proposal: change behavior with respect to recipients matching /^-/

3 msg	Re: Virtual domain aliases
4 msg	address verify vs. virtual_alias_maps
20 msg	Postfix/ClamAV Config Error
4 msg	smtp /dev/poll problem
6 msg	Addresses filtering for only one supported domain
14 msg	Greylist question
1 msg	One transport with AUTH and other transport wit...
7 msg	Is this expected reject behavior for foreign IP...
3 msg	relay_domains and virtual_mailbox_domains not w...
2 msg	Need help debugging a possible content filter p...
11 msg	spam emails with \| in front of the email addresses
9 msg	unexpected domain rewrite (by postfix?)
5 msg	Error receiving email
20 msg	Postfix 2.5-20071111, smtp.gmail.com, bouncing ...
1 msg	Bounce notification configure
45 msg	Re: Recipient validation
2 msg	Use of MySQL for lookups

proposal: change behavior with respect to recip...
\ Ben Rosengart (27 Nov 2007)
. \ Victor Duchovni (27 Nov 2007)
. . \ Ben Rosengart (27 Nov 2007)
. \ (Wietse Venema) (27 Nov 2007)
. . \ Victor Duchovni (27 Nov 2007)
. . . \ (Wietse Venema) (27 Nov 2007)
. . . . \ Victor Duchovni (27 Nov 2007)
. . . . . \ (Wietse Venema) (13 Dec 2007)

11 msg	OT: Any bad DKIM experiences?
8 msg	hashed spool directories

Subject:	proposal: change behavior with respect to recipients matching /^-/
Group:	Postfix-users
From:	Ben Rosengart
Date:	27 Nov 2007

With the default "allow_min_user = no", recipients whose addresses
begin with '-' are bounced by qmgr. This is to avoid, as Viktor
Duchovni puts it, "security issues with naive filters that don't put
'--' between sender and recipients."

You might think that smtpd would reject such recipients, but it
doesn't; it can't be sure that the leading '-' will still be present
after rewriting. In order to "be liberal in what it accepts", smtpd
assumes that the result of rewriting will not match /^-/.

Given that the internet is plagued by backscatter, this seems like
the wrong assumption to me. In Postfix's default configuration,
rewriting does not cure the problem, and a bounce, which might be
backscatter, is generated, and smtpd's default stance should reflect
this fact.

I propose a new parameter, "smtpd_allow_min_user", defaulting to
"no". If people want the current behavior, they can change it to
"yes". Or, if we want to really solve the problem,
"smtpd_allow_min_user_maps", allowing the user to define the set of
addresses which is acceptable despite a leading '-'.

(Another surprising (and therefore undesirable) effect of the current
system is that if a rewrite which moves or removes the leading '-' is
moved from, say, virtual(5) to generic(5), mail which previously
worked will begin bouncing.)

What do people think?

Thanks,
--
Ben Rosengart