Continuing the discussion of a strawman user interface, I see some
opportunities to generalize this and to make some improvements
elsewhere in Postfix.
We start with Postfix access control based on client certificate
feartures:
smtpd_mumble_restrictions =
...
check_tls_access {
maptype:mapname,
{ search = rfc822name, subject_dn, smtputf8mailbox, ... } }
...
where the 'search' attribute specifies a list with one or more of
rfc822name, subject_dn, smtputf8mailbox, key_fingerprint, and so on.
This requires new infrastructure that converts the 'search' list
into a list of named constants (internally, a vector of NAME_CODE
results). check_tls_access is then implemented as a loop over the
internal form of the search list.
So far, so good.
Would this syntax also be useful for other Postfix features? It
would be good if it does. Here's a strawman inside a strawman.
Once the above is implemented, the same approach could be used to
improve other parts of Postfix by making existing hard-coded behavior
configurable, for example how check_client_access looks up subnet
and partial address information, or how virtual_alias_maps looks
up full and partial address forms. The examples below show the
lookup order that is currently hard-coded.
smtpd_mumble_restrictions =
...
check_client_access {
maptype:mapname,
# instead of parent, maybe use dot-parent or no parent
{ search = domain, parent, address, subnet }
}
...
virtual_alias_maps = {
hash:/etc/postfix/virtual,
{ search = full, full-noext, localpart-if-local, at-domain }
} {
other table ...
}
Ditto for canonical_maps and transport_maps.
This would be a compatibility break, because with the above, all
virtual_alias_maps searches are done on the first table before
trying the next table. One could argue that current behavior is
non-intuitive.
Another possible benefit: this syntax may be useful to support
substring queries with 'postmap -q'.
To make the main.cf configuration easier to use, the config file
parser could be modified to process '}' at the start of a line as
the continuation of the preceding line. This would be a simple change.
Wietse
