j> 692c2aa98e2SPeter WemmH?M?Message-Id: <$t.$i@$j> 69306f25ae9SGregory Neil Shapiro 694c2aa98e2SPeter Wemm# 695c2aa98e2SPeter Wemm###################################################################### 696c2aa98e2SPeter Wemm###################################################################### 697c2aa98e2SPeter Wemm##### 698c2aa98e2SPeter Wemm##### REWRITING RULES 699c2aa98e2SPeter Wemm##### 700c2aa98e2SPeter Wemm###################################################################### 701c2aa98e2SPeter Wemm###################################################################### 702c2aa98e2SPeter Wemm 703c2aa98e2SPeter Wemm############################################ 704c2aa98e2SPeter Wemm### Ruleset 3 -- Name Canonicalization ### 705c2aa98e2SPeter Wemm############################################ 70606f25ae9SGregory Neil ShapiroScanonify=3 707c2aa98e2SPeter Wemm 708c2aa98e2SPeter Wemm# handle null input (translate to <@> special case) 709c2aa98e2SPeter WemmR$@ $@ <@> 710c2aa98e2SPeter Wemm 711c2aa98e2SPeter Wemm# strip group: syntax (not inside angle brackets!) and trailing semicolon 712c2aa98e2SPeter WemmR$* $: $1 <@> mark addresses 713c2aa98e2SPeter WemmR$* < $* > $* <@> $: $1 < $2 > $3 unmark <addr> 714c2aa98e2SPeter WemmR@ $* <@> $: @ $1 unmark @host:... 71540266059SGregory Neil ShapiroR$* [ IPv6 : $+ ] <@> $: $1 [ IPv6 : $2 ] unmark IPv6 addr 716c2aa98e2SPeter WemmR$* :: $* <@> $: $1 :: $2 unmark node::addr 717c2aa98e2SPeter WemmR:`include': $* <@> $: :`include': $1 unmark :`include':... 718c2aa98e2SPeter WemmR$* : $* [ $* ] $: $1 : $2 [ $3 ] <@> remark if leading colon 719c2aa98e2SPeter WemmR$* : $* <@> $: $2 strip colon if marked 720c2aa98e2SPeter WemmR$* <@> $: $1 unmark 721c2aa98e2SPeter WemmR$* ; $1 strip trailing semi 722193538b7SGregory Neil ShapiroR$* < $+ :; > $* $@ $2 :; <@> catch <list:;> 723c2aa98e2SPeter WemmR$* < $* ; > $1 < $2 > bogus bracketed semi 724c2aa98e2SPeter Wemm 725c2aa98e2SPeter Wemm# null input now results from list:; syntax 726c2aa98e2SPeter WemmR$@ $@ :; <@> 727c2aa98e2SPeter Wemm 728c2aa98e2SPeter Wemm# strip angle brackets -- note RFC733 heuristic to get innermost item 729c2aa98e2SPeter WemmR$* $: < $1 > housekeeping <> 730c2aa98e2SPeter WemmR$+ < $* > < $2 > strip excess on left 731c2aa98e2SPeter WemmR< $* > $+ < $1 > strip excess on right 732c2aa98e2SPeter WemmR<> $@ < @ > MAIL FROM:<> case 733c2aa98e2SPeter WemmR< $+ > $: $1 remove housekeeping <> 734c2aa98e2SPeter Wemm 73506f25ae9SGregory Neil Shapiroifdef(`_USE_DEPRECATED_ROUTE_ADDR_',`dnl 736c2aa98e2SPeter Wemm# make sure <@a,@b,@c:user@d> syntax is easy to parse -- undone later 737c2aa98e2SPeter WemmR@ $+ , $+ @ $1 : $2 change all "," to ":" 738c2aa98e2SPeter Wemm 739c2aa98e2SPeter Wemm# localize and dispose of route-based addresses 74040266059SGregory Neil Shapirodnl XXX: IPv6 colon conflict 74140266059SGregory Neil Shapiroifdef(`NO_NETINET6', `dnl', 74240266059SGregory Neil Shapiro`R@ [$+] : $+ $@ $>Canonify2 < @ [$1] > : $2 handle <route-addr>') 74306f25ae9SGregory Neil ShapiroR@ $+ : $+ $@ $>Canonify2 < @$1 > : $2 handle <route-addr> 74406f25ae9SGregory Neil Shapirodnl',`dnl 74506f25ae9SGregory Neil Shapiro# strip route address <@a,@b,@c:user@d> -> <user@d> 74606f25ae9SGregory Neil ShapiroR@ $+ , $+ $2 74740266059SGregory Neil Shapiroifdef(`NO_NETINET6', `dnl', 74840266059SGregory Neil Shapiro`R@ [ $* ] : $+ $2') 74906f25ae9SGregory Neil ShapiroR@ $+ : $+ $2 75006f25ae9SGregory Neil Shapirodnl') 751c2aa98e2SPeter Wemm 752c2aa98e2SPeter Wemm# find focus for list syntax 75306f25ae9SGregory Neil ShapiroR $+ : $* ; @ $+ $@ $>Canonify2 $1 : $2 ; < @ $3 > list syntax 754c2aa98e2SPeter WemmR $+ : $* ; $@ $1 : $2; list syntax 755c2aa98e2SPeter Wemm 756c2aa98e2SPeter Wemm# find focus for @ syntax addresses 757c2aa98e2SPeter WemmR$+ @ $+ $: $1 < @ $2 > focus on domain 758c2aa98e2SPeter WemmR$+ < $+ @ $+ > $1 $2 < @ $3 > move gaze right 75906f25ae9SGregory Neil ShapiroR$+ < @ $+ > $@ $>Canonify2 $1 < @ $2 > already canonical 760c2aa98e2SPeter Wemm 76140266059SGregory Neil Shapirodnl This is flagged as an error in S0; no need to silently fix it here. 76240266059SGregory Neil Shapirodnl # do some sanity checking 76340266059SGregory Neil Shapirodnl R$* < @ $~[ $* : $* > $* $1 < @ $2 $3 > $4 nix colons in addrs 764c2aa98e2SPeter Wemm 765c2aa98e2SPeter Wemmifdef(`_NO_UUCP_', `dnl', 766c2aa98e2SPeter Wemm`# convert old-style addresses to a domain-based address 76706f25ae9SGregory Neil ShapiroR$- ! $+ $@ $>Canonify2 $2 < @ $1 .UUCP > resolve uucp names 76806f25ae9SGregory Neil ShapiroR$+ . $- ! $+ $@ $>Canonify2 $3 < @ $1 . $2 > domain uucps 76906f25ae9SGregory Neil ShapiroR$+ ! $+ $@ $>Canonify2 $2 < @ $1 .UUCP > uucp subdomains 770c2aa98e2SPeter Wemm') 771c2aa98e2SPeter Wemmifdef(`_USE_DECNET_SYNTAX_', 772c2aa98e2SPeter Wemm`# convert node::user addresses into a domain-based address 77306f25ae9SGregory Neil ShapiroR$- :: $+ $@ $>Canonify2 $2 < @ $1 .DECNET > resolve DECnet names 77406f25ae9SGregory Neil ShapiroR$- . $- :: $+ $@ $>Canonify2 $3 < @ $1.$2 .DECNET > numeric DECnet addr 775c2aa98e2SPeter Wemm', 776c2aa98e2SPeter Wemm `dnl') 777c2aa98e2SPeter Wemm# if we have % signs, take the rightmost one 778c2aa98e2SPeter WemmR$* % $* $1 @ $2 First make them all @s. 779c2aa98e2SPeter WemmR$* @ $* @ $* $1 % $2 @ $3 Undo all but the last. 78006f25ae9SGregory Neil ShapiroR$* @ $* $@ $>Canonify2 $1 < @ $2 > Insert < > and finish 781c2aa98e2SPeter Wemm 782c2aa98e2SPeter Wemm# else we must be a local name 78306f25ae9SGregory Neil ShapiroR$* $@ $>Canonify2 $1 784c2aa98e2SPeter Wemm 785c2aa98e2SPeter Wemm 786c2aa98e2SPeter Wemm################################################ 787c2aa98e2SPeter Wemm### Ruleset 96 -- bottom half of ruleset 3 ### 788c2aa98e2SPeter Wemm################################################ 789c2aa98e2SPeter Wemm 79006f25ae9SGregory Neil ShapiroSCanonify2=96 791c2aa98e2SPeter Wemm 792c2aa98e2SPeter Wemm# handle special cases for local names 793c2aa98e2SPeter WemmR$* < @ localhost > $* $: $1 < @ $j . > $2 no domain at all 794c2aa98e2SPeter WemmR$* < @ localhost . $m > $* $: $1 < @ $j . > $2 local domain 795c2aa98e2SPeter Wemmifdef(`_NO_UUCP_', `dnl', 796c2aa98e2SPeter Wemm`R$* < @ localhost . UUCP > $* $: $1 < @ $j . > $2 .UUCP domain') 79706f25ae9SGregory Neil Shapiro 79840266059SGregory Neil Shapiro# check for IPv4/IPv6 domain literal 79940266059SGregory Neil ShapiroR$* < @ [ $+ ] > $* $: $1 < @@ [ $2 ] > $3 mark [addr] 800c2aa98e2SPeter WemmR$* < @@ $=w > $* $: $1 < @ $j . > $3 self-literal 801c2aa98e2SPeter WemmR$* < @@ $+ > $* $@ $1 < @ $2 > $3 canon IP addr 802c2aa98e2SPeter Wemm 80306f25ae9SGregory Neil Shapiroifdef(`_DOMAIN_TABLE_', `dnl 804c2aa98e2SPeter Wemm# look up domains in the domain table 805c2aa98e2SPeter WemmR$* < @ $+ > $* $: $1 < @ $(domaintable $2 $) > $3', `dnl') 806c2aa98e2SPeter Wemm 80706f25ae9SGregory Neil Shapiroundivert(2)dnl LOCAL_RULE_3 808c2aa98e2SPeter Wemm 80906f25ae9SGregory Neil Shapiroifdef(`_BITDOMAIN_TABLE_', `dnl 810c2aa98e2SPeter Wemm# handle BITNET mapping 811c2aa98e2SPeter WemmR$* < @ $+ .BITNET > $* $: $1 < @ $(bitdomain $2 $: $2.BITNET $) > $3', `dnl') 812c2aa98e2SPeter Wemm 81306f25ae9SGregory Neil Shapiroifdef(`_UUDOMAIN_TABLE_', `dnl 814c2aa98e2SPeter Wemm# handle UUCP mapping 815c2aa98e2SPeter WemmR$* < @ $+ .UUCP > $* $: $1 < @ $(uudomain $2 $: $2.UUCP $) > $3', `dnl') 816c2aa98e2SPeter Wemm 817c2aa98e2SPeter Wemmifdef(`_NO_UUCP_', `dnl', 818c2aa98e2SPeter Wemm`ifdef(`UUCP_RELAY', 819c2aa98e2SPeter Wemm`# pass UUCP addresses straight through 820c2aa98e2SPeter WemmR$* < @ $+ . UUCP > $* $@ $1 < @ $2 . UUCP . > $3', 821c2aa98e2SPeter Wemm`# if really UUCP, handle it immediately 822c2aa98e2SPeter Wemmifdef(`_CLASS_U_', 823c2aa98e2SPeter Wemm`R$* < @ $=U . UUCP > $* $@ $1 < @ $2 . UUCP . > $3', `dnl') 824c2aa98e2SPeter Wemmifdef(`_CLASS_V_', 825c2aa98e2SPeter Wemm`R$* < @ $=V . UUCP > $* $@ $1 < @ $2 . UUCP . > $3', `dnl') 826c2aa98e2SPeter Wemmifdef(`_CLASS_W_', 827c2aa98e2SPeter Wemm`R$* < @ $=W . UUCP > $* $@ $1 < @ $2 . UUCP . > $3', `dnl') 828c2aa98e2SPeter Wemmifdef(`_CLASS_X_', 829c2aa98e2SPeter Wemm`R$* < @ $=X . UUCP > $* $@ $1 < @ $2 . UUCP . > $3', `dnl') 830c2aa98e2SPeter Wemmifdef(`_CLASS_Y_', 831c2aa98e2SPeter Wemm`R$* < @ $=Y . UUCP > $* $@ $1 < @ $2 . UUCP . > $3', `dnl') 832c2aa98e2SPeter Wemm 833c2aa98e2SPeter Wemmifdef(`_NO_CANONIFY_', `dnl', `dnl 834c2aa98e2SPeter Wemm# try UUCP traffic as a local address 835c2aa98e2SPeter WemmR$* < @ $+ . UUCP > $* $: $1 < @ $[ $2 $] . UUCP . > $3 836c2aa98e2SPeter WemmR$* < @ $+ . . UUCP . > $* $@ $1 < @ $2 . > $3') 837c2aa98e2SPeter Wemm')') 83806f25ae9SGregory Neil Shapiro# hostnames ending in class P are always canonical 83906f25ae9SGregory Neil ShapiroR$* < @ $* $=P > $* $: $1 < @ $2 $3 . > $4 84006f25ae9SGregory Neil Shapirodnl apply the next rule only for hostnames not in class P 84106f25ae9SGregory Neil Shapirodnl this even works for phrases in class P since . is in class P 84206f25ae9SGregory Neil Shapirodnl which daemon flags are set? 84306f25ae9SGregory Neil ShapiroR$* < @ $* $~P > $* $: $&{daemon_flags} $| $1 < @ $2 $3 > $4 84406f25ae9SGregory Neil Shapirodnl the other rules in this section only apply if the hostname 84506f25ae9SGregory Neil Shapirodnl does not end in class P hence no further checks are done here 84606f25ae9SGregory Neil Shapirodnl if this ever changes make sure the lookups are "protected" again! 84706f25ae9SGregory Neil Shapiroifdef(`_NO_CANONIFY_', `dnl 84806f25ae9SGregory Neil Shapirodnl do not canonify unless: 84906f25ae9SGregory Neil Shapirodnl domain ends in class {Canonify} (this does not work if the intersection 85006f25ae9SGregory Neil Shapirodnl with class P is non-empty) 85106f25ae9SGregory Neil Shapirodnl or {daemon_flags} has c set 85206f25ae9SGregory Neil Shapiro# pass to name server to make hostname canonical if in class {Canonify} 85306f25ae9SGregory Neil ShapiroR$* $| $* < @ $* $={Canonify} > $* $: $2 < @ $[ $3 $4 $] > $5 85406f25ae9SGregory Neil Shapiro# pass to name server to make hostname canonical if requested 85506f25ae9SGregory Neil ShapiroR$* c $* $| $* < @ $* > $* $: $3 < @ $[ $4 $] > $5 85606f25ae9SGregory Neil Shapirodnl trailing dot? -> do not apply _CANONIFY_HOSTS_ 85706f25ae9SGregory Neil ShapiroR$* $| $* < @ $+ . > $* $: $2 < @ $3 . > $4 85806f25ae9SGregory Neil Shapiro# add a trailing dot to qualified hostnames so other rules will work 85906f25ae9SGregory Neil ShapiroR$* $| $* < @ $+.$+ > $* $: $2 < @ $3.$4 . > $5 86006f25ae9SGregory Neil Shapiroifdef(`_CANONIFY_HOSTS_', `dnl 86106f25ae9SGregory Neil Shapirodnl this should only apply to unqualified hostnames 86206f25ae9SGregory Neil Shapirodnl but if a valid character inside an unqualified hostname is an OperatorChar 86306f25ae9SGregory Neil Shapirodnl then $- does not work. 86406f25ae9SGregory Neil Shapiro# lookup unqualified hostnames 86506f25ae9SGregory Neil ShapiroR$* $| $* < @ $* > $* $: $2 < @ $[ $3 $] > $4', `dnl')', `dnl 86606f25ae9SGregory Neil Shapirodnl _NO_CANONIFY_ is not set: canonify unless: 86706f25ae9SGregory Neil Shapirodnl {daemon_flags} contains CC (do not canonify) 868193538b7SGregory Neil Shapirodnl but add a trailing dot to qualified hostnames so other rules will work 869193538b7SGregory Neil Shapirodnl should we do this for every hostname: even unqualified? 870193538b7SGregory Neil ShapiroR$* CC $* $| $* < @ $+.$+ > $* $: $3 < @ $4.$5 . > $6 87106f25ae9SGregory Neil ShapiroR$* CC $* $| $* $: $3 87240266059SGregory Neil Shapiroifdef(`_FFR_NOCANONIFY_HEADERS', `dnl 87340266059SGregory Neil Shapiro# do not canonify header addresses 87440266059SGregory Neil ShapiroR$* $| $* < @ $* $~P > $* $: $&{addr_type} $| $2 < @ $3 $4 > $5 87540266059SGregory Neil ShapiroR$* h $* $| $* < @ $+.$+ > $* $: $3 < @ $4.$5 . > $6 87640266059SGregory Neil ShapiroR$* h $* $| $* $: $3', `dnl') 877c2aa98e2SPeter Wemm# pass to name server to make hostname canonical 87806f25ae9SGregory Neil ShapiroR$* $| $* < @ $* > $* $: $2 < @ $[ $3 $] > $4') 87906f25ae9SGregory Neil Shapirodnl remove {daemon_flags} for other cases 88006f25ae9SGregory Neil ShapiroR$* $| $* $: $2 881c2aa98e2SPeter Wemm 882c2aa98e2SPeter Wemm# local host aliases and pseudo-domains are always canonical 883c2aa98e2SPeter WemmR$* < @ $=w > $* $: $1 < @ $2 . > $3 884c2aa98e2SPeter Wemmifdef(`_MASQUERADE_ENTIRE_DOMAIN_', 885c2aa98e2SPeter Wemm`R$* < @ $* $=M > $* $: $1 < @ $2 $3 . > $4', 886c2aa98e2SPeter Wemm`R$* < @ $=M > $* $: $1 < @ $2 . > $3') 88706f25ae9SGregory Neil Shapiroifdef(`_VIRTUSER_TABLE_', `dnl 88806f25ae9SGregory Neil Shapirodnl virtual hosts are also canonical 88906f25ae9SGregory Neil Shapiroifdef(`_VIRTUSER_ENTIRE_DOMAIN_', 89006f25ae9SGregory Neil Shapiro`R$* < @ $* $={VirtHost} > $* $: $1 < @ $2 $3 . > $4', 89106f25ae9SGregory Neil Shapiro`R$* < @ $={VirtHost} > $* $: $1 < @ $2 . > $3')', 89206f25ae9SGregory Neil Shapiro`dnl') 89340266059SGregory Neil Shapiroifdef(`_GENERICS_TABLE_', `dnl 89440266059SGregory Neil Shapirodnl hosts for genericstable are also canonical 89540266059SGregory Neil Shapiroifdef(`_GENERICS_ENTIRE_DOMAIN_', 89640266059SGregory Neil Shapiro`R$* < @ $* $=G > $* $: $1 < @ $2 $3 . > $4', 89740266059SGregory Neil Shapiro`R$* < @ $=G > $* $: $1 < @ $2 . > $3')', 89840266059SGregory Neil Shapiro`dnl') 89906f25ae9SGregory Neil Shapirodnl remove superfluous dots (maybe repeatedly) which may have been added 90006f25ae9SGregory Neil Shapirodnl by one of the rules before 901c2aa98e2SPeter WemmR$* < @ $* . . > $* $1 < @ $2 . > $3 902c2aa98e2SPeter Wemm 903c2aa98e2SPeter Wemm 904c2aa98e2SPeter Wemm################################################## 905c2aa98e2SPeter Wemm### Ruleset 4 -- Final Output Post-rewriting ### 906c2aa98e2SPeter Wemm################################################## 90706f25ae9SGregory Neil ShapiroSfinal=4 908c2aa98e2SPeter Wemm 909193538b7SGregory Neil ShapiroR$+ :; <@> $@ $1 : handle <list:;> 910c2aa98e2SPeter WemmR$* <@> $@ handle <> and list:; 911c2aa98e2SPeter Wemm 912c2aa98e2SPeter Wemm# strip trailing dot off possibly canonical name 913c2aa98e2SPeter WemmR$* < @ $+ . > $* $1 < @ $2 > $3 914c2aa98e2SPeter Wemm 91506f25ae9SGregory Neil Shapiro# eliminate internal code 916c2aa98e2SPeter WemmR$* < @ *LOCAL* > $* $1 < @ $j > $2 917c2aa98e2SPeter Wemm 918c2aa98e2SPeter Wemm# externalize local domain info 919c2aa98e2SPeter WemmR$* < $+ > $* $1 $2 $3 defocus 920c2aa98e2SPeter WemmR@ $+ : @ $+ : $+ @ $1 , @ $2 : $3 <route-addr> canonical 921c2aa98e2SPeter WemmR@ $* $@ @ $1 ... and exit 922c2aa98e2SPeter Wemm 923c2aa98e2SPeter Wemmifdef(`_NO_UUCP_', `dnl', 924c2aa98e2SPeter Wemm`# UUCP must always be presented in old form 925c2aa98e2SPeter WemmR$+ @ $- . UUCP $2!$1 u@h.UUCP => h!u') 926c2aa98e2SPeter Wemm 927c2aa98e2SPeter Wemmifdef(`_USE_DECNET_SYNTAX_', 928c2aa98e2SPeter Wemm`# put DECnet back in :: form 929c2aa98e2SPeter WemmR$+ @ $+ . DECNET $2 :: $1 u@h.DECNET => h::u', 930c2aa98e2SPeter Wemm `dnl') 931c2aa98e2SPeter Wemm# delete duplicate local names 932c2aa98e2SPeter WemmR$+ % $=w @ $=w $1 @ $2 u%host@host => u@host 933c2aa98e2SPeter Wemm 934c2aa98e2SPeter Wemm 935c2aa98e2SPeter Wemm 936c2aa98e2SPeter Wemm############################################################## 937c2aa98e2SPeter Wemm### Ruleset 97 -- recanonicalize and call ruleset zero ### 938c2aa98e2SPeter Wemm### (used for recursive calls) ### 939c2aa98e2SPeter Wemm############################################################## 940c2aa98e2SPeter Wemm 94106f25ae9SGregory Neil ShapiroSRecurse=97 94206f25ae9SGregory Neil ShapiroR$* $: $>canonify $1 94306f25ae9SGregory Neil ShapiroR$* $@ $>parse $1 944c2aa98e2SPeter Wemm 945c2aa98e2SPeter Wemm 946c2aa98e2SPeter Wemm###################################### 947c2aa98e2SPeter Wemm### Ruleset 0 -- Parse Address ### 948c2aa98e2SPeter Wemm###################################### 949c2aa98e2SPeter Wemm 95006f25ae9SGregory Neil ShapiroSparse=0 951c2aa98e2SPeter Wemm 952c2aa98e2SPeter WemmR$* $: $>Parse0 $1 initial parsing 953c2aa98e2SPeter WemmR<@> $#_LOCAL_ $: <@> special case error msgs 95406f25ae9SGregory Neil ShapiroR$* $: $>ParseLocal $1 handle local hacks 955c2aa98e2SPeter WemmR$* $: $>Parse1 $1 final parsing 956c2aa98e2SPeter Wemm 957c2aa98e2SPeter Wemm# 958c2aa98e2SPeter Wemm# Parse0 -- do initial syntax checking and eliminate local addresses. 959c2aa98e2SPeter Wemm# This should either return with the (possibly modified) input 960c2aa98e2SPeter Wemm# or return with a #error mailer. It should not return with a 961c2aa98e2SPeter Wemm# #mailer other than the #error mailer. 962c2aa98e2SPeter Wemm# 963c2aa98e2SPeter Wemm 964c2aa98e2SPeter WemmSParse0 965c2aa98e2SPeter WemmR<@> $@ <@> special case error msgs 96640266059SGregory Neil ShapiroR$* : $* ; <@> $#error $@ 5.1.3 $: "_CODE553 List:; syntax illegal for recipient addresses" 96706f25ae9SGregory Neil ShapiroR@ <@ $* > < @ $1 > catch "@@host" bogosity 96840266059SGregory Neil ShapiroR<@ $+> $#error $@ 5.1.3 $: "_CODE553 User address required" 96940266059SGregory Neil ShapiroR$+ <@> $#error $@ 5.1.3 $: "_CODE553 Hostname required" 970c2aa98e2SPeter WemmR$* $: <> $1 97140266059SGregory Neil Shapirodnl allow tricks like [host1]:[host2] 97240266059SGregory Neil ShapiroR<> $* < @ [ $* ] : $+ > $* $1 < @ [ $2 ] : $3 > $4 97340266059SGregory Neil ShapiroR<> $* < @ [ $* ] , $+ > $* $1 < @ [ $2 ] , $3 > $4 97440266059SGregory Neil Shapirodnl but no a@[b]c 97540266059SGregory Neil ShapiroR<> $* < @ [ $* ] $+ > $* $#error $@ 5.1.2 $: "_CODE553 Invalid address" 976c2aa98e2SPeter WemmR<> $* < @ [ $+ ] > $* $1 < @ [ $2 ] > $3 97740266059SGregory Neil ShapiroR<> $* <$* : $* > $* $#error $@ 5.1.3 $: "_CODE553 Colon illegal in host name part" 978c2aa98e2SPeter WemmR<> $* $1 97940266059SGregory Neil ShapiroR$* < @ . $* > $* $#error $@ 5.1.2 $: "_CODE553 Invalid host name" 98040266059SGregory Neil ShapiroR$* < @ $* .. $* > $* $#error $@ 5.1.2 $: "_CODE553 Invalid host name" 98140266059SGregory Neil Shapirodnl no a@b@ 98240266059SGregory Neil ShapiroR$* < @ $* @ > $* $#error $@ 5.1.2 $: "_CODE553 Invalid route address" 98340266059SGregory Neil Shapirodnl no a@b@c 98440266059SGregory Neil ShapiroR$* @ $* < @ $* > $* $#error $@ 5.1.3 $: "_CODE553 Invalid route address" 98506f25ae9SGregory Neil Shapirodnl comma only allowed before @; this check is not complete 98640266059SGregory Neil ShapiroR$* , $~O $* $#error $@ 5.1.3 $: "_CODE553 Invalid route address" 98740266059SGregory Neil Shapiro 98840266059SGregory Neil Shapiroifdef(`_STRICT_RFC821_', `# more RFC 821 checks 98940266059SGregory Neil ShapiroR$* . < @ $* > $* $#error $@ 5.1.2 $: "_CODE553 Local part must not end with a dot" 99040266059SGregory Neil ShapiroR. $* < @ $* > $* $#error $@ 5.1.2 $: "_CODE553 Local part must not begin with a dot" 99140266059SGregory Neil Shapirodnl', `dnl') 992c2aa98e2SPeter Wemm 993c2aa98e2SPeter Wemm# now delete the local info -- note $=O to find characters that cause forwarding 99406f25ae9SGregory Neil ShapiroR$* < @ > $* $@ $>Parse0 $>canonify $1 user@ => user 99506f25ae9SGregory Neil ShapiroR< @ $=w . > : $* $@ $>Parse0 $>canonify $2 @here:... -> ... 996c2aa98e2SPeter WemmR$- < @ $=w . > $: $(dequote $1 $) < @ $2 . > dequote "foo"@here 99740266059SGregory Neil ShapiroR< @ $+ > $#error $@ 5.1.3 $: "_CODE553 User address required" 99806f25ae9SGregory Neil ShapiroR$* $=O $* < @ $=w . > $@ $>Parse0 $>canonify $1 $2 $3 ...@here -> ... 999c2aa98e2SPeter WemmR$- $: $(dequote $1 $) < @ *LOCAL* > dequote "foo" 100040266059SGregory Neil ShapiroR< @ *LOCAL* > $#error $@ 5.1.3 $: "_CODE553 User address required" 1001c2aa98e2SPeter WemmR$* $=O $* < @ *LOCAL* > 100206f25ae9SGregory Neil Shapiro $@ $>Parse0 $>canonify $1 $2 $3 ...@*LOCAL* -> ... 1003c2aa98e2SPeter WemmR$* < @ *LOCAL* > $: $1 1004c2aa98e2SPeter Wemm 1005c2aa98e2SPeter Wemm# 1006c2aa98e2SPeter Wemm# Parse1 -- the bottom half of ruleset 0. 1007c2aa98e2SPeter Wemm# 1008c2aa98e2SPeter Wemm 1009c2aa98e2SPeter WemmSParse1 101006f25ae9SGregory Neil Shapiroifdef(`_LDAP_ROUTING_', `dnl 101106f25ae9SGregory Neil Shapiro# handle LDAP routing for hosts in $={LDAPRoute} 101240266059SGregory Neil ShapiroR$+ < @ $={LDAPRoute} . > $: $>LDAPExpand <$1 < @ $2 . >> <$1 @ $2> <> 101340266059SGregory Neil ShapiroR$+ < @ $={LDAPRouteEquiv} . > $: $>LDAPExpand <$1 < @ $2 . >> <$1 @ $M> <>', 1014c2aa98e2SPeter Wemm`dnl') 1015c2aa98e2SPeter Wemm 101606f25ae9SGregory Neil Shapiroifdef(`_MAILER_smtp_', 101706f25ae9SGregory Neil Shapiro`# handle numeric address spec 101806f25ae9SGregory Neil Shapirodnl there is no check whether this is really an IP number 101906f25ae9SGregory Neil ShapiroR$* < @ [ $+ ] > $* $: $>ParseLocal $1 < @ [ $2 ] > $3 numeric internet spec 102006f25ae9SGregory Neil ShapiroR$* < @ [ $+ ] > $* $1 < @ [ $2 ] : $S > $3 Add smart host to path 102106f25ae9SGregory Neil ShapiroR$* < @ [ $+ ] : > $* $#_SMTP_ $@ [$2] $: $1 < @ [$2] > $3 no smarthost: send 102206f25ae9SGregory Neil ShapiroR$* < @ [ $+ ] : $- : $*> $* $#$3 $@ $4 $: $1 < @ [$2] > $5 smarthost with mailer 102306f25ae9SGregory Neil ShapiroR$* < @ [ $+ ] : $+ > $* $#_SMTP_ $@ $3 $: $1 < @ [$2] > $4 smarthost without mailer', 102406f25ae9SGregory Neil Shapiro `dnl') 102506f25ae9SGregory Neil Shapiro 102606f25ae9SGregory Neil Shapiroifdef(`_VIRTUSER_TABLE_', `dnl 1027c2aa98e2SPeter Wemm# handle virtual users 102840266059SGregory Neil Shapiroifdef(`_VIRTUSER_STOP_ONE_LEVEL_RECURSION_',`dnl 102940266059SGregory Neil Shapirodnl this is not a documented option 103040266059SGregory Neil Shapirodnl it stops looping in virtusertable mapping if input and output 103140266059SGregory Neil Shapirodnl are identical, i.e., if address A is mapped to A. 103240266059SGregory Neil Shapirodnl it does not deal with multi-level recursion 103340266059SGregory Neil Shapiro# handle full domains in RHS of virtusertable 103440266059SGregory Neil ShapiroR$+ < @ $+ > $: $(macro {RecipientAddress} $) $1 < @ $2 > 103540266059SGregory Neil ShapiroR$+ < @ $+ > $: <?> $1 < @ $2 > $| $>final $1 < @ $2 > 103640266059SGregory Neil ShapiroR<?> $+ $| $+ $: $1 $(macro {RecipientAddress} $@ $2 $) 103740266059SGregory Neil ShapiroR<?> $+ $| $* $: $1', 103840266059SGregory Neil Shapiro`dnl') 103906f25ae9SGregory Neil ShapiroR$+ $: <!> $1 Mark for lookup 104040266059SGregory Neil Shapirodnl input: <!> local<@domain> 104106f25ae9SGregory Neil Shapiroifdef(`_VIRTUSER_ENTIRE_DOMAIN_', 104206f25ae9SGregory Neil Shapiro`R<!> $+ < @ $* $={VirtHost} . > $: < $(virtuser $1 @ $2 $3 $@ $1 $: @ $) > $1 < @ $2 $3 . >', 104306f25ae9SGregory Neil Shapiro`R<!> $+ < @ $={VirtHost} . > $: < $(virtuser $1 @ $2 $@ $1 $: @ $) > $1 < @ $2 . >') 104440266059SGregory Neil Shapirodnl input: <result-of-lookup | @> local<@domain> | <!> local<@domain> 104506f25ae9SGregory Neil ShapiroR<!> $+ < @ $=w . > $: < $(virtuser $1 @ $2 $@ $1 $: @ $) > $1 < @ $2 . > 104640266059SGregory Neil Shapirodnl if <@> local<@domain>: no match but try lookup 104740266059SGregory Neil Shapirodnl user+detail: try user++@domain if detail not empty 104840266059SGregory Neil ShapiroR<@> $+ + $+ < @ $* . > 104940266059SGregory Neil Shapiro $: < $(virtuser $1 + + @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . > 105040266059SGregory Neil Shapirodnl user+detail: try user+*@domain 1051c2aa98e2SPeter WemmR<@> $+ + $* < @ $* . > 105240266059SGregory Neil Shapiro $: < $(virtuser $1 + * @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . > 105340266059SGregory Neil Shapirodnl user+detail: try user@domain 1054c2aa98e2SPeter WemmR<@> $+ + $* < @ $* . > 105540266059SGregory Neil Shapiro $: < $(virtuser $1 @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . > 105606f25ae9SGregory Neil Shapirodnl try default entry: @domain 105740266059SGregory Neil Shapirodnl ++@domain 105840266059SGregory Neil ShapiroR<@> $+ + $+ < @ $+ . > $: < $(virtuser + + @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . > 105906f25ae9SGregory Neil Shapirodnl +*@domain 106040266059SGregory Neil ShapiroR<@> $+ + $* < @ $+ . > $: < $(virtuser + * @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . > 106106f25ae9SGregory Neil Shapirodnl @domain if +detail exists 106294c01205SGregory Neil Shapirodnl if no match, change marker to prevent a second @domain lookup 106394c01205SGregory Neil ShapiroR<@> $+ + $* < @ $+ . > $: < $(virtuser @ $3 $@ $1 $@ $2 $@ +$2 $: ! $) > $1 + $2 < @ $3 . > 106494c01205SGregory Neil Shapirodnl without +detail 1065c2aa98e2SPeter WemmR<@> $+ < @ $+ . > $: < $(virtuser @ $2 $@ $1 $: @ $) > $1 < @ $2 . > 106640266059SGregory Neil Shapirodnl no match 1067c2aa98e2SPeter WemmR<@> $+ $: $1 106840266059SGregory Neil Shapirodnl remove mark 106906f25ae9SGregory Neil ShapiroR<!> $+ $: $1 107006f25ae9SGregory Neil ShapiroR< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4 1071c2aa98e2SPeter WemmR< error : $- $+ > $* $#error $@ $(dequote $1 $) $: $2 107240266059SGregory Neil Shapiroifdef(`_VIRTUSER_STOP_ONE_LEVEL_RECURSION_',`dnl 107340266059SGregory Neil Shapiro# check virtuser input address against output address, if same, skip recursion 107440266059SGregory Neil ShapiroR< $+ > $+ < @ $+ > $: < $1 > $2 < @ $3 > $| $1 107540266059SGregory Neil Shapiro# it is the same: stop now 107640266059SGregory Neil ShapiroR< $+ > $+ < @ $+ > $| $&{RecipientAddress} $: $>ParseLocal $>Parse0 $>canonify $1 107740266059SGregory Neil ShapiroR< $+ > $+ < @ $+ > $| $* $: < $1 > $2 < @ $3 > 107840266059SGregory Neil Shapirodnl', `dnl') 107913058a91SGregory Neil Shapirodnl this is not a documented option 108013058a91SGregory Neil Shapirodnl it performs no looping at all for virtusertable 10818774250cSGregory Neil Shapiroifdef(`_NO_VIRTUSER_RECURSION_', 10828774250cSGregory Neil Shapiro`R< $+ > $+ < @ $+ > $: $>ParseLocal $>Parse0 $>canonify $1', 10838774250cSGregory Neil Shapiro`R< $+ > $+ < @ $+ > $: $>Recurse $1') 10848774250cSGregory Neil Shapirodnl', `dnl') 1085c2aa98e2SPeter Wemm 1086c2aa98e2SPeter Wemm# short circuit local delivery so forwarded email works 1087c2aa98e2SPeter Wemmifdef(`_MAILER_usenet_', `dnl 108806f25ae9SGregory Neil ShapiroR$+ . USENET < @ $=w . > $#usenet $@ usenet $: $1 handle usenet specially', `dnl') 108942e5d165SGregory Neil Shapiro 109042e5d165SGregory Neil Shapiro 1091c2aa98e2SPeter Wemmifdef(`_STICKY_LOCAL_DOMAIN_', 1092c2aa98e2SPeter Wemm`R$+ < @ $=w . > $: < $H > $1 < @ $2 . > first try hub 109306f25ae9SGregory Neil ShapiroR< $+ > $+ < $+ > $>MailerToTriple < $1 > $2 < $3 > yep .... 109406f25ae9SGregory Neil Shapirodnl $H empty (but @$=w.) 1095c2aa98e2SPeter WemmR< > $+ + $* < $+ > $#_LOCAL_ $: $1 + $2 plussed name? 1096c2aa98e2SPeter WemmR< > $+ < $+ > $#_LOCAL_ $: @ $1 nope, local address', 1097c2aa98e2SPeter Wemm`R$=L < @ $=w . > $#_LOCAL_ $: @ $1 special local names 1098c2aa98e2SPeter WemmR$+ < @ $=w . > $#_LOCAL_ $: $1 regular local name') 1099c2aa98e2SPeter Wemm 110006f25ae9SGregory Neil Shapiroifdef(`_MAILER_TABLE_', `dnl 1101c2aa98e2SPeter Wemm# not local -- try mailer table lookup 1102c2aa98e2SPeter WemmR$* <@ $+ > $* $: < $2 > $1 < @ $2 > $3 extract host name 1103c2aa98e2SPeter WemmR< $+ . > $* $: < $1 > $2 strip trailing dot 1104c2aa98e2SPeter WemmR< $+ > $* $: < $(mailertable $1 $) > $2 lookup 110506f25ae9SGregory Neil Shapirodnl it is $~[ instead of $- to avoid matches on IPv6 addresses 110606f25ae9SGregory Neil ShapiroR< $~[ : $* > $* $>MailerToTriple < $1 : $2 > $3 check -- resolved? 110706f25ae9SGregory Neil ShapiroR< $+ > $* $: $>Mailertable <$1> $2 try domain', 1108c2aa98e2SPeter Wemm`dnl') 110906f25ae9SGregory Neil Shapiroundivert(4)dnl UUCP rules from `MAILER(uucp)' 1110c2aa98e2SPeter Wemm 1111c2aa98e2SPeter Wemmifdef(`_NO_UUCP_', `dnl', 1112c2aa98e2SPeter Wemm`# resolve remotely connected UUCP links (if any) 1113c2aa98e2SPeter Wemmifdef(`_CLASS_V_', 111406f25ae9SGregory Neil Shapiro`R$* < @ $=V . UUCP . > $* $: $>MailerToTriple < $V > $1 <@$2.UUCP.> $3', 1115c2aa98e2SPeter Wemm `dnl') 1116c2aa98e2SPeter Wemmifdef(`_CLASS_W_', 111706f25ae9SGregory Neil Shapiro`R$* < @ $=W . UUCP . > $* $: $>MailerToTriple < $W > $1 <@$2.UUCP.> $3', 1118c2aa98e2SPeter Wemm `dnl') 1119c2aa98e2SPeter Wemmifdef(`_CLASS_X_', 112006f25ae9SGregory Neil Shapiro`R$* < @ $=X . UUCP . > $* $: $>MailerToTriple < $X > $1 <@$2.UUCP.> $3', 1121c2aa98e2SPeter Wemm `dnl')') 1122c2aa98e2SPeter Wemm 1123c2aa98e2SPeter Wemm# resolve fake top level domains by forwarding to other hosts 1124c2aa98e2SPeter Wemmifdef(`BITNET_RELAY', 112506f25ae9SGregory Neil Shapiro`R$*<@$+.BITNET.>$* $: $>MailerToTriple < $B > $1 <@$2.BITNET.> $3 user@host.BITNET', 1126c2aa98e2SPeter Wemm `dnl') 1127c2aa98e2SPeter Wemmifdef(`DECNET_RELAY', 112806f25ae9SGregory Neil Shapiro`R$*<@$+.DECNET.>$* $: $>MailerToTriple < $C > $1 <@$2.DECNET.> $3 user@host.DECNET', 1129c2aa98e2SPeter Wemm `dnl') 1130c2aa98e2SPeter Wemmifdef(`_MAILER_pop_', 1131c2aa98e2SPeter Wemm`R$+ < @ POP. > $#pop $: $1 user@POP', 1132c2aa98e2SPeter Wemm `dnl') 1133c2aa98e2SPeter Wemmifdef(`_MAILER_fax_', 1134c2aa98e2SPeter Wemm`R$+ < @ $+ .FAX. > $#fax $@ $2 $: $1 user@host.FAX', 1135c2aa98e2SPeter Wemm`ifdef(`FAX_RELAY', 113606f25ae9SGregory Neil Shapiro`R$*<@$+.FAX.>$* $: $>MailerToTriple < $F > $1 <@$2.FAX.> $3 user@host.FAX', 1137c2aa98e2SPeter Wemm `dnl')') 1138c2aa98e2SPeter Wemm 1139c2aa98e2SPeter Wemmifdef(`UUCP_RELAY', 1140c2aa98e2SPeter Wemm`# forward non-local UUCP traffic to our UUCP relay 114106f25ae9SGregory Neil ShapiroR$*<@$*.UUCP.>$* $: $>MailerToTriple < $Y > $1 <@$2.UUCP.> $3 uucp mail', 1142c2aa98e2SPeter Wemm`ifdef(`_MAILER_uucp_', 1143c2aa98e2SPeter Wemm`# forward other UUCP traffic straight to UUCP 1144c2aa98e2SPeter WemmR$* < @ $+ .UUCP. > $* $#_UUCP_ $@ $2 $: $1 < @ $2 .UUCP. > $3 user@host.UUCP', 1145c2aa98e2SPeter Wemm `dnl')') 1146c2aa98e2SPeter Wemmifdef(`_MAILER_usenet_', ` 1147c2aa98e2SPeter Wemm# addresses sent to net.group.USENET will get forwarded to a newsgroup 114806f25ae9SGregory Neil ShapiroR$+ . USENET $#usenet $@ usenet $: $1', 1149c2aa98e2SPeter Wemm `dnl') 1150c2aa98e2SPeter Wemm 1151c2aa98e2SPeter Wemmifdef(`_LOCAL_RULES_', 1152c2aa98e2SPeter Wemm`# figure out what should stay in our local mail system 1153c2aa98e2SPeter Wemmundivert(1)', `dnl') 1154c2aa98e2SPeter Wemm 1155c2aa98e2SPeter Wemm# pass names that still have a host to a smarthost (if defined) 115606f25ae9SGregory Neil ShapiroR$* < @ $* > $* $: $>MailerToTriple < $S > $1 < @ $2 > $3 glue on smarthost name 1157c2aa98e2SPeter Wemm 1158c2aa98e2SPeter Wemm# deal with other remote names 1159c2aa98e2SPeter Wemmifdef(`_MAILER_smtp_', 1160c2aa98e2SPeter Wemm`R$* < @$* > $* $#_SMTP_ $@ $2 $: $1 < @ $2 > $3 user@host.domain', 116140266059SGregory Neil Shapiro`R$* < @$* > $* $#error $@ 5.1.2 $: "_CODE553 Unrecognized host name " $2') 1162c2aa98e2SPeter Wemm 1163c2aa98e2SPeter Wemm# handle locally delivered names 1164c2aa98e2SPeter WemmR$=L $#_LOCAL_ $: @ $1 special local names 1165c2aa98e2SPeter WemmR$+ $#_LOCAL_ $: $1 regular local names 1166c2aa98e2SPeter Wemm 1167c2aa98e2SPeter Wemm########################################################################### 1168c2aa98e2SPeter Wemm### Ruleset 5 -- special rewriting after aliases have been expanded ### 1169c2aa98e2SPeter Wemm########################################################################### 1170c2aa98e2SPeter Wemm 117106f25ae9SGregory Neil ShapiroSLocal_localaddr 117206f25ae9SGregory Neil ShapiroSlocaladdr=5 117306f25ae9SGregory Neil ShapiroR$+ $: $1 $| $>"Local_localaddr" $1 117440266059SGregory Neil ShapiroR$+ $| $#ok $@ $1 no change 117506f25ae9SGregory Neil ShapiroR$+ $| $#$* $#$2 117606f25ae9SGregory Neil ShapiroR$+ $| $* $: $1 1177c2aa98e2SPeter Wemm 117840266059SGregory Neil Shapiroifdef(`_PRESERVE_LUSER_HOST_', `dnl 117940266059SGregory Neil Shapiro# Preserve rcpt_host in {Host} 118040266059SGregory Neil ShapiroR$+ $: $1 $| $&h $| $&{Host} check h and {Host} 118140266059SGregory Neil ShapiroR$+ $| $| $: $(macro {Host} $@ $) $1 no h or {Host} 118240266059SGregory Neil ShapiroR$+ $| $| $+ $: $1 h not set, {Host} set 118340266059SGregory Neil ShapiroR$+ $| +$* $| $* $: $1 h is +detail, {Host} set 11846a2f2ff3SGregory Neil ShapiroR$+ $| $* @ $+ $| $* $: $(macro {Host} $@ @$3 $) $1 set {Host} to host in h 118540266059SGregory Neil ShapiroR$+ $| $+ $| $* $: $(macro {Host} $@ @$2 $) $1 set {Host} to h 118640266059SGregory Neil Shapiro')dnl 118740266059SGregory Neil Shapiro 118840266059SGregory Neil Shapiroifdef(`_FFR_5_', `dnl 118942e5d165SGregory Neil Shapiro# Preserve host in a macro 119042e5d165SGregory Neil ShapiroR$+ $: $(macro {LocalAddrHost} $) $1 119142e5d165SGregory Neil ShapiroR$+ @ $+ $: $(macro {LocalAddrHost} $@ @ $2 $) $1') 1192c2aa98e2SPeter Wemm 119340266059SGregory Neil Shapiroifdef(`_PRESERVE_LOCAL_PLUS_DETAIL_', `', `dnl 119442e5d165SGregory Neil Shapiro# deal with plussed users so aliases work nicely 119542e5d165SGregory Neil ShapiroR$+ + * $#_LOCAL_ $@ $&h $: $1`'ifdef(`_FFR_5_', ` $&{LocalAddrHost}') 119642e5d165SGregory Neil ShapiroR$+ + $* $#_LOCAL_ $@ + $2 $: $1 + *`'ifdef(`_FFR_5_', ` $&{LocalAddrHost}') 119742e5d165SGregory Neil Shapiro') 1198c2aa98e2SPeter Wemm# prepend an empty "forward host" on the front 1199c2aa98e2SPeter WemmR$+ $: <> $1 1200c2aa98e2SPeter Wemm 1201c2aa98e2SPeter Wemmifdef(`LUSER_RELAY', `dnl 1202c2aa98e2SPeter Wemm# send unrecognized local users to a relay host 120340266059SGregory Neil Shapiroifdef(`_PRESERVE_LOCAL_PLUS_DETAIL_', `dnl 120442e5d165SGregory Neil ShapiroR< > $+ + $* $: < ? $L > <+ $2> $(user $1 $) look up user+ 120542e5d165SGregory Neil ShapiroR< > $+ $: < ? $L > < > $(user $1 $) look up user 120642e5d165SGregory Neil ShapiroR< ? $* > < $* > $+ <> $: < > $3 $2 found; strip $L 120742e5d165SGregory Neil ShapiroR< ? $* > < $* > $+ $: < $1 > $3 $2 not found', ` 120806f25ae9SGregory Neil ShapiroR< > $+ $: < $L > $(user $1 $) look up user 120940266059SGregory Neil ShapiroR< $* > $+ <> $: < > $2 found; strip $L') 121040266059SGregory Neil Shapiroifdef(`_PRESERVE_LUSER_HOST_', `dnl 121140266059SGregory Neil ShapiroR< $+ > $+ $: < $1 > $2 $&{Host}') 121240266059SGregory Neil Shapirodnl') 1213c2aa98e2SPeter Wemm 121440266059SGregory Neil Shapiroifdef(`MAIL_HUB', `dnl 121540266059SGregory Neil ShapiroR< > $+ $: < $H > $1 try hub', `dnl') 121640266059SGregory Neil Shapiroifdef(`LOCAL_RELAY', `dnl 121740266059SGregory Neil ShapiroR< > $+ $: < $R > $1 try relay', `dnl') 121840266059SGregory Neil Shapiroifdef(`_PRESERVE_LOCAL_PLUS_DETAIL_', `dnl 121940266059SGregory Neil ShapiroR< > $+ $@ $1', `dnl 122006f25ae9SGregory Neil ShapiroR< > $+ $: < > < $1 <> $&h > nope, restore +detail 122140266059SGregory Neil Shapiroifdef(`_PRESERVE_LUSER_HOST_', `dnl 122240266059SGregory Neil ShapiroR< > < $+ @ $+ <> + $* > $: < > < $1 + $3 @ $2 > check whether +detail') 122306f25ae9SGregory Neil ShapiroR< > < $+ <> + $* > $: < > < $1 + $2 > check whether +detail 122406f25ae9SGregory Neil ShapiroR< > < $+ <> $* > $: < > < $1 > else discard 1225c2aa98e2SPeter WemmR< > < $+ + $* > $* < > < $1 > + $2 $3 find the user part 122642e5d165SGregory Neil ShapiroR< > < $+ > + $* $#_LOCAL_ $@ $2 $: @ $1`'ifdef(`_FFR_5_', ` $&{LocalAddrHost}') strip the extra + 1227c2aa98e2SPeter WemmR< > < $+ > $@ $1 no +detail 12282e43090eSPeter WemmR$+ $: $1 <> $&h add +detail back in 122940266059SGregory Neil Shapiroifdef(`_PRESERVE_LUSER_HOST_', `dnl 123040266059SGregory Neil ShapiroR$+ @ $+ <> + $* $: $1 + $3 @ $2 check whether +detail') 12312e43090eSPeter WemmR$+ <> + $* $: $1 + $2 check whether +detail 123242e5d165SGregory Neil ShapiroR$+ <> $* $: $1 else discard') 123306f25ae9SGregory Neil ShapiroR< local : $* > $* $: $>MailerToTriple < local : $1 > $2 no host extension 123406f25ae9SGregory Neil ShapiroR< error : $* > $* $: $>MailerToTriple < error : $1 > $2 no host extension 123540266059SGregory Neil Shapiroifdef(`_PRESERVE_LUSER_HOST_', `dnl 123640266059SGregory Neil Shapirodnl it is $~[ instead of $- to avoid matches on IPv6 addresses 123740266059SGregory Neil ShapiroR< $~[ : $+ > $+ @ $+ $: $>MailerToTriple < $1 : $2 > $3 < @ $4 >') 123840266059SGregory Neil ShapiroR< $~[ : $+ > $+ $: $>MailerToTriple < $1 : $2 > $3 < @ $2 > 123940266059SGregory Neil Shapiroifdef(`_PRESERVE_LUSER_HOST_', `dnl 124040266059SGregory Neil ShapiroR< $+ > $+ @ $+ $@ $>MailerToTriple < $1 > $2 < @ $3 >') 124106f25ae9SGregory Neil ShapiroR< $+ > $+ $@ $>MailerToTriple < $1 > $2 < @ $1 > 1242c2aa98e2SPeter Wemm 124306f25ae9SGregory Neil Shapiroifdef(`_MAILER_TABLE_', `dnl 124440266059SGregory Neil Shapiroifdef(`_LDAP_ROUTING_', `dnl 124540266059SGregory Neil Shapiro################################################################### 124640266059SGregory Neil Shapiro### Ruleset LDAPMailertable -- mailertable lookup for LDAP ### 124740266059SGregory Neil Shapirodnl input: <Domain> FullAddress 124840266059SGregory Neil Shapiro################################################################### 124940266059SGregory Neil Shapiro 125040266059SGregory Neil ShapiroSLDAPMailertable 125140266059SGregory Neil ShapiroR< $+ > $* $: < $(mailertable $1 $) > $2 lookup 125240266059SGregory Neil ShapiroR< $~[ : $* > $* $>MailerToTriple < $1 : $2 > $3 check resolved? 125340266059SGregory Neil ShapiroR< $+ > $* $: < $1 > $>Mailertable <$1> $2 try domain 125440266059SGregory Neil ShapiroR< $+ > $#$* $#$2 found 125540266059SGregory Neil ShapiroR< $+ > $* $#_RELAY_ $@ $1 $: $2 not found, direct relay', 125640266059SGregory Neil Shapiro`dnl') 125740266059SGregory Neil Shapiro 1258c2aa98e2SPeter Wemm################################################################### 1259c2aa98e2SPeter Wemm### Ruleset 90 -- try domain part of mailertable entry ### 126006f25ae9SGregory Neil Shapirodnl input: LeftPartOfDomain <RightPartOfDomain> FullAddress 1261c2aa98e2SPeter Wemm################################################################### 1262c2aa98e2SPeter Wemm 126306f25ae9SGregory Neil ShapiroSMailertable=90 126406f25ae9SGregory Neil Shapirodnl shift and check 126506f25ae9SGregory Neil Shapirodnl %2 is not documented in cf/README 1266c2aa98e2SPeter WemmR$* <$- . $+ > $* $: $1$2 < $(mailertable .$3 $@ $1$2 $@ $2 $) > $4 126706f25ae9SGregory Neil Shapirodnl it is $~[ instead of $- to avoid matches on IPv6 addresses 126806f25ae9SGregory Neil ShapiroR$* <$~[ : $* > $* $>MailerToTriple < $2 : $3 > $4 check -- resolved? 126906f25ae9SGregory Neil ShapiroR$* < . $+ > $* $@ $>Mailertable $1 . <$2> $3 no -- strip & try again 127006f25ae9SGregory Neil Shapirodnl is $2 always empty? 1271c2aa98e2SPeter WemmR$* < $* > $* $: < $(mailertable . $@ $1$2 $) > $3 try "." 127206f25ae9SGregory Neil ShapiroR< $~[ : $* > $* $>MailerToTriple < $1 : $2 > $3 "." found? 127306f25ae9SGregory Neil Shapirodnl return full address 1274c2aa98e2SPeter WemmR< $* > $* $@ $2 no mailertable match', 1275c2aa98e2SPeter Wemm`dnl') 1276c2aa98e2SPeter Wemm 1277c2aa98e2SPeter Wemm################################################################### 1278c2aa98e2SPeter Wemm### Ruleset 95 -- canonify mailer:[user@]host syntax to triple ### 127906f25ae9SGregory Neil Shapirodnl input: in general: <[mailer:]host> lp<@domain>rest 128006f25ae9SGregory Neil Shapirodnl <> address -> address 128106f25ae9SGregory Neil Shapirodnl <error:d.s.n:text> -> error 128206f25ae9SGregory Neil Shapirodnl <error:text> -> error 128306f25ae9SGregory Neil Shapirodnl <mailer:user@host> lp<@domain>rest -> mailer host user 128406f25ae9SGregory Neil Shapirodnl <mailer:host> address -> mailer host address 128506f25ae9SGregory Neil Shapirodnl <localdomain> address -> address 128606f25ae9SGregory Neil Shapirodnl <host> address -> relay host address 1287c2aa98e2SPeter Wemm################################################################### 1288c2aa98e2SPeter Wemm 128906f25ae9SGregory Neil ShapiroSMailerToTriple=95 1290c2aa98e2SPeter WemmR< > $* $@ $1 strip off null relay 129106f25ae9SGregory Neil ShapiroR< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4 1292c2aa98e2SPeter WemmR< error : $- $+ > $* $#error $@ $(dequote $1 $) $: $2 1293c2aa98e2SPeter WemmR< local : $* > $* $>CanonLocal < $1 > $2 129440266059SGregory Neil Shapirodnl it is $~[ instead of $- to avoid matches on IPv6 addresses 129540266059SGregory Neil ShapiroR< $~[ : $+ @ $+ > $*<$*>$* $# $1 $@ $3 $: $2<@$3> use literal user 129640266059SGregory Neil ShapiroR< $~[ : $+ > $* $# $1 $@ $2 $: $3 try qualified mailer 1297c2aa98e2SPeter WemmR< $=w > $* $@ $2 delete local host 1298c2aa98e2SPeter WemmR< $+ > $* $#_RELAY_ $@ $1 $: $2 use unqualified mailer 1299c2aa98e2SPeter Wemm 1300c2aa98e2SPeter Wemm################################################################### 1301c2aa98e2SPeter Wemm### Ruleset CanonLocal -- canonify local: syntax ### 130206f25ae9SGregory Neil Shapirodnl input: <user> address 130306f25ae9SGregory Neil Shapirodnl <x> <@host> : rest -> Recurse rest 130406f25ae9SGregory Neil Shapirodnl <x> p1 $=O p2 <@host> -> Recurse p1 $=O p2 130506f25ae9SGregory Neil Shapirodnl <> user <@host> rest -> local user@host user 130606f25ae9SGregory Neil Shapirodnl <> user -> local user user 130706f25ae9SGregory Neil Shapirodnl <user@host> lp <@domain> rest -> <user> lp <@host> [cont] 130806f25ae9SGregory Neil Shapirodnl <user> lp <@host> rest -> local lp@host user 130906f25ae9SGregory Neil Shapirodnl <user> lp -> local lp user 1310c2aa98e2SPeter Wemm################################################################### 1311c2aa98e2SPeter Wemm 1312c2aa98e2SPeter WemmSCanonLocal 13132e43090eSPeter Wemm# strip local host from routed addresses 131406f25ae9SGregory Neil ShapiroR< $* > < @ $+ > : $+ $@ $>Recurse $3 131506f25ae9SGregory Neil ShapiroR< $* > $+ $=O $+ < @ $+ > $@ $>Recurse $2 $3 $4 13162e43090eSPeter Wemm 1317c2aa98e2SPeter Wemm# strip trailing dot from any host name that may appear 1318c2aa98e2SPeter WemmR< $* > $* < @ $* . > $: < $1 > $2 < @ $3 > 1319c2aa98e2SPeter Wemm 1320c2aa98e2SPeter Wemm# handle local: syntax -- use old user, either with or without host 1321c2aa98e2SPeter WemmR< > $* < @ $* > $* $#_LOCAL_ $@ $1@$2 $: $1 1322c2aa98e2SPeter WemmR< > $+ $#_LOCAL_ $@ $1 $: $1 1323c2aa98e2SPeter Wemm 1324c2aa98e2SPeter Wemm# handle local:user@host syntax -- ignore host part 1325c2aa98e2SPeter WemmR< $+ @ $+ > $* < @ $* > $: < $1 > $3 < @ $4 > 1326c2aa98e2SPeter Wemm 1327c2aa98e2SPeter Wemm# handle local:user syntax 1328c2aa98e2SPeter WemmR< $+ > $* <@ $* > $* $#_LOCAL_ $@ $2@$3 $: $1 1329c2aa98e2SPeter WemmR< $+ > $* $#_LOCAL_ $@ $2 $: $1 1330c2aa98e2SPeter Wemm 1331c2aa98e2SPeter Wemm################################################################### 1332c2aa98e2SPeter Wemm### Ruleset 93 -- convert header names to masqueraded form ### 1333c2aa98e2SPeter Wemm################################################################### 1334c2aa98e2SPeter Wemm 133506f25ae9SGregory Neil ShapiroSMasqHdr=93 1336c2aa98e2SPeter Wemm 133706f25ae9SGregory Neil Shapiroifdef(`_GENERICS_TABLE_', `dnl 1338c2aa98e2SPeter Wemm# handle generics database 1339c2aa98e2SPeter Wemmifdef(`_GENERICS_ENTIRE_DOMAIN_', 134006f25ae9SGregory Neil Shapirodnl if generics should be applied add a @ as mark 1341c2aa98e2SPeter Wemm`R$+ < @ $* $=G . > $: < $1@$2$3 > $1 < @ $2$3 . > @ mark', 1342c2aa98e2SPeter Wemm`R$+ < @ $=G . > $: < $1@$2 > $1 < @ $2 . > @ mark') 1343c2aa98e2SPeter WemmR$+ < @ *LOCAL* > $: < $1@$j > $1 < @ *LOCAL* > @ mark 134406f25ae9SGregory Neil Shapirodnl workspace: either user<@domain> or <user@domain> user <@domain> @ 134506f25ae9SGregory Neil Shapirodnl ignore the first case for now 134606f25ae9SGregory Neil Shapirodnl if it has the mark lookup full address 134740266059SGregory Neil Shapirodnl broken: %1 is full address not just detail 134806f25ae9SGregory Neil ShapiroR< $+ > $+ < $* > @ $: < $(generics $1 $: @ $1 $) > $2 < $3 > 134906f25ae9SGregory Neil Shapirodnl workspace: ... or <match|@user@domain> user <@domain> 135006f25ae9SGregory Neil Shapirodnl no match, try user+detail@domain 135106f25ae9SGregory Neil ShapiroR<@$+ + $* @ $+> $+ < @ $+ > 135206f25ae9SGregory Neil Shapiro $: < $(generics $1+*@$3 $@ $2 $:@$1 + $2@$3 $) > $4 < @ $5 > 135306f25ae9SGregory Neil ShapiroR<@$+ + $* @ $+> $+ < @ $+ > 135406f25ae9SGregory Neil Shapiro $: < $(generics $1@$3 $: $) > $4 < @ $5 > 135506f25ae9SGregory Neil Shapirodnl no match, remove mark 135606f25ae9SGregory Neil ShapiroR<@$+ > $+ < @ $+ > $: < > $2 < @ $3 > 135706f25ae9SGregory Neil Shapirodnl no match, try @domain for exceptions 135806f25ae9SGregory Neil ShapiroR< > $+ < @ $+ . > $: < $(generics @$2 $@ $1 $: $) > $1 < @ $2 . > 135906f25ae9SGregory Neil Shapirodnl workspace: ... or <match> user <@domain> 136006f25ae9SGregory Neil Shapirodnl no match, try local part 1361c2aa98e2SPeter WemmR< > $+ < @ $+ > $: < $(generics $1 $: $) > $1 < @ $2 > 136206f25ae9SGregory Neil ShapiroR< > $+ + $* < @ $+ > $: < $(generics $1+* $@ $2 $: $) > $1 + $2 < @ $3 > 136306f25ae9SGregory Neil ShapiroR< > $+ + $* < @ $+ > $: < $(generics $1 $: $) > $1 + $2 < @ $3 > 136406f25ae9SGregory Neil ShapiroR< $* @ $* > $* < $* > $@ $>canonify $1 @ $2 found qualified 136506f25ae9SGregory Neil ShapiroR< $+ > $* < $* > $: $>canonify $1 @ *LOCAL* found unqualified 1366c2aa98e2SPeter WemmR< > $* $: $1 not found', 1367c2aa98e2SPeter Wemm`dnl') 1368c2aa98e2SPeter Wemm 136906f25ae9SGregory Neil Shapiro# do not masquerade anything in class N 137006f25ae9SGregory Neil ShapiroR$* < @ $* $=N . > $@ $1 < @ $2 $3 . > 137106f25ae9SGregory Neil Shapiro 137240266059SGregory Neil Shapiroifdef(`MASQUERADE_NAME', `dnl 1373c2aa98e2SPeter Wemm# special case the users that should be exposed 1374c2aa98e2SPeter WemmR$=E < @ *LOCAL* > $@ $1 < @ $j . > leave exposed 1375c2aa98e2SPeter Wemmifdef(`_MASQUERADE_ENTIRE_DOMAIN_', 1376c2aa98e2SPeter Wemm`R$=E < @ $* $=M . > $@ $1 < @ $2 $3 . >', 1377c2aa98e2SPeter Wemm`R$=E < @ $=M . > $@ $1 < @ $2 . >') 1378c2aa98e2SPeter Wemmifdef(`_LIMITED_MASQUERADE_', `dnl', 1379c2aa98e2SPeter Wemm`R$=E < @ $=w . > $@ $1 < @ $2 . >') 1380c2aa98e2SPeter Wemm 1381c2aa98e2SPeter Wemm# handle domain-specific masquerading 1382c2aa98e2SPeter Wemmifdef(`_MASQUERADE_ENTIRE_DOMAIN_', 1383c2aa98e2SPeter Wemm`R$* < @ $* $=M . > $* $: $1 < @ $2 $3 . @ $M > $4 convert masqueraded doms', 1384c2aa98e2SPeter Wemm`R$* < @ $=M . > $* $: $1 < @ $2 . @ $M > $3 convert masqueraded doms') 1385c2aa98e2SPeter Wemmifdef(`_LIMITED_MASQUERADE_', `dnl', 1386c2aa98e2SPeter Wemm`R$* < @ $=w . > $* $: $1 < @ $2 . @ $M > $3') 1387c2aa98e2SPeter WemmR$* < @ *LOCAL* > $* $: $1 < @ $j . @ $M > $2 1388c2aa98e2SPeter WemmR$* < @ $+ @ > $* $: $1 < @ $2 > $3 $M is null 1389c2aa98e2SPeter WemmR$* < @ $+ @ $+ > $* $: $1 < @ $3 . > $4 $M is not null 139040266059SGregory Neil Shapirodnl', `dnl no masquerading 139140266059SGregory Neil Shapirodnl just fix *LOCAL* leftovers 139240266059SGregory Neil ShapiroR$* < @ *LOCAL* > $@ $1 < @ $j . >') 1393c2aa98e2SPeter Wemm 1394c2aa98e2SPeter Wemm################################################################### 1395c2aa98e2SPeter Wemm### Ruleset 94 -- convert envelope names to masqueraded form ### 1396c2aa98e2SPeter Wemm################################################################### 1397c2aa98e2SPeter Wemm 139806f25ae9SGregory Neil ShapiroSMasqEnv=94 1399c2aa98e2SPeter Wemmifdef(`_MASQUERADE_ENVELOPE_', 140006f25ae9SGregory Neil Shapiro`R$+ $@ $>MasqHdr $1', 1401c2aa98e2SPeter Wemm`R$* < @ *LOCAL* > $* $: $1 < @ $j . > $2') 1402c2aa98e2SPeter Wemm 1403c2aa98e2SPeter Wemm################################################################### 1404c2aa98e2SPeter Wemm### Ruleset 98 -- local part of ruleset zero (can be null) ### 1405c2aa98e2SPeter Wemm################################################################### 1406c2aa98e2SPeter Wemm 140706f25ae9SGregory Neil ShapiroSParseLocal=98 140806f25ae9SGregory Neil Shapiroundivert(3)dnl LOCAL_RULE_0 1409c2aa98e2SPeter Wemm 141006f25ae9SGregory Neil Shapiroifdef(`_LDAP_ROUTING_', `dnl 141140266059SGregory Neil Shapiro###################################################################### 141240266059SGregory Neil Shapiro### LDAPExpand: Expand address using LDAP routing 141340266059SGregory Neil Shapiro### 141440266059SGregory Neil Shapiro### Parameters: 141540266059SGregory Neil Shapiro### <$1> -- parsed address (user < @ domain . >) (pass through) 141640266059SGregory Neil Shapiro### <$2> -- RFC822 address (user @ domain) (used for lookup) 141740266059SGregory Neil Shapiro### <$3> -- +detail information 141840266059SGregory Neil Shapiro### 141940266059SGregory Neil Shapiro### Returns: 142040266059SGregory Neil Shapiro### Mailer triplet ($#mailer $@ host $: address) 142140266059SGregory Neil Shapiro### Parsed address (user < @ domain . >) 142240266059SGregory Neil Shapiro###################################################################### 142340266059SGregory Neil Shapiro 142406f25ae9SGregory Neil ShapiroSLDAPExpand 142506f25ae9SGregory Neil Shapiro# do the LDAP lookups 142640266059SGregory Neil ShapiroR<$+><$+><$*> $: <$(ldapmra $2 $: $)> <$(ldapmh $2 $: $)> <$1> <$2> <$3> 142706f25ae9SGregory Neil Shapiro 1428605302a5SGregory Neil Shapiro# look for temporary failures (return original address, MTA will queue up) 1429959366dcSGregory Neil ShapiroR<$* <TMPF>> <$*> <$+> <$+> <$*> $@ $3 1430959366dcSGregory Neil ShapiroR<$*> <$* <TMPF>> <$+> <$+> <$*> $@ $3 1431605302a5SGregory Neil Shapiro 143206f25ae9SGregory Neil Shapiro# if mailRoutingAddress and local or non-existant mailHost, 143306f25ae9SGregory Neil Shapiro# return the new mailRoutingAddress 143440266059SGregory Neil Shapiroifelse(_LDAP_ROUTE_DETAIL_, `_PRESERVE_', `dnl 143540266059SGregory Neil ShapiroR<$+@$+> <$=w> <$+> <$+> <$*> $@ $>Parse0 $>canonify $1 $6 @ $2 143640266059SGregory Neil ShapiroR<$+@$+> <> <$+> <$+> <$*> $@ $>Parse0 $>canonify $1 $5 @ $2') 143740266059SGregory Neil ShapiroR<$+> <$=w> <$+> <$+> <$*> $@ $>Parse0 $>canonify $1 143840266059SGregory Neil ShapiroR<$+> <> <$+> <$+> <$*> $@ $>Parse0 $>canonify $1 143906f25ae9SGregory Neil Shapiro 144094c01205SGregory Neil Shapiro 144106f25ae9SGregory Neil Shapiro# if mailRoutingAddress and non-local mailHost, 144206f25ae9SGregory Neil Shapiro# relay to mailHost with new mailRoutingAddress 144340266059SGregory Neil Shapiroifelse(_LDAP_ROUTE_DETAIL_, `_PRESERVE_', `dnl 144440266059SGregory Neil Shapiroifdef(`_MAILER_TABLE_', `dnl 144540266059SGregory Neil Shapiro# check mailertable for host, relay from there 144640266059SGregory Neil ShapiroR<$+@$+> <$+> <$+> <$+> <$*> $>LDAPMailertable <$3> $>canonify $1 $6 @ $2', 144740266059SGregory Neil Shapiro`R<$+@$+> <$+> <$+> <$+> <$*> $#_RELAY_ $@ $3 $: $>canonify $1 $6 @ $2')') 144840266059SGregory Neil Shapiroifdef(`_MAILER_TABLE_', `dnl 144940266059SGregory Neil Shapiro# check mailertable for host, relay from there 145040266059SGregory Neil ShapiroR<$+> <$+> <$+> <$+> <$*> $>LDAPMailertable <$2> $>canonify $1', 145140266059SGregory Neil Shapiro`R<$+> <$+> <$+> <$+> <$*> $#_RELAY_ $@ $2 $: $>canonify $1') 145206f25ae9SGregory Neil Shapiro 145306f25ae9SGregory Neil Shapiro# if no mailRoutingAddress and local mailHost, 145406f25ae9SGregory Neil Shapiro# return original address 145540266059SGregory Neil ShapiroR<> <$=w> <$+> <$+> <$*> $@ $2 145606f25ae9SGregory Neil Shapiro 145794c01205SGregory Neil Shapiro 145806f25ae9SGregory Neil Shapiro# if no mailRoutingAddress and non-local mailHost, 145906f25ae9SGregory Neil Shapiro# relay to mailHost with original address 146040266059SGregory Neil Shapiroifdef(`_MAILER_TABLE_', `dnl 146140266059SGregory Neil Shapiro# check mailertable for host, relay from there 146240266059SGregory Neil ShapiroR<> <$+> <$+> <$+> <$*> $>LDAPMailertable <$1> $2', 146340266059SGregory Neil Shapiro`R<> <$+> <$+> <$+> <$*> $#_RELAY_ $@ $1 $: $2') 146406f25ae9SGregory Neil Shapiro 146540266059SGregory Neil Shapiroifdef(`_LDAP_ROUTE_DETAIL_', 146640266059SGregory Neil Shapiro`# if no mailRoutingAddress and no mailHost, 146740266059SGregory Neil Shapiro# try without +detail 146840266059SGregory Neil ShapiroR<> <> <$+> <$+ + $* @ $+> <> $@ $>LDAPExpand <$1> <$2 @ $4> <+$3>')dnl 146940266059SGregory Neil Shapiro 147040266059SGregory Neil Shapiro# if still no mailRoutingAddress and no mailHost, 147106f25ae9SGregory Neil Shapiro# try @domain 147240266059SGregory Neil Shapiroifelse(_LDAP_ROUTE_DETAIL_, `_PRESERVE_', `dnl 147340266059SGregory Neil ShapiroR<> <> <$+> <$+ + $* @ $+> <> $@ $>LDAPExpand <$1> <@ $4> <+$3>') 147440266059SGregory Neil ShapiroR<> <> <$+> <$+ @ $+> <$*> $@ $>LDAPExpand <$1> <@ $3> <$4> 147506f25ae9SGregory Neil Shapiro 147606f25ae9SGregory Neil Shapiro# if no mailRoutingAddress and no mailHost and this was a domain attempt, 147706f25ae9SGregory Neil Shapiroifelse(_LDAP_ROUTING_, `_MUST_EXIST_', `dnl 147806f25ae9SGregory Neil Shapiro# user does not exist 147940266059SGregory Neil ShapiroR<> <> <$+> <@ $+> <$*> $: <?> < $&{addr_type} > < $1 > 148040266059SGregory Neil Shapiro# only give error for envelope recipient 148140266059SGregory Neil ShapiroR<?> <e r> <$+> $#error $@ nouser $: "550 User unknown" 148240266059SGregory Neil ShapiroR<?> <$*> <$+> $@ $2', 148306f25ae9SGregory Neil Shapiro`dnl 148406f25ae9SGregory Neil Shapiro# return the original address 148540266059SGregory Neil ShapiroR<> <> <$+> <@ $+> <$*> $@ $1')', 148606f25ae9SGregory Neil Shapiro`dnl') 148706f25ae9SGregory Neil Shapiro 148806f25ae9SGregory Neil Shapiroifelse(substr(confDELIVERY_MODE,0,1), `d', `errprint(`WARNING: Antispam rules not available in deferred delivery mode. 148906f25ae9SGregory Neil Shapiro')') 149040266059SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl', `divert(-1)') 1491c2aa98e2SPeter Wemm###################################################################### 149240266059SGregory Neil Shapiro### D: LookUpDomain -- search for domain in access database 1493c2aa98e2SPeter Wemm### 1494c2aa98e2SPeter Wemm### Parameters: 1495c2aa98e2SPeter Wemm### <$1> -- key (domain name) 1496c2aa98e2SPeter Wemm### <$2> -- default (what to return if not found in db) 149706f25ae9SGregory Neil Shapirodnl must not be empty 149840266059SGregory Neil Shapiro### <$3> -- mark (must be <(!|+) single-token>) 149906f25ae9SGregory Neil Shapiro### ! does lookup only with tag 150006f25ae9SGregory Neil Shapiro### + does lookup with and without tag 150140266059SGregory Neil Shapiro### <$4> -- passthru (additional data passed unchanged through) 150206f25ae9SGregory Neil Shapirodnl returns: <default> <passthru> 150306f25ae9SGregory Neil Shapirodnl <result> <passthru> 1504c2aa98e2SPeter Wemm###################################################################### 1505c2aa98e2SPeter Wemm 150640266059SGregory Neil ShapiroSD 150706f25ae9SGregory Neil Shapirodnl workspace <key> <default> <passthru> <mark> 150806f25ae9SGregory Neil Shapirodnl lookup with tag (in front, no delimiter here) 150940266059SGregory Neil Shapirodnl 2 3 4 5 151040266059SGregory Neil ShapiroR<$*> <$+> <$- $-> <$*> $: < $(access $4`'_TAG_DELIM_`'$1 $: ? $) > <$1> <$2> <$3 $4> <$5> 151106f25ae9SGregory Neil Shapirodnl workspace <result-of-lookup|?> <key> <default> <passthru> <mark> 151206f25ae9SGregory Neil Shapirodnl lookup without tag? 151340266059SGregory Neil Shapirodnl 1 2 3 4 151440266059SGregory Neil ShapiroR<?> <$+> <$+> <+ $-> <$*> $: < $(access $1 $: ? $) > <$1> <$2> <+ $3> <$4> 151540266059SGregory Neil Shapiroifdef(`_LOOKUPDOTDOMAIN_', `dnl omit first component: lookup .rest 151640266059SGregory Neil Shapirodnl XXX apply this also to IP addresses? 151740266059SGregory Neil Shapirodnl currently it works the wrong way round for [1.2.3.4] 151840266059SGregory Neil Shapirodnl 1 2 3 4 5 6 151940266059SGregory Neil ShapiroR<?> <$+.$+> <$+> <$- $-> <$*> $: < $(access $5`'_TAG_DELIM_`'.$2 $: ? $) > <$1.$2> <$3> <$4 $5> <$6> 152040266059SGregory Neil Shapirodnl 1 2 3 4 5 152140266059SGregory Neil ShapiroR<?> <$+.$+> <$+> <+ $-> <$*> $: < $(access .$2 $: ? $) > <$1.$2> <$3> <+ $4> <$5>', `dnl') 152240266059SGregory Neil Shapiroifdef(`_ACCESS_SKIP_', `dnl 152340266059SGregory Neil Shapirodnl found SKIP: return <default> and <passthru> 152440266059SGregory Neil Shapirodnl 1 2 3 4 5 152540266059SGregory Neil ShapiroR<SKIP> <$+> <$+> <$- $-> <$*> $@ <$2> <$5>', `dnl') 152640266059SGregory Neil Shapirodnl not found: IPv4 net (no check is done whether it is an IP number!) 152740266059SGregory Neil Shapirodnl 1 2 3 4 5 6 152840266059SGregory Neil ShapiroR<?> <[$+.$-]> <$+> <$- $-> <$*> $@ $>D <[$1]> <$3> <$4 $5> <$6> 152940266059SGregory Neil Shapiroifdef(`NO_NETINET6', `dnl', 153040266059SGregory Neil Shapiro`dnl not found: IPv6 net 153140266059SGregory Neil Shapirodnl (could be merged with previous rule if we have a class containing .:) 153240266059SGregory Neil Shapirodnl 1 2 3 4 5 6 153340266059SGregory Neil ShapiroR<?> <[$+::$-]> <$+> <$- $-> <$*> $: $>D <[$1]> <$3> <$4 $5> <$6> 153440266059SGregory Neil ShapiroR<?> <[$+:$-]> <$+> <$- $-> <$*> $: $>D <[$1]> <$3> <$4 $5> <$6>') 153506f25ae9SGregory Neil Shapirodnl not found, but subdomain: try again 153640266059SGregory Neil Shapirodnl 1 2 3 4 5 6 153740266059SGregory Neil ShapiroR<?> <$+.$+> <$+> <$- $-> <$*> $@ $>D <$2> <$3> <$4 $5> <$6> 153840266059SGregory Neil Shapiroifdef(`_FFR_LOOKUPTAG_', `dnl lookup Tag: 153940266059SGregory Neil Shapirodnl 1 2 3 4 154040266059SGregory Neil ShapiroR<?> <$+> <$+> <! $-> <$*> $: < $(access $3`'_TAG_DELIM_ $: ? $) > <$1> <$2> <! $3> <$4>', `dnl') 154140266059SGregory Neil Shapirodnl not found, no subdomain: return <default> and <passthru> 154240266059SGregory Neil Shapirodnl 1 2 3 4 5 154340266059SGregory Neil ShapiroR<?> <$+> <$+> <$- $-> <$*> $@ <$2> <$5> 154440266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 154540266059SGregory Neil Shapirodnl 2 3 4 5 6 154640266059SGregory Neil ShapiroR<$* _ATMPF_> <$+> <$+> <$- $-> <$*> $@ <_ATMPF_> <$6>', `dnl') 154740266059SGregory Neil Shapirodnl return <result of lookup> and <passthru> 154840266059SGregory Neil Shapirodnl 2 3 4 5 6 154940266059SGregory Neil ShapiroR<$*> <$+> <$+> <$- $-> <$*> $@ <$1> <$6> 1550c2aa98e2SPeter Wemm 1551c2aa98e2SPeter Wemm###################################################################### 155240266059SGregory Neil Shapiro### A: LookUpAddress -- search for host address in access database 1553c2aa98e2SPeter Wemm### 1554c2aa98e2SPeter Wemm### Parameters: 1555c2aa98e2SPeter Wemm### <$1> -- key (dot quadded host address) 1556c2aa98e2SPeter Wemm### <$2> -- default (what to return if not found in db) 155706f25ae9SGregory Neil Shapirodnl must not be empty 155840266059SGregory Neil Shapiro### <$3> -- mark (must be <(!|+) single-token>) 155906f25ae9SGregory Neil Shapiro### ! does lookup only with tag 156006f25ae9SGregory Neil Shapiro### + does lookup with and without tag 156140266059SGregory Neil Shapiro### <$4> -- passthru (additional data passed through) 156206f25ae9SGregory Neil Shapirodnl returns: <default> <passthru> 156306f25ae9SGregory Neil Shapirodnl <result> <passthru> 1564c2aa98e2SPeter Wemm###################################################################### 1565c2aa98e2SPeter Wemm 156640266059SGregory Neil ShapiroSA 156706f25ae9SGregory Neil Shapirodnl lookup with tag 156840266059SGregory Neil Shapirodnl 2 3 4 5 156940266059SGregory Neil ShapiroR<$+> <$+> <$- $-> <$*> $: < $(access $4`'_TAG_DELIM_`'$1 $: ? $) > <$1> <$2> <$3 $4> <$5> 157006f25ae9SGregory Neil Shapirodnl lookup without tag 157140266059SGregory Neil Shapirodnl 1 2 3 4 157240266059SGregory Neil ShapiroR<?> <$+> <$+> <+ $-> <$*> $: < $(access $1 $: ? $) > <$1> <$2> <+ $3> <$4> 157340266059SGregory Neil Shapirodnl workspace <result-of-lookup|?> <key> <default> <mark> <passthru> 157440266059SGregory Neil Shapiroifdef(`_ACCESS_SKIP_', `dnl 157540266059SGregory Neil Shapirodnl found SKIP: return <default> and <passthru> 157640266059SGregory Neil Shapirodnl 1 2 3 4 5 157740266059SGregory Neil ShapiroR<SKIP> <$+> <$+> <$- $-> <$*> $@ <$2> <$5>', `dnl') 157840266059SGregory Neil Shapiroifdef(`NO_NETINET6', `dnl', 157940266059SGregory Neil Shapiro`dnl no match; IPv6: remove last part 158040266059SGregory Neil Shapirodnl 1 2 3 4 5 6 158140266059SGregory Neil ShapiroR<?> <$+::$-> <$+> <$- $-> <$*> $@ $>A <$1> <$3> <$4 $5> <$6> 158240266059SGregory Neil ShapiroR<?> <$+:$-> <$+> <$- $-> <$*> $@ $>A <$1> <$3> <$4 $5> <$6>') 158306f25ae9SGregory Neil Shapirodnl no match; IPv4: remove last part 158440266059SGregory Neil Shapirodnl 1 2 3 4 5 6 158540266059SGregory Neil ShapiroR<?> <$+.$-> <$+> <$- $-> <$*> $@ $>A <$1> <$3> <$4 $5> <$6> 158606f25ae9SGregory Neil Shapirodnl no match: return default 158740266059SGregory Neil Shapirodnl 1 2 3 4 5 158840266059SGregory Neil ShapiroR<?> <$+> <$+> <$- $-> <$*> $@ <$2> <$5> 158940266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 159040266059SGregory Neil Shapirodnl 2 3 4 5 6 159140266059SGregory Neil ShapiroR<$* _ATMPF_> <$+> <$+> <$- $-> <$*> $@ <_ATMPF_> <$6>', `dnl') 159206f25ae9SGregory Neil Shapirodnl match: return result 159340266059SGregory Neil Shapirodnl 2 3 4 5 6 159440266059SGregory Neil ShapiroR<$*> <$+> <$+> <$- $-> <$*> $@ <$1> <$6> 159540266059SGregory Neil Shapirodnl endif _ACCESS_TABLE_ 159640266059SGregory Neil Shapirodivert(0) 1597c2aa98e2SPeter Wemm###################################################################### 1598065a643dSPeter Wemm### CanonAddr -- Convert an address into a standard form for 1599065a643dSPeter Wemm### relay checking. Route address syntax is 1600065a643dSPeter Wemm### crudely converted into a %-hack address. 1601065a643dSPeter Wemm### 1602065a643dSPeter Wemm### Parameters: 1603065a643dSPeter Wemm### $1 -- full recipient address 1604065a643dSPeter Wemm### 1605065a643dSPeter Wemm### Returns: 1606065a643dSPeter Wemm### parsed address, not in source route form 160706f25ae9SGregory Neil Shapirodnl user%host%host<@domain> 160806f25ae9SGregory Neil Shapirodnl host!user<@domain> 1609065a643dSPeter Wemm###################################################################### 1610065a643dSPeter Wemm 1611065a643dSPeter WemmSCanonAddr 161206f25ae9SGregory Neil ShapiroR$* $: $>Parse0 $>canonify $1 make domain canonical 161306f25ae9SGregory Neil Shapiroifdef(`_USE_DEPRECATED_ROUTE_ADDR_',`dnl 1614065a643dSPeter WemmR< @ $+ > : $* @ $* < @ $1 > : $2 % $3 change @ to % in src route 1615065a643dSPeter WemmR$* < @ $+ > : $* : $* $3 $1 < @ $2 > : $4 change to % hack. 1616065a643dSPeter WemmR$* < @ $+ > : $* $3 $1 < @ $2 > 161706f25ae9SGregory Neil Shapirodnl') 1618065a643dSPeter Wemm 1619065a643dSPeter Wemm###################################################################### 1620c2aa98e2SPeter Wemm### ParseRecipient -- Strip off hosts in $=R as well as possibly 1621c2aa98e2SPeter Wemm### $* $=m or the access database. 1622c2aa98e2SPeter Wemm### Check user portion for host separators. 1623c2aa98e2SPeter Wemm### 1624c2aa98e2SPeter Wemm### Parameters: 1625c2aa98e2SPeter Wemm### $1 -- full recipient address 1626c2aa98e2SPeter Wemm### 1627c2aa98e2SPeter Wemm### Returns: 1628c2aa98e2SPeter Wemm### parsed, non-local-relaying address 1629c2aa98e2SPeter Wemm###################################################################### 1630c2aa98e2SPeter Wemm 1631c2aa98e2SPeter WemmSParseRecipient 163206f25ae9SGregory Neil Shapirodnl mark and canonify address 1633065a643dSPeter WemmR$* $: <?> $>CanonAddr $1 163406f25ae9SGregory Neil Shapirodnl workspace: <?> localpart<@domain[.]> 1635c2aa98e2SPeter WemmR<?> $* < @ $* . > <?> $1 < @ $2 > strip trailing dots 163606f25ae9SGregory Neil Shapirodnl workspace: <?> localpart<@domain> 1637c2aa98e2SPeter WemmR<?> $- < @ $* > $: <?> $(dequote $1 $) < @ $2 > dequote local part 1638c2aa98e2SPeter Wemm 1639c2aa98e2SPeter Wemm# if no $=O character, no host in the user portion, we are done 1640c2aa98e2SPeter WemmR<?> $* $=O $* < @ $* > $: <NO> $1 $2 $3 < @ $4> 164106f25ae9SGregory Neil Shapirodnl no $=O in localpart: return 1642c2aa98e2SPeter WemmR<?> $* $@ $1 1643c2aa98e2SPeter Wemm 164440266059SGregory Neil Shapirodnl workspace: <NO> localpart<@domain>, where localpart contains $=O 164506f25ae9SGregory Neil Shapirodnl mark everything which has an "authorized" domain with <RELAY> 1646c2aa98e2SPeter Wemmifdef(`_RELAY_ENTIRE_DOMAIN_', `dnl 1647c2aa98e2SPeter Wemm# if we relay, check username portion for user%host so host can be checked also 1648c2aa98e2SPeter WemmR<NO> $* < @ $* $=m > $: <RELAY> $1 < @ $2 $3 >', `dnl') 164906f25ae9SGregory Neil Shapirodnl workspace: <(NO|RELAY)> localpart<@domain>, where localpart contains $=O 165006f25ae9SGregory Neil Shapirodnl if mark is <NO> then change it to <RELAY> if domain is "authorized" 165140266059SGregory Neil Shapiro 165240266059SGregory Neil Shapirodnl what if access map returns something else than RELAY? 165340266059SGregory Neil Shapirodnl we are only interested in RELAY entries... 165440266059SGregory Neil Shapirodnl other To: entries: blacklist recipient; generic entries? 165540266059SGregory Neil Shapirodnl if it is an error we probably do not want to relay anyway 1656c2aa98e2SPeter Wemmifdef(`_RELAY_HOSTS_ONLY_', 1657c2aa98e2SPeter Wemm`R<NO> $* < @ $=R > $: <RELAY> $1 < @ $2 > 165806f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 165906f25ae9SGregory Neil ShapiroR<NO> $* < @ $+ > $: <$(access To:$2 $: NO $)> $1 < @ $2 > 1660065a643dSPeter WemmR<NO> $* < @ $+ > $: <$(access $2 $: NO $)> $1 < @ $2 >',`dnl')', 1661c2aa98e2SPeter Wemm`R<NO> $* < @ $* $=R > $: <RELAY> $1 < @ $2 $3 > 166206f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 166340266059SGregory Neil ShapiroR<NO> $* < @ $+ > $: $>D <$2> <NO> <+ To> <$1 < @ $2 >> 1664c2aa98e2SPeter WemmR<$+> <$+> $: <$1> $2',`dnl')') 1665065a643dSPeter Wemm 166606f25ae9SGregory Neil Shapiro 166740266059SGregory Neil Shapiroifdef(`_RELAY_MX_SERVED_', `dnl 166840266059SGregory Neil Shapirodnl do "we" ($=w) act as backup MX server for the destination domain? 166940266059SGregory Neil ShapiroR<NO> $* < @ $+ > $: <MX> < : $(mxserved $2 $) : > < $1 < @$2 > > 167040266059SGregory Neil ShapiroR<MX> < : $* <TEMP> : > $* $#TEMP $@ 4.7.1 $: "450 Can not check MX records for recipient host " $1 167140266059SGregory Neil Shapirodnl yes: mark it as <RELAY> 167240266059SGregory Neil ShapiroR<MX> < $* : $=w. : $* > < $+ > $: <RELAY> $4 167340266059SGregory Neil Shapirodnl no: put old <NO> mark back 167440266059SGregory Neil ShapiroR<MX> < : $* : > < $+ > $: <NO> $2', `dnl') 167540266059SGregory Neil Shapiro 167640266059SGregory Neil Shapirodnl do we relay to this recipient domain? 1677c2aa98e2SPeter WemmR<RELAY> $* < @ $* > $@ $>ParseRecipient $1 167840266059SGregory Neil Shapirodnl something else 167940266059SGregory Neil ShapiroR<$+> $* $@ $2 1680c2aa98e2SPeter Wemm 168106f25ae9SGregory Neil Shapiro 1682c2aa98e2SPeter Wemm###################################################################### 1683c2aa98e2SPeter Wemm### check_relay -- check hostname/address on SMTP startup 1684c2aa98e2SPeter Wemm###################################################################### 1685c2aa98e2SPeter Wemm 1686c2aa98e2SPeter WemmSLocal_check_relay 168706f25ae9SGregory Neil ShapiroScheck`'_U_`'relay 1688c2aa98e2SPeter WemmR$* $: $1 $| $>"Local_check_relay" $1 1689c2aa98e2SPeter WemmR$* $| $* $| $#$* $#$3 1690c2aa98e2SPeter WemmR$* $| $* $| $* $@ $>"Basic_check_relay" $1 $| $2 1691c2aa98e2SPeter Wemm 1692c2aa98e2SPeter WemmSBasic_check_relay 1693c2aa98e2SPeter Wemm# check for deferred delivery mode 169494c01205SGregory Neil ShapiroR$* $: < $&{deliveryMode} > $1 1695c2aa98e2SPeter WemmR< d > $* $@ deferred 1696c2aa98e2SPeter WemmR< $* > $* $: $2 1697c2aa98e2SPeter Wemm 169806f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 169942e5d165SGregory Neil Shapirodnl workspace: {client_name} $| {client_addr} 170040266059SGregory Neil ShapiroR$+ $| $+ $: $>D < $1 > <?> <+ Connect> < $2 > 170142e5d165SGregory Neil Shapirodnl workspace: <result-of-lookup> <{client_addr}> 170213bd1963SGregory Neil Shapirodnl OR $| $+ if client_name is empty 170313bd1963SGregory Neil ShapiroR $| $+ $: $>A < $1 > <?> <+ Connect> <> empty client_name 170413bd1963SGregory Neil Shapirodnl workspace: <result-of-lookup> <{client_addr}> 170540266059SGregory Neil ShapiroR<?> <$+> $: $>A < $1 > <?> <+ Connect> <> no: another lookup 170640266059SGregory Neil Shapirodnl workspace: <result-of-lookup> (<>|<{client_addr}>) 170740266059SGregory Neil ShapiroR<?> <$*> $: OK found nothing 170840266059SGregory Neil Shapirodnl workspace: <result-of-lookup> (<>|<{client_addr}>) | OK 170942e5d165SGregory Neil ShapiroR<$={Accept}> <$*> $@ $1 return value of lookup 171040266059SGregory Neil ShapiroR<REJECT> <$*> $#error ifdef(`confREJECT_MSG', `$: "confREJECT_MSG"', `$@ 5.7.1 $: "550 Access denied"') 171140266059SGregory Neil ShapiroR<DISCARD> <$*> $#discard $: discard 171240266059SGregory Neil Shapiroifdef(`_FFR_QUARANTINE', 171340266059SGregory Neil Shapiro`R<QUARANTINE:$+> <$*> $#error $@ quarantine $: $1', `dnl') 171406f25ae9SGregory Neil Shapirodnl error tag 171542e5d165SGregory Neil ShapiroR<ERROR:$-.$-.$-:$+> <$*> $#error $@ $1.$2.$3 $: $4 171642e5d165SGregory Neil ShapiroR<ERROR:$+> <$*> $#error $: $1 171740266059SGregory Neil Shapiroifdef(`_ATMPF_', `R<$* _ATMPF_> <$*> $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 171806f25ae9SGregory Neil Shapirodnl generic error from access map 171942e5d165SGregory Neil ShapiroR<$+> <$*> $#error $: $1', `dnl') 1720c2aa98e2SPeter Wemm 1721c2aa98e2SPeter Wemmifdef(`_RBL_',`dnl 172206f25ae9SGregory Neil Shapiro# DNS based IP address spam list 172340266059SGregory Neil Shapirodnl workspace: ignored... 1724c2aa98e2SPeter WemmR$* $: $&{client_addr} 172506f25ae9SGregory Neil ShapiroR$-.$-.$-.$- $: <?> $(host $4.$3.$2.$1._RBL_. $: OK $) 172606f25ae9SGregory Neil ShapiroR<?>OK $: OKSOFAR 172794c01205SGregory Neil ShapiroR<?>$+ $#error $@ 5.7.1 $: "550 Rejected: " $&{client_addr} " listed at _RBL_"', 1728c2aa98e2SPeter Wemm`dnl') 172906f25ae9SGregory Neil Shapiroundivert(8) 1730c2aa98e2SPeter Wemm 1731c2aa98e2SPeter Wemm###################################################################### 1732c2aa98e2SPeter Wemm### check_mail -- check SMTP ``MAIL FROM:'' command argument 1733c2aa98e2SPeter Wemm###################################################################### 1734c2aa98e2SPeter Wemm 1735c2aa98e2SPeter WemmSLocal_check_mail 173606f25ae9SGregory Neil ShapiroScheck`'_U_`'mail 1737c2aa98e2SPeter WemmR$* $: $1 $| $>"Local_check_mail" $1 1738c2aa98e2SPeter WemmR$* $| $#$* $#$2 1739c2aa98e2SPeter WemmR$* $| $* $@ $>"Basic_check_mail" $1 1740c2aa98e2SPeter Wemm 1741c2aa98e2SPeter WemmSBasic_check_mail 1742c2aa98e2SPeter Wemm# check for deferred delivery mode 174394c01205SGregory Neil ShapiroR$* $: < $&{deliveryMode} > $1 1744c2aa98e2SPeter WemmR< d > $* $@ deferred 1745c2aa98e2SPeter WemmR< $* > $* $: $2 1746c2aa98e2SPeter Wemm 174706f25ae9SGregory Neil Shapiro# authenticated? 174806f25ae9SGregory Neil Shapirodnl done first: we can require authentication for every mail transaction 174906f25ae9SGregory Neil Shapirodnl workspace: address as given by MAIL FROM: (sender) 175006f25ae9SGregory Neil ShapiroR$* $: $1 $| $>"tls_client" $&{verify} $| MAIL 175106f25ae9SGregory Neil ShapiroR$* $| $#$+ $#$2 175206f25ae9SGregory Neil Shapirodnl undo damage: remove result of tls_client call 175306f25ae9SGregory Neil ShapiroR$* $| $* $: $1 175406f25ae9SGregory Neil Shapiro 175506f25ae9SGregory Neil Shapirodnl workspace: address as given by MAIL FROM: 175606f25ae9SGregory Neil ShapiroR<> $@ <OK> we MUST accept <> (RFC 1123) 175706f25ae9SGregory Neil Shapiroifdef(`_ACCEPT_UNQUALIFIED_SENDERS_',`dnl',`dnl 175806f25ae9SGregory Neil Shapirodnl do some additional checks 175906f25ae9SGregory Neil Shapirodnl no user@host 176006f25ae9SGregory Neil Shapirodnl no user@localhost (if nonlocal sender) 176106f25ae9SGregory Neil Shapirodnl this is a pretty simple canonification, it will not catch every case 176206f25ae9SGregory Neil Shapirodnl just make sure the address has <> around it (which is required by 176306f25ae9SGregory Neil Shapirodnl the RFC anyway, maybe we should complain if they are missing...) 176406f25ae9SGregory Neil Shapirodnl dirty trick: if it is user@host, just add a dot: user@host. this will 176506f25ae9SGregory Neil Shapirodnl not be modified by host lookups. 176606f25ae9SGregory Neil ShapiroR$+ $: <?> $1 176706f25ae9SGregory Neil ShapiroR<?><$+> $: <@> <$1> 176806f25ae9SGregory Neil ShapiroR<?>$+ $: <@> <$1> 176906f25ae9SGregory Neil Shapirodnl workspace: <@> <address> 177006f25ae9SGregory Neil Shapirodnl prepend daemon_flags 177106f25ae9SGregory Neil ShapiroR$* $: $&{daemon_flags} $| $1 177206f25ae9SGregory Neil Shapirodnl workspace: ${daemon_flags} $| <@> <address> 177306f25ae9SGregory Neil Shapirodnl do not allow these at all or only from local systems? 177406f25ae9SGregory Neil ShapiroR$* f $* $| <@> < $* @ $- > $: < ? $&{client_name} > < $3 @ $4 > 177506f25ae9SGregory Neil Shapirodnl accept unqualified sender: change mark to avoid test 177606f25ae9SGregory Neil ShapiroR$* u $* $| <@> < $* > $: <?> < $3 > 177706f25ae9SGregory Neil Shapirodnl workspace: ${daemon_flags} $| <@> <address> 177806f25ae9SGregory Neil Shapirodnl or: <? ${client_name} > <address> 177906f25ae9SGregory Neil Shapirodnl or: <?> <address> 178006f25ae9SGregory Neil Shapirodnl remove daemon_flags 178106f25ae9SGregory Neil ShapiroR$* $| $* $: $2 178206f25ae9SGregory Neil Shapiro# handle case of @localhost on address 178306f25ae9SGregory Neil ShapiroR<@> < $* @ localhost > $: < ? $&{client_name} > < $1 @ localhost > 178406f25ae9SGregory Neil ShapiroR<@> < $* @ [127.0.0.1] > 178506f25ae9SGregory Neil Shapiro $: < ? $&{client_name} > < $1 @ [127.0.0.1] > 178606f25ae9SGregory Neil ShapiroR<@> < $* @ localhost.$m > 178706f25ae9SGregory Neil Shapiro $: < ? $&{client_name} > < $1 @ localhost.$m > 178806f25ae9SGregory Neil Shapiroifdef(`_NO_UUCP_', `dnl', 178906f25ae9SGregory Neil Shapiro`R<@> < $* @ localhost.UUCP > 179006f25ae9SGregory Neil Shapiro $: < ? $&{client_name} > < $1 @ localhost.UUCP >') 179106f25ae9SGregory Neil Shapirodnl workspace: < ? $&{client_name} > <user@localhost|host> 179206f25ae9SGregory Neil Shapirodnl or: <@> <address> 179306f25ae9SGregory Neil Shapirodnl or: <?> <address> (thanks to u in ${daemon_flags}) 179406f25ae9SGregory Neil ShapiroR<@> $* $: $1 no localhost as domain 179506f25ae9SGregory Neil Shapirodnl workspace: < ? $&{client_name} > <user@localhost|host> 179606f25ae9SGregory Neil Shapirodnl or: <address> 179706f25ae9SGregory Neil Shapirodnl or: <?> <address> (thanks to u in ${daemon_flags}) 179806f25ae9SGregory Neil ShapiroR<? $=w> $* $: $2 local client: ok 179940266059SGregory Neil ShapiroR<? $+> <$+> $#error $@ 5.5.4 $: "_CODE553 Real domain name required for sender address" 180006f25ae9SGregory Neil Shapirodnl remove <?> (happens only if ${client_name} == "" or u in ${daemon_flags}) 180106f25ae9SGregory Neil ShapiroR<?> $* $: $1') 180206f25ae9SGregory Neil Shapirodnl workspace: address (or <address>) 180306f25ae9SGregory Neil ShapiroR$* $: <?> $>CanonAddr $1 canonify sender address and mark it 180406f25ae9SGregory Neil Shapirodnl workspace: <?> CanonicalAddress (i.e. address in canonical form localpart<@host>) 180506f25ae9SGregory Neil Shapirodnl there is nothing behind the <@host> so no trailing $* needed 1806065a643dSPeter WemmR<?> $* < @ $+ . > <?> $1 < @ $2 > strip trailing dots 1807c2aa98e2SPeter Wemm# handle non-DNS hostnames (*.bitnet, *.decnet, *.uucp, etc) 1808959366dcSGregory Neil ShapiroR<?> $* < @ $* $=P > $: <_RES_OK_> $1 < @ $2 $3 > 180906f25ae9SGregory Neil Shapirodnl workspace <mark> CanonicalAddress where mark is ? or OK 181094c01205SGregory Neil Shapirodnl A sender address with my local host name ($j) is safe 1811959366dcSGregory Neil ShapiroR<?> $* < @ $j > $: <_RES_OK_> $1 < @ $j > 1812c2aa98e2SPeter Wemmifdef(`_ACCEPT_UNRESOLVABLE_DOMAINS_', 181340266059SGregory Neil Shapiro`R<?> $* < @ $+ > $: <_RES_OK_> $1 < @ $2 > ... unresolvable OK', 181406f25ae9SGregory Neil Shapiro`R<?> $* < @ $+ > $: <? $(resolve $2 $: $2 <PERM> $) > $1 < @ $2 > 181506f25ae9SGregory Neil ShapiroR<? $* <$->> $* < @ $+ > 181606f25ae9SGregory Neil Shapiro $: <$2> $3 < @ $4 >') 181740266059SGregory Neil Shapirodnl workspace <mark> CanonicalAddress where mark is ?, _RES_OK_, PERM, TEMP 181806f25ae9SGregory Neil Shapirodnl mark is ? iff the address is user (wo @domain) 1819c2aa98e2SPeter Wemm 182006f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 182106f25ae9SGregory Neil Shapiro# check sender address: user@address, user@, address 182206f25ae9SGregory Neil Shapirodnl should we remove +ext from user? 182340266059SGregory Neil Shapirodnl workspace: <mark> CanonicalAddress where mark is: ?, _RES_OK_, PERM, TEMP 182440266059SGregory Neil ShapiroR<$+> $+ < @ $* > $: @<$1> <$2 < @ $3 >> $| <F:$2@$3> <U:$2@> <D:$3> 182506f25ae9SGregory Neil ShapiroR<$+> $+ $: @<$1> <$2> $| <U:$2@> 182606f25ae9SGregory Neil Shapirodnl workspace: @<mark> <CanonicalAddress> $| <@type:address> .... 182706f25ae9SGregory Neil Shapirodnl $| is used as delimiter, otherwise false matches may occur: <user<@domain>> 182806f25ae9SGregory Neil Shapirodnl will only return user<@domain when "reversing" the args 182906f25ae9SGregory Neil ShapiroR@ <$+> <$*> $| <$+> $: <@> <$1> <$2> $| $>SearchList <+ From> $| <$3> <> 183006f25ae9SGregory Neil Shapirodnl workspace: <@><mark> <CanonicalAddress> $| <result> 183106f25ae9SGregory Neil ShapiroR<@> <$+> <$*> $| <$*> $: <$3> <$1> <$2> reverse result 183206f25ae9SGregory Neil Shapirodnl workspace: <result> <mark> <CanonicalAddress> 1833c2aa98e2SPeter Wemm# retransform for further use 183406f25ae9SGregory Neil Shapirodnl required form: 183506f25ae9SGregory Neil Shapirodnl <ResultOfLookup|mark> CanonicalAddress 183606f25ae9SGregory Neil ShapiroR<?> <$+> <$*> $: <$1> $2 no match 183706f25ae9SGregory Neil ShapiroR<$+> <$+> <$*> $: <$1> $3 relevant result, keep it', `dnl') 183806f25ae9SGregory Neil Shapirodnl workspace <ResultOfLookup|mark> CanonicalAddress 183906f25ae9SGregory Neil Shapirodnl mark is ? iff the address is user (wo @domain) 1840c2aa98e2SPeter Wemm 1841c2aa98e2SPeter Wemmifdef(`_ACCEPT_UNQUALIFIED_SENDERS_',`dnl',`dnl 1842c2aa98e2SPeter Wemm# handle case of no @domain on address 184306f25ae9SGregory Neil Shapirodnl prepend daemon_flags 184406f25ae9SGregory Neil ShapiroR<?> $* $: $&{daemon_flags} $| <?> $1 184506f25ae9SGregory Neil Shapirodnl accept unqualified sender: change mark to avoid test 184640266059SGregory Neil ShapiroR$* u $* $| <?> $* $: <_RES_OK_> $3 184706f25ae9SGregory Neil Shapirodnl remove daemon_flags 184806f25ae9SGregory Neil ShapiroR$* $| $* $: $2 184913bd1963SGregory Neil ShapiroR<?> $* $: < ? $&{client_addr} > $1 1850959366dcSGregory Neil ShapiroR<?> $* $@ <_RES_OK_> ...local unqualed ok 185140266059SGregory Neil ShapiroR<? $+> $* $#error $@ 5.5.4 $: "_CODE553 Domain name required for sender address " $&f 1852c2aa98e2SPeter Wemm ...remote is not') 1853c2aa98e2SPeter Wemm# check results 185406f25ae9SGregory Neil ShapiroR<?> $* $: @ $1 mark address: nothing known about it 185540266059SGregory Neil ShapiroR<$={ResOk}> $* $@ <_RES_OK_> domain ok: stop 185606f25ae9SGregory Neil ShapiroR<TEMP> $* $#error $@ 4.1.8 $: "451 Domain of sender address " $&f " does not resolve" 185740266059SGregory Neil ShapiroR<PERM> $* $#error $@ 5.1.8 $: "_CODE553 Domain of sender address " $&f " does not exist" 185806f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 185940266059SGregory Neil ShapiroR<$={Accept}> $* $# $1 accept from access map 1860c2aa98e2SPeter WemmR<DISCARD> $* $#discard $: discard 186140266059SGregory Neil Shapiroifdef(`_FFR_QUARANTINE', 186240266059SGregory Neil Shapiro`R<QUARANTINE:$+> $* $#error $@ quarantine $: $1', `dnl') 186306f25ae9SGregory Neil ShapiroR<REJECT> $* $#error ifdef(`confREJECT_MSG', `$: "confREJECT_MSG"', `$@ 5.7.1 $: "550 Access denied"') 186406f25ae9SGregory Neil Shapirodnl error tag 186506f25ae9SGregory Neil ShapiroR<ERROR:$-.$-.$-:$+> $* $#error $@ $1.$2.$3 $: $4 186606f25ae9SGregory Neil ShapiroR<ERROR:$+> $* $#error $: $1 186740266059SGregory Neil Shapiroifdef(`_ATMPF_', `R<_ATMPF_> $* $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 186806f25ae9SGregory Neil Shapirodnl generic error from access map 186906f25ae9SGregory Neil ShapiroR<$+> $* $#error $: $1 error from access db', 1870c2aa98e2SPeter Wemm`dnl') 1871c2aa98e2SPeter Wemm 1872c2aa98e2SPeter Wemm###################################################################### 1873c2aa98e2SPeter Wemm### check_rcpt -- check SMTP ``RCPT TO:'' command argument 1874c2aa98e2SPeter Wemm###################################################################### 1875c2aa98e2SPeter Wemm 1876c2aa98e2SPeter WemmSLocal_check_rcpt 187706f25ae9SGregory Neil ShapiroScheck`'_U_`'rcpt 1878c2aa98e2SPeter WemmR$* $: $1 $| $>"Local_check_rcpt" $1 1879c2aa98e2SPeter WemmR$* $| $#$* $#$2 1880c2aa98e2SPeter WemmR$* $| $* $@ $>"Basic_check_rcpt" $1 1881c2aa98e2SPeter Wemm 1882c2aa98e2SPeter WemmSBasic_check_rcpt 188340266059SGregory Neil Shapiro# empty address? 188440266059SGregory Neil ShapiroR<> $#error $@ nouser $: "553 User address required" 188540266059SGregory Neil ShapiroR$@ $#error $@ nouser $: "553 User address required" 1886c2aa98e2SPeter Wemm# check for deferred delivery mode 188794c01205SGregory Neil ShapiroR$* $: < $&{deliveryMode} > $1 1888c2aa98e2SPeter WemmR< d > $* $@ deferred 1889c2aa98e2SPeter WemmR< $* > $* $: $2 1890c2aa98e2SPeter Wemm 189106f25ae9SGregory Neil Shapiroifdef(`_REQUIRE_QUAL_RCPT_', `dnl 189240266059SGregory Neil Shapirodnl this code checks for user@host where host is not a FQHN. 189340266059SGregory Neil Shapirodnl it is not activated. 189440266059SGregory Neil Shapirodnl notice: code to check for a recipient without a domain name is 189540266059SGregory Neil Shapirodnl available down below; look for the same macro. 189640266059SGregory Neil Shapirodnl this check is done here because the name might be qualified by the 189740266059SGregory Neil Shapirodnl canonicalization. 189840266059SGregory Neil Shapiro# require fully qualified domain part? 189940266059SGregory Neil Shapirodnl very simple canonification: make sure the address is in < > 190006f25ae9SGregory Neil ShapiroR$+ $: <?> $1 190106f25ae9SGregory Neil ShapiroR<?> <$+> $: <@> <$1> 190206f25ae9SGregory Neil ShapiroR<?> $+ $: <@> <$1> 190340266059SGregory Neil ShapiroR<@> < postmaster > $: postmaster 190413bd1963SGregory Neil ShapiroR<@> < $* @ $+ . $+ > $: < $1 @ $2 . $3 > 190506f25ae9SGregory Neil Shapirodnl prepend daemon_flags 190640266059SGregory Neil ShapiroR<@> $* $: $&{daemon_flags} $| <@> $1 190706f25ae9SGregory Neil Shapirodnl workspace: ${daemon_flags} $| <@> <address> 190806f25ae9SGregory Neil Shapirodnl do not allow these at all or only from local systems? 190940266059SGregory Neil ShapiroR$* r $* $| <@> < $* @ $* > $: < ? $&{client_name} > < $3 @ $4 > 191006f25ae9SGregory Neil ShapiroR<?> < $* > $: <$1> 191106f25ae9SGregory Neil ShapiroR<? $=w> < $* > $: <$1> 191240266059SGregory Neil ShapiroR<? $+> <$+> $#error $@ 5.5.4 $: "553 Fully qualified domain name required" 191306f25ae9SGregory Neil Shapirodnl remove daemon_flags for other cases 191406f25ae9SGregory Neil ShapiroR$* $| <@> $* $: $2', `dnl') 191506f25ae9SGregory Neil Shapiro 191640266059SGregory Neil Shapirodnl ################################################################## 191740266059SGregory Neil Shapirodnl call subroutines for recipient and relay 191840266059SGregory Neil Shapirodnl possible returns from subroutines: 191940266059SGregory Neil Shapirodnl $#TEMP temporary failure 192040266059SGregory Neil Shapirodnl $#error permanent failure (or temporary if from access map) 192140266059SGregory Neil Shapirodnl $#other stop processing 192240266059SGregory Neil Shapirodnl RELAY RELAYing allowed 192340266059SGregory Neil Shapirodnl other otherwise 192440266059SGregory Neil Shapiro###################################################################### 192540266059SGregory Neil ShapiroR$* $: $1 $| @ $>"Rcpt_ok" $1 192640266059SGregory Neil Shapirodnl temporary failure? remove mark @ and remember 192740266059SGregory Neil ShapiroR$* $| @ $#TEMP $+ $: $1 $| T $2 192840266059SGregory Neil Shapirodnl error or ok (stop) 192940266059SGregory Neil ShapiroR$* $| @ $#$* $#$2 193040266059SGregory Neil Shapiroifdef(`_PROMISCUOUS_RELAY_', `divert(-1)', `dnl') 193140266059SGregory Neil ShapiroR$* $| @ RELAY $@ RELAY 193240266059SGregory Neil Shapirodnl something else: call check sender (relay) 193340266059SGregory Neil ShapiroR$* $| @ $* $: O $| $>"Relay_ok" $1 193440266059SGregory Neil Shapirodnl temporary failure: call check sender (relay) 193540266059SGregory Neil ShapiroR$* $| T $+ $: T $2 $| $>"Relay_ok" $1 193640266059SGregory Neil Shapirodnl temporary failure? return that 193740266059SGregory Neil ShapiroR$* $| $#TEMP $+ $#error $2 193840266059SGregory Neil Shapirodnl error or ok (stop) 193940266059SGregory Neil ShapiroR$* $| $#$* $#$2 194040266059SGregory Neil ShapiroR$* $| RELAY $@ RELAY 194140266059SGregory Neil Shapirodnl something else: return previous temp failure 194240266059SGregory Neil ShapiroR T $+ $| $* $#error $1 194340266059SGregory Neil Shapiro# anything else is bogus 194440266059SGregory Neil ShapiroR$* $#error $@ 5.7.1 $: confRELAY_MSG 194540266059SGregory Neil Shapirodivert(0) 194640266059SGregory Neil Shapiro 194740266059SGregory Neil Shapiro###################################################################### 194840266059SGregory Neil Shapiro### Rcpt_ok: is the recipient ok? 194940266059SGregory Neil Shapirodnl input: recipient address (RCPT TO) 195040266059SGregory Neil Shapirodnl output: see explanation at call 195140266059SGregory Neil Shapiro###################################################################### 195240266059SGregory Neil ShapiroSRcpt_ok 1953c2aa98e2SPeter Wemmifdef(`_LOOSE_RELAY_CHECK_',`dnl 1954065a643dSPeter WemmR$* $: $>CanonAddr $1 1955c2aa98e2SPeter WemmR$* < @ $* . > $1 < @ $2 > strip trailing dots', 1956c2aa98e2SPeter Wemm`R$* $: $>ParseRecipient $1 strip relayable hosts') 1957c2aa98e2SPeter Wemm 1958065a643dSPeter Wemmifdef(`_BESTMX_IS_LOCAL_',`dnl 1959065a643dSPeter Wemmifelse(_BESTMX_IS_LOCAL_, `', `dnl 1960065a643dSPeter Wemm# unlimited bestmx 1961065a643dSPeter WemmR$* < @ $* > $* $: $1 < @ $2 @@ $(bestmx $2 $) > $3', 1962065a643dSPeter Wemm`dnl 1963065a643dSPeter Wemm# limit bestmx to $=B 19642e43090eSPeter WemmR$* < @ $* $=B > $* $: $1 < @ $2 $3 @@ $(bestmx $2 $3 $) > $4') 196540266059SGregory Neil ShapiroR$* $=O $* < @ $* @@ $=w . > $* $@ $>"Rcpt_ok" $1 $2 $3 1966065a643dSPeter WemmR$* < @ $* @@ $=w . > $* $: $1 < @ $3 > $4 1967065a643dSPeter WemmR$* < @ $* @@ $* > $* $: $1 < @ $2 > $4') 1968065a643dSPeter Wemm 1969c2aa98e2SPeter Wemmifdef(`_BLACKLIST_RCPT_',`dnl 197006f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 1971c2aa98e2SPeter Wemm# blacklist local users or any host from receiving mail 1972c2aa98e2SPeter WemmR$* $: <?> $1 197306f25ae9SGregory Neil Shapirodnl user is now tagged with @ to be consistent with check_mail 197406f25ae9SGregory Neil Shapirodnl and to distinguish users from hosts (com would be host, com@ would be user) 197540266059SGregory Neil ShapiroR<?> $+ < @ $=w > $: <> <$1 < @ $2 >> $| <F:$1@$2> <U:$1@> <D:$2> 197640266059SGregory Neil ShapiroR<?> $+ < @ $* > $: <> <$1 < @ $2 >> $| <F:$1@$2> <D:$2> 197706f25ae9SGregory Neil ShapiroR<?> $+ $: <> <$1> $| <U:$1@> 197806f25ae9SGregory Neil Shapirodnl $| is used as delimiter, otherwise false matches may occur: <user<@domain>> 197906f25ae9SGregory Neil Shapirodnl will only return user<@domain when "reversing" the args 198006f25ae9SGregory Neil ShapiroR<> <$*> $| <$+> $: <@> <$1> $| $>SearchList <+ To> $| <$2> <> 198106f25ae9SGregory Neil ShapiroR<@> <$*> $| <$*> $: <$2> <$1> reverse result 198206f25ae9SGregory Neil ShapiroR<?> <$*> $: @ $1 mark address as no match 198340266059SGregory Neil Shapirodnl we may have to filter here because otherwise some RHSs 198440266059SGregory Neil Shapirodnl would be interpreted as generic error messages... 198540266059SGregory Neil Shapirodnl error messages should be "tagged" by prefixing them with error: ! 198640266059SGregory Neil Shapirodnl that would make a lot of things easier. 198706f25ae9SGregory Neil ShapiroR<$={Accept}> <$*> $: @ $2 mark address as no match 198840266059SGregory Neil Shapiroifdef(`_ACCESS_SKIP_', `dnl 198940266059SGregory Neil ShapiroR<SKIP> <$*> $: @ $1 mark address as no match', `dnl') 199040266059SGregory Neil Shapiroifdef(`_DELAY_COMPAT_8_10_',`dnl 199140266059SGregory Neil Shapirodnl compatility with 8.11/8.10: 199206f25ae9SGregory Neil Shapirodnl we have to filter these because otherwise they would be interpreted 199306f25ae9SGregory Neil Shapirodnl as generic error message... 199406f25ae9SGregory Neil Shapirodnl error messages should be "tagged" by prefixing them with error: ! 199506f25ae9SGregory Neil Shapirodnl that would make a lot of things easier. 199606f25ae9SGregory Neil Shapirodnl maybe we should stop checks already here (if SPAM_xyx)? 199706f25ae9SGregory Neil ShapiroR<$={SpamTag}> <$*> $: @ $2 mark address as no match') 199840266059SGregory Neil ShapiroR<REJECT> $* $#error $@ 5.2.1 $: confRCPTREJ_MSG 199906f25ae9SGregory Neil ShapiroR<DISCARD> $* $#discard $: discard 200040266059SGregory Neil Shapiroifdef(`_FFR_QUARANTINE', 200140266059SGregory Neil Shapiro`R<QUARANTINE:$+> $* $#error $@ quarantine $: $1', `dnl') 200206f25ae9SGregory Neil Shapirodnl error tag 200306f25ae9SGregory Neil ShapiroR<ERROR:$-.$-.$-:$+> $* $#error $@ $1.$2.$3 $: $4 200406f25ae9SGregory Neil ShapiroR<ERROR:$+> $* $#error $: $1 200540266059SGregory Neil Shapiroifdef(`_ATMPF_', `R<_ATMPF_> $* $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 200606f25ae9SGregory Neil Shapirodnl generic error from access map 200706f25ae9SGregory Neil ShapiroR<$+> $* $#error $: $1 error from access db 200806f25ae9SGregory Neil ShapiroR@ $* $1 remove mark', `dnl')', `dnl') 2009c2aa98e2SPeter Wemm 201040266059SGregory Neil Shapiroifdef(`_PROMISCUOUS_RELAY_', `divert(-1)', `dnl') 201140266059SGregory Neil Shapiro# authenticated via TLS? 201240266059SGregory Neil ShapiroR$* $: $1 $| $>RelayTLS client authenticated? 201306f25ae9SGregory Neil ShapiroR$* $| $# $+ $# $2 error/ok? 201406f25ae9SGregory Neil ShapiroR$* $| $* $: $1 no 201506f25ae9SGregory Neil Shapiro 201640266059SGregory Neil ShapiroR$* $: $1 $| $>"Local_Relay_Auth" $&{auth_type} 201740266059SGregory Neil Shapirodnl workspace: localpart<@domain> $| result of Local_Relay_Auth 201840266059SGregory Neil ShapiroR$* $| $# $* $# $2 201940266059SGregory Neil Shapirodnl if Local_Relay_Auth returns NO then do not check $={TrustAuthMech} 202040266059SGregory Neil ShapiroR$* $| NO $: $1 202140266059SGregory Neil ShapiroR$* $| $* $: $1 $| $&{auth_type} 202240266059SGregory Neil Shapirodnl workspace: localpart<@domain> [ $| ${auth_type} ] 202306f25ae9SGregory Neil Shapirodnl empty ${auth_type}? 202406f25ae9SGregory Neil ShapiroR$* $| $: $1 202506f25ae9SGregory Neil Shapirodnl mechanism ${auth_type} accepted? 202606f25ae9SGregory Neil Shapirodnl use $# to override further tests (delay_checks): see check_rcpt below 202740266059SGregory Neil ShapiroR$* $| $={TrustAuthMech} $# RELAY 202840266059SGregory Neil Shapirodnl remove ${auth_type} 202906f25ae9SGregory Neil ShapiroR$* $| $* $: $1 2030193538b7SGregory Neil Shapirodnl workspace: localpart<@domain> | localpart 203106f25ae9SGregory Neil Shapiroifelse(defn(`_NO_UUCP_'), `r', 2032193538b7SGregory Neil Shapiro`R$* ! $* < @ $* > $: <REMOTE> $2 < @ BANG_PATH > 2033193538b7SGregory Neil ShapiroR$* ! $* $: <REMOTE> $2 < @ BANG_PATH >', `dnl') 2034c2aa98e2SPeter Wemm# anything terminating locally is ok 2035c2aa98e2SPeter Wemmifdef(`_RELAY_ENTIRE_DOMAIN_', `dnl 203640266059SGregory Neil ShapiroR$+ < @ $* $=m > $@ RELAY', `dnl') 203740266059SGregory Neil ShapiroR$+ < @ $=w > $@ RELAY 2038c2aa98e2SPeter Wemmifdef(`_RELAY_HOSTS_ONLY_', 203940266059SGregory Neil Shapiro`R$+ < @ $=R > $@ RELAY 204006f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 204106f25ae9SGregory Neil ShapiroR$+ < @ $+ > $: <$(access To:$2 $: ? $)> <$1 < @ $2 >> 204206f25ae9SGregory Neil Shapirodnl workspace: <Result-of-lookup | ?> <localpart<@domain>> 204306f25ae9SGregory Neil ShapiroR<?> <$+ < @ $+ >> $: <$(access $2 $: ? $)> <$1 < @ $2 >>',`dnl')', 204440266059SGregory Neil Shapiro`R$+ < @ $* $=R > $@ RELAY 204506f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 204640266059SGregory Neil ShapiroR$+ < @ $+ > $: $>D <$2> <?> <+ To> <$1 < @ $2 >>',`dnl')') 204706f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 204806f25ae9SGregory Neil Shapirodnl workspace: <Result-of-lookup | ?> <localpart<@domain>> 204940266059SGregory Neil ShapiroR<RELAY> $* $@ RELAY 205040266059SGregory Neil Shapiroifdef(`_ATMPF_', `R<$* _ATMPF_> $* $#TEMP $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 2051c2aa98e2SPeter WemmR<$*> <$*> $: $2',`dnl') 2052c2aa98e2SPeter Wemm 205306f25ae9SGregory Neil Shapiro 2054c2aa98e2SPeter Wemmifdef(`_RELAY_MX_SERVED_', `dnl 2055c2aa98e2SPeter Wemm# allow relaying for hosts which we MX serve 205606f25ae9SGregory Neil ShapiroR$+ < @ $+ > $: < : $(mxserved $2 $) : > $1 < @ $2 > 205706f25ae9SGregory Neil Shapirodnl this must not necessarily happen if the client is checked first... 205840266059SGregory Neil ShapiroR< : $* <TEMP> : > $* $#TEMP $@ 4.7.1 $: "450 Can not check MX records for recipient host " $1 205940266059SGregory Neil ShapiroR<$* : $=w . : $*> $* $@ RELAY 2060065a643dSPeter WemmR< : $* : > $* $: $2', 2061c2aa98e2SPeter Wemm`dnl') 2062c2aa98e2SPeter Wemm 2063c2aa98e2SPeter Wemm# check for local user (i.e. unqualified address) 2064c2aa98e2SPeter WemmR$* $: <?> $1 2065065a643dSPeter WemmR<?> $* < @ $+ > $: <REMOTE> $1 < @ $2 > 2066c2aa98e2SPeter Wemm# local user is ok 206706f25ae9SGregory Neil Shapirodnl is it really? the standard requires user@domain, not just user 206806f25ae9SGregory Neil Shapirodnl but we should accept it anyway (maybe making it an option: 206906f25ae9SGregory Neil Shapirodnl RequireFQDN ?) 207006f25ae9SGregory Neil Shapirodnl postmaster must be accepted without domain (DRUMS) 207106f25ae9SGregory Neil Shapiroifdef(`_REQUIRE_QUAL_RCPT_', `dnl 207240266059SGregory Neil ShapiroR<?> postmaster $@ OK 207306f25ae9SGregory Neil Shapiro# require qualified recipient? 207406f25ae9SGregory Neil Shapirodnl prepend daemon_flags 207506f25ae9SGregory Neil ShapiroR<?> $+ $: $&{daemon_flags} $| <?> $1 207606f25ae9SGregory Neil Shapirodnl workspace: ${daemon_flags} $| <?> localpart 207706f25ae9SGregory Neil Shapirodnl do not allow these at all or only from local systems? 207806f25ae9SGregory Neil Shapirodnl r flag? add client_name 207906f25ae9SGregory Neil ShapiroR$* r $* $| <?> $+ $: < ? $&{client_name} > <?> $3 208006f25ae9SGregory Neil Shapirodnl no r flag: relay to local user (only local part) 208106f25ae9SGregory Neil Shapiro# no qualified recipient required 208240266059SGregory Neil ShapiroR$* $| <?> $+ $@ RELAY 208306f25ae9SGregory Neil Shapirodnl client_name is empty 208440266059SGregory Neil ShapiroR<?> <?> $+ $@ RELAY 208506f25ae9SGregory Neil Shapirodnl client_name is local 208640266059SGregory Neil ShapiroR<? $=w> <?> $+ $@ RELAY 208706f25ae9SGregory Neil Shapirodnl client_name is not local 208806f25ae9SGregory Neil ShapiroR<? $+> $+ $#error $@ 5.5.4 $: "553 Domain name required"', `dnl 208906f25ae9SGregory Neil Shapirodnl no qualified recipient required 209040266059SGregory Neil ShapiroR<?> $+ $@ RELAY') 209106f25ae9SGregory Neil Shapirodnl it is a remote user: remove mark and then check client 2092c2aa98e2SPeter WemmR<$+> $* $: $2 209306f25ae9SGregory Neil Shapirodnl currently the recipient address is not used below 2094c2aa98e2SPeter Wemm 209540266059SGregory Neil Shapiro###################################################################### 209640266059SGregory Neil Shapiro### Relay_ok: is the relay/sender ok? 209740266059SGregory Neil Shapirodnl input: ignored 209840266059SGregory Neil Shapirodnl output: see explanation at call 209940266059SGregory Neil Shapiro###################################################################### 210040266059SGregory Neil ShapiroSRelay_ok 2101c2aa98e2SPeter Wemm# anything originating locally is ok 2102c2aa98e2SPeter Wemm# check IP address 2103c2aa98e2SPeter WemmR$* $: $&{client_addr} 210440266059SGregory Neil ShapiroR$@ $@ RELAY originated locally 210540266059SGregory Neil ShapiroR0 $@ RELAY originated locally 210613bd1963SGregory Neil ShapiroR127.0.0.1 $@ RELAY originated locally 210713bd1963SGregory Neil ShapiroRIPv6:::1 $@ RELAY originated locally 210840266059SGregory Neil ShapiroR$=R $* $@ RELAY relayable IP address 210906f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 211040266059SGregory Neil ShapiroR$* $: $>A <$1> <?> <+ Connect> <$1> 211140266059SGregory Neil ShapiroR<RELAY> $* $@ RELAY relayable IP address 2112959366dcSGregory Neil Shapiroifdef(`_FFR_REJECT_IP_IN_CHECK_RCPT_',`dnl 2113959366dcSGregory Neil Shapirodnl this will cause rejections in cases like: 2114959366dcSGregory Neil Shapirodnl Connect:My.Host.Domain RELAY 2115959366dcSGregory Neil Shapirodnl Connect:My.Net REJECT 2116959366dcSGregory Neil Shapirodnl since in check_relay client_name is checked before client_addr 2117959366dcSGregory Neil ShapiroR<REJECT> $* $@ REJECT rejected IP address') 211840266059SGregory Neil Shapiroifdef(`_ATMPF_', `R<_ATMPF_> $* $#TEMP $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 2119c2aa98e2SPeter WemmR<$*> <$*> $: $2', `dnl') 2120c2aa98e2SPeter WemmR$* $: [ $1 ] put brackets around it... 212140266059SGregory Neil ShapiroR$=w $@ RELAY ... and see if it is local 2122c2aa98e2SPeter Wemm 212306f25ae9SGregory Neil Shapiroifdef(`_RELAY_DB_FROM_', `define(`_RELAY_MAIL_FROM_', `1')')dnl 212406f25ae9SGregory Neil Shapiroifdef(`_RELAY_LOCAL_FROM_', `define(`_RELAY_MAIL_FROM_', `1')')dnl 212506f25ae9SGregory Neil Shapiroifdef(`_RELAY_MAIL_FROM_', `dnl 212606f25ae9SGregory Neil Shapirodnl input: {client_addr} or something "broken" 212706f25ae9SGregory Neil Shapirodnl just throw the input away; we do not need it. 212806f25ae9SGregory Neil Shapiro# check whether FROM is allowed to use system as relay 212906f25ae9SGregory Neil ShapiroR$* $: <?> $>CanonAddr $&f 213040266059SGregory Neil ShapiroR<?> $+ < @ $+ . > <?> $1 < @ $2 > remove trailing dot 2131c2aa98e2SPeter Wemmifdef(`_RELAY_LOCAL_FROM_', `dnl 213206f25ae9SGregory Neil Shapiro# check whether local FROM is ok 213340266059SGregory Neil ShapiroR<?> $+ < @ $=w > $@ RELAY FROM local', `dnl') 213406f25ae9SGregory Neil Shapiroifdef(`_RELAY_DB_FROM_', `dnl 2135605302a5SGregory Neil ShapiroR<?> $+ < @ $+ > $: <@> $>SearchList <! From> $| <F:$1@$2> ifdef(`_RELAY_DB_FROM_DOMAIN_', ifdef(`_RELAY_HOSTS_ONLY_', `<E:$2>', `<D:$2>')) <> 213640266059SGregory Neil ShapiroR<@> <RELAY> $@ RELAY RELAY FROM sender ok 213740266059SGregory Neil Shapiroifdef(`_ATMPF_', `R<@> <_ATMPF_> $#TEMP $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 213840266059SGregory Neil Shapiro', `dnl 213940266059SGregory Neil Shapiroifdef(`_RELAY_DB_FROM_DOMAIN_', 214040266059SGregory Neil Shapiro`errprint(`*** ERROR: _RELAY_DB_FROM_DOMAIN_ requires _RELAY_DB_FROM_ 214106f25ae9SGregory Neil Shapiro')', 214206f25ae9SGregory Neil Shapiro`dnl') 214306f25ae9SGregory Neil Shapirodnl')', `dnl') 214440266059SGregory Neil Shapirodnl notice: the rulesets above do not leave a unique workspace behind. 214540266059SGregory Neil Shapirodnl it does not matter in this case because the following rule ignores 214640266059SGregory Neil Shapirodnl the input. otherwise these rules must "clean up" the workspace. 214706f25ae9SGregory Neil Shapiro 214806f25ae9SGregory Neil Shapiro# check client name: first: did it resolve? 214906f25ae9SGregory Neil Shapirodnl input: ignored 215006f25ae9SGregory Neil ShapiroR$* $: < $&{client_resolve} > 215140266059SGregory Neil ShapiroR<TEMP> $#TEMP $@ 4.7.1 $: "450 Relaying temporarily denied. Cannot resolve PTR record for " $&{client_addr} 215206f25ae9SGregory Neil ShapiroR<FORGED> $#error $@ 5.7.1 $: "550 Relaying denied. IP name possibly forged " $&{client_name} 215306f25ae9SGregory Neil ShapiroR<FAIL> $#error $@ 5.7.1 $: "550 Relaying denied. IP name lookup failed " $&{client_name} 215406f25ae9SGregory Neil Shapirodnl ${client_resolve} should be OK, so go ahead 215540266059SGregory Neil ShapiroR$* $: <@> $&{client_name} 215606f25ae9SGregory Neil Shapirodnl should not be necessary since it has been done for client_addr already 215713bd1963SGregory Neil Shapirodnl this rule actually may cause a problem if {client_name} resolves to "" 215813bd1963SGregory Neil Shapirodnl however, this should not happen since the forward lookup should fail 215913bd1963SGregory Neil Shapirodnl and {client_resolve} should be TEMP or FAIL. 216013bd1963SGregory Neil Shapirodnl nevertheless, removing the rule doesn't hurt. 216113bd1963SGregory Neil Shapirodnl R<@> $@ RELAY 216240266059SGregory Neil Shapirodnl workspace: <@> ${client_name} (not empty) 216340266059SGregory Neil Shapiro# pass to name server to make hostname canonical 216440266059SGregory Neil ShapiroR<@> $* $=P $:<?> $1 $2 216540266059SGregory Neil ShapiroR<@> $+ $:<?> $[ $1 $] 216640266059SGregory Neil Shapirodnl workspace: <?> ${client_name} (canonified) 216740266059SGregory Neil ShapiroR$* . $1 strip trailing dots 216806f25ae9SGregory Neil Shapiroifdef(`_RELAY_ENTIRE_DOMAIN_', `dnl 216940266059SGregory Neil ShapiroR<?> $* $=m $@ RELAY', `dnl') 217040266059SGregory Neil ShapiroR<?> $=w $@ RELAY 217106f25ae9SGregory Neil Shapiroifdef(`_RELAY_HOSTS_ONLY_', 217240266059SGregory Neil Shapiro`R<?> $=R $@ RELAY 217306f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 217406f25ae9SGregory Neil ShapiroR<?> $* $: <$(access Connect:$1 $: ? $)> <$1> 217506f25ae9SGregory Neil ShapiroR<?> <$*> $: <$(access $1 $: ? $)> <$1>',`dnl')', 217640266059SGregory Neil Shapiro`R<?> $* $=R $@ RELAY 217706f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 217840266059SGregory Neil ShapiroR<?> $* $: $>D <$1> <?> <+ Connect> <$1>',`dnl')') 217906f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 218040266059SGregory Neil ShapiroR<RELAY> $* $@ RELAY 218140266059SGregory Neil Shapiroifdef(`_ATMPF_', `R<$* _ATMPF_> $* $#TEMP $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 218206f25ae9SGregory Neil ShapiroR<$*> <$*> $: $2',`dnl') 218340266059SGregory Neil Shapirodnl end of _PROMISCUOUS_RELAY_ 218406f25ae9SGregory Neil Shapirodivert(0) 218506f25ae9SGregory Neil Shapiroifdef(`_DELAY_CHECKS_',`dnl 218606f25ae9SGregory Neil Shapiro# turn a canonical address in the form user<@domain> 218706f25ae9SGregory Neil Shapiro# qualify unqual. addresses with $j 218806f25ae9SGregory Neil Shapirodnl it might have been only user (without <@domain>) 218906f25ae9SGregory Neil ShapiroSFullAddr 219006f25ae9SGregory Neil ShapiroR$* <@ $+ . > $1 <@ $2 > 219106f25ae9SGregory Neil ShapiroR$* <@ $* > $@ $1 <@ $2 > 219206f25ae9SGregory Neil ShapiroR$+ $@ $1 <@ $j > 2193c2aa98e2SPeter Wemm 219413bd1963SGregory Neil ShapiroSDelay_TLS_Client 219513bd1963SGregory Neil Shapiro# authenticated? 219613bd1963SGregory Neil Shapirodnl code repeated here from Basic_check_mail 219713bd1963SGregory Neil Shapirodnl only called from check_rcpt in delay mode if checkrcpt returns $# 219813bd1963SGregory Neil ShapiroR$* $: $1 $| $>"tls_client" $&{verify} $| MAIL 219913bd1963SGregory Neil ShapiroR$* $| $#$+ $#$2 220013bd1963SGregory Neil Shapirodnl return result from checkrcpt 220113bd1963SGregory Neil ShapiroR$* $# $1 220213bd1963SGregory Neil Shapiro 220313bd1963SGregory Neil ShapiroSDelay_TLS_Client2 220413bd1963SGregory Neil Shapiro# authenticated? 220513bd1963SGregory Neil Shapirodnl code repeated here from Basic_check_mail 220613bd1963SGregory Neil Shapirodnl only called from check_rcpt in delay mode if stopping due to Friend/Hater 220713bd1963SGregory Neil ShapiroR$* $: $1 $| $>"tls_client" $&{verify} $| MAIL 220813bd1963SGregory Neil ShapiroR$* $| $#$+ $#$2 220913bd1963SGregory Neil Shapirodnl return result from friend/hater check 221013bd1963SGregory Neil ShapiroR$* $@ $1 221113bd1963SGregory Neil Shapiro 221206f25ae9SGregory Neil Shapiro# call all necessary rulesets 221306f25ae9SGregory Neil ShapiroScheck_rcpt 221406f25ae9SGregory Neil Shapirodnl this test should be in the Basic_check_rcpt ruleset 221506f25ae9SGregory Neil Shapirodnl which is the correct DSN code? 221606f25ae9SGregory Neil Shapiro# R$@ $#error $@ 5.1.3 $: "553 Recipient address required" 221713bd1963SGregory Neil Shapiro 221806f25ae9SGregory Neil ShapiroR$+ $: $1 $| $>checkrcpt $1 221906f25ae9SGregory Neil Shapirodnl now we can simply stop checks by returning "$# xyz" instead of just "ok" 222013bd1963SGregory Neil Shapirodnl on error (or discard) stop now 222113bd1963SGregory Neil ShapiroR$+ $| $#error $* $#error $2 222213bd1963SGregory Neil ShapiroR$+ $| $#discard $* $#discard $2 222313bd1963SGregory Neil Shapirodnl otherwise call tls_client; see above 222413bd1963SGregory Neil ShapiroR$+ $| $#$* $@ $>"Delay_TLS_Client" $2 222506f25ae9SGregory Neil ShapiroR$+ $| $* $: <?> $>FullAddr $>CanonAddr $1 222606f25ae9SGregory Neil Shapiroifdef(`_SPAM_FH_', 222706f25ae9SGregory Neil Shapiro`dnl lookup user@ and user@address 222806f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `', 222906f25ae9SGregory Neil Shapiro`errprint(`*** ERROR: FEATURE(`delay_checks', `argument') requires FEATURE(`access_db') 223006f25ae9SGregory Neil Shapiro')')dnl 223106f25ae9SGregory Neil Shapirodnl one of the next two rules is supposed to match 223206f25ae9SGregory Neil Shapirodnl this code has been copied from BLACKLIST... etc 223306f25ae9SGregory Neil Shapirodnl and simplified by omitting some < >. 223440266059SGregory Neil ShapiroR<?> $+ < @ $=w > $: <> $1 < @ $2 > $| <F: $1@$2 > <D: $2 > <U: $1@> 223540266059SGregory Neil ShapiroR<?> $+ < @ $* > $: <> $1 < @ $2 > $| <F: $1@$2 > <D: $2 > 223606f25ae9SGregory Neil Shapirodnl R<?> $@ something_is_very_wrong_here 223740266059SGregory Neil Shapiro# lookup the addresses only with Spam tag 223840266059SGregory Neil ShapiroR<> $* $| <$+> $: <@> $1 $| $>SearchList <! Spam> $| <$2> <> 223906f25ae9SGregory Neil ShapiroR<@> $* $| $* $: $2 $1 reverse result 224006f25ae9SGregory Neil Shapirodnl', `dnl') 224106f25ae9SGregory Neil Shapiroifdef(`_SPAM_FRIEND_', 224206f25ae9SGregory Neil Shapiro`# is the recipient a spam friend? 224306f25ae9SGregory Neil Shapiroifdef(`_SPAM_HATER_', 224413bd1963SGregory Neil Shapiro `errprint(`*** ERROR: define either Hater or Friend -- not both. 224506f25ae9SGregory Neil Shapiro')', `dnl') 224613bd1963SGregory Neil ShapiroR<FRIEND> $+ $@ $>"Delay_TLS_Client2" SPAMFRIEND 224706f25ae9SGregory Neil ShapiroR<$*> $+ $: $2', 224806f25ae9SGregory Neil Shapiro`dnl') 224906f25ae9SGregory Neil Shapiroifdef(`_SPAM_HATER_', 225006f25ae9SGregory Neil Shapiro`# is the recipient no spam hater? 225140266059SGregory Neil ShapiroR<HATER> $+ $: $1 spam hater: continue checks 225213bd1963SGregory Neil ShapiroR<$*> $+ $@ $>"Delay_TLS_Client2" NOSPAMHATER everyone else: stop 225306f25ae9SGregory Neil Shapirodnl',`dnl') 225406f25ae9SGregory Neil Shapirodnl run further checks: check_mail 225506f25ae9SGregory Neil Shapirodnl should we "clean up" $&f? 225640266059SGregory Neil Shapiroifdef(`_FFR_MAIL_MACRO', 225740266059SGregory Neil Shapiro`R$* $: $1 $| $>checkmail $&{mail_from}', 225840266059SGregory Neil Shapiro`R$* $: $1 $| $>checkmail <$&f>') 2259605302a5SGregory Neil Shapirodnl recipient (canonical format) $| result of checkmail 226006f25ae9SGregory Neil ShapiroR$* $| $#$* $#$2 226106f25ae9SGregory Neil Shapirodnl run further checks: check_relay 2262605302a5SGregory Neil ShapiroR$* $| $* $: $1 $| $>checkrelay $&{client_name} $| $&{client_addr} 226306f25ae9SGregory Neil ShapiroR$* $| $#$* $#$2 226406f25ae9SGregory Neil ShapiroR$* $| $* $: $1 226506f25ae9SGregory Neil Shapiro', `dnl') 226640266059SGregory Neil Shapiro 226740266059SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl', `divert(-1)') 226840266059SGregory Neil Shapiro###################################################################### 226940266059SGregory Neil Shapiro### F: LookUpFull -- search for an entry in access database 227040266059SGregory Neil Shapiro### 227140266059SGregory Neil Shapiro### lookup of full key (which should be an address) and 227240266059SGregory Neil Shapiro### variations if +detail exists: +* and without +detail 227340266059SGregory Neil Shapiro### 227440266059SGregory Neil Shapiro### Parameters: 227540266059SGregory Neil Shapiro### <$1> -- key 227640266059SGregory Neil Shapiro### <$2> -- default (what to return if not found in db) 227740266059SGregory Neil Shapirodnl must not be empty 227840266059SGregory Neil Shapiro### <$3> -- mark (must be <(!|+) single-token>) 227940266059SGregory Neil Shapiro### ! does lookup only with tag 228040266059SGregory Neil Shapiro### + does lookup with and without tag 228140266059SGregory Neil Shapiro### <$4> -- passthru (additional data passed unchanged through) 228240266059SGregory Neil Shapirodnl returns: <default> <passthru> 228340266059SGregory Neil Shapirodnl <result> <passthru> 228440266059SGregory Neil Shapiro###################################################################### 228540266059SGregory Neil Shapiro 228640266059SGregory Neil ShapiroSF 228740266059SGregory Neil Shapirodnl workspace: <key> <def> <o tag> <thru> 228840266059SGregory Neil Shapirodnl full lookup 228940266059SGregory Neil Shapirodnl 2 3 4 5 229040266059SGregory Neil ShapiroR<$+> <$*> <$- $-> <$*> $: <$(access $4`'_TAG_DELIM_`'$1 $: ? $)> <$1> <$2> <$3 $4> <$5> 229140266059SGregory Neil Shapirodnl no match, try without tag 229240266059SGregory Neil Shapirodnl 1 2 3 4 229340266059SGregory Neil ShapiroR<?> <$+> <$*> <+ $-> <$*> $: <$(access $1 $: ? $)> <$1> <$2> <+ $3> <$4> 229440266059SGregory Neil Shapirodnl no match, +detail: try +* 229540266059SGregory Neil Shapirodnl 1 2 3 4 5 6 7 229640266059SGregory Neil ShapiroR<?> <$+ + $* @ $+> <$*> <$- $-> <$*> 229740266059SGregory Neil Shapiro $: <$(access $6`'_TAG_DELIM_`'$1+*@$3 $: ? $)> <$1+$2@$3> <$4> <$5 $6> <$7> 229840266059SGregory Neil Shapirodnl no match, +detail: try +* without tag 229940266059SGregory Neil Shapirodnl 1 2 3 4 5 6 230040266059SGregory Neil ShapiroR<?> <$+ + $* @ $+> <$*> <+ $-> <$*> 230140266059SGregory Neil Shapiro $: <$(access $1+*@$3 $: ? $)> <$1+$2@$3> <$4> <+ $5> <$6> 230240266059SGregory Neil Shapirodnl no match, +detail: try without +detail 230340266059SGregory Neil Shapirodnl 1 2 3 4 5 6 7 230440266059SGregory Neil ShapiroR<?> <$+ + $* @ $+> <$*> <$- $-> <$*> 230540266059SGregory Neil Shapiro $: <$(access $6`'_TAG_DELIM_`'$1@$3 $: ? $)> <$1+$2@$3> <$4> <$5 $6> <$7> 230640266059SGregory Neil Shapirodnl no match, +detail: try without +detail and without tag 230740266059SGregory Neil Shapirodnl 1 2 3 4 5 6 230840266059SGregory Neil ShapiroR<?> <$+ + $* @ $+> <$*> <+ $-> <$*> 230940266059SGregory Neil Shapiro $: <$(access $1@$3 $: ? $)> <$1+$2@$3> <$4> <+ $5> <$6> 231040266059SGregory Neil Shapirodnl no match, return <default> <passthru> 231140266059SGregory Neil Shapirodnl 1 2 3 4 5 231240266059SGregory Neil ShapiroR<?> <$+> <$*> <$- $-> <$*> $@ <$2> <$5> 231340266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 231440266059SGregory Neil Shapirodnl 2 3 4 5 231540266059SGregory Neil ShapiroR<$+ _ATMPF_> <$*> <$- $-> <$*> $@ <_ATMPF_> <$5>', `dnl') 231640266059SGregory Neil Shapirodnl match, return <match> <passthru> 231740266059SGregory Neil Shapirodnl 2 3 4 5 231840266059SGregory Neil ShapiroR<$+> <$*> <$- $-> <$*> $@ <$1> <$5> 231940266059SGregory Neil Shapiro 232040266059SGregory Neil Shapiro###################################################################### 232140266059SGregory Neil Shapiro### E: LookUpExact -- search for an entry in access database 232240266059SGregory Neil Shapiro### 232340266059SGregory Neil Shapiro### Parameters: 232440266059SGregory Neil Shapiro### <$1> -- key 232540266059SGregory Neil Shapiro### <$2> -- default (what to return if not found in db) 232640266059SGregory Neil Shapirodnl must not be empty 232740266059SGregory Neil Shapiro### <$3> -- mark (must be <(!|+) single-token>) 232840266059SGregory Neil Shapiro### ! does lookup only with tag 232940266059SGregory Neil Shapiro### + does lookup with and without tag 233040266059SGregory Neil Shapiro### <$4> -- passthru (additional data passed unchanged through) 233140266059SGregory Neil Shapirodnl returns: <default> <passthru> 233240266059SGregory Neil Shapirodnl <result> <passthru> 233340266059SGregory Neil Shapiro###################################################################### 233440266059SGregory Neil Shapiro 233540266059SGregory Neil ShapiroSE 233640266059SGregory Neil Shapirodnl 2 3 4 5 233740266059SGregory Neil ShapiroR<$*> <$*> <$- $-> <$*> $: <$(access $4`'_TAG_DELIM_`'$1 $: ? $)> <$1> <$2> <$3 $4> <$5> 233840266059SGregory Neil Shapirodnl no match, try without tag 233940266059SGregory Neil Shapirodnl 1 2 3 4 234040266059SGregory Neil ShapiroR<?> <$+> <$*> <+ $-> <$*> $: <$(access $1 $: ? $)> <$1> <$2> <+ $3> <$4> 234140266059SGregory Neil Shapirodnl no match, return default passthru 234240266059SGregory Neil Shapirodnl 1 2 3 4 5 234340266059SGregory Neil ShapiroR<?> <$+> <$*> <$- $-> <$*> $@ <$2> <$5> 234440266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 234540266059SGregory Neil Shapirodnl 2 3 4 5 234640266059SGregory Neil ShapiroR<$+ _ATMPF_> <$*> <$- $-> <$*> $@ <_ATMPF_> <$5>', `dnl') 234740266059SGregory Neil Shapirodnl match, return <match> <passthru> 234840266059SGregory Neil Shapirodnl 2 3 4 5 234940266059SGregory Neil ShapiroR<$+> <$*> <$- $-> <$*> $@ <$1> <$5> 235040266059SGregory Neil Shapiro 235140266059SGregory Neil Shapiro###################################################################### 235240266059SGregory Neil Shapiro### U: LookUpUser -- search for an entry in access database 235340266059SGregory Neil Shapiro### 235440266059SGregory Neil Shapiro### lookup of key (which should be a local part) and 235540266059SGregory Neil Shapiro### variations if +detail exists: +* and without +detail 235640266059SGregory Neil Shapiro### 235740266059SGregory Neil Shapiro### Parameters: 235840266059SGregory Neil Shapiro### <$1> -- key (user@) 235940266059SGregory Neil Shapiro### <$2> -- default (what to return if not found in db) 236040266059SGregory Neil Shapirodnl must not be empty 236140266059SGregory Neil Shapiro### <$3> -- mark (must be <(!|+) single-token>) 236240266059SGregory Neil Shapiro### ! does lookup only with tag 236340266059SGregory Neil Shapiro### + does lookup with and without tag 236440266059SGregory Neil Shapiro### <$4> -- passthru (additional data passed unchanged through) 236540266059SGregory Neil Shapirodnl returns: <default> <passthru> 236640266059SGregory Neil Shapirodnl <result> <passthru> 236740266059SGregory Neil Shapiro###################################################################### 236840266059SGregory Neil Shapiro 236940266059SGregory Neil ShapiroSU 237040266059SGregory Neil Shapirodnl user lookups are always with trailing @ 237140266059SGregory Neil Shapirodnl 2 3 4 5 237240266059SGregory Neil ShapiroR<$+> <$*> <$- $-> <$*> $: <$(access $4`'_TAG_DELIM_`'$1 $: ? $)> <$1> <$2> <$3 $4> <$5> 237340266059SGregory Neil Shapirodnl no match, try without tag 237440266059SGregory Neil Shapirodnl 1 2 3 4 237540266059SGregory Neil ShapiroR<?> <$+> <$*> <+ $-> <$*> $: <$(access $1 $: ? $)> <$1> <$2> <+ $3> <$4> 237640266059SGregory Neil Shapirodnl do not remove the @ from the lookup: 237740266059SGregory Neil Shapirodnl it is part of the +detail@ which is omitted for the lookup 237840266059SGregory Neil Shapirodnl no match, +detail: try +* 237940266059SGregory Neil Shapirodnl 1 2 3 4 5 6 238040266059SGregory Neil ShapiroR<?> <$+ + $* @> <$*> <$- $-> <$*> 238140266059SGregory Neil Shapiro $: <$(access $5`'_TAG_DELIM_`'$1+*@ $: ? $)> <$1+$2@> <$3> <$4 $5> <$6> 238240266059SGregory Neil Shapirodnl no match, +detail: try +* without tag 238340266059SGregory Neil Shapirodnl 1 2 3 4 5 238440266059SGregory Neil ShapiroR<?> <$+ + $* @> <$*> <+ $-> <$*> 238540266059SGregory Neil Shapiro $: <$(access $1+*@ $: ? $)> <$1+$2@> <$3> <+ $4> <$5> 238640266059SGregory Neil Shapirodnl no match, +detail: try without +detail 238740266059SGregory Neil Shapirodnl 1 2 3 4 5 6 238840266059SGregory Neil ShapiroR<?> <$+ + $* @> <$*> <$- $-> <$*> 238940266059SGregory Neil Shapiro $: <$(access $5`'_TAG_DELIM_`'$1@ $: ? $)> <$1+$2@> <$3> <$4 $5> <$6> 239040266059SGregory Neil Shapirodnl no match, +detail: try without +detail and without tag 239140266059SGregory Neil Shapirodnl 1 2 3 4 5 239240266059SGregory Neil ShapiroR<?> <$+ + $* @> <$*> <+ $-> <$*> 239340266059SGregory Neil Shapiro $: <$(access $1@ $: ? $)> <$1+$2@> <$3> <+ $4> <$5> 239440266059SGregory Neil Shapirodnl no match, return <default> <passthru> 239540266059SGregory Neil Shapirodnl 1 2 3 4 5 239640266059SGregory Neil ShapiroR<?> <$+> <$*> <$- $-> <$*> $@ <$2> <$5> 239740266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 239840266059SGregory Neil Shapirodnl 2 3 4 5 239940266059SGregory Neil ShapiroR<$+ _ATMPF_> <$*> <$- $-> <$*> $@ <_ATMPF_> <$5>', `dnl') 240040266059SGregory Neil Shapirodnl match, return <match> <passthru> 240140266059SGregory Neil Shapirodnl 2 3 4 5 240240266059SGregory Neil ShapiroR<$+> <$*> <$- $-> <$*> $@ <$1> <$5> 240340266059SGregory Neil Shapiro 240406f25ae9SGregory Neil Shapiro###################################################################### 240506f25ae9SGregory Neil Shapiro### SearchList: search a list of items in the access map 240606f25ae9SGregory Neil Shapiro### Parameters: 240706f25ae9SGregory Neil Shapiro### <exact tag> $| <mark:address> <mark:address> ... <> 240806f25ae9SGregory Neil Shapirodnl maybe we should have a @ (again) in front of the mark to 240906f25ae9SGregory Neil Shapirodnl avoid errorneous matches (with error messages?) 241006f25ae9SGregory Neil Shapirodnl if we can make sure that tag is always a single token 241106f25ae9SGregory Neil Shapirodnl then we can omit the delimiter $|, otherwise we need it 241240266059SGregory Neil Shapirodnl to avoid errorneous matchs (first rule: D: if there 241306f25ae9SGregory Neil Shapirodnl is that mark somewhere in the list, it will be taken). 241406f25ae9SGregory Neil Shapirodnl moreover, we can do some tricks to enforce lookup with 241506f25ae9SGregory Neil Shapirodnl the tag only, e.g.: 241606f25ae9SGregory Neil Shapiro### where "exact" is either "+" or "!": 241706f25ae9SGregory Neil Shapiro### <+ TAG> lookup with and w/o tag 241806f25ae9SGregory Neil Shapiro### <! TAG> lookup with tag 241906f25ae9SGregory Neil Shapirodnl Warning: + and ! should be in OperatorChars (otherwise there must be 242006f25ae9SGregory Neil Shapirodnl a blank between them and the tag. 242106f25ae9SGregory Neil Shapiro### possible values for "mark" are: 242240266059SGregory Neil Shapiro### D: recursive host lookup (LookUpDomain) 242306f25ae9SGregory Neil Shapirodnl A: recursive address lookup (LookUpAddress) [not yet required] 242406f25ae9SGregory Neil Shapiro### E: exact lookup, no modifications 242506f25ae9SGregory Neil Shapiro### F: full lookup, try user+ext@domain and user@domain 242606f25ae9SGregory Neil Shapiro### U: user lookup, try user+ext and user (input must have trailing @) 242706f25ae9SGregory Neil Shapiro### return: <RHS of lookup> or <?> (not found) 242806f25ae9SGregory Neil Shapiro###################################################################### 242906f25ae9SGregory Neil Shapiro 243006f25ae9SGregory Neil Shapiro# class with valid marks for SearchList 243106f25ae9SGregory Neil Shapirodnl if A is activated: add it 243240266059SGregory Neil ShapiroC{src}E F D U ifdef(`_FFR_SRCHLIST_A', `A') 243306f25ae9SGregory Neil ShapiroSSearchList 243440266059SGregory Neil Shapiro# just call the ruleset with the name of the tag... nice trick... 243540266059SGregory Neil Shapirodnl 2 3 4 243640266059SGregory Neil ShapiroR<$+> $| <$={src}:$*> <$*> $: <$1> $| <$4> $| $>$2 <$3> <?> <$1> <> 243740266059SGregory Neil Shapirodnl workspace: <o tag> $| <rest> $| <result of lookup> <> 243840266059SGregory Neil Shapirodnl no match and nothing left: return 243940266059SGregory Neil ShapiroR<$+> $| <> $| <?> <> $@ <?> 244040266059SGregory Neil Shapirodnl no match but something left: continue 244140266059SGregory Neil ShapiroR<$+> $| <$+> $| <?> <> $@ $>SearchList <$1> $| <$2> 244240266059SGregory Neil Shapirodnl match: return 244340266059SGregory Neil ShapiroR<$+> $| <$*> $| <$+> <> $@ <$3> 244406f25ae9SGregory Neil Shapirodnl return result from recursive invocation 244540266059SGregory Neil ShapiroR<$+> $| <$+> $@ <$2> 244640266059SGregory Neil Shapirodnl endif _ACCESS_TABLE_ 244740266059SGregory Neil Shapirodivert(0) 244806f25ae9SGregory Neil Shapiro 244940266059SGregory Neil Shapiro###################################################################### 245040266059SGregory Neil Shapiro### trust_auth: is user trusted to authenticate as someone else? 245140266059SGregory Neil Shapiro### 245240266059SGregory Neil Shapiro### Parameters: 245340266059SGregory Neil Shapiro### $1: AUTH= parameter from MAIL command 245440266059SGregory Neil Shapiro###################################################################### 245540266059SGregory Neil Shapiro 245640266059SGregory Neil Shapirodnl empty ruleset definition so it can be called 245740266059SGregory Neil ShapiroSLocal_trust_auth 245806f25ae9SGregory Neil ShapiroStrust_auth 245906f25ae9SGregory Neil ShapiroR$* $: $&{auth_type} $| $1 246006f25ae9SGregory Neil Shapiro# required by RFC 2554 section 4. 246106f25ae9SGregory Neil ShapiroR$@ $| $* $#error $@ 5.7.1 $: "550 not authenticated" 246206f25ae9SGregory Neil Shapirodnl seems to be useful... 246306f25ae9SGregory Neil ShapiroR$* $| $&{auth_authen} $@ identical 246406f25ae9SGregory Neil ShapiroR$* $| <$&{auth_authen}> $@ identical 246506f25ae9SGregory Neil Shapirodnl call user supplied code 246606f25ae9SGregory Neil ShapiroR$* $| $* $: $1 $| $>"Local_trust_auth" $1 246706f25ae9SGregory Neil ShapiroR$* $| $#$* $#$2 246806f25ae9SGregory Neil Shapirodnl default: error 246906f25ae9SGregory Neil ShapiroR$* $#error $@ 5.7.1 $: "550 " $&{auth_authen} " not allowed to act as " $&{auth_author} 247006f25ae9SGregory Neil Shapiro 247140266059SGregory Neil Shapiro###################################################################### 247240266059SGregory Neil Shapiro### Relay_Auth: allow relaying based on authentication? 247340266059SGregory Neil Shapiro### 247440266059SGregory Neil Shapiro### Parameters: 247540266059SGregory Neil Shapiro### $1: ${auth_type} 247640266059SGregory Neil Shapiro###################################################################### 247740266059SGregory Neil ShapiroSLocal_Relay_Auth 247806f25ae9SGregory Neil Shapiro 247940266059SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 248040266059SGregory Neil Shapiro###################################################################### 248140266059SGregory Neil Shapiro### srv_features: which features to offer to a client? 248240266059SGregory Neil Shapiro### (done in server) 248340266059SGregory Neil Shapiro###################################################################### 248440266059SGregory Neil ShapiroSsrv_features 248540266059SGregory Neil Shapiroifdef(`_LOCAL_SRV_FEATURES_', `dnl 248640266059SGregory Neil ShapiroR$* $: $1 $| $>"Local_srv_features" $1 248740266059SGregory Neil ShapiroR$* $| $#$* $#$2 248840266059SGregory Neil ShapiroR$* $| $* $: $1', `dnl') 248940266059SGregory Neil ShapiroR$* $: $>D <$&{client_name}> <?> <! SRV_FEAT_TAG> <> 249040266059SGregory Neil ShapiroR<?>$* $: $>A <$&{client_addr}> <?> <! SRV_FEAT_TAG> <> 249140266059SGregory Neil ShapiroR<?>$* $: <$(access SRV_FEAT_TAG`'_TAG_DELIM_ $: ? $)> 249206f25ae9SGregory Neil ShapiroR<?>$* $@ OK 249340266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 249440266059SGregory Neil ShapiroR<$* _ATMPF_>$* $#temp', `dnl') 249540266059SGregory Neil ShapiroR<$+>$* $# $1 249606f25ae9SGregory Neil Shapiro 249740266059SGregory Neil Shapiro###################################################################### 249840266059SGregory Neil Shapiro### try_tls: try to use STARTTLS? 249940266059SGregory Neil Shapiro### (done in client) 250040266059SGregory Neil Shapiro###################################################################### 250106f25ae9SGregory Neil ShapiroStry_tls 250240266059SGregory Neil Shapiroifdef(`_LOCAL_TRY_TLS_', `dnl 250340266059SGregory Neil ShapiroR$* $: $1 $| $>"Local_try_tls" $1 250440266059SGregory Neil ShapiroR$* $| $#$* $#$2 250540266059SGregory Neil ShapiroR$* $| $* $: $1', `dnl') 250640266059SGregory Neil ShapiroR$* $: $>D <$&{server_name}> <?> <! TLS_TRY_TAG> <> 250740266059SGregory Neil ShapiroR<?>$* $: $>A <$&{server_addr}> <?> <! TLS_TRY_TAG> <> 250840266059SGregory Neil ShapiroR<?>$* $: <$(access TLS_TRY_TAG`'_TAG_DELIM_ $: ? $)> 250906f25ae9SGregory Neil ShapiroR<?>$* $@ OK 251040266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 251140266059SGregory Neil ShapiroR<$* _ATMPF_>$* $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 2512193538b7SGregory Neil ShapiroR<NO>$* $#error $@ 5.7.1 $: "550 do not try TLS with " $&{server_name} " ["$&{server_addr}"]" 251306f25ae9SGregory Neil Shapiro 251440266059SGregory Neil Shapiro###################################################################### 251540266059SGregory Neil Shapiro### tls_rcpt: is connection with server "good" enough? 251640266059SGregory Neil Shapiro### (done in client, per recipient) 251740266059SGregory Neil Shapirodnl called from deliver() before RCPT command 251840266059SGregory Neil Shapiro### 251940266059SGregory Neil Shapiro### Parameters: 252040266059SGregory Neil Shapiro### $1: recipient 252140266059SGregory Neil Shapiro###################################################################### 252240266059SGregory Neil ShapiroStls_rcpt 252340266059SGregory Neil Shapiroifdef(`_LOCAL_TLS_RCPT_', `dnl 252440266059SGregory Neil ShapiroR$* $: $1 $| $>"Local_tls_rcpt" $1 252540266059SGregory Neil ShapiroR$* $| $#$* $#$2 252640266059SGregory Neil ShapiroR$* $| $* $: $1', `dnl') 252740266059SGregory Neil Shapirodnl store name of other side 252840266059SGregory Neil ShapiroR$* $: $(macro {TLS_Name} $@ $&{server_name} $) $1 252940266059SGregory Neil Shapirodnl canonify recipient address 253040266059SGregory Neil ShapiroR$+ $: <?> $>CanonAddr $1 253140266059SGregory Neil Shapirodnl strip trailing dots 253240266059SGregory Neil ShapiroR<?> $+ < @ $+ . > <?> $1 <@ $2 > 253340266059SGregory Neil Shapirodnl full address? 253440266059SGregory Neil ShapiroR<?> $+ < @ $+ > $: $1 <@ $2 > $| <F:$1@$2> <U:$1@> <D:$2> <E:> 253540266059SGregory Neil Shapirodnl only localpart? 253640266059SGregory Neil ShapiroR<?> $+ $: $1 $| <U:$1@> <E:> 253740266059SGregory Neil Shapirodnl look it up 253840266059SGregory Neil Shapirodnl also look up a default value via E: 253940266059SGregory Neil ShapiroR$* $| $+ $: $1 $| $>SearchList <! TLS_RCPT_TAG> $| $2 <> 254040266059SGregory Neil Shapirodnl found nothing: stop here 254140266059SGregory Neil ShapiroR$* $| <?> $@ OK 254240266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 254340266059SGregory Neil ShapiroR$* $| <$* _ATMPF_> $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 254440266059SGregory Neil Shapirodnl use the generic routine (for now) 254540266059SGregory Neil ShapiroR$* $| <$+> $@ $>"TLS_connection" $&{verify} $| <$2>') 254640266059SGregory Neil Shapiro 254740266059SGregory Neil Shapiro###################################################################### 254840266059SGregory Neil Shapiro### tls_client: is connection with client "good" enough? 254940266059SGregory Neil Shapiro### (done in server) 255040266059SGregory Neil Shapiro### 255140266059SGregory Neil Shapiro### Parameters: 255240266059SGregory Neil Shapiro### ${verify} $| (MAIL|STARTTLS) 255340266059SGregory Neil Shapiro###################################################################### 255406f25ae9SGregory Neil Shapirodnl MAIL: called from check_mail 255506f25ae9SGregory Neil Shapirodnl STARTTLS: called from smtp() after STARTTLS has been accepted 255606f25ae9SGregory Neil ShapiroStls_client 255740266059SGregory Neil Shapiroifdef(`_LOCAL_TLS_CLIENT_', `dnl 255840266059SGregory Neil ShapiroR$* $: $1 $| $>"Local_tls_client" $1 255940266059SGregory Neil ShapiroR$* $| $#$* $#$2 256040266059SGregory Neil ShapiroR$* $| $* $: $1', `dnl') 256106f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 256240266059SGregory Neil Shapirodnl store name of other side 256340266059SGregory Neil ShapiroR$* $: $(macro {TLS_Name} $@ $&{server_name} $) $1 256406f25ae9SGregory Neil Shapirodnl ignore second arg for now 256506f25ae9SGregory Neil Shapirodnl maybe use it to distinguish permanent/temporary error? 256606f25ae9SGregory Neil Shapirodnl if MAIL: permanent (STARTTLS has not been offered) 256706f25ae9SGregory Neil Shapirodnl if STARTTLS: temporary (offered but maybe failed) 256840266059SGregory Neil ShapiroR$* $| $* $: $1 $| $>D <$&{client_name}> <?> <! TLS_CLT_TAG> <> 256940266059SGregory Neil ShapiroR$* $| <?>$* $: $1 $| $>A <$&{client_addr}> <?> <! TLS_CLT_TAG> <> 257006f25ae9SGregory Neil Shapirodnl do a default lookup: just TLS_CLT_TAG 257106f25ae9SGregory Neil ShapiroR$* $| <?>$* $: $1 $| <$(access TLS_CLT_TAG`'_TAG_DELIM_ $: ? $)> 257240266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 257340266059SGregory Neil ShapiroR$* $| <$* _ATMPF_> $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 257440266059SGregory Neil ShapiroR$* $@ $>"TLS_connection" $1', `dnl 257540266059SGregory Neil ShapiroR$* $| $* $@ $>"TLS_connection" $1') 257606f25ae9SGregory Neil Shapiro 257740266059SGregory Neil Shapiro###################################################################### 257840266059SGregory Neil Shapiro### tls_server: is connection with server "good" enough? 257940266059SGregory Neil Shapiro### (done in client) 258040266059SGregory Neil Shapiro### 258140266059SGregory Neil Shapiro### Parameter: 258240266059SGregory Neil Shapiro### ${verify} 258340266059SGregory Neil Shapiro###################################################################### 258406f25ae9SGregory Neil Shapirodnl i.e. has the server been authenticated and is encryption active? 258506f25ae9SGregory Neil Shapirodnl called from deliver() after STARTTLS command 258606f25ae9SGregory Neil ShapiroStls_server 258740266059SGregory Neil Shapiroifdef(`_LOCAL_TLS_SERVER_', `dnl 258840266059SGregory Neil ShapiroR$* $: $1 $| $>"Local_tls_server" $1 258940266059SGregory Neil ShapiroR$* $| $#$* $#$2 259040266059SGregory Neil ShapiroR$* $| $* $: $1', `dnl') 259106f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 259240266059SGregory Neil Shapirodnl store name of other side 259340266059SGregory Neil ShapiroR$* $: $(macro {TLS_Name} $@ $&{server_name} $) $1 259440266059SGregory Neil ShapiroR$* $: $1 $| $>D <$&{server_name}> <?> <! TLS_SRV_TAG> <> 259540266059SGregory Neil ShapiroR$* $| <?>$* $: $1 $| $>A <$&{server_addr}> <?> <! TLS_SRV_TAG> <> 259606f25ae9SGregory Neil Shapirodnl do a default lookup: just TLS_SRV_TAG 259706f25ae9SGregory Neil ShapiroR$* $| <?>$* $: $1 $| <$(access TLS_SRV_TAG`'_TAG_DELIM_ $: ? $)> 259840266059SGregory Neil Shapiroifdef(`_ATMPF_', `dnl tempfail? 259940266059SGregory Neil ShapiroR$* $| <$* _ATMPF_> $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."', `dnl') 260040266059SGregory Neil ShapiroR$* $@ $>"TLS_connection" $1', `dnl 260140266059SGregory Neil ShapiroR$* $@ $>"TLS_connection" $1') 260206f25ae9SGregory Neil Shapiro 260340266059SGregory Neil Shapiro###################################################################### 260440266059SGregory Neil Shapiro### TLS_connection: is TLS connection "good" enough? 260540266059SGregory Neil Shapiro### 260640266059SGregory Neil Shapiro### Parameters: 260706f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 260840266059SGregory Neil Shapiro### ${verify} $| <Requirement> [<>]', `dnl 260940266059SGregory Neil Shapiro### ${verify}') 261040266059SGregory Neil Shapiro### Requirement: RHS from access map, may be ? for none. 261140266059SGregory Neil Shapirodnl syntax for Requirement: 261240266059SGregory Neil Shapirodnl [(PERM|TEMP)+] (VERIFY[:bits]|ENCR:bits) [+extensions] 261340266059SGregory Neil Shapirodnl extensions: could be a list of further requirements 261440266059SGregory Neil Shapirodnl for now: CN:string {cn_subject} == string 261540266059SGregory Neil Shapiro###################################################################### 261640266059SGregory Neil ShapiroSTLS_connection 261740266059SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl', `dnl use default error 261840266059SGregory Neil Shapirodnl deal with TLS handshake failures: abort 261940266059SGregory Neil ShapiroRSOFTWARE $#error $@ ifdef(`TLS_PERM_ERR', `5.7.0', `4.7.0') $: "ifdef(`TLS_PERM_ERR', `503', `403') TLS handshake." 262040266059SGregory Neil Shapirodivert(-1)') 262106f25ae9SGregory Neil Shapirodnl common ruleset for tls_{client|server} 262240266059SGregory Neil Shapirodnl input: ${verify} $| <ResultOfLookup> [<>] 262306f25ae9SGregory Neil Shapirodnl remove optional <> 262406f25ae9SGregory Neil ShapiroR$* $| <$*>$* $: $1 $| <$2> 262540266059SGregory Neil Shapirodnl workspace: ${verify} $| <ResultOfLookup> 262640266059SGregory Neil Shapiro# create the appropriate error codes 262706f25ae9SGregory Neil Shapirodnl permanent or temporary error? 262806f25ae9SGregory Neil ShapiroR$* $| <PERM + $={tls} $*> $: $1 $| <503:5.7.0> <$2 $3> 262906f25ae9SGregory Neil ShapiroR$* $| <TEMP + $={tls} $*> $: $1 $| <403:4.7.0> <$2 $3> 263006f25ae9SGregory Neil Shapirodnl default case depends on TLS_PERM_ERR 263106f25ae9SGregory Neil ShapiroR$* $| <$={tls} $*> $: $1 $| <ifdef(`TLS_PERM_ERR', `503:5.7.0', `403:4.7.0')> <$2 $3> 263240266059SGregory Neil Shapirodnl workspace: ${verify} $| [<SMTP:ESC>] <ResultOfLookup> 263340266059SGregory Neil Shapiro# deal with TLS handshake failures: abort 263406f25ae9SGregory Neil ShapiroRSOFTWARE $| <$-:$+> $* $#error $@ $2 $: $1 " TLS handshake failed." 263506f25ae9SGregory Neil Shapirodnl no <reply:dns> i.e. not requirements in the access map 263606f25ae9SGregory Neil Shapirodnl use default error 263706f25ae9SGregory Neil ShapiroRSOFTWARE $| $* $#error $@ ifdef(`TLS_PERM_ERR', `5.7.0', `4.7.0') $: "ifdef(`TLS_PERM_ERR', `503', `403') TLS handshake failed." 263840266059SGregory Neil ShapiroR$* $| <$*> <VERIFY> $: <$2> <VERIFY> <> $1 263940266059SGregory Neil Shapirodnl separate optional requirements 264040266059SGregory Neil ShapiroR$* $| <$*> <VERIFY + $+> $: <$2> <VERIFY> <$3> $1 264140266059SGregory Neil ShapiroR$* $| <$*> <$={tls}:$->$* $: <$2> <$3:$4> <> $1 264240266059SGregory Neil Shapirodnl separate optional requirements 264340266059SGregory Neil ShapiroR$* $| <$*> <$={tls}:$- + $+>$* $: <$2> <$3:$4> <$5> $1 264406f25ae9SGregory Neil Shapirodnl some other value in access map: accept 264506f25ae9SGregory Neil Shapirodnl this also allows to override the default case (if used) 264606f25ae9SGregory Neil ShapiroR$* $| $* $@ OK 264706f25ae9SGregory Neil Shapiro# authentication required: give appropriate error 264806f25ae9SGregory Neil Shapiro# other side did authenticate (via STARTTLS) 264940266059SGregory Neil Shapirodnl workspace: <SMTP:ESC> <{VERIFY,ENCR}[:BITS]> <[extensions]> ${verify} 265006f25ae9SGregory Neil Shapirodnl only verification required and it succeeded 265140266059SGregory Neil ShapiroR<$*><VERIFY> <> OK $@ OK 265240266059SGregory Neil Shapirodnl verification required and it succeeded but extensions are given 265340266059SGregory Neil Shapirodnl change it to <SMTP:ESC> <REQ:0> <extensions> 265440266059SGregory Neil ShapiroR<$*><VERIFY> <$+> OK $: <$1> <REQ:0> <$2> 265506f25ae9SGregory Neil Shapirodnl verification required + some level of encryption 265640266059SGregory Neil ShapiroR<$*><VERIFY:$-> <$*> OK $: <$1> <REQ:$2> <$3> 265706f25ae9SGregory Neil Shapirodnl just some level of encryption required 265840266059SGregory Neil ShapiroR<$*><ENCR:$-> <$*> $* $: <$1> <REQ:$2> <$3> 265940266059SGregory Neil Shapirodnl workspace: 266040266059SGregory Neil Shapirodnl 1. <SMTP:ESC> <VERIFY [:bits]> <[extensions]> {verify} (!= OK) 266140266059SGregory Neil Shapirodnl 2. <SMTP:ESC> <REQ:bits> <[extensions]> 266240266059SGregory Neil Shapirodnl verification required but ${verify} is not set (case 1.) 266340266059SGregory Neil ShapiroR<$-:$+><VERIFY $*> <$*> $#error $@ $2 $: $1 " authentication required" 266440266059SGregory Neil ShapiroR<$-:$+><VERIFY $*> <$*> FAIL $#error $@ $2 $: $1 " authentication failed" 266540266059SGregory Neil ShapiroR<$-:$+><VERIFY $*> <$*> NO $#error $@ $2 $: $1 " not authenticated" 266640266059SGregory Neil ShapiroR<$-:$+><VERIFY $*> <$*> NOT $#error $@ $2 $: $1 " no authentication requested" 266740266059SGregory Neil ShapiroR<$-:$+><VERIFY $*> <$*> NONE $#error $@ $2 $: $1 " other side does not support STARTTLS" 266806f25ae9SGregory Neil Shapirodnl some other value for ${verify} 266940266059SGregory Neil ShapiroR<$-:$+><VERIFY $*> <$*> $+ $#error $@ $2 $: $1 " authentication failure " $4 267040266059SGregory Neil Shapirodnl some level of encryption required: get the maximum level (case 2.) 267140266059SGregory Neil ShapiroR<$*><REQ:$-> <$*> $: <$1> <REQ:$2> <$3> $>max $&{cipher_bits} : $&{auth_ssf} 267206f25ae9SGregory Neil Shapirodnl compare required bits with actual bits 267340266059SGregory Neil ShapiroR<$*><REQ:$-> <$*> $- $: <$1> <$2:$4> <$3> $(arith l $@ $4 $@ $2 $) 267440266059SGregory Neil ShapiroR<$-:$+><$-:$-> <$*> TRUE $#error $@ $2 $: $1 " encryption too weak " $4 " less than " $3 267540266059SGregory Neil Shapirodnl strength requirements fulfilled 267640266059SGregory Neil Shapirodnl TLS Additional Requirements Separator 267740266059SGregory Neil Shapirodnl this should be something which does not appear in the extensions itself 267840266059SGregory Neil Shapirodnl @ could be part of a CN, DN, etc... 267940266059SGregory Neil Shapirodnl use < > ? those are encoded in CN, DN, ... 268040266059SGregory Neil Shapirodefine(`_TLS_ARS_', `++')dnl 268140266059SGregory Neil Shapirodnl workspace: 268240266059SGregory Neil Shapirodnl <SMTP:ESC> <REQ:bits> <extensions> result-of-compare 268340266059SGregory Neil ShapiroR<$-:$+><$-:$-> <$*> $* $: <$1:$2 _TLS_ARS_ $5> 268440266059SGregory Neil Shapirodnl workspace: <SMTP:ESC _TLS_ARS_ extensions> 268540266059SGregory Neil Shapirodnl continue: check extensions 268640266059SGregory Neil ShapiroR<$-:$+ _TLS_ARS_ > $@ OK 268740266059SGregory Neil Shapirodnl split extensions into own list 268840266059SGregory Neil ShapiroR<$-:$+ _TLS_ARS_ $+ > $: <$1:$2> <$3> 268940266059SGregory Neil ShapiroR<$-:$+> < $+ _TLS_ARS_ $+ > <$1:$2> <$3> <$4> 269040266059SGregory Neil ShapiroR<$-:$+> $+ $@ $>"TLS_req" $3 $| <$1:$2> 269106f25ae9SGregory Neil Shapiro 269240266059SGregory Neil Shapiro###################################################################### 269340266059SGregory Neil Shapiro### TLS_req: check additional TLS requirements 269440266059SGregory Neil Shapiro### 269540266059SGregory Neil Shapiro### Parameters: [<list> <of> <req>] $| <$-:$+> 269640266059SGregory Neil Shapiro### $-: SMTP reply code 269740266059SGregory Neil Shapiro### $+: Enhanced Status Code 269840266059SGregory Neil Shapirodnl further requirements for this ruleset: 269940266059SGregory Neil Shapirodnl name of "other side" is stored is {TLS_name} (client/server_name) 270040266059SGregory Neil Shapirodnl 270140266059SGregory Neil Shapirodnl currently only CN[:common_name] is implemented 270240266059SGregory Neil Shapirodnl right now this is only a logical AND 270340266059SGregory Neil Shapirodnl i.e. all requirements must be true 270440266059SGregory Neil Shapirodnl how about an OR? CN must be X or CN must be Y or .. 270540266059SGregory Neil Shapirodnl use a macro to compute this as a trivial sequential 270640266059SGregory Neil Shapirodnl operations (no precedences etc)? 270740266059SGregory Neil Shapiro###################################################################### 270840266059SGregory Neil ShapiroSTLS_req 270940266059SGregory Neil Shapirodnl no additional requirements: ok 271040266059SGregory Neil ShapiroR $| $+ $@ OK 271140266059SGregory Neil Shapirodnl require CN: but no CN specified: use name of other side 271240266059SGregory Neil ShapiroR<CN> $* $| <$+> $: <CN:$&{TLS_Name}> $1 $| <$2> 271340266059SGregory Neil Shapirodnl match, check rest 271440266059SGregory Neil ShapiroR<CN:$&{cn_subject}> $* $| <$+> $@ $>"TLS_req" $1 $| <$2> 271540266059SGregory Neil Shapirodnl CN does not match 271640266059SGregory Neil Shapirodnl 1 2 3 4 271740266059SGregory Neil ShapiroR<CN:$+> $* $| <$-:$+> $#error $@ $4 $: $3 " CN " $&{cn_subject} " does not match " $1 271840266059SGregory Neil Shapirodnl cert subject 271940266059SGregory Neil ShapiroR<CS:$&{cert_subject}> $* $| <$+> $@ $>"TLS_req" $1 $| <$2> 272040266059SGregory Neil Shapirodnl CS does not match 272140266059SGregory Neil Shapirodnl 1 2 3 4 272213bd1963SGregory Neil ShapiroR<CS:$+> $* $| <$-:$+> $#error $@ $4 $: $3 " Cert Subject " $&{cert_subject} " does not match " $1 272340266059SGregory Neil Shapirodnl match, check rest 272440266059SGregory Neil ShapiroR<CI:$&{cert_issuer}> $* $| <$+> $@ $>"TLS_req" $1 $| <$2> 272540266059SGregory Neil Shapirodnl CI does not match 272640266059SGregory Neil Shapirodnl 1 2 3 4 272713bd1963SGregory Neil ShapiroR<CI:$+> $* $| <$-:$+> $#error $@ $4 $: $3 " Cert Issuer " $&{cert_issuer} " does not match " $1 272840266059SGregory Neil Shapirodnl return from recursive call 272940266059SGregory Neil ShapiroROK $@ OK 273040266059SGregory Neil Shapiro 273140266059SGregory Neil Shapiro###################################################################### 273240266059SGregory Neil Shapiro### max: return the maximum of two values separated by : 273340266059SGregory Neil Shapiro### 273440266059SGregory Neil Shapiro### Parameters: [$-]:[$-] 273540266059SGregory Neil Shapiro###################################################################### 273606f25ae9SGregory Neil ShapiroSmax 273706f25ae9SGregory Neil ShapiroR: $: 0 273806f25ae9SGregory Neil ShapiroR:$- $: $1 273906f25ae9SGregory Neil ShapiroR$-: $: $1 274006f25ae9SGregory Neil ShapiroR$-:$- $: $(arith l $@ $1 $@ $2 $) : $1 : $2 274106f25ae9SGregory Neil ShapiroRTRUE:$-:$- $: $2 274240266059SGregory Neil ShapiroR$-:$-:$- $: $2 274340266059SGregory Neil Shapirodnl endif _ACCESS_TABLE_ 274440266059SGregory Neil Shapirodivert(0) 274506f25ae9SGregory Neil Shapiro 274640266059SGregory Neil Shapiro###################################################################### 274740266059SGregory Neil Shapiro### RelayTLS: allow relaying based on TLS authentication 274840266059SGregory Neil Shapiro### 274940266059SGregory Neil Shapiro### Parameters: 275040266059SGregory Neil Shapiro### none 275140266059SGregory Neil Shapiro###################################################################### 275240266059SGregory Neil ShapiroSRelayTLS 275306f25ae9SGregory Neil Shapiro# authenticated? 275406f25ae9SGregory Neil Shapirodnl we do not allow relaying for anyone who can present a cert 275506f25ae9SGregory Neil Shapirodnl signed by a "trusted" CA. For example, even if we put verisigns 275613bd1963SGregory Neil Shapirodnl CA in CertPath so we can authenticate users, we do not allow 275706f25ae9SGregory Neil Shapirodnl them to abuse our server (they might be easier to get hold of, 275806f25ae9SGregory Neil Shapirodnl but anyway). 275906f25ae9SGregory Neil Shapirodnl so here is the trick: if the verification succeeded 276006f25ae9SGregory Neil Shapirodnl we look up the cert issuer in the access map 276106f25ae9SGregory Neil Shapirodnl (maybe after extracting a part with a regular expression) 276206f25ae9SGregory Neil Shapirodnl if this returns RELAY we relay without further questions 276306f25ae9SGregory Neil Shapirodnl if it returns SUBJECT we perform a similar check on the 276406f25ae9SGregory Neil Shapirodnl cert subject. 276506f25ae9SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 276640266059SGregory Neil ShapiroR$* $: <?> $&{verify} 276740266059SGregory Neil ShapiroR<?> OK $: OK authenticated: continue 276840266059SGregory Neil ShapiroR<?> $* $@ NO not authenticated 276906f25ae9SGregory Neil Shapiroifdef(`_CERT_REGEX_ISSUER_', `dnl 277040266059SGregory Neil ShapiroR$* $: $(CERTIssuer $&{cert_issuer} $)', 277140266059SGregory Neil Shapiro`R$* $: $&{cert_issuer}') 277240266059SGregory Neil ShapiroR$+ $: $(access CERTISSUER`'_TAG_DELIM_`'$1 $) 277306f25ae9SGregory Neil Shapirodnl use $# to stop further checks (delay_check) 277440266059SGregory Neil ShapiroRRELAY $# RELAY 277506f25ae9SGregory Neil Shapiroifdef(`_CERT_REGEX_SUBJECT_', `dnl 277640266059SGregory Neil ShapiroRSUBJECT $: <@> $(CERTSubject $&{cert_subject} $)', 277740266059SGregory Neil Shapiro`RSUBJECT $: <@> $&{cert_subject}') 277840266059SGregory Neil ShapiroR<@> $+ $: <@> $(access CERTSUBJECT`'_TAG_DELIM_`'$1 $) 277940266059SGregory Neil ShapiroR<@> RELAY $# RELAY 278040266059SGregory Neil ShapiroR$* $: NO', `dnl') 278140266059SGregory Neil Shapiro 278240266059SGregory Neil Shapiro###################################################################### 278340266059SGregory Neil Shapiro### authinfo: lookup authinfo in the access map 278440266059SGregory Neil Shapiro### 278540266059SGregory Neil Shapiro### Parameters: 278640266059SGregory Neil Shapiro### $1: {server_name} 278740266059SGregory Neil Shapiro### $2: {server_addr} 278840266059SGregory Neil Shapirodnl both are currently ignored 278940266059SGregory Neil Shapirodnl if it should be done via another map, we either need to restrict 279040266059SGregory Neil Shapirodnl functionality (it calls D and A) or copy those rulesets (or add another 279140266059SGregory Neil Shapirodnl parameter which I want to avoid, it's quite complex already) 279240266059SGregory Neil Shapiro###################################################################### 279340266059SGregory Neil Shapirodnl omit this ruleset if neither is defined? 279440266059SGregory Neil Shapirodnl it causes DefaultAuthInfo to be ignored 279540266059SGregory Neil Shapirodnl (which may be considered a good thing). 279640266059SGregory Neil ShapiroSauthinfo 279740266059SGregory Neil Shapiroifdef(`_AUTHINFO_TABLE_', `dnl 279840266059SGregory Neil ShapiroR$* $: <$(authinfo AuthInfo:$&{server_name} $: ? $)> 279940266059SGregory Neil ShapiroR<?> $: <$(authinfo AuthInfo:$&{server_addr} $: ? $)> 280040266059SGregory Neil ShapiroR<?> $: <$(authinfo AuthInfo: $: ? $)> 280140266059SGregory Neil ShapiroR<?> $@ no no authinfo available 280240266059SGregory Neil ShapiroR<$*> $# $1 280340266059SGregory Neil Shapirodnl', `dnl 280440266059SGregory Neil Shapiroifdef(`_ACCESS_TABLE_', `dnl 280540266059SGregory Neil ShapiroR$* $: $1 $| $>D <$&{server_name}> <?> <! AuthInfo> <> 280640266059SGregory Neil ShapiroR$* $| <?>$* $: $1 $| $>A <$&{server_addr}> <?> <! AuthInfo> <> 280740266059SGregory Neil ShapiroR$* $| <?>$* $: $1 $| <$(access AuthInfo`'_TAG_DELIM_ $: ? $)> <> 280840266059SGregory Neil ShapiroR$* $| <?>$* $@ no no authinfo available 280940266059SGregory Neil ShapiroR$* $| <$*> <> $# $2 281040266059SGregory Neil Shapirodnl', `dnl')') 281106f25ae9SGregory Neil Shapiro 281206f25ae9SGregory Neil Shapiroundivert(9)dnl LOCAL_RULESETS 281306f25ae9SGregory Neil Shapiro# 281406f25ae9SGregory Neil Shapiro###################################################################### 281506f25ae9SGregory Neil Shapiro###################################################################### 281606f25ae9SGregory Neil Shapiro##### 281706f25ae9SGregory Neil Shapiro`##### MAIL FILTER DEFINITIONS' 281806f25ae9SGregory Neil Shapiro##### 281906f25ae9SGregory Neil Shapiro###################################################################### 282006f25ae9SGregory Neil Shapiro###################################################################### 282140266059SGregory Neil Shapiro_MAIL_FILTERS_ 2822c2aa98e2SPeter Wemm# 2823c2aa98e2SPeter Wemm###################################################################### 2824c2aa98e2SPeter Wemm###################################################################### 2825c2aa98e2SPeter Wemm##### 2826c2aa98e2SPeter Wemm`##### MAILER DEFINITIONS' 2827c2aa98e2SPeter Wemm##### 2828c2aa98e2SPeter Wemm###################################################################### 2829c2aa98e2SPeter Wemm###################################################################### 283006f25ae9SGregory Neil Shapiroundivert(7)dnl MAILER_DEFINITIONS 283142e5d165SGregory Neil Shapiro 2832