From e1745375128ccb771593ec899fc2498b767a0cc6 Mon Sep 17 00:00:00 2001 From: Mix Date: Wed, 14 Oct 2026 23:11:20 +0300 Subject: [PATCH] postfix config: port 25's size limit for cleanup too, no local delivery Port 25 says it takes INBOUND_MESSAGE_SIZE_LIMIT (25 MiB by default) with smtpd -o message_size_limit, but cleanup writes the queue file under its own limit, main.cf's - never set, so DEF_MESSAGE_LIMIT, 10240000 (Postfix 3.7.11, src/cleanup/cleanup_init.c, cleanup_post_jail(), set_file_limit(); src/global/mail_params.h). A larger message went through DATA and was refused 552 (assumptions C-P31). cleanup now gets port 25's limit as a master.cf -o when it is larger than main.cf's; 465 and 587 keep main.cf's in smtpd's own DATA/BDAT checks. /etc/postfix outlives a restart, so the override is removed with postconf -PX first on every start. An empty mydestination left one local destination: an address literal of an interface the container listens on (src/global/resolve_local.c, resolve_local(), own_inet_addr()). local_transport is now "error:local mail delivery is disabled", as STANDARD_CONFIGURATION_README's null client has it (assumptions C-P8). Stand (2026-10-14, make e2e, exit 0): inbound_relay_delivers_and_refuses sends a 12 MB message through port 25 and finds it at the upstream, and counts it among the Inbound log's rows; new address_literal_is_not_local - probe@[127.0.0.1] from an application is refused at RCPT "550 5.1.1 ... local mail delivery is disabled" (smtpd's check_rcpt_maps() rejects what resolves to the error transport; before, local(8) took it). go vet and go test ./... pass on the server (23 packages). Tested together with the next commit (the log tailer); the two touch no common file. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 12 ++++++++++++ build/postfix-config.sh | 27 +++++++++++++++++++++++++-- test/e2e/delivery_log_test.go | 20 ++++++++++++++++++++ test/e2e/main_test.go | 3 +++ test/e2e/port25_features_test.go | 26 +++++++++++++++++++++----- 5 files changed, 81 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e0d379e..4925205 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -68,6 +68,18 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version as `bounced`. The row now holds the recipient as Postfix logs it, once, and is found under `orig_to=` when Postfix rewrote it (assumptions B-G5, A-9, A-31, D-S20). +- **Inbound mail between 10 MB and the port's limit is accepted.** Port 25 + said it took messages up to `INBOUND_MESSAGE_SIZE_LIMIT` (25 MiB by + default), but Postfix writes the message to its queue under a limit of + its own, main.cf's, never set and so 10240000 bytes: a larger message was + taken through `DATA` and then refused with 552. That limit now follows + port 25's when it is larger; 465 and 587 keep theirs (assumptions + C-P31). +- **Mail to an address literal of the container is refused, not delivered + locally.** An empty `mydestination` left one way to local delivery: + `user@[127.0.0.1]` and the container's other addresses. Local delivery is + now Postfix's refusal, and Postfix refuses such a recipient at `RCPT TO`: + `550 5.1.1 ... local mail delivery is disabled` (assumptions C-P8). - **A bounce is judged by the filter lists as the panel counts it.** rspamd's sender rules took a bounce's `From:` header when the envelope sender was empty, so a bounce could be refused or allowed by an entry the diff --git a/build/postfix-config.sh b/build/postfix-config.sh index 5abb0da..25fb294 100644 --- a/build/postfix-config.sh +++ b/build/postfix-config.sh @@ -170,6 +170,10 @@ DMARC_RELAY_DOMAINS_MAP="${POSTFIX_DMARC_RELAY_DOMAINS:-/data/postfix/dmarc_rela # directory and the file with the ownership postlogd writes and the panel reads. MAIL_LOG_PATH="${MAIL_LOG:-/data/log/mail.log}" +# /etc/postfix outlives a restart of the container, so a cleanup limit set for +# port 25 before is taken back here and set again below when it still applies. +postconf -PX "cleanup/unix/message_size_limit" 2>/dev/null || true + # --- main.cf ----------------------------------------------------------------- # maillog_file lives under the persistent /data bind mount (architecture.md ยง # Log tailer). Postfix's default maillog_file_prefixes are only /var and @@ -199,11 +203,18 @@ postconf -e \ postconf -M "postlog/unix-dgram=postlog unix-dgram n - n - 1 postlogd" # This is an outbound relay: no local delivery, no per-user aliases. Empty -# these so a misfiled recipient never gets delivered locally. +# these so a misfiled recipient never gets delivered locally. An empty +# mydestination is not enough: an address literal of an interface the +# container listens on - x@[127.0.0.1] - is local too (Postfix 3.7.11, +# src/global/resolve_local.c, resolve_local(), own_inet_addr()), so local(8) +# itself is replaced by a refusal, as Postfix's null-client example does +# (README_FILES/STANDARD_CONFIGURATION_README, "local_transport = error:local +# mail delivery is disabled"; assumptions C-P8). postconf -e \ "local_recipient_maps=" \ "alias_maps=" \ - "alias_database=" + "alias_database=" \ + "local_transport=error:local mail delivery is disabled" # Outbound delivery: straight to the recipient MX, opportunistic TLS. postconf -e \ @@ -563,6 +574,18 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true "smtp/inet/message_size_limit=${PORT25_SIZE}" master_cf_set_smtp_inet_o smtpd_recipient_restrictions "${RECIPIENT_RESTRICTIONS}" master_cf_set_smtp_inet_o smtpd_milters "${INBOUND_MILTERS}" + + # smtpd's -o limit is not the whole of it: cleanup writes the queue file + # under its own message_size_limit, main.cf's, which is never set here and + # so is 10240000 (Postfix 3.7.11, src/cleanup/cleanup_init.c, + # cleanup_post_jail(), set_file_limit(); src/global/mail_params.h, + # DEF_MESSAGE_LIMIT), and a larger message is refused 552 after DATA + # (assumptions C-P31). cleanup gets port 25's limit when it is larger; + # smtpd on 465 and 587 still holds its own, main.cf's (src/smtpd/smtpd.c, + # the DATA and BDAT size checks). + if [ "${PORT25_SIZE}" -gt "$(postconf -h message_size_limit)" ]; then + postconf -P "cleanup/unix/message_size_limit=${PORT25_SIZE}" + fi else postconf -MX "smtp/inet" 2>/dev/null || true postconf -MX "dmarc-ingest/unix" 2>/dev/null || true diff --git a/test/e2e/delivery_log_test.go b/test/e2e/delivery_log_test.go index 3da1a02..10edf3c 100644 --- a/test/e2e/delivery_log_test.go +++ b/test/e2e/delivery_log_test.go @@ -181,3 +181,23 @@ print("; ".join(r[0]+" "+r[1] for r in rows))`, token) t.Fatal(err) } } + +// testAddressLiteralIsNotLocal: an address literal of an interface the +// container listens on is a local destination to Postfix even with an empty +// mydestination (Postfix 3.7.11, src/global/resolve_local.c, +// resolve_local()). Local delivery is Postfix's refusal now +// (local_transport=error:..., assumptions C-P8), and smtpd refuses such a +// recipient at RCPT with its text: smtpd_reject_unlisted_recipient (on by +// default) runs check_rcpt_maps(), which rejects whatever resolves to the +// error transport (src/smtpd/smtpd_check.c). Before, the message was +// accepted and handed to local(8). +func testAddressLiteralIsNotLocal(t *testing.T, sc *scenario) { + res := attemptSend(sendAttempt{ + authLogin: sc.appLogin, authPassword: sc.appPassword, + from: "alerts@" + senderDomain, headerFrom: "alerts@" + senderDomain, + to: "probe@[127.0.0.1]", subject: "e2e " + uniqueToken("literal"), body: "to an address literal of the container", + }) + if err := res.refusedAt("RCPT", 550, "local mail delivery is disabled"); err != nil { + t.Fatalf("to probe@[127.0.0.1]: %v", err) + } +} diff --git a/test/e2e/main_test.go b/test/e2e/main_test.go index 85d4826..956c562 100644 --- a/test/e2e/main_test.go +++ b/test/e2e/main_test.go @@ -348,6 +348,9 @@ func TestE2E(t *testing.T) { run("recipients_as_postfix_logs_them", func(t *testing.T) { testRecipientsAsPostfixLogsThem(t, sc) }) + run("address_literal_is_not_local", func(t *testing.T) { + testAddressLiteralIsNotLocal(t, sc) + }) run("expired_message_is_closed", func(t *testing.T) { testExpiredMessageIsClosed(t, sc) }) diff --git a/test/e2e/port25_features_test.go b/test/e2e/port25_features_test.go index 7ee76c3..0d83576 100644 --- a/test/e2e/port25_features_test.go +++ b/test/e2e/port25_features_test.go @@ -268,6 +268,21 @@ func testInboundRelay(t *testing.T, sc *scenario) { t.Fatalf("mail for the inbound domain never reached its upstream: %v\n%s", err, mailLogTail(h, "postfix/")) } + // Port 25's limit is the whole limit: a 12 MB message - over the + // 10240000 bytes cleanup would hold it to on its own, under the 25 MiB the + // listener says - is accepted and passed on (Postfix 3.7.11, + // src/cleanup/cleanup_init.c, cleanup_post_jail(); assumptions C-P31). + big := uniqueToken("inbound-12mb") + line := "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ab\r\n" + bigBody := strings.Repeat(line, 12*1000*1000/len(line)) + if res := deliverPort25("someone@stranger.e2e.test", inboundRecipient, + strings.Replace(message(inboundRecipient, big), "mail for the inbound domain\r\n", bigBody, 1)); !res.ok() { + t.Fatalf("port 25 refused a 12 MB message: %v\n%s", res.firstErr(), mailLogTail(h, "postfix/")) + } + if _, err := findSinkMessage(h.stageDir, big, 60*time.Second); err != nil { + t.Fatalf("the 12 MB message never reached the upstream: %v\n%s", err, mailLogTail(h, "postfix/")) + } + // The filter lists exist as files from the first start with the relay on, // readable by a filter that is another user in another container. Nothing // is on them until someone adds an entry. @@ -335,7 +350,8 @@ func testInboundRelay(t *testing.T, sc *scenario) { return "" } - rows := logRows("e2e " + token) + rows := logRows("e2e " + big) + rowWith(rows, "user@"+inboundDomain, "e2e "+big, `class="tag is-success is-light" popovertarget="why-`) rowWith(rows, "someone@stranger.e2e.test", "user@"+inboundDomain, "e2e "+token, `class="tag is-success is-light" popovertarget="why-`, `Decided byselfpost`, @@ -343,8 +359,8 @@ func testInboundRelay(t *testing.T, sc *scenario) { `href="/inbound/filter-lists?list=deny&kind=address&value=someone%40stranger.e2e.test">Deny sender`) // A report mailed to the server's own name earlier in the run came through // the same listener and is not the relay's mail. - if len(rows) != 1 { - t.Fatalf("the Inbound log holds %d rows, want the relayed message alone:\n%s", len(rows), strings.Join(rows, "\n")) + if len(rows) != 2 { + t.Fatalf("the Inbound log holds %d rows, want the two relayed messages alone:\n%s", len(rows), strings.Join(rows, "\n")) } // Postfix 3.7.11, src/smtpd/smtpd_check.c: "User unknown in relay recipient @@ -377,8 +393,8 @@ func testInboundRelay(t *testing.T, sc *scenario) { if strings.Contains(refused, "sender") { t.Fatalf("the refused row offers a way into the filter lists:\n%s", refused) } - if len(rows) != 2 { - t.Fatalf("the Inbound log holds %d rows, want the relayed message and one refusal:\n%s", len(rows), strings.Join(rows, "\n")) + if len(rows) != 3 { + t.Fatalf("the Inbound log holds %d rows, want the two relayed messages and one refusal:\n%s", len(rows), strings.Join(rows, "\n")) } // The filter lists: an entry added in the panel is in the map file the