- # -*- test-case-name: openid.test.test_fetchers -*-

- """

- This module contains the HTTP fetcher interface and several implementations.

- """

- 

- __all__ = ['fetch', 'getDefaultFetcher', 'setDefaultFetcher', 'HTTPResponse',

-            'HTTPFetcher', 'createHTTPFetcher', 'HTTPFetchingError',

-            'HTTPError']

- 

- import urllib2

- import time

- import cStringIO

- import sys

- 

- import openid

- import openid.urinorm

- 

- # Try to import httplib2 for caching support

- # http://bitworking.org/projects/httplib2/

- try:

-     import httplib2

- except ImportError:

-     # httplib2 not available

-     httplib2 = None

- 

- # try to import pycurl, which will let us use CurlHTTPFetcher

- try:

-     import pycurl

- except ImportError:

-     pycurl = None

- 

- USER_AGENT = "python-openid/%s (%s)" % (openid.__version__, sys.platform)

- MAX_RESPONSE_KB = 1024

- 

- def fetch(url, body=None, headers=None):

-     """Invoke the fetch method on the default fetcher. Most users

-     should need only this method.

- 

-     @raises Exception: any exceptions that may be raised by the default fetcher

-     """

-     fetcher = getDefaultFetcher()

-     return fetcher.fetch(url, body, headers)

- 

- def createHTTPFetcher():

-     """Create a default HTTP fetcher instance

- 

-     prefers Curl to urllib2."""

-     if pycurl is None:

-         fetcher = Urllib2Fetcher()

-     else:

-         fetcher = CurlHTTPFetcher()

- 

-     return fetcher

- 

- # Contains the currently set HTTP fetcher. If it is set to None, the

- # library will call createHTTPFetcher() to set it. Do not access this

- # variable outside of this module.

- _default_fetcher = None

- 

- def getDefaultFetcher():

-     """Return the default fetcher instance

-     if no fetcher has been set, it will create a default fetcher.

- 

-     @return: the default fetcher

-     @rtype: HTTPFetcher

-     """

-     global _default_fetcher

- 

-     if _default_fetcher is None:

-         setDefaultFetcher(createHTTPFetcher())

- 

-     return _default_fetcher

- 

- def setDefaultFetcher(fetcher, wrap_exceptions=True):

-     """Set the default fetcher

- 

-     @param fetcher: The fetcher to use as the default HTTP fetcher

-     @type fetcher: HTTPFetcher

- 

-     @param wrap_exceptions: Whether to wrap exceptions thrown by the

-         fetcher wil HTTPFetchingError so that they may be caught

-         easier. By default, exceptions will be wrapped. In general,

-         unwrapped fetchers are useful for debugging of fetching errors

-         or if your fetcher raises well-known exceptions that you would

-         like to catch.

-     @type wrap_exceptions: bool

-     """

-     global _default_fetcher

-     if fetcher is None or not wrap_exceptions:

-         _default_fetcher = fetcher

-     else:

-         _default_fetcher = ExceptionWrappingFetcher(fetcher)

- 

- def usingCurl():

-     """Whether the currently set HTTP fetcher is a Curl HTTP fetcher."""

-     fetcher = getDefaultFetcher()

-     if isinstance(fetcher, ExceptionWrappingFetcher):

-         fetcher = fetcher.fetcher

-     return isinstance(fetcher, CurlHTTPFetcher)

- 

- class HTTPResponse(object):

-     """XXX document attributes"""

-     headers = None

-     status = None

-     body = None

-     final_url = None

- 

-     def __init__(self, final_url=None, status=None, headers=None, body=None):

-         self.final_url = final_url

-         self.status = status

-         self.headers = headers

-         self.body = body

- 

-     def __repr__(self):

-         return "<%s status %s for %s>" % (self.__class__.__name__,

-                                           self.status,

-                                           self.final_url)

- 

- class HTTPFetcher(object):

-     """

-     This class is the interface for openid HTTP fetchers.  This

-     interface is only important if you need to write a new fetcher for

-     some reason.

-     """

- 

-     def fetch(self, url, body=None, headers=None):

-         """

-         This performs an HTTP POST or GET, following redirects along

-         the way. If a body is specified, then the request will be a

-         POST. Otherwise, it will be a GET.

- 

- 

-         @param headers: HTTP headers to include with the request

-         @type headers: {str:str}

- 

-         @return: An object representing the server's HTTP response. If

-             there are network or protocol errors, an exception will be

-             raised. HTTP error responses, like 404 or 500, do not

-             cause exceptions.

- 

-         @rtype: L{HTTPResponse}

- 

-         @raise Exception: Different implementations will raise

-             different errors based on the underlying HTTP library.

-         """

-         raise NotImplementedError

- 

- def _allowedURL(url):

-     return url.startswith('http://') or url.startswith('https://')

- 

- class HTTPFetchingError(Exception):

-     """Exception that is wrapped around all exceptions that are raised

-     by the underlying fetcher when using the ExceptionWrappingFetcher

- 

-     @ivar why: The exception that caused this exception

-     """

-     def __init__(self, why=None):

-         Exception.__init__(self, why)

-         self.why = why

- 

- class ExceptionWrappingFetcher(HTTPFetcher):

-     """Fetcher that wraps another fetcher, causing all exceptions

- 

-     @cvar uncaught_exceptions: Exceptions that should be exposed to the

-         user if they are raised by the fetch call

-     """

- 

-     uncaught_exceptions = (SystemExit, KeyboardInterrupt, MemoryError)

- 

-     def __init__(self, fetcher):

-         self.fetcher = fetcher

- 

-     def fetch(self, *args, **kwargs):

-         try:

-             return self.fetcher.fetch(*args, **kwargs)

-         except self.uncaught_exceptions:

-             raise

-         except:

-             exc_cls, exc_inst = sys.exc_info()[:2]

-             if exc_inst is None:

-                 # string exceptions

-                 exc_inst = exc_cls

- 

-             raise HTTPFetchingError(why=exc_inst)

- 

- class Urllib2Fetcher(HTTPFetcher):

-     """An C{L{HTTPFetcher}} that uses urllib2.

-     """

- 

-     # Parameterized for the benefit of testing frameworks, see

-     # http://trac.openidenabled.com/trac/ticket/85

-     urlopen = staticmethod(urllib2.urlopen)

- 

-     def fetch(self, url, body=None, headers=None):

-         if not _allowedURL(url):

-             raise ValueError('Bad URL scheme: %r' % (url,))

- 

-         if headers is None:

-             headers = {}

- 

-         headers.setdefault(

-             'User-Agent',

-             "%s Python-urllib/%s" % (USER_AGENT, urllib2.__version__,))

- 

-         req = urllib2.Request(url, data=body, headers=headers)

-         try:

-             f = self.urlopen(req)

-             try:

-                 return self._makeResponse(f)

-             finally:

-                 f.close()

-         except urllib2.HTTPError, why:

-             try:

-                 return self._makeResponse(why)

-             finally:

-                 why.close()

- 

-     def _makeResponse(self, urllib2_response):

-         resp = HTTPResponse()

-         resp.body = urllib2_response.read(MAX_RESPONSE_KB * 1024)

-         resp.final_url = urllib2_response.geturl()

-         resp.headers = dict(urllib2_response.info().items())

- 

-         if hasattr(urllib2_response, 'code'):

-             resp.status = urllib2_response.code

-         else:

-             resp.status = 200

- 

-         return resp

- 

- class HTTPError(HTTPFetchingError):

-     """

-     This exception is raised by the C{L{CurlHTTPFetcher}} when it

-     encounters an exceptional situation fetching a URL.

-     """

-     pass

- 

- # XXX: define what we mean by paranoid, and make sure it is.

- class CurlHTTPFetcher(HTTPFetcher):

-     """

-     An C{L{HTTPFetcher}} that uses pycurl for fetching.

-     See U{http://pycurl.sourceforge.net/}.

-     """

-     ALLOWED_TIME = 20 # seconds

- 

-     def __init__(self):

-         HTTPFetcher.__init__(self)

-         if pycurl is None:

-             raise RuntimeError('Cannot find pycurl library')

- 

-     def _parseHeaders(self, header_file):

-         header_file.seek(0)

- 

-         # Remove the status line from the beginning of the input

-         unused_http_status_line = header_file.readline().lower ()

-         while unused_http_status_line.lower().startswith('http/1.1 1'):

-             unused_http_status_line = header_file.readline()

-             unused_http_status_line = header_file.readline()

- 

-         lines = [line.strip() for line in header_file]

- 

-         # and the blank line from the end

-         empty_line = lines.pop()

-         if empty_line:

-             raise HTTPError("No blank line at end of headers: %r" % (line,))

- 

-         headers = {}

-         for line in lines:

-             try:

-                 name, value = line.split(':', 1)

-             except ValueError:

-                 raise HTTPError(

-                     "Malformed HTTP header line in response: %r" % (line,))

- 

-             value = value.strip()

- 

-             # HTTP headers are case-insensitive

-             name = name.lower()

-             headers[name] = value

- 

-         return headers

- 

-     def _checkURL(self, url):

-         # XXX: document that this can be overridden to match desired policy

-         # XXX: make sure url is well-formed and routeable

-         return _allowedURL(url)

- 

-     def fetch(self, url, body=None, headers=None):

-         stop = int(time.time()) + self.ALLOWED_TIME

-         off = self.ALLOWED_TIME

- 

-         if headers is None:

-             headers = {}

- 

-         headers.setdefault('User-Agent',

-                            "%s %s" % (USER_AGENT, pycurl.version,))

- 

-         header_list = []

-         if headers is not None:

-             for header_name, header_value in headers.iteritems():

-                 header_list.append('%s: %s' % (header_name, header_value))

- 

-         c = pycurl.Curl()

-         try:

-             c.setopt(pycurl.NOSIGNAL, 1)

- 

-             if header_list:

-                 c.setopt(pycurl.HTTPHEADER, header_list)

- 

-             # Presence of a body indicates that we should do a POST

-             if body is not None:

-                 c.setopt(pycurl.POST, 1)

-                 c.setopt(pycurl.POSTFIELDS, body)

- 

-             while off > 0:

-                 if not self._checkURL(url):

-                     raise HTTPError("Fetching URL not allowed: %r" % (url,))

- 

-                 data = cStringIO.StringIO()

-                 def write_data(chunk):

-                     if data.tell() > 1024*MAX_RESPONSE_KB:

-                         return 0

-                     else:

-                         return data.write(chunk)

- 

-                 response_header_data = cStringIO.StringIO()

-                 c.setopt(pycurl.WRITEFUNCTION, write_data)

-                 c.setopt(pycurl.HEADERFUNCTION, response_header_data.write)

-                 c.setopt(pycurl.TIMEOUT, off)

-                 c.setopt(pycurl.URL, openid.urinorm.urinorm(url))

- 

-                 c.perform()

- 

-                 response_headers = self._parseHeaders(response_header_data)

-                 code = c.getinfo(pycurl.RESPONSE_CODE)

-                 if code in [301, 302, 303, 307]:

-                     url = response_headers.get('location')

-                     if url is None:

-                         raise HTTPError(

-                             'Redirect (%s) returned without a location' % code)

- 

-                     # Redirects are always GETs

-                     c.setopt(pycurl.POST, 0)

- 

-                     # There is no way to reset POSTFIELDS to empty and

-                     # reuse the connection, but we only use it once.

-                 else:

-                     resp = HTTPResponse()

-                     resp.headers = response_headers

-                     resp.status = code

-                     resp.final_url = url

-                     resp.body = data.getvalue()

-                     return resp

- 

-                 off = stop - int(time.time())

- 

-             raise HTTPError("Timed out fetching: %r" % (url,))

-         finally:

-             c.close()

- 

- class HTTPLib2Fetcher(HTTPFetcher):

-     """A fetcher that uses C{httplib2} for performing HTTP

-     requests. This implementation supports HTTP caching.

- 

-     @see: http://bitworking.org/projects/httplib2/

-     """

- 

-     def __init__(self, cache=None):

-         """@param cache: An object suitable for use as an C{httplib2}

-             cache. If a string is passed, it is assumed to be a

-             directory name.

-         """

-         if httplib2 is None:

-             raise RuntimeError('Cannot find httplib2 library. '

-                                'See http://bitworking.org/projects/httplib2/')

- 

-         super(HTTPLib2Fetcher, self).__init__()

- 

-         # An instance of the httplib2 object that performs HTTP requests

-         self.httplib2 = httplib2.Http(cache)

- 

-         # We want httplib2 to raise exceptions for errors, just like

-         # the other fetchers.

-         self.httplib2.force_exception_to_status_code = False

- 

-     def fetch(self, url, body=None, headers=None):

-         """Perform an HTTP request

- 

-         @raises Exception: Any exception that can be raised by httplib2

- 

-         @see: C{L{HTTPFetcher.fetch}}

-         """

-         if body:

-             method = 'POST'

-         else:

-             method = 'GET'

- 

-         if headers is None:

-             headers = {}

- 

-         # httplib2 doesn't check to make sure that the URL's scheme is

-         # 'http' so we do it here.

-         if not (url.startswith('http://') or url.startswith('https://')):

-             raise ValueError('URL is not a HTTP URL: %r' % (url,))

- 

-         httplib2_response, content = self.httplib2.request(

-             url, method, body=body, headers=headers)

- 

-         # Translate the httplib2 response to our HTTP response abstraction

- 

-         # When a 400 is returned, there is no "content-location"

-         # header set. This seems like a bug to me. I can't think of a

-         # case where we really care about the final URL when it is an

-         # error response, but being careful about it can't hurt.

-         try:

-             final_url = httplib2_response['content-location']

-         except KeyError:

-             # We're assuming that no redirects occurred

-             assert not httplib2_response.previous

- 

-             # And this should never happen for a successful response

-             assert httplib2_response.status != 200

-             final_url = url

- 

-         return HTTPResponse(

-             body=content,

-             final_url=final_url,

-             headers=dict(httplib2_response.items()),

-             status=httplib2_response.status,

-             )

- <VirtualHost *:80>

-     ServerAdmin admin@fedoraproject.org

-     ServerName {{ ansible_hostname }}

- </VirtualHost>

- <VirtualHost *:443>

-     ServerAdmin admin@fedoraproject.org

-     ServerName {{ ansible_hostname }}

- 

-     SSLEngine on

-     SSLCertificateFile    /etc/pki/tls/certs/localhost.crt

-     SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

-     #SSLCertificateChainFile /etc/pki/tls/cert.pem

-     SSLHonorCipherOrder On

-     SSLCipherSuite {{ ssl_ciphers }}

-     SSLProtocol {{ ssl_protocols }}

- </VirtualHost>

- 

- {{ mailman_webui_basedir }}/var/logs/*.log {

-     missingok

-     sharedscripts

-     su mailman mailman

-     postrotate

-         /bin/kill -HUP `cat {{ mailman_webui_basedir }}/var/master.pid 2>/dev/null` 2>/dev/null || true

-         # Don't run "mailman3 reopen" with SELinux on here in the logrotate

-         # context, it will be blocked

-         #/usr/bin/mailman3 reopen >/dev/null 2>&1 || true

-     endscript

- }

- [Unit]

- Description=GNU Mailing List Manager

- After=syslog.target network.target

- 

- [Service]

- Type=forking

- PIDFile={{ mailman_webui_basedir }}/var/master.pid

- User=mailman

- Group=mailman

- ExecStart={{ mailman_webui_basedir }}/venv-3.4/bin/mailman -C /etc/mailman.cfg start

- ExecReload={{ mailman_webui_basedir }}/venv-3.4/bin/mailman -C /etc/mailman.cfg restart

- ExecStop={{ mailman_webui_basedir }}/venv-3.4/bin/mailman -C /etc/mailman.cfg stop

- 

- [Install]

- WantedBy=multi-user.target

- local   all         all                               peer

- host    all         all         127.0.0.1/32          md5

- host    all         all         ::1/128               md5

- *:*:mailman:mailmanadmin:{{ lists_dev_mm_db_pass }}

- *:*:hyperkitty:hyperkittyadmin:{{ lists_dev_hk_db_pass }}

- LoadModule ssl_module modules/mod_ssl.so

- Listen 443

- Defaults>postgres !requiretty

-     when: inventory_hostname.startswith('mailman01.phx2') or inventory_hostname.startswith('lists-dev')

- # "false"

- # Global Postfix configuration file. This file lists only a subset

- # of all parameters. For the syntax, and for a complete parameter

- # list, see the postconf(5) manual page (command: "man 5 postconf").

- #

- # For common configuration examples, see BASIC_CONFIGURATION_README

- # and STANDARD_CONFIGURATION_README. To find these documents, use

- # the command "postconf html_directory readme_directory", or go to

- # http://www.postfix.org/.

- #

- # For best results, change no more than 2-3 parameters at a time,

- # and test if Postfix still works after every change.

- 

- # SOFT BOUNCE

- #

- # The soft_bounce parameter provides a limited safety net for

- # testing.  When soft_bounce is enabled, mail will remain queued that

- # would otherwise bounce. This parameter disables locally-generated

- # bounces, and prevents the SMTP server from rejecting mail permanently

- # (by changing 5xx replies into 4xx replies). However, soft_bounce

- # is no cure for address rewriting mistakes or mail routing mistakes.

- #

- #soft_bounce = no

- 

- # LOCAL PATHNAME INFORMATION

- #

- # The queue_directory specifies the location of the Postfix queue.

- # This is also the root directory of Postfix daemons that run chrooted.

- # See the files in examples/chroot-setup for setting up Postfix chroot

- # environments on different UNIX systems.

- #

- queue_directory = /var/spool/postfix

- 

- # The command_directory parameter specifies the location of all

- # postXXX commands.

- #

- command_directory = /usr/sbin

- 

- # The daemon_directory parameter specifies the location of all Postfix

- # daemon programs (i.e. programs listed in the master.cf file). This

- # directory must be owned by root.

- #

- daemon_directory = /usr/libexec/postfix

- 

- # QUEUE AND PROCESS OWNERSHIP

- #

- # The mail_owner parameter specifies the owner of the Postfix queue

- # and of most Postfix daemon processes.  Specify the name of a user

- # account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS

- # AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM.  In

- # particular, don't specify nobody or daemon. PLEASE USE A DEDICATED

- # USER.

- #

- mail_owner = postfix

- 

- # The default_privs parameter specifies the default rights used by

- # the local delivery agent for delivery to external file or command.

- # These rights are used in the absence of a recipient user context.

- # DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER.

- #

- #default_privs = nobody

- 

- # INTERNET HOST AND DOMAIN NAMES

- # 

- # The myhostname parameter specifies the internet hostname of this

- # mail system. The default is to use the fully-qualified domain name

- # from gethostname(). $myhostname is used as a default value for many

- # other configuration parameters.

- #

- #myhostname = host.domain.tld

- #myhostname = virtual.domain.tld

- 

- # The mydomain parameter specifies the local internet domain name.

- # The default is to use $myhostname minus the first component.

- # $mydomain is used as a default value for many other configuration

- # parameters.

- #

- #mydomain = domain.tld

- 

- # SENDING MAIL

- # 

- # The myorigin parameter specifies the domain that locally-posted

- # mail appears to come from. The default is to append $myhostname,

- # which is fine for small sites.  If you run a domain with multiple

- # machines, you should (1) change this to $mydomain and (2) set up

- # a domain-wide alias database that aliases each user to

- # user@that.users.mailhost.

- #

- # For the sake of consistency between sender and recipient addresses,

- # myorigin also specifies the default domain name that is appended

- # to recipient addresses that have no @domain part.

- #

- #myorigin = $myhostname

- #myorigin = $mydomain

- 

- mydomain = fedoraproject.org

- myorigin = fedoraproject.org

- 

- # RECEIVING MAIL

- 

- # The inet_interfaces parameter specifies the network interface

- # addresses that this mail system receives mail on.  By default,

- # the software claims all active interfaces on the machine. The

- # parameter also controls delivery of mail to user@[ip.address].

- #

- # See also the proxy_interfaces parameter, for network addresses that

- # are forwarded to us via a proxy or network address translator.

- #

- # Note: you need to stop/start Postfix when this parameter changes.

- #

- #inet_interfaces = all

- #inet_interfaces = $myhostname

- #inet_interfaces = $myhostname, localhost

- inet_interfaces = all

- 

- # The proxy_interfaces parameter specifies the network interface

- # addresses that this mail system receives mail on by way of a

- # proxy or network address translation unit. This setting extends

- # the address list specified with the inet_interfaces parameter.

- #

- # You must specify your proxy/NAT addresses when your system is a

- # backup MX host for other domains, otherwise mail delivery loops

- # will happen when the primary MX host is down.

- #

- #proxy_interfaces =

- #proxy_interfaces = 1.2.3.4

- 

- # The mydestination parameter specifies the list of domains that this

- # machine considers itself the final destination for.

- #

- # These domains are routed to the delivery agent specified with the

- # local_transport parameter setting. By default, that is the UNIX

- # compatible delivery agent that lookups all recipients in /etc/passwd

- # and /etc/aliases or their equivalent.

- #

- # The default is $myhostname + localhost.$mydomain.  On a mail domain

- # gateway, you should also include $mydomain.

- #

- # Do not specify the names of virtual domains - those domains are

- # specified elsewhere (see VIRTUAL_README).

- #

- # Do not specify the names of domains that this machine is backup MX

- # host for. Specify those names via the relay_domains settings for

- # the SMTP server, or use permit_mx_backup if you are lazy (see

- # STANDARD_CONFIGURATION_README).

- #

- # The local machine is always the final destination for mail addressed

- # to user@[the.net.work.address] of an interface that the mail system

- # receives mail on (see the inet_interfaces parameter).

- #

- # Specify a list of host or domain names, /file/name or type:table

- # patterns, separated by commas and/or whitespace. A /file/name

- # pattern is replaced by its contents; a type:table is matched when

- # a name matches a lookup key (the right-hand side is ignored).

- # Continue long lines by starting the next line with whitespace.

- #

- # See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".

- #

- mydestination = $myhostname, localhost.$mydomain, localhost, lists-dev.cloud.fedoraproject.org

- #mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

- #mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,

- #	mail.$mydomain, www.$mydomain, ftp.$mydomain

- 

- # REJECTING MAIL FOR UNKNOWN LOCAL USERS

- #

- # The local_recipient_maps parameter specifies optional lookup tables

- # with all names or addresses of users that are local with respect

- # to $mydestination, $inet_interfaces or $proxy_interfaces.

- #

- # If this parameter is defined, then the SMTP server will reject

- # mail for unknown local users. This parameter is defined by default.

- #

- # To turn off local recipient checking in the SMTP server, specify

- # local_recipient_maps = (i.e. empty).

- #

- # The default setting assumes that you use the default Postfix local

- # delivery agent for local delivery. You need to update the

- # local_recipient_maps setting if:

- #

- # - You define $mydestination domain recipients in files other than

- #   /etc/passwd, /etc/aliases, or the $virtual_alias_maps files.

- #   For example, you define $mydestination domain recipients in    

- #   the $virtual_mailbox_maps files.

- #

- # - You redefine the local delivery agent in master.cf.

- #

- # - You redefine the "local_transport" setting in main.cf.

- #

- # - You use the "luser_relay", "mailbox_transport", or "fallback_transport"

- #   feature of the Postfix local delivery agent (see local(8)).

- #

- # Details are described in the LOCAL_RECIPIENT_README file.

- #

- # Beware: if the Postfix SMTP server runs chrooted, you probably have

- # to access the passwd file via the proxymap service, in order to

- # overcome chroot restrictions. The alternative, having a copy of

- # the system passwd file in the chroot jail is just not practical.

- #

- # The right-hand side of the lookup tables is conveniently ignored.

- # In the left-hand side, specify a bare username, an @domain.tld

- # wild-card, or specify a user@domain.tld address.

- # 

- #local_recipient_maps = unix:passwd.byname $alias_maps

- #local_recipient_maps = proxy:unix:passwd.byname $alias_maps

- #local_recipient_maps =

- 

- # The unknown_local_recipient_reject_code specifies the SMTP server

- # response code when a recipient domain matches $mydestination or

- # ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty

- # and the recipient address or address local-part is not found.

- #

- # The default setting is 550 (reject mail) but it is safer to start

- # with 450 (try again later) until you are certain that your

- # local_recipient_maps settings are OK.

- #

- unknown_local_recipient_reject_code = 550

- 

- # TRUST AND RELAY CONTROL

- 

- # The mynetworks parameter specifies the list of "trusted" SMTP

- # clients that have more privileges than "strangers".

- #

- # In particular, "trusted" SMTP clients are allowed to relay mail

- # through Postfix.  See the smtpd_recipient_restrictions parameter

- # in postconf(5).

- #

- # You can specify the list of "trusted" network addresses by hand

- # or you can let Postfix do it for you (which is the default).

- #

- # By default (mynetworks_style = subnet), Postfix "trusts" SMTP

- # clients in the same IP subnetworks as the local machine.

- # On Linux, this does works correctly only with interfaces specified

- # with the "ifconfig" command.

- # 

- # Specify "mynetworks_style = class" when Postfix should "trust" SMTP

- # clients in the same IP class A/B/C networks as the local machine.

- # Don't do this with a dialup site - it would cause Postfix to "trust"

- # your entire provider's network.  Instead, specify an explicit

- # mynetworks list by hand, as described below.

- #  

- # Specify "mynetworks_style = host" when Postfix should "trust"

- # only the local machine.

- # 

- #mynetworks_style = class

- #mynetworks_style = subnet

- #mynetworks_style = host

- 

- # Alternatively, you can specify the mynetworks list by hand, in

- # which case Postfix ignores the mynetworks_style setting.

- #

- # Specify an explicit list of network/netmask patterns, where the

- # mask specifies the number of bits in the network part of a host

- # address.

- #

- # You can also specify the absolute pathname of a pattern file instead

- # of listing the patterns here. Specify type:table for table-based lookups

- # (the value on the table right-hand side is not used).

- #

- #mynetworks = 168.100.189.0/28, 127.0.0.0/8

- #mynetworks = $config_directory/mynetworks

- #mynetworks = hash:/etc/postfix/network_table

- 

- 

- # The relay_domains parameter restricts what destinations this system will

- # relay mail to.  See the smtpd_recipient_restrictions description in

- # postconf(5) for detailed information.

- #

- # By default, Postfix relays mail

- # - from "trusted" clients (IP address matches $mynetworks) to any destination,

- # - from "untrusted" clients to destinations that match $relay_domains or

- #   subdomains thereof, except addresses with sender-specified routing.

- # The default relay_domains value is $mydestination.

- # 

- # In addition to the above, the Postfix SMTP server by default accepts mail

- # that Postfix is final destination for:

- # - destinations that match $inet_interfaces or $proxy_interfaces,

- # - destinations that match $mydestination

- # - destinations that match $virtual_alias_domains,

- # - destinations that match $virtual_mailbox_domains.

- # These destinations do not need to be listed in $relay_domains.

- # 

- # Specify a list of hosts or domains, /file/name patterns or type:name

- # lookup tables, separated by commas and/or whitespace.  Continue

- # long lines by starting the next line with whitespace. A file name

- # is replaced by its contents; a type:name table is matched when a

- # (parent) domain appears as lookup key.

- #

- # NOTE: Postfix will not automatically forward mail for domains that

- # list this system as their primary or backup MX host. See the

- # permit_mx_backup restriction description in postconf(5).

- #

- #relay_domains = $mydestination

- 

- 

- 

- # INTERNET OR INTRANET

- 

- # The relayhost parameter specifies the default host to send mail to

- # when no entry is matched in the optional transport(5) table. When

- # no relayhost is given, mail is routed directly to the destination.

- #

- # On an intranet, specify the organizational domain name. If your

- # internal DNS uses no MX records, specify the name of the intranet

- # gateway host instead.

- #

- # In the case of SMTP, specify a domain, host, host:port, [host]:port,

- # [address] or [address]:port; the form [host] turns off MX lookups.

- #

- # If you're connected via UUCP, see also the default_transport parameter.

- #

- #relayhost = $mydomain

- #relayhost = [gateway.my.domain]

- #relayhost = [mailserver.isp.tld]

- #relayhost = uucphost

- #relayhost = [an.ip.add.ress]

- 

- 

- # REJECTING UNKNOWN RELAY USERS

- #

- # The relay_recipient_maps parameter specifies optional lookup tables

- # with all addresses in the domains that match $relay_domains.

- #

- # If this parameter is defined, then the SMTP server will reject

- # mail for unknown relay users. This feature is off by default.

- #

- # The right-hand side of the lookup tables is conveniently ignored.

- # In the left-hand side, specify an @domain.tld wild-card, or specify

- # a user@domain.tld address.

- # 

- #relay_recipient_maps = hash:/etc/postfix/relay_recipients

- 

- # INPUT RATE CONTROL

- #

- # The in_flow_delay configuration parameter implements mail input

- # flow control. This feature is turned on by default, although it

- # still needs further development (it's disabled on SCO UNIX due

- # to an SCO bug).

- # 

- # A Postfix process will pause for $in_flow_delay seconds before

- # accepting a new message, when the message arrival rate exceeds the

- # message delivery rate. With the default 100 SMTP server process

- # limit, this limits the mail inflow to 100 messages a second more

- # than the number of messages delivered per second.

- # 

- # Specify 0 to disable the feature. Valid delays are 0..10.

- # 

- #in_flow_delay = 1s

- 

- # ADDRESS REWRITING

- #

- # The ADDRESS_REWRITING_README document gives information about