1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/postfix/postfix-srs.patch Thu Sep 13 20:05:49 2012 +0200
1.3 @@ -0,0 +1,493 @@
1.4 +diff -urN README_FILES/SRS_README.orig README_FILES/SRS_README
1.5 +--- README_FILES/SRS_README.orig 1970-01-01 01:00:00.000000000 +0100
1.6 ++++ README_FILES/SRS_README 2012-02-21 14:22:05.000000000 +0100
1.7 +@@ -0,0 +1,56 @@
1.8 ++
1.9 ++CREDITS:
1.10 ++
1.11 ++- originally written by Shevek <srs@anarres.org>
1.12 ++- fixes and porting to postfix 2.1 by Branko F. Gracnar <bfg@frost.ath.cx>
1.13 ++- redesigned and ported to debian postfix 2.7.0 by Chris <chris@codefrickler.de>
1.14 ++
1.15 ++SYNOPSIS:
1.16 ++Works with all address classes (not limited to local domain).
1.17 ++Doesn't depend on .forward-files or alias_maps.
1.18 ++SMTPD accepts valid srs addresses without further configuration.
1.19 ++Sender gets rewritten only when necessary:
1.20 ++- rewrite after queuing (after separation to on- and off-site destinations)
1.21 ++- rewrite only if sender and recipient are off-site and host is not a relay for recipient
1.22 ++Alias domain can be chosen automatically from original on-site-recipient.
1.23 ++
1.24 ++
1.25 ++USAGE:
1.26 ++
1.27 ++1) Apply the patch.
1.28 ++
1.29 ++2) Create makefiles with
1.30 ++
1.31 ++make makefiles CCARGS="-DHAS_SRS -I<directory-containing--srs2.h>" AUXLIBS="-L<directory-containing--libsrs2.so> -lsrs2"
1.32 ++
1.33 ++
1.34 ++3) Build.
1.35 ++
1.36 ++4) Add the following global configuration variables to main.cf:
1.37 ++All variables are optional, except where stated:
1.38 ++
1.39 ++ srs_domain (string)
1.40 ++ A domain to use in rewritten addresses. This must point only
1.41 ++ to machines which know the encoding secret used by this
1.42 ++ system. It defaults to $myorigin. If set to the emtpy
1.43 ++ string, use domain from original recipient if host is final
1.44 ++ destination, otherwise use $myorigin.
1.45 ++ srs_hashlength (int)
1.46 ++ The hash length to generate in a rewritten address.
1.47 ++ srs_hashmin (int)
1.48 ++ The hash length to require when checking an address.
1.49 ++ srs_maxage (int)
1.50 ++ The maximum permitted age of a rewritten address.
1.51 ++ srs_secrets (string)
1.52 ++ [required] A list of secrets with which to generate
1.53 ++ and check addresses.
1.54 ++ srs_separator (string)
1.55 ++ The separator to appear immediately after SRS[01] in
1.56 ++ rewritten addresses.
1.57 ++
1.58 ++
1.59 ++See http://www.libsrs2.org/ for more information about the meaning
1.60 ++of these variables. They are standard across MTAs.
1.61 ++
1.62 ++5) Fire up and enjoy.
1.63 ++
1.64 +diff -urN src/cleanup/cleanup_addr.c.orig src/cleanup/cleanup_addr.c
1.65 +--- src/cleanup/cleanup_addr.c.orig 2012-02-21 14:21:34.000000000 +0100
1.66 ++++ src/cleanup/cleanup_addr.c 2012-02-21 14:22:05.000000000 +0100
1.67 +@@ -163,6 +163,10 @@
1.68 + {
1.69 + VSTRING *clean_addr = vstring_alloc(100);
1.70 + const char *bcc;
1.71 ++#ifdef HAS_SRS
1.72 ++ int srs_state;
1.73 ++ VSTRING *srs_rcpt;
1.74 ++#endif
1.75 +
1.76 + /*
1.77 + * Note: an unqualified envelope address is for all practical purposes
1.78 +@@ -174,6 +178,14 @@
1.79 + cleanup_rewrite_internal(MAIL_ATTR_RWR_LOCAL,
1.80 + clean_addr, *buf ? buf : var_empty_addr);
1.81 + if (state->flags & CLEANUP_FLAG_MAP_OK) {
1.82 ++#ifdef HAS_SRS
1.83 ++ if ((srs_state = postfix_srs_reverse(STR(clean_addr), &srs_rcpt)) < 0) {
1.84 ++ /* XXX errors */
1.85 ++ } else if (srs_state == 1) {
1.86 ++ vstring_free(clean_addr);
1.87 ++ clean_addr = srs_rcpt;
1.88 ++ }
1.89 ++#endif
1.90 + if (cleanup_rcpt_canon_maps
1.91 + && (cleanup_rcpt_canon_flags & CLEANUP_CANON_FLAG_ENV_RCPT))
1.92 + cleanup_map11_internal(state, clean_addr, cleanup_rcpt_canon_maps,
1.93 +diff -urN src/global/mail_params.c.orig src/global/mail_params.c
1.94 +--- src/global/mail_params.c.orig 2012-02-21 14:21:34.000000000 +0100
1.95 ++++ src/global/mail_params.c 2012-02-21 14:22:05.000000000 +0100
1.96 +@@ -308,6 +308,15 @@
1.97 + bool var_long_queue_ids;
1.98 + bool var_daemon_open_fatal;
1.99 +
1.100 ++#ifdef HAS_SRS
1.101 ++int var_srs_hashlength;
1.102 ++int var_srs_hashmin;
1.103 ++int var_srs_maxage;
1.104 ++char *var_srs_secrets;
1.105 ++char *var_srs_separator;
1.106 ++char *var_srs_domain;
1.107 ++#endif
1.108 ++
1.109 + const char null_format_string[1] = "";
1.110 +
1.111 + /* check_myhostname - lookup hostname and validate */
1.112 +@@ -579,6 +588,11 @@
1.113 + VAR_INT_FILT_CLASSES, DEF_INT_FILT_CLASSES, &var_int_filt_classes, 0, 0,
1.114 + /* multi_instance_wrapper may have dependencies but not dependents. */
1.115 + VAR_MULTI_WRAPPER, DEF_MULTI_WRAPPER, &var_multi_wrapper, 0, 0,
1.116 ++#ifdef HAS_SRS
1.117 ++ VAR_SRS_SECRETS, DEF_SRS_SECRETS, &var_srs_secrets, 0, 0,
1.118 ++ VAR_SRS_SEPARATOR, DEF_SRS_SEPARATOR, &var_srs_separator, 1, 1,
1.119 ++ VAR_SRS_DOMAIN, DEF_SRS_DOMAIN, &var_srs_domain, 0, 0,
1.120 ++#endif
1.121 + 0,
1.122 + };
1.123 + static const CONFIG_STR_FN_TABLE function_str_defaults_2[] = {
1.124 +@@ -602,6 +616,11 @@
1.125 + VAR_MIME_BOUND_LEN, DEF_MIME_BOUND_LEN, &var_mime_bound_len, 1, 0,
1.126 + VAR_DELAY_MAX_RES, DEF_DELAY_MAX_RES, &var_delay_max_res, MIN_DELAY_MAX_RES, MAX_DELAY_MAX_RES,
1.127 + VAR_INET_WINDOW, DEF_INET_WINDOW, &var_inet_windowsize, 0, 0,
1.128 ++#ifdef HAS_SRS
1.129 ++ VAR_SRS_HASHLENGTH, DEF_SRS_HASHLENGTH, &var_srs_hashlength, 1, 20,
1.130 ++ VAR_SRS_HASHMIN, DEF_SRS_HASHMIN, &var_srs_hashmin, 1, 20,
1.131 ++ VAR_SRS_MAXAGE, DEF_SRS_MAXAGE, &var_srs_maxage, 1, 0,
1.132 ++#endif
1.133 + 0,
1.134 + };
1.135 + static const CONFIG_LONG_TABLE long_defaults[] = {
1.136 +diff -urN src/global/mail_params.h.orig src/global/mail_params.h
1.137 +--- src/global/mail_params.h.orig 2012-02-21 14:21:34.000000000 +0100
1.138 ++++ src/global/mail_params.h 2012-02-21 14:22:41.000000000 +0100
1.139 +@@ -1981,6 +1981,35 @@
1.140 + #define DEF_ALLOW_UNTRUST_ROUTE 0
1.141 + extern bool var_allow_untrust_route;
1.142 +
1.143 ++/**
1.144 ++ * SRS. Shevek <srs@anarres.org>, updated by Chris <chris@codefrickler.de>
1.145 ++ */
1.146 ++#ifdef HAS_SRS
1.147 ++#define VAR_SRS_HASHLENGTH "srs_hashlength"
1.148 ++#define DEF_SRS_HASHLENGTH 4
1.149 ++extern int var_srs_hashlength;
1.150 ++
1.151 ++#define VAR_SRS_HASHMIN "srs_hashmin"
1.152 ++#define DEF_SRS_HASHMIN 4
1.153 ++extern int var_srs_hashmin;
1.154 ++
1.155 ++#define VAR_SRS_MAXAGE "srs_maxage"
1.156 ++#define DEF_SRS_MAXAGE 21
1.157 ++extern int var_srs_maxage;
1.158 ++
1.159 ++#define VAR_SRS_SECRETS "srs_secrets"
1.160 ++#define DEF_SRS_SECRETS ""
1.161 ++extern char *var_srs_secrets;
1.162 ++
1.163 ++#define VAR_SRS_DOMAIN "srs_domain"
1.164 ++#define DEF_SRS_DOMAIN "$myorigin"
1.165 ++extern char *var_srs_domain;
1.166 ++
1.167 ++#define VAR_SRS_SEPARATOR "srs_separator"
1.168 ++#define DEF_SRS_SEPARATOR "="
1.169 ++extern char *var_srs_separator;
1.170 ++#endif
1.171 ++
1.172 + /*
1.173 + * Names of specific restrictions, and the corresponding configuration
1.174 + * parameters that control the status codes sent in response to rejected
1.175 +diff -urN src/global/Makefile.in.orig src/global/Makefile.in
1.176 +--- src/global/Makefile.in.orig 2012-02-21 14:21:34.000000000 +0100
1.177 ++++ src/global/Makefile.in 2012-02-21 14:22:05.000000000 +0100
1.178 +@@ -29,7 +29,7 @@
1.179 + user_acl.c valid_mailhost_addr.c verify.c verify_clnt.c \
1.180 + verp_sender.c wildcard_inet_addr.c xtext.c delivered_hdr.c \
1.181 + fold_addr.c header_body_checks.c mkmap_proxy.c data_redirect.c \
1.182 +- match_service.c mail_conf_nint.c addr_match_list.c mail_conf_nbool.c \
1.183 ++ match_service.c mail_conf_nint.c addr_match_list.c mail_conf_nbool.c srs.c \
1.184 + smtp_reply_footer.c safe_ultostr.c verify_sender_addr.c \
1.185 + dict_memcache.c mail_version.c memcache_proto.c server_acl.c \
1.186 + mkmap_fail.c
1.187 +@@ -63,7 +63,7 @@
1.188 + user_acl.o valid_mailhost_addr.o verify.o verify_clnt.o \
1.189 + verp_sender.o wildcard_inet_addr.o xtext.o delivered_hdr.o \
1.190 + fold_addr.o header_body_checks.o mkmap_proxy.o data_redirect.o \
1.191 +- match_service.o mail_conf_nint.o addr_match_list.o mail_conf_nbool.o \
1.192 ++ match_service.o mail_conf_nint.o addr_match_list.o mail_conf_nbool.o srs.o \
1.193 + smtp_reply_footer.o safe_ultostr.o verify_sender_addr.o \
1.194 + dict_memcache.o mail_version.o memcache_proto.o server_acl.o \
1.195 + mkmap_fail.o
1.196 +diff -urN src/global/srs.c.orig src/global/srs.c
1.197 +--- src/global/srs.c.orig 1970-01-01 01:00:00.000000000 +0100
1.198 ++++ src/global/srs.c 2012-02-21 14:22:27.000000000 +0100
1.199 +@@ -0,0 +1,144 @@
1.200 ++/*++
1.201 ++/* NAME
1.202 ++/* srs 3
1.203 ++/* SUMMARY
1.204 ++/* Sender Rewriting Scheme
1.205 ++/* SYNOPSIS
1.206 ++/* void postfix_srs_reverse(rcpt, decoded)
1.207 ++/* const char *rcpt
1.208 ++/* VSTRING **decoded
1.209 ++/*
1.210 ++/* int postfix_srs_forward(sender, alias, encoded)
1.211 ++/* const char *sender
1.212 ++/* const char *alias
1.213 ++/* VSTRING **decoded
1.214 ++/* DESCRIPTION
1.215 ++/* This module rewrites addresses according to the Sender Rewriting
1.216 ++/* Scheme, documented at http://www.libsrs2.org/.
1.217 ++/*
1.218 ++/* srs_reverse() reverse-rewrites the rewritten form of an address
1.219 ++/*
1.220 ++/* srs_forward() rewrites the envelope sender using alias domain
1.221 ++/*
1.222 ++/* DIAGNOSTICS
1.223 ++/* LICENSE
1.224 ++/* .ad
1.225 ++/* .fi
1.226 ++/* The Secure Mailer license must be distributed with this software.
1.227 ++/* AUTHOR(S)
1.228 ++/* Shevek <srs@anarres.org>
1.229 ++/* Chris <chris@codefrickler.de>
1.230 ++/*--*/
1.231 ++
1.232 ++#ifdef HAS_SRS
1.233 ++
1.234 ++/* System library. */
1.235 ++
1.236 ++#include <stdlib.h>
1.237 ++#include <sys_defs.h>
1.238 ++#include <string.h>
1.239 ++
1.240 ++#include <srs2.h>
1.241 ++
1.242 ++/* Utility library. */
1.243 ++
1.244 ++#include <msg.h>
1.245 ++#include <vstring.h>
1.246 ++#include <mymalloc.h>
1.247 ++#include <stringops.h>
1.248 ++
1.249 ++/* Global library. */
1.250 ++
1.251 ++#include <mail_params.h>
1.252 ++
1.253 ++#define SRS_FAIL_UNLESS(x) do { int __ret = (x); if (__ret != SRS_SUCCESS) msg_fatal("SRS configuration error: %s", srs_strerror(__ret)); } while(0)
1.254 ++
1.255 ++/* my function declarations */
1.256 ++int postfix_srs_forward (const char *sender, const char *alias, VSTRING **encoded);
1.257 ++int postfix_srs_reverse (const char *rcpt, VSTRING **decoded);
1.258 ++
1.259 ++static srs_t *srs;
1.260 ++
1.261 ++static void postfix_srs_init (void) {
1.262 ++ char *saved_secrets;
1.263 ++ char *secret;
1.264 ++ char *ptr;
1.265 ++
1.266 ++ if (srs == NULL) {
1.267 ++ /* XXX Can't use memory functions from postfix because of inconsistensies in libsrs2
1.268 ++ srs_set_malloc((srs_malloc_t)mymalloc, (srs_realloc_t)myrealloc, (srs_free_t)myfree);
1.269 ++ */
1.270 ++
1.271 ++ srs = srs_new();
1.272 ++ /* avoid sender-domain-check, since we have already done this ourselves */
1.273 ++ SRS_FAIL_UNLESS(srs_set_alwaysrewrite(srs, 1));
1.274 ++ SRS_FAIL_UNLESS(srs_set_hashlength(srs, var_srs_hashlength));
1.275 ++ SRS_FAIL_UNLESS(srs_set_hashmin(srs, var_srs_hashmin));
1.276 ++ SRS_FAIL_UNLESS(srs_set_maxage(srs, var_srs_maxage));
1.277 ++ SRS_FAIL_UNLESS(srs_set_separator(srs, var_srs_separator[0]));
1.278 ++
1.279 ++ ptr = saved_secrets = mystrdup(var_srs_secrets);
1.280 ++ while ((secret = mystrtok(&ptr, ", \t\r\n")) != 0) {
1.281 ++ SRS_FAIL_UNLESS(srs_add_secret(srs, secret));
1.282 ++ }
1.283 ++ myfree(saved_secrets);
1.284 ++ }
1.285 ++}
1.286 ++
1.287 ++int postfix_srs_reverse(const char *rcpt, VSTRING **decoded) {
1.288 ++ char *out;
1.289 ++ int ret;
1.290 ++
1.291 ++ if (!SRS_IS_SRS_ADDRESS(rcpt))
1.292 ++ return (0);
1.293 ++
1.294 ++ postfix_srs_init();
1.295 ++
1.296 ++ ret = srs_reverse_alloc(srs, &out, rcpt);
1.297 ++
1.298 ++ if (ret != SRS_SUCCESS) {
1.299 ++ switch (SRS_ERROR_TYPE(ret)) {
1.300 ++ case SRS_ERRTYPE_CONFIG:
1.301 ++ msg_fatal("SRS configuration error: %s", srs_strerror(ret));
1.302 ++ return (-1);
1.303 ++ case SRS_ERRTYPE_INPUT:
1.304 ++ msg_fatal("SRS reverse failed for <%s>: %s", rcpt, srs_strerror(ret));
1.305 ++ return (-1);
1.306 ++ case SRS_ERRTYPE_SYNTAX:
1.307 ++ case SRS_ERRTYPE_SRS:
1.308 ++ msg_warn("SRS reverse failed for <%s>: %s", rcpt, srs_strerror(ret));
1.309 ++ break;
1.310 ++ }
1.311 ++ return (0);
1.312 ++ }
1.313 ++
1.314 ++ if (decoded) {
1.315 ++ *decoded = vstring_alloc(100);
1.316 ++ vstring_strcpy(*decoded, out);
1.317 ++ }
1.318 ++ free(out);
1.319 ++
1.320 ++ return (1);
1.321 ++}
1.322 ++
1.323 ++int postfix_srs_forward(const char *sender, const char *alias, VSTRING **encoded) {
1.324 ++ char *out;
1.325 ++ int ret;
1.326 ++
1.327 ++ postfix_srs_init();
1.328 ++
1.329 ++ ret = srs_forward_alloc(srs, &out, sender, alias);
1.330 ++
1.331 ++ if (ret != SRS_SUCCESS) {
1.332 ++ msg_warn("SRS forward failed for <%s>: %s", sender, srs_strerror(ret));
1.333 ++ return (0);
1.334 ++ }
1.335 ++
1.336 ++ *encoded = vstring_alloc(100);
1.337 ++ vstring_strcpy(*encoded, out);
1.338 ++ free(out);
1.339 ++
1.340 ++ return (1);
1.341 ++}
1.342 ++
1.343 ++#endif
1.344 +diff -urN src/qmgr/qmgr_deliver.c.orig src/qmgr/qmgr_deliver.c
1.345 +--- src/qmgr/qmgr_deliver.c.orig 2012-02-21 14:21:34.000000000 +0100
1.346 ++++ src/qmgr/qmgr_deliver.c 2012-02-21 14:22:05.000000000 +0100
1.347 +@@ -76,6 +76,7 @@
1.348 + #include <dsn_buf.h>
1.349 + #include <dsb_scan.h>
1.350 + #include <rcpt_print.h>
1.351 ++#include <resolve_clnt.h>
1.352 +
1.353 + /* Application-specific. */
1.354 +
1.355 +@@ -129,6 +130,73 @@
1.356 + }
1.357 + }
1.358 +
1.359 ++#ifdef HAS_SRS
1.360 ++/* qmgr_deliver_check_srs - check whether sender should be rewritten */
1.361 ++
1.362 ++static int qmgr_deliver_check_srs(QMGR_MESSAGE *message, RECIPIENT_LIST list, char **alias, RESOLVE_REPLY *reply)
1.363 ++{
1.364 ++ char *pos;
1.365 ++
1.366 ++ /*
1.367 ++ * Rewrite if we are not final destination nor relay host for recipient and sender address
1.368 ++ * it should be enough to look at the first recipient, since transport/nexthop are the same for all recipients
1.369 ++ */
1.370 ++ resolve_clnt_query(list.info->address, reply);
1.371 ++ if (reply->flags & RESOLVE_FLAG_FAIL)
1.372 ++ return (-1);
1.373 ++ else if (!(reply->flags & RESOLVE_CLASS_DEFAULT))
1.374 ++ return (0);
1.375 ++
1.376 ++ resolve_clnt_query(message->sender, reply);
1.377 ++ if (reply->flags & RESOLVE_FLAG_FAIL)
1.378 ++ return (-1);
1.379 ++ else if (!(reply->flags & RESOLVE_CLASS_DEFAULT))
1.380 ++ return (0);
1.381 ++
1.382 ++ if (var_srs_domain[0]) {
1.383 ++ *alias = var_srs_domain;
1.384 ++ } else {
1.385 ++ /* retrieve alias domain from original recipient if we are final destination ... */
1.386 ++ resolve_clnt_query(list.info->orig_addr, reply);
1.387 ++ if (reply->flags & RESOLVE_FLAG_FAIL)
1.388 ++ return (-1);
1.389 ++ if ((reply->flags & RESOLVE_CLASS_FINAL) && (pos = strrchr(list.info->orig_addr, '@'))) {
1.390 ++ *alias = pos + 1;
1.391 ++ } else {
1.392 ++ /* ... or use myorigin as fallback */
1.393 ++ *alias = var_myorigin;
1.394 ++ }
1.395 ++ }
1.396 ++
1.397 ++ return (1);
1.398 ++}
1.399 ++
1.400 ++/* qmgr_deliver_do_srs - compute srs address if necessary */
1.401 ++
1.402 ++static int qmgr_deliver_do_srs(QMGR_MESSAGE *message, RECIPIENT_LIST list, VSTRING **encoded)
1.403 ++{
1.404 ++ RESOLVE_REPLY reply;
1.405 ++ char *alias;
1.406 ++ int state;
1.407 ++
1.408 ++ resolve_clnt_init(&reply);
1.409 ++ state = qmgr_deliver_check_srs(message, list, &alias, &reply);
1.410 ++ resolve_clnt_free(&reply);
1.411 ++ if (state < 0) {
1.412 ++ msg_warn("srs lookup problem");
1.413 ++ return (-1);
1.414 ++ } else if (state == 0) {
1.415 ++ return (0);
1.416 ++ }
1.417 ++
1.418 ++ state = postfix_srs_forward(message->sender, alias, encoded);
1.419 ++ if (state < 0)
1.420 ++ return (-1);
1.421 ++
1.422 ++ return (1);
1.423 ++}
1.424 ++#endif
1.425 ++
1.426 + /* qmgr_deliver_send_request - send delivery request to delivery process */
1.427 +
1.428 + static int qmgr_deliver_send_request(QMGR_ENTRY *entry, VSTREAM *stream)
1.429 +@@ -140,6 +208,9 @@
1.430 + MSG_STATS stats;
1.431 + char *sender;
1.432 + int flags;
1.433 ++#ifdef HAS_SRS
1.434 ++ int srs_state;
1.435 ++#endif
1.436 +
1.437 + /*
1.438 + * If variable envelope return path is requested, change prefix+@origin
1.439 +@@ -147,7 +218,19 @@
1.440 + * recipient per delivery.
1.441 + */
1.442 + if (message->verp_delims == 0) {
1.443 +- sender = message->sender;
1.444 ++#ifdef HAS_SRS
1.445 ++ srs_state = qmgr_deliver_do_srs(message, list, &sender_buf);
1.446 ++ if (srs_state < 0) {
1.447 ++ return (-1);
1.448 ++ } else if (srs_state == 1) {
1.449 ++ sender = vstring_str(sender_buf);
1.450 ++ msg_info("%s: srs_from=<%s>", message->queue_id, sender);
1.451 ++ } else {
1.452 ++ sender = message->sender;
1.453 ++ }
1.454 ++#else
1.455 ++ sender = message->sender;
1.456 ++#endif
1.457 + } else {
1.458 + sender_buf = vstring_alloc(100);
1.459 + verp_sender(sender_buf, message->verp_delims,
1.460 +diff -urN src/smtpd/smtpd_check.c.orig src/smtpd/smtpd_check.c
1.461 +--- src/smtpd/smtpd_check.c.orig 2012-02-21 14:21:34.000000000 +0100
1.462 ++++ src/smtpd/smtpd_check.c 2012-02-21 14:22:05.000000000 +0100
1.463 +@@ -929,6 +929,19 @@
1.464 + reject_server_error(state);
1.465 + }
1.466 +
1.467 ++#ifdef HAS_SRS
1.468 ++/* check_mail_addr_srs - check if address is a valid srs address */
1.469 ++
1.470 ++static int check_mail_addr_srs(SMTPD_STATE *state, const char *reply_name, const char *addr)
1.471 ++{
1.472 ++ int result;
1.473 ++
1.474 ++ if ((result = postfix_srs_reverse(addr, 0)) < 0)
1.475 ++ reject_dict_retry(state, reply_name);
1.476 ++ return (result);
1.477 ++}
1.478 ++#endif
1.479 ++
1.480 + /* reject_unknown_reverse_name - fail if reverse client hostname is unknown */
1.481 +
1.482 + static int reject_unknown_reverse_name(SMTPD_STATE *state)
1.483 +@@ -4552,6 +4565,13 @@
1.484 + || MATCH(canonical_maps, CONST_STR(reply->recipient))
1.485 + || MATCH(virt_alias_maps, CONST_STR(reply->recipient)))
1.486 + return (0);
1.487 ++
1.488 ++#ifdef HAS_SRS
1.489 ++ /* allow valid srs address */
1.490 ++ if ((reply->flags & RESOLVE_CLASS_FINAL)
1.491 ++ && check_mail_addr_srs(state, recipient, CONST_STR(reply->recipient)) == 1)
1.492 ++ return (0);
1.493 ++#endif
1.494 +
1.495 + /*
1.496 + * At this point, anything that resolves to the error mailer is known to
