On Tue, Sep 22, 2020 at 04:19:41PM +0200, Marek Kozlowski wrote:
> On 9/18/20 6:09 PM, Viktor Dukhovni wrote:
> >> I've been asked a very strange question. According to the best of my
> >> knowledge there is no setting but maybe I'm wrong:
> >>
> >> Is it possible the define a very selective relay according to the
> >> following pseudo code:
> >>
> >> /* a, b and c are set to some single values */
> >> if (client's_IP==a)
> >
> > smtpd_client_restrictions =
> > permit_auth_destination,
> > check_client_access inline:{ a=OK },
> > reject
> >
> >> if (MAIL_FROM==b)
> >
> > smtpd_sender_restrictions =
> > permit_auth_destination,
> > check_sender_access inline:{ b=OK },
> > reject
> >
> >> if (RCPT_TO==c)
> >
> > smtpd_recipient_restrictions =
> > permit_auth_destination,
> > check_recipient_access inline:{ c=OK },
> > reject
>
> Are you quite sure that 'permit_auth_destination' is allowed in
> 'smtpd_client_restrictions' and 'smtpd_sender_restrictions'??
Would I have posted the above answer if I weren't quite sure? You just
need to not inadvertently set "smtpd_delay_reject = no".
> Even if so *I'm in doubt) are sure it would work as and 'AND'?
Your doubt is unwarranted. For a recipient to be accepted all the
top-level built-in restriction classes are evaluated in turn and *all*
must pass (not reject) the recipient.
> if (client's_IP==a)
> if (MAIL_FROM==b)
> if (RCPT_TO==c)
> then relay=OK
>
> (relay if and only if all conditions are met)
That's how it works.
> Seems very suspiciously strange..
Your suspicion is oddly unexpected.
--
Viktor.
