milter: the level-2 limit and the client IP list hold for every message

Security fix, outside the inbound antispam feature. Found by its
technical review (Opus, 2026-10-12), reproduced on the test stand
before the fix: over an application's level-2 limit, two MAIL FROM on
one connection were answered 451 and then accepted.

Cause. Postfix introduces a client to a milter once per connection.
The milter library (go-milter 0.4.1, session.go) replaces the milter's
session after any reply that is not "continue" - a refusal, or the
accept that used to end a message. The new session never saw Connect,
so it had no client address, and both checks passed a message without
one: overLimit returned early ("no client IP to key on") and
authIPAllowed did the same. So every message after the first on a
connection, and every MAIL FROM after a refused one, skipped the
level-2 limit and an application's client IP list. In the code since
1.9.0 for the list and longer for the limit.

Fix.
  - build/postfix-config.sh: milter_mail_macros carries {client_addr},
    so the address comes with every MAIL FROM; MailFrom reads it (both
    spellings of IPv6) in the journal milter and the inbound journal
    milter.
  - overLimit no longer asks for a client address: a ceiling is on a
    domain or an application.
  - authIPAllowed refuses an application that has a client IP list when
    no address is known.
  - Body replies "continue" in both milters, which lets the message
    through as "accept" did and keeps the session.

The inbound journal milter had the same cause with a smaller effect:
rows of a connection's later messages had no client address.

In the same file, the checks of INBOUND_ANTISPAM_MILTER and
INBOUND_JOURNAL_MILTER_SOCKET refuse any character outside their set
first: a glob's "*" matched anything after the first characters.

Tests: a session that never saw Connect is judged by the macro, a
listed and an unlisted address, no address, not an address; the limit
with no client address; the inbound milter answers only "continue".
test/e2e sends two MAIL FROM on one connection over the limit and
wants both refused.

Checked on the test server: e2e red before the fix on exactly that
check, green after; go vet ./... ok, go test ./... ok (22 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/negative_test.go

@@ -52,6 +52,17 @@ func testLevel2RateLimit(t *testing.T, sc *scenario) {
 			second.dialErr, second.authErr, second.rcptErr, second.dataErr)
 	}
 
+	// The limit holds for every message of a connection, not for its first
+	// only. The milter library hands the milter a fresh session after any reply
+	// that is not "continue" - the refusal above is one - and Postfix does not
+	// introduce the client again, so a second MAIL FROM on the same connection
+	// used to arrive with no client address and was let through (found by the
+	// technical review of 2026-10-12; the same hole let an application past its
+	// client-address list).
+	if errs := mailTwiceOnOneConnection(login, password, from); errs[0] == nil || errs[1] == nil {
+		t.Fatalf("over the level-2 limit, two MAIL FROM on one connection were answered %v and %v, want both refused", errs[0], errs[1])
+	}
+
 	if err := waitFor("a rejected row for l2app in the send log", 15*time.Second, 500*time.Millisecond, func() (bool, error) {
 		rows, err := sc.panel.sendLogRows(senderDomain, login)
 		if err != nil {

test/e2e/smtp_client.go

@@ -140,3 +140,35 @@ func buildMessage(a sendAttempt) string {
 		a.from, a.to, a.subject, time.Now().UTC().Format(time.RFC1123Z), a.body,
 	)
 }
+
+// mailTwiceOnOneConnection authenticates once and sends MAIL FROM twice on the
+// same connection, with a RSET between, and returns how each was answered. No
+// message is sent: this is about what the server says to the second
+// transaction of a connection whose first was refused.
+func mailTwiceOnOneConnection(login, password, from string) [2]error {
+	var out [2]error
+	conn, err := tls.DialWithDialer(&net.Dialer{Timeout: 10 * time.Second}, "tcp", smtpsAddr, &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         selfpostHostname,
+	})
+	if err != nil {
+		return [2]error{nil, nil}
+	}
+	c, err := smtp.NewClient(conn, selfpostHostname)
+	if err != nil {
+		_ = conn.Close()
+		return [2]error{nil, nil}
+	}
+	defer c.Close()
+	if err := c.Hello("e2e-client.e2e.test"); err != nil {
+		return [2]error{nil, nil}
+	}
+	if err := c.Auth(smtp.PlainAuth("", login, password, selfpostHostname)); err != nil {
+		return [2]error{nil, nil}
+	}
+	out[0] = c.Mail(from)
+	_ = c.Reset()
+	out[1] = c.Mail(from)
+	_ = c.Quit()
+	return out
+}