Postfix official version 1.1 patch 09 available

Postfix 1.1 patch 09 brings you the usual minor fixes that also
appeared in recent snapshots, plus a change that closes an obscure
relaying loophole with user@[email protected]
addresses for virtual domains with @domain.name catch-all patterns.

This change introduces a new parameter, with backwards compatible
default settings. To allow Postfix to receive user@domain@domain
addresses, specify "resolve_dequoted_address = no" in main.cf (quote
the address localpart as per RFC 822, don't look for @ etc.  inside
the address localpart).  Although this is technically more correct,
it also opens opportunities for mail relay attacks when Postfix
provides backup MX service for Sendmail systems.

For the other minor changes, see the HISTORY file extract below.

Available from ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/

       11893 May 13 17:59 postfix-1.1-patch09.gz
      217323 May 13 16:10 postfix-1.1.9.HISTORY
       53697 May 13 16:11 postfix-1.1.9.RELEASE_NOTES
     1190272 May 13 17:51 postfix-1.1.9.tar.gz
	 152 May 13 17:51 postfix-1.1.9.tar.gz.sig

You can also point your browser at:

    ftp://ftp.porcupine.org/mirrors/postfix-release/index.html

Soon to appear on the mirror sites listed on www.postfix.org.

        Wietse

Extract from the RELEASE_NOTES file:

    Incompatible changes with Postfix version 1.1.9 (released 20020513)
    ===================================================================

    The Postfix SMTP server by default no longer accepts mail for
    user@[email protected], to close a relaying
    loophole with postfix-style virtual domains that have @domain.name
    catch-all patterns. 

    To allow such addresses, specify "resolve_dequoted_address = no"
    in main.cf (quote the address localpart as per RFC 822, and don't
    look for @ or % or !  characters inside the address localpart).
    However, this opens opportunities for obscure mail relay attacks
    when Postfix provides backup MX service for Sendmail systems.

    The appearance of user@domain1@domain2 addresses has changed.  In
    mail headers, such addresses are now properly quoted as
    "user@domain1"@domain2. As a side effect, this quoted form is now
    also expected on the left-hand side of virtual and canonical lookup
    tables, but only by some of the Postfix components.  For now, it
    is better not to use user@domain1@domain2 address forms on the
    left-hand side of lookup tables.

Extract from the HISTORY file:

20020508

        Bugfix: close user@[email protected]
        source routing relaying loophole involving postfix-style
        virtual domains with @virtual.domain catch-all patterns.
        Problem reported by Victor Duchovny. File:  smtpd/smtpd_check.c.

        Bugfix: mail_addr_map() used the "wrong" @ character in
        addresses with multiple @. Victor Duchovny. File:
        global/mail_addr_map.c.

        Bugfix: for address localpart quoting, now quote @ as a
        special character everywhere, except when resolving addresses.
        Previously, the @ was nowhere quoted as a special character,
        not even in SMTP commands.  Files:  global/quote_82[12]_local.c
        and some clients.

20020509

        Safety: don't allow an OK access rule lookup result for
        user@[email protected]. Suggested by
        Victor Duchovny, Morgan Stanley. File: smtpd/smtpd_check.c.

        Bugfix: quote unquoted address localparts that need quoting.
        Files: global/tok822_parse.c, global/quote_82[12]_local.c.

20020512

        Cleanup: the SMTP client logged and bounced the CNAME
        expanded recipient address, and thereby complicated trouble
        shooting.  File:  src/smtp_proto.c.

        Bugfix: the SMTP and LMTP clients bounced the quoted
        recipient address, resulting in too much quoting in bounce
        reports.  Files:  src/smtp_proto.c, lmtp/lmtp_proto.c.

20020513

        Bugfix: the LDAP client used the "wrong" @ character in
        addresses with multiple @. LaMont Jones, HP. File:
        util/dict_ldap.c.

        Compatibility: forwards "postqueue -r" compatibility with
        the additional queue file records that are stored by snapshot
        20050512.

        Cleanup: specify "resolve_dequoted_address = no" to prevent
        Postfix from looking inside quotes for extra @ etc. characters
        when resolving an address. This behavior is technically
        more correct, but it opens a mail relay loophole with "user
        @domain"@domain when relaying mail to a Sendmail system.