milter: the level-2 limit and the client IP list hold for every message

Security fix, outside the inbound antispam feature. Found by its
technical review (Opus, 2026-10-12), reproduced on the test stand
before the fix: over an application's level-2 limit, two MAIL FROM on
one connection were answered 451 and then accepted.

Cause. Postfix introduces a client to a milter once per connection.
The milter library (go-milter 0.4.1, session.go) replaces the milter's
session after any reply that is not "continue" - a refusal, or the
accept that used to end a message. The new session never saw Connect,
so it had no client address, and both checks passed a message without
one: overLimit returned early ("no client IP to key on") and
authIPAllowed did the same. So every message after the first on a
connection, and every MAIL FROM after a refused one, skipped the
level-2 limit and an application's client IP list. In the code since
1.9.0 for the list and longer for the limit.

Fix.
  - build/postfix-config.sh: milter_mail_macros carries {client_addr},
    so the address comes with every MAIL FROM; MailFrom reads it (both
    spellings of IPv6) in the journal milter and the inbound journal
    milter.
  - overLimit no longer asks for a client address: a ceiling is on a
    domain or an application.
  - authIPAllowed refuses an application that has a client IP list when
    no address is known.
  - Body replies "continue" in both milters, which lets the message
    through as "accept" did and keeps the session.

The inbound journal milter had the same cause with a smaller effect:
rows of a connection's later messages had no client address.

In the same file, the checks of INBOUND_ANTISPAM_MILTER and
INBOUND_JOURNAL_MILTER_SOCKET refuse any character outside their set
first: a glob's "*" matched anything after the first characters.

Tests: a session that never saw Connect is judged by the macro, a
listed and an unlisted address, no address, not an address; the limit
with no client address; the inbound milter answers only "continue".
test/e2e sends two MAIL FROM on one connection over the limit and
wants both refused.

Checked on the test server: e2e red before the fix on exactly that
check, green after; go vet ./... ok, go test ./... ok (22 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/inbound_test.go

@@ -77,8 +77,8 @@ func TestInboundRecordsAcceptedMessage(t *testing.T) {
 	resp := message(t, s, "<sender@example.net> SIZE=1200",
 		[]string{"<a@in.example.com>", "b@IN.example.com"},
 		[][2]string{{"Subject", "=?utf-8?Q?Sch=C3=B6n?="}})
-	if resp != milter.RespAccept {
-		t.Errorf("end-of-message response = %v, want accept", resp)
+	if resp != milter.RespContinue {
+		t.Errorf("end-of-message response = %v, want continue", resp)
 	}
 	if len(rec.rows) != 2 {
 		t.Fatalf("rows = %+v, want one per recipient", rec.rows)
@@ -217,8 +217,8 @@ func TestInboundAcceptsWhenTheStoreFails(t *testing.T) {
 		"lookup": {lookupErr: errors.New("boom")},
 	} {
 		s := inboundSessionFor(t, rec, false)
-		if resp := message(t, s, "sender@example.net", []string{"a@in.example.com"}, nil); resp != milter.RespAccept {
-			t.Errorf("%s failure: response = %v, want accept", name, resp)
+		if resp := message(t, s, "sender@example.net", []string{"a@in.example.com"}, nil); resp != milter.RespContinue {
+			t.Errorf("%s failure: response = %v, want continue", name, resp)
 		}
 	}
 }
@@ -234,3 +234,46 @@ func TestRspamdVerdictKeepsTheListSymbols(t *testing.T) {
 		t.Errorf("detail = %q\nwant     %q", detail, want)
 	}
 }
+
+// The client address of a connection's later messages comes from the MAIL
+// macro: a session the library made after a non-continue reply saw no Connect.
+func TestInboundClientAddressFromTheMailMacro(t *testing.T) {
+	rec := &fakeInbound{domains: map[string]bool{"in.example.com": true}}
+	s := &inboundSession{rec: rec} // no Connect
+	if _, err := s.MailFrom("sender@example.net", mods(map[string]string{"{client_addr}": "IPv6:2001:db8::7"})); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.RcptTo("a@in.example.com", mods(nil)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.Body(mods(nil)); err != nil {
+		t.Fatal(err)
+	}
+	if len(rec.rows) != 1 || rec.rows[0].ClientIP != "2001:db8::7" {
+		t.Errorf("rows = %+v", rec.rows)
+	}
+}
+
+// No callback of the inbound milter answers anything but "continue": it must
+// never be the reason a message is held up, and a non-continue reply would
+// cost it its session.
+func TestInboundOnlyEverContinues(t *testing.T) {
+	rec := &fakeInbound{domains: map[string]bool{"in.example.com": true}}
+	s := &inboundSession{rec: rec, filter: true}
+	check := func(stage string, resp milter.Response, err error) {
+		t.Helper()
+		if err != nil || resp != milter.RespContinue {
+			t.Errorf("%s: %v, %v", stage, resp, err)
+		}
+	}
+	resp, err := s.Connect("mx", "tcp4", 0, net.ParseIP("203.0.113.7"), mods(nil))
+	check("connect", resp, err)
+	resp, err = s.MailFrom("a@example.net", mods(nil))
+	check("mail", resp, err)
+	resp, err = s.RcptTo("a@in.example.com", mods(nil))
+	check("rcpt", resp, err)
+	resp, err = s.Header("X-Rspamd-Action", "reject", mods(nil))
+	check("header", resp, err)
+	resp, err = s.Body(mods(nil))
+	check("end of message", resp, err)
+}