· 11 years ago · Jul 30, 2015, 08:21 AM
1#
2# Copyright (c) 1998-2004, 2009, 2010 Sendmail, Inc. and its suppliers.
3# All rights reserved.
4# Copyright (c) 1983, 1995 Eric P. Allman. All rights reserved.
5# Copyright (c) 1988, 1993
6# The Regents of the University of California. All rights reserved.
7#
8# By using this file, you agree to the terms and conditions set
9# forth in the LICENSE file which can be found at the top level of
10# the sendmail distribution.
11#
12#
13
14######################################################################
15######################################################################
16#####
17##### SENDMAIL CONFIGURATION FILE
18#####
19##### built by root@amd64.openbsd.org on Mon Jul 23 13:00:41 MDT 2012
20##### in /usr/src/gnu/usr.sbin/sendmail/cf/cf
21##### using /usr/src/gnu/usr.sbin/sendmail/cf/cf/../ as configuration include directory
22#####
23######################################################################
24#####
25##### DO NOT EDIT THIS FILE! Only edit the source .mc file.
26#####
27######################################################################
28######################################################################
29
30##### $Sendmail: cfhead.m4,v 8.121 2010/01/07 18:20:19 ca Exp $ #####
31##### $Sendmail: cf.m4,v 8.32 1999/02/07 07:26:14 gshapiro Exp $ #####
32##### @(#)openbsd-proto.mc $Revision: 1.12 $ #####
33##### $Sendmail: openbsd.m4,v 8.3 1999/04/24 05:37:42 gshapiro Exp $ #####
34
35##### $Sendmail: nouucp.m4,v 8.13 1999/11/24 18:37:07 ca Exp $ #####
36
37##### $Sendmail: access_db.m4,v 8.27 2006/07/06 21:10:10 ca Exp $ #####
38
39##### $Sendmail: blacklist_recipients.m4,v 8.13 1999/04/02 02:25:13 gshapiro Exp $ #####
40
41##### $Sendmail: use_cw_file.m4,v 8.11 2001/08/26 20:58:57 gshapiro Exp $ #####
42
43
44##### $Sendmail: mailertable.m4,v 8.25 2002/06/27 23:23:57 gshapiro Exp $ #####
45
46##### $Sendmail: use_ct_file.m4,v 8.11 2001/08/26 20:58:57 gshapiro Exp $ #####
47
48
49##### $Sendmail: virtusertable.m4,v 8.23 2002/06/27 23:23:57 gshapiro Exp $ #####
50
51##### $Sendmail: genericstable.m4,v 8.23 2002/06/27 23:23:57 gshapiro Exp $ #####
52
53##### $Sendmail: always_add_domain.m4,v 8.11 2000/09/12 22:00:53 ca Exp $ #####
54
55##### $Sendmail: redirect.m4,v 8.15 1999/08/06 01:47:36 gshapiro Exp $ #####
56
57##### $Sendmail: no_default_msa.m4,v 8.2 2001/02/14 05:03:22 gshapiro Exp $ #####
58
59
60
61##### $Sendmail: proto.m4,v 8.744 2010/11/23 20:29:47 guenther Exp $ #####
62
63# level 10 config file format
64V10/Berkeley
65
66# override file safeties - setting this option compromises system security,
67# addressing the actual file configuration problem is preferred
68# need to set this before any file actions are encountered in the cf file
69#O DontBlameSendmail=safe
70
71# default LDAP map specification
72# need to set this now before any LDAP maps are defined
73#O LDAPDefaultSpec=-h localhost
74
75##################
76# local info #
77##################
78
79# my LDAP cluster
80# need to set this before any LDAP lookups are done (including classes)
81#D{sendmailMTACluster}$m
82
83Cwlocalhost
84# file containing names of hosts for which we receive email
85Fw-o /etc/mail/local-host-names
86
87# my official domain name
88# ... define this only if sendmail cannot automatically determine your domain
89#Dj$w.Foo.COM
90
91# host/domain names ending with a token in class P are canonical
92CP.
93
94# "Smart" relay host (may be null)
95DS
96
97
98# operators that cannot be in local usernames (i.e., network indicators)
99CO @ %
100
101# a class with just dot (for identifying canonical names)
102C..
103
104# a class with just a left bracket (for identifying domain literals)
105C[[
106
107# access_db acceptance class
108C{Accept}OK RELAY
109
110
111# Resolve map (to check if a host exists in check_mail)
112Kresolve host -a<OKR> -T<TEMP>
113C{ResOk}OKR
114
115
116# Hosts for which relaying is permitted ($=R)
117FR-o /etc/mail/relay-domains
118
119# arithmetic map
120Karith arith
121# macro storage map
122Kmacro macro
123# possible values for TLS_connection in access map
124C{Tls}VERIFY ENCR
125
126
127
128
129
130# dequoting map
131Kdequote dequote
132
133# class E: names that should be exposed as from this host, even if we masquerade
134# class L: names that should be delivered locally, even if we have a relay
135# class M: domains that should be converted to $M
136# class N: domains that should not be converted to $M
137#CL root
138
139
140
141# my name for error messages
142DnMAILER-DAEMON
143
144
145# Access list database (for spam stomping)
146Kaccess hash -o -T<TMPF> /etc/mail/access
147
148# Mailer table (overriding domains)
149Kmailertable hash -o /etc/mail/mailertable
150
151# Virtual user table (maps incoming users)
152Kvirtuser hash -o /etc/mail/virtusertable
153
154# Generics table (mapping outgoing addresses)
155Kgenerics hash -o /etc/mail/genericstable
156
157CPREDIRECT
158
159# Configuration version number
160DZ8.14.5
161
162
163###############
164# Options #
165###############
166
167# strip message body to 7 bits on input?
168O SevenBitInput=False
169
170# 8-bit data handling
171#O EightBitMode=pass8
172
173# wait for alias file rebuild (default units: minutes)
174O AliasWait=10
175
176# location of alias file
177O AliasFile=/etc/mail/aliases
178
179# minimum number of free blocks on filesystem
180O MinFreeBlocks=100
181
182# maximum message size
183#O MaxMessageSize=0
184
185# substitution for space (blank) characters
186O BlankSub=.
187
188# avoid connecting to "expensive" mailers on initial submission?
189O HoldExpensive=False
190
191# checkpoint queue runs after every N successful deliveries
192#O CheckpointInterval=10
193
194# default delivery mode
195O DeliveryMode=background
196
197# error message header/file
198#O ErrorHeader=/etc/mail/error-header
199
200# error mode
201#O ErrorMode=print
202
203# save Unix-style "From_" lines at top of header?
204#O SaveFromLine=False
205
206# queue file mode (qf files)
207#O QueueFileMode=0600
208
209# temporary file mode
210O TempFileMode=0600
211
212# match recipients against GECOS field?
213#O MatchGECOS=False
214
215# maximum hop count
216#O MaxHopCount=25
217
218# location of help file
219O HelpFile=/etc/mail/helpfile
220
221# ignore dots as terminators in incoming messages?
222#O IgnoreDots=False
223
224# name resolver options
225O ResolverOptions=WorkAroundBrokenAAAA
226
227# deliver MIME-encapsulated error messages?
228O SendMimeErrors=True
229
230# Forward file search path
231O ForwardPath=$z/.forward.$w:$z/.forward
232
233# open connection cache size
234O ConnectionCacheSize=2
235
236# open connection cache timeout
237O ConnectionCacheTimeout=5m
238
239# persistent host status directory
240#O HostStatusDirectory=.hoststat
241
242# single thread deliveries (requires HostStatusDirectory)?
243#O SingleThreadDelivery=False
244
245# use Errors-To: header?
246O UseErrorsTo=False
247
248# log level
249O LogLevel=9
250
251# send to me too, even in an alias expansion?
252#O MeToo=True
253
254# verify RHS in newaliases?
255O CheckAliases=False
256
257# default messages to old style headers if no special punctuation?
258O OldStyleHeaders=True
259
260# SMTP daemon options
261
262O DaemonPortOptions=Family=inet, Address=0.0.0.0, Name=MTA
263O DaemonPortOptions=Family=inet6, Address=::, Name=MTA6, M=O
264O DaemonPortOptions=Family=inet, Address=0.0.0.0, Port=587, Name=MSA, M=E
265O DaemonPortOptions=Family=inet6, Address=::, Port=587, Name=MSA6, M=O, M=E
266
267# SMTP client options
268
269O ClientPortOptions=Family=inet, Address=0.0.0.0
270O ClientPortOptions=Family=inet6, Address=::
271
272# Modifiers to define {daemon_flags} for direct submissions
273#O DirectSubmissionModifiers
274
275# Use as mail submission program? See sendmail/SECURITY
276#O UseMSP
277
278# privacy flags
279O PrivacyOptions=authwarnings,needmailhelo,noexpn,novrfy,nobodyreturn
280
281# who (if anyone) should get extra copies of error messages
282#O PostmasterCopy=Postmaster
283
284# slope of queue-only function
285#O QueueFactor=600000
286
287# limit on number of concurrent queue runners
288#O MaxQueueChildren
289
290# maximum number of queue-runners per queue-grouping with multiple queues
291#O MaxRunnersPerQueue=1
292
293# priority of queue runners (nice(3))
294#O NiceQueueRun
295
296# shall we sort the queue by hostname first?
297#O QueueSortOrder=priority
298
299# minimum time in queue before retry
300#O MinQueueAge=30m
301
302# how many jobs can you process in the queue?
303#O MaxQueueRunSize=0
304
305# perform initial split of envelope without checking MX records
306#O FastSplit=1
307
308# queue directory
309O QueueDirectory=/var/spool/mqueue
310
311# key for shared memory; 0 to turn off, -1 to auto-select
312#O SharedMemoryKey=0
313
314# file to store auto-selected key for shared memory (SharedMemoryKey = -1)
315#O SharedMemoryKeyFile
316
317# timeouts (many of these)
318#O Timeout.initial=5m
319#O Timeout.connect=5m
320#O Timeout.aconnect=0s
321#O Timeout.iconnect=5m
322#O Timeout.helo=5m
323#O Timeout.mail=10m
324#O Timeout.rcpt=1h
325#O Timeout.datainit=5m
326#O Timeout.datablock=1h
327#O Timeout.datafinal=1h
328#O Timeout.rset=5m
329#O Timeout.quit=2m
330#O Timeout.misc=2m
331#O Timeout.command=1h
332#O Timeout.ident=5s
333#O Timeout.fileopen=60s
334#O Timeout.control=2m
335O Timeout.queuereturn=5d
336#O Timeout.queuereturn.normal=5d
337#O Timeout.queuereturn.urgent=2d
338#O Timeout.queuereturn.non-urgent=7d
339#O Timeout.queuereturn.dsn=5d
340O Timeout.queuewarn=4h
341#O Timeout.queuewarn.normal=4h
342#O Timeout.queuewarn.urgent=1h
343#O Timeout.queuewarn.non-urgent=12h
344#O Timeout.queuewarn.dsn=4h
345#O Timeout.hoststatus=30m
346#O Timeout.resolver.retrans=5s
347#O Timeout.resolver.retrans.first=5s
348#O Timeout.resolver.retrans.normal=5s
349#O Timeout.resolver.retry=4
350#O Timeout.resolver.retry.first=4
351#O Timeout.resolver.retry.normal=4
352#O Timeout.lhlo=2m
353#O Timeout.auth=10m
354#O Timeout.starttls=1h
355
356# time for DeliverBy; extension disabled if less than 0
357#O DeliverByMin=0
358
359# should we not prune routes in route-addr syntax addresses?
360#O DontPruneRoutes=False
361
362# queue up everything before forking?
363O SuperSafe=True
364
365# status file
366O StatusFile=/var/log/sendmail.st
367
368# time zone handling:
369# if undefined, use system default
370# if defined but null, use TZ envariable passed in
371# if defined and non-null, use that info
372#O TimeZoneSpec=
373
374# default UID (can be username or userid:groupid)
375#O DefaultUser=mailnull
376
377# list of locations of user database file (null means no lookup)
378#O UserDatabaseSpec=/etc/mail/userdb
379
380# fallback MX host
381#O FallbackMXhost=fall.back.host.net
382
383# fallback smart host
384#O FallbackSmartHost=fall.back.host.net
385
386# if we are the best MX host for a site, try it directly instead of config err
387#O TryNullMXList=False
388
389# load average at which we just queue messages
390#O QueueLA=8
391
392# load average at which we refuse connections
393#O RefuseLA=12
394
395# log interval when refusing connections for this long
396#O RejectLogInterval=3h
397
398# load average at which we delay connections; 0 means no limit
399#O DelayLA=0
400
401# maximum number of children we allow at one time
402#O MaxDaemonChildren=0
403
404# maximum number of new connections per second
405#O ConnectionRateThrottle=0
406
407# Width of the window
408#O ConnectionRateWindowSize=60s
409
410# work recipient factor
411#O RecipientFactor=30000
412
413# deliver each queued job in a separate process?
414#O ForkEachJob=False
415
416# work class factor
417#O ClassFactor=1800
418
419# work time factor
420#O RetryFactor=90000
421
422# default character set
423#O DefaultCharSet=unknown-8bit
424
425# service switch file (name hardwired on Solaris, Ultrix, OSF/1, others)
426#O ServiceSwitchFile=/etc/mail/service.switch
427
428# hosts file (normally /etc/hosts)
429#O HostsFile=/etc/hosts
430
431# dialup line delay on connection failure
432#O DialDelay=0s
433
434# action to take if there are no recipients in the message
435#O NoRecipientAction=none
436
437# chrooted environment for writing to files
438#O SafeFileEnvironment
439
440# are colons OK in addresses?
441#O ColonOkInAddr=True
442
443# shall I avoid expanding CNAMEs (violates protocols)?
444#O DontExpandCnames=False
445
446# SMTP initial login message (old $e macro)
447O SmtpGreetingMessage=$j Sendmail $v/$Z; $b
448
449# UNIX initial From header format (old $l macro)
450O UnixFromLine=From $g $d
451
452# From: lines that have embedded newlines are unwrapped onto one line
453#O SingleLineFromHeader=False
454
455# Allow HELO SMTP command that does not include a host name
456#O AllowBogusHELO=False
457
458# Characters to be quoted in a full name phrase (@,;:\()[] are automatic)
459#O MustQuoteChars=.
460
461# delimiter (operator) characters (old $o macro)
462O OperatorChars=.:%@!^/[]+
463
464# shall I avoid calling initgroups(3) because of high NIS costs?
465#O DontInitGroups=False
466
467# are group-writable :include: and .forward files (un)trustworthy?
468# True (the default) means they are not trustworthy.
469#O UnsafeGroupWrites=True
470
471
472# where do errors that occur when sending errors get sent?
473#O DoubleBounceAddress=postmaster
474
475# issue temporary errors (4xy) instead of permanent errors (5xy)?
476#O SoftBounce=False
477
478# where to save bounces if all else fails
479#O DeadLetterDrop=/var/tmp/dead.letter
480
481# what user id do we assume for the majority of the processing?
482#O RunAsUser=sendmail
483
484# maximum number of recipients per SMTP envelope
485#O MaxRecipientsPerMessage=0
486
487# limit the rate recipients per SMTP envelope are accepted
488# once the threshold number of recipients have been rejected
489#O BadRcptThrottle=0
490
491
492# shall we get local names from our installed interfaces?
493#O DontProbeInterfaces=False
494
495# Return-Receipt-To: header implies DSN request
496#O RrtImpliesDsn=False
497
498# override connection address (for testing)
499#O ConnectOnlyTo=0.0.0.0
500
501# Trusted user for file ownership and starting the daemon
502#O TrustedUser=root
503
504# Control socket for daemon management
505#O ControlSocketName=/var/spool/mqueue/.control
506
507# Maximum MIME header length to protect MUAs
508#O MaxMimeHeaderLength=0/0
509
510# Maximum length of the sum of all headers
511#O MaxHeadersLength=32768
512
513# Maximum depth of alias recursion
514#O MaxAliasRecursion=10
515
516# location of pid file
517#O PidFile=/var/run/sendmail.pid
518
519# Prefix string for the process title shown on 'ps' listings
520#O ProcessTitlePrefix=prefix
521
522# Data file (df) memory-buffer file maximum size
523#O DataFileBufferSize=4096
524
525# Transcript file (xf) memory-buffer file maximum size
526#O XscriptFileBufferSize=4096
527
528# lookup type to find information about local mailboxes
529#O MailboxDatabase=pw
530
531# override compile time flag REQUIRES_DIR_FSYNC
532#O RequiresDirfsync=true
533
534# list of authentication mechanisms
535#O AuthMechanisms=EXTERNAL GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5
536
537# Authentication realm
538#O AuthRealm
539
540# default authentication information for outgoing connections
541#O DefaultAuthInfo=/etc/mail/default-auth-info
542
543# SMTP AUTH flags
544#O AuthOptions
545
546# SMTP AUTH maximum encryption strength
547#O AuthMaxBits
548
549# SMTP STARTTLS server options
550#O TLSSrvOptions
551
552
553# Input mail filters
554#O InputMailFilters
555
556
557# CA directory
558#O CACertPath
559# CA file
560#O CACertFile
561# Server Cert
562#O ServerCertFile
563# Server private key
564#O ServerKeyFile
565# Client Cert
566#O ClientCertFile
567# Client private key
568#O ClientKeyFile
569# File containing certificate revocation lists
570#O CRLFile
571# DHParameters (only required if DSA/DH is used)
572#O DHParameters
573# Random data source (required for systems without /dev/urandom under OpenSSL)
574#O RandFile
575
576# Maximum number of "useless" commands before slowing down
577#O MaxNOOPCommands=20
578
579# Name to use for EHLO (defaults to $j)
580#O HeloName
581
582############################
583# QUEUE GROUP DEFINITIONS #
584############################
585
586
587###########################
588# Message precedences #
589###########################
590
591Pfirst-class=0
592Pspecial-delivery=100
593Plist=-30
594Pbulk=-60
595Pjunk=-100
596
597#####################
598# Trusted users #
599#####################
600
601# this is equivalent to setting class "t"
602Ft-o /etc/mail/trusted-users
603Troot
604Tdaemon
605
606#########################
607# Format of headers #
608#########################
609
610H?P?Return-Path: <$g>
611HReceived: $?sfrom $s $.$?_($?s$|from $.$_)
612 $.$?{auth_type}(authenticated$?{auth_ssf} bits=${auth_ssf}$.)
613 $.by $j ($v/$Z)$?r with $r$. id $i$?{tls_version}
614 (version=${tls_version} cipher=${cipher} bits=${cipher_bits} verify=${verify})$.$?u
615 for $u; $|;
616 $.$b
617H?D?Resent-Date: $a
618H?D?Date: $a
619H?F?Resent-From: $?x$x <$g>$|$g$.
620H?F?From: $?x$x <$g>$|$g$.
621H?x?Full-Name: $x
622# HPosted-Date: $a
623# H?l?Received-Date: $b
624H?M?Resent-Message-Id: <$t.$i@$j>
625H?M?Message-Id: <$t.$i@$j>
626
627#
628######################################################################
629######################################################################
630#####
631##### REWRITING RULES
632#####
633######################################################################
634######################################################################
635
636############################################
637### Ruleset 3 -- Name Canonicalization ###
638############################################
639Scanonify=3
640
641# handle null input (translate to <@> special case)
642R$@ $@ <@>
643
644# strip group: syntax (not inside angle brackets!) and trailing semicolon
645R$* $: $1 <@> mark addresses
646R$* < $* > $* <@> $: $1 < $2 > $3 unmark <addr>
647R@ $* <@> $: @ $1 unmark @host:...
648R$* [ IPv6 : $+ ] <@> $: $1 [ IPv6 : $2 ] unmark IPv6 addr
649R$* :: $* <@> $: $1 :: $2 unmark node::addr
650R:include: $* <@> $: :include: $1 unmark :include:...
651R$* : $* [ $* ] $: $1 : $2 [ $3 ] <@> remark if leading colon
652R$* : $* <@> $: $2 strip colon if marked
653R$* <@> $: $1 unmark
654R$* ; $1 strip trailing semi
655R$* < $+ :; > $* $@ $2 :; <@> catch <list:;>
656R$* < $* ; > $1 < $2 > bogus bracketed semi
657
658# null input now results from list:; syntax
659R$@ $@ :; <@>
660
661# strip angle brackets -- note RFC733 heuristic to get innermost item
662R$* $: < $1 > housekeeping <>
663R$+ < $* > < $2 > strip excess on left
664R< $* > $+ < $1 > strip excess on right
665R<> $@ < @ > MAIL FROM:<> case
666R< $+ > $: $1 remove housekeeping <>
667
668# strip route address <@a,@b,@c:user@d> -> <user@d>
669R@ $+ , $+ $2
670R@ [ $* ] : $+ $2
671R@ $+ : $+ $2
672
673# find focus for list syntax
674R $+ : $* ; @ $+ $@ $>Canonify2 $1 : $2 ; < @ $3 > list syntax
675R $+ : $* ; $@ $1 : $2; list syntax
676
677# find focus for @ syntax addresses
678R$+ @ $+ $: $1 < @ $2 > focus on domain
679R$+ < $+ @ $+ > $1 $2 < @ $3 > move gaze right
680R$+ < @ $+ > $@ $>Canonify2 $1 < @ $2 > already canonical
681
682
683# if we have % signs, take the rightmost one
684R$* % $* $1 @ $2 First make them all @s.
685R$* @ $* @ $* $1 % $2 @ $3 Undo all but the last.
686R$* @ $* $@ $>Canonify2 $1 < @ $2 > Insert < > and finish
687
688# else we must be a local name
689R$* $@ $>Canonify2 $1
690
691
692################################################
693### Ruleset 96 -- bottom half of ruleset 3 ###
694################################################
695
696SCanonify2=96
697
698# handle special cases for local names
699R$* < @ localhost > $* $: $1 < @ $j . > $2 no domain at all
700R$* < @ localhost . $m > $* $: $1 < @ $j . > $2 local domain
701
702# check for IPv4/IPv6 domain literal
703R$* < @ [ $+ ] > $* $: $1 < @@ [ $2 ] > $3 mark [addr]
704R$* < @@ $=w > $* $: $1 < @ $j . > $3 self-literal
705R$* < @@ $+ > $* $@ $1 < @ $2 > $3 canon IP addr
706
707
708
709
710
711# hostnames ending in class P are always canonical
712R$* < @ $* $=P > $* $: $1 < @ $2 $3 . > $4
713R$* < @ $* $~P > $* $: $&{daemon_flags} $| $1 < @ $2 $3 > $4
714R$* CC $* $| $* < @ $+.$+ > $* $: $3 < @ $4.$5 . > $6
715R$* CC $* $| $* $: $3
716# pass to name server to make hostname canonical
717R$* $| $* < @ $* > $* $: $2 < @ $[ $3 $] > $4
718R$* $| $* $: $2
719
720# local host aliases and pseudo-domains are always canonical
721R$* < @ $=w > $* $: $1 < @ $2 . > $3
722R$* < @ $=M > $* $: $1 < @ $2 . > $3
723R$* < @ $={VirtHost} > $* $: $1 < @ $2 . > $3
724R$* < @ $=G > $* $: $1 < @ $2 . > $3
725R$* < @ $* . . > $* $1 < @ $2 . > $3
726
727
728##################################################
729### Ruleset 4 -- Final Output Post-rewriting ###
730##################################################
731Sfinal=4
732
733R$+ :; <@> $@ $1 : handle <list:;>
734R$* <@> $@ handle <> and list:;
735
736# strip trailing dot off possibly canonical name
737R$* < @ $+ . > $* $1 < @ $2 > $3
738
739# eliminate internal code
740R$* < @ *LOCAL* > $* $1 < @ $j > $2
741
742# externalize local domain info
743R$* < $+ > $* $1 $2 $3 defocus
744R@ $+ : @ $+ : $+ @ $1 , @ $2 : $3 <route-addr> canonical
745R@ $* $@ @ $1 ... and exit
746
747
748# delete duplicate local names
749R$+ % $=w @ $=w $1 @ $2 u%host@host => u@host
750
751
752
753##############################################################
754### Ruleset 97 -- recanonicalize and call ruleset zero ###
755### (used for recursive calls) ###
756##############################################################
757
758SRecurse=97
759R$* $: $>canonify $1
760R$* $@ $>parse $1
761
762
763######################################
764### Ruleset 0 -- Parse Address ###
765######################################
766
767Sparse=0
768
769R$* $: $>Parse0 $1 initial parsing
770R<@> $#local $: <@> special case error msgs
771R$* $: $>ParseLocal $1 handle local hacks
772R$* $: $>Parse1 $1 final parsing
773
774#
775# Parse0 -- do initial syntax checking and eliminate local addresses.
776# This should either return with the (possibly modified) input
777# or return with a #error mailer. It should not return with a
778# #mailer other than the #error mailer.
779#
780
781SParse0
782R<@> $@ <@> special case error msgs
783R$* : $* ; <@> $#error $@ 5.1.3 $: "553 List:; syntax illegal for recipient addresses"
784R@ <@ $* > < @ $1 > catch "@@host" bogosity
785R<@ $+> $#error $@ 5.1.3 $: "553 User address required"
786R$+ <@> $#error $@ 5.1.3 $: "553 Hostname required"
787R$* $: <> $1
788R<> $* < @ [ $* ] : $+ > $* $1 < @ [ $2 ] : $3 > $4
789R<> $* < @ [ $* ] , $+ > $* $1 < @ [ $2 ] , $3 > $4
790R<> $* < @ [ $* ] $+ > $* $#error $@ 5.1.2 $: "553 Invalid address"
791R<> $* < @ [ $+ ] > $* $1 < @ [ $2 ] > $3
792R<> $* <$* : $* > $* $#error $@ 5.1.3 $: "553 Colon illegal in host name part"
793R<> $* $1
794R$* < @ . $* > $* $#error $@ 5.1.2 $: "553 Invalid host name"
795R$* < @ $* .. $* > $* $#error $@ 5.1.2 $: "553 Invalid host name"
796R$* < @ $* @ > $* $#error $@ 5.1.2 $: "553 Invalid route address"
797R$* @ $* < @ $* > $* $#error $@ 5.1.3 $: "553 Invalid route address"
798R$* , $~O $* $#error $@ 5.1.3 $: "553 Invalid route address"
799
800
801# now delete the local info -- note $=O to find characters that cause forwarding
802R$* < @ > $* $@ $>Parse0 $>canonify $1 user@ => user
803R< @ $=w . > : $* $@ $>Parse0 $>canonify $2 @here:... -> ...
804R$- < @ $=w . > $: $(dequote $1 $) < @ $2 . > dequote "foo"@here
805R< @ $+ > $#error $@ 5.1.3 $: "553 User address required"
806R$* $=O $* < @ $=w . > $@ $>Parse0 $>canonify $1 $2 $3 ...@here -> ...
807R$- $: $(dequote $1 $) < @ *LOCAL* > dequote "foo"
808R< @ *LOCAL* > $#error $@ 5.1.3 $: "553 User address required"
809R$* $=O $* < @ *LOCAL* >
810 $@ $>Parse0 $>canonify $1 $2 $3 ...@*LOCAL* -> ...
811R$* < @ *LOCAL* > $: $1
812
813#
814# Parse1 -- the bottom half of ruleset 0.
815#
816
817SParse1
818
819# handle numeric address spec
820R$* < @ [ $+ ] > $* $: $>ParseLocal $1 < @ [ $2 ] > $3 numeric internet spec
821R$* < @ [ $+ ] > $* $: $1 < @ [ $2 ] : $S > $3 Add smart host to path
822R$* < @ [ $+ ] : > $* $#esmtp $@ [$2] $: $1 < @ [$2] > $3 no smarthost: send
823R$* < @ [ $+ ] : $- : $*> $* $#$3 $@ $4 $: $1 < @ [$2] > $5 smarthost with mailer
824R$* < @ [ $+ ] : $+ > $* $#esmtp $@ $3 $: $1 < @ [$2] > $4 smarthost without mailer
825
826# handle virtual users
827R$+ $: <!> $1 Mark for lookup
828R<!> $+ < @ $={VirtHost} . > $: < $(virtuser $1 @ $2 $@ $1 $: @ $) > $1 < @ $2 . >
829R<!> $+ < @ $=w . > $: < $(virtuser $1 @ $2 $@ $1 $: @ $) > $1 < @ $2 . >
830R<@> $+ + $+ < @ $* . >
831 $: < $(virtuser $1 + + @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . >
832R<@> $+ + $* < @ $* . >
833 $: < $(virtuser $1 + * @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . >
834R<@> $+ + $* < @ $* . >
835 $: < $(virtuser $1 @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . >
836R<@> $+ + $+ < @ $+ . > $: < $(virtuser + + @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . >
837R<@> $+ + $* < @ $+ . > $: < $(virtuser + * @ $3 $@ $1 $@ $2 $@ +$2 $: @ $) > $1 + $2 < @ $3 . >
838R<@> $+ + $* < @ $+ . > $: < $(virtuser @ $3 $@ $1 $@ $2 $@ +$2 $: ! $) > $1 + $2 < @ $3 . >
839R<@> $+ < @ $+ . > $: < $(virtuser @ $2 $@ $1 $: @ $) > $1 < @ $2 . >
840R<@> $+ $: $1
841R<!> $+ $: $1
842R< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4
843R< error : $- $+ > $* $#error $@ $(dequote $1 $) $: $2
844R< $+ > $+ < @ $+ > $: $>Recurse $1
845
846# short circuit local delivery so forwarded email works
847
848
849R$=L < @ $=w . > $#local $: @ $1 special local names
850R$+ < @ $=w . > $#local $: $1 regular local name
851
852# not local -- try mailer table lookup
853R$* <@ $+ > $* $: < $2 > $1 < @ $2 > $3 extract host name
854R< $+ . > $* $: < $1 > $2 strip trailing dot
855R< $+ > $* $: < $(mailertable $1 $) > $2 lookup
856R< $~[ : $* > $* $>MailerToTriple < $1 : $2 > $3 check -- resolved?
857R< $+ > $* $: $>Mailertable <$1> $2 try domain
858
859
860# resolve fake top level domains by forwarding to other hosts
861
862
863
864# pass names that still have a host to a smarthost (if defined)
865R$* < @ $* > $* $: $>MailerToTriple < $S > $1 < @ $2 > $3 glue on smarthost name
866
867# deal with other remote names
868R$* < @$* > $* $#esmtp $@ $2 $: $1 < @ $2 > $3 user@host.domain
869
870# handle locally delivered names
871R$=L $#local $: @ $1 special local names
872R$+ $#local $: $1 regular local names
873
874###########################################################################
875### Ruleset 5 -- special rewriting after aliases have been expanded ###
876###########################################################################
877
878SLocal_localaddr
879Slocaladdr=5
880R$+ $: $1 $| $>"Local_localaddr" $1
881R$+ $| $#ok $@ $1 no change
882R$+ $| $#$* $#$2
883R$+ $| $* $: $1
884
885
886
887
888# deal with plussed users so aliases work nicely
889R$+ + * $#local $@ $&h $: $1
890R$+ + $* $#local $@ + $2 $: $1 + *
891
892# prepend an empty "forward host" on the front
893R$+ $: <> $1
894
895
896
897R< > $+ $: < > < $1 <> $&h > nope, restore +detail
898
899R< > < $+ <> + $* > $: < > < $1 + $2 > check whether +detail
900R< > < $+ <> $* > $: < > < $1 > else discard
901R< > < $+ + $* > $* < > < $1 > + $2 $3 find the user part
902R< > < $+ > + $* $#local $@ $2 $: @ $1 strip the extra +
903R< > < $+ > $@ $1 no +detail
904R$+ $: $1 <> $&h add +detail back in
905
906R$+ <> + $* $: $1 + $2 check whether +detail
907R$+ <> $* $: $1 else discard
908R< local : $* > $* $: $>MailerToTriple < local : $1 > $2 no host extension
909R< error : $* > $* $: $>MailerToTriple < error : $1 > $2 no host extension
910
911R< $~[ : $+ > $+ $: $>MailerToTriple < $1 : $2 > $3 < @ $2 >
912
913R< $+ > $+ $@ $>MailerToTriple < $1 > $2 < @ $1 >
914
915
916###################################################################
917### Ruleset 90 -- try domain part of mailertable entry ###
918###################################################################
919
920SMailertable=90
921R$* <$- . $+ > $* $: $1$2 < $(mailertable .$3 $@ $1$2 $@ $2 $) > $4
922R$* <$~[ : $* > $* $>MailerToTriple < $2 : $3 > $4 check -- resolved?
923R$* < . $+ > $* $@ $>Mailertable $1 . <$2> $3 no -- strip & try again
924R$* < $* > $* $: < $(mailertable . $@ $1$2 $) > $3 try "."
925R< $~[ : $* > $* $>MailerToTriple < $1 : $2 > $3 "." found?
926R< $* > $* $@ $2 no mailertable match
927
928###################################################################
929### Ruleset 95 -- canonify mailer:[user@]host syntax to triple ###
930###################################################################
931
932SMailerToTriple=95
933R< > $* $@ $1 strip off null relay
934R< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4
935R< error : $- : $+ > $* $#error $@ $(dequote $1 $) $: $2
936R< error : $+ > $* $#error $: $1
937R< local : $* > $* $>CanonLocal < $1 > $2
938R< $~[ : $+ @ $+ > $*<$*>$* $# $1 $@ $3 $: $2<@$3> use literal user
939R< $~[ : $+ > $* $# $1 $@ $2 $: $3 try qualified mailer
940R< $=w > $* $@ $2 delete local host
941R< $+ > $* $#relay $@ $1 $: $2 use unqualified mailer
942
943###################################################################
944### Ruleset CanonLocal -- canonify local: syntax ###
945###################################################################
946
947SCanonLocal
948# strip local host from routed addresses
949R< $* > < @ $+ > : $+ $@ $>Recurse $3
950R< $* > $+ $=O $+ < @ $+ > $@ $>Recurse $2 $3 $4
951
952# strip trailing dot from any host name that may appear
953R< $* > $* < @ $* . > $: < $1 > $2 < @ $3 >
954
955# handle local: syntax -- use old user, either with or without host
956R< > $* < @ $* > $* $#local $@ $1@$2 $: $1
957R< > $+ $#local $@ $1 $: $1
958
959# handle local:user@host syntax -- ignore host part
960R< $+ @ $+ > $* < @ $* > $: < $1 > $3 < @ $4 >
961
962# handle local:user syntax
963R< $+ > $* <@ $* > $* $#local $@ $2@$3 $: $1
964R< $+ > $* $#local $@ $2 $: $1
965
966###################################################################
967### Ruleset 93 -- convert header names to masqueraded form ###
968###################################################################
969
970SMasqHdr=93
971
972# handle generics database
973R$+ < @ $=G . > $: < $1@$2 > $1 < @ $2 . > @ mark
974R$+ < @ *LOCAL* > $: < $1@$j > $1 < @ *LOCAL* > @ mark
975R< $+ > $+ < $* > @ $: < $(generics $1 $: @ $1 $) > $2 < $3 >
976R<@$+ + $* @ $+> $+ < @ $+ >
977 $: < $(generics $1+*@$3 $@ $2 $:@$1 + $2@$3 $) > $4 < @ $5 >
978R<@$+ + $* @ $+> $+ < @ $+ >
979 $: < $(generics $1@$3 $: $) > $4 < @ $5 >
980R<@$+ > $+ < @ $+ > $: < > $2 < @ $3 >
981R< > $+ < @ $+ . > $: < $(generics @$2 $@ $1 $: $) > $1 < @ $2 . >
982R< > $+ < @ $+ > $: < $(generics $1 $: $) > $1 < @ $2 >
983R< > $+ + $* < @ $+ > $: < $(generics $1+* $@ $2 $: $) > $1 + $2 < @ $3 >
984R< > $+ + $* < @ $+ > $: < $(generics $1 $: $) > $1 + $2 < @ $3 >
985R< $* @ $* > $* < $* > $@ $>canonify $1 @ $2 found qualified
986R< $+ > $* < $* > $: $>canonify $1 @ *LOCAL* found unqualified
987R< > $* $: $1 not found
988
989# do not masquerade anything in class N
990R$* < @ $* $=N . > $@ $1 < @ $2 $3 . >
991
992R$* < @ *LOCAL* > $@ $1 < @ $j . >
993
994###################################################################
995### Ruleset 94 -- convert envelope names to masqueraded form ###
996###################################################################
997
998SMasqEnv=94
999R$* < @ *LOCAL* > $* $: $1 < @ $j . > $2
1000
1001###################################################################
1002### Ruleset 98 -- local part of ruleset zero (can be null) ###
1003###################################################################
1004
1005SParseLocal=98
1006
1007# addresses sent to foo@host.REDIRECT will give a 551 error code
1008R$* < @ $+ .REDIRECT. > $: $1 < @ $2 . REDIRECT . > < ${opMode} >
1009R$* < @ $+ .REDIRECT. > <i> $: $1 < @ $2 . REDIRECT. >
1010R$* < @ $+ .REDIRECT. > < $- > $#error $@ 5.1.1 $: "551 User has moved; please try " <$1@$2>
1011
1012
1013
1014
1015######################################################################
1016### D: LookUpDomain -- search for domain in access database
1017###
1018### Parameters:
1019### <$1> -- key (domain name)
1020### <$2> -- default (what to return if not found in db)
1021### <$3> -- mark (must be <(!|+) single-token>)
1022### ! does lookup only with tag
1023### + does lookup with and without tag
1024### <$4> -- passthru (additional data passed unchanged through)
1025######################################################################
1026
1027SD
1028R<$*> <$+> <$- $-> <$*> $: < $(access $4:$1 $: ? $) > <$1> <$2> <$3 $4> <$5>
1029R<?> <$+> <$+> <+ $-> <$*> $: < $(access $1 $: ? $) > <$1> <$2> <+ $3> <$4>
1030R<?> <[$+.$-]> <$+> <$- $-> <$*> $@ $>D <[$1]> <$3> <$4 $5> <$6>
1031R<?> <[$+::$-]> <$+> <$- $-> <$*> $: $>D <[$1]> <$3> <$4 $5> <$6>
1032R<?> <[$+:$-]> <$+> <$- $-> <$*> $: $>D <[$1]> <$3> <$4 $5> <$6>
1033R<?> <$+.$+> <$+> <$- $-> <$*> $@ $>D <$2> <$3> <$4 $5> <$6>
1034R<?> <$+> <$+> <$- $-> <$*> $@ <$2> <$5>
1035R<$* <TMPF>> <$+> <$+> <$- $-> <$*> $@ <<TMPF>> <$6>
1036R<$*> <$+> <$+> <$- $-> <$*> $@ <$1> <$6>
1037
1038######################################################################
1039### A: LookUpAddress -- search for host address in access database
1040###
1041### Parameters:
1042### <$1> -- key (dot quadded host address)
1043### <$2> -- default (what to return if not found in db)
1044### <$3> -- mark (must be <(!|+) single-token>)
1045### ! does lookup only with tag
1046### + does lookup with and without tag
1047### <$4> -- passthru (additional data passed through)
1048######################################################################
1049
1050SA
1051R<$+> <$+> <$- $-> <$*> $: < $(access $4:$1 $: ? $) > <$1> <$2> <$3 $4> <$5>
1052R<?> <$+> <$+> <+ $-> <$*> $: < $(access $1 $: ? $) > <$1> <$2> <+ $3> <$4>
1053R<?> <$+::$-> <$+> <$- $-> <$*> $@ $>A <$1> <$3> <$4 $5> <$6>
1054R<?> <$+:$-> <$+> <$- $-> <$*> $@ $>A <$1> <$3> <$4 $5> <$6>
1055R<?> <$+.$-> <$+> <$- $-> <$*> $@ $>A <$1> <$3> <$4 $5> <$6>
1056R<?> <$+> <$+> <$- $-> <$*> $@ <$2> <$5>
1057R<$* <TMPF>> <$+> <$+> <$- $-> <$*> $@ <<TMPF>> <$6>
1058R<$*> <$+> <$+> <$- $-> <$*> $@ <$1> <$6>
1059
1060######################################################################
1061### CanonAddr -- Convert an address into a standard form for
1062### relay checking. Route address syntax is
1063### crudely converted into a %-hack address.
1064###
1065### Parameters:
1066### $1 -- full recipient address
1067###
1068### Returns:
1069### parsed address, not in source route form
1070######################################################################
1071
1072SCanonAddr
1073R$* $: $>Parse0 $>canonify $1 make domain canonical
1074
1075
1076######################################################################
1077### ParseRecipient -- Strip off hosts in $=R as well as possibly
1078### $* $=m or the access database.
1079### Check user portion for host separators.
1080###
1081### Parameters:
1082### $1 -- full recipient address
1083###
1084### Returns:
1085### parsed, non-local-relaying address
1086######################################################################
1087
1088SParseRecipient
1089R$* $: <?> $>CanonAddr $1
1090R<?> $* < @ $* . > <?> $1 < @ $2 > strip trailing dots
1091R<?> $- < @ $* > $: <?> $(dequote $1 $) < @ $2 > dequote local part
1092
1093# if no $=O character, no host in the user portion, we are done
1094R<?> $* $=O $* < @ $* > $: <NO> $1 $2 $3 < @ $4>
1095R<?> $* $@ $1
1096
1097
1098R<NO> $* < @ $* $=R > $: <RELAY> $1 < @ $2 $3 >
1099R<NO> $* < @ $+ > $: $>D <$2> <NO> <+ To> <$1 < @ $2 >>
1100R<$+> <$+> $: <$1> $2
1101
1102
1103
1104R<RELAY> $* < @ $* > $@ $>ParseRecipient $1
1105R<$+> $* $@ $2
1106
1107
1108######################################################################
1109### check_relay -- check hostname/address on SMTP startup
1110######################################################################
1111
1112
1113
1114SLocal_check_relay
1115Scheck_relay
1116R$* $: $1 $| $>"Local_check_relay" $1
1117R$* $| $* $| $#$* $#$3
1118R$* $| $* $| $* $@ $>"Basic_check_relay" $1 $| $2
1119
1120SBasic_check_relay
1121# check for deferred delivery mode
1122R$* $: < $&{deliveryMode} > $1
1123R< d > $* $@ deferred
1124R< $* > $* $: $2
1125
1126R$+ $| $+ $: $>D < $1 > <?> <+ Connect> < $2 >
1127R $| $+ $: $>A < $1 > <?> <+ Connect> <> empty client_name
1128R<?> <$+> $: $>A < $1 > <?> <+ Connect> <> no: another lookup
1129R<?> <$*> $: OK found nothing
1130R<$={Accept}> <$*> $@ $1 return value of lookup
1131R<REJECT> <$*> $#error $@ 5.7.1 $: "550 Access denied"
1132R<DISCARD> <$*> $#discard $: discard
1133R<QUARANTINE:$+> <$*> $#error $@ quarantine $: $1
1134R<ERROR:$-.$-.$-:$+> <$*> $#error $@ $1.$2.$3 $: $4
1135R<ERROR:$+> <$*> $#error $: $1
1136R<$* <TMPF>> <$*> $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1137R<$+> <$*> $#error $: $1
1138
1139
1140######################################################################
1141### check_mail -- check SMTP `MAIL FROM:' command argument
1142######################################################################
1143
1144SLocal_check_mail
1145Scheck_mail
1146R$* $: $1 $| $>"Local_check_mail" $1
1147R$* $| $#$* $#$2
1148R$* $| $* $@ $>"Basic_check_mail" $1
1149
1150SBasic_check_mail
1151# check for deferred delivery mode
1152R$* $: < $&{deliveryMode} > $1
1153R< d > $* $@ deferred
1154R< $* > $* $: $2
1155
1156# authenticated?
1157R$* $: $1 $| $>"tls_client" $&{verify} $| MAIL
1158R$* $| $#$+ $#$2
1159R$* $| $* $: $1
1160
1161R<> $@ <OK> we MUST accept <> (RFC 1123)
1162R$+ $: <?> $1
1163R<?><$+> $: <@> <$1>
1164R<?>$+ $: <@> <$1>
1165R$* $: $&{daemon_flags} $| $1
1166R$* f $* $| <@> < $* @ $- > $: < ? $&{client_name} > < $3 @ $4 >
1167R$* u $* $| <@> < $* > $: <?> < $3 >
1168R$* $| $* $: $2
1169# handle case of @localhost on address
1170R<@> < $* @ localhost > $: < ? $&{client_name} > < $1 @ localhost >
1171R<@> < $* @ [127.0.0.1] >
1172 $: < ? $&{client_name} > < $1 @ [127.0.0.1] >
1173R<@> < $* @ localhost.$m >
1174 $: < ? $&{client_name} > < $1 @ localhost.$m >
1175R<@> $* $: $1 no localhost as domain
1176R<? $=w> $* $: $2 local client: ok
1177R<? $+> <$+> $#error $@ 5.5.4 $: "553 Real domain name required for sender address"
1178R<?> $* $: $1
1179R$* $: <?> $>CanonAddr $1 canonify sender address and mark it
1180R<?> $* < @ $+ . > <?> $1 < @ $2 > strip trailing dots
1181# handle non-DNS hostnames (*.bitnet, *.decnet, *.uucp, etc)
1182R<?> $* < @ $* $=P > $: <OKR> $1 < @ $2 $3 >
1183R<?> $* < @ $j > $: <OKR> $1 < @ $j >
1184R<?> $* < @ $+ > $: <? $(resolve $2 $: $2 <PERM> $) > $1 < @ $2 >
1185R<? $* <$->> $* < @ $+ >
1186 $: <$2> $3 < @ $4 >
1187
1188# check sender address: user@address, user@, address
1189R<$+> $+ < @ $* > $: @<$1> <$2 < @ $3 >> $| <F:$2@$3> <U:$2@> <D:$3>
1190R<$+> $+ $: @<$1> <$2> $| <U:$2@>
1191R@ <$+> <$*> $| <$+> $: <@> <$1> <$2> $| $>SearchList <+ From> $| <$3> <>
1192R<@> <$+> <$*> $| <$*> $: <$3> <$1> <$2> reverse result
1193# retransform for further use
1194R<?> <$+> <$*> $: <$1> $2 no match
1195R<$+> <$+> <$*> $: <$1> $3 relevant result, keep it
1196
1197# handle case of no @domain on address
1198R<?> $* $: $&{daemon_flags} $| <?> $1
1199R$* u $* $| <?> $* $: <OKR> $3
1200R$* $| $* $: $2
1201R<?> $* $: < ? $&{client_addr} > $1
1202R<?> $* $@ <OKR> ...local unqualed ok
1203R<? $+> $* $#error $@ 5.5.4 $: "553 Domain name required for sender address " $&f
1204 ...remote is not
1205# check results
1206R<?> $* $: @ $1 mark address: nothing known about it
1207R<$={ResOk}> $* $: @ $2 domain ok
1208R<TEMP> $* $#error $@ 4.1.8 $: "451 Domain of sender address " $&f " does not resolve"
1209R<PERM> $* $#error $@ 5.1.8 $: "553 Domain of sender address " $&f " does not exist"
1210R<$={Accept}> $* $# $1 accept from access map
1211R<DISCARD> $* $#discard $: discard
1212R<QUARANTINE:$+> $* $#error $@ quarantine $: $1
1213R<REJECT> $* $#error $@ 5.7.1 $: "550 Access denied"
1214R<ERROR:$-.$-.$-:$+> $* $#error $@ $1.$2.$3 $: $4
1215R<ERROR:$+> $* $#error $: $1
1216R<<TMPF>> $* $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1217R<$+> $* $#error $: $1 error from access db
1218
1219
1220
1221######################################################################
1222### check_rcpt -- check SMTP `RCPT TO:' command argument
1223######################################################################
1224
1225SLocal_check_rcpt
1226Scheck_rcpt
1227R$* $: $1 $| $>"Local_check_rcpt" $1
1228R$* $| $#$* $#$2
1229R$* $| $* $@ $>"Basic_check_rcpt" $1
1230
1231SBasic_check_rcpt
1232# empty address?
1233R<> $#error $@ nouser $: "553 User address required"
1234R$@ $#error $@ nouser $: "553 User address required"
1235# check for deferred delivery mode
1236R$* $: < $&{deliveryMode} > $1
1237R< d > $* $@ deferred
1238R< $* > $* $: $2
1239
1240
1241######################################################################
1242R$* $: $1 $| @ $>"Rcpt_ok" $1
1243R$* $| @ $#TEMP $+ $: $1 $| T $2
1244R$* $| @ $#$* $#$2
1245R$* $| @ RELAY $@ RELAY
1246R$* $| @ $* $: O $| $>"Relay_ok" $1
1247R$* $| T $+ $: T $2 $| $>"Relay_ok" $1
1248R$* $| $#TEMP $+ $#error $2
1249R$* $| $#$* $#$2
1250R$* $| RELAY $@ RELAY
1251R T $+ $| $* $#error $1
1252# anything else is bogus
1253R$* $#error $@ 5.7.1 $: "550 Relaying denied"
1254
1255
1256######################################################################
1257### Rcpt_ok: is the recipient ok?
1258######################################################################
1259SRcpt_ok
1260R$* $: $>ParseRecipient $1 strip relayable hosts
1261
1262
1263
1264# blacklist local users or any host from receiving mail
1265R$* $: <?> $1
1266R<?> $+ < @ $=w > $: <> <$1 < @ $2 >> $| <F:$1@$2> <U:$1@> <D:$2>
1267R<?> $+ < @ $* > $: <> <$1 < @ $2 >> $| <F:$1@$2> <D:$2>
1268R<?> $+ $: <> <$1> $| <U:$1@>
1269R<> <$*> $| <$+> $: <@> <$1> $| $>SearchList <+ To> $| <$2> <>
1270R<@> <$*> $| <$*> $: <$2> <$1> reverse result
1271R<?> <$*> $: @ $1 mark address as no match
1272R<$={Accept}> <$*> $: @ $2 mark address as no match
1273
1274R<REJECT> $* $#error $@ 5.2.1 $: "550 Mailbox disabled for this recipient"
1275R<DISCARD> $* $#discard $: discard
1276R<QUARANTINE:$+> $* $#error $@ quarantine $: $1
1277R<ERROR:$-.$-.$-:$+> $* $#error $@ $1.$2.$3 $: $4
1278R<ERROR:$+> $* $#error $: $1
1279R<<TMPF>> $* $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1280R<$+> $* $#error $: $1 error from access db
1281R@ $* $1 remove mark
1282
1283# authenticated via TLS?
1284R$* $: $1 $| $>RelayTLS client authenticated?
1285R$* $| $# $+ $# $2 error/ok?
1286R$* $| $* $: $1 no
1287
1288R$* $: $1 $| $>"Local_Relay_Auth" $&{auth_type}
1289R$* $| $# $* $# $2
1290R$* $| NO $: $1
1291R$* $| $* $: $1 $| $&{auth_type}
1292R$* $| $: $1
1293R$* $| $={TrustAuthMech} $# RELAY
1294R$* $| $* $: $1
1295R$* ! $* < @ $* > $: <REMOTE> $2 < @ BANG_PATH >
1296R$* ! $* $: <REMOTE> $2 < @ BANG_PATH >
1297# anything terminating locally is ok
1298R$+ < @ $=w > $@ RELAY
1299R$+ < @ $* $=R > $@ RELAY
1300R$+ < @ $+ > $: $>D <$2> <?> <+ To> <$1 < @ $2 >>
1301R<RELAY> $* $@ RELAY
1302R<$* <TMPF>> $* $#TEMP $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1303R<$*> <$*> $: $2
1304
1305
1306
1307# check for local user (i.e. unqualified address)
1308R$* $: <?> $1
1309R<?> $* < @ $+ > $: <REMOTE> $1 < @ $2 >
1310# local user is ok
1311R<?> $+ $@ RELAY
1312R<$+> $* $: $2
1313
1314######################################################################
1315### Relay_ok: is the relay/sender ok?
1316######################################################################
1317SRelay_ok
1318# anything originating locally is ok
1319# check IP address
1320R$* $: $&{client_addr}
1321R$@ $@ RELAY originated locally
1322R0 $@ RELAY originated locally
1323R127.0.0.1 $@ RELAY originated locally
1324RIPv6:::1 $@ RELAY originated locally
1325R$=R $* $@ RELAY relayable IP address
1326R$* $: $>A <$1> <?> <+ Connect> <$1>
1327R<RELAY> $* $@ RELAY relayable IP address
1328
1329R<<TMPF>> $* $#TEMP $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1330R<$*> <$*> $: $2
1331R$* $: [ $1 ] put brackets around it...
1332R$=w $@ RELAY ... and see if it is local
1333
1334
1335# check client name: first: did it resolve?
1336R$* $: < $&{client_resolve} >
1337R<TEMP> $#TEMP $@ 4.4.0 $: "450 Relaying temporarily denied. Cannot resolve PTR record for " $&{client_addr}
1338R<FORGED> $#error $@ 5.7.1 $: "550 Relaying denied. IP name possibly forged " $&{client_name}
1339R<FAIL> $#error $@ 5.7.1 $: "550 Relaying denied. IP name lookup failed " $&{client_name}
1340R$* $: <@> $&{client_name}
1341# pass to name server to make hostname canonical
1342R<@> $* $=P $:<?> $1 $2
1343R<@> $+ $:<?> $[ $1 $]
1344R$* . $1 strip trailing dots
1345R<?> $=w $@ RELAY
1346R<?> $* $=R $@ RELAY
1347R<?> $* $: $>D <$1> <?> <+ Connect> <$1>
1348R<RELAY> $* $@ RELAY
1349R<$* <TMPF>> $* $#TEMP $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1350R<$*> <$*> $: $2
1351
1352
1353
1354######################################################################
1355### F: LookUpFull -- search for an entry in access database
1356###
1357### lookup of full key (which should be an address) and
1358### variations if +detail exists: +* and without +detail
1359###
1360### Parameters:
1361### <$1> -- key
1362### <$2> -- default (what to return if not found in db)
1363### <$3> -- mark (must be <(!|+) single-token>)
1364### ! does lookup only with tag
1365### + does lookup with and without tag
1366### <$4> -- passthru (additional data passed unchanged through)
1367######################################################################
1368
1369SF
1370R<$+> <$*> <$- $-> <$*> $: <$(access $4:$1 $: ? $)> <$1> <$2> <$3 $4> <$5>
1371R<?> <$+> <$*> <+ $-> <$*> $: <$(access $1 $: ? $)> <$1> <$2> <+ $3> <$4>
1372R<?> <$+ + $* @ $+> <$*> <$- $-> <$*>
1373 $: <$(access $6:$1+*@$3 $: ? $)> <$1+$2@$3> <$4> <$5 $6> <$7>
1374R<?> <$+ + $* @ $+> <$*> <+ $-> <$*>
1375 $: <$(access $1+*@$3 $: ? $)> <$1+$2@$3> <$4> <+ $5> <$6>
1376R<?> <$+ + $* @ $+> <$*> <$- $-> <$*>
1377 $: <$(access $6:$1@$3 $: ? $)> <$1+$2@$3> <$4> <$5 $6> <$7>
1378R<?> <$+ + $* @ $+> <$*> <+ $-> <$*>
1379 $: <$(access $1@$3 $: ? $)> <$1+$2@$3> <$4> <+ $5> <$6>
1380R<?> <$+> <$*> <$- $-> <$*> $@ <$2> <$5>
1381R<$+ <TMPF>> <$*> <$- $-> <$*> $@ <<TMPF>> <$5>
1382R<$+> <$*> <$- $-> <$*> $@ <$1> <$5>
1383
1384######################################################################
1385### E: LookUpExact -- search for an entry in access database
1386###
1387### Parameters:
1388### <$1> -- key
1389### <$2> -- default (what to return if not found in db)
1390### <$3> -- mark (must be <(!|+) single-token>)
1391### ! does lookup only with tag
1392### + does lookup with and without tag
1393### <$4> -- passthru (additional data passed unchanged through)
1394######################################################################
1395
1396SE
1397R<$*> <$*> <$- $-> <$*> $: <$(access $4:$1 $: ? $)> <$1> <$2> <$3 $4> <$5>
1398R<?> <$+> <$*> <+ $-> <$*> $: <$(access $1 $: ? $)> <$1> <$2> <+ $3> <$4>
1399R<?> <$+> <$*> <$- $-> <$*> $@ <$2> <$5>
1400R<$+ <TMPF>> <$*> <$- $-> <$*> $@ <<TMPF>> <$5>
1401R<$+> <$*> <$- $-> <$*> $@ <$1> <$5>
1402
1403######################################################################
1404### U: LookUpUser -- search for an entry in access database
1405###
1406### lookup of key (which should be a local part) and
1407### variations if +detail exists: +* and without +detail
1408###
1409### Parameters:
1410### <$1> -- key (user@)
1411### <$2> -- default (what to return if not found in db)
1412### <$3> -- mark (must be <(!|+) single-token>)
1413### ! does lookup only with tag
1414### + does lookup with and without tag
1415### <$4> -- passthru (additional data passed unchanged through)
1416######################################################################
1417
1418SU
1419R<$+> <$*> <$- $-> <$*> $: <$(access $4:$1 $: ? $)> <$1> <$2> <$3 $4> <$5>
1420R<?> <$+> <$*> <+ $-> <$*> $: <$(access $1 $: ? $)> <$1> <$2> <+ $3> <$4>
1421R<?> <$+ + $* @> <$*> <$- $-> <$*>
1422 $: <$(access $5:$1+*@ $: ? $)> <$1+$2@> <$3> <$4 $5> <$6>
1423R<?> <$+ + $* @> <$*> <+ $-> <$*>
1424 $: <$(access $1+*@ $: ? $)> <$1+$2@> <$3> <+ $4> <$5>
1425R<?> <$+ + $* @> <$*> <$- $-> <$*>
1426 $: <$(access $5:$1@ $: ? $)> <$1+$2@> <$3> <$4 $5> <$6>
1427R<?> <$+ + $* @> <$*> <+ $-> <$*>
1428 $: <$(access $1@ $: ? $)> <$1+$2@> <$3> <+ $4> <$5>
1429R<?> <$+> <$*> <$- $-> <$*> $@ <$2> <$5>
1430R<$+ <TMPF>> <$*> <$- $-> <$*> $@ <<TMPF>> <$5>
1431R<$+> <$*> <$- $-> <$*> $@ <$1> <$5>
1432
1433######################################################################
1434### SearchList: search a list of items in the access map
1435### Parameters:
1436### <exact tag> $| <mark:address> <mark:address> ... <>
1437### where "exact" is either "+" or "!":
1438### <+ TAG> lookup with and w/o tag
1439### <! TAG> lookup with tag
1440### possible values for "mark" are:
1441### D: recursive host lookup (LookUpDomain)
1442### E: exact lookup, no modifications
1443### F: full lookup, try user+ext@domain and user@domain
1444### U: user lookup, try user+ext and user (input must have trailing @)
1445### return: <RHS of lookup> or <?> (not found)
1446######################################################################
1447
1448# class with valid marks for SearchList
1449C{Src}E F D U
1450SSearchList
1451# just call the ruleset with the name of the tag... nice trick...
1452R<$+> $| <$={Src}:$*> <$*> $: <$1> $| <$4> $| $>$2 <$3> <?> <$1> <>
1453R<$+> $| <> $| <?> <> $@ <?>
1454R<$+> $| <$+> $| <?> <> $@ $>SearchList <$1> $| <$2>
1455R<$+> $| <$*> $| <$+> <> $@ <$3>
1456R<$+> $| <$+> $@ <$2>
1457
1458
1459######################################################################
1460### trust_auth: is user trusted to authenticate as someone else?
1461###
1462### Parameters:
1463### $1: AUTH= parameter from MAIL command
1464######################################################################
1465
1466SLocal_trust_auth
1467Strust_auth
1468R$* $: $&{auth_type} $| $1
1469# required by RFC 2554 section 4.
1470R$@ $| $* $#error $@ 5.7.1 $: "550 not authenticated"
1471R$* $| $&{auth_authen} $@ identical
1472R$* $| <$&{auth_authen}> $@ identical
1473R$* $| $* $: $1 $| $>"Local_trust_auth" $2
1474R$* $| $#$* $#$2
1475R$* $#error $@ 5.7.1 $: "550 " $&{auth_authen} " not allowed to act as " $&{auth_author}
1476
1477######################################################################
1478### Relay_Auth: allow relaying based on authentication?
1479###
1480### Parameters:
1481### $1: ${auth_type}
1482######################################################################
1483SLocal_Relay_Auth
1484
1485######################################################################
1486### srv_features: which features to offer to a client?
1487### (done in server)
1488######################################################################
1489Ssrv_features
1490R$* $: $>D <$&{client_name}> <?> <! "Srv_Features"> <>
1491R<?>$* $: $>A <$&{client_addr}> <?> <! "Srv_Features"> <>
1492R<?>$* $: <$(access "Srv_Features": $: ? $)>
1493R<?>$* $@ OK
1494R<$* <TMPF>>$* $#temp
1495R<$+>$* $# $1
1496
1497######################################################################
1498### try_tls: try to use STARTTLS?
1499### (done in client)
1500######################################################################
1501Stry_tls
1502R$* $: $>D <$&{server_name}> <?> <! "Try_TLS"> <>
1503R<?>$* $: $>A <$&{server_addr}> <?> <! "Try_TLS"> <>
1504R<?>$* $: <$(access "Try_TLS": $: ? $)>
1505R<?>$* $@ OK
1506R<$* <TMPF>>$* $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1507R<NO>$* $#error $@ 5.7.1 $: "550 do not try TLS with " $&{server_name} " ["$&{server_addr}"]"
1508
1509######################################################################
1510### tls_rcpt: is connection with server "good" enough?
1511### (done in client, per recipient)
1512###
1513### Parameters:
1514### $1: recipient
1515######################################################################
1516Stls_rcpt
1517R$* $: $(macro {TLS_Name} $@ $&{server_name} $) $1
1518R$+ $: <?> $>CanonAddr $1
1519R<?> $+ < @ $+ . > <?> $1 <@ $2 >
1520R<?> $+ < @ $+ > $: $1 <@ $2 > $| <F:$1@$2> <U:$1@> <D:$2> <E:>
1521R<?> $+ $: $1 $| <U:$1@> <E:>
1522R$* $| $+ $: $1 $| $>SearchList <! "TLS_Rcpt"> $| $2 <>
1523R$* $| <?> $@ OK
1524R$* $| <$* <TMPF>> $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1525R$* $| <$+> $@ $>"TLS_connection" $&{verify} $| <$2>
1526
1527######################################################################
1528### tls_client: is connection with client "good" enough?
1529### (done in server)
1530###
1531### Parameters:
1532### ${verify} $| (MAIL|STARTTLS)
1533######################################################################
1534Stls_client
1535R$* $: $(macro {TLS_Name} $@ $&{client_name} $) $1
1536R$* $| $* $: $1 $| $>D <$&{client_name}> <?> <! "TLS_Clt"> <>
1537R$* $| <?>$* $: $1 $| $>A <$&{client_addr}> <?> <! "TLS_Clt"> <>
1538R$* $| <?>$* $: $1 $| <$(access "TLS_Clt": $: ? $)>
1539R$* $| <$* <TMPF>> $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1540R$* $@ $>"TLS_connection" $1
1541
1542######################################################################
1543### tls_server: is connection with server "good" enough?
1544### (done in client)
1545###
1546### Parameter:
1547### ${verify}
1548######################################################################
1549Stls_server
1550R$* $: $(macro {TLS_Name} $@ $&{server_name} $) $1
1551R$* $: $1 $| $>D <$&{server_name}> <?> <! "TLS_Srv"> <>
1552R$* $| <?>$* $: $1 $| $>A <$&{server_addr}> <?> <! "TLS_Srv"> <>
1553R$* $| <?>$* $: $1 $| <$(access "TLS_Srv": $: ? $)>
1554R$* $| <$* <TMPF>> $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
1555R$* $@ $>"TLS_connection" $1
1556
1557######################################################################
1558### TLS_connection: is TLS connection "good" enough?
1559###
1560### Parameters:
1561### ${verify} $| <Requirement> [<>]
1562### Requirement: RHS from access map, may be ? for none.
1563######################################################################
1564STLS_connection
1565R$* $| <$*>$* $: $1 $| <$2>
1566# create the appropriate error codes
1567R$* $| <PERM + $={Tls} $*> $: $1 $| <503:5.7.0> <$2 $3>
1568R$* $| <TEMP + $={Tls} $*> $: $1 $| <403:4.7.0> <$2 $3>
1569R$* $| <$={Tls} $*> $: $1 $| <403:4.7.0> <$2 $3>
1570# deal with TLS handshake failures: abort
1571RSOFTWARE $| <$-:$+> $* $#error $@ $2 $: $1 " TLS handshake failed."
1572RSOFTWARE $| $* $#error $@ 4.7.0 $: "403 TLS handshake failed."
1573# deal with TLS protocol errors: abort
1574RPROTOCOL $| <$-:$+> $* $#error $@ $2 $: $1 " STARTTLS failed."
1575RPROTOCOL $| $* $#error $@ 4.7.0 $: "403 STARTTLS failed."
1576R$* $| <$*> <VERIFY> $: <$2> <VERIFY> <> $1
1577R$* $| <$*> <VERIFY + $+> $: <$2> <VERIFY> <$3> $1
1578R$* $| <$*> <$={Tls}:$->$* $: <$2> <$3:$4> <> $1
1579R$* $| <$*> <$={Tls}:$- + $+>$* $: <$2> <$3:$4> <$5> $1
1580R$* $| $* $@ OK
1581# authentication required: give appropriate error
1582# other side did authenticate (via STARTTLS)
1583R<$*><VERIFY> <> OK $@ OK
1584R<$*><VERIFY> <$+> OK $: <$1> <REQ:0> <$2>
1585R<$*><VERIFY:$-> <$*> OK $: <$1> <REQ:$2> <$3>
1586R<$*><ENCR:$-> <$*> $* $: <$1> <REQ:$2> <$3>
1587R<$-:$+><VERIFY $*> <$*> $#error $@ $2 $: $1 " authentication required"
1588R<$-:$+><VERIFY $*> <$*> FAIL $#error $@ $2 $: $1 " authentication failed"
1589R<$-:$+><VERIFY $*> <$*> NO $#error $@ $2 $: $1 " not authenticated"
1590R<$-:$+><VERIFY $*> <$*> NOT $#error $@ $2 $: $1 " no authentication requested"
1591R<$-:$+><VERIFY $*> <$*> NONE $#error $@ $2 $: $1 " other side does not support STARTTLS"
1592R<$-:$+><VERIFY $*> <$*> $+ $#error $@ $2 $: $1 " authentication failure " $4
1593R<$*><REQ:$-> <$*> $: <$1> <REQ:$2> <$3> $>max $&{cipher_bits} : $&{auth_ssf}
1594R<$*><REQ:$-> <$*> $- $: <$1> <$2:$4> <$3> $(arith l $@ $4 $@ $2 $)
1595R<$-:$+><$-:$-> <$*> TRUE $#error $@ $2 $: $1 " encryption too weak " $4 " less than " $3
1596R<$-:$+><$-:$-> <$*> $* $: <$1:$2 ++ $5>
1597R<$-:$+ ++ > $@ OK
1598R<$-:$+ ++ $+ > $: <$1:$2> <$3>
1599R<$-:$+> < $+ ++ $+ > <$1:$2> <$3> <$4>
1600R<$-:$+> $+ $@ $>"TLS_req" $3 $| <$1:$2>
1601
1602######################################################################
1603### TLS_req: check additional TLS requirements
1604###
1605### Parameters: [<list> <of> <req>] $| <$-:$+>
1606### $-: SMTP reply code
1607### $+: Enhanced Status Code
1608######################################################################
1609STLS_req
1610R $| $+ $@ OK
1611R<CN> $* $| <$+> $: <CN:$&{TLS_Name}> $1 $| <$2>
1612R<CN:$&{cn_subject}> $* $| <$+> $@ $>"TLS_req" $1 $| <$2>
1613R<CN:$+> $* $| <$-:$+> $#error $@ $4 $: $3 " CN " $&{cn_subject} " does not match " $1
1614R<CS:$&{cert_subject}> $* $| <$+> $@ $>"TLS_req" $1 $| <$2>
1615R<CS:$+> $* $| <$-:$+> $#error $@ $4 $: $3 " Cert Subject " $&{cert_subject} " does not match " $1
1616R<CI:$&{cert_issuer}> $* $| <$+> $@ $>"TLS_req" $1 $| <$2>
1617R<CI:$+> $* $| <$-:$+> $#error $@ $4 $: $3 " Cert Issuer " $&{cert_issuer} " does not match " $1
1618ROK $@ OK
1619
1620######################################################################
1621### max: return the maximum of two values separated by :
1622###
1623### Parameters: [$-]:[$-]
1624######################################################################
1625Smax
1626R: $: 0
1627R:$- $: $1
1628R$-: $: $1
1629R$-:$- $: $(arith l $@ $1 $@ $2 $) : $1 : $2
1630RTRUE:$-:$- $: $2
1631R$-:$-:$- $: $2
1632
1633
1634######################################################################
1635### RelayTLS: allow relaying based on TLS authentication
1636###
1637### Parameters:
1638### none
1639######################################################################
1640SRelayTLS
1641# authenticated?
1642R$* $: <?> $&{verify}
1643R<?> OK $: OK authenticated: continue
1644R<?> $* $@ NO not authenticated
1645R$* $: $&{cert_issuer}
1646R$+ $: $(access CERTISSUER:$1 $)
1647RRELAY $# RELAY
1648RSUBJECT $: <@> $&{cert_subject}
1649R<@> $+ $: <@> $(access CERTSUBJECT:$1 $)
1650R<@> RELAY $# RELAY
1651R$* $: NO
1652
1653######################################################################
1654### authinfo: lookup authinfo in the access map
1655###
1656### Parameters:
1657### $1: {server_name}
1658### $2: {server_addr}
1659######################################################################
1660Sauthinfo
1661R$* $: $1 $| $>D <$&{server_name}> <?> <! AuthInfo> <>
1662R$* $| <?>$* $: $1 $| $>A <$&{server_addr}> <?> <! AuthInfo> <>
1663R$* $| <?>$* $: $1 $| <$(access AuthInfo: $: ? $)> <>
1664R$* $| <?>$* $@ no no authinfo available
1665R$* $| <$*> <> $# $2
1666
1667
1668
1669
1670
1671
1672
1673
1674HMessage-Id: $>CheckMessageId
1675
1676SCheckMessageId
1677R< $+ @ $+ > $@ OK
1678R$* $#error $: 553 Header Error
1679#
1680######################################################################
1681######################################################################
1682#####
1683##### MAIL FILTER DEFINITIONS
1684#####
1685######################################################################
1686######################################################################
1687
1688#
1689######################################################################
1690######################################################################
1691#####
1692##### MAILER DEFINITIONS
1693#####
1694######################################################################
1695######################################################################
1696
1697
1698##################################################
1699### Local and Program Mailer specification ###
1700##################################################
1701
1702##### $Sendmail: local.m4,v 8.59 2004/11/23 00:37:25 ca Exp $ #####
1703
1704#
1705# Envelope sender rewriting
1706#
1707SEnvFromL
1708R<@> $n errors to mailer-daemon
1709R@ <@ $*> $n temporarily bypass Sun bogosity
1710R$+ $: $>AddDomain $1 add local domain if needed
1711R$* $: $>MasqEnv $1 do masquerading
1712
1713#
1714# Envelope recipient rewriting
1715#
1716SEnvToL
1717R$+ < @ $* > $: $1 strip host part
1718R$+ + $* $: < $&{addr_type} > $1 + $2 mark with addr type
1719R<e s> $+ + $* $: $1 remove +detail for sender
1720R< $* > $+ $: $2 else remove mark
1721
1722#
1723# Header sender rewriting
1724#
1725SHdrFromL
1726R<@> $n errors to mailer-daemon
1727R@ <@ $*> $n temporarily bypass Sun bogosity
1728R$+ $: $>AddDomain $1 add local domain if needed
1729R$* $: $>MasqHdr $1 do masquerading
1730
1731#
1732# Header recipient rewriting
1733#
1734SHdrToL
1735R$+ $: $>AddDomain $1 add local domain if needed
1736R$* < @ *LOCAL* > $* $: $1 < @ $j . > $2
1737
1738#
1739# Common code to add local domain name (only if always-add-domain)
1740#
1741SAddDomain
1742R$* < @ $* > $* $@ $1 < @ $2 > $3 already fully qualified
1743
1744R$+ $@ $1 < @ *LOCAL* > add local qualification
1745
1746Mlocal, P=/usr/libexec/mail.local, F=lsDFMAw5:/|@qrmn9S, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL,
1747 T=DNS/RFC822/X-Unix,
1748 A=mail -d $u
1749Mprog, P=/bin/sh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/,
1750 T=X-Unix/X-Unix/X-Unix,
1751 A=sh -c $u
1752
1753#####################################
1754### SMTP Mailer specification ###
1755#####################################
1756
1757##### $Sendmail: smtp.m4,v 8.65 2006/07/12 21:08:10 ca Exp $ #####
1758
1759#
1760# common sender and masquerading recipient rewriting
1761#
1762SMasqSMTP
1763R$* < @ $* > $* $@ $1 < @ $2 > $3 already fully qualified
1764R$+ $@ $1 < @ *LOCAL* > add local qualification
1765
1766#
1767# convert pseudo-domain addresses to real domain addresses
1768#
1769SPseudoToReal
1770
1771# pass <route-addr>s through
1772R< @ $+ > $* $@ < @ $1 > $2 resolve <route-addr>
1773
1774# output fake domains as user%fake@relay
1775
1776
1777#
1778# envelope sender rewriting
1779#
1780SEnvFromSMTP
1781R$+ $: $>PseudoToReal $1 sender/recipient common
1782R$* :; <@> $@ list:; special case
1783R$* $: $>MasqSMTP $1 qualify unqual'ed names
1784R$+ $: $>MasqEnv $1 do masquerading
1785
1786
1787#
1788# envelope recipient rewriting --
1789# also header recipient if not masquerading recipients
1790#
1791SEnvToSMTP
1792R$+ $: $>PseudoToReal $1 sender/recipient common
1793R$+ $: $>MasqSMTP $1 qualify unqual'ed names
1794R$* < @ *LOCAL* > $* $: $1 < @ $j . > $2
1795
1796#
1797# header sender and masquerading header recipient rewriting
1798#
1799SHdrFromSMTP
1800R$+ $: $>PseudoToReal $1 sender/recipient common
1801R:; <@> $@ list:; special case
1802
1803# do special header rewriting
1804R$* <@> $* $@ $1 <@> $2 pass null host through
1805R< @ $* > $* $@ < @ $1 > $2 pass route-addr through
1806R$* $: $>MasqSMTP $1 qualify unqual'ed names
1807R$+ $: $>MasqHdr $1 do masquerading
1808
1809
1810#
1811# relay mailer header masquerading recipient rewriting
1812#
1813SMasqRelay
1814R$+ $: $>MasqSMTP $1
1815R$+ $: $>MasqHdr $1
1816
1817Msmtp, P=[IPC], F=mDFMuX, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\n, L=990,
1818 T=DNS/RFC822/SMTP,
1819 A=TCP $h
1820Mesmtp, P=[IPC], F=mDFMuXa, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\n, L=990,
1821 T=DNS/RFC822/SMTP,
1822 A=TCP $h
1823Msmtp8, P=[IPC], F=mDFMuX8, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\n, L=990,
1824 T=DNS/RFC822/SMTP,
1825 A=TCP $h
1826Mdsmtp, P=[IPC], F=mDFMuXa%, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\n, L=990,
1827 T=DNS/RFC822/SMTP,
1828 A=TCP $h
1829Mrelay, P=[IPC], F=mDFMuXa8, S=EnvFromSMTP/HdrFromSMTP, R=MasqSMTP, E=\r\n, L=2040,
1830 T=DNS/RFC822/SMTP,
1831 A=TCP $h
1832
1833### openbsd-proto.mc ###
1834# divert(-1)
1835# #
1836# # Default OpenBSD sendmail configuration for systems accepting mail
1837# # from the internet.
1838# #
1839# # Note that lines beginning with "dnl" below are comments.
1840#
1841# divert(0)dnl
1842# VERSIONID(`@(#)openbsd-proto.mc $Revision: 1.12 $')dnl
1843# OSTYPE(openbsd)dnl
1844# dnl
1845# dnl If you have a non-static IP address you may wish to forward outgoing mail
1846# dnl through your ISP's mail server to prevent matching one of the dialup
1847# dnl DNS black holes. Just uncomment the following line and replace
1848# dnl mail.myisp.net with the hostname of your ISP's mail server.
1849# dnl
1850# dnl define(`SMART_HOST', `mail.myisp.net')dnl
1851# dnl
1852# dnl Disable EXPN and VRFY to help thwart address harvesters and require
1853# dnl senders to say hello.
1854# dnl
1855# define(`confPRIVACY_FLAGS', `authwarnings,needmailhelo,noexpn,novrfy,nobodyreturn')dnl
1856# dnl
1857# dnl We wish to make the existence of the local-host-names and
1858# dnl trusted-users files optional, hence the "-o" below.
1859# dnl
1860# define(`confCW_FILE', `-o MAIL_SETTINGS_DIR`'local-host-names')dnl
1861# define(`confCT_FILE', `-o MAIL_SETTINGS_DIR`'trusted-users')dnl
1862# dnl
1863# dnl Use of UUCP-style addresses in the modern internet are generally
1864# dnl an error (and sometimes used by spammers) so disable support for them.
1865# dnl To simply treat '!' as a normal character, change `reject' to
1866# dnl `nospecial'.
1867# dnl
1868# FEATURE(nouucp, `reject')dnl
1869# dnl
1870# dnl The access database allows for certain actions to be taken based on
1871# dnl the source address.
1872# dnl
1873# FEATURE(`access_db', `hash -o -T<TMPF> /etc/mail/access')dnl
1874# FEATURE(`blacklist_recipients')dnl
1875# dnl
1876# dnl Enable support for /etc/mail/local-host-names.
1877# dnl Contains hostnames that should be considered local.
1878# dnl
1879# FEATURE(`use_cw_file')dnl
1880# dnl
1881# dnl Enable support for /etc/mail/mailertable.
1882# dnl
1883# FEATURE(`mailertable', `hash -o /etc/mail/mailertable')dnl
1884# dnl
1885# dnl Enable support for /etc/mail/trusted-users.
1886# dnl Users listed herein may spoof mail from other users.
1887# dnl
1888# FEATURE(`use_ct_file')dnl
1889# dnl
1890# dnl Enable support for /etc/mail/virtusertable.
1891# dnl Used to do N -> N address mapping.
1892# dnl
1893# FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable')dnl
1894# dnl
1895# dnl Rewrite (unqualified) outgoing email addresses using the
1896# dnl mapping listed in /etc/mail/genericstable
1897# dnl
1898# FEATURE(genericstable, `hash -o /etc/mail/genericstable')dnl
1899# dnl
1900# dnl Normally only local addresses are rewritten. By using
1901# dnl generics_entire_domain and either GENERICS_DOMAIN
1902# dnl or GENERICS_DOMAIN_FILE addresses from hosts in the
1903# dnl specified domain(s) will be rewritten too.
1904# dnl
1905# dnl FEATURE(generics_entire_domain)dnl
1906# dnl GENERICS_DOMAIN(`othercompany.com')dnl
1907# dnl GENERICS_DOMAIN_FILE(`/etc/mail/generics-domains')dnl
1908# dnl
1909# dnl Include the local host domain even on locally delivered mail
1910# dnl (which would otherwise contain only the username).
1911# FEATURE(always_add_domain)dnl
1912# dnl
1913# dnl Bounce messages addressed to "address.REDIRECT". This allows the
1914# dnl admin to alias a user who has moved to "new_address.REDIRECT" so
1915# dnl that senders will know the user's new address.
1916# FEATURE(redirect)dnl
1917# dnl
1918# dnl Accept incoming connections on any IPv4 or IPv6 interface for ports
1919# dnl 25 (SMTP) and 587 (MSA).
1920# dnl
1921# FEATURE(`no_default_msa')dnl
1922# ifdef(`LOCALHOST_ONLY', `
1923# DAEMON_OPTIONS(`Family=inet, address=127.0.0.1, Name=MTA')dnl
1924# DAEMON_OPTIONS(`Family=inet6, address=::1, Name=MTA6, M=O')dnl
1925# DAEMON_OPTIONS(`Family=inet, address=127.0.0.1, Port=587, Name=MSA, M=E')dnl
1926# DAEMON_OPTIONS(`Family=inet6, address=::1, Port=587, Name=MSA6, M=O, M=E')dnl
1927# ',`
1928# DAEMON_OPTIONS(`Family=inet, Address=0.0.0.0, Name=MTA')dnl
1929# DAEMON_OPTIONS(`Family=inet6, Address=::, Name=MTA6, M=O')dnl
1930# DAEMON_OPTIONS(`Family=inet, Address=0.0.0.0, Port=587, Name=MSA, M=E')dnl
1931# DAEMON_OPTIONS(`Family=inet6, Address=::, Port=587, Name=MSA6, M=O, M=E')dnl
1932# ')dnl
1933# dnl
1934# dnl Use either IPv4 or IPv6 for outgoing connections.
1935# dnl
1936# CLIENT_OPTIONS(`Family=inet, Address=0.0.0.0')dnl
1937# CLIENT_OPTIONS(`Family=inet6, Address=::')dnl
1938# dnl
1939# dnl Some broken nameservers will return SERVFAIL (a temporary failure)
1940# dnl on T_AAAA (IPv6) lookups.
1941# dnl
1942# define(`confBIND_OPTS', `WorkAroundBrokenAAAA')dnl
1943# dnl
1944# dnl TLS/SSL support; uncomment and read starttls(8) to use.
1945# dnl
1946# dnl define(`CERT_DIR', `MAIL_SETTINGS_DIR`'certs')dnl
1947# dnl define(`confCACERT_PATH', `CERT_DIR')dnl
1948# dnl define(`confCACERT', `CERT_DIR/mycert.pem')dnl
1949# dnl define(`confSERVER_CERT', `CERT_DIR/mycert.pem')dnl
1950# dnl define(`confSERVER_KEY', `CERT_DIR/mykey.pem')dnl
1951# dnl define(`confCLIENT_CERT', `CERT_DIR/mycert.pem')dnl
1952# dnl define(`confCLIENT_KEY', `CERT_DIR/mykey.pem')dnl
1953# dnl
1954# dnl Masquerading -- rewriting the From address to a specific domain.
1955# dnl Please see the "MASQUERADING AND RELAYING" section of
1956# dnl /usr/share/sendmail/README for details.
1957# dnl
1958# dnl MASQUERADE_AS(`mycompany.com')dnl
1959# dnl
1960# dnl Masquerade the envelope From in addition to the From: header.
1961# dnl
1962# dnl FEATURE(masquerade_envelope)dnl
1963# dnl
1964# dnl Masquerade host.sub.dom.ain as well as host.dom.ain.
1965# dnl
1966# dnl FEATURE(masquerade_entire_domain)dnl
1967# dnl
1968# dnl Only masquerade messages going outside the local domain.
1969# dnl
1970# dnl FEATURE(local_no_masquerade)dnl
1971# dnl
1972# dnl Rewrite addresses from user@othercompany.com when relayed in
1973# dnl addition to locally-generated messages.
1974# dnl
1975# dnl MASQUERADE_DOMAIN(`othercompany.com')dnl
1976# dnl
1977# dnl Specific hosts that should be excepted from MASQUERADE_DOMAIN.
1978# dnl
1979# dnl MASQUERADE_EXCEPTION(`host.othercompany.com')dnl
1980# dnl
1981# dnl Only masquerade for hosts listed by MASQUERADE_DOMAIN
1982# dnl (normally any host considered local is also masqueraded).
1983# dnl
1984# dnl FEATURE(limited_masquerade)dnl
1985# dnl
1986# dnl Specific users that should be excepted from masquerading.
1987# dnl
1988# dnl EXPOSED_USER(`root')dnl
1989# dnl EXPOSED_USER(`daemon')dnl
1990# dnl EXPOSED_USER_FILE(`/etc/mail/exposed-users')dnl
1991# dnl
1992# dnl End of masquerading section.
1993# MAILER(local)dnl
1994# MAILER(smtp)dnl
1995# dnl
1996# dnl Enforce valid Message-Id to help stop spammers.
1997# dnl
1998# LOCAL_RULESETS
1999# HMessage-Id: $>CheckMessageId
2000#
2001# SCheckMessageId
2002# R< $+ @ $+ > $@ OK
2003# R$* $#error $: 553 Header Error