CVSROOT: /cvs
Module name: src
Changes by: o...@cvs.openbsd.org 2024/01/03 01:11:15
Modified files:
usr.sbin/smtpd : envelope.c mta.c mta_session.c smtp_session.c
smtpd.h util.c
Log message:
relax ORCPT syntax validation
We expected the ORCPT parameter to be a valid rfc822 address. This is
wrong on multiple levels:
- any other IANA-registered "addr-type" can be used
- the parameter may be encoded and we didn't decode it prior validation
- RFC3461 explicitly states that "[..] the address associated with the
ORCPT keyword is NOT constrained to conform to the syntax rules for
that 'addr-type'".
Instead, just validate the xtext and preserve the ORCPT value as-is.
Issue originally reported by Tim Kuijsten, Tassilo Philipp and others.
ok millert@
