From fc5794b0404d44bf03f97dbecd3fd45b52de3286 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Fri, 11 Sep 2026 05:14:46 +0200
Subject: [PATCH] Fix Postfix map updates failing when CIDR tables are
 configured

---
 CHANGELOG.md           |  1 +
 postfix/postfix-lib.pl |  4 +++-
 postfix/t/run-tests.t  | 30 ++++++++++++++++++++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 362646af1..af51113da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@
 * Add DNF 4 and 5 package hold management to the Software Package Updates module
 * Add `return` based redirects with 301, 302, 303, 307 and 308 codes to the URL Re-Writing pages in the Nginx Webserver module [forum.virtualmin.com/t/137940](https://forum.virtualmin.com/t/137940)
 * Fix DNF update confirmations by previewing packages and dependencies that will be installed or updated
+* Fix Postfix map updates failing when CIDR tables are configured
 * Fix PostgreSQL initialization on EL systems to use SCRAM-SHA-256 authentication by default
 * Fix IPsec host key generation with modern Libreswan [#2132](https://github.com/webmin/webmin/issues/2132)
 * Fix journal since filter showing oldest entries on older systemd [forum.virtualmin.com/t/137876](https://forum.virtualmin.com/t/137876)
diff --git a/postfix/postfix-lib.pl b/postfix/postfix-lib.pl
index 7836c4afe..1823b54ab 100755
--- a/postfix/postfix-lib.pl
+++ b/postfix/postfix-lib.pl
@@ -804,8 +804,10 @@ sub regenerate_any_table
     foreach my $map (@files)
     {
         next unless $map;
+	# Text maps are read directly by Postfix and cannot be indexed.
 	if (&file_map_type($map->[0]) &&
-	    $map->[0] ne 'regexp' && $map->[0] ne 'pcre') {
+	    $map->[0] ne 'regexp' && $map->[0] ne 'pcre' &&
+	    $map->[0] ne 'cidr') {
 		my $out = &backquote_logged(
 			$config{'postfix_lookup_table_command'}.
 			" -c $config_dir".
diff --git a/postfix/t/run-tests.t b/postfix/t/run-tests.t
index 4b0fdfbb7..b1de508a9 100644
--- a/postfix/t/run-tests.t
+++ b/postfix/t/run-tests.t
@@ -118,6 +118,36 @@ is_deeply([ get_maps_types_files('') ], [],
 is_deeply([ get_maps_types_files('garbage-without-colon') ], [],
           'unparseable value yields no maps');
 
+# --- map regeneration ----------------------------------------------------
+# Rebuild only indexed maps, preserving their configured types. Text and
+# external database maps must never be passed to postmap for indexing.
+{
+    no warnings qw(redefine once);
+    my @commands;
+    my $maps = 'hash:/fixture/hash, lmdb:/fixture/lmdb, btree:/fixture/btree, '.
+               'dbm:/fixture/dbm, regexp:/fixture/regexp, pcre:/fixture/pcre, '.
+               'cidr:/fixture/cidr, mysql:/fixture/mysql';
+    local *get_current_value = sub { return $maps; };
+    local *get_real_value = sub { return $maps; };
+    local *backquote_logged = sub { push(@commands, $_[0]); $? = 0; return ''; };
+    local $config{'postfix_lookup_table_command'} = '/fixture/postmap';
+    regenerate_transport_table();
+    is(scalar(@commands), 4, 'only indexed maps are rebuilt');
+    foreach my $type ('hash', 'lmdb', 'btree', 'dbm') {
+        ok(scalar(grep { index($_, "$type:/fixture/$type") >= 0 } @commands),
+           "$type map keeps its configured type");
+    }
+    @commands = ();
+    $maps = 'cidr:/fixture/cidr';
+    regenerate_transport_table();
+    is_deeply(\@commands, [], 'CIDR-only configuration requires no index');
+    local *backquote_logged = sub { $? = 256; return 'postmap failed'; };
+    local *error = sub { die $_[0]; };
+    $maps = 'hash:/fixture/hash';
+    eval { regenerate_transport_table(); };
+    like($@, qr/postmap failed/, 'indexing failures retain the Postfix error');
+}
+
 # --- get_maps_files (path extraction) --------------------------------------
 is_deeply([ get_maps_files('hash:/etc/postfix/aliases,hash:/etc/aliases') ],
           [ '/etc/postfix/aliases', '/etc/aliases' ],