Subject: PATCH: recipient addresses starting with `-'

From: [email-masked] (Wietse Venema)
Date: Wed, 22 Sep 1999 13:32:06 -0400 (EDT)

By default, Postfix performs all mail deliveries by itself, both
locally and via the network.

For specific destinations, the system administrator can configure
Postfix to delegate delivery to external commands.  Examples of
commonly-used external delivery channels are cyrus IMAP, and UUCP.

The interface to external commands often involves passing the
recipient address on the command line. Unless sufficient care is
taken, an external command can misinterpret a recipient address
that starts with `-' as a command-line option.

In theory it would be sufficient for me to say people should always
carefully set up their master.cf pipe command entries with `--'
before the first non-option argument, but mistakes will be made.

Instead it seems safer to always reject recipient addresses starting
with `-' so that they will never be passed on to external commands.

The patch below modifies the Postfix queue manager so that recipient
address starting with `-' will always be bounced. 

An updated Postfix release, postfix-19990906-pl03, is being uploaded
to ftp://ftp.porcupine.org/mirrors/postfix-release/ and is expected
to appear soon on the FTP mirror sites.

Credits to Mads Kiilerich for pointing out the problem.

	Wietse

Prereq: "Postfix-19990906-pl02"
*** ./global/mail_version.h-	Tue Sep  7 15:17:39 1999
--- ./global/mail_version.h	Wed Sep 22 12:34:40 1999
***************
*** 15,21 ****
    * Version of this program.
    */
  #define VAR_MAIL_VERSION	"mail_version"
! #define DEF_MAIL_VERSION	"Postfix-19990906-pl02"
  extern char *var_mail_version;
  
  /* LICENSE
--- 15,21 ----
    * Version of this program.
    */
  #define VAR_MAIL_VERSION	"mail_version"
! #define DEF_MAIL_VERSION	"Postfix-19990906-pl03"
  extern char *var_mail_version;
  
  /* LICENSE
*** ./qmgr/qmgr_message.c-	Sat Sep  4 16:37:30 1999
--- ./qmgr/qmgr_message.c	Wed Sep 22 12:50:35 1999
***************
*** 490,495 ****
--- 490,513 ----
  	}
  
  	/*
+ 	 * Bounce recipient addresses that start with `-'. External commands
+ 	 * may misinterpret such addresses as command-line options.
+ 	 * 
+ 	 * In theory I could say people should always carefully set up their
+ 	 * master.cf pipe mailer entries with `--' before the first
+ 	 * non-option argument, but mistakes will happen regardless.
+ 	 * 
+ 	 * Therefore the protection is put in place here, in the queue manager,
+ 	 * where it cannot be bypassed.
+ 	 */
+ 	if (recipient->address[0] == '-') {
+ 	    qmgr_bounce_recipient(message, recipient,
+ 				  "invalid recipient syntax: \"%s\"",
+ 				  recipient->address);
+ 	    continue;
+ 	}
+ 
+ 	/*
  	 * Queues are identified by the transport name and by the next-hop
  	 * hostname. When the destination is local (no next hop), derive the
  	 * queue name from the recipient name. XXX Should split the address
*** ./postlock/postlock.c-	Sun Sep  5 18:09:24 1999
--- ./postlock/postlock.c	Wed Sep 22 12:37:09 1999
***************
*** 86,92 ****
  #include <unistd.h>
  #include <fcntl.h>
  #include <errno.h>
- #include <sysexits.h>
  
  /* Utility library. */
  
--- 86,91 ----
***************
*** 102,107 ****
--- 101,107 ----
  #include <dot_lockfile.h>
  #include <deliver_flock.h>
  #include <mail_conf.h>
+ #include <sys_exits.h>
  
  /* Application-specific. */
  
*** ./HISTORY-	Tue Sep  7 12:40:00 1999
--- ./HISTORY	Wed Sep 22 13:07:36 1999
***************
*** 3049,3051 ****
--- 3049,3063 ----
  
  	Bugfix: check_sender_access was recognized as a valid
  	restriction name only if a sender had been specified.
+ 
+ 19990908
+ 
+ 	Portability: Unixware has <sysexits.h> only after sendmail
+ 	is installed. Changed postlock.c to use global/sys_exists.h.
+ 
+ 19990922
+ 
+ 	Security: recipient addresses must not start with '-', in
+ 	order to protect external commands against surprises.
+ 	Credits to Mads Kiilerich @ Kiilerich.com.  File:
+ 	qmgr/qmgr_message.c.