Matthias Andree:
> I'm not sure if we're talking about the same problem,

Yes. If an owner-root alias exists, then Postfix writes the recipients
in the expansion of the root alias to queue file, without attempting
to recursively expand aliases and .forward files.

However, |command and /file/name destinations in the expansion of
an alias or forward file must be delivered immediately, so if those
fail with a temporary error, then the whole alias will receive the
mail again later.

> I can think of some solutions (brain storm):
>
> a) drop original recipient on the floor, possibly break mail up.

Excuse me? Postfix must not drop mail on the floor. If an alias
expands into

        destination1
        "|command that fails with soft error"
        destination2

then destination2 must receive the mail.

> b) keep a list of successful deliveries. Postfix needs to eliminate
> duplicates from the alias expansion anyways.

This list requires persistent storage. Where? Postfix is designed
on the principle of write once files, so that Postfix can be killed
at arbitrary moments without causing loss of mail.

This is in fact the only solution that I could come up with that
does not compromise security.

> c) flag testme in queue as "already expanded".

The alias can be flagged as "already expanded" when ALL destinations
are either delivered, or when they are stored persistently so that
they can be delivered later.

Storing |command and /file/name destinations is extremely dangerous.
This solution does not pass the security test.

> I'm not sure which one works out, but the present behaviour is not
> adequate. Compatibility back and forth, if it floods my users'
> mailboxes, that's the point where compatibility should end.

If an alias name appears in its own expansion, then the mail must
be delivered to the user; and of the user appears in her own .forward
file, then the mail must be given to the mailbox. There are too
many installations that expect that Postfix can handle recursion
like sendmail.

> d) switch between "broken-compatible" and "sensible" alias treatment

And cleverly he forgot to define what the sendible treatment is.

        Wietse

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]