12694 lines
431 KiB
Plaintext
12694 lines
431 KiB
Plaintext
In addition to the names listed below, the following people provided
|
|
useful inputs on many occasions: Paul D. Robertson, Simon J. Mudd.
|
|
Apologies for any names omitted.
|
|
|
|
19980105
|
|
|
|
The compiled-in default value for resolve_smtp_sender was
|
|
wrong (from the days that it was a boolean), causing smtpd
|
|
to dump core when the variable was not set in main.cf.
|
|
|
|
The INSTALL instructions now have separate sections for
|
|
the three basic ways of running vmailer.
|
|
|
|
The INSTALL instructions now have discusses how to deal
|
|
with chrooted processes.
|
|
|
|
Ported to RedHat 5.0. My, these people have re-organized
|
|
their include files quite a bit, haven't they.
|
|
|
|
19980106
|
|
|
|
On RedHat Linux 4.2/5.0, when a FIFO listener opens the
|
|
FIFO with mode O_RDONLY, the FIFO remains forever readable
|
|
after the writer has closed it. Workaround: open the FIFO
|
|
mode O_RDWR.
|
|
|
|
Test program: util/fifo_rdonly_bug.c
|
|
|
|
Unfortunately, the above fix triggers a bug on BSD/OS 3.1
|
|
where opening the FIFO mode O_RDWR causes select() to claim
|
|
that the FIFO is readable even before any data is written
|
|
to it, causing read() to block or to fail.
|
|
|
|
Test program: util/fifo_rdwr_bug.c
|
|
|
|
printfck (check arguments of printf-like function calls)
|
|
found a missing argument in local/command.c
|
|
|
|
Miscellaneous Makefile cleanups that I didn't finish before
|
|
the first alpha release.
|
|
|
|
19980107
|
|
|
|
Sometimes the DNS will claim that a domain does not exist,
|
|
when in fact it does. Thus, it is a bad idea to reject mail
|
|
from apparently non-existent domains. I have changed the
|
|
smtpd so that it produces a soft error responses when a
|
|
resolve_smtp_sender test fails with HOST_NOT_FOUND. Note:
|
|
by default, this test is still disabled.
|
|
|
|
The DB and DBM read routines will now automagically figure
|
|
out if (key, value) pairs were written including a terminating
|
|
null byte or not. The DB and DBM write routines will use
|
|
this result to determine how to write, and will fall back
|
|
to per-system defaults otherwise.
|
|
|
|
Renamed the README to MUSINGS, and wrote up a README that
|
|
reflects the current status of the software.
|
|
|
|
Added -d (don't disconnect) and -c (show running counter)
|
|
option to te smtp-source test program. These tools are
|
|
great torture tests for the mail software, and for the
|
|
system that it runs on.
|
|
|
|
Turned down the process_limit parameter (# of parallel smtp
|
|
clients or servers) to avoid unpleasant surprises. You can
|
|
crank up the process_limit parameter in main.cf.
|
|
|
|
19980111
|
|
|
|
Feature: when run by the superuser, mailq now shows the
|
|
mail queue even when the mail system is down. To this end,
|
|
mailq (sendmail -bp) runs the showq program directly instead
|
|
of connecting to the UNIX-domain service socket, and drops
|
|
privileges etc. as usual.
|
|
|
|
19980119
|
|
|
|
Bugfix: Edwin Kremer spotted an oversight in the negated
|
|
host matching code (for name or address patterns prefixed
|
|
by !).
|
|
|
|
Bugfix: upon receipt of a SIGHUP signal, the master now
|
|
disconnects from its child processes, so that the current
|
|
generation of child processes commits suicide, and so that
|
|
the next generation of child processes will use the new
|
|
configuration settings.
|
|
|
|
Bugfix: the smtp server now skips the sender DNS domain
|
|
lookup test for foo@[address]
|
|
|
|
Bugfix: don't append the local domain to foo@[address]
|
|
|
|
19980120
|
|
|
|
Bugfix: old low-priority bug in some list walk code that
|
|
caused the master to drop core when a service was turned
|
|
off in master.cf.
|
|
|
|
Robustness: the mail system should be able to start up and
|
|
to accept local postings even while the naming service is
|
|
down. For this reason, the mail system no longer uses
|
|
gethostbyname() to look up its own machine name. Sites
|
|
that use short hostnames will have to specify their FQDN
|
|
in main.cf (this will eventually be done by the system
|
|
installation/configuration procedure). Should the config
|
|
language support backticks so one can say `domainname`?
|
|
What about $name stuff between the backtics?
|
|
|
|
Security: the master now creates FIFOs and UNIX-domain
|
|
sockets as the mail owner instead of as root, for better
|
|
protection against subverted mail systems. chmod() is
|
|
susceptible to race conditions. fchmod(), although safer,
|
|
often does not work on sockets.
|
|
|
|
Portability: anticipate that all major UNIXes will create
|
|
UNIX-domain sockets with permissions modified by the process
|
|
umask (required by POSIX). For this reason, we always
|
|
chmod() UNIX-domain sockets, unless the system allows us
|
|
to use the safer fchmod() instead.
|
|
|
|
Portability: the semi-resident servers now properly handle
|
|
EWOULDBLOCK returns from accept() in addition to EGAIN
|
|
(on some systems, EAGAIN and EWOULDBLOCK have different
|
|
values).
|
|
|
|
Bugfix: the semi-resident servers now properly handle EINTR
|
|
returns From accept().
|
|
|
|
Bugfix: Edwin Kremer found that mynetworks() would compute
|
|
(32 - mask) instead of mask.
|
|
|
|
19980121
|
|
|
|
Feature: /etc/vmailer/relocated is used by the local delivery
|
|
program and specifies what mail should be bounced with a
|
|
"user has moved to XXX" message. The main.cf configuration
|
|
parameter is "relocated_maps". Just like the "virtual_maps"
|
|
config parameter, this feature is off by default, and the
|
|
parameter can have values such as "files" or "files, nis"
|
|
(on hosts equipped with NIS).
|
|
|
|
19980123
|
|
|
|
Cleanup: virtual domain support moved from the queue manager
|
|
to the resolve service, where it belongs.
|
|
|
|
Feature: /etc/vmailer/canonical is used by the rewrite
|
|
service for all addresses, and maps a canonical address
|
|
(user@domain) to another address. Typical use is to generate
|
|
Firstname.Lastname@domain addresses, or to clean up dirty
|
|
addresses from non-RFC 822 mail systems. The main.cf
|
|
configuration parameter is "canonical_maps". Just like
|
|
the "virtual_maps" config parameter, this feature is off
|
|
by default, and the parameter can have values such as
|
|
"files" or "files, nis" (on hosts equipped with NIS).
|
|
|
|
19980124
|
|
|
|
HPUX10 port and many little fixes from Pieter Schoenmakers.
|
|
|
|
Bugfix: isolated an old mysterious bug that could make the
|
|
master deaf for new connections while no child process was
|
|
running. A typical result was that no pickup daemon would
|
|
be started after the previous one had terminated voluntarily.
|
|
|
|
Bugfix: the NIS lookup code did not mystrdup() the NIS map
|
|
name and would access free()d memory.
|
|
|
|
19980125
|
|
|
|
Bugfix: the vstream routines would sometimes ignore flushing
|
|
errors. The error would still be reported by vstream_fclose()
|
|
and vstream_ferror().
|
|
|
|
Feature: time limit on delivery to shell commands. Config
|
|
parameter: command_time_limit. Default value: 100 sec. The
|
|
idea is to prevent one bad .forward file or alias file
|
|
entry from slowly using up all local delivery process slots.
|
|
|
|
19980126
|
|
|
|
Code cleanup: in preparation for SMTP extensions such as
|
|
SIZE, allow an extended SMTP command to have a variable
|
|
number of options.
|
|
|
|
19980127
|
|
|
|
Bugfix: moved canonical map lookups away from the rewriting
|
|
module to the cleanup service, so that canonical map lookups
|
|
do not interfere with address rewriting on behalf of other
|
|
programs. Back to an older trivial-rewrite program version.
|
|
|
|
Bugfix: moved virtual map lookups away from the resolver
|
|
back to the queue manager, so that virtual domain lookup
|
|
does not interfere with address resolution on behalf of
|
|
other programs. Back to an older qmgr program version.
|
|
|
|
19980131
|
|
|
|
Feature: integrated and adapted Guido van Rooij's SIZE
|
|
option (RFC 1870), carefully avoiding potential problems
|
|
due to overflow (by multiplying large numbers) or unsigned
|
|
underflow (by subtracting numbers).
|
|
|
|
Code cleanup: cleaned up the code that parses the server
|
|
response to the HELO/EHLO command, so that we can more
|
|
reliably recognize what options a server supports.
|
|
|
|
19980201
|
|
|
|
Portability: integrated the IRIX 6 port by Oved Ben-Aroya.
|
|
|
|
Portability: the software now figures out by itself if a
|
|
server should open its FIFO read-write or read-only, to
|
|
avoid getting stuck with a FIFO that stays readable forever.
|
|
|
|
Bugfix: the cleanup service would terminate with a fatal
|
|
vstream_fseek() error when the queue file was too large.
|
|
|
|
Bugfix: the cleanup service could be killed by a signal
|
|
when the queue file became too large.
|
|
|
|
19980203
|
|
|
|
Portability: some systems have statfs(), some have statvfs(),
|
|
and the relevant include files are in a different place on
|
|
almost every system.
|
|
|
|
Portability: the makedefs script now nukes the -O compiler
|
|
flag when building on AIX with IBM's own compiler...
|
|
|
|
19980204
|
|
|
|
Portability: HP-UX 9.x support by Pieter Schoenmakers.
|
|
|
|
Portability: added SYSV-style ulimit() file size limit
|
|
support for HP-UX 9.x.
|
|
|
|
Portability: added some #includes that appeared to be
|
|
missing according to the Digital UNIX cc compiler.
|
|
|
|
Bugfix: sys_defs.h now correctly specifies NIS support for
|
|
LINUX2, HPUX9 and HPUX10.
|
|
|
|
Security: fixed a file descriptor leak in the local delivery
|
|
agent that could give shell commands access to the VMailer
|
|
IPC streams. This should not cause a vulnerability, given
|
|
the design and implementation of the mailer, but it would
|
|
be like asking for trouble.
|
|
|
|
Bugfix: the sendmail -B (body type) option did not take a
|
|
value.
|
|
|
|
19980205
|
|
|
|
Bugfix (SUNOS5): should not have deleted the SVID_GETTOD
|
|
definition from util/sys_defs.h.
|
|
|
|
Bugfix (HPUX9): forgot to specify whether to use statfs()
|
|
or statvfs().
|
|
|
|
Bugfix (HPUX9): don't try to raise the file size ulimit.
|
|
|
|
Bugfix (HPUX9): must specify file size limit in 512-blocks.
|
|
|
|
19980207
|
|
|
|
Robustness: the master process now raises the file size
|
|
limit when it is started with a limit that is less than
|
|
VMailer's file size limit. File: util/file_limit.c.
|
|
|
|
Security: the dns lookup routines now screen all result
|
|
names with valid_hostname(). Bad names are treated as
|
|
transient errors.
|
|
|
|
Feature: qmail compatibility: when the home_mailbox parameter
|
|
is set, mail is delivered to ~/$home_mailbox instead of to
|
|
/var[/spool]/mail/username. This hopefully makes it easier
|
|
to lure people away from qmail :-)
|
|
|
|
Robustness: several testers by accident configured relayhost
|
|
the same as myhostname. The programs now explicitly check
|
|
for this mistake.
|
|
|
|
Bugfix: deliver_request_read() would free unallocated memory
|
|
when it received an incomplete delivery request from the
|
|
queue manager.
|
|
|
|
Robustness: local_destination_concurrency=1 prevents parallel
|
|
delivery to the same user (with possibly disastrous effects
|
|
when that user has an expensive pipeline in the .forward
|
|
or procmail config file). Each transport can have its own
|
|
XXX_destination_concurrency parameter, to limit the number
|
|
of simultaneous deliveries to the same destination.
|
|
|
|
19980208
|
|
|
|
Robustness: added "slow open" mode, to gradually increase
|
|
the number of simultaneous connections to the same site as
|
|
long as delivery succeeds, and to gradually decrease the
|
|
number of connections while delivery fails. Brad Knowles
|
|
provided the inspiration to do this.
|
|
|
|
This also solves the "thundering herd" problem (making a
|
|
bunch of connections to a dead host when it was time to
|
|
retry that host). Let's see when other mailers fix this.
|
|
|
|
Feature: Added $smtpd_banner and $mail_version, for those
|
|
who want to show the world what software version they are
|
|
running.
|
|
|
|
Bugfix: vmailer-script now properly labels each syslog
|
|
entry.
|
|
|
|
19980210
|
|
|
|
Portability: merged in NEXTSTEP 3 port from Pieter Schoenmakers
|
|
|
|
Bugfix: the local delivery program now checks that a
|
|
destination is a regular file before locking it.
|
|
|
|
19980211
|
|
|
|
Robustness: the local delivery agent sets HOME, LOGNAME,
|
|
and SHELL when delivering to a user shell command. PATH is
|
|
always set, and TZ is passed through if it is set.
|
|
|
|
19980212
|
|
|
|
Feature: mailq (sendmail -bp) now also lists the maildrop
|
|
queue (with mail that hasn't been picked up yet).
|
|
|
|
19980213
|
|
|
|
Feature: the smtpd now says: 502 HELP not implemented. This
|
|
should impress the heck out of the competition :-)
|
|
|
|
19980214
|
|
|
|
Feature: local delivery to configurable system-wide command
|
|
(e.g. procmail) avoids the need for per-user ~/.forward
|
|
shell commands. Config parameter: mailbox_command.
|
|
|
|
19980215
|
|
|
|
Performance: avoid running a shell when a command contains
|
|
no shell magic characters or built-in shell commands. This
|
|
speeds up delivery to all commands. File: util/exec_command.c.
|
|
|
|
Bugfix: the local delivery agent, after reading EOF from
|
|
a child process, now sends SIGKILL only when the child does
|
|
not terminate within a limited amount of time. This avoids
|
|
some problems with procmail. File: util/timed_wait.c.
|
|
|
|
19980217
|
|
|
|
Portability: folded in NetInfo support from Pieter
|
|
Schoenmakers.
|
|
|
|
19980218
|
|
|
|
Feature: new vmlock command to run a command while keeping
|
|
an exclusive lock on a mailbox.
|
|
|
|
Feature: with "recipient_delimiter = +", mail for local
|
|
address "user+foo" is delivered to "foo", with a "Delivered-To:
|
|
user+foo@domain" message header. Files: qmgr/qmgr_message.c,
|
|
local/recipient.c. This must be the cheapest feature.
|
|
|
|
19980219
|
|
|
|
Code cleanup: moved error handling into functions that
|
|
should always succeed (non_blocking(), close_on_exec()).
|
|
|
|
19980223
|
|
|
|
Bugfix: null pointer bug in the cleanup program after
|
|
processing a From: header with no mail address (or with
|
|
only a comment).
|
|
|
|
19980226
|
|
|
|
Robustness: now detects when getpwnam() returns a name that
|
|
differs from the requested name.
|
|
|
|
Feature: Added %p support to the vbuf_print formatting
|
|
module.
|
|
|
|
Code cleanup: revamped the alias/include/.forward loop
|
|
detection and duplicate suppression code in the local
|
|
delivery agent. This must be the fourth iteration, and
|
|
again the code has been simplified.
|
|
|
|
19980228
|
|
|
|
Robustness: don't treat anything starting with whitespace
|
|
as a header record. Instead, explicitly test for leading
|
|
whitespace where we permit it. Files: global/is_header.c,
|
|
bounce/bounce_flush_service.c, local/delivered.c.
|
|
|
|
19980301
|
|
|
|
Compatibility: the sendmail program now accepts the -N
|
|
command-line option (delivery status notification) but
|
|
ignores it entirely, just like many other sendmail options.
|
|
|
|
Bugfix: dns_lookup.c was too conservative with buffer sizes
|
|
and would incorrectly report "malformed name server reply".
|
|
|
|
19980302
|
|
|
|
Bugfix: the local delivery agent was not null-byte clean.
|
|
|
|
19980307
|
|
|
|
Feature: integrated Pieter Schoenmaker's code for transport
|
|
lookup tables that list (transport, nexthop) by destination.
|
|
|
|
19980309
|
|
|
|
Bugfix: delivery agents no longer rename corrupt queue
|
|
files, because programs might fall over each other doing
|
|
so. Instead, when a delivery agent detects queue file
|
|
corruption, it chmods the queue file, simulates a soft
|
|
error, and lets the queue manager take care of the problem.
|
|
|
|
Bugfix: the SMTP server implemented VRFY incorrectly.
|
|
|
|
Feature: first shot at a pipe mailer, which can be used to
|
|
extend VMailer with external mail transports such as UUCP
|
|
(provided that the remote site understands domain addressing,
|
|
because VMailer version 1 does not rewrite addresses).
|
|
|
|
Cleanup: extended the master/child interface so that the
|
|
service name (from master.cf) is passed on to the child.
|
|
The pipe mailer needs the service name so it can look up
|
|
service-specific configuration parameters (privilege level,
|
|
recipient limit, time limit, and so on).
|
|
|
|
19980310-12
|
|
|
|
Cleanup: factored out the pipe_command() code, so it can
|
|
be shared between pipe mailer and local delivery agent.
|
|
|
|
19980314
|
|
|
|
Compatibility: the sendmail program now parses each
|
|
command-line recipient as if it were an RFC 822 message
|
|
header; some MUAs specify comma-separated recipients in a
|
|
command-line argument; and some MUAs even specify "word
|
|
word <address>" forms as command-line arguments.
|
|
|
|
19980315
|
|
|
|
Bugfix: VMailer's queue processing randomization wasn't
|
|
adequate for unloaded systems with small backlogs.
|
|
|
|
Bugfix: smtpd now uses double-buffered stream I/O to prevent
|
|
loss of input sent ahead of responses.
|
|
|
|
19980316
|
|
|
|
Bugfix: the smtpd anti-relay code didn't treat all hosts
|
|
listed in $mydestinations as local, so it would accept mail
|
|
only for hosts listed in $relay_domains (default: my own
|
|
domain).
|
|
|
|
Bugfix: smtpd now replies with 502 when given an unknown
|
|
command.
|
|
|
|
19980318
|
|
|
|
Cleanup: resolve/rewrite clients now automatically disconnect
|
|
after a configurable amount of idle time (ipc_idle).
|
|
|
|
19980322
|
|
|
|
Tolerance: VRFY now permits user@domain, even though the
|
|
RFC requires that special characters such as @ be escaped.
|
|
|
|
19980325
|
|
|
|
Bugfix: a recipient delimiter of "-" could interfere with
|
|
special addresses such as owner-xxx or double-bounce.
|
|
|
|
Tolerance: the SMTP client now permits blank lines in SMTP
|
|
server responses.
|
|
|
|
Tolerance: the SMTP client now falls back to SMTP when it
|
|
apparently mistook an SMTP server as ESMTP capable.
|
|
|
|
Bugfix: eliminated strtok() calls in favor of mystrtok().
|
|
Symptom: master.cf parsing would break if $inet_interfaces
|
|
was more than one word.
|
|
|
|
19980328
|
|
|
|
Bugfix: user->addr patterns in canonical and virtual tables
|
|
matched only $myorigin, not hosts listed in $mydestination
|
|
or addresses listed in $inet_interfaces. The man pages
|
|
were wrong too. File: global/addr_match.c.
|
|
|
|
19980401
|
|
|
|
Robustness: FIFO file permissions now default to 0622. On
|
|
some systems, opening a FIFO read-only could deafen the
|
|
pickup daemon. Only the listener end (which is opened as
|
|
root) needs read access anyway, so there should not be a
|
|
loss of functionality by making FIFOs non-readable for
|
|
non-mail processes.
|
|
|
|
19980402
|
|
|
|
Compatibility: sendmail -I and -c options added.
|
|
|
|
19980403
|
|
|
|
Feature: virtual lookups are now recursive. File:
|
|
qmgr/qmgr_message.c
|
|
|
|
19980405
|
|
|
|
Implemented sendmail -bs (stand-alone) mode. This mode runs
|
|
as the user and therefore deposits into the maildrop queue.
|
|
|
|
19980406
|
|
|
|
The pickup service now removes malformed maildrop files.
|
|
|
|
19980407
|
|
|
|
The pickup service now guards against maildrop files with
|
|
time stamps dated into the future.
|
|
|
|
19980408
|
|
|
|
Bugfix: in the canonical and virtual maps, foo->address
|
|
would match foo@$myorigin only. This has been fixed to also
|
|
match hosts listed in main.cf:$mydestination and the
|
|
addresses listed in main.cf:$inet_interfaces.
|
|
|
|
Bugfix: added double buffering support to the VMailer SMTP
|
|
server. This makes the SMTP server robust against SMTP
|
|
clients that talk ahead of time, and should have been in
|
|
there from day one.
|
|
|
|
19980409
|
|
|
|
Bugfix: the VMailer SMTP client now recognizes its own
|
|
hostname in the SMTP greeting banner only when that name
|
|
appears as the first word on the first line.
|
|
|
|
19980410
|
|
|
|
Feature: smtpd now logs the local queue ID along with the
|
|
client name/address, and pickup now logs the local queue
|
|
ID along with the message owner.
|
|
|
|
Bugfix: still didn't do virtual/canonical lookups right
|
|
(code used the non-case-folded key instead of the case
|
|
folded one).
|
|
|
|
19980418
|
|
|
|
Bugfix: the SMTP server did not flush the "250 OK queued
|
|
as XXXX" message from the SMTP conversation history.
|
|
|
|
19980419
|
|
|
|
Bugfix: qmgr would not notice that a malformed message has
|
|
multiple senders, and would leak memory (Tom Ptacek).
|
|
|
|
19980421
|
|
|
|
Portability: in the mantools scripts, the expr pattern no
|
|
longer has ^ at the beginning, and the scripts now use the
|
|
expand program instead of my own detab utility.
|
|
|
|
19980425
|
|
|
|
NetBSD 1.x patch by Soren S. Jorvang.
|
|
|
|
19980511
|
|
|
|
Feature: the SMTP server now logs the protocol (SMTP or
|
|
ESMTP) as part of the Received: header.
|
|
|
|
Feature: smtpd now logs the last command when a session is
|
|
aborted due to timeout, unexpected EOF, or too many client
|
|
errors.
|
|
|
|
19980514
|
|
|
|
Bugfix: the queue manager did not update the counter for
|
|
in-core message structures, so the in-core message limit
|
|
had no effect. This can be bad when you have a large backlog
|
|
with many messages eligible for delivery.
|
|
|
|
Robustness: the queue manager now also limits the total
|
|
number of in-core recipient structures, so that it won't
|
|
use excessive amounts of memory on sites that have large
|
|
mailing lists.
|
|
|
|
19980518
|
|
|
|
Bugfix: the SMTP client did not notice that the DNS client
|
|
received a truncated response. As a result, a backup MX
|
|
host could incorrectly claim that it was the best MX host
|
|
and declare a mailer loop.
|
|
|
|
Added start_msg/stop_msg entries to the vmailer startup
|
|
script, for easy installation.
|
|
|
|
Cleanup: VMailer databases are now explicitly specified as
|
|
type:name, for example, hash:/etc/aliases or nis:mail.aliases,
|
|
instead of implicitly as "files", "nis" and so on. Test
|
|
program: util/dict_open. This change allowed me to
|
|
eliminate a lot of redundant code from mkmap_xxx.c, and
|
|
from everything that does map lookups.
|
|
|
|
19980525
|
|
|
|
Bugfix: local/dotforward.c compared the result of opening
|
|
a user's ~/.forward against the wrong error value.
|
|
|
|
19980526
|
|
|
|
Bugfix: the smtpd VRFY command could look at free()d memory.
|
|
|
|
Robustness: the smtpd program had a fixed limit on the
|
|
number of token structures. The code now dynamically
|
|
allocates token structures.
|
|
|
|
Bugfix: the queue manager still used the deprecated parameter
|
|
name xxx_deliver_concurrency for concurrency control, but
|
|
the documentation talks about the preferred parameter name
|
|
xxx_destination_concurrency. Fix: try xxx_destination_concurrency
|
|
first, then fall back to xxx_deliver_concurrency.
|
|
|
|
19980621-19980702
|
|
|
|
Cleanup: the string read routines now report the last
|
|
character read or VSTREAM_EOF. This change is necessary
|
|
for the implementation of the long SMTP line bugfix.
|
|
|
|
Bugfix: the smtp server exited the DATA command prematurely
|
|
when the client sent long lines. Reason: the smtp server
|
|
did not remember that it broke long lines, so that '.'
|
|
could appear to be the first character on a line when in
|
|
fact it wasn't.
|
|
|
|
Bugfix: the queue manager made lots of stupid errors while
|
|
reading $qmgr_message_recipient_limit chunks of recipients
|
|
from a queue file. This code has been restructured.
|
|
|
|
19980706
|
|
|
|
Performance: the cleanup program now always adds return-receipt
|
|
and errors-to records to a queue file, so that the queue
|
|
manager does not have to plow through huge lists of
|
|
recipients.
|
|
|
|
Robustness: the initial destination concurrency now defaults
|
|
to 2, so that one bad message or one bad connection does
|
|
not stop all mail to a site. The configuration parameter
|
|
is called initial_destination_concurrency.
|
|
|
|
Performance: the per-message recipient limit is now enforced
|
|
by the queue manager instead of by the transport. Thus, a
|
|
large list of recipients for the same site is now mapped
|
|
onto several delivery requests which can be handled in
|
|
parallel, instead of being mapped onto one delivery request
|
|
that is sent to limited numbers of recipients, one group
|
|
after the other.
|
|
|
|
19980707
|
|
|
|
Cleanup: the queue manager now does an additional recipient
|
|
sort after the recipients have been resolved, so that the
|
|
code can do better aggregation of recipients by next hop
|
|
destination.
|
|
|
|
Feature: lines in the master.cf file can now be continued
|
|
in the same manner as lines in the main.cf file, i.e. by
|
|
starting the next line with whitespace.
|
|
|
|
Feature: the smtp client now warns that a message may be
|
|
delivered multiple times when the response to "." is not
|
|
received (the problem described in RFC 1047).
|
|
|
|
Cleanup: when the queue manager changes its little mind
|
|
after contacting a delivery agent (for example, it decides
|
|
to skip the host because a transport or host goes bad),
|
|
the delivery agent no longer complains about premature EOF.
|
|
File: global/deliver_request.c
|
|
|
|
19980709
|
|
|
|
Bugfix: when breaking long lines, the SMTP client did not
|
|
escape leading dots in secondary etc. line fragments. Fix:
|
|
don't break lines. This change makes VMailer line-length
|
|
transparent. Files: global/smtp_stream.c, smtp/smtp_proto.c.
|
|
|
|
19980712
|
|
|
|
Cleanup: the queue manager to deliver agent protocol now
|
|
distinguishes between domain-specific soft errors and
|
|
recipient-specific soft errors. Result: many soft errors
|
|
with SMTP delivery no longer affect other mail the same
|
|
domain.
|
|
|
|
19980713
|
|
|
|
Feature: the file modification time stamp of deferred queue
|
|
files is set to the nearest wakeup time of their recipient
|
|
hosts, or if delivery was deferred due to a non-host problem,
|
|
the time stamp is set into the future by the configurable
|
|
minimal backoff time.
|
|
|
|
Bugfix: the SMTP client and the MAILQ command would report
|
|
as message size the total queue file size. That would
|
|
grossly overestimate the size of a message with many
|
|
recipients.
|
|
|
|
Bugfix: the 19980709 fix screwed up locally-posted mail
|
|
that didn't end in newline.
|
|
|
|
19980714
|
|
|
|
Robustness: the makedefs script now defaults to no optimization
|
|
when compiling for purify.
|
|
|
|
19980715
|
|
|
|
Robustness: the makedefs script now defaults to no optimization
|
|
when compiling with gcc 2.8, until this compiler is known
|
|
to be OK.
|
|
|
|
Workaround: when sending multiple messages over the same
|
|
SMTP connection, some SMTP servers need an RSET command
|
|
before the second etc. MAIL FROM command. The VMailer SMTP
|
|
client now sends a redundant RSET command just in case.
|
|
|
|
The queue manager now logs explicitly when delivery is
|
|
deferred because of a "dead" message transport.
|
|
|
|
19980716
|
|
|
|
Feature: mailq and mail bounces now finally report why mail
|
|
was deferred (the reason was logged to the syslog file
|
|
only). Changes were made to the bounce service (generalized
|
|
to be usable for defer logs), showq service (to show reasons)
|
|
and the queue manager.
|
|
|
|
As a result the defer directory (with one log per deferred
|
|
message) may contain many files; also, this directory is
|
|
accessed each time a message is let into the active queue,
|
|
in order to delete its old defer log. This means that hashed
|
|
directories are now a must.
|
|
|
|
19980718-20
|
|
|
|
Feature: configurable timeout for establishing smtp
|
|
connections. Parameter: smtp_connect_timeout (default 0,
|
|
which means use the timeout as wired into the kernel).
|
|
Inspired by code from Lamont Jones. For a clean but far
|
|
from trivial implementation, see util/timed_connect.c
|
|
|
|
Cleaned up the interfaces that implement read/write deadlines.
|
|
Instead of returning -2, the routines now set errno to
|
|
ETIMEDOUT; the readable/writable tests are now separate.
|
|
|
|
19980722
|
|
|
|
Feature: the default indexed file type (hash, btree, dbm)
|
|
is now configurable with the "database_type" parameter.
|
|
The default value for this parameter is system specific.
|
|
|
|
Feature: selectively turn on verbose logging for hosts that
|
|
match the patterns specified via the "debug_peer_list"
|
|
config parameter. Syntax is like the "bad_smtp_clients"
|
|
parameter (see global/peer_list.c). The verbose logging
|
|
level is specified with "debug_peer_level" (default 2).
|
|
|
|
Security: the local delivery agent no longer delivers to
|
|
files that have execute permission enabled.
|
|
|
|
19980723
|
|
|
|
Workarounds for Solaris 2.x UNIX-domain sockets: they lose
|
|
data when you close them immediately after writing to them.
|
|
This could screw up the delivery agent to queue manager
|
|
protocol.
|
|
|
|
19980724
|
|
|
|
Cleanup: spent most of the day cleaning up queue manager
|
|
code that defers mail when a site or transport dies, and
|
|
fixed a few obscure problems in the process.
|
|
|
|
19980726
|
|
|
|
Feature: the admin can now configure what classes of problems
|
|
result in mail to the postmaster. Configuration parameter:
|
|
"notify_classes". Default is backwards compatible: bounce,
|
|
policy, protocol, resource, and software.
|
|
|
|
19980726-28
|
|
|
|
Feature: the admin can now configure what smtp server access
|
|
control restrictions must be applied, and in what order.
|
|
Configuration parameters: smtpd_client_restrictions,
|
|
smtpd_helo_restrictions, smtpd_mail_restrictions and
|
|
smtpd_rcpt_restrictions. Defaults are intended to be
|
|
backwards compatible. The bad_senders and bad_clients lists
|
|
are gone and have become db (dbm, nis, etc) maps. Files:
|
|
smtpd/smtpd_check.c, config/main.cf.
|
|
|
|
19980729-31
|
|
|
|
Feature: hashed queues. Rewrote parts of the mail queue
|
|
API. Configuration parameters: "hash_queue_names" specifies
|
|
what queue directories will be hashed (default: the defer
|
|
log directory), "hash_queue_depth" specifies the number of
|
|
subdirectories used for hashing (default 2).
|
|
|
|
19980802
|
|
|
|
Bugfix: the pipe mailer should expand command-line arguments
|
|
with $recipient once for every recipient (producing one
|
|
command-line argument per recipient), instead of replacing
|
|
$recipient by of all recipients (i.e. producing only one
|
|
command-line argument). This is required for compatibility
|
|
with programs that expect to be run from sendmail, such as
|
|
uux. Thanks to Ollivier Robert for helping me to get this
|
|
right.
|
|
|
|
Code cleanup: for the above, cleaned up the macro expansion
|
|
code in dict.c and factored out the parsing into a separate
|
|
module, mac_parse.c.
|
|
|
|
19980803
|
|
|
|
"|command" and /file/name destinations in alias databases
|
|
are now executed with the privileges of the database owner
|
|
(unless root or vmailer). Thus, with: "alias_maps =
|
|
hash:/etc/aliases, hash:/home/majordomo/aliases", and with
|
|
/home/majordomo/aliases* owned by the majordomo account,
|
|
you no longer need the majordomo set-uid wrapper program,
|
|
and you no longer need root privileges in order to install
|
|
a new mailing list.
|
|
|
|
19980804
|
|
|
|
Added support for the real-time blackhole list. Example:
|
|
"client_restrictions = permit_mynetworks, reject_maps_rbl"
|
|
|
|
All SMTP server "reject" status codes are now configurable:
|
|
unknown_client_reject_code, mynetworks_reject_code,
|
|
invalid_hostname_reject_code, unknown_hostname_reject_code,
|
|
unknown_address_reject_code, relay_domains_reject_code,
|
|
access_map_reject_code, maps_rbl_reject_code. Default values
|
|
are documented in the smtpd/smtpd_check.c man page.
|
|
|
|
19980806-8
|
|
|
|
Code cleanup: after eye balling line-by line diffs, started
|
|
deleting code that duplicated functionality because it was
|
|
at the wrong abstraction level (smtp_trouble.c), moved
|
|
functionality that was in the wrong place (dictionary
|
|
reference counts in maps.c instead of dict.c), simplified
|
|
code that was too complex (password-file structure cache)
|
|
and fixed some code that was just wrong.
|
|
|
|
19980808
|
|
|
|
Robustness: the number of queue manager in-core structures
|
|
for dead hosts is limited; the limit scales with the limit
|
|
on the number of in-core recipient structures. The idea is
|
|
to not run out of memory under conditions of stress.
|
|
|
|
19980809
|
|
|
|
Feature: mail to files and commands can now be restricted
|
|
by class: alias, forward file or include file. The default
|
|
restrictions are: "allow_mail_to_files = alias, forward"
|
|
and allow_mail_to_commands = alias, forward". The idea is
|
|
to protect against buggy mailing list managers that allow
|
|
intruders to subscribe /file/name or "|command".
|
|
|
|
19980810-12
|
|
|
|
Cleanup: deleted a couple hundred lines of code from the
|
|
local delivery agent. It will never be a great program;
|
|
sendmail compatibility is asking a severe toll.
|
|
|
|
19980814
|
|
|
|
Cleanup: made the program shut up about some benign error
|
|
conditions that were reported by Daniel Eisenbud.
|
|
|
|
19980814-7
|
|
|
|
Documentation: made a start of HTML docs that describe all
|
|
configuration parameters.
|
|
|
|
Feature: while documenting things, added smtpd_helo_required.
|
|
|
|
19980817
|
|
|
|
Bugfix: at startup the queue manager now updates the time
|
|
stamps of active queue files some time into the future.
|
|
This eliminates duplicate deliveries after "vmailer reload".
|
|
|
|
Bugfix: the local delivery agent now applies the recipient
|
|
delimiter after looking in the alias database, instead of
|
|
before.
|
|
|
|
Documentation bugfixes by Matt Shibla, Tom Limoncelli,
|
|
Eilon Gishri.
|
|
|
|
19980819
|
|
|
|
GLIBC fixes from Myrdraal.
|
|
|
|
Bugfix: applied showq buffer reallocation workaround in
|
|
the wrong place.
|
|
|
|
Bugfix: can't use shorts in varargs lists. SunOS 4 has
|
|
short uid_t and gid_t. pipe_command() would complain.
|
|
|
|
Bugfix: can't use signed char in ctype macros. All ctype
|
|
arguments are now casted to unsigned char. Thanks, Casper
|
|
Dik.
|
|
|
|
19980820
|
|
|
|
Bugfix: save the alias lookup result before looking up the
|
|
owner. The previous alpha release did this right.
|
|
|
|
Cleanup: mail_trigger() no longer complains when the trigger
|
|
FIFO or socket is unavailable. This change is necessary to
|
|
shut up the sendmail mail posting program, so that it can
|
|
be used on mail clients that mount their maildrop via NFS.
|
|
|
|
Experiment: pickup and pipe now run as vmailer most of the
|
|
time, and switch to user privileges only temporarily.
|
|
Files: util/set_eugid.c global/pipe_command.c pipe/pipe.c
|
|
pickup/pickup.c. Is this more secure/ What about someone
|
|
manipulating such a process while not root? It still has
|
|
ruid == 0.
|
|
|
|
19980822
|
|
|
|
Portability: with GNU make, commands such as "(false;true)"
|
|
and "while :; do false; done" don't fail. Workaround: use
|
|
"set -e" all over the place. Problem found by Jeff Wolfe.
|
|
|
|
Feature: "check_XXX_access maptype:mapname" (XXX = client,
|
|
helo, sender, recipient). Now you can make recipient and
|
|
other SPAM restrictions dependent on client or sender access
|
|
tables lookup results.
|
|
|
|
19980823
|
|
|
|
Bugfix: smtpd access table lookup keys were case sensitive.
|
|
|
|
Added "permit" and "reject" operators. These are useful at
|
|
the end of SPAM restriction lists (smtpd_XXX_restrictions).
|
|
|
|
Added a first implementation of the permit_mx_backup SPAM
|
|
restriction. This permits mail relaying to any domain that
|
|
lists this mail system as an MX host (including mail for
|
|
the local machine). Thanks to Ollivier Robert for useful
|
|
discussions.
|
|
|
|
19980824
|
|
|
|
Bugfix: transport table lookup keys were case sensitive.
|
|
|
|
19980825
|
|
|
|
Portability: sa_len is some ugly #define on some SGI systems,
|
|
so we must rename identifiers (file util/connect.c).
|
|
|
|
Bugfix: uucp delivery errors are now sent to the sender.
|
|
Thanks, Mark Delany.
|
|
|
|
Bugfix: the pipe delivery agent now replaces empty sender
|
|
by the mailer daemon address. Mark Delany, again.
|
|
|
|
Portability: GNU getopt looks at all command-line arguments.
|
|
Fix: insert -- into the pipe/uucp definition in master.cf.
|
|
|
|
Bugfix: the smtp server command tokenizer silently discarded
|
|
the [] around [text], so that HELO [x.x.x.x] was read as
|
|
if the client had sent: HELO x.x.x.x. Thanks, Peter Bivesand.
|
|
|
|
Bugfix: the HELO unknown hostname/bad hostname restrictions
|
|
would have treated [text] as a domain name anyway.
|
|
|
|
Bugfix: the $local_duplicate_filter_limit value was not
|
|
picked up by the local delivery agent. This means the local
|
|
delivery agent could run out of memory on large mailing
|
|
list deliveries.
|
|
|
|
19980826
|
|
|
|
Performance: mkmap/mkalias now run with the same speed as
|
|
sendmail. VMailer now uses a 4096-entry cache with 1 Mbyte
|
|
of memory for DB lookups. File: util/dict_db.c.
|
|
|
|
19980902
|
|
|
|
Robustness: the reject_unknown_hostname restriction for
|
|
HELO/EHLO hostnames will now permit names that have an MX
|
|
record instead of an A record.
|
|
|
|
19980903
|
|
|
|
Feature: appending @$myorigin to an unqualified address is
|
|
configurable with the boolean append_at_myorigin parameter
|
|
(default: yes).
|
|
|
|
Feature: appending .$mydomain to user@host is configurable
|
|
with the boolean append_dot_mydomain parameter (default:
|
|
yes).
|
|
|
|
Feature: site!user is rewritten to user@site, under control
|
|
of the boolean parameter swap_bangpath (default: yes).
|
|
|
|
Feature: permit a naked IP address in HELO commands (i.e.
|
|
an address without the enclosing [] as required by the
|
|
RFC), by specifying "permit_naked_ip_address" as one of
|
|
the restrictions in the "smtpd_helo_restrictions" config
|
|
parameter.
|
|
|
|
19980904
|
|
|
|
Code cleanup: when an SMTP client aborts a session after
|
|
sending MAIL FROM, the cleanup service no longer warns that
|
|
it is "skipping further client input". Files: cleanup/*.c.
|
|
Thanks, Daniel Eisenbud, for prodding.
|
|
|
|
Code cleanup: when an SMTP server disconnects in the middle
|
|
of a session, don't try to send QUIT over the non-existing
|
|
connection. Files: global/smtp_stream.c, smtp/smtp.c.
|
|
Thanks, Daniel Eisenbud, for prodding, again.
|
|
|
|
Code cleanup: the VMailer version number has moved from
|
|
mail_params.h (which is included by lots of modules) to a
|
|
separate file global/mail_version.h, so that a version
|
|
change no longer results in massive recompilation.
|
|
|
|
Bugfix: Errors-To was flagged as a sender address, so the
|
|
address never was picked up.
|
|
|
|
Code cleanup: support for Errors-To: headers completed.
|
|
|
|
19980905
|
|
|
|
Feature: per-message exponential delivery backoff, by
|
|
looking at the amount of time a message has been queued.
|
|
Thanks, Mark Delany.
|
|
|
|
19980906
|
|
|
|
Code cleanup: ripped out the per-host exponential backoff
|
|
code. It was broken by 19980818. It was probably a bad idea
|
|
anyway, because it required per-host, in-core, state kept
|
|
by the queue manager. All we do now is to keep state for
|
|
$minimal_backoff_time seconds, but only for a limited number
|
|
of hosts. Daniel Eisenbud spotted the problem.
|
|
|
|
Lost feature: the SMTP session transcripts now show who
|
|
said what. This feature was inadvertently dropped during
|
|
development. Thanks, Daniel Eisenbud, for reminding.
|
|
|
|
Documentation: the hard-coded rewriting process of the
|
|
trivial-rewrite program is described in html/rewrite.html.
|
|
|
|
Feature: the local delivery agent now does alias lookups
|
|
before and after chopping off the recipient subaddress.
|
|
This allows you to forward user-anything to another user,
|
|
without losing the ability to redirect specific user-foo
|
|
addresses.
|
|
|
|
19980909
|
|
|
|
Feature: the smtp client now logs a warning that a server
|
|
sends a greeting banner with the client's hostname, which
|
|
could imply a mailer loop.
|
|
|
|
19980910
|
|
|
|
Feature: separate canonical maps for sender and recipient
|
|
address rewriting, so that you can rewrite an ugly sender
|
|
address and still forward mail to that same ugly address
|
|
without creating a mailer loop. Files: cleanup_envelope.c,
|
|
cleanup_message.c, cleanup_rewrite.c.
|
|
|
|
19980911
|
|
|
|
Feature: virtual maps now support multiple addresses on
|
|
the right-hand side. In the case of virtual domains this
|
|
can eliminate the need for address expansion via local
|
|
aliases, making virtual domains much easier to administer.
|
|
This required that I moved the virtual table lookups from
|
|
the queue manager to the cleanup service, so that every
|
|
recipient has an on-disk status record. Files: qmgr.c,
|
|
qmgr_message.c, cleanup_envelope.c, cleanup_rewrite.c,
|
|
cleanup_virtual.c.
|
|
|
|
Feature: sendmail/mailq/newaliases pass on the -v flag to
|
|
the program that they end up running, to make debugging a
|
|
little easier.
|
|
|
|
19980914
|
|
|
|
Bugfix: some anti-spam measures didn't recognize some
|
|
addresses as local and would do too much work. File:
|
|
smtpd_check.c.
|
|
|
|
Bugfix: the smtp sender/recipient table lookup restriction
|
|
destroyed global data, so that other restrictions could
|
|
break. File: smtpd_check.c.
|
|
|
|
Bugfix: after vmailer reload, single-threaded servers could
|
|
exit before flushing unwritten data to the client. Example:
|
|
cleanup would exit before acking success to pickup, so the
|
|
message would be delivered twice. Bug reported by Brian
|
|
Candler.
|
|
|
|
Cleanup: removed spurious error output from vmailer-script.
|
|
Reported by Brian Candler.
|
|
|
|
Tolerance: ignore non-numeric SMTP server responses. There's
|
|
lot of brain damage out there on the net.
|
|
|
|
19980915
|
|
|
|
Feature: the smtp-sink benchmark tool now announces itself
|
|
with a neutral name so that it can be run on the same
|
|
machine as VMailer, without causing Postfix to complain
|
|
about a mailer loop.
|
|
|
|
Robustness: on LINUX, vmailer-script now does chattr +S to
|
|
force synchronous directory updates. Fix developed with
|
|
Chris Wedgwood.
|
|
|
|
19980916
|
|
|
|
Bugfix: when transforming an RFC 822 address to external
|
|
form, there is no need to quote " characters in comments.
|
|
This didn't break anything, it just looked ugly. File:
|
|
global/tok822_parse.c
|
|
|
|
19980917
|
|
|
|
Workaround: with deliveries to /file/name, use fsync() and
|
|
ftruncate() only on regular files. File: local/file.c
|
|
|
|
Workaround: the plumbing code in master_spawn.c didn't
|
|
check if it was dup2()/close()ing a descriptor to itself
|
|
then closing it. Will have to redo the plumbing later.
|
|
|
|
19980918
|
|
|
|
Workaround: on multiprocessor Solaris machines, one-second
|
|
rollover appears to happen on different CPUs at slightly
|
|
different times. Made the queue manager more tolerant for
|
|
such things. Problem reported by Daniel Eisenbud.
|
|
|
|
Workaround: in preparation for deployment with a network-shared
|
|
maildrop directory. make pickup more tolerant against clock
|
|
drift between clients and servers.
|
|
|
|
19980921
|
|
|
|
New vstream_popen() module that opens a two-way channel
|
|
across a socketpair-based pipe. This module isn't being
|
|
used yet; it is here only to complete the vstream code.
|
|
|
|
19980922
|
|
|
|
Code cleanup: the xxx_server_main() interface for master
|
|
child processes now uses a name-value argument list instead
|
|
of an ugly and inflexible data structure.
|
|
|
|
Bugfix: moved the test if a non-interactive process is run
|
|
by hand, so that the "don't do this" error message can be
|
|
printed to stderr before any significant processing.
|
|
|
|
Bugfix: smtpd now can talk to unix-domain sockets without
|
|
bailing out on a peer lookup problem. Files: smtpd/smtpd.c,
|
|
util/peer_name.c.
|
|
|
|
Safety: by default, the postmaster is no longer informed
|
|
of protocol problems, policy violations or bounces.
|
|
|
|
Safety: the SMTP server now sleeps before sending a [45]xx
|
|
error response, in order to prevent clients from hammering
|
|
the server with a connect/error/disconnect loop. Parameter:
|
|
smtpd_error_sleep_time (default: 5).
|
|
|
|
Feature: the logging facility is compile-time configurable
|
|
(e.g., make makefiles "CCARGS=-DLOG_FACILITY=LOG_LOCAL1").
|
|
|
|
19980923
|
|
|
|
Bugfix: changed virtual/canonical map search order from
|
|
(user@domain, @domain, user) to (user@domain, user, @domain)
|
|
so the search order is most specific to least specific.
|
|
File: global/addr_map.c, lots of documentation.
|
|
|
|
Bugfix: after the change of 19980910, cleanup_message
|
|
extracted recipients from Reply-To: etc. headers. Found
|
|
by Lamont Jones.
|
|
|
|
19980925
|
|
|
|
Bugfix: the change in virtual/canonical map search order
|
|
broke @domain entries; they would never be looked up if
|
|
the address matched $myorigin or $mydestinations. Found by
|
|
Chip Christian who now regrets asking for the change.
|
|
|
|
Bugfix: cleanup initialized an error mask incorrectly, so
|
|
that it would keep writing to a file larger than the queue
|
|
file size limit, and so it would treat the error as a
|
|
recoverable one instead of sending a bounce. Thanks, Pieter
|
|
Schoenmakers.
|
|
|
|
Bugfix: the "queue file cleanup on fatal error" action was
|
|
no longer enabled in the sendmail mail posting agent.
|
|
|
|
Feature: the sendmail mail posting program now returns
|
|
EX_UNAVAILABLE when the size of the input exceeds the queue
|
|
file size limit. NB THIS CHANGE HAS BEEN WITHDRAWN.
|
|
|
|
19980926
|
|
|
|
Code cleanup: the dotlock file locking routine is no longer
|
|
derived from Eric Allman's 4.3BSD port of mail.local.
|
|
|
|
Code cleanup: the retry strategy of the file locking routines
|
|
dot_lockfile() and deliver_flock() is now configurable
|
|
(deliver_flock_attempts, deliver_flock_delay, deliver_flock_stale).
|
|
|
|
Code cleanup: the master.pid lock file is now created with
|
|
symlink paranoia, and is properly locked so that PID rollover
|
|
will not cause false matches.
|
|
|
|
Bugfix: the vbuf_print() formatting engine did not know
|
|
about the '+' format specifier.
|
|
|
|
Cleanup: replaced unnecessary instances of stdio calls by
|
|
vstream ones.
|
|
|
|
19980929-19981002
|
|
|
|
Compatibility: added support for "sendmail -q". This required
|
|
a change to the queue manager trigger protocol, and a code
|
|
reorganization of the way queue scans were done. The queue
|
|
manager socket now has become public.
|
|
|
|
19981002
|
|
|
|
SMTPD now logs "lost connection after end-of-message"
|
|
instead of "lost connection after DATA".
|
|
|
|
19981005
|
|
|
|
More bullet proofing: timeouts on all triggers.
|
|
|
|
19981006
|
|
|
|
Bugfix: make the number of cleanup processes unlimited, in
|
|
order to avoid deadlock. The number of instances needed is
|
|
one per smtp/pickup process, and an indeterminate number
|
|
per local delivery agent. Thanks, Thanks, David Miller and
|
|
Terry Lorrah for cleueing me in.
|
|
|
|
Bugfix: "sendmail -t" extracted recipients weren't subjected
|
|
to virtual mapping. Daniel Eisenbud strikes again.
|
|
|
|
19981007
|
|
|
|
Compatibility: if the first input line ends in CRLF, the
|
|
sendmail posting agent will treat all CRLF as LF. Otherwise,
|
|
CRLF is left alone. This is a compromise between sendmail
|
|
compatibility (all lines end in CRLF) and binary transparency
|
|
(some, but not all, lines contain CRLF).
|
|
|
|
19981008
|
|
|
|
Robustness: stop recursive virtual expansion when the
|
|
left-hand side appears in its own expansion.
|
|
|
|
19981009
|
|
|
|
Portability: trigger servers such as pickup and qmgr can
|
|
now use either FIFOs or UNIX-domain sockets; hopefully at
|
|
least one of them works properly. Trigger clients were
|
|
already capable of using either form of local IPC.
|
|
|
|
19981011
|
|
|
|
Feature: masquerading. Strip subdomains from domains listed
|
|
in $masquerade_domains. Exception: envelope recipients are
|
|
left alone, in order to not screw up routing.
|
|
|
|
19981015
|
|
|
|
Code cleanup: moved the recipient duplicate filter from
|
|
the user-level sendmail posting agent to the semi-resident
|
|
cleanup service, so that the filter operates on the output
|
|
from address canonicalization and of virtual expansion,
|
|
instead of operating on their inputs.
|
|
|
|
19981016
|
|
|
|
Bugfix: after kill()ing a bunch of child processes, wait()
|
|
sometimes fails before all children have been reaped, and
|
|
must be called again, or the master will SIGSEGV later.
|
|
Problem reported by Scott Cotton.
|
|
|
|
Workaround: don't log a complaint when an SMTP client goes
|
|
away without sending QUIT.
|
|
|
|
19981018
|
|
|
|
Workaround: Solaris 2.5 ioctl SIOCGIFCONF returns a hard
|
|
error (EINVAL) when the result buffer is not large enough.
|
|
This can happen on systems with many real or virtual
|
|
interfaces. File: util/inet_addr_local.c. Problem reported
|
|
by Scott Cotton.
|
|
|
|
Workaround: the optional HELO/EHLO hostname syntax check
|
|
now allows a single trailing dot.
|
|
|
|
Workaround: with UNIX-domain sockets, LINUX connect() blocks
|
|
until the server calls accept(). File: qmgr/qmgr_transport.c.
|
|
Terry Lorrah and Scott Cotton provided the necessary
|
|
evidence.
|
|
|
|
19981020
|
|
|
|
Robustness: recursive canonical mapping terminates when
|
|
the result stops changing.
|
|
|
|
Code cleanup: reorganized the address rewriting and mapping
|
|
code in the cleanup service, to make it easier to implement
|
|
the previous enhancement.
|
|
|
|
19981022
|
|
|
|
Code cleanup: more general queue scanning programming
|
|
interface, in preparation for hashed queues. File:
|
|
qmgr/qmgr_scan.c.
|
|
|
|
Bugfix: a non-FIFO server with a process limit of 1 has a
|
|
too short listen queue. Until now this was not a problem
|
|
because only FIFO servers had a process limit of 1, and
|
|
FIFOs have no listen queue. Fix: always configure a listen
|
|
queue of proc_limit or more. File: master/master_listen.c.
|
|
|
|
19981023
|
|
|
|
Feature: by popular request, mail delay is logged when
|
|
delivering, bouncing or deferring mail.
|
|
|
|
19981024
|
|
|
|
Cleanup: double-bounce mail is now absorbed by the queue
|
|
manager, instead of the local delivery agent, so that the
|
|
mail system will not go mad when no local delivery agent
|
|
is configured.
|
|
|
|
19981025
|
|
|
|
Cleanup: moved the relocated table from the local delivery
|
|
agent to the queue manager, so that the table can also be
|
|
used for virtual addresses.
|
|
|
|
Code reorg: in order for the queue manager to absorb
|
|
recipients, the queue file has to stay open until all
|
|
recipients have been assigned to a destination queue.
|
|
|
|
19981026
|
|
|
|
vmlogger command, so that vmailer-script logging becomes
|
|
consistent with the rest of the VMailer system.
|
|
|
|
Code reorg: logger interface now can handle multiple output
|
|
handlers (e.g. syslog and stderr stream).
|
|
|
|
Bugfix: a first line starting with whitespace is no longer
|
|
treated as an extension of our own Received: header. Files:
|
|
smtpd/smtpd.c, pickup/pickup.c.
|
|
|
|
19981027
|
|
|
|
Bugfix: the bang-path swapping code went into a loop on an
|
|
address consisting of just a single !. Eilon Gishri had
|
|
the privilege of finding this one.
|
|
|
|
Workaround: the non-blocking UNIX-domain socket connect is
|
|
now enabled only on systems that need it. It may cause
|
|
kernel trouble on Solaris 2.x.
|
|
|
|
Bugfix: the resolver didn't implement bangpath swapping,
|
|
so that mail for site!user@mydomain would be delivered to
|
|
a local user named "site!user".
|
|
|
|
19981028
|
|
|
|
Cleanup: a VSTREAM can now use different file descriptors
|
|
for reading and writing. This was necessary to prevent
|
|
"sendmail -bs" and showq from writing to stdin. Eilon Gishri
|
|
observed the problem.
|
|
|
|
19981029
|
|
|
|
The RFC 822 address manipulation routines no longer give
|
|
special attention to 8-bit data. Files: global/tok822_parse.c,
|
|
global/quote_822_local.c.
|
|
|
|
Bugfix: host:port and other non-domain stuff is no longer
|
|
allowed in mail addresses. File: qmgr/qmgr_message.c.
|
|
|
|
Workaround: LINUX accept() wakes up before the three-way
|
|
handshake is complete, so it can fail with ECONNRESET.
|
|
Files: master/single_server.c, master/multi_server.c.
|
|
|
|
Feature: when delivering to user+foo, try ~user/.forward+foo
|
|
before trying ~user/.forward.
|
|
|
|
Bugfix: smtpd in "sendmail -bs" (stand-alone) mode didn't
|
|
clean up when terminated by a signal.
|
|
|
|
Bugfix: smtpd in "sendmail -bs" (stand-alone) mode should
|
|
not try to enforce spam controls because it cannot access
|
|
the address rewriting machinery.
|
|
|
|
Cleanup: the percent hack (user%domain -> user@domain) is
|
|
now configurable (allow_percent_hack, default: yes).
|
|
|
|
Bugfix: daemons in -S (stand-alone) mode didn't change
|
|
directory to the queue. This was no problem with daemons
|
|
run by the sendmail compatibility program.
|
|
|
|
19981030
|
|
|
|
Feature: when virtual/canonical/relocated lookup fails for
|
|
an address that contains the optional recipient delimiter
|
|
(e.g., user+foo@domain), the search is done again with the
|
|
unextended address (e.g., user@domain). File: global/addr_find.c.
|
|
|
|
Code reorg: the address searching is now implemented by a
|
|
separate module global/addr_find.c, so that the same code
|
|
can be used for both (non-mapping) relocated table lookups
|
|
and for canonical and virtual mapping. The actual mapping
|
|
is still done in the global/addr_map.c module.
|
|
|
|
Robustness: the SMTP client now skips hosts that don't send
|
|
greeting banner text. File: smtp/smtp_connect.c
|
|
|
|
Feature: preliminary support to disable delivered-to. This
|
|
is desirable for mailing list managers that don't want to
|
|
advertise internal aliases.
|
|
|
|
Generic support: when the recipient_feature_delimiter
|
|
configuration parameter is set, the local delivery agent
|
|
uses it to split the recipient localpart into fields. Any
|
|
field that has a known name such as "nodelivered" enables
|
|
the corresponding delivery feature.
|
|
|
|
19981031
|
|
|
|
Code reorg: address splitting on recipient delimiter is
|
|
now centralized in global/split_addr.c, which knows about
|
|
all reserved names that should never be split.
|
|
|
|
Robustness: when a request for an internal service cannot
|
|
be satisfied because the master has terminated, terminate
|
|
instead of trying to reach the service every 30 seconds.
|
|
|
|
Safety: the local delivery agent now runs as vmailer most
|
|
of the time, just like pickup and pipe. Files: local/local.c,
|
|
local/mailbox.c
|
|
|
|
19981101
|
|
|
|
Compatibility: the tokenizer for alias/forward/etc.
|
|
expansion now updates an optional counter with the number
|
|
of destinations found; If no destinations is found in a
|
|
.forward file, deliver to the mailbox instead. Thanks,
|
|
Daniel Eisenbud, for showing the way to go.
|
|
|
|
Robustness: the pickup daemon should always include a
|
|
posting-time record, even when the sendmail posting agent
|
|
didn't. However, just like before, user-provided posting
|
|
times will be ignored. Ollivier Robert found this one.
|
|
|
|
Robustness: duplicate entries in aliases or maps now cause
|
|
a warning instead of a fatal error (and an incomplete file).
|
|
|
|
Robustness: mkmap now prints a warning when an entry is in
|
|
"key: value" format, which is the format expected for alias
|
|
databases, not for maps.
|
|
|
|
Portability: on LINUX, prepend "+" to the getopt() options
|
|
string so that getopt() will stop at the first non-option
|
|
argument. Suggestion by Marco d'Itri.
|
|
|
|
19981103
|
|
|
|
Cleaned up the set_eugid() and open_as() implementations,
|
|
and added stat_as() and fstat_as() so that the local delivery
|
|
agent would look up include files and .forward files with
|
|
the right privileges.
|
|
|
|
19981104
|
|
|
|
Bugfix: the :include: routine now stat()s/open()s files
|
|
included by root-owned aliases as root, not as nobody.
|
|
|
|
Bugfix: the master crashed when a service with wakeup timer
|
|
was disabled or renamed. Fix: eliminate some pathological
|
|
coupling between process management and wakeup management.
|
|
|
|
Feature: partial implementation of ETRN (causes a full
|
|
deferred queue scan). Thanks Lamont Jones for reminding me
|
|
that things can be useful already before they are perfect.
|
|
|
|
Cleanup: simplified the SMTPD tokenizer.
|
|
|
|
Bugfix: sendmail -bs didn't properly notify the mail system
|
|
of new mail.
|
|
|
|
Compatibility: the MAIL FROM and RCPT TO commands now accept
|
|
the most common address forms without enclosing <>. The <>
|
|
is still needed for addresses that contain a "string", an
|
|
[address], or a colon (:).
|
|
|
|
19981105
|
|
|
|
Bugfix: "master -t" would claim that the master runs when
|
|
in fact the pid directory does not exist, causing trouble
|
|
with first time startup (reported by several).
|
|
|
|
Portability: added a sane_accept() module that maps all
|
|
beneficial accept() error results to EAGAIN. According to
|
|
private communication with Alan Cox, Linux 2.0.x accept()
|
|
can return a variety of error conditions, so we play safe
|
|
and allow for any error that may happen because SYN+ACK
|
|
could not be sent.
|
|
|
|
Portability: NETBSD1 uses dotlock files (Perry Metzger).
|
|
|
|
Bugfix: the local delivery agent did not canonicalize
|
|
owner-foo sender addresses, so that local users would see
|
|
owner-foo instead of owner-foo@$myorigin (Perry Metzger).
|
|
|
|
OPENSTEP4 support, similar to NEXTSTEP3 (Gerben Wierda).
|
|
|
|
19981106
|
|
|
|
Portability: the master startup would take a long time on
|
|
AIX because AIX has a very large per-process open file
|
|
limit. Fix is to check the status of only the first couple
|
|
hundred file descriptors instead. File: master/master.c.
|
|
|
|
Bugfix: mail to user@[net.work.addr.ess] was broken because
|
|
of a reversed test. File: qmgr/qmgr_message.c.
|
|
|
|
19981107
|
|
|
|
Compatibility: don't clobber the envelope sender address
|
|
when an alias has no owner-foo alias (problem diagnosed by
|
|
Christophe Kalt).
|
|
|
|
Bugfix: mail to local users in include files would be
|
|
delivered directly if the alias didn't have an owner-foo
|
|
alias, and if the alias database and include file were
|
|
owned by root.
|
|
|
|
Feature: with user+foo addresses, any +foo address extension
|
|
that is not explicitly matched in canonical, virtual or
|
|
alias databases is propagated to the table lookup result.
|
|
|
|
19981108
|
|
|
|
Bugfix: minor memory leak in the user+foo table lookup
|
|
code.
|
|
|
|
Configurability: specify virtual.domain in the virtual map,
|
|
and mail for unknown@virtual.domain will bounce automatically.
|
|
The $relay_domains default value now includes $virtual_maps,
|
|
so the SMTP server will accept mail for the domain. Marco
|
|
d'Itri put me on the right track.
|
|
|
|
Configurability: The mydestinations configuration parameter
|
|
now accepts /file/name expressions and type:name lookup
|
|
tables.
|
|
|
|
Code cleanup: in order to make the previous two enhancements
|
|
possible, revised the string/host/address matching engine
|
|
so it can handle any mixture of strings, /file/name patterns
|
|
and type:name lookup tables. Files: util/match_{list,ops}.c,
|
|
global/{domain,namadr,string}_list.c.
|
|
|
|
19981110
|
|
|
|
Code cleanup: replaced remaining isxxx() calls by ISXXX().
|
|
|
|
19981111
|
|
|
|
Bugfix: the "bounce unknown virtual user" code was in the
|
|
wrong place. Problem tackled with help of Chip Christian.
|
|
|
|
Portability: reportedly, Solaris 2.5.1 can hang waiting
|
|
for a UNIX-domain connection to be accepted, so it gets
|
|
the same workaround that was designed for LINUX. Problem
|
|
reported by Scott Cotton.
|
|
|
|
19981112
|
|
|
|
Management: "vmailer stop" now allows delivery agents to
|
|
finish what they are doing, like "vmailer reload".
|
|
|
|
Management; "vmailer abort" causes immediate termination.
|
|
|
|
Workaround: zombie processes pile up with HP-UX. Reason:
|
|
select() does not return upon SIGCHLD when SA_RESTART is
|
|
specified to sigaction(). Workaround: shorten the select()
|
|
timer to 10 seconds, #ifdef BRAINDEAD_SELECT_RESTARTS.
|
|
Thanks, Lamont Jones.
|
|
|
|
19981117
|
|
|
|
Rename: VMailer is now Postfix. Sigh.
|
|
|
|
19981118
|
|
|
|
Cleanup: generalized the safe_open() routine so that it is
|
|
no longer limited to mailbox files, lock files, etc.
|
|
|
|
Bugfix (found during code review): vstream*printf() could
|
|
run off the end of a stream buffer after an I/O error,
|
|
because vbuf_print() ignored the result from VBUF_SPACE().
|
|
|
|
Bugfix (found during code review): resolve_local() could
|
|
clobber its argument, but the docs didn't say so.
|
|
|
|
19981121
|
|
|
|
Cleanup: the is_header() routine now allows 8-bit data in
|
|
header labels.
|
|
|
|
19981123
|
|
|
|
Bugfix (found during code review): the mail_queue_enter()
|
|
path argument wasn't optional. File: global/mail_queue.c
|
|
|
|
19981124
|
|
|
|
Cleanup: eliminated redundant tests for a zero result from
|
|
vstream_fdopen(). Unlike the stdio fdopen() routine, the
|
|
vstream_fdopen() routine either succeeds or never returns.
|
|
|
|
Bugfix: the queue manager now looks at the clock before
|
|
examining a file time stamp, to avoid spurious complaints
|
|
about time warps on busy machines. File: qmgr/qmgr_active.c.
|
|
|
|
19981125
|
|
|
|
Compatibility: allow trailing dot at the end of user@domain.
|
|
Address canonicalization now strips it off. Issue brought
|
|
forward by Eilon Gishri. File: trivial-rewrite/rewrite.c.
|
|
|
|
Robustness: changed DNS lookup order of MAIL FROM etc.
|
|
domains from MX then A to A then MX, just in case the MX
|
|
lookup fails with a server error.
|
|
|
|
Renamed vmcat, vmlock, vmlogger, vmtrigger to postcat,
|
|
postlock, postlog, postkick. Also renamed mkmap and mkalias
|
|
to postmap and postalias.
|
|
|
|
19981126
|
|
|
|
Workaround: Lamont Jones found a way for HP-UX to terminate
|
|
select() after SIGCHLD. The code is #ifdef USE_SIG_RETURN.
|
|
Files: util/sys_defs.h, master/master_sig.c.
|
|
|
|
Bugfix: the Delivered-To: loop detection code had stopped
|
|
working, when long ago the is_header() routine was changed.
|
|
File: local/delivered.c.
|
|
|
|
19981128
|
|
|
|
Bugfix: postcat opened queue files read-write, where only
|
|
read access was needed. File: postcat/postcat.c.
|
|
|
|
19981129
|
|
|
|
Safety: added a sleep(1) to all fatal and panic exits.
|
|
File: util/msg.c.
|
|
|
|
19981201
|
|
|
|
Robustness: postcat now insists that a file starts with a
|
|
time record.
|
|
|
|
Consistency: added "-c config_dir" command-line options
|
|
where appropriate.
|
|
|
|
19981202
|
|
|
|
Man pages, on-line version.
|
|
|
|
19981203
|
|
|
|
Man pages, html version; overview documentation.
|
|
|
|
19981206
|
|
|
|
Sendmail silently accepted the unsupported -qRsite and
|
|
-qSsite options. It now prints an error message and
|
|
terminates.
|
|
|
|
Separated the contributed tree from the IBM code; moved
|
|
the LDAP and NEXTSTEP/OPENSTEP code to the contributed
|
|
source tree because obviously I didn't write it.
|
|
|
|
19981206-9
|
|
|
|
Had to write a postconf configuration utility in order to
|
|
reliably find out about all configuration parameters and
|
|
their defaults.
|
|
|
|
Documentation bugfixes by Matt Shibla, Scott Drassinower,
|
|
Greg A. Woods.
|
|
|
|
19981209
|
|
|
|
On machines with short hostnames, postconf -d cored while
|
|
reporting a fatal error. It should not report that error
|
|
in the first place. Thanks, Eilon Gishri.
|
|
|
|
Changed the FAQ entry about rejecting mail for *.my.domain
|
|
on a firewall. Chip Christian was right, I was wrong.
|
|
|
|
19981214
|
|
|
|
Portability: with GNU getopt, optind is not initially 1,
|
|
breaking an assumption in sendmail/sendmail.c. Liviu Daia.
|
|
|
|
Annoyance: on non-networked systems, don't warn that only
|
|
one network interface was found. File: global/inet_addr_local.c.
|
|
Reported by several.
|
|
|
|
Bugfix: on non-networked systems, the smtp client assumed
|
|
that it was running in virtual host mode, and would bind
|
|
to the loopback interface. File smtp/smtp_connect.c. Liviu
|
|
Daia, again.
|
|
|
|
19981220
|
|
|
|
Robustness: when looking up an A or MX record, do not give
|
|
up when the A query fails because of a server error. File
|
|
dns/dns_lookup.c. Reported by Scott Drassinower.
|
|
|
|
19981221
|
|
|
|
Bugfix: "bounce mail for non-existent virtual user" didn't
|
|
work when a non-default relay host was configured in main.cf
|
|
or in the transport table. File: qmgr/qmgr_message.c.
|
|
|
|
Bugfix: the maildrop directory should not be world-readable.
|
|
Files: conf/postfix-script, showq/showq.c.
|
|
|
|
Documentation: fixed several omissions and errors.
|
|
|
|
Documentation: removed references to the broken recipient
|
|
feature delimiter configuration parameter.
|
|
|
|
Bugfix: write mailbox file as the recipient, so that file
|
|
quota work as expected.
|
|
|
|
Bugfix: pickup would die when it tried to remove a non-file
|
|
in the maildrop directory (Jeff Wolfe).
|
|
|
|
19981222
|
|
|
|
Sendmail no longer logs the queue ID when it is unable to
|
|
notify the pickup daemon. This is a late addition to the
|
|
"unreadable maildrop queue" patch.
|
|
|
|
user.lock files are now created as root, so that postfix
|
|
needs no group directory write permission.
|
|
|
|
19981224
|
|
|
|
Security: allow queue file link counts > 1, to avoid
|
|
non-delivery of maildrop files with links to a non-maildrop
|
|
directory. Files: global/mail_open_ok.c, and anything
|
|
that calls this code (qmgr, pickup, showq). If multiple
|
|
hard links are a problem, see the set-gid "postdrop" utility
|
|
below.
|
|
|
|
19981225
|
|
|
|
Robustness: the queue manager no longer aborts when a queue
|
|
file suddenly disappears (e.g. because the file was removed
|
|
by hand).
|
|
|
|
Feature: when a writable maildrop directory is a problem,
|
|
sites can make the new "postdrop" utility set-gid. This
|
|
command is never used when the maildrop directory is
|
|
world-writable.
|
|
|
|
Robustness: make the queue file creation routine more
|
|
resistant against denial of service race attack. File:
|
|
global/mail_queue.c
|
|
|
|
19981226
|
|
|
|
New suid_priv module to enable/disable privileges in a
|
|
set-uid/gid program. In the end I decided to not use it.
|
|
|
|
19981228
|
|
|
|
Robustness: make the pickup daemon more resistant against
|
|
non-file race attack.
|
|
|
|
Cleanup: generic mail_stream.c interface for writing queue
|
|
file streams to files, daemons or commands. This simplifies
|
|
the code in smtpd and in sendmail that must be able to pipe
|
|
mail through the postdrop command. The cleanup daemon has
|
|
been modified to use the same interface. Result: less code.
|
|
|
|
Feature: smtpd now logs the only recipient in Received:
|
|
headers.
|
|
|
|
Feature: separate command and daemon directories. Both
|
|
default to $program_directory. Install conf/postfix-script
|
|
if you want to use this feature.
|
|
|
|
19981230
|
|
|
|
Patch to avoid conflict with non-writable top-level Makefile
|
|
(Lamont Jones).
|
|
|
|
19981231
|
|
|
|
Portability: port to UnixWare 7 by Ronald Joe Record, SCO.
|
|
|
|
19990104
|
|
|
|
Bugfix: fencepost (Jon Ribbens, Oaktree Internet Solutions
|
|
Ltd.) Files: quote_82[12]_local.c.
|
|
|
|
Bugfix: wrong default for relay_domains (Juergen Kirschbaum,
|
|
Bayerische Landesbank). File: mail_params.h.
|
|
|
|
Bugfix: changed 5xx response for "too may recipients" to
|
|
4xx. File: smtpd.c.
|
|
|
|
19990106
|
|
|
|
Feature: defer_transports specifies the names of transports
|
|
that should be used only when "sendmail -q" (or equivalent)
|
|
is issued. For example, "defer_transports = smtp" is useful
|
|
for sites that are disconnected most of the time. File:
|
|
qmgr_message.c.
|
|
|
|
19990107
|
|
|
|
Feature: local_command_shell specifies a non-default shell
|
|
for delivery to command by the local delivery agent. For
|
|
example, "local_command_shell = /some/where/smrsh -c"
|
|
restricts what may appear in "|command" destinations.
|
|
File: global/pipe_command.c.
|
|
|
|
19990112-16
|
|
|
|
Feature: SMTP command pipelining support based on an initial
|
|
version by Jon Ribbens, Oaktree Internet Solutions Ltd.
|
|
This one took several days of massaging before I felt
|
|
comfortable about it. Files: smtp.c, smtp_proto.c.
|
|
|
|
Bugfix: the SMTP server would flush responses one-by-one,
|
|
which caused suboptimal performance with pipelined clients.
|
|
The vstream routines now flush the write buffer when the
|
|
read() routine is called, instead of flushing when the
|
|
application changes from writing to reading. Delayed flush
|
|
prevents the SMTP server from flushing responses one-by-one
|
|
and thus triggering Nagle's algorithm. File: util/vstream.c.
|
|
|
|
19990117
|
|
|
|
Bugfixes and enhancements to the smtpstone tools by Drew
|
|
Derbyshire, Kendra Electronic Wonderworks: send helo command,
|
|
send message headers, format the message content to lines
|
|
< 80, work around NT stacks, make "." recognition more
|
|
robust. Files: smtp-source.c, smtp-sink.c.
|
|
|
|
Strategy: look at the deferred queue only when the incoming
|
|
queue is empty; limit the number of recipients read from
|
|
a queue file depending on the number of recipients already
|
|
in core. Files: qmgr.c, qmgr_message.c.
|
|
|
|
Feature: postponed anti-UCE restrictions. The decision to
|
|
reject junk mail on the basis of the client name/address,
|
|
HELO hostname or sender address can now be postponed until
|
|
the RCPT TO command (or HELO or MAIL FROM if you like).
|
|
File: smtpd_check.c.
|
|
|
|
19990118
|
|
|
|
Feature: incremental updates of alias databases and of
|
|
other lookup tables. Both postalias and postmap now take
|
|
a -i option for incremental updates from standard input.
|
|
Files: global/mkmap_*.c, post{map,alias}/post{map,alias}.c.
|
|
|
|
Compatibility: newaliases can now update multiple alias
|
|
databases: list them in the "alias_database" parameter in
|
|
main.cf. By the same token, postalias can now update multiple
|
|
maps in one command. Files: post{map,alias}/post{map,alias}.c
|
|
|
|
Feature: mail to <> is now sent to the address specified
|
|
with the "empty_address_recipient" configuration parameter
|
|
which defaults to MAILER-DAEMON (idea by Lamont Jones,
|
|
Hewlett-Packard). File: cleanup/cleanup_envelope.c.
|
|
|
|
Compatibility: the transport table now uses .domain.name
|
|
to match subdomains, just like sendmail mailer tables (patch
|
|
by Lamont Jones, Hewlett-Packard).
|
|
|
|
Feature: mailq now ends with a total queue size summary
|
|
(Eilon Gishri, Israel Inter University Computation Center).
|
|
|
|
19990119
|
|
|
|
Feature: address masquerade exceptions for user names listed
|
|
in the "masquerade_exceptions" configuration parameter.
|
|
File: cleanup/cleanup_masquerade.c.
|
|
|
|
Feature: qmail-style maildir support, based on initial code
|
|
by Kevin W. Brown, Quantum Internet Services Inc.
|
|
|
|
Workaround: Solaris 2.something connect() fails with
|
|
ECONNREFUSED when the system is busy (Chris Cappuccio,
|
|
Empire Net). File: global/mail_connect.c.
|
|
|
|
Feature: the cleanup service now adds a Return-Path: header
|
|
when none is present. This header is needed for some mail
|
|
delivery programs (see below). File: cleanup_message.c.
|
|
|
|
Feature: the pipe mailer now supports $user, $extension
|
|
and $mailbox macros in command-line expansions. This, plus
|
|
the Return-Path: header (see above), should be sufficient
|
|
to support cyrus IMAP out of the box. Based on initial
|
|
code by Joerg Henne, Cogito Informationssysteme GMBH.
|
|
File: pipe/pipe.c.
|
|
|
|
Bugfix: with address extensions enabled, canonical and
|
|
virtual lookups now are done in the proper order:
|
|
user+foo@domain, user@domain, user+foo, user, @domain.
|
|
File: global/mail_addr_find.c.
|
|
|
|
19990119
|
|
|
|
Feature: the local mailer now prepends a Received: message
|
|
header with the queue ID to forwarded mail, in order to
|
|
make message tracing easier. File: local/forward.c.
|
|
|
|
Cleanup: after "postfix reload", no more broken pipe
|
|
complaints from resolve/rewrite clients.
|
|
|
|
19990121
|
|
|
|
Feature: pickup (again) logs uid and sender address. On
|
|
repeated request by Scott Cotton, Internet Consultants
|
|
Group, Inc.
|
|
|
|
Portability: doze() function for systems without usleep().
|
|
|
|
Cleanup: clients are now consistently logged as host[address].
|
|
|
|
19990122
|
|
|
|
Maildir support changed: specify "home_mailbox = Maildir/".
|
|
The magic is the trailing /. Suggested by Daniel Eisenbud,
|
|
University of California at Berkeley.
|
|
|
|
Maildir support from aliases, :include: and .forward files.
|
|
Specify /file/name/ - the trailing / is required. Suggested
|
|
by Daniel Eisenbud, University of California at Berkeley.
|
|
|
|
Workaround: watchdog timer to prevent the queue manager
|
|
from locking up on some systems.
|
|
|
|
Bugfix: in Received: headers, the "for <recipient>"
|
|
information was in the wrong place. Pointed out by Jon
|
|
Ribbens, Oaktree Internet Solutions Ltd.
|
|
|
|
19990124
|
|
|
|
Portability: more workarounds for GNU getopt() by Liviu
|
|
Daia, Institute of Mathematics, Romanian Academy. File:
|
|
sendmail/sendmail.c.
|
|
|
|
19990125
|
|
|
|
Bugfix: Postfix should not masquerade recipient addresses
|
|
extracted from message headers. Problem reported by David
|
|
Blacka, Network Solutions. File: cleanup/cleanup_message.c.
|
|
|
|
19990126
|
|
|
|
Feature: smtpd_etrn_restrictions parameter to restrict who
|
|
may use ETRN and what domains may be specified. Example:
|
|
"smtpd_etrn_restrictions = permit_mynetworks, reject".
|
|
Requested by Jon Ribbens, Oaktree Internet Solutions Ltd.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
19990127
|
|
|
|
Bugfix: in an attempt to shave some cycles, the anti junk
|
|
mail routines would use the wrong resolved address. This
|
|
"optimization" is now turned off. Problem reported by Sam
|
|
Eaton, Pavilion Internet Plc. File: smtpd/smtpd_check.c.
|
|
|
|
Feature: BIFF notifications. For compatibility reasons
|
|
this feature is on by default. This "protocol" can be a
|
|
real performance pig. Specify "biff = no" in main.cf if
|
|
your machine has lots of shell users. Feature requested by
|
|
Dan Farmer - it's one of the things one does for friends.
|
|
Files: local/mailbox.c, local/biff_notify.c.
|
|
|
|
Bugfix: another case sensitivity problem, this time with
|
|
virtual lookups to recognize unknown@virtual.domain.
|
|
Problem reported by Bo Kleve, Linkoping University. File:
|
|
qmgr/qmgr_message.c.
|
|
|
|
19990128
|
|
|
|
Feature: with "soft_bounce = yes", defer delivery instead
|
|
of bouncing mail. This is a safety net for configuration
|
|
errors with delivery agents. It has no effect on errors in
|
|
virtual maps, canonical maps, or in junk mail restrictions.
|
|
Feature requested by Bennett Todd. File: global/bounce.c.
|
|
|
|
19990129
|
|
|
|
Compatibility: the qmail maildir.5 documentation prescribes
|
|
maildir file names of the form time.pid.hostname, which is
|
|
wrong because Postfix processes perform multiple deliveries.
|
|
Elsewhere the qmail author has documented how maildir files
|
|
should be named under such conditions. Postfix has been
|
|
changed to be conformant. File: local/maildir.c.
|
|
|
|
19990131
|
|
|
|
Feature: special treatment of owner-foo and foo-request
|
|
can be turned off. Specify "owner_request_special = no".
|
|
Requested by Matthew Green and others. Files: local/alias.c,
|
|
global/split_addr.c. This affects canonical, virtual and
|
|
alias lookups.
|
|
|
|
19990204
|
|
|
|
Portability: signal handling for HP-UX 9 by Lamont Jones
|
|
of Hewlett Packard. File: master/master_sig.c.
|
|
|
|
Robustness: disable random walk inside a per-site queue to
|
|
avoid message starvation under heavy load. File: qmgr_entry.c.
|
|
|
|
Robustness: under some conditions the queue manager could
|
|
declare a host dead after just one delivery failure. File:
|
|
qmgr_queue.c.
|
|
|
|
19990212
|
|
|
|
Feature: skip SMTP servers that greet us with a 4XX status
|
|
code. Example: "smtp_skip_4xx_greeting = yes". By default,
|
|
the Postfix SMTP client defers delivery when a server
|
|
declines talking to us. File: smtp/smtp_connect.c.
|
|
|
|
Robustness: upon startup the queue manager now moves active
|
|
queue files to the incoming queue instead of the deferred
|
|
queue, to avoid anomalous delivery delays on systems that
|
|
have a huge incoming queue. Files: qmgr/qmgr.c,
|
|
qmgr/qmgr_active.c, global/mail_flush.c, conf/postfix-script*
|
|
|
|
19990213
|
|
|
|
Robustness: added watchdog timers to avoid getting stuck
|
|
on systems with broken select() socket implementations.
|
|
File: qmgr_transport.c, qmgr_deliver.c.
|
|
|
|
19990218
|
|
|
|
Feature: NFS-friendly delivery to mailbox by avoiding the
|
|
use of root privileges as much as possible. With input by
|
|
Mike Muus, Army Research Lab, USA.
|
|
|
|
Feature: the smtp-sink test server now supports SMTP command
|
|
pipelining. To this end we had to generalize the timer and
|
|
vstream support. Poor performance is fixed 19990222.
|
|
|
|
Cleanup: timer event routines now have the same interface
|
|
as read/write event routines (event type + context). File:
|
|
util/events.c.
|
|
|
|
Feature: new vstream_peek() routine to tell how much unread
|
|
data is left in a VSTREAM buffer. This is the vstream
|
|
variant of the peekfd() routine for kernel read buffers.
|
|
File: util/vstream.c.
|
|
|
|
Feature: directory scanning support for hashed mail queue
|
|
directories. So far the results are disappointing: with
|
|
depth = 2 (16 directories with 16 subdirectories), mailq
|
|
takes 5 seconds with an empty queue unless all directories
|
|
happen to be cached in memory. We need a bit map before
|
|
hashed queue directories become practical. Depth=1 hashing
|
|
doesn't slow down mailq much, but doesn't help much either.
|
|
Files: util/scan_dir.c, global/mail_scan_dir.c.
|
|
|
|
19990221
|
|
|
|
Workaround: with "ignore_mx_lookup_error = yes", the SMTP
|
|
client always performs an A lookup when an MX lookup could
|
|
not be completed, rather than treating MX lookup failure
|
|
as a temporary error condition. Unfortunately there are
|
|
many broken DNS servers on the Internet. File: smtp/smtp_addr.c.
|
|
|
|
19990222
|
|
|
|
Performance: rewrote the guts of the smtp-sink test server
|
|
so it can do pipelining without losing performance.
|
|
|
|
19990223
|
|
|
|
Workaround: hotmail.com sometimes drops the connection
|
|
after "." (causing misleading diagnostics to be logged) or
|
|
waits minutes after receiving QUIT. Solution: do not wait
|
|
for the response to QUIT. File: smtp/smtp_proto.c. This
|
|
is turned off with: "smtp_skip_quit_response = no".
|
|
|
|
19990224
|
|
|
|
Feature: the pipe mailer accepts user=username:groupname,
|
|
based on code submitted by Philip A. Prindeville, Mirapoint,
|
|
Inc., USA. File: pipe/pipe.c.
|
|
|
|
Workaround: use file locking to prevent multiple processes
|
|
from select()ing on the same socket. This causes performance
|
|
problems on large BSD systems. Files: master/*_server.c.
|
|
|
|
19990225
|
|
|
|
Bugfix: with "inet_interfaces = 127.0.0.1", don't bind to
|
|
the loopback interface. Problem reported by Steve Bellovin
|
|
of AT&T. File: smtp/smtp_addr.c.
|
|
|
|
Feature: "postsuper" command to remove stale queue files
|
|
to update queues after changes to the queue structure
|
|
parameters (hash_queue_names, hash_queue_depth). This
|
|
command is to be run from the postfix-script maintenance
|
|
shell script.
|
|
|
|
19990301
|
|
|
|
Feature: new postconf -h (suppress `name = ' in output)
|
|
option to make the program easier to use in, e.g., shell
|
|
scripts.
|
|
|
|
Feature: dict_unix module so you can add the UNIX passwd
|
|
table to the SMTPD access control list.
|
|
|
|
19990302
|
|
|
|
Feature: "luser_relay = destination" captures mail for
|
|
non-existent local recipients. This works only when the
|
|
local delivery agent does mailbox delivery (including
|
|
delivery via mailbox_command), not when mailbox delivery
|
|
is delegated to another message transport.
|
|
|
|
Feature: new reject_non_fqdn_{hostname,sender,recipient}
|
|
restrictions to require fully.qualified.domain forms in
|
|
HELO, MAIL FROM and RCPT TO commands (while still allowing
|
|
the <> sender address).
|
|
|
|
19990304
|
|
|
|
Bugfix: backed out the 19990119 change to always insert
|
|
Return-Path: if that header is not present. The pipe and
|
|
local agents now are responsible for prepending Return-Path:.
|
|
Files: cleanup/cleanup_message.c, global/mail_copy.[hc],
|
|
pipe/pipe.c, global/header_opts.c. This causes an incompatible
|
|
change to the pipe flags parameter, because Return-Path:
|
|
now must be requested explicitly.
|
|
|
|
19990305
|
|
|
|
Bugfix: showq (the mailq server) incorrectly assumed that
|
|
all recipients of a deferred message are listed in the
|
|
corresponding defer logfile. It now lists all recipients.
|
|
Files: showq/showq.c, cleanup/cleanup_envelope.c (ensure
|
|
that sender records always precede recipient records).
|
|
|
|
Cleanup: smtpd HELO restrictions validate [numerical] forms.
|
|
Files: util/valid_hostname.c, smtpd/smtpd_check.c. Initial
|
|
code by Philip A. Prindeville, Mirapoint, Inc., USA.
|
|
|
|
19990306
|
|
|
|
Cleanup: re-vamped the valid_hostname module, and added a
|
|
maximal label length (63) requirement.
|
|
|
|
Feature: fallback_relay parameter to specify extra backup
|
|
hosts in case the regular relay hosts are not found or not
|
|
available. Files: smtp/smtp_addr.c.
|
|
|
|
Feature: "always_bcc = address" specifies where to send a
|
|
copy of each message that enters he system. However, if
|
|
that copy bounces, the sender will be informed of the
|
|
bounce. Files: smtpd/smtpd.c, pickup/pickup.c
|
|
|
|
Compatibility: the transport map will now route on top-level
|
|
domains, so you can dump all of .bitnet to a bitnet relay.
|
|
|
|
19990307
|
|
|
|
Feature: LDAP lookups, updated by Jon Hensley, Merit Network,
|
|
USA.
|
|
|
|
Feature: regular expression (PCRE) support by Andrew
|
|
McNamara, connect.com.au Pty. Ltd., Australia. In order to
|
|
use this code specify pcre:/file/name. You can use this
|
|
anywhere you would use a DB or DBM file, NIS or LDAP. See:
|
|
PCRE_README for how to enable this code.
|
|
|
|
Feature: "delay_warning_time = 4" causes Postfix to send
|
|
a "your mail is delayed" notice after approx. 4 hours.
|
|
Daniel Eisenbud, University of California at Berkeley.
|
|
Files: qmgr/qmgr_active.c, qmgr/qmgr_message. Postmaster
|
|
notices for delayed mail are disabled by default. In order
|
|
to receive postmaster notices, specify "notify_classes =
|
|
... delay ...".
|
|
|
|
Cleanup: do not send undeliverable bounced mail to postmaster.
|
|
This was causing lots of pain with junk mail from bogus
|
|
sender addresses to non-existent recipients. This change
|
|
was reversed 19990311.
|
|
|
|
19990308
|
|
|
|
Bugfix: the dotforward routine was too eager with throwing
|
|
away extension information, so that the Delivered-To: info
|
|
would differ for \mailbox and |command. Problem reported
|
|
by Rafi Sadowski, Open University, Israel.
|
|
|
|
Bugfix: seems I never got around to fix the btree access
|
|
method. I finally did. Problem reported by: Matt Smith,
|
|
AvTel Communications Inc., USA.
|
|
|
|
19990311
|
|
|
|
Back by popular demand: with "notify_classes = 2bounce ..."
|
|
Postfix will send undeliverable bounced mail to postmaster.
|
|
The default is to not send double bounces. This change
|
|
reverses a change made on 19990307.
|
|
|
|
19990312
|
|
|
|
Feature: configurable exit handler for server skeletons.
|
|
Philip A. Prindeville, Mirapoint, Inc., USA. Files:
|
|
master/*server.c.
|
|
|
|
Feature: mail_spool_directory configuration parameter to
|
|
specify the UNIX mail spool directory. The default setting
|
|
is system dependent.
|
|
|
|
19990313
|
|
|
|
Cleanup: share file descriptors for resolve and rewrite
|
|
client connections. This puts less strain on the trivial-rewrite
|
|
service.
|
|
|
|
Portability: support for UnixWare 2.1 by Dmitry E. Kiselyov,
|
|
Nizhny Novgorod City Health Emergency Station.
|
|
|
|
Feature: configurable delays in the smtpstone test programs.
|
|
With input by Philip A. Prindeville, Mirapoint, Inc., USA.
|
|
Files: smtpstone/*.c.
|
|
|
|
Bugfix: a "signal 11" problem in the trivial-rewrite program
|
|
that would occasionally happen after "postfix reload".
|
|
Reason: some rewrite clients would clobber their input,
|
|
and when they had to retransmit the query, the input would
|
|
be a zero-length string, which trivial-rewrite isn't supposed
|
|
to receive.
|
|
|
|
19990314
|
|
|
|
Feature: "mailbox_transport = cyrus" delegates all local
|
|
mailbox delivery to a master.cf entry called "cyrus" (the
|
|
same trick for procmail), including users not found in the
|
|
UNIX passwd database. This gives the flexibility of $name
|
|
expansions by the pipe mailer, without losing local aliases
|
|
and ~/.forward processing. Result of discussions with Rupa
|
|
Schomaker, RS Consulting.
|
|
|
|
19990315
|
|
|
|
Feature: the mydestination parameter can now be an empty
|
|
string, for hosts that don't receive any mail locally. Be
|
|
sure to specify a default route for mail that comes to the
|
|
machine or mail will loop.
|
|
|
|
19990316
|
|
|
|
Bugfix: the SMTPD check scaffolding didn't apply the same
|
|
sanity checks as the production code. Problem reported by
|
|
Alain Thivillon, Herve Schauer Consultants, France. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
Portability: some systems can have more than 59 seconds in
|
|
a minute. Based on a fix by Liviu Daia, Institute of
|
|
Mathematics, Romanian Academy. File: global/mail_date.c.
|
|
|
|
Enhancement: include the client network address in the
|
|
rejected by RBL response. Lamont Jones, Hewlett-Packard.
|
|
|
|
Workaround: use fstat() to figure out if the maildrop is
|
|
world-writable. access() uses the real uid, which stinks.
|
|
|
|
Robustness: don't do partial address lookups (user@, domain,
|
|
user, @domain) with regexp-style tables.
|
|
|
|
Security: don't allow regexp-style tables to be used for
|
|
aliases. It would be too easy to slip in "|command" or
|
|
:include: or /file/name.
|
|
|
|
19990317
|
|
|
|
Feature: "fallback_transport = cyrus" delegates non-UNIX
|
|
recipients to a master.cf entry called "cyrus", allowing
|
|
you to have both UNIX and non-UNIX mailboxes side by side.
|
|
|
|
19990319
|
|
|
|
Workaround: on 4.4 BSD derivatives, fstat() can return
|
|
EBADF on an open file descriptor. Now, that was a surprise.
|
|
This caused std{out,err} from cron commands to not be
|
|
delivered.
|
|
|
|
Bugfix: "local -v" stopped working.
|
|
|
|
Workaround: more watchdog timers for postfix-unfriendly
|
|
systems. By now every Postfix daemon has one. Call it life
|
|
insurance.
|
|
|
|
Robustness: increased the maximal time to receive or deliver
|
|
mail from $ipc_timeout (default: 3600 seconds) to the more
|
|
generous $daemon_timeout (default: 18000 seconds). We don't
|
|
want false alarms.
|
|
|
|
Portability: IRIX 5.2 does not have usleep().
|
|
|
|
19990320
|
|
|
|
Bugfix: \username was broken. Frank Dziuba was the first
|
|
to notice.
|
|
|
|
19990321
|
|
|
|
Workaround: from now on, Postfix on Solaris uses stream
|
|
pipes instead of UNIX-domain sockets. Despite workarounds,
|
|
the latter were causing more trouble than anything else on
|
|
all systems combined.
|
|
|
|
19990322
|
|
|
|
Portability: the makedefs would mis-identify IRIX 6.5.x as
|
|
IRIX 5.x. Fix by Brian Truelsen of Maersk Mc-Kinney Moller
|
|
Institute for Production Technology, Denmark.
|
|
|
|
Feature: reject_unknown_recipient_domain restriction for
|
|
recipient addresses. For the sake of symmetry, we now also
|
|
have reject_unknown_sender_domain. This means the old
|
|
reject_unknown_address restriction is being phased out.
|
|
Suggested by Rask Ingemann Lambertsen, Denmark Technical
|
|
University.
|
|
|
|
Feature: unknown sender/recipient domain restrictions now
|
|
distinguish between soft errors (always: 450) and hard
|
|
errors (configurable with the unknown_address_reject_code
|
|
parameter, default: 450; use 550 at your own risk).
|
|
|
|
Feature: no HELO junk mail restrictions means that no syntax
|
|
check will be done on HELO/EHLO hostname arguments.
|
|
|
|
Bugfix: the initial Solaris workaround for UNIX-domain
|
|
sockets could cause the queue manager to block if Postfix
|
|
ran into a delivery agent process limit. After another code
|
|
rewrite that problem is eliminated. Thanks to Chris
|
|
Cappuccio, Empire Net, for assistance with testing.
|
|
|
|
19990323
|
|
|
|
Bugfix: too much forwarding when users list their own name
|
|
in their .forward file (e.g. mail to user@localhost would
|
|
go through .forward, would be forwarded to user@$myorigin,
|
|
and would go through .forward again). Problem reported by
|
|
Roman Dolejsi, Prague University of Economics.
|
|
|
|
19990324
|
|
|
|
Bugfix: missing map name in check_xxx_access restrictions
|
|
could cause a segmentation error. Lamont Jones, Hewlett-
|
|
Packard.
|
|
|
|
Feature: forward_path configuration parameter (default:
|
|
$home/.forward$recipient_delimiter$extension,$home/.forward).
|
|
Based on initial code by Philip A. Prindeville, Mirapoint,
|
|
Inc., USA. Files: local/dotforward.c.
|
|
|
|
19990325
|
|
|
|
Workaround: Solaris NIS alias maps need special entries
|
|
(YP_MASTER_NAME, YP_LAST_MODIFIED). What's worse, normal
|
|
keys/values include a null byte at the end, but the YP_XXX
|
|
ones don't. Problem reported by Walcir Fontanini, state
|
|
university of Campinas, Brazil. File: postalias/postalias.c.
|
|
|
|
Compatibility: Solaris NIS apparently does include a null
|
|
byte at the end of keys and values. File: util/sys_defs.h.
|
|
|
|
Feature: library support for config parameters that are
|
|
not $name expanded at program start-up. This was needed
|
|
for forward_path, and will also be needed to make message
|
|
headers customizable.
|
|
|
|
Bugfix: pcre didn't handle \\ right. Lamont Jones, Hewlett-
|
|
Packard. File: util/dict_pcre.c.
|
|
|
|
19990326
|
|
|
|
Compatibility: Postfix now puts two spaces after the sender
|
|
in a "From sender date..." header. Found by John A. Martin,
|
|
fixed by Lamont Jones, Hewlett-Packard.
|
|
|
|
Bugfix: when a recipient appeared multiple times in a local
|
|
alias or include expansion, the delivery status could be
|
|
left uninitialized, causing the mail to be deferred and
|
|
delivered again. File: local/recipient.c.
|
|
|
|
19990327
|
|
|
|
Cleanup: the dictionary routines now take an extra flag
|
|
argument to control such things as warning about duplicates,
|
|
and appending null bytes to key/value. The latter was needed
|
|
for a clean implementation of NIS master alias maps support.
|
|
|
|
Feature: POSIX regular expressions by Lamont Jones. See
|
|
config/sample-regexp.c. Right now, enabled on *BSD and
|
|
LINUX only.
|
|
|
|
19990328
|
|
|
|
Code cleanup: dictionaries now have flags that say whether
|
|
lookup keys are fixed strings or whether keys are subjected
|
|
to pattern matching. This is needed to avoid passing partial
|
|
addresses to regexp-based lookup tables (user, @domain,
|
|
user@, domain). Files: util/dict*.c.
|
|
|
|
Bugfix: fixed memory leaks and core dumps in the regexp
|
|
and pcre routines (neither handled an empty pattern file).
|
|
|
|
19990329
|
|
|
|
Code cleanup: the dictionary I/O routines now do their own
|
|
locking depending on dictionary flag settings. This means
|
|
that the low-level dict_get() interface can now be used
|
|
for safe dictionary lookups. This is needed for 19990328's
|
|
partial lookup key support. Files: util/dict*.c. global/maps.c.
|
|
|
|
Feature: regular expression matches are no longer limited
|
|
to user@domain address forms in access/canonical/virtual
|
|
maps, but can also be used for domains in transport maps.
|
|
This needed the partial lookup key support to avoid passing
|
|
partial addresses to regexp-based lookup tables (user,
|
|
@domain, user@, domain). Files: global/maps.c
|
|
global/mail_addr_find.c.
|
|
|
|
Feature: new dictionary types can be registered with
|
|
dict_open_register(). File: util/dict_open.c.
|
|
|
|
19990330
|
|
|
|
Bug fix: match_list membership dictionary lookups were case
|
|
sensitive when they should not. Patch by Lutz Jaenicke,
|
|
BTU Cottbus, Germany.
|
|
|
|
19990402
|
|
|
|
Feature: $domain macro support in forward_path. Philip A.
|
|
Prindeville, Mirapoint, Inc., USA. File: local/dotforward.c.
|
|
|
|
Feature: if an address extension (+foo) is explicitly
|
|
matched by the .forward+foo file name, do not propagate
|
|
the extension to recipient addresses. This is more consistent
|
|
with the way aliases are expanded. File: local/dotforward.c.
|
|
|
|
19990404
|
|
|
|
Bugfix: after receiving mail, the SMTP server didn't reset
|
|
the cleanup error flag, so that multiple deliveries over
|
|
the same SMTP session could fail due to errors with previous
|
|
deliveries. Found by Lamont Jones, Hewlett-Packard.
|
|
|
|
19990405
|
|
|
|
Feature: MIME-encapsulated bounces. Philip A. Prindeville,
|
|
Mirapoint, Inc., USA. File: bounce/bounce_notify_service.c
|
|
|
|
Cleanup: vstreams now properly look at the EOF flag before
|
|
attempting to read, eliminating the need for typing Ctrl-D
|
|
twice to test programs; the EOF flag is reset after each
|
|
unget or seek operation. Files: util/vstream.c, util/vbuf.c.
|
|
|
|
Feature: in preparation for configurable message headers
|
|
the mac_parse() routine now balances the parentheses in
|
|
${name} or $(name). We need this in order to support
|
|
conditional expressions such as ${name?text} where `text'
|
|
contains other ${name} expressions.
|
|
|
|
19990406
|
|
|
|
Cleanup: changed MIME header information to make bounces
|
|
more RFC 1892 compliant.
|
|
|
|
19990407
|
|
|
|
Feature: "best_mx_transport = local" delivers mail locally
|
|
if the local machine is the best mail exchanger (by default,
|
|
mail is bounced with a "mail loops back to myself" error).
|
|
|
|
Config: in order to make feature tracking easier the source
|
|
code distribution now has a copy of the default settings
|
|
in conf/main.cf.default.
|
|
|
|
Feature: separate configurable postmaster addresses for
|
|
single bounces (bounce_notice_recipient), double bounces
|
|
(2bounce_notice_recipient), delayed mail (delay_notice_recipient),
|
|
and for other mailer errors (error_notice_recipient). The
|
|
default for all is "postmaster".
|
|
|
|
19990408
|
|
|
|
Workaround: on Solaris 2.x, the master appears to lose its
|
|
exclusive lock on the master.pid file, so keep grabbing
|
|
the lock each time the master wakes up from select().
|
|
|
|
Robustness: don't flush VSTREAM buffers after I/O error.
|
|
This prevents surprises when calling vstream_fclose() after
|
|
truncating a mailbox to its original size.
|
|
|
|
Portability: on LINUX systems, if <db_185.h> exists, don't
|
|
look for <db/db.h>.
|
|
|
|
Workaround: specify "sun_mailtool_compatibility = yes" to
|
|
avoid clashes with the mailtool application. This disables
|
|
kernel locks on mailbox files. Use only where needed.
|
|
|
|
Portability: renamed readline to readlline, to avoid clashes
|
|
with mysql.
|
|
|
|
19990409
|
|
|
|
Bugfix: ignore temp queue files that aren't old enough.
|
|
Problem reported by Vivek Khera, Khera Communications, Inc.
|
|
|
|
Bugfix: fixed typo in dict_db.c that caused processes to
|
|
not release DB shared locks.
|
|
|
|
Feature: auto-detection of changes to DB or DBM lookup
|
|
tables. This avoids the need to run "postfix reload" after
|
|
change to the smtp access table and other tables.
|
|
|
|
Feature: regular expression checks for message headers.
|
|
This requires support for POSIX or for PCRE regular
|
|
expressions. Specify "header_checks = regexp:/file/name"
|
|
or "header_checks = pcre:/file/name", and specify
|
|
"/^header-name: badstuff/ REJECT" in the pattern file
|
|
(patterns are case-insensitive by default). Code by Lamont
|
|
Jones, Hewlett-Packard. It is to be expected that full
|
|
content filtering will be delegated to an external command.
|
|
|
|
19990410
|
|
|
|
Bugfix: auto-detection of changes to DB or DBM lookup tables
|
|
wasn't done for TCP connections.
|
|
|
|
19990410
|
|
|
|
Feature: $recipient expansion in forward_path. Philip A.
|
|
Prindeville, Mirapoint, Inc., USA. File: local/dotforward.c
|
|
|
|
Feature: the smtp client consistently treats a numerical
|
|
hostname as an address. File: smtp/smtp_addr.c.
|
|
|
|
19990414
|
|
|
|
Compatibility: support comment lines starting with # in
|
|
$mydestination include files. This makes Postfix more
|
|
compatible with sendmail.cw files. File: util/match_list.c.
|
|
|
|
Feature: if your machines have short host names, specify
|
|
"mydomain = domain.name", and you no longer have to specify
|
|
"myhostname = host.domain.name". Files: global/mail_params.c,
|
|
postconf/postconf.c.
|
|
|
|
19990420
|
|
|
|
Cleanup: bounce mail when a mailbox goes over file quota,
|
|
instead of deferring delivery. File: local/mailbox.c.
|
|
|
|
19990421
|
|
|
|
Feature: auto-detection of changes to DB or DBM lookup
|
|
tables now includes the case where a file is unlinked.
|
|
Philip A. Prindeville, Mirapoint, Inc., USA. File:
|
|
util/dict.c.
|
|
|
|
19990422
|
|
|
|
Robustness: Lotus mail sends MAIL FROM: <@> instead of <>.
|
|
Problem reported by Erik Toubro Nielsen, IFAD, Denmark.
|
|
Files: trivial-rewrite/rewrite.c (@ becomes empty address)
|
|
and global/rewrite_clnt.c (allow empty response).
|
|
|
|
Bugfix: showq could segfault when writing to a broken pipe.
|
|
Problem reported by Bryan Fullerton, Canadian Broadcasting
|
|
Corporation. Files: util/vbuf_print.c.
|
|
|
|
Cleanup: got rid of the "fatal: write error: Broken pipe"
|
|
message when mailq output is piped into a program that
|
|
terminates early.
|
|
|
|
Cleanup: bounce messages are multipart/mixed with the error
|
|
report as part of the first message segment, because users
|
|
had trouble extracting the delivery error report from the
|
|
attachment.
|
|
|
|
19990423
|
|
|
|
Cleanup: the default junk mail reject code is now 554
|
|
(service unavailable) rather than 550 (user unknown).
|
|
|
|
Folded in the updated dict_ldap.c module by John Hensley,
|
|
Merit Network, USA.
|
|
|
|
Folded in the vstream_popen.c updates by Philip A.
|
|
Prindeville, Mirapoint, Inc., USA. This copies a lot of
|
|
code from pipe_command(); the next step is to trim that
|
|
module.
|
|
|
|
19990425
|
|
|
|
Workaround: renamed config.h to mail_conf.h etc. in order
|
|
to avoid name collisions with LINUX (yes, they have a system
|
|
include file called config.h). For compatibility with people
|
|
who have written software for Postfix, there's a config.h
|
|
that aliases the old names to the new ones. That file will
|
|
go away eventually.
|
|
|
|
19990426
|
|
|
|
Feature: error mailer, in order to easily bounce mail for
|
|
specific destinations. In the transport table, specify:
|
|
"host.domain error:host.domain is unavailable". Too bad
|
|
that the transport table triggers on destination domain
|
|
only; it would be nice to bounce specific users as well.
|
|
|
|
19990427
|
|
|
|
Cleanup: "disable_dns_lookups = yes" now should disable
|
|
all DNS lookups by the SMTP client.
|
|
|
|
19990428
|
|
|
|
Bugfix: with DBM files, Postfix was watching the "dir" file
|
|
modification time for changes. It should be watching the
|
|
"pag" file instead.
|
|
|
|
19990429
|
|
|
|
Cleanup: all callbacks in the master to server API now pass
|
|
on the service name and the application-specific argument
|
|
vector. Files: master/*server.c.
|
|
|
|
19990504
|
|
|
|
Feature: conditional macro expansion. ${name?text} expands
|
|
to text when name is defined, otherwise the result is empty.
|
|
${name:text} expands to text when name is undefined,
|
|
otherwise the result is empty. File: util/mac_expand.c.
|
|
|
|
Feature: conditional macro expansion of the forward_path
|
|
configuration parameters of $user, $home, $shell, $recipient,
|
|
$extension, $domain, $mailbox and $recipient_delimiter.
|
|
Files: local/dotforward.c, local/local_expand.c.
|
|
|
|
19990506
|
|
|
|
Cleanup: eliminated misleading warnings about unknown HELO
|
|
etc. SMTPD restrictions when the HELO etc. information is
|
|
not available. File: smtpd/smtpd_check.c.
|
|
|
|
19990507
|
|
|
|
Feature: all smtpd reject messages now contain the MAIL
|
|
FROM and RCPT TO addresses, if available.
|
|
|
|
19990508
|
|
|
|
Feature: conditional macro expansion of the luser_relay
|
|
configuration parameter. It is no longer possible to specify
|
|
/file/name or "|command" destinations. File: local/unknown.c.
|
|
|
|
Cleanup: changed the mac_parse interface so that the
|
|
application callback routine can return status information.
|
|
Updated the dict_regexp and dict_pcre modules accordingly.
|
|
|
|
Cleanup: changed the mac_expand interface so that the caller
|
|
provides an attribute lookup routine, instead of having to
|
|
provide a copy of all attributes upfront. Files:
|
|
util/mac_expand.c, local/local_expand.c.
|
|
|
|
Feature: control over how address extensions are propagated
|
|
to other addresses. By default, propagation of unmatched
|
|
address extensions is now restricted to canonical and
|
|
virtual mappings. Specify "propagate_unmatched_extensions
|
|
= canonical, virtual, alias, forward, include" to restore
|
|
previous behavior.
|
|
|
|
19990509
|
|
|
|
Feature: USER, EXTENSION, DOMAIN, RECIPIENT (entire address)
|
|
and MAILBOX (address localpart) environment variables are
|
|
exported to shell commands (including mailbox_command).
|
|
|
|
Feature: new command_expansion_filter parameter to control
|
|
what characters may appear in message attributes that are
|
|
exported via environment variables.
|
|
|
|
Cleanup: SMTPD reject messages are more informative, and
|
|
more complete sender/recipient information is logged for
|
|
the local sysadmin.
|
|
|
|
19990510
|
|
|
|
Bugfix: missing MIME header in postmaster bounce notices.
|
|
Found by Samuel Tardieu, Ecole Nationale Superieure des
|
|
Telecommunications, France.
|
|
|
|
Feature: UCE restrictions are always delayed until RCPT
|
|
TO, VRFY or ETRN. To change back to the default specify
|
|
"smtpd_delay_reject = no" in /etc/postfix/main.cf.
|
|
|
|
Bugfix: missing duplicate filter call. This caused too many
|
|
deliveries when a user is listed multiple times in an alias.
|
|
Reported by Hideyuki Suzuki, School of Engineering, University
|
|
of Tokyo. Backed out on 19990512 because it caused problems.
|
|
Fixed 19990513 but needs further study.
|
|
|
|
Feature: it is now possible to move queue files back into
|
|
the maildrop queue, so that they can benefit from changes
|
|
in canonical and virtual mappings. In order to make this
|
|
possible, some restrictions on queue file contents were
|
|
relaxed. Files: pickup/pickup.c, cleanup/cleanup_extracted.c.
|
|
|
|
Feature: made a start with integrating Joerg Henne's
|
|
dictionary extensions to remove entries and to iterate over
|
|
entries. That code is almost four months old by now.
|
|
|
|
19990511
|
|
|
|
Feature: added a "undeliverable postmaster notification
|
|
discarded" warning when mail is dropped on the floor.
|
|
Requested by Michael Hasenstein, SuSE, Germany.
|
|
|
|
19990517
|
|
|
|
Bugfix: reject_non_fqdn_sender/recipient would pass
|
|
user@[ip_address] regardless of destination. Eric Cholet
|
|
had the honor of suffering from this one.
|
|
|
|
19990527
|
|
|
|
More SMTP client logging for easier debugging: the smtp
|
|
client now logs hostname[ip.addr], and logs every failed
|
|
attempt to reach an MX host, not just the last one.
|
|
|
|
19990601
|
|
|
|
Bugfix: emit a blank line before a MIME boundary; the line
|
|
is part of the boundary. File: bounce/bounce_notify_service.c.
|
|
Wolfgang Segmuller, IBM Research.
|
|
|
|
19990610
|
|
|
|
Bugfix: the "is this the loopback interface" test was
|
|
broken. Reported by Claus Fischer @microworld.com. File:
|
|
smtp/smtp_connect.c.
|
|
|
|
Usability: added helpful warnings about restrictions that
|
|
are being ignored after check_relay_domains, etc.
|
|
|
|
Portability: Reliant Unix support by Gert-Jan Looy, Siemens,
|
|
the Netherlands.
|
|
|
|
19990611
|
|
|
|
Robustness: the postfix-script start-up procedure now
|
|
detects a missing master program, avoiding misleading
|
|
warnings that the mail system is already running. Fix
|
|
suggested by David E. Smith @technopagan.org.
|
|
|
|
Portability: Mac OS X Server Port by Mark Miller @swoon.net.
|
|
|
|
Feature: on systems that use dotlock files for mailbox
|
|
locking, the local delivery agent now will attempt to use
|
|
dotlock files when delivering to user-specified files.
|
|
Dotlock files for user-specified destinations are created
|
|
with the privileges of the user. For backwards compatibility,
|
|
Postfix will attempt to create dotlocks for user-specified
|
|
destinations only when the user has parent directory write
|
|
permission.
|
|
|
|
Feature: specify "expand_owner_alias = yes" in order to
|
|
use the right-hand side of an owner- alias, instead of
|
|
using the left-hand side address. Needed by Juergen Georgi.
|
|
|
|
19990622
|
|
|
|
Bugfix: the local delivery agent did not set user attributes
|
|
when delivering to root, so that forward_path did not expand
|
|
properly. Found by Jozsef Kadlecsik, KFKI Research Institute
|
|
for Particle and Nuclear Physics, Hungary. File:
|
|
local/dotforward.c.
|
|
|
|
Bugfix: the unix:passwd.byname mechanism is not suitable
|
|
for smtpd access control - the user name would have to end
|
|
in @, or the access control software would have to be
|
|
changed. Removed the example from the RELEASE_NOTES file.
|
|
|
|
19990623
|
|
|
|
Bugfix: the smtp server did not reset the error flag after
|
|
".". Found by James Ponder, Oaktree Internet Solutions Ltd.
|
|
File: smtpd/smtpd.c.
|
|
|
|
Bugfix: fencepost error in the doze() routine (an usleep()
|
|
replacement for systems without one). Found by Simon J
|
|
Mudd. File: util/doze.c.
|
|
|
|
19990624
|
|
|
|
Portability: support for AIX 3.2.5 (!) by Florian Lohoff
|
|
@rfc822.org.
|
|
|
|
Portability: Ultrix 4.3 support by Christian von Roques
|
|
@pond.sub.org.
|
|
|
|
Feature: mysql support by Scott Cotton and Joshua Marcus,
|
|
Internet Consultants Group, Inc. Files: util/dict_myqsl.*.
|
|
|
|
19990627
|
|
|
|
Bugfix: Postfix is now distributed under the new IBM Public
|
|
License (version 1, dated June 14, 1999).
|
|
|
|
Feature: the Delivered-To: header can be turned off for
|
|
delivery to command or file/mailbox. The default setting
|
|
is: "prepend_delivered_header = command, file, forward".
|
|
Turning off the Delivered-To: header when forwarding mail
|
|
is not recommended.
|
|
|
|
19990628
|
|
|
|
Feature: the postlock command now returns EX_TEMPFAIL when
|
|
the destination file is locked by another process.
|
|
|
|
19990705
|
|
|
|
Workaround: in the SMTP client, move the "mail loops back
|
|
to myself test" from the 220 greeting to the HELO response.
|
|
This change does not weaken the test, and makes Postfix
|
|
more robust against broken software that greets with the
|
|
client hostname.
|
|
|
|
19990706
|
|
|
|
Workaround: in the INSTALL file, use `&&' instead of `;'
|
|
in (cd path; tar ...) pipelines because some UNIX re-invented
|
|
shells don't bail out when cd fails. Matthias Andree
|
|
@stud.uni-dortmund.de.
|
|
|
|
19990709
|
|
|
|
Bugfix: $user was not set when delivering to a non-user.
|
|
Found by Vladimir Ulogov @ rohan.control.att.com when
|
|
configuring a luser_relay that contained $user.
|
|
|
|
19990714
|
|
|
|
Robustness: add PATH statement to Solaris2 chroot setup
|
|
script to avoid running the ucb commands. Problem found by
|
|
Panagiotis Astithas @ ece.ntua.gr.
|
|
|
|
19990721
|
|
|
|
Bugfix: don't claim a "mail loops to myself" error when
|
|
the best MX host was not found in the DNS. Found by Andrew
|
|
McNamara, connect.com.au Pty Ltd. File: smtp/smtp_addr.c.
|
|
|
|
19990810
|
|
|
|
Feature: added "-c config_dir" support to the postconf
|
|
command. This probably means that "-f file" will never be
|
|
implemented.
|
|
|
|
19990812
|
|
|
|
Bugfix: showq didn't print properly when listing a maildrop
|
|
file. Fix by: Andrew McNamara, connect.com.au Pty Ltd.
|
|
File: showq/showq.c.
|
|
|
|
Feature: added SENDER to the list of parameters exported
|
|
to external commands. File: local/command.c. Code by: Lars
|
|
Hecking, National Microelectronics Research Centre, Ireland.
|
|
|
|
19990813
|
|
|
|
Bugfix: sendmail -t (extract recipients from headers) did
|
|
not work when the always_bcc feature was turned on. Reported
|
|
by: Denis Shaposhnikov @ neva.vlink.ru.
|
|
|
|
19990813
|
|
Bugfix: "sendmail -bd" returns a bogus exit status (the
|
|
child process ID). Fix by Lamont Jones of Hewlett-Packard.
|
|
File: sendmail/sendmail.c.
|
|
|
|
19990824
|
|
|
|
Bugfix: null pointer dereference while rejecting VRFY before
|
|
MAIL FROM. Found by Laurent Wacrenier @ fr.clara.net.
|
|
|
|
19990826
|
|
|
|
Portability: more MacOS X Server patches; some NEXTSTEP/OPENSTEP
|
|
code that had been removed for the first public beta release;
|
|
NEXTSTEP/OPENSTEP now defaults to netinfo for the aliases
|
|
database. Submitted by Gerben Wierda.
|
|
|
|
Portability: workaround for a FreeBSD 3.x active network
|
|
interface without IP address by Pierre Beyssac @ enst.fr.
|
|
File: inet_addr_local.c.
|
|
|
|
19990831
|
|
|
|
Workaround: sendmail now prints a warning when installed
|
|
set-uid or when run by a set-uid command. Reportedly, the
|
|
linuxconf software turns on the set-uid bit, which could
|
|
open up a security loophole. File: sendmail/sendmail.c.
|
|
|
|
Bugfix: Postfix daemons now temporarily lock DB/DBM files
|
|
while opening them, in order to avoid "invalid argument"
|
|
errors because some other process is changing the file.
|
|
Files: util/dict_db.c, util/dict_dbm.c.
|
|
|
|
Robustness: Postfix locks queue files during delivery, to
|
|
prevent duplicate delivery when "postfix reload" is
|
|
immediately followed by "sendmail -q". This involves a
|
|
change of the deliver_request interface: delivery agents
|
|
no longer need to open and close queue files explicitly.
|
|
Files: global/deliver_request.c, pipe/pipe.c, smtp/smtp.c,
|
|
local/local.c, qmgr/qmgr_active.c, qmgr/qmgr_message.c.
|
|
|
|
Feature: reject_unauth_destination SMTP recipient restriction
|
|
that rejects destinations not in $relay_domains. By Lamont
|
|
Jones of Hewlett-Packard. File: smtpd/smtpd_check.c.
|
|
|
|
Security: do not allow weird characters in the expansion
|
|
of $names that appear in $forward_path. Just like with
|
|
shell commands, replace bad characters in expansions by
|
|
underscores. Configuration parameter: forward_expansion_filter.
|
|
|
|
19990902
|
|
|
|
Documentation: added a sample postfix alias to the examples
|
|
in the INSTALL document and in the conf/aliases file.
|
|
Reminded by Simon J. Mudd @ alltrading.com.
|
|
|
|
19990903
|
|
|
|
Bugfix: in case of some error conditions the pickup daemon
|
|
could leak small amounts of memory.
|
|
|
|
19990905
|
|
|
|
Bugfix: no more "skipping further client input" warnings
|
|
when a message header is rejected.
|
|
|
|
Feature: reject_unauth_pipelining SMTP restriction that
|
|
rejects mail from clients that improperly use SMTP command
|
|
pipelining.
|
|
|
|
Robustness: the LDAP client by default no longer looks up
|
|
names containing "*". See the lookup_wildcards feature in
|
|
LDAP_README. Update by John Hensley.
|
|
|
|
Documentation: address masquerading with exceptions FAQ by
|
|
Jim Seymour @ jimsun.LinxNet.com.
|
|
|
|
Bugfix: mysql reconnect after disconnect by Scott Cotton
|
|
Internet Consultants Group, Inc. File: util/dict_myqsl.c.
|
|
|
|
Portability: the Postfix to PCRE interface now expects
|
|
version 2.08. Postfix is no longer compatible with PCRE
|
|
versions before 2.6.
|
|
|
|
19990906
|
|
|
|
Feature: INSTALL.sh script that makes Postfix installation
|
|
a bit less painful. This script can be used for installing
|
|
and for upgrading Postfix. It replaces files instead of
|
|
overwriting them, and leaves existing configuration and
|
|
queue files intact.
|
|
|
|
19990907
|
|
|
|
Bugfix: reject_non_fqdn_sender used the wrong test to see
|
|
if a sender address was given and could dump core. This
|
|
must have been broken ever since the UCE tests were moved
|
|
to the RCPT TO stage in 19990510.
|
|
|
|
Bugfix: check_sender_access was recognized as a valid
|
|
restriction name only if a sender had been specified.
|
|
|
|
19990908
|
|
|
|
Portability: Unixware has <sysexits.h> only after sendmail
|
|
is installed. Changed postlock.c to use global/sys_exits.h.
|
|
|
|
19990909
|
|
|
|
Performance: added one-entry cache to the address rewriting
|
|
client and to the address resolving client. This is because
|
|
UCE restrictions tend to produce the same query repeatedly.
|
|
Files: global/rewrite_clnt.c, global/resolve_clnt.c.
|
|
|
|
Feature: the UCE restrictions are now fully recursive so
|
|
you can have per-client/helo/sender/recipient restrictions.
|
|
Instead of OK, REJECT or [45]xx, you can specify a sequence
|
|
of restrictions on the right-hand side of an SMTPD access
|
|
table. This means you can no longer use canonical/virtual/alias
|
|
maps as SMTPD access tables. But the loss is compensated
|
|
for. File: smtpd/smtpd_access.c.
|
|
|
|
Feature: restriction classes, essentially a short-hand for
|
|
restriction lists. These short hands are useful mostly on
|
|
the right-hand side of SMTPD access tables. You must use
|
|
restriction classes in order to have lookup tables on the
|
|
right-hand side of an SMTPD access table. File:
|
|
smtpd/smtpd_access.c.
|
|
|
|
Feature: "permit_recipient_map maptype:mapname" permits a
|
|
recipient address when it matches the specified table.
|
|
Lookups are done just as with canonical/virtual maps. With
|
|
this, you can also use passwd/aliases as SMTPD access maps.
|
|
File: smtpd/smtpd_access.c.
|
|
|
|
19990910
|
|
|
|
Changed "permit_address_map" into "permit_recipient_map"
|
|
and added a test for the case that they specify a lookup
|
|
table on the right-hand side of an SMTPD access map. File:
|
|
smtpd/smtpd_access.c.
|
|
|
|
Cleanup: removed spurious sender address checks for <>.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
Cleanup: the smtp client now consistently logs host[address]
|
|
for all connection attempts.
|
|
|
|
19990919
|
|
|
|
Feature: in an SMTPD access map, an all-numeric right-hand
|
|
side now means OK, for better cooperation with out-of-band
|
|
authentication mechanisms.
|
|
|
|
19990922
|
|
|
|
Security: recipient addresses must not start with '-', in
|
|
order to protect external commands. The old behavior is
|
|
re-instated when main.cf specifies: "allow_min_user =
|
|
yes". Credits to Mads Kiilerich @ Kiilerich.com. File:
|
|
qmgr/qmgr_message.c.
|
|
|
|
Bugfix: after 19990831, the queue manager would throw away
|
|
defer logs after deferring mail to known-to-be-dead hosts
|
|
or message transports. This means that in some cases, mailq
|
|
would not show why mail is delayed, and that delayed mail
|
|
could be sent back with recipients missing from the error
|
|
report. Reported by Giulio Orsero @ tiscalinet.it.
|
|
|
|
19990923
|
|
|
|
Bugfix: the above bugfix broke bounces of mail with bad
|
|
address syntax and relocated users. Problem diagnosed by
|
|
Dick Porter @ acm.org.
|
|
|
|
Documentation: added DO NOT EDIT THIS FILE. EDIT MAIN.CF
|
|
INSTEAD notices to the sample-xxx.cf files.
|
|
|
|
19991007
|
|
|
|
Compatibility: ignore the sendmail -U (initial user
|
|
submission) option. Thomas Quinot @ cuivre.fr.eu.org.
|
|
|
|
19991103
|
|
|
|
Code cleanup: don't send postmaster notifications when an
|
|
SMTP client sends a DATA command while no recipients were
|
|
accepted. This can happen when a pipelined client runs
|
|
into an UCE block. File: smtpd/smtpd.c.
|
|
|
|
19991104
|
|
|
|
Robustness: do not apply UCE header checks to mail that is
|
|
generated by Postfix (bounces, forwarded mail etc.). Files:
|
|
smtpd/smtpd.c, pickup/pickup.c, cleanup/cleanup_message.c.
|
|
|
|
Robustness: new generic watchdog module that can deal with
|
|
clocks that jump occasionally. Files: util/watchdog.c,
|
|
master/master.c, master/{single,multi,trigger}_server.c.
|
|
This hopefully ends the false watchdog alarms that happen
|
|
when clocks are set or when laptops are resumed.
|
|
|
|
Code cleanup: BSMTP requires dot quoting as per RFC 821.
|
|
Based on code by Florian Lohoff @ rfc822.org. Files:
|
|
global/mail_copy.[hc], pipe/pipe.c.
|
|
|
|
19991105
|
|
|
|
Bugfix: the crufty code in inet_addr_local() did not find
|
|
IP aliases. File: util/inet_addr_local.c.
|
|
|
|
Portability: the INSTALL.sh utility did not find users or
|
|
groups in NIS or Netinfo tables. The script no longer
|
|
searches the /etc/passwd and /etc/group files. Instead it
|
|
now queries the unix:passwd.byname and unix:group.byname
|
|
maps. For this, a -q (query) option was added to postmap
|
|
(and to postalias, for symmetry). Files: util/dict_unix.c,
|
|
postalias/postalias.c, postmap/postmap.c, INSTALL.sh.
|
|
|
|
Bugfix: LDAP lookup timeout settings were ignored. Patch
|
|
by John Hensley. File: util/dict_ldap.c.
|
|
|
|
19991108
|
|
|
|
Bugfix: when doing a fresh install, INSTALL.sh didn't set
|
|
main.cf:mail_owner properly (Simon J. Mudd).
|
|
|
|
19991109
|
|
|
|
Bugfix: when doing a fresh install, INSTALL.sh no longer
|
|
worked (missing main.cf file). Fix: add "-c" argument to
|
|
the postmap commands (Lars Hecking @ nmrc.ucc.ie).
|
|
|
|
Documentation: removed spurious "do not edit" comments from
|
|
the sample pcre and regexp configuration files.
|
|
|
|
19991110-13
|
|
|
|
Code cleanup: greatly simplified the SMTPD command parser
|
|
and somewhat simplified the code that groks RFC 822-style
|
|
address syntax in MAIL FROM and RCPT TO commands.
|
|
|
|
New parameter: strict_rfc821_envelopes (default: no) to
|
|
reject RFC 822 address forms (with comments etc.) in SMTP
|
|
envelopes. By default, the Postfix SMTP server only logs
|
|
a warning.
|
|
|
|
19991113
|
|
|
|
Oops, also updated the SMTP VRFY code in the light of
|
|
changes to the SMTPD command parser.
|
|
|
|
Cleanup: the local delivery agent now explicitly rejects
|
|
recipients with an empty username.
|
|
|
|
19991114
|
|
|
|
Workaround: with some gawk versions, postconf/extract.awk
|
|
reportedly returns a non-zero exit status upon success.
|
|
Added an explicit exit(0) statement.
|
|
|
|
19991115
|
|
|
|
Feature: DNS TXT record lookup support, based on initial
|
|
code by Simon J Mudd. File: dns/dns_lookup.c.
|
|
|
|
Feature: RBL TXT record lookups, based on initial code by
|
|
Simon J Mudd. File: smtpd/smtpd_check.c.
|
|
|
|
Feature: permit_auth_destination restriction based on code
|
|
by Jesper Skriver @ skriver.dk.
|
|
|
|
Code cleanup: the transport table now can override all
|
|
deliveries, including local ones.
|
|
|
|
19991116
|
|
|
|
Code cleanup: a new "local_transports" configuration
|
|
parameter explicitly lists all transports that deliver mail
|
|
locally. The first name listed there is the default local
|
|
transport. This is the end of the "empty next-hop hostname"
|
|
hack to indicate that a destination is local. Files:
|
|
trivial-rewrite/resolve.c, global/local_transport.[hc]
|
|
|
|
Feature: "postconf -m" shows what lookup table types are
|
|
available. Code by Scott Cotton, Internet Consultants
|
|
Group, Inc.
|
|
|
|
Feature: "postconf -e" edits any number of main.cf parameters.
|
|
The edit is done on a copy, and the copy is renamed into
|
|
the place of the original. File: postconf/postconf.c,
|
|
util/readlline.[hc].
|
|
|
|
19991117
|
|
|
|
Portability: SunOS 4 has no SA_RESTART. File: util/watchdog.c.
|
|
|
|
Feature: on systems with h_errno, the "reject_unknown_client"
|
|
restriction now distinguishes between soft errors (always
|
|
reply with 450) and hard errors (use the user-specified
|
|
reply code). This should lessen the load by broken mailers
|
|
that re-connect once a minute.
|
|
|
|
Feature: forward/reverse name/address check for SMTP client
|
|
hostnames. This fends off some hypothetical attacks by
|
|
spammers who are in control of their own reverse mapping.
|
|
|
|
Robustness: postconf no longer aborts when it can't figure
|
|
out the local domain name; it prints a warning instead.
|
|
This allows you to use "postconf -e" to fix the problem.
|
|
|
|
19991118
|
|
|
|
Bugfix: the RFC822 address parser would misparse a leading
|
|
\ as an atom all by itself. Problem reported by Keith
|
|
Stevenson @ louisville.edu. File: global/tok822_parse.c.
|
|
|
|
19991119
|
|
|
|
Bugfix: tiny memory leak in pipe_command() when fork()
|
|
fails. File: global/pipe_command.c.
|
|
|
|
19991120
|
|
|
|
Bugfix: reversed test for all-numerical results in SMTPD
|
|
access maps. File: smtpd/smtpd_check.c.
|
|
|
|
19991121
|
|
|
|
Robustness: INSTALL.sh no longer uses postmap for sanity
|
|
checks.
|
|
|
|
Feature: INSTALL.sh now has an install_root option.
|
|
|
|
Bugfix: INSTALL.sh now installs manual pages with proper
|
|
permissions and ownership.
|
|
|
|
Bugfix: the LDAP client did not properly escape special
|
|
characters in lookup keys (patch by John Hensley). File:
|
|
util/dict_ldap.c.
|
|
|
|
19991122
|
|
|
|
Bugfix: missing absolute path in INSTALL.sh broke fresh
|
|
install.
|
|
|
|
19991124
|
|
|
|
Bugfix: the local delivery agent's recipient duplicate
|
|
filter did not work when configured to use unlimited memory
|
|
(which is not a recommended setting). Patrik Rak @raxoft.cz.
|
|
|
|
19991125
|
|
|
|
Bugfix: postconf didn't have an umask(022) call at the
|
|
beginning (problem experienced by Matthias Andree).
|
|
|
|
19991126
|
|
|
|
Bugfix: DNS TXT records now have string lengths before text
|
|
(Mark Martinec @ nsc.ijs.si).
|
|
|
|
19991127
|
|
|
|
Update: the LDAP client code now supports escapes as per
|
|
RFC2254 (John Hensley).
|
|
|
|
19991207
|
|
|
|
Performance: one message with many recipients no longer
|
|
stops other mail from being delivered. The queue manager
|
|
now frees in-memory recipients as soon as a message is
|
|
delivered to one destination, rather than waiting until
|
|
all in-memory destinations of that message have been tried.
|
|
Patch by Patrik Rak @ raxoft.cz. Files: qmgr/qmgr_entry.c,
|
|
qmgr/qmgr_message.c.
|
|
|
|
Performance: when delivering mail to a huge list of
|
|
recipients, the queue manager now reads more recipients
|
|
from the queue file before delivery concurrency drops too
|
|
low. Files: qmgr/qmgr_entry.c, qmgr/qmgr_message.c.
|
|
|
|
19991208
|
|
|
|
Updated LDAP client code by John Hensley with escape
|
|
sequences as per RFC 2254. File: util/dict_ldap.c.
|
|
|
|
Updated MYSQL client code by Scott Cotton. File: dict_mysql.c.
|
|
|
|
Feature: added -N/-n options to include/exclude terminating
|
|
nulls in keys and values in postmap/postalias DB or DBM
|
|
files. Normally, Postfix uses whatever is appropriate for
|
|
the host system. A non-default setting can be necessary
|
|
for inter-operability with third-party software.
|
|
|
|
Bugfix: the local delivery agent would deliver to the user
|
|
instead of the .forward file when the .forward file was
|
|
already visited via some non-recursive path. Patch by Patrik
|
|
Rak @ raxoft.cz. Files: global/been_here.c, local/dotforward.c.
|
|
|
|
Robustness: attempt to deliver all addresses in the expansion
|
|
of an alias or .forward file, even when some addresses must
|
|
be deferred. File: local/token.c.
|
|
|
|
19991211
|
|
|
|
Performance: qmgr_fudge_factor controls what percentage of
|
|
delivery resources Postfix will devote to one message.
|
|
With 100%, delivery of one message does not begin before
|
|
delivery of the previous message is completed. This is good
|
|
for list performance, bad for one-to-one mail. With 10%,
|
|
response time for one-to-one mail improves much, but list
|
|
performance suffers. In the worst case, people near the
|
|
start of a mailing list get a burst of postings today,
|
|
while people near the end of the list get that same burst
|
|
of postings a whole day later. Files: qmgr/qmgr_message.c,
|
|
qmgr/qmgr_entry.c.
|
|
|
|
Bugfix: address rewriting would panic on a lone \ at the
|
|
end of a line where an address was expected. Jason Hoos @
|
|
thwack.net. File: global/rewrite_clnt.c.
|
|
|
|
19991215
|
|
|
|
Bugfix: the strict RFC821 envelope address check should
|
|
not be applied to VRFY commands. File: smtpd/smtpd.c.
|
|
|
|
Cleanup: permit_recipient_maps is gone, because that could
|
|
only be used inside UCE restrictions.
|
|
|
|
19991216
|
|
|
|
Feature: allow an empty inet_interfaces parameter, just
|
|
like an empty mydestination parameter. It's needed for true
|
|
null clients and for firewalls that deliver no local mail.
|
|
|
|
Feature: "disable_vrfy_command = yes" disables some forms
|
|
of address harvesting used by spammers.
|
|
|
|
Workaround: added the alias map parameter definition to
|
|
the smtpd code. This is a symptom of a general problem
|
|
with parameters that have non-empty default values: unless
|
|
a program explicitly defines such a parameter, the parameter
|
|
defaults to the empty string when used in other parameters.
|
|
There's also a problem with evaluation order.
|
|
|
|
Feature: the SMTP server rejects mail for unknown users in
|
|
virtual domains that are defined by Postfix virtual domain
|
|
files. File: smtpd/smtpd_check.c.
|
|
|
|
Feature: reject mail for unknown local users at the SMTP
|
|
port. The local_recipient_maps configuration parameter
|
|
specifies maps with all addresses that are local with
|
|
respect to $mydestination or $inet_interfaces. Example:
|
|
"local_recipient_maps = $alias_maps unix:passwd.byname".
|
|
This feature is disabled by default. You may have to copy
|
|
the passwd file into the chroot jail. File: smtpd/smtpd_check.c.
|
|
|
|
Feature: the sendmail -f option now understands '<user>'
|
|
and even understands address forms with RFC 822-style
|
|
comments.
|
|
|
|
19991217
|
|
|
|
Cleanup: no more UCE checks for VRFY commands. It still
|
|
reports unknown local/virtual users. File: smtpd/smtpd_check.c.
|
|
|
|
Robustness: upon Postfix startup, report discrepancies
|
|
between system files inside and outside the chroot jail.
|
|
Files: conf/postfix-script-nosgid, conf/postfix-script-sgid.
|
|
|
|
19991218
|
|
|
|
Cleanup: INSTALL.sh produces relative symlinks, which is
|
|
necessary when install_root is not /.
|
|
|
|
19991219
|
|
|
|
Documentation: completely reorganized the FAQ and added
|
|
many new entries. Rewrote the UCE html documentation.
|
|
|
|
Cleanup: INSTALL.sh uses a configurable directory for
|
|
scratch files, so that it can install from a file system
|
|
that is not writable by the super-user.
|
|
|
|
Cleanup: INSTALL.sh gives helpful hints when the "mv"
|
|
command is unable to move symlinks across file system
|
|
boundaries.
|
|
|
|
19991220
|
|
|
|
Cleanup: it is no longer necessary to list $virtual_maps
|
|
as part of the relay_domains definition. The SMTP server
|
|
now by default accepts mail for destinations that match
|
|
$inet_interfaces, $mydestination or $virtual_maps, whether
|
|
or not these are specified in relay_domains. We still need
|
|
the ugly "virtual.domain whatever" hack in the virtual
|
|
maps. Files: smtpd/smtpd_check.c and lots of documentation
|
|
and sample config files.
|
|
|
|
19991221
|
|
|
|
Removed cyrus -q flag (ignore quotas) from the sample
|
|
master.cf file.
|
|
|
|
19991223
|
|
|
|
Bugfix: smtpd should not check for unknown users when
|
|
running in stand-alone (sendmail -bs) mode. Problem
|
|
experienced by Chuck Mead. File: smtpd/smtpd.c.
|
|
|
|
Retraction: the "local_transports" configuration parameter
|
|
is gone. Adjusted code and documentation accordingly.
|
|
Instead, use just one "local_transport" parameter with the
|
|
name of the default local transport. Files: smtpd/smtpd_check.c,
|
|
qmgr/qmgr_message.c, trivial-rewrite/ resolve.c, local/resolve.c.
|
|
|
|
Feature: Postfix SMTPD now insists that the smtpd recipient
|
|
restrictions contain at least one restriction that by
|
|
default rejects mail. This should make it much more difficult
|
|
to change Postfix into an open relay. File: smtpd/smtpd_check.c.
|
|
|
|
Retraction: null-length inet_interfaces is too confusing.
|
|
|
|
19991224
|
|
|
|
Bugfix: the relative symlink code in INSTALL.sh computed
|
|
the ../ prefix from the wrong pathname.
|
|
|
|
1999122[5-7]
|
|
|
|
Feature: "allow_untrusted_routing = no" (default) prevents
|
|
forwarding of source-routed mail from untrusted clients to
|
|
destinations that are blessed by the relay_domains parameter
|
|
(example: user@domain2@domain1 etc.). This plugs a mail
|
|
relay loophole where a backup MX host forwards junk mail
|
|
to a primary MX host which forwards the junk to the Internet.
|
|
Files: global/quote_822_local.c, smtp/quote_821_local.c,
|
|
trivial-rewrite/rewrite.c, trivial-rewrite/resolve.c,
|
|
smtp/smtpd_check.c.
|
|
|
|
In order to make this possible, the Postfix resolver data
|
|
structure and protocol has changed, so that all resolver
|
|
clients need to be re-compiled.
|
|
|
|
Side effect from the above change: from now on, an address
|
|
with @ in the recipient localpart no longer bounces with
|
|
"user unknown" but instead is rejected with "relay access
|
|
denied" or "source-routed relay access denied".
|
|
|
|
19991227
|
|
|
|
Workaround: the BSD/OS "mkdir -p" and "cmp -s" commands
|
|
misbehave on boundary cases: directory exists or file does
|
|
not exist. Those who re-invent...
|
|
|
|
19991229
|
|
|
|
Added the no source routing info requirement to addresses
|
|
accepted by the permit_mx_backup UCE restriction.
|
|
|
|
19991230
|
|
|
|
Added a spawn daemon (not compiled and installed by default)
|
|
to enable LMTP delivery over UNIX-domain sockets. The goal
|
|
is to simplify the experimental LMTP delivery agent by
|
|
ripping out the privileged code that forks the LMTP server.
|
|
|
|
20000102
|
|
|
|
Clarified documentation after early feedback on the 19991231
|
|
release by Drew Derbyshire, Ollivier Robert, Khetan Gajjar.
|
|
|
|
Sanity check: a common error is to list Postfix virtual
|
|
domains in the mydestination parameter. This causes the
|
|
new optional local_recipient_maps feature to reject mail
|
|
for virtual users. The SMTP server now explicitly tests
|
|
for this common error and logs a warning instead of refusing
|
|
the mail. File: smtpd/smtpd_check.c.
|
|
|
|
20000104
|
|
|
|
Bugfix: a case sensitivity bug had slipped through in the
|
|
anti-relaying code, causing mail for USER@VIRTUAL.DOMAIN
|
|
to be rejected with "relay access denied". This was found
|
|
by Jim Maenpaa @ jmm.com.
|
|
|
|
Questionable feature: set "smtp_skip_5xx_greeting = yes"
|
|
to make Postfix more sendmail compatible, even though this
|
|
is wrong, IMNSHO. File: smtp/smtp_connect.c.
|
|
|
|
Portability: Ultrix patch from Simon Burge @ thistledown.com.au.
|
|
|
|
Portability: Siemens Pyramid (dcosx) patch by Thomas D.
|
|
Knox @ vushta.com.
|
|
|
|
Performance: FreeBSD has bidirectional pipes that are faster
|
|
than socketpairs. Anticipating on more platform-specific
|
|
optimizations, all duplex pipe plumbing is now isolated in
|
|
a duplex_pipe.c module that provides a system-independent
|
|
interface.
|
|
|
|
20000105
|
|
|
|
Cleanup: the INSTALL.sh script now updates the sample files
|
|
in /etc/postfix even when main.cf exists.
|
|
|
|
20000106
|
|
|
|
Bugfix: the SMTP server should consult the relocated map
|
|
for virtual destinations (Denis Shaposhnikov). Files:
|
|
smtpd/smtpd.c smtpd/smtpd_check.c.
|
|
|
|
20000108
|
|
|
|
Workaround: rename() over NFS can fail with ENOENT even
|
|
when the operation succeeds (Graham Orndorff @ WebTV). This
|
|
is not news. Any non-idempotent operation can fail over
|
|
NFS when the NFS server's acknowledgment is lost and the
|
|
NFS client code retries the operation (other examples are:
|
|
create, symlink, link, unlink, mkdir, rmdir). Postfix has
|
|
workarounds for the cases where this is most likely to
|
|
cause trouble. Files: util/sane_{rename,link}.[hc]. If
|
|
you want reliable mail system, do not use NFS.
|
|
|
|
20000115
|
|
|
|
Workaround: better detection of bad hardware. Added SIGBUS
|
|
to the list of signals that the master will log before
|
|
exiting.
|
|
|
|
20000122
|
|
|
|
Portability: preliminary SCO5 port Christopher Wong @
|
|
csports.com. This still needs to a workaround for "find"
|
|
not supporting "-type s" (actually, UNIX-domain sockets
|
|
have no unique representation in the file system and show
|
|
up as FIFOs).
|
|
|
|
20000115-22
|
|
|
|
Bugfix: in case of a too long message header, don't extract
|
|
recipients from message headers. With the previous behavior,
|
|
Bcc information could be left in the message body, as one
|
|
person found out the hard way. Files: cleanup/cleanup.c,
|
|
cleanup/cleanup_extracted.c, global/cleanup_user.h.
|
|
|
|
20000124
|
|
|
|
Whatever: RFC 1869 amends RFC 821 and specifies that code
|
|
555 is to be used when a MAIL FROM or RCPT TO parameter is
|
|
not implemented or not recognized. Russ Allbery @stanford.edu.
|
|
This reply code is added to the list of reply codes that
|
|
cause the Postfix SMTP client to mail a transcript to the
|
|
postmaster. File: smtp/smtp_trouble.c.
|
|
|
|
20000126
|
|
|
|
Emergency feature: qmgr_site_hog_factor (default: 90 percent)
|
|
limits the amount of resources that Postfix devotes to a
|
|
single destination. With less than 100, Postfix defers the
|
|
excess mail so that one site with a large backlog does not
|
|
block other deliveries. Files: qmgr/qmgr.c, qmgr/qmgr_message.c.
|
|
|
|
20000128
|
|
|
|
Cleanup: the queue manager no longer replaces the nexthop
|
|
field by the recipient localpart when a destination matches
|
|
$mydestination/$inet_interfaces. The price is the introduction
|
|
of a new parameter local_destination_recipient_limit which
|
|
defaults to 1 in order to maintain backwards compatibility.
|
|
Files: qmgr/qmgr.c, qmgr/qmgr_message.c.
|
|
|
|
20000129
|
|
|
|
Bugfix: extracted recipients were misfiled when a message
|
|
was moved back to the maildrop queue. But they still worked
|
|
due to a coincidence.
|
|
|
|
Feature: bounce_recip() bounces a recipient immediately
|
|
without accessing a bounce logfile. This is necessary for
|
|
VERP bounces, for bounces by delivery agents that change
|
|
the sender address, and for bounces that for some reason
|
|
must not use temporary logfiles. Files: global/bounce.c,
|
|
bounce/bounce_recip_service.c.
|
|
|
|
20000130
|
|
|
|
Bugfix: the too long header fix of 20000115-22 lost mail
|
|
with too long headers that didn't need to extract recipients
|
|
from message headers.
|
|
|
|
Bugfix: the too long header fix of 20000115-22 lost mail
|
|
without (blank line + message body).
|
|
|
|
Code rewrite: reorganized the cleanup daemon source code
|
|
so that the cleanup service can be called one record at a
|
|
time (see cleanup/cleanup_api.c); also got rid of the global
|
|
state variables and fixed a couple bugs that were introduced
|
|
with 20000115-22.
|
|
|
|
20000204
|
|
|
|
Feature: in daemon mode, the MAIL FROM size check can be
|
|
postponed until RCPT TO so that Postfix can log sender and
|
|
recipient. Simon J Mudd. Files: smtpd/smtpd.c
|
|
|
|
Robustness: limit the number of recipient addresses that
|
|
can be extracted from message headers. Parameter:
|
|
extract_recipient_limit (default: 10240). Files:
|
|
cleanup/cleanup_message.c, cleanup/cleanup_extracted.c.
|
|
|
|
Cleanup: the message header reject logging now includes
|
|
sender and recipient address (if possible), so that the
|
|
logging looks more like the other reject logging. File:
|
|
cleanup/cleanup_message.c.
|
|
|
|
Documentation: added sections on regular expression tables
|
|
to the access, canonical, virtual, transport and relocated
|
|
man pages, and write new man pages that are specific to
|
|
regular expressions: pcre_table.5 and regexp_table.5.
|
|
|
|
20000214
|
|
|
|
Bugfix: postconf reported some parameters more than once
|
|
because the parameter extracting script didn't recognize
|
|
lines that differ in whitespace only. File: postconf/extract.awk.
|
|
Reported by Kenn Martin.
|
|
|
|
20000221
|
|
|
|
Logging: the SMTP client now logs log host+port when it is
|
|
unable to connect to a non-MX host, just like it logs
|
|
host+port when unable to connect to an MX host.
|
|
|
|
20000226
|
|
|
|
Bugfix: the SMTP server's "User unknown" test didn't notice
|
|
LDAP etc. dictionary access errors. The code now reports
|
|
a 450 status (try again instead of bounce) if the reply is
|
|
not definitive. File: smtp/smtpd_check.c.
|
|
|
|
Robustness: the smtp-source program could stall when making
|
|
hundreds of parallel connections to a Postfix system with
|
|
only one SMTP server process. The fix is to use non-blocking
|
|
connect() calls, very carefully. File: smtpstone/smtp-source.c.
|
|
|
|
20000303
|
|
|
|
Feature: with smtp_always_send_ehlo the SMTP client will
|
|
send EHLO regardless of the content of the SMTP server's
|
|
greeting. File: smtp/smtp_proto.c.
|
|
|
|
20000304
|
|
|
|
Feature: DICT_FLAG_SYNC_UPDATE flag for synchronous dictionary
|
|
updates, if supported by the underlying mechanism. Files:
|
|
util/dict.h, util/dict_open.c, util/dict_db.c.
|
|
|
|
20000307
|
|
|
|
Cleanup: the manual pages in Postfix configuration files
|
|
no longer contain troff formatting codes. The text is now
|
|
generated from prototype files in a new "proto" subdirectory.
|
|
Requested by Matthias Andree @ stud.uni-dortmund.de.
|
|
|
|
20000308
|
|
|
|
Bugfix: the unused db and dbm "delete" routines would
|
|
clobber the per-dictionary flags when called before reading
|
|
or writing the table. Files: util/dict_dbm.c, util/dict_db.c.
|
|
Lutz Jaenicke @ aet.TU-Cottbus.DE.
|
|
|
|
Bugfix: the SMTP server would produce a cryptic message
|
|
when a queue file write error happened before it had written
|
|
any recipients. Keith Stevenson. File: smtpd/smtpd.c.
|
|
|
|
Robustness: the db and dbm "delete" routines didn't adjust
|
|
to dictionaries with/without one trailing null in lookup
|
|
keys and values. Did a complete rewrite of the routines.
|
|
Files: util/dict_db.c, util/dict_dbm.c.
|
|
|
|
Feature: specify "-d key" to postalias or postmap in order
|
|
to remove one key. This still needs to be generalized to
|
|
multi-key removal (read stdin?). Files: postmap/postmap.c,
|
|
postalias/postalias.c.
|
|
|
|
Test: added test targets for the dictionary delete operations.
|
|
Files: util/Makefile.in, util/dict_test.{c,in,ref}.
|
|
|
|
Feature: added data offset and recipient count fields to
|
|
the first queue file record output from the cleanup daemon.
|
|
The recipient counts provides an initial estimate for a
|
|
more advanced queue manager scheduling algorithm. Files:
|
|
cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c.
|
|
|
|
20000311
|
|
|
|
Portability: HP-UX awk can't handle bare { in regexps
|
|
(Lamont Jones. HP). File: postconf/extract.awk.
|
|
|
|
Compatibility: sendmail now recognizes '.' as end of input.
|
|
File: sendmail/sendmail.c.
|
|
|
|
20000313
|
|
|
|
Compatibility: dtcm (CDE desktop calendar manager) leaks
|
|
a file descriptor into its child process, and requires that
|
|
sendmail closes the descriptor, otherwise mail notification
|
|
will hang. These GUI programmers never figured out that
|
|
the child process must close the writing end of a pipe.
|
|
File: sendmail/sendmail.c.
|
|
|
|
20000314
|
|
|
|
Feature: SASL authentication in the SMTP server and client.
|
|
Based on code contributed by Till Franke, SuSE. Specify:
|
|
"smtpd_sasl_auth_enable = yes" and "smtp_sasl_auth_enable
|
|
= yes". The "permit_sasl_authenticated" UCE restriction
|
|
gives special treatment to authenticated clients.
|
|
|
|
20000315
|
|
|
|
Workaround: added -blibpath option for AIX 4.x, to close
|
|
hole in case postdrop needs to be set-gid.
|
|
|
|
20000320
|
|
|
|
Portability: FreeBSD 5.x added to the list of supported
|
|
systems (Mark Huizer).
|
|
|
|
20000323
|
|
|
|
Portability: INSTALL.sh looks if sendmail is in /usr/lib
|
|
rather than in /usr/sbin.
|
|
|
|
20000326
|
|
|
|
Bugfix: settings in one mysql configuration file would act
|
|
as the implicit defaults for the next one, which could be
|
|
confusing. Patch by Scott Cotton. File: util/dict_mysql.c.
|
|
|
|
Robustness: limit the number of "junk" commands that can
|
|
be issued in an SMTP session (ex.: NOOP, VRFY, ETRN, RSET).
|
|
Problem report by Michael Ju. Tokarev @ tls.msk.ru. Files:
|
|
global/mail_params.h, smtpd/smtpd.c.
|
|
|
|
20000413
|
|
|
|
Portability: more MacOS X patches by Gerben Wierda.
|
|
|
|
Bugfix: RFC 822 requires the presence of at least one
|
|
destination message header. The cleanup daemon now generates
|
|
a generic "To: undisclosed-recipients:;" message header
|
|
when no destination header is present. The header content
|
|
is specified with the undisclosed_recipients_header parameter.
|
|
Problem pointed out by Geoff Gibbs, UK-Human Genome Mapping
|
|
Project-Resource Centre.
|
|
|
|
20000416
|
|
|
|
Workaround: allow <(comment)> as SMTP MAIL FROM address.
|
|
|
|
20000417
|
|
|
|
The SASL authentication in the SMTP server and client works,
|
|
but only on Linux and Solaris, neither of which I wish to
|
|
run on my laptop.
|
|
|
|
20000418
|
|
|
|
Added LMTP support to the smtp-source and smtp-sink utilities
|
|
so that I don't have to install Cyrus IMAP just to test
|
|
LMTP.
|
|
|
|
20000419
|
|
|
|
Bugfix: removed the () from the tokenized representation
|
|
of RFC 822 comments, so that comments with \( or \) can be
|
|
unparsed correctly. Problem reported by Bodo Moeller.
|
|
|
|
20000423
|
|
|
|
Bugfix: mail_copy() could prepend > or . in the middle of
|
|
long lines. Found by code inspection.
|
|
|
|
20000427
|
|
|
|
New code: unescape module that translates C escape sequences
|
|
into their equivalent character values. File: util/unescape.c.
|
|
|
|
Feature: the pipe mailer now has a way to specify the output
|
|
record delimiter (for example, eol=\r\n). This is necessary
|
|
for transports that require CRLF instead of UNIX-style LF.
|
|
|
|
20000502
|
|
|
|
In order to support timeouts more conveniently, VSTREAMs
|
|
now have built into them the concept of timeout. Instead
|
|
of calling read() and write(), the low-level VSTREAM
|
|
interface now by default uses timed_read() and timed_write()
|
|
which receive a timeout parameter; vstream_ctl(stream,
|
|
VSTREAM_CTL_TIMEOUT...) sets the timeout deadline on a
|
|
stream, and vstream_ftimeout(stream) queries a stream for
|
|
timeout errors. This change simplified timeout handling
|
|
considerably. Files: util/vbuf.h, util/vstream.[hc],
|
|
global/smtp_stream.c, global/timed_ipc.c.
|
|
|
|
20000504
|
|
|
|
Added application context to VSTREAMs, which is passed on
|
|
transparently to application-provided read/write routines.
|
|
vstream_ctl(stream, VSTREAM_CTL_CONTEXT...) sets the context.
|
|
Files: util/vstream.[hc].
|
|
|
|
Added vstream_setjmp() and vstream_longjmp() support to
|
|
make exception handling more convenient. Turn on exception
|
|
handling with vstream_ctl(stream, VSTREAM_CTL_EXCEPT...).
|
|
Files: util/vstream.[hc].
|
|
|
|
Cleaned up the smtp_stream module further and got rid of
|
|
the global state that limited the use of this module to
|
|
one stream per process. Files: global/smtp_stream.[hc].
|
|
|
|
20000505
|
|
|
|
Bugfix: the SMTP server now flushes unwritten output before
|
|
tarpit delays, to avoid protocol timeouts in pipelined
|
|
sessions when a client causes lots of errors. Found by
|
|
Lamont Jones, HP. File: smtpd/smtpd_chat.c.
|
|
|
|
Finished the LMTP client, which is based on a modified
|
|
version of the SMTP client by Philippe Prindeville, Mirapoint,
|
|
Inc., later modified by Amos Gouaux, UTDallas, and then
|
|
Wietse ripped it all up again. Currently this talks LMTP
|
|
over TCP only.
|
|
|
|
Feature: override main.cf parameters in master.cf. Specify
|
|
"-o parameter=value" after the program name. This allows
|
|
you to selectively override myhostname etc. See also the
|
|
new smtp_bind_address parameter below.
|
|
|
|
20000506
|
|
|
|
Convenience: the LMTP and SMTP clients now append the local
|
|
domain to unqualified nexthop destinations. This makes it
|
|
more convenient to set up transport maps. Files:
|
|
lmtp/lmtp_addr.c, smtp/smtp_addr.c.
|
|
|
|
Sendmail compatibility: the Postfix SMTP client now skips
|
|
servers that greet the client with a 4xx or 5xx status
|
|
code. To disable, set both smtp_skip_4xx_greeting and
|
|
smtp_skip_5xx_greeting to "no".
|
|
|
|
20000507
|
|
|
|
Portability: NetBSD has migrated to /etc/mail/aliases. We
|
|
can expect to see this happen more often when systems start
|
|
shipping Sendmail 8.10. File: util/sys_defs.h
|
|
|
|
Updated LDAP code by John Hensley, with support for
|
|
dereferencing of LDAP aliases, which have nothing to do
|
|
with Postfix aliases.
|
|
|
|
Feature: "smtp_bind_address=x.x.x.x" specifies the source
|
|
IP address for SMTP client connections. Specify in master.cf
|
|
as "smtp -o smtp_bind_address=x.x.x.x" in order to give
|
|
different delivery agents different source addresses.
|
|
|
|
20000510
|
|
|
|
Cleanup: mailbox_transport did not work with the lmtp
|
|
delivery agent. This dates back to when Postfix used empty
|
|
nexthop information to indicate that a destination was
|
|
local. File: global/deliver_pass.c.
|
|
|
|
Bugfix: configuration parameters for one mysql dictionary
|
|
would become default settings for the next one. File:
|
|
dict_mysql.c. This patch was merged into Postfix a while
|
|
back but apparently that Postfix version was nuked when
|
|
other parts were redesigned. Update by Scott Cotton.
|
|
|
|
Bugfix: some Postfix delivery agents would abort on addresses
|
|
of the form `stuff@.' which could be generated only locally.
|
|
Found by Patrik Rak. File: trivial-rewrite/resolve.c.
|
|
|
|
Third-party Berkeley DB support for HP-UX by Lamont Jones.
|
|
File: makedefs.
|
|
|
|
20000511
|
|
|
|
Bugfix: Postfix would incorrectly reject domain names with
|
|
adjacent - characters. File: util/valid_hostname.c.
|
|
|
|
Bugfix: the 20000505 pipeline tarpit delay flush was wrong
|
|
and caused the client and server to get out of phase. Yuck!
|
|
|
|
20000513
|
|
|
|
Feature: VSTREAMs now have the concept of last fill/flush
|
|
time, which is needed to prevent timeouts with pipelined
|
|
SMTP sessions as detailed in the next item.
|
|
|
|
Bugfix: delayed SMTP command/reply flushing to prevent
|
|
sender delays from accumulating too much and causing timeouts
|
|
with pipelined sessions. For example, client-side delays
|
|
happen when a client does DNS lookups to replace hostname
|
|
aliases in MAIL FROM or RCPT TO commands; server-side delays
|
|
happen when an UCE restriction involves a time-consuming
|
|
DNS lookup, or when a server generates tarpit delays.
|
|
Files: lmtp/lmtp_proto.c, smtp/smtp_proto.c, smtpd/smtpd_chat.c.
|
|
|
|
Portability: define ANAL_CAST for compilation environments
|
|
that reject explicit casts between pointers and integral
|
|
types. File: util/sys_defs.h, master/*server.c. Upon closer
|
|
investigation, this turned out to be the result of someone's
|
|
compiler configuration preferences. Therefore the change
|
|
is likely to go away after a code cleanup.
|
|
|
|
20000514
|
|
|
|
Feature: mysql client support for multi-valued queries
|
|
(select email, email2 from aliastbl where username='$local')
|
|
By Loic Le Loarer @ m4x.org. File: util/dict_mysql.c.
|
|
|
|
Finalized the delayed SMTP command/reply flushing code in
|
|
the SMTP and LMTP clients after lots of testing and review.
|
|
|
|
20000520
|
|
|
|
Robustness: upon receipt of mail, map the mailer-daemon
|
|
sender address back into the magic null string. File:
|
|
cleanup/cleanup_envelope.c.
|
|
|
|
20000524
|
|
|
|
Bugfix: the code for masquerade_exceptions was case sensitive.
|
|
Reported by Eduard Vopicka. File: cleanup/cleanup_masquerade.c.
|
|
|
|
20000526
|
|
|
|
Feature: experimental queue manager by Patrik Rak with a
|
|
fancy pre-emptive scheduling algorithm that improves delivery
|
|
performance of mail with few recipients. This queue manager
|
|
is made available as "nqmgr".
|
|
|
|
20000528
|
|
|
|
Feature: the SMTP client SASL password file can contain
|
|
entries for destination domain names (the address remote
|
|
part) not just mail server hostnames. File: smtp_sasl_glue.c.
|
|
|
|
Feature: smtpd_sasl_local_domain parameter (default:
|
|
$myhostname) to specify the local SASL authentication realm.
|
|
File: smtpd_sasl_glue.c.
|
|
|
|
Feature: specify "body_checks=regexp:/file/name" for a very
|
|
crude one line at a time message body content filter. This
|
|
feature uses the same filtering syntax as the header_checks
|
|
feature. File: cleanup/cleanup_message.c. See also the
|
|
conf/sample-filter.cf file.
|
|
|
|
20000530
|
|
|
|
Feature: full content filtering through external software.
|
|
This uses existing interfaces for sending mail to the
|
|
external content filter and for injecting it back into
|
|
Postfix. Details in FILTER_README. Files: pickup/pickup.c,
|
|
smtpd/smtpd.c, qmgr/qmgr_message.c.
|
|
|
|
20000531
|
|
|
|
More SASL feedback by Liviu Daia, regarding the use of
|
|
authentication realms. File smtpd/smtpd_sasl_glue.c.
|
|
|
|
Added a simple shell-script based content filtering example
|
|
to the FILTER_README file.
|
|
|
|
Content filtering support for nqmgr by Patrik Rak. File:
|
|
nqmgr/qmgr_message.c.
|
|
|
|
Renamed "content inspection" etc. to "content filtering"
|
|
in anticipation of a new hook for content inspection that
|
|
only inspects mail without re-injecting it into Postfix.
|
|
|
|
20000601
|
|
|
|
Feature: limit the size of pipe mailer deliveries with the
|
|
size=nnn command-line attribute. Patch by Andrew McNamara.
|
|
|
|
20000603
|
|
|
|
Bugfix: don't try to do SASL authentication when running
|
|
in stand-alone (sendmail -bs) mode. Fix by Liviu Daia.
|
|
|
|
Bug: the unauthorized pipelining test fails with single
|
|
recipient mail when smtpd_delay_reject = yes.
|
|
|
|
20000617
|
|
|
|
Bugfix: conf/sample-ldap.cf was no longer up to date with
|
|
reality. Patch by Lamont Jones, HP.
|
|
|
|
Bugfix: the maildir delivery routine left temporary files
|
|
lying around after unsuccessful delivery (problem reported
|
|
by Brian Laughton @ Corp.Axxent.Ca).
|
|
|
|
20000621
|
|
|
|
AIX 4.x had POSIX regular expression support all the time
|
|
I was working on Postfix. Better find out late than never.
|
|
|
|
20000623
|
|
|
|
Bugfix: the SMTP server did not reset the so-called junk
|
|
command counter after successful delivery (Mark Hoffman @
|
|
wallst.com). File: smtpd/smtpd.c.
|
|
|
|
20000625
|
|
|
|
Cleanup: remove Content-Length from incoming mail. The
|
|
sender has no authority over the format of mail as stored
|
|
by the receiving system. File: global/header_opts.h.
|
|
|
|
Feature: rewrite Mail-Followup-To: as sender. Files:
|
|
global/header_opts.[hc].
|
|
|
|
Cleanup: rewrite Reply-To, Errors-To, Return-Receipt-To as
|
|
sender, so that address masquerading works as expected.
|
|
Files: global/header_opts.c.
|
|
|
|
Feature: specify "require_home_directory = yes" to prevent
|
|
mail from being delivered to a user whose home directory
|
|
is not mounted. File: local/dotforward.c.
|
|
|
|
Cleanup: the pipe deliver agent no longer appends a blank
|
|
line when the F flag (prepend From_ line) is specified.
|
|
Specify the B flag if you need that blank line. The local
|
|
delivery agent no longer appends a blank line to mail that
|
|
is delivered to external command. Files: pipe/pipe.c,
|
|
global/mail_copy.[hc].
|
|
|
|
20000708
|
|
|
|
Portability: support for NEXT/OPENSTEP requires extra
|
|
include file in util/watchdog.c (Masaki Murase).
|
|
|
|
20000715
|
|
|
|
Added macros to turn on vstream/vstring/etc. format string
|
|
checking by gcc, in addition to the checking that was
|
|
already implemented with printfck. File: util/sys_defs.h,
|
|
the macros for PRINTFLIKE and SCANFLIKE. Problem - unlike
|
|
the printfck tool, gcc finds format argument type mismatches
|
|
only in code that isn't #ifdef-ed out.
|
|
|
|
20000718
|
|
|
|
Robustness: make_dirs() now continues when a missing
|
|
directory is created by another process.
|
|
|
|
20000720
|
|
|
|
Feature: the queue manager now logs the number of recipients
|
|
when opening a queue file (a zero recipient count is logged
|
|
with older queue files). File: global/opened.c.
|
|
|
|
20000726
|
|
|
|
Robustness: added watchdog_pat() routine to keep the watchdog
|
|
quiet if a client stays connected for a lot of time. Files:
|
|
util/watchdog.[hc], smtpd/smtpd.c.
|
|
|
|
20000729
|
|
|
|
Robustness: if relayhost is specified but the host does
|
|
not exist, defer mail instead of bouncing it (which would
|
|
lose the mail if the bounce would have to be delivered to
|
|
that same non-existent relayhost). Problem reported by
|
|
Chris Cooper @ maths.ox.ac.uk. File: smtp/smtp_connect.c.
|
|
|
|
20000821
|
|
|
|
Feature: added -r (replace key+value) option to postalias
|
|
and postmap.
|
|
|
|
Cleanup: smtpd now replies with 555 when the client sends
|
|
unrecognized RCPT TO parameters, as required by RFC 1869
|
|
(problem report by Robert Norris @ its.monash.edu.au).
|
|
File: smtpd/smtpd.c.
|
|
|
|
20000822
|
|
|
|
Logging: the SMTP server's SASL code logs the authentication
|
|
method along with an authentication failure. Suggested by
|
|
Ronald F. Guilmette @ monkeys.com.
|
|
|
|
Workaround: some systems have file size resource limits
|
|
that cannot be represented with the off_t type that is used
|
|
by standard functions such as lseek(2). Problem reported
|
|
by Blaz Zupan @ amis.net.
|
|
|
|
20000823
|
|
|
|
Feature: all this discussion about when to reject mail and
|
|
when not made me decide to implement a TCP-based map type
|
|
so that it becomes relatively simple to implement dynamic
|
|
access controls, for example, hold off mail from an unknown
|
|
client or sender until we have completed some investigation,
|
|
after which we will either reject or accept.
|
|
|
|
However, this code is turned off until it is finished.
|
|
|
|
20000905
|
|
|
|
Robustness: the dns client now rejects malformed domain
|
|
names rather than depending on the DNS to report that the
|
|
name does not exist. Linux returns a rather misleading
|
|
server failure code as found out by Patrik Rak. File:
|
|
dns/dns_lookup.c.
|
|
|
|
20000911
|
|
|
|
Feature: added IGNORE keyword to header_checks and body_checks
|
|
to pretend that certain data does not exist. File:
|
|
cleanup/cleanup_message.c.
|
|
|
|
20000911
|
|
|
|
Bugfix: the SASL code did not allow MAIL FROM... AUTH=sender
|
|
without prior authentication. The RFC allows this, although
|
|
one wonders what the reasoning behind this is. File:
|
|
smtpd/smtpd_sasl_proto.c.
|
|
|
|
20000913
|
|
|
|
Bugfix: the rmail script did not handle remote UUCP systems
|
|
that send a from_ line with unqualified envelope sender.
|
|
Reported by Luciano Mannucci.
|
|
|
|
Compatibility: don't insert Sender: header lines. Sendmail
|
|
has not done so for at least 10 years, if it ever did.
|
|
Problem reported by Brad Knowles. File: cleanup/cleanup_message.c.
|
|
|
|
20000916
|
|
|
|
Bugfix: when propagating an address extension in a virtual
|
|
or canonical mapping, cleanup accesses memory that is no
|
|
longer allocated. This can happen when the result address
|
|
length is more than 100 characters. Problem reported by
|
|
Adi Prasaja @ satunet.com. File: global/mail_addr_crunch.c.
|
|
|
|
Bugfix: fixed a misleading error message when the cleanup
|
|
server reaches the queue file size limit. Fix by Robby
|
|
Griffin @ MIT.EDU. File: cleanup/cleanup_extracted.c.
|
|
|
|
20000917
|
|
|
|
Bugfix: postalias -i would complain about duplicate entries
|
|
for the Sendmail-compatible @ entry and for the NIS-compatible
|
|
YP_LAST_MODIFIED and YP_MASTER_NAME entries.
|
|
|
|
20000918
|
|
|
|
Gross hack: prevent looping on a bad recipient by always
|
|
forwarding recipients in :include: files to a new mail
|
|
delivery request, even when owner-listname is not set.
|
|
File: local/recipient.c.
|
|
|
|
20000919
|
|
|
|
Convenience: INSTALL.sh now imports default settings from
|
|
the process environment, in order to make scripting easier.
|
|
|
|
Robustness: INSTALL.sh now systematically skips over CVS,
|
|
RCS and SCCS cruft.
|
|
|
|
Portability: another fix for NEXTSTEP (Masaki MURASE).
|
|
File: util/spawn_command.h.
|
|
|
|
20000920
|
|
|
|
Cleanup: in a transport table entry, do not ignore port
|
|
numbers specified as [host]:port. In fact, this is now
|
|
becoming the preferred form, in order to avoid parsing
|
|
problems with IPV6 addresses. Postfix supports both forms,
|
|
but future versions will print a warning for the old form.
|
|
Problem reported by Claus Fischer @ werhats.at
|
|
|
|
Bugfix: missing initialization for state->sasl_method can
|
|
cause permit_sasl_authenticated to always succeed. Report
|
|
and fix by Lutz Jaenicke @ aet.TU-Cottbus.DE.
|
|
|
|
FAQ: added notes about how to delete, copy or restore queue
|
|
files in a safe manner.
|
|
|
|
20000921
|
|
|
|
File reorganization. No code change except Makefiles. All
|
|
sources are pushed down by one directory level to keep file
|
|
listings usable. Released as 20000922, so that I have a
|
|
reference to run "diff -cr against.
|
|
|
|
Bugfix: the spawn service was installed without man pages.
|
|
|
|
Portability: MacOSX hints and tips by Joe Block, University
|
|
of Central Florida School of Optics/CREOL
|
|
|
|
Portability: The MacOSX gcc compiler does not understand
|
|
the new printf_like/scanf_like attributes. File: util/sys_defs.h.
|
|
|
|
20000922
|
|
|
|
nqmgr update from Patrik Rak for the changed queue manager
|
|
to delivery agent protocol.
|
|
|
|
Lame feature: syslog_facility parameter to control where
|
|
syslogd sends Postfix logging (default: syslog_facility =
|
|
mail). However, errors during command-line parsing are
|
|
still logged with the default syslog facility, as are errors
|
|
while processing the main.cf file (surprise). Based on
|
|
code by Andrew McNamara.
|
|
|
|
20000923
|
|
|
|
Cleanup: new bounce logfile API so that Postfix can change
|
|
to an extensible bounce logfile format with per-recipient
|
|
sender addresses (needed for VERP and for reporting local
|
|
list delivery problems to the list owner) and other
|
|
attributes. File: global/bounce_log.[hc].
|
|
|
|
Cleanup: replaced the ad-hoc logfile parsing code in showq
|
|
by something that uses the generic bounce logfile API.
|
|
|
|
20000924
|
|
|
|
Feature: Postfix bounced mail and delayed mail notifications
|
|
now have the standard RFC 1894 form (DSN). The bounce
|
|
service now uses the generic bounce logfile API. File:
|
|
bounce/bounce_notify_service.c, bounce/bounce_notify_util.c.
|
|
|
|
Cleanup: deleted the per-recipient bounce protocol. Future
|
|
bounce logfiles will support per-recipient bounce addresses.
|
|
Files: global/bounce.c, bounce/bounce_recip_service.
|
|
|
|
20000925
|
|
|
|
Workaround: sendmail allows MAIL FROM and RCPT TO envelope
|
|
addresses like <the dude <dude@site>> so we will never get
|
|
rid of them. To disallow, specify "strict_rfc821_envelopes
|
|
= yes". File: smtpd/smtpd.c.
|
|
|
|
20000926-20001003
|
|
|
|
Feature: a "flush" server that keeps per-destination records
|
|
of deferred mail. It is the basis of a faster ETRN and
|
|
"sendmail -qRsite" implementation. This code was rewritten
|
|
half a dozen times.
|
|
|
|
20000928
|
|
|
|
Bugfix: the stricter dns_lookup() argument checks revealed
|
|
that Postfix was doing DNS lookups for domain literals
|
|
([ip.address]) when expanding aliases in MAIL FROM and RCPT
|
|
TO address parameters. Reported by Jim Littlefield. File:
|
|
smtp/smtp_unalias.c.
|
|
|
|
Documentation: added text on the biff=yes/no parameter to
|
|
conf/sample-local.cf (text provided by Paul Wagland,
|
|
relational-consultancy.com.
|
|
|
|
Robustness? Log errors from SASL library code as warnings
|
|
not as fatal errors. Files: smtp*/*glue.c.
|
|
|
|
20001001
|
|
|
|
Feature: in master.cf, specify ? after wakeup time to avoid
|
|
waking up services that aren't being used.
|
|
|
|
20001003
|
|
|
|
Feature: the fast flush refresh and purge time interval
|
|
parameters can now be specified in user-specified units by
|
|
providing an appropriate suffix: s (seconds), m (minutes),
|
|
h (hours), d (days), w (weeks). unit. This was needed so
|
|
that I could test the flush server code in a reasonable
|
|
way (its timeouts are normally specified in days or hours,
|
|
and I don't have that much time for testing). Other Postfix
|
|
time interval parameters will be migrated as time permits.
|
|
Files: conf/sample-flush.cf, global/mail_conf_time.c,
|
|
postconf/postconf.c.
|
|
|
|
Unfeature: qmgr_hog_factor is now disabled by default. It
|
|
was just too confusing. If you don't know what this means,
|
|
do not worry.
|
|
|
|
20001005
|
|
|
|
Cleanup: after "postfix reload" do not penalize mail that
|
|
was in the active queue, but make it ready for immediate
|
|
delivery so that ETRN etc. works as intended. Files:
|
|
*qmgr/qmgr.c, *qmgr/qmgr_active.c.
|
|
|
|
Portability: Redhat 7 library interfaces have changed
|
|
incompatibly, which breaks existing software. File makedefs.
|
|
|
|
Consistency: the fallback_relay parameter did not understand
|
|
the [] or host:port syntax, and there was no way to suppress
|
|
MX record lookups. Files: smtp/smtp_addr.c, smtp/smtp_connect.c.
|
|
|
|
Convenience: you can now specify multiple SMTP destinations
|
|
in the relayhost or fallback_relay configuration parameters.
|
|
The specified destinations will be tried in the specified
|
|
order. File: smtp/smtp_connect.c.
|
|
|
|
Many typographical corrections by Matthias Andree.
|
|
|
|
20001024
|
|
|
|
Documentation: the canonical, virtual etc. manual pages
|
|
did not document the effect of leading whitespace.
|
|
|
|
20001025
|
|
|
|
Bugfix: virtual map expansion stopped too early with
|
|
self-referential aliases. Reported by Michael Douglass @
|
|
datafoundry.net. File: cleanup/cleanup_map1n.c.
|
|
|
|
20001026
|
|
|
|
Horror: postmap and postalias (newaliases) silently lose
|
|
the file lock while building a lookup table with Berkeley
|
|
DB 2.x and later on Solaris, HP-UX, IRIX, and UNIXWARE.
|
|
The result is that table lookups fail while the table is
|
|
being built, so that mail is lost. In order to avoid this
|
|
misbehavior one has to use an undocumented feature that is
|
|
NOT available with the DB1.85 compatibility interface.
|
|
Therefore, Postfix now supports three Berkeley DB programming
|
|
interfaces of increasing complexity. File: util/dict_db.c.
|
|
|
|
Bugfix: some character manipulations were not portable for
|
|
signed/unsigned characters. Files: global/quote_821_local.c,
|
|
global/quote_822_local.c.
|
|
|
|
Workaround: apparently, some software sends SMTP mail that
|
|
begins with "From sender time-stamp". Sendmail silently
|
|
ignores such RFC violating garbage, and therefore Postfix
|
|
needs to jump another hoop. File: smtpd/smtpd.c.
|
|
|
|
20001028
|
|
|
|
Bugfix: the flush server tried to access config files after
|
|
going to the chroot jail. Found by Lutz Jaenicke, TU-Cottbus.DE.
|
|
File: flush/flush.c.
|
|
|
|
Update: revised LDAP module from primary maintainer John
|
|
Hensley, with contributions from many other people. Files:
|
|
util/dict_ldap.c, LDAP_README.
|
|
|
|
Update: LINUX2 chroot setup script by Matthias Andree,
|
|
uni-dortmund.de.
|
|
|
|
Feature: specify unix:/path/name for LMTP connections over
|
|
UNIX-domain sockets, and specify inet:host or inet:host:port
|
|
for IPV4. If no unix: or inet: is specified, IPV4 is assumed.
|
|
File: lmtp/lmtp_connect.c.
|
|
|
|
Feature: added UNIX-domain support to the smtpstone test
|
|
programs in order to test the LMTP client UNIX-domain
|
|
support.
|
|
|
|
20001030
|
|
|
|
Bugfix: further testing in preparation for 19991231-pl10
|
|
revealed that the DB map code was now broken for every
|
|
platform.
|
|
|
|
20001031
|
|
|
|
Performance: the slow start (gradually increase number of
|
|
parallel connections to the same site) was too gentle and
|
|
Postfix would back off too quickly. Files: qmgr/qmgr_queue.c
|
|
and nqmgr/qmgr_queue.c.
|
|
|
|
20001101
|
|
|
|
FAQ update by Ralph Hildebrandt.
|
|
|
|
20001104
|
|
|
|
Portability: RedHat Linux has changed incompatibly, again.
|
|
Fixed with the help of Matthias Andree. File: makedefs.
|
|
|
|
20001109
|
|
|
|
Cleanup: changed prototype of internal function that did
|
|
not return a useful result. File: src/util/vstream_popen.c.
|
|
|
|
20001110
|
|
|
|
Workaround: the Debian post install script passes an open
|
|
file descriptor into the master server and waits forever.
|
|
Reported by Lamont Jones. File: master/master.c.
|
|
|
|
20001114
|
|
|
|
Compatibility: added sendmail -G (gateway submission) option
|
|
for compatibility with the sendmail rmail command. Requested
|
|
by David Gilbert, Velocet Communications.
|
|
|
|
20001116
|
|
|
|
Documentation: added MAILER-DAEMON to the list of sample
|
|
masquerade_exceptions settings in conf/sample-rewrite.cf.
|
|
Suggested by Karl O. Pinc, pop.artic.edu.
|
|
|
|
Performance: the slow start (gradually increase number of
|
|
parallel connections to the same site) was too gentle and
|
|
Postfix would back off too quickly. Files: qmgr/qmgr_queue.c
|
|
and nqmgr/qmgr_queue.c. Yup, changed the same code, again.
|
|
We now allow for a margin above the actual concurrency,
|
|
with the size of the initial destination concurrency.
|
|
Final solution by Patrik Rak.
|
|
|
|
Bugfix: the recipient home directory test broke mailbox_transport
|
|
support for non-UNIX recipients. File: local/recipient.c.
|
|
|
|
20001117
|
|
|
|
Robustness: additional integrity tests for the nqmgr by
|
|
Patrik Rak. File: nqmgr/qmgr_message.c.
|
|
|
|
20001118
|
|
|
|
Bugfix: the new LDAP client code did not work properly if
|
|
the new ldap_domain parameter was not specified. LaMont
|
|
Jones, HP. File: util/dict_ldap.c.
|
|
|
|
Feature: the soft_bounce safety net is extended to the SMTP
|
|
server. With "soft_bounce = yes", The SMTP server changes
|
|
all 5xx (reject) replies into 4xx (try again) replies.
|
|
|
|
Documentation: the virtual(5) man page now documents both
|
|
Postfix-style virtual domains and Sendmail-style virtual
|
|
domains, including their interaction with local usernames,
|
|
aliases and mailing lists. Hopefully, this ends some of
|
|
the confusion surrounding virtual domain support. Updated
|
|
several FAQ entries concerning virtual domain support.
|
|
|
|
Documentation: added FAQ entry for the biff service.
|
|
|
|
20001119
|
|
|
|
Bugfix: per-destination queue names were case sensitive so
|
|
that the same site could have multiple queues. Reported
|
|
by Patrik Rak. Files: *qmgr/qmgr_message.c.
|
|
|
|
20001120
|
|
|
|
Bugfix: per-destination deferred mail logfiles were case
|
|
sensitive so that the same site could have multiple deferred
|
|
mail logfiles, so that not all mail would be flushed with
|
|
ETRN. Reported by Ralph Hildebrandt. Files: flush/flush.c.
|
|
|
|
Portability: added (int) casts to printf-like arguments
|
|
that specify the width of %*letter conversions. On some
|
|
systems, sizeof and pointer difference expressions are
|
|
wider than an int. Reported by Valentin Nechayev @ lucky.net.
|
|
|
|
20001121:
|
|
|
|
Compatibility: Postfix now retries delivery when an external
|
|
command is killed by a signal, because people expect such
|
|
behavior from Sendmail. File: global/pipe_command.c.
|
|
|
|
20001123-30
|
|
|
|
Feature: mailbox locking is now configurable. The configuration
|
|
parameter name is "mailbox_delivery_lock". Depending on
|
|
the operating system one can specify one or more of "flock",
|
|
"fcntl" and "dotlock". Use "postconf -l" to find out what
|
|
locking methods Postfix supports. The default setting is
|
|
system dependent. All mailbox file opens are now done by
|
|
one central mbox_open() routine. This affects the operation
|
|
of the postlock command, and of local delivery to mailbox
|
|
or /file/name. Files: util/safe_open.c, util/myflock.c,
|
|
global/deliver_flock.c, global/mbox_conf.c, global/mbox_open.c.
|
|
local/mailbox.c, local/file.c, postlock/postlock.c.
|
|
|
|
Compatibility: the old sun_mailtool_compatibility parameter
|
|
is being phased out. It still works (by turning off
|
|
flock/fcntl locks), but logs a warning as a reminder that
|
|
it will go away.
|
|
|
|
Compatibility: when delivering to /file/name, the local
|
|
delivery agent now logs a warning when it is unable to
|
|
create a /file/name.lock file, and then delivers the mail
|
|
(older Postfix versions would silently deliver).
|
|
|
|
20001202
|
|
|
|
Feature: specify "smtp_never_send_ehlo = no" to disable
|
|
ESMTP. Someone asked for this long ago. Files: smtp/smtp.c,
|
|
smtp/smtp_proto.c.
|
|
|
|
Feature? Bugfix? The smtp client now skips server replies
|
|
that do not start with "CODE SPACE" or with "CODE HYPHEN",
|
|
and flags them as protocol errors. Older versions silently
|
|
treat "CODE TEXT" as "CODE SPACE TEXT". File: smtp/smtp_chat.c.
|
|
|
|
20001203
|
|
|
|
Documentation: postmap(1) and postalias(1) did not document
|
|
the process exit status for "-q key".
|
|
|
|
20001204
|
|
|
|
Bugfix: the Postfix master daemon no longer imported
|
|
MAIL_CONF and some other necessary environment parameters.
|
|
Postfix now has explicit "import_environment" and
|
|
"export_environment" configuration parameters that control
|
|
what environment parameters are shared with non-Postfix
|
|
processes. Files: util/clean_env.c, util/spawn_command.c,
|
|
util/vstream_popen.c, global/pipe_command.c, and everything
|
|
that invokes this code.
|
|
|
|
20001208
|
|
|
|
Bugfix: while processing massive amounts of one-recipient
|
|
mail, qmgr could deadlock for 10 seconds while sending a
|
|
bounce message. All queue manager bounce send requests are
|
|
now implemented asynchronously. Files: global/abounce.[hc]
|
|
(asynchronous bounce client), qmgr/qmgr_active.c. Problem
|
|
reported by El Bunzo (webpower.nl) and Tiger Technologies
|
|
(tigertech.com).
|
|
|
|
20001209
|
|
|
|
Feature: mailbox_transport and fallback_transport can now
|
|
have the form transport:nexthop, with suitable defaults
|
|
when either transport or nexthop are omitted, just like in
|
|
the Postfix transport map. This allows you to specify for
|
|
example, "mailbox_transport = lmtp:unix:/file/name". File:
|
|
global/deliver_pass.c.
|
|
|
|
20001210
|
|
|
|
Bugfix: the local_destination_concurrency_limit paramater
|
|
no longer worked as per-user concurrency limit but instead
|
|
worked as per-domain limit, so that the limit of "2" in
|
|
the default main.cf files resulted in poor local delivery
|
|
performance. Files: qmgr/qmgr_message.c, qmgr/qmgr_deliver.c.
|
|
Problem reported by David Schweikert (ee.ethz.ch) and Dallas
|
|
Wisehaupt (cynicism.com).
|
|
|
|
20001210
|
|
|
|
Feature: support for MYSQL connections over UNIX-domain
|
|
sockets by Piotr Klaban. Files: util/dict_mysql.c,
|
|
MYSQL_README.
|
|
|
|
20001211
|
|
|
|
Small dirt: postconf -m produced too much output due to a
|
|
missing "else", and the optional SASL code needed a fix
|
|
for the changed name_mask API.
|
|
|
|
20001212
|
|
|
|
Workaround: due to an error, record type L for "filter
|
|
transport name" was the same as that for the already existing
|
|
record type L for "record not ending in newline", causing
|
|
the pickup daemon to discard all records not ending in
|
|
newline. The code cannot be changed without breaking
|
|
compatibility with queued mail, so the pickup server is
|
|
changed to discard type L records only from the message
|
|
envelope, not from the content. File: pickup/pickup.c.
|
|
|
|
20001213
|
|
|
|
Bugfix: dict_ldap did not properly initialize a handle
|
|
after connection timeout. Problem reported by Alain Thivillon.
|
|
File: util/dict_ldap.c.
|
|
|
|
20001214
|
|
|
|
Feature: local_transport and default_transport now also
|
|
understand the transport[:destination] notation, so that
|
|
all transport config parameters are similar again. File:
|
|
trivial-rewrite/resolve.c, trivial-rewrite/transport.c.
|
|
|
|
Code cleanup: mailbox_transport and fallback_transport no
|
|
longer allow the user to omit the transport part of a
|
|
transport:destination specification. That just did not make
|
|
any sense at all. The :destination part is still optional.
|
|
File: global/deliver_pass.c.
|
|
|
|
Feature: most time-related configuration parameters take
|
|
a one-letter suffix that specifies the time unit: s
|
|
(second), m (minutes), h (hours), d (days), w (weeks).
|
|
"postconf -d" output includes the default time unit. Files:
|
|
many.
|
|
|
|
Code cleanup: in a CONFIG_TIME_TABLE, the default time unit
|
|
is now always the last character of a default time value.
|
|
It is no longer necessary to specify the default time unit
|
|
separately. This change means that it will not be possible
|
|
to specify default values in the form of function calls,
|
|
but that was unused anyway. Files: global/mail_conf_time.c,
|
|
and user code.
|
|
|
|
20001217
|
|
|
|
Bugfix: reorganized some code in the MYSQL client to end
|
|
a number of memory allocation/deallocation problems. This
|
|
code needs more work. File: dict_mysql.c.
|
|
|
|
20001218
|
|
|
|
Bugfix: the MYSQL client did not provide function pointers
|
|
for unimplemented operations, causing "postmap -d" to dump
|
|
core instead if issuing an error message. This is what I
|
|
get for accepting code that I cannot test myself.
|
|
|
|
20001221
|
|
|
|
Code cleanup: configuration parameters that are $name
|
|
expanded at run-time now have their own data type hierarchy
|
|
instead of being piggy-backed on top of strings that are
|
|
$name expanded at program initialization time. Files:
|
|
global/mail_conf.h, global/mail_conf_raw.c, and code that
|
|
calls it.
|
|
|
|
20001230
|
|
|
|
Update: replaced the default rbl.maps.vix.com setting by
|
|
the current blackholes.mail-abuse.org.
|
|
|
|
20010102
|
|
|
|
Code cleanup: the queue manager is a bit greedier with
|
|
allocating a delivery agent. Problem pointed out by Patrik
|
|
Rak. All bugs in the solution are mine. Files:
|
|
*qmgr/qmgr_active.c.
|
|
|
|
20010105
|
|
|
|
Bugfix: the FILTER_README shell script example did not
|
|
correctly pass exit status to the parent.
|
|
|
|
Bugfix: soft errors in client hostname lookups would be
|
|
treated as hard errors. Fix by Michael Herrmann
|
|
(informatik.tu-muenchen.de). File: smtpd/smtpd_peer.c.
|
|
|
|
20010110
|
|
|
|
Bugfix: the mkdir() EEXIST race condition workaround was
|
|
not complete. Matthias Andree, Daniel Roesen. Files:
|
|
global/mail_queue.c, util/make_dirs.c.
|
|
|
|
20010111
|
|
|
|
Portability: IRIX 6.5.10 defines sa_len as a macro, causing
|
|
a name collision with a variable used by Postfix. Roberto
|
|
Totaro, enigma.ethz.ch. File: smtpstone/smtp-source.c.
|
|
|
|
20010116
|
|
|
|
Bugfix: REJECT by header/body_checks was flagged in smtpd
|
|
as a bounce, should be policy, in order to make postmaster
|
|
notifications more consistent. File: smtpd/smtpd.c.
|
|
|
|
Merged updated chroot setup procedure by Matthias Andree.
|
|
Files: examples/chroot-setup/LINUX2.
|
|
|
|
20010117
|
|
|
|
Formatting: changed the seconds and days formats in the
|
|
"your mail is delayed" text so that it does not switch to
|
|
scientific notation. File: bounce/bounce_notify_util.c.
|
|
|
|
20010119
|
|
|
|
Feature: SASL support for the LMTP client. Recent CYRUS
|
|
software requires this for Postfix over TCP sockets.
|
|
|
|
20010120
|
|
|
|
Bugfix: the 20001005 revised fallback_relay support caused
|
|
Postfix to send mail to the fallback even when the local
|
|
machine was an MX host for the final destination. Result:
|
|
mailer loop. Found by Laurent Wacrenier (teaser.fr). Files:
|
|
smtp/smtp_connect.c, smtp/smtp_addr.c.
|
|
|
|
20010121
|
|
|
|
Workaround: specify "broken_sasl_auth_clients = yes" in
|
|
order to support old Microsoft clients that implement a
|
|
non-standard version of RFC 2554 (AUTH command).
|
|
|
|
Workaround: Lotus Domino 5.0.4 violates RFC 2554 and replies
|
|
to EHLO with AUTH=LOGIN. File: smtp/smtp_proto.c.
|
|
|
|
20010125
|
|
|
|
Code cleanup: wrote creator/destructor for dictionary
|
|
objects that provides default methods that trap all attempts
|
|
to perform an unimplemented operation. Based on an ansatz
|
|
by Laurent Wacrenier (teaser.fr). Files: util/dict*.[hc].
|
|
|
|
Code cleanup: INSTALL.sh does not ask questions when stdin
|
|
is not connected to a tty (as in: make install</dev/null).
|
|
To automate a customized install, the script imports
|
|
environment variables for install_root etc.
|
|
|
|
20010127
|
|
|
|
Workaround: randomize the delay between attempts to lock
|
|
a file, so that multiple bounce or defer servers are less
|
|
likely to retry all at the same time. likely. File:
|
|
util/rand_sleep.c, global/deliver_flock.c, global/dot_lockfile.c.
|
|
|
|
20010128
|
|
|
|
Code cleanup: complaints about invalid or numeric hostnames
|
|
either provide specific context or are removed as redundant.
|
|
Files: util/valid_hostname.c dns/dns_lookup.c.
|
|
|
|
Code cleanup: new mailbox_size_limit parameter (default:
|
|
20MB). Until now, the mailbox size limit was the same as
|
|
the message size limit, due to artefact of implementation.
|
|
Files: global/mail_params.h, local/local.c.
|
|
|
|
Bugfix: fix for the ldap_domains parameter, both semantics
|
|
and documentation by LaMont Jones. Files: LDAP_README,
|
|
conf/sample-ldap.cf, util/dict_ldap.c.
|
|
|
|
Update: merged in the virtual delivery agent by Andrew
|
|
McNamara. See VIRTUAL_README for detailed examples.
|
|
|
|
Update: merged a re-vamped nqmgr by Patrik Rak.
|
|
|
|
20010129
|
|
|
|
Tweak: several little nqmgr tweaks by Patrik Rak. Files:
|
|
global/mail_params.h, nqmgr/qmgr_job.c.
|
|
|
|
Bugfix: the virtual delivery agent did not save maps_find()
|
|
results timely. J?rgen Thomsen, postfix.jth.net. File:
|
|
virtual/mailbox.c.
|
|
|
|
Security: disallow regexp tables in the virtual delivery
|
|
agent. The $1 etc. substitution mechanism gives too much
|
|
power to the sender. File: virtual/mailbox.c.
|
|
|
|
Cleanup: clarified documentation and boundary cases in the
|
|
random_sleep() routine.
|
|
|
|
Bugfix: the MISSING_USLEEP feature was used backwards.
|
|
Patrik Rak. File: util/random_sleep.c.
|
|
|
|
20010130
|
|
|
|
Workaround: Linux usleep() is void, BSD/Solaris usleep()
|
|
returns int, don't use it. File util/random_sleep.c.
|
|
|
|
Made local maildir bounce/defer handling mode consistent
|
|
with local mailbox delivery. File local/maildir.c.
|
|
|
|
The smtp client now defers delivery when all MX hosts have
|
|
no A record. File: smtp/smtp_addr.c
|
|
|
|
Bundled the man2html and postlink quick hacks so people
|
|
can do their own manual page processing. See scripts in
|
|
the mantools directory.
|
|
|
|
Documentation: updated the reference to sendmail in the
|
|
html/index.html page.
|
|
|
|
Documentation: added note about the Cisco PIX "fixup smtp"
|
|
bug that causes mail delivery problems when "." and "CRLF"
|
|
arrive in separate packets. File: html/faq.html.
|
|
|
|
20010201
|
|
|
|
Bugfix: another missing initialization in the mysql client.
|
|
File: util/dict_mysql.c.
|
|
|
|
Sanitized time routine by Patrik Rak, to make his nqmgr
|
|
robust against people who set their clock back. Files:
|
|
util/sane_time.[hc].
|
|
|
|
Bumped the default mailbox file size limits to 50MB.
|
|
|
|
20010202
|
|
|
|
Bugfix: fixed the way the master resets the file size limit
|
|
to avoid problems when a Postfix daemon updates a queue
|
|
file. The file size limit is now increased to INT_MAX if
|
|
it is smaller than INT_MAX, so that it is less likely to
|
|
interfere than the old setting of message_size_limit.
|
|
|
|
Feature: disable mailbox size limits for the local and
|
|
virtual delivery agents by setting mailbox_size_limit or
|
|
virtual_mailbox_limit to zero.
|
|
|
|
20010203
|
|
|
|
Update: null candidate patch from Patrik Rak. Files:
|
|
nqmgr/qmgr_entry.c nqmgr/qmgr_job.c nqmgr/qmgr_message.c.
|
|
|
|
Cleanup: added one gruesome command to the postlink script
|
|
for hyperlinking nroff manual page output. Word abbreviation
|
|
broke some <a href...> </a> instances across line boundaries.
|
|
sed(1) is an amazing tool. File: mantools/postlink.
|
|
|
|
20010204
|
|
|
|
Laid the ground work for logging of table accesses. This
|
|
will give more insight into how Postfix uses its lookup
|
|
tables. User interface comes later. File: util/dict_debug.c.
|
|
|
|
20010216
|
|
|
|
Bugfix: the pipe delivery agent expanded $size as if it
|
|
were a recipient, instead of expanding it as $nexthop or
|
|
as $sender. Reported by Michael Tokarev. File: pipe/pipe.c.
|
|
|
|
20010221
|
|
|
|
Bugfix: poor LMTP performance for domains that are listed
|
|
in $mydestination, because Postfix would send one recipient
|
|
at a time, with multiple deliveries of recipients of the
|
|
same message in parallel; a similar problem could exist
|
|
with virus scanning and with firewall relay hosts that
|
|
forward mail for $mydestination to an inside machine. This
|
|
behavior is now changed to depend on the transport-specific
|
|
xxx_destination_recipient_limit parameter. This also means
|
|
that you can now get qmail behavior for SMTP deliveries by
|
|
setting smtp_destination_recipient_limit=1. File:
|
|
{qmgr,nqmgr}/qmgr_message.c.
|
|
|
|
Workaround: Solaris socketpair() can fail with EINTR. Added
|
|
a sane_socketpair.c module that joins the ranks of the
|
|
other sane_whatever workarounds. Reported by Andrew McNamara.
|
|
File: util/sane_socketpair.[hc]
|
|
|
|
20010222
|
|
|
|
Documentation: the default main.cf file has a prominent
|
|
warning that mynetworks should be properly configured in
|
|
order to reject unauthorized mail relay requests from
|
|
strangers.
|
|
|
|
Documentation: the INSTALL document, section "mandatory
|
|
configuration file edits" has a section that explains that
|
|
mynetworks should be properly configured in order to reject
|
|
unauthorized mail relay requests from strangers.
|
|
|
|
20010223
|
|
|
|
Documentation: the basic.html document has a section that
|
|
explains that mynetworks should be properly configured in
|
|
order to reject unauthorized mail relay requests from
|
|
strangers.
|
|
|
|
Feature: new "mynetworks_style" parameter that controls
|
|
how mynetworks (trusted networks) is derived from the
|
|
inet_interfaces (machine interfaces) setting. Specify
|
|
"class" for entire class A, B, C networks; "subnet" for
|
|
the local subnets only; or "host" for maximal privacy.
|
|
Files: util/inet_addr_local.[hc], global/own_inet_addr.[hc],
|
|
global/mynetworks.[hc], postconf/postconf.c.
|
|
|
|
Portability: MACOSX patches by Gerben Wierda.
|
|
|
|
Portability: Solaris /dev/null is a symlink, which tripped
|
|
up the code to safely open a file before local delivery.
|
|
We now grudgingly allow symlinks owned by root. File:
|
|
util/safe_open.c.
|
|
|
|
20010224
|
|
|
|
Bugfix: "postconf mynetworks" ignored the inet_interfaces
|
|
setting. That was a very old one. File: postconf/postconf.c.
|
|
|
|
INCOMPATIBLE CHANGE: POSTFIX NO LONGER RELAYS MAIL FOR
|
|
CLIENTS IN THE ENTIRE CLASS A/B/C NETWORK. POSTFIX BY
|
|
DEFAULT RELAYS MAIL FOR CLIENTS IN THE LOCAL SUBNETWORK.
|
|
Specify "mynetworks_style = class" to get the old behavior.
|
|
|
|
20010225
|
|
|
|
Portability: master sigchld handler based on writing to a
|
|
pipe, so that the master wakes up from select(). Based on
|
|
code by Erik Forsberg, Linkoping University, Sweden. File:
|
|
master/master_sig.c. Disabled until after the major release.
|
|
|
|
Code cleanup: Postfix should now run with no alias database.
|
|
|
|
Code cleanup: local_destination_recipient_limit and
|
|
local_destination_concurrency_limit have become first-class
|
|
configuration parameters. Files: global/mail_params.h,
|
|
*qmgr/qmgr.c, postconf/postconf.c.
|
|
|
|
20010226
|
|
|
|
Documentation suggestions by Lars Hecking and Richard
|
|
Huxton, Matthias Andree and many others.
|
|
|
|
Code cleanup: some queue/transport operations need to be
|
|
moved, after the code cleanup of the recipient/concurrency
|
|
limit handling. Patrik Rak. Files: *qmgr/qmgr_message.c.
|
|
|
|
20010301
|
|
|
|
Feature: configurable name in syslog output (default:
|
|
"syslog_name = postfix") so that different Postfix instances
|
|
can be recognized by their logging. File: global/mail_task.c.
|
|
|
|
20010313
|
|
|
|
Workaround for logic mismatch in nqmgr that was exposed
|
|
with the introduction of the asynchronous bounce client.
|
|
Patrik Rak.
|
|
|
|
20010313
|
|
|
|
Bugfix: the RFC 822 untokenizer quoted newlines inside
|
|
comments. File: global/tok822_parse.c.
|
|
|
|
20010316
|
|
|
|
Cleanup: removed an extraneous warning when a queue file
|
|
write error happened.
|
|
|
|
20010321
|
|
|
|
Workaround: LMTP connection caching never worked for
|
|
destinations starting with unix: or inet:. File:
|
|
lmtp/lmtp_connect.c.
|
|
|
|
20010322
|
|
|
|
Portability: Solaris <2.6 does not have srandom() and
|
|
random() in libc. File: util/rand_sleep.c. It does not have
|
|
to be cryptographically strong.
|
|
|
|
Bugfix: the fast ETRN flush server could not handle [ipaddr]
|
|
or domain names with one-character hostname part. This
|
|
fix changes the destination to logfile name mapping, so
|
|
that you need to populate the new files with "sendmail -q".
|
|
The old files go away automatically. File: flush/flush.c.
|
|
|
|
20010327
|
|
|
|
Speed up mailq (sendmail -bp) display by flushing output
|
|
after each file. File: showq/showq.c.
|
|
|
|
Portability: missing string.h includes, %p wants (void *),
|
|
Lamont Jones, HP.
|
|
|
|
20010328
|
|
|
|
Bugfix: swapped logic caused cleanup to stall when the
|
|
queue file size exceeded the file size limit by less than
|
|
one the VSTREAM buffer size, so that the "file too big"
|
|
was detected after flushing the last queue file record.
|
|
File: cleanup/cleanup.c.
|
|
|
|
20010329
|
|
|
|
Portability: workaround for missing prototype problem in
|
|
dict_ldap.c. This module should move to the global directory,
|
|
because it depends on Postfix main.cf parameter information.
|
|
|
|
Workaround: after sending a trigger message over a socket,
|
|
do not immediately close the client side, but close it from
|
|
a background thread that waits until the server closes the
|
|
socket first. This avoids trouble with socket implementations
|
|
that destroy a socket when the client closes a socket before
|
|
the server has received the client's data. Files:
|
|
util/{inet,unix,stream}_trigger.c, util/events.c,
|
|
master/master_trigger.c, postkick/postkick.c.
|
|
|
|
20010403
|
|
|
|
Workaround: the mysql library can return null pointers
|
|
rather than zero-length strings. File: util/dict_mysql.c.
|
|
|
|
20010404
|
|
|
|
Ergonomics: log additional information about the reason
|
|
why "mail for XXX loops back to myself" when the local
|
|
machine is the best MX host. File: smtp/smtp_addr.c.
|
|
|
|
20010406
|
|
|
|
Changed some noisy LDAP client warnings into optional
|
|
logging. LaMont Jones, util/dict_ldap.c.
|
|
|
|
20010411
|
|
|
|
Bugfix: the SMTP server now replies with 550 instead of
|
|
503 when it receives the DATA command without having received
|
|
a valid recipient address. This is needed for the Sendmail
|
|
client-side pipelining implementation. Problem reported by
|
|
Lutz Jaenicke. File: smtpd/smtpd.c.
|
|
|
|
Cleanup: shut up if chattr fails on Reiserfs and other file
|
|
systems that do not support the respective attributes.
|
|
Files: conf/postfix-script-{no,}sgid.
|
|
|
|
20010413
|
|
|
|
Ergonomics: Postfix applications now warn when a DB or DBM
|
|
file is out of date, and recommend to rebuild the table.
|
|
Files: util/dict_db.c, util/dict_dbm.c.
|
|
|
|
20010414
|
|
|
|
Feature: specify a key of "-" to the postmap or postalias
|
|
-q or -d option, and the keys will be read from standard
|
|
input, one key per line. Files: postmap/postmap.c,
|
|
postalias/postalias.c.
|
|
|
|
Bugfix: with a non-default inet_interfaces setting, the
|
|
master ignored host information in master.cf host:port
|
|
settings. Fix by Jun-ichiro itojun Hagino @ iijlab.net.
|
|
Files: master/master.h, master/master_ent.c.
|
|
|
|
20010426
|
|
|
|
Bugfix: the SMTP server did not parse invalid MAIL FROM or
|
|
RCPT TO addresses such as <first last <user@domain>> the
|
|
way it was supposed to do. I thought this was taken care
|
|
of years ago. File: smtpd/smtpd.c.
|
|
|
|
20010427
|
|
|
|
Bugfix: smtpd would reject mail instead of replying with
|
|
a 4xx temporary error code when, for example, an LDAP or
|
|
mysql server was unavailable. Remotely based on a fix by
|
|
Robert Kiessling @ de.easynet.net. File: smtpd/smtpd_check.c.
|
|
|
|
20010429
|
|
|
|
Feature: the Postfix SMTP client now by default randomly
|
|
shuffles destination IP addresses of equal preference.
|
|
Specify "smtp_randomize_addresses = no" to disable.
|
|
Shuffling code by Elias Levy @ SecurityFocus.com Files:
|
|
dns/dns_rr.c, smtp/smtp_addr.c.
|
|
|
|
20010501
|
|
|
|
Bugfix: The SMTP server's 550 in reply to DATA should be
|
|
a 554 response. And it wasn't Sendmail. Claus Assman.
|
|
|
|
Bugfix: the INSTALL.sh test for non-interactive upgrade
|
|
broke rooted installations that specify settings via the
|
|
environment. Simon Mudd.
|
|
|
|
Bugfix: mailq output is now really flushed one message at
|
|
a time. File: sendmail/sendmail.c.
|
|
|
|
Feature: "postsuper -d queueID" deletes one message queue
|
|
file; "postsuper -d -" reads zero or more queue IDs from
|
|
standard input, and deletes one instance of each file.
|
|
File: postsuper/postsuper.c.
|
|
|
|
Code cleanup: in order to make postsuper -d safe with a
|
|
running Postfix mail system, some routines had to be made
|
|
tolerant for sudden queue file disappearances. Files:
|
|
global/deliver_request.c, *qmgr/qmgr_move.c.
|
|
|
|
Code cleanup: in order to make postsuper -d more usable,
|
|
the showq command was extended to safely list the possibly
|
|
world-writable maildrop directory. File: showq/showq.c.
|
|
|
|
20010504
|
|
|
|
Feature: postsuper -d will also delete defer and bounce
|
|
logfiles when the named queue file is found.
|
|
|
|
20010505
|
|
|
|
RFC 2821 feature: an SMTP server must reset all buffers
|
|
upon receipt of EHLO. File: smtpd/smtpd_check.c.
|
|
|
|
RFC 2821 feature: an SMTP server must accept a recipient
|
|
address of "postmaster" without domain name. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
RFC 2821 recommendation: reply with 503 to commands sent
|
|
after 554 greeting. File: smtpd/smtpd.c.
|
|
|
|
RFC 2821 recommendation: if VRFY is enabled, list it in
|
|
the EHLO response. File: smtpd/smtpd.c.
|
|
|
|
RFC 2821 recommendation: SMTP clients should use EHLO.
|
|
The default setting of smtp_always_send_ehlo has changed
|
|
from 0 (send EHLO if server greets with ESMTP) to 1 (always
|
|
send EHLO). In all cases, Postfix falls back to HELO if
|
|
the server does not support EHLO. File: smtp/smtp_proto.c.
|
|
|
|
20010507
|
|
|
|
Bugfix: with soft_bounce=yes, the SMTP server would log
|
|
5xx replies even though it would send 4xx replies to the
|
|
client (Phil Howard, ipal.net). File: smtpd/smtpd_check.c.
|
|
|
|
20010515
|
|
|
|
Compatibility: Microsoft sends "AUTH=MBS_BASIC LOGIN".
|
|
Updated the parsing code in smtp/smtp_proto.c. Problem
|
|
reported by Ralf Tessmann, Godot GmbH.
|
|
|
|
20010520
|
|
|
|
Standard: deleted the non-standard "via" portion from
|
|
Received: headers generated by Postfix bounce or other
|
|
notification processes. File: global/post_mail.c.
|
|
|
|
Robustness: eliminated stack-based recursion from the RFC
|
|
822 address parser. File: global/tok822_parse.c.
|
|
|
|
Standard: annotated the source code with comments based on
|
|
RFC 2821 and 2822. Not all the RFC changes make sense.
|
|
|
|
RFC 2821 recommendation: treat a RCPT 552 reply as if the
|
|
server sent 452. Files: smtp/smtp_proto.c, lmtp/lmtp_proto.c.
|
|
|
|
Cleanup: moved ownership of the debug_peer parameters from
|
|
the applications to the library, so that a Postfix shared
|
|
library does not suffer from undefined references. Files:
|
|
smtp/smtp.c, lmtp/lmtp.c, smtpd/smtpd.c, global/mail_params.c.
|
|
LaMont Jones, for Debian.
|
|
|
|
20010522
|
|
|
|
Feature: "postsuper -r queueID" re-queues a message, and
|
|
"postsuper -r ALL" re-queues all mail. The message is moved
|
|
to the maildrop queue so that the pickup daemon will copy
|
|
it to a new queue file, and so that address rewriting will
|
|
be done again. This is useful after changes of address
|
|
rewriting or virtual mappings.
|
|
|
|
Feature: "postsuper -d ALL [queue-name]" deletes a bunch
|
|
of mail.
|
|
|
|
20010523
|
|
|
|
Feature: "postsuper -s" (which is done by default) renames
|
|
queue files whose name (queue ID) does not match the message
|
|
file inode number.
|
|
|
|
Bugfix: memory leak in the LDAP client module. Alain
|
|
Thivillon, France Teaser - Groupe Firstream.
|
|
|
|
20010525
|
|
|
|
Portability: gcc 2.6.3 does not have __attribute__ (Clive
|
|
Jones, dgw.co.uk). File: util/sys_defs.h.
|
|
|
|
Bugfix: the SMTP and LMTP clients claimed that a queue file
|
|
needed to be delivered again (even when all recipients were
|
|
erased from the queue file) when no QUIT or RSET reply was
|
|
received (by default, this does not happen with SMTP mail
|
|
because the SMTP client does not wait for QUIT replies and
|
|
does not send RSET to deliver mail). As a result of the
|
|
same bug the LMTP client followed a dangling pointer when
|
|
sending QUIT after process idle timeout while the LMTP
|
|
server had disconnected. Files: smtp/smtp_proto.c,
|
|
lmtp/lmtp_proto.c.
|
|
|
|
20010526
|
|
|
|
newaliases no longer complains when an empty list is
|
|
specified with the alias_database configuration parameter.
|
|
File: sendmail/sendmail.c.
|
|
|
|
20010529
|
|
|
|
Workaround: old PIX firewall code messes up when the final
|
|
".<CR><LF>" at the end of DATA spans a packet boundary.
|
|
When Postfix detects PIX SMTP fixup mode, Postfix flushes
|
|
the output buffers before sending the final ".<CR><LF>".
|
|
File: smtp/smtp_proto.c.
|
|
|
|
20010530
|
|
|
|
Portability: updated code for Mac OS X, accounting for the
|
|
post-Beta changes. Code by Joe Block, UCF School of
|
|
Optics/CREOL.
|
|
|
|
20010601
|
|
|
|
Safety: postdrop turns off interrupts when cleaning up
|
|
after interrupt. The additional safety does not hurt anyone.
|
|
File: src/postdrop/postdrop.c.
|
|
|
|
20010607
|
|
|
|
Safety: dropped the RFC 2821 compliant code that treats
|
|
552 RCPT TO replies as 452. It created more problems than
|
|
it solved. Files: smtp/smtp_proto.c, lmtp/lmtp_proto.c.
|
|
|
|
Logging: the SMTP server now logs a warning if RBL lookups
|
|
have problems other than "not found". file: smtpd/smtpd_check.c.
|
|
|
|
20010610
|
|
|
|
Feature: address quoting and case folding flags for the
|
|
pipe(8) mailer.
|
|
|
|
20010611
|
|
|
|
Workaround: some MTAs fall on their face when they receive
|
|
unexpectedly long lines. From now on, Postfix defaults to
|
|
breaking long lines at 2048 (like Sendmail so it has got
|
|
to be right). To get the old, content preserving, behavior
|
|
specify "smtp_truncate_lines = no". File: smtp/smtp_proto.c.
|
|
|
|
20010614
|
|
|
|
Bugfix: did not really undo 2821 552->452 mapping.
|
|
|
|
20010628
|
|
|
|
Bugfix: postfix-script used a hard-coded maildrop group
|
|
owner instead of using the install-time specified name
|
|
stored in /etc/postfix/install.cf. Problem reported by
|
|
David Terrell @ meat.net.
|
|
|
|
20010701
|
|
|
|
Feature: mail_spool_directory ending in / causes maildir
|
|
style delivery.
|
|
|
|
Bugfix: the FreeBSD kernel parameters kern.ipc.nmbclusters
|
|
and kern.ipc.maxsockets cannot be set with sysctl commands.
|
|
File: html/faq.html. Len Conrad @ Go2France.com.
|
|
|
|
Cleanup: the virtual delivery agent was poorly integrated
|
|
so that the SMTP server and queue manager did not reject
|
|
mail for unknown users. Files: smtpd/smtpd_check.c.
|
|
|
|
20010705
|
|
|
|
Feature: QMQP server, compatible with qmail and the ezmlm
|
|
list manager. Files: util/netstring.[hc], qmqpd/qmqpd*.c.
|
|
|
|
20010706
|
|
|
|
Feature: QMQP stress test message generator program. Files:
|
|
smtpstone/qmqp-source.c, smtpstone/qmqp-sink.c.
|
|
|
|
20010708
|
|
|
|
Bugfix: with disable_dns=yes, the SMTP client treated all
|
|
host lookup errors as permanent. File: smtp/smtp_addr.c.
|
|
|
|
20010709
|
|
|
|
Feature: VERP support, based on a patch by Peng Yong, and
|
|
with the missing parts filled in so that the Postfix bounce
|
|
daemon can send one VERP bounce per undeliverable recipient.
|
|
Files: , sendmail/sendmail.c, smtpd/smtpd.c, qmgr/qmgr_deliver.c,
|
|
bounce/bounce_notify_verp.c, qmqpd/qmqpd.c, plus a couple
|
|
support routines in the global library.
|
|
|
|
Cleanup: with recipient_delimiter=+ (or any character other
|
|
than -) Postfix will now recognize address extensions even
|
|
with owner-foo+extension addresses. This is necessary to
|
|
make VERP work for mailing lists.
|
|
|
|
20010710
|
|
|
|
Bugfix: potential memory leak in the queue managers with
|
|
the new VERP delimiter record. Fix by Patrik Rak.
|
|
|
|
20010711
|
|
|
|
Cleanup: you can now specify the VERP delimiter characters
|
|
on the sendmail(1) command line, but they are still optional.
|
|
|
|
Safety: with maildir style delivery and with hashed mailboxes
|
|
the system mail spool directory must not be world writable.
|
|
|
|
20010713
|
|
|
|
Safety: the verp_delimiter_filter parameter (default: -=+)
|
|
limits what characters Postfix accepts as VERP delimiter
|
|
characters.
|
|
|
|
20010714
|
|
|
|
Logging: the queue manager now logs a "status=expired"
|
|
record when it returns a message that is too old. Files:
|
|
*qmgr/qmgr_active.c.
|
|
|
|
20010719
|
|
|
|
Feature: stiffer coupling between mail receiving rates and
|
|
mail delivery rates, using a trivial token-based scheme,
|
|
implemented by reading and writing an in-memory pipe. The
|
|
queue manager produces one token when it retrieves mail
|
|
from the incoming queue. The cleanup daemon consumes one
|
|
token when it adds mail to the incoming queue. If no token
|
|
is available the cleanup server pauses for $in_flow_delay
|
|
seconds and proceeds anyway. The delay allows mail sending
|
|
process to catch up and access the disk while not blocking
|
|
inbound mail. Valid delays are 0..10 seconds.
|
|
|
|
20010727
|
|
|
|
Bugfix: updated LDAP client module from LaMont Jones, HP.
|
|
This also introduces new LDAP query filter patterns: %u
|
|
(address localpart) and %d (domain part). Files:
|
|
conf/sample-ldap.cf, util/dict_ldap.c.
|
|
|
|
20010729
|
|
|
|
Bugfix: recursive smtpd_whatever_restrictions clobbered
|
|
intermediate results when switching between sender and
|
|
recipient address restrictions. Problem found by Victor
|
|
Duchovni, morganstanley.com. In order to fix, introduced
|
|
address resolver result caching, which should also help to
|
|
speed up sender/recipient address restriction processing.
|
|
|
|
Bugfix: the not yet announced DUNNO access table lookup
|
|
result did not prevent lookups with substrings of the same
|
|
lookup key. Found by Victor Duchovni, morganstanley.com.
|
|
|
|
20010730
|
|
|
|
Robustness: trim trailing whitespace from regexp and pcre
|
|
right-hand sides, for consistency with DB/DBM tables.
|
|
Files: util/dict_pcre.c, util/dict_regexp.c.
|
|
|
|
20010731
|
|
|
|
Robustness: eliminate duplicate IP addresses after expansion
|
|
of hostnames in $inet_interfaces, so that Postfix does not
|
|
suddenly refuse to start up after someone changes the DNS.
|
|
Files: util/inet_addr_list.c global/own_inet_addr.c.
|
|
|
|
Feature: specify "disable_verp_bounces = yes" to have
|
|
Postfix send one RFC-standard, non-VERP, bounce report for
|
|
multi-recipient mail, even when VERP style delivery was
|
|
requested.
|
|
|
|
20010801
|
|
|
|
Bugfix: postconf was using unexpanded values internally
|
|
for myhostname, inet_interfaces, and mynetworks_style.
|
|
This broke the "postconf -d" mynetworks computation. File:
|
|
postconf/postconf.c.
|
|
|
|
20010803
|
|
|
|
Feature: masquerade_classes parameter for fine control of
|
|
address masquerading. The default setting is backwards
|
|
compatible: envelope_sender header_sender header_recipient.
|
|
Files: cleanup/whatever.c.
|
|
|
|
20010822
|
|
|
|
Code cleanup: the bounce daemon complained about data that
|
|
it was not going to send back anyway. Fix: stop reading
|
|
the original message when the bounce message reaches the
|
|
bounce message size limit. File: bounce/bounce_notify_util.c.
|
|
|
|
20010826
|
|
|
|
Logging: postsuper now logs the queue ID when it requeues
|
|
a message, or when it deletes a message from the mail queue.
|
|
File: postsuper/postsuper.c.
|
|
|
|
20010830
|
|
|
|
Safety: the SMTP server now sends a 4xx (try again later)
|
|
response when an UCE restriction is misconfigured, instead
|
|
of ignoring the bad restriction and possibly accepting mail
|
|
that it should not accept. File: smtpd/smtpd_check.c.
|
|
|
|
20010907
|
|
|
|
Workaround: the Postfix qmqp-source program produced mail
|
|
not ending in newline. qmail-qmqpd accepts such mail, but
|
|
qmail-remote is unable to deliver it. Matthias Andree,
|
|
uni-dortmund.de. File: smtpstone/qmqp-source.c.
|
|
|
|
20010910
|
|
|
|
Bugfix: the smtp-sink stress test program broke when RCPT
|
|
TO commands crossed network packet boundaries. Problem
|
|
reported by Matthias Andree, uni-dortmund.de. File:
|
|
smtpstone/smtp-sink.c.
|
|
|
|
20010917
|
|
|
|
Code cleanup: permit_mx_backup implements the old behavior
|
|
(accept mail if the local MTA is MX relay), and allows an
|
|
additional restriction via the permit_mx_backup_networks
|
|
parameter (accept mail only if the primary MX hosts match
|
|
the specified list of network blocks). This second restriction
|
|
is now entirely optional, for backwards compatibility.
|
|
|
|
Bugfix: an address extension could be appended multiple
|
|
times to the result of a canonical or virtual map lookup.
|
|
File: global/mail_addr_map.c. Fix by Victor Duchovni,
|
|
Morgan Stanley.
|
|
|
|
Bugfix: split_addr() would split an address even when there
|
|
was no data before the recipient delimiter. In combination
|
|
with the above bug, this could cause an address to grow
|
|
exponentially in size. Problem reported by Victor Duchovni,
|
|
Morgan Stanley. File: global/split_addr.c.
|
|
|
|
20010918
|
|
|
|
Bugfix: the mail_addr_map() fix was almost but not quite
|
|
right. It took two clever people and several iterations of
|
|
email to really fix the mail_addr_map() problem. Thanks
|
|
to Victor Duchovni and Liviu Daia.
|
|
|
|
20011006
|
|
|
|
Cleanup: Postfix no longer flushes the whole deferred queue
|
|
after an ETRN request for a random domain name (i.e. a
|
|
domain name not matched by $fast_flush_domains); the SMTP
|
|
server instead replies with "459 service unavailable".
|
|
Files: smtpd/smtpd.c, global/flush_clnt.c, flush/flush.c.
|
|
|
|
20011008
|
|
|
|
Bugfix: there was a minute memory leak when an smtpd access
|
|
restriction was misconfigured. File: smtpd/smtpd_check.c.
|
|
|
|
20011010
|
|
|
|
Code cleanup: Postfix daemons now print the name of the
|
|
UNIX-domain socket (instead of "unknown stream") in case
|
|
of a malformed client request. Files: master/*server.c.
|
|
|
|
20011010-14
|
|
|
|
Code cleanup: replaced the ugly mail_print() and mail-scan()
|
|
protocols by (name,value) attribute lists. This gives better
|
|
error detection when we make changes to internal protocols,
|
|
and allows new attributes to be introduced without breaking
|
|
everything immediately. Files: util/attr_print.c util/attr_scan.c
|
|
global/mail_command_server.c global/mail_command_client.c
|
|
as wel as most Postfix applications and daemons.
|
|
|
|
20011015
|
|
|
|
Put base 64 encoding into place on the replaced internal
|
|
protocols. Files: util/base64_code.[hc].
|
|
|
|
Feature: header/body REJECT rules can now provide text that
|
|
is sent to the originator. Files: cleanup/cleanup.c,
|
|
cleanup/cleanup_message.c, conf/sample-filter.cf.
|
|
|
|
20011016
|
|
|
|
Bugfix: As of 20000625, Errors-To: was broken, because the
|
|
code to extract the address was not moved from recipient
|
|
address rewriting to sender address rewriting. Problem
|
|
reported by Roelof Osinga @ nisser.com. File:
|
|
cleanup/cleanup_message.c.
|
|
|
|
20011029
|
|
|
|
Bugfix: virtual map expansion terminated early because the
|
|
detection of self-referential entries was flawed. File:
|
|
cleanup/cleanup_map1n.c.
|
|
|
|
20011031
|
|
|
|
Bugfix: mail_date() mis-formatted negative time zone offsets
|
|
with fractional hours (-03-30 instead of -0330). Fix by
|
|
Chad House, greyfirst.ca. File: global/mail_date.c.
|
|
|
|
20011102
|
|
|
|
Feature: new -f option to postmap and postalias (do not
|
|
lowercase the lookup key while creating a table). Files:
|
|
util/dict.h postmap/postmap.c postalias/postalias.c.
|
|
|
|
Code cleanup: simplified the attribute print/scan routines,
|
|
and removed the never-used support for sending and receiving
|
|
integer arrays and string arrays. Files: util/attr_print.c,
|
|
util/attr_scan.c.
|
|
|
|
Bugfix: qmqpd could read past the end of a string while
|
|
looking for qmail's VERP magic token in the envelope sender
|
|
address. File: qmqpd/qmqpd.c.
|
|
|
|
Code cleanup: finished testing the new internal protocols.
|
|
The only bug was with the flush server, which still needs
|
|
to support the old (string + null byte) protocol for triggers
|
|
from the Postfix master daemon.
|
|
|
|
20011103
|
|
|
|
Bugfix: Postfix would log the wrong error text when locally
|
|
submitted mail was deferred due to "soft_bounce = yes".
|
|
|
|
Bugfix: The LDAP client dropped any entries that don't have
|
|
the result_attribute, but errored out when a DN didn't
|
|
exist. The behavior is now consistent: treat non-existant
|
|
DN's in a special result attribute expansion the same as
|
|
DN's with no attribute. LaMont Jones, HP.
|
|
|
|
20011104
|
|
|
|
Bugfix: the new smtp-sink -n option (terminate after the
|
|
specified number of deliveries) wasn't optional.
|
|
|
|
Portability: updated Mac OS X documentation and install
|
|
scripts by Gerben Wierda.
|
|
|
|
20011105
|
|
|
|
Bugfix: missing terminator in new attribute-based function
|
|
call caused signal 11. File: src/cleanup/cleanup.c.
|
|
|
|
Lame workaround for ESTALE errors with mail delivery over
|
|
NFS. Additional bandages were added to the local delivery
|
|
agent. However, Wietse maintains that Postfix offers no
|
|
guarantee for reliable delivery over NFS.
|
|
|
|
Feature: put "warn_if_reject" before an smtpd restriction,
|
|
and that restriction logs warnings without rejecting mail.
|
|
This makes it easier to test configurations "live" without
|
|
having to lose mail. File: smtpd/smtpd_check.c.
|
|
|
|
20011107
|
|
|
|
Workaround: in order to get mail past PIX firewall bugs,
|
|
the Postfix SMTP client now blocks until the socket send
|
|
buffer is empty before sending the final ".<CR><LF>". Files:
|
|
util/sock_empty_wait.c, smtp/smtp_proto.c. Changed into
|
|
sleep(10) on 20011119. Sleep suggested by Hobbit.
|
|
|
|
20011108
|
|
|
|
Feature: added string-null encoding for internal protocols.
|
|
Files: util/attr_print0.c, util/attr_scan0.c.
|
|
|
|
Feature: configurable parent domain matching for domain
|
|
and hostname/address match lists: either .domain or the
|
|
domain name itself. Files: util/match_ops.c util/match_list.c
|
|
|
|
Feature: added pretend-to-be-behind-PIX mode to the smtp-sink
|
|
test program, in order to stress test some PIX bug workaround
|
|
code.
|
|
|
|
20011109
|
|
|
|
Workaround: Linux and Solaris systems have no reasonable
|
|
way to block until a socket drains. On these systems Postfix
|
|
simply waits for 10 seconds, in order to work around PIX
|
|
".<CR><LF>" bugs. File: util/sock_empty_wait.c.
|
|
|
|
20011114
|
|
|
|
Bugfix: reset the smtpd command transaction log between
|
|
deliveries. File: smtpd/smtpd.c.
|
|
|
|
20011115
|
|
|
|
Feature: mailbox_command_maps no longer requires that every
|
|
user has an entry. If the user does not have a command
|
|
entry, the local delivery agent tries the other delivery
|
|
methods (mailbox_command, home_mailbox). File: local/mailbox.c.
|
|
|
|
Bugfix: reset the smtpd command transaction log between
|
|
non-deliveries. File: smtpd/smtpd.c.
|
|
|
|
20011116
|
|
|
|
Bugfix: consolidated all the command transaction log resets
|
|
and eliminated one missing reset (Victor Duchovni, Morgan
|
|
Stanley). File: smtpd/smtpd.c.
|
|
|
|
20011118
|
|
|
|
Cleanup: replaced unnecessary match_list wrapper code by
|
|
macros. Files: global/{string,domain,namadr}_list.[hc].
|
|
|
|
20011119
|
|
|
|
Feature: configurable parent domain matching strategy for
|
|
transport map lookups. File: trivial-rewrite/transport.c.
|
|
|
|
New parent_domain_matches_subdomains parameter. This lists
|
|
all the Postfix features where a domain name matches itself
|
|
and all its subdomains (instead of requiring ".domain.name"
|
|
for subdomain matches). Planning for future backwards
|
|
compatibility :-) File: global/match_parent_style.c.
|
|
|
|
Workaround: simplified the PIX ".<CR><LF>" bug to always
|
|
sleep for 10 seconds. File: smtp/smtp_proto.c.
|
|
|
|
20011120
|
|
|
|
Workaround: disable attribute string length restriction so
|
|
that trivial-rewrite does not refuse to rewrite broken mail
|
|
headers. Files: util/attr_scan*.c.
|
|
|
|
20011121
|
|
|
|
Bugfix: missing long integer support in the new IPC protocols.
|
|
Files: util/attr_scan*.c, util/attr_print*.c.
|
|
|
|
Portability: AIX5 (Adrian P. van Bloois), MAC OS X 10.1.1
|
|
(Gerben Wierda).
|
|
|
|
20011125
|
|
|
|
Bugfix: spurious postmaster notifications because some flag
|
|
was not reset.
|
|
|
|
Feature: new parameter smtpd_sender_login_maps that specifies
|
|
the (SASL) login name that owns a MAIL FROM address.
|
|
Specify a regexp table in order to require a simple one-to-one
|
|
mapping. This is used in the reject_sender_login_mismatch
|
|
sender anti-spoofing feature.
|
|
|
|
Feature: restriction reject_sender_login_mismatch refuses
|
|
a MAIL FROM address when $smtpd_sender_login_maps specifies
|
|
an owner but the client is not (SASL) logged in as the MAIL
|
|
FROM address owner, or when a client is (SASL) logged in
|
|
but the client login name does not own the MAIL FROM address
|
|
according to $smtpd_sender_login_maps. File: smtpd/smpd_check.c.
|
|
|
|
Documentation: added some redundancy to the LMTP_README
|
|
file so people can keep track of the difference between
|
|
the Postfix LMTP client and the non-Postfix LMTP server.
|
|
|
|
20011126
|
|
|
|
Feature: smtpd_noop_commands specifies a list of commands
|
|
that are treated as NOOP (no operation) commands, without
|
|
syntax check or state change. File: smtpd/smtpd.c.
|
|
|
|
Bugfix: the "mark queue file as corrupt" code did not work
|
|
because it was never used. Files: global/mark_corrupt.c,
|
|
global/mail_copy.c, global/pipe_command.c, *qmgr/qmgr_active.c,
|
|
local/maildir.c, local/mailbox.c, local/command.c, pipe/pipe.c,
|
|
virtual/mailbox.c, virtual/maildir.c.
|
|
|
|
Bugfix: the bounce daemon broke in the unlikely case of a
|
|
non-existing queue file. File: bounce/bounce_notify_util.c.
|
|
|
|
20011127
|
|
|
|
Feature: added WARN command to header/body_checks files as
|
|
proposed by Michael Tokarev. File: cleanup/cleanup_message.c.
|
|
|
|
Bugfix: the postdrop program was broken after the change
|
|
of Postfix internal protocols. This broke "sendmail -bs"
|
|
mail submissions with "secure" maildrop directory. Reported
|
|
by Craig Loomis, apo.nmsu.edu. File: postdrop/postdrop.c.
|
|
|
|
Feature: a first start at fault injection for testing
|
|
unlikely error scenarios (such as corrupt queue files).
|
|
Parameter: fault_injection_code, must be left at zero for
|
|
production use.
|
|
|
|
20011128
|
|
|
|
Robustness: add a file size limit to the sendmail and
|
|
postdrop submission programs to stop run-away process
|
|
accidents. This is not a defense against DOS attack. Files:
|
|
sendmail/sendmail.c, postdrop/postdrop.c.
|
|
|
|
That resulted in a considerable amount of work to properly
|
|
propagate "file too large" conditions back to the sendmail
|
|
mail posting user interface. Took the opportunity to express
|
|
other mail submission fatal exits with the <sysexits.h>
|
|
exit status codes. Files: sendmail/sendmail.c,
|
|
postdrop/postdrop.c.
|
|
|
|
20011129
|
|
|
|
Maintenance: dict_ldap.c wasn't updated after the revision
|
|
of the string matching routines. File: util/dict_ldap.c.
|
|
|
|
20011208
|
|
|
|
Maintenance: LDAP module and documentation from LaMont
|
|
Jones. This version adds verbose logging for LDAP library
|
|
routines. Files: src/util/dict_ldap.[hc], LDAP_README,
|
|
conf/sample-ldap.cf
|
|
|
|
Portability: made memory alignment restrictions configurable.
|
|
File: util/mymalloc.c.
|
|
|
|
Bugfix? Avoid surprises with source routed destinations
|
|
and OK entries in SMTPD access maps. File: smtpd/smtpd_access.c.
|
|
|
|
Security: "postfix check" looks for damage by well-intended
|
|
but misguided use of "chown -R postfix /var/spool/postfix".
|
|
That would make chrooted Postfix less secure than non-chrooted
|
|
Postfix. These extra tests may cause complaints with
|
|
third-party patches such as TLS that introduce their own
|
|
files into the jail.
|
|
|
|
Feature: static map type that always returns the map name
|
|
as lookup value, regardless of lookup key value. Contributed
|
|
Jeff Miller (jeffm at ghostgun.com)
|
|
|
|
Feature: turn off the PIX <CR><LF>.<CR><LF> workaround for
|
|
the first mail delivery attempt, i.e. when mail is queued
|
|
for less than $smtp_pix_workaround_threshold_time (default:
|
|
500) seconds. New parameter $smtp_pix_workaround_delay_time
|
|
to control the delay before sending .<CR><LF> (default: 10
|
|
seconds) when doing the PIX <CR><LF>.<CR><LF> workaround.
|
|
|
|
20011210
|
|
|
|
Bugfix: the 20011128 change in sendmail and postdrop did
|
|
not handle the case of message_size_limit=0. Fix by Will
|
|
Day, Georgia Tech.
|
|
|
|
20011212
|
|
|
|
Compatibility: The SMTP server now accepts <CR><CR><LF> as
|
|
if the client sent <CR><LF>. Reportedly, some badly written
|
|
windows software produces such garbage, and some badly
|
|
written windows anti-VIRUS software cannot handle such
|
|
garbage. File: global/smtp_stream.c.
|
|
|
|
20011214
|
|
|
|
Bugfix: postmap/postalias queries ignored the -f flag.
|
|
Reported by Hamish Marson.
|
|
|
|
20011217
|
|
|
|
Compatibility: Sendmail now has a -L option to set the
|
|
syslogging label. Postfix sendmail uses syslog_name instead,
|
|
and ignores the -L option.
|
|
|
|
Security: subtle hardening of the Postfix chroot jail,
|
|
Postfix queue file permissions and access methods, in case
|
|
someone compromises the postfix account. Michael Tokarev,
|
|
who received the insights from Solar Designer, who tested
|
|
Postfix with a kernel module that is paranoid about open()
|
|
calls. Files: master/master_wakeup.c, util/fifo_trigger.c,
|
|
postfix-script.
|
|
|
|
Convenience: issue a warning instead of aborting when the
|
|
local machine name is not in fully-qualified domain form.
|
|
This would otherwise break initial postfix installation
|
|
which needs the postconf command. File: global/mail_params.c.
|
|
|
|
20011220
|
|
|
|
Added more garbage detection to postconf -e input processing.
|
|
|
|
20011221
|
|
|
|
Feature: SMTPD access map lookups of null sender addresses.
|
|
If your access maps cannot store or look up null string
|
|
key values, specify "smtpd_null_access_lookup_key = <>"
|
|
and the null sender address will be looked up as <> instead.
|
|
File: src/smtpd_access.c.
|
|
|
|
20011223
|
|
|
|
Safety: configuration file comments no longer span multiple
|
|
lines when the next line begins with whitespace; multi-line
|
|
input is no longer terminated by a comment line, by an all
|
|
white space line, or by an empty line. Michael Tokarev made
|
|
the crucial suggestion to simplify the readline routine.
|
|
Files: util/readlline.c, postconf/postconf.c.
|
|
|
|
Cleanup: proper detection of big number overflow in EHLO
|
|
and MAIL FROM size announcements, with input from Victor
|
|
Duchovni, Morgan Stanley. Files: global/off_cvt.c,
|
|
smtpd/smtpd.c, smtp/smtp_proto.c, util/alldig.c.
|
|
|
|
Forward compatibility: added queue file record types for
|
|
original recipient and for generic named attributes.
|
|
|
|
Cleanup: safe_open() now returns sensible errno values so
|
|
that the fifo_trigger() external interface is restored.
|
|
|
|
20011225
|
|
|
|
Upgrade: PCRE_README now describes PCRE version 3.x.
|
|
|
|
Cleanup: flush SMTPD command history upon receipt of EHLO,
|
|
RSET, and upon DATA completion, only if it exceeds
|
|
$smtpd_history_flush_threshold lines (default: 100).
|
|
Distant derivative of code by Michael Tokarev. File:
|
|
smtpd/smtpd.c.
|
|
|
|
20011228
|
|
|
|
Bugfix: a readlline() error message showed less text than
|
|
intended. Christian von Roques.
|
|
|
|
Cleanup: postfix now installs with group-writable maildrop
|
|
directory and with a set-gid postdrop mail submission
|
|
command. The pickup service is now unprivileged. The
|
|
world-writable maildrop directory no longer exists.
|
|
|
|
The cleanup service is now public, in preparation for local
|
|
sendmail/postdrop mail submission that avoids the maildrop
|
|
queue directory while Postfix is up.
|
|
|
|
Cleanup: moved the main.cf/master.cf file editing from the
|
|
postfix-script file to the INSTALL.sh file.
|
|
|
|
Cleanup: INSTALL.sh no longer accepts "no" as the destination
|
|
of Postfix manual pages.
|
|
|
|
20011230
|
|
|
|
Cleanup: the code for "mailq", "sendmail -q", and for
|
|
"sendmail -qRsite" was moved from the sendmail command to
|
|
a new set-gid postqueue command. The pickup and qmgr FIFOs
|
|
are no longer world writable. Files: sendmail/sendmail.c,
|
|
postqueue/postqueue.c.
|
|
|
|
20020101
|
|
|
|
Security: new alternate_config_directories parameter that
|
|
specifies what directories a set-gid command will accept
|
|
as its configuration directory. The list must be specified
|
|
in the default main.cf file. File: global/mail_conf.c.
|
|
|
|
Cleanup: "sendmail -qRsite" is no longer implemented by
|
|
connecting to the SMTP port. It is now implemented by
|
|
talking to the fast flush service. File: postqueue/postqueue.c.
|
|
|
|
20020203
|
|
|
|
Cleanup: INSTALL.sh now records all installation information
|
|
in the main.cf file. The now obsolete install.cf file is
|
|
used only when upgrading from an older Postfix release.
|
|
|
|
Cleanup: INSTALL.sh now takes name=value settings on the
|
|
command line, and has a new "-upgrade" command line option
|
|
to turn on non-interactive installation.
|
|
|
|
Security: additional run-time checks to discourage sharing
|
|
of Postfix user/group ID values with other accounts.
|
|
|
|
20020105
|
|
|
|
Cleanup: SMTPD access maps now return DUNNO (undetermined)
|
|
instead of OK when a recipient address contains multiple
|
|
domains (user@dom1@dom2, etcetera). Victor Duchovni, Morgan
|
|
Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
20020106
|
|
|
|
Bugfix: SMTPD access maps did not handle address extensions.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
20020107
|
|
|
|
Bugfix: postfix-script, when creating a missing maildrop
|
|
queue directory, still referenced install.cf when setting
|
|
maildrop directory group ownership; and the postfix command
|
|
did not export the setgid_group parameter to the postfix-script
|
|
shell script. Victor Duchovni.
|
|
|
|
Bugfix: postfix-script, when creating a missing public
|
|
queue directory, did not set group ownership of the public
|
|
directory.
|
|
|
|
20020109
|
|
|
|
Cleanup: rewrote the Postfix installation procedure again.
|
|
It is now separated into 1) a primary installation script
|
|
(postfix-install) that installs files locally or that builds
|
|
a package for distribution and that stores file owner and
|
|
permission information in /etc/postfix/post-files, and 2)
|
|
a post-installation script (/etc/postfix/post-install) that
|
|
creates missing directories, that sets file/directory
|
|
ownership and permissions, and that upgrades existing
|
|
configuration files if necessary.
|
|
|
|
20020110
|
|
|
|
Workaround: AIX null read() return on an empty but open
|
|
non-blocking pipe. File: master/master_flow.c. Report:
|
|
Hamish Marson.
|
|
|
|
20020111
|
|
|
|
Feedback: feedback, bugfixes, and brain-dead shell workarounds
|
|
for the install scripts by Victor Duchovni and Simon Mudd.
|
|
|
|
20020113
|
|
|
|
Rewrote postfix-install. The postfix-files file now controls
|
|
what is installed. Refined the semantics of many post-install
|
|
operations. post-install now auto-saves settings that
|
|
override main.cf.
|
|
|
|
20020114
|
|
|
|
Bugfix: alternate_config_directories did not take comma or
|
|
whitespace as separators. File: global/mail_conf.c. Victor
|
|
Duchovni, Morgan Stanley.
|
|
|
|
Bugfix: the rewritten postfix-install script did not chattr
|
|
+S the Postfix queue.
|
|
|
|
20020115
|
|
|
|
Cleanup: added sample_directory and readme_directory
|
|
installation parameters for sample configuration files and
|
|
for README files. Files: postconf.c, postfix-install,
|
|
conf/postfix-files, conf/post-install.
|
|
|
|
Robustness: the postfix command now exports all installation
|
|
parameter settings, and input filters the environment, so
|
|
that the startup shell scripts produce a consistent result.
|
|
Files: postconf.c.
|
|
|
|
20020117
|
|
|
|
Portability: patch from LaMont Jones for compiling dict_ldap.c
|
|
with the Netscape SDK.
|
|
|
|
Feature: added "r" (recursive chown/chgrp) flag to the
|
|
postfix-files database, for more convenient change of
|
|
Postfix queue ownership. Files: conf/postfix-files,
|
|
conf/post-install.
|
|
|
|
20020122
|
|
|
|
Documentation: lots of little fixes.
|
|
|
|
Documentation: updates for the VIRTUAL_README file by Victor
|
|
Duchovni, Morgan Stanley.
|
|
|
|
Bugfix: postqueue -s dereferenced a null pointer when given
|
|
a numerical domain argument. LaMont Jones, HP.
|
|
|
|
Cleanup: smtpd now logs a warning when permit_sasl_authenticated
|
|
is used while SASL authentication is disabled, instead of
|
|
simply ignoring the restriction. LaMont Jones, HP. File:
|
|
smtpd/smtpd.c.
|
|
|
|
Safety: when postmap creates a non-existent file, the new
|
|
file inherits group/other read permissions from the source
|
|
file. Based on code by LaMont Jones, HP. File:
|
|
postmap/postmap.c.
|
|
|
|
20020123
|
|
|
|
Portability: some Linux systems install libnsl.so without
|
|
libnsl.a file, causing an yp_match undefined reference
|
|
problem. File: makedefs.
|
|
|
|
20020124
|
|
|
|
Portability: post-install now requests that command_directory
|
|
is given on the command line when the postconf command is
|
|
in an unusual place.
|
|
|
|
Safety: extra code to detect and report Berkeley DB version
|
|
mismatches between compile time and run time. This test
|
|
is limited to mismatches in the major version number only.
|
|
File: util/dict_db.c. Based on code by Lawrence Greenfield,
|
|
Carnegie-Mellon university.
|
|
|
|
Safety: the postfix command and the master daemon abort if
|
|
they are running set-uid.
|
|
|
|
Documentation: the postmap manual page described an out of
|
|
date input file format.
|
|
|
|
20020129
|
|
|
|
Workaround: SCO version 3.2 can't ioctl(FIONREAD) a pipe.
|
|
Therefore, input mail flow control is disabled by default.
|
|
Files: makedefs, global/mail_params.h, conf/main.cf.
|
|
Problem reported by Kurt Andersen, Agilent.
|
|
|
|
20020201
|
|
|
|
Workaround: changed the default smtpd_null_access_lookup_key
|
|
setting to <>, because some Bezerkeloid DB implementations
|
|
can't handle null-length lookup keys. File: global/mail_params.h.
|
|
|
|
Bugfix: backed out a null-length address panic call by
|
|
ignoring the problem, like Postfix did in the past. File:
|
|
global/resolve_local.c.
|
|
|
|
Safety: "postfix check" will now warn if /usr/lib/sendmail
|
|
and /usr/sbin/sendmail differ, and will propose to replace
|
|
one by a symlink to the other. File: conf/postfix-script.
|
|
|
|
20020204
|
|
|
|
Sanity: additional permission checks for "postfix check"
|
|
that warn for setgid_group group ownership mismatches. by
|
|
Matthias Andree, uni-dortmund.de. File: conf/postfix-script.
|
|
|
|
Bugfix: "postfix check" used a too simplistic way to
|
|
recognize file ownership (grepping ls output). It now uses
|
|
the recently discovered "find -prune". Peter Bieringer,
|
|
Matthias Andree. File: conf/postfix-script.
|
|
|
|
20020218
|
|
|
|
Workaround: log a warning and disconnect when an SMTP client
|
|
ignores our negative replies and starts sending message
|
|
content without permission. File: smtpd/smtpd.c.
|
|
|
|
20020220
|
|
|
|
Bugfix: mismatch in the file being locked by dict_dbm and
|
|
the file being locked by postmap, so that locks did not
|
|
work correctly. Victor Duchovni, Morgan Stanley.
|
|
|
|
20020222
|
|
|
|
Workaround: Solaris bug 4380626: strcasecmp() and strncasecmp()
|
|
produce incorrect results with 8-bit characters. For example,
|
|
non-ASCII characters could compare equal to ASCII characters,
|
|
and that could result in any number of security problems.
|
|
Files: util/strcasecmp.c, COPYRIGHT (the BSD license).
|
|
|
|
Bugfix: off-by-one error, causing a null byte to be written
|
|
outside dynamically allocated memory in the queue manager
|
|
with addresses of exactly 100 bytes long, resulting in
|
|
SIGSEGV on systems with an "exact fit" malloc routine.
|
|
Experienced by Ralf Hildebrandt; diagnosed by Victor
|
|
Duchovni. Files: *qmgr/qmgr_message.c. This is not a
|
|
security problem.
|
|
|
|
Bugfix: make all recipient comparisons transitive, because
|
|
Solaris qsort() causes SIGSEGV errors otherwise. Victor
|
|
Duchovni, Morgan Stanley. File: *qmgr/qmgr_message.c.
|
|
|
|
20020302
|
|
|
|
Bugfix: don't strip source route (@domain...:) when the
|
|
result would be an empty address. This avoids problems when
|
|
append_at_myorigin is set to "no" (which is not supported).
|
|
Problem reported by Charles McColgan, Big Fish Communications.
|
|
File: trivial-rewrite/rewrite.c.
|
|
|
|
20020304
|
|
|
|
Cleanup: postqueue should not not complain when output
|
|
fails with "broken pipe".
|
|
|
|
20020308
|
|
|
|
Bugfix? reply with 550 not 552 when content is rejected.
|
|
552 is reserved for "too much mail".
|
|
|
|
Documentation: add note to sendmail manual page that running
|
|
"sendmail -bs" as $mail_owner enables SMTP server UCE and
|
|
access control checks. This is meant for use from inetd
|
|
etc. Matthias Andree.
|
|
|
|
20020311
|
|
|
|
Bugfix: DBM maps should use different files for locking
|
|
and for change detection. Problem reported by Victor
|
|
Duchovni, Morgan Stanley. Files: util/dict.h util/dict.c
|
|
util/dict_db.c util/dict_dbm.c global/mkmap.c local/alias.c.
|
|
|
|
20020313
|
|
|
|
Bugfix: mailq could show addresses with unusual characters
|
|
twice. Problem reported by Victor Duchovni, Morgan Stanley.
|
|
File: showq/showq.c.
|
|
|
|
Bugfix: null recipients weren't properly recorded in
|
|
bounce/defer logfiles. Such recipient addresses are not
|
|
accepted in SMTP mail, but they could appear within locally
|
|
submitted mail. File: bounce/bounce_append_service.c.
|
|
|
|
20020318
|
|
|
|
Workaround: Berkeley DB can't handle null key lookups,
|
|
which happen with HELO names ending in ".". Victor Duchovni,
|
|
Morgan Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
Logging: log a hint when mail is deferred because the
|
|
soft_bounce parameter is set. People sometimes forget to
|
|
turn it off. File: global/bounce.c.
|
|
|
|
20020319
|
|
|
|
Cleanup: add a msg_warn() call when fork() fails in
|
|
pipe_command(), to make problems easier to investigate.
|
|
Chris Wedgwood. File: global/pipe_command.c.
|
|
|
|
20020320
|
|
|
|
Feature: smtp_helo_name parameter to specify the hostname
|
|
or [ip.address] in HELO or EHLO commands. Files: smtp/smtp.c
|
|
smtp/smtp_proto.c.
|
|
|
|
20020324
|
|
|
|
Cleanup: more graceful handling of long physical message
|
|
header lines upon input. Physical header lines can now
|
|
extend up to $header_size_limit characters. When a logical
|
|
message header is too long, the excess text is discarded
|
|
and Postfix no longer switches to body mode, to avoid
|
|
breaking MIME encapsulation. Based on code by Victor
|
|
Duchovni, Morgan Stanley. Files: cleanup/cleanup_out.c,
|
|
cleanup/cleanup_message.c.
|
|
|
|
Cleanup: more graceful handling of long physical message
|
|
header or body lines upon output by the SMTP client. The
|
|
SMTP client output line length is controlled by a new
|
|
parameter smtp_line_length_limit (default: 990; specify 0
|
|
to disable the limit). Long lines are folded by inserting
|
|
<CR> <LF> <SPACE>, to avoid breaking MIME encapsulation.
|
|
Based on code by Victor Duchovni, Morgan Stanley. File:
|
|
smtp/smtp_proto.c.
|
|
|
|
20020325
|
|
|
|
Cleanup: allow additional text after a WARN command in a
|
|
header/body_checks pattern file, so that one can change
|
|
REJECT+text into WARN+text and vice versa. Based on code
|
|
by Fredrik Thulin, Stockholm University.
|
|
|
|
Cleanup: log a warning when an unknown command is found in
|
|
a header/body_checks pattern file, or when additional text
|
|
is found after a command that does not expect additional
|
|
text. Based on code by Fredrik Thulin, Stockholm University.
|
|
|
|
Bugfix: sendmail should not recognize "." as the end of
|
|
input when the current read operation started in the middle
|
|
of a line. Victor Duchovni, Morgan Stanley. File:
|
|
sendmail/sendmail.c.
|
|
|
|
20020328
|
|
|
|
Portability fix for OPENSTEP and NEXTSTEP by Gerben Wierda.
|
|
File: util/sys_defs.h.
|
|
|
|
20020329
|
|
|
|
Bugfix: defer_transports broke because the flush server
|
|
triggered mail delivery (as if ETRN was sent) while doing
|
|
some internal housekeeping of per-destination logfiles.
|
|
Problem experienced by LaMont Jones, HP. File: flush/flush.c.
|
|
|
|
Bugfix: virtual mapping broke for addresses with embedded
|
|
whitespace. Fix by Victor Duchovni, Morgan Stanley. File:
|
|
cleanup/cleanup_map1n.c.
|
|
|
|
Feature: configurable service name for the internal services:
|
|
bounce, cleanup, defer, error, flush, pickup, queue, rewrite,
|
|
showq. This allows you to specify, for example, a non-default
|
|
cleanup service (smtpd -o cleanup_service_name=alt_cleanup).
|
|
Files: global/mail_params.[hc].
|
|
|
|
Feature: SASL version 2 support by Jason Hoos. Files:
|
|
*/*_sasl_glue.c, SASL_README, conf/sample-auth.cf.
|
|
|
|
20020330
|
|
|
|
Bugfix: postqueue did not pass on non-default configuration
|
|
directory settings when running showq while the mail system
|
|
is down. The super-user is now exempted from environment
|
|
stripping in postqueue/postqueue.c. Problem reported by
|
|
Victor Duchovni, Morgan Stanley.
|
|
|
|
20020402
|
|
|
|
Workaround: recognize more headers that are sent instead
|
|
of SMTP commands. File: smtpd/smtpd.c.
|
|
|
|
20020413
|
|
|
|
Feature: new pipe delivery agent "D" flag to prepend a
|
|
Delivered-To: message header. This requires single recipient
|
|
deliveries. Based on code by Matthias Andree. File:
|
|
pipe/pipe.c.
|
|
|
|
20020414
|
|
|
|
Portability: Postfix will no longer attempt to build with
|
|
gdbm support, because gdbm is broken. File: makedefs.
|
|
|
|
20020415
|
|
|
|
Cleanup: the attribute list IPC code did not distinguish
|
|
between "disconnect" and "timeout" while reading an attribute
|
|
list, making trouble shooting more difficult than necessary.
|
|
Files: util/attr_scan0.c, util/attr_scan64.c.
|
|
|
|
Cleanup: install parameter defaults can now be overruled
|
|
from makedefs: sendmail_path, mailq_path, newaliases_path,
|
|
command_directory, daemon_directory. Based on code by Victor
|
|
Duchovni, Morgan Stanley. File: util/sys_defs.h.
|
|
|
|
20020411
|
|
|
|
Cleanup: Use more robust quoting passing makedefs/Makefile
|
|
settings. This also simplifies the seven backslashes example
|
|
in the INSTALL file. Victor Duchovni, Morgan Stanley.
|
|
Files: makedefs, INSTALL.
|
|
|
|
20020417
|
|
|
|
Bugfix: the post-install script failed to upgrade master.cf
|
|
settings from private to public if the service was explicitly
|
|
configured as private.
|
|
|
|
20020418
|
|
|
|
Documentation: added CPU saving patterns for quickly skipping
|
|
base 64 encoded text in message bodies. Liviu Daia. Files:
|
|
{proto,conf}/pcre_table, {proto,conf}/regexp_table,
|
|
conf/sample_{regexp,pcre}_body.cf.
|
|
|
|
20020426
|
|
|
|
Bugfix: the SMTP client forgot to quote whitespace etc.
|
|
in a sender/recipient address when DNS lookup was turned
|
|
off (disable_dns_lookups = yes). Problem experienced by
|
|
Chip Paswater. Files: smtp/smtp_proto.c.
|
|
|
|
20020501
|
|
|
|
Feature: wildcard lookup in transport maps (lookup key
|
|
"*"). Code developed with Lamont Jones, HP.
|
|
|
|
Feature: a null transport:destination transport map entry
|
|
means proceed as if the transport map lookup failed. Code
|
|
developed with Lamont Jones, HP.
|
|
|
|
Feature: more efficient use of cache memory when a process
|
|
opens multiple Berkeley DB tables; and faster performance
|
|
creating large tables by using more buffer memory. Files:
|
|
util/dict_db.[hc], global/mkmap_db.c. Victor Duchovni,
|
|
Morgan Stanley.
|
|
|
|
20020503
|
|
|
|
Cleanup: postqueue silently ignored command-line arguments
|
|
following -p or -f options, instead of complaining; postqueue
|
|
produced an incorrect error message (mail system down) when
|
|
the command was installed with incorrect privileges. File:
|
|
postqueue/postqueue.c.
|
|
|
|
Bugfix: while reporting a domain name or IP address syntax
|
|
error, postqueue could dereference a dangling pointer with
|
|
some getopt() implementations. LaMont Jones, HP. File:
|
|
postqueue/postqueue.c.
|
|
|
|
Safety: postalias and postmap now drop root privileges
|
|
while processing a non-root input file. Thus, the result
|
|
should be writable to the source file owner. Specify the
|
|
-o option if this is a problem. Files: postmap/postmap.c,
|
|
postalias/postalias.c.
|
|
|
|
Consistency: just like postmap, postalias now copies file
|
|
permissions from the source file when it creates a new
|
|
table for the first time. File: postalias/postalias.c.
|
|
|
|
20020504
|
|
|
|
Portability: run-time test to avoid GDBM trouble. File:
|
|
util/dict_dbm.c.
|
|
|
|
20020505
|
|
|
|
Cleanup: revised and simplified the transport map semantics.
|
|
Null transport or nexhop fields now mean: "do not change":
|
|
use what would be used if the transport map did not exist.
|
|
This change eliminated a lot of code. The incompatibility
|
|
is that a null transport field no longer defaults to
|
|
$default_transport, but to $local_transport or $default_transport
|
|
depending on the destination, and that a transport map only
|
|
overrides relayhost when the table specifies explicit
|
|
nexthop information. Files: trivial-rewrite/transport.c,
|
|
trivial-rewrite/resolve.c.
|
|
|
|
Cleanup: revised the user interface for controlling the
|
|
Berkeley DB create and read buffer size controls. Files:
|
|
util/dict_db.[hc], global/mail_params.[hc], global/mkmap_db.c.
|
|
|
|
20020507
|
|
|
|
Cleanup: simplified the hash/btree cache management code.
|
|
The caches are now per table instead of shared, and the
|
|
default read cache size is reduced to 128 kBytes. File:
|
|
util/dict_db.c.
|
|
|
|
20020508
|
|
|
|
Bugfix: close user@domain@postfix-style.virtual.domain
|
|
source routing relaying loophole involving postfix-style
|
|
virtual domains with @virtual.domain catch-all patterns.
|
|
Problem reported by Victor Duchovni. File: smtpd/smtpd_check.c.
|
|
|
|
Bugfix: mail_addr_map() used the "wrong" @ character in
|
|
addresses with multiple @. Victor Duchovni. File:
|
|
global/mail_addr_map.c.
|
|
|
|
Bugfix: for address localpart quoting, now quote @ as a
|
|
special character everywhere, except when resolving addresses.
|
|
Previously, the @ was nowhere quoted as a special character,
|
|
not even in SMTP commands. Files: global/quote_82[12]_local.c
|
|
and clients.
|
|
|
|
20020509
|
|
|
|
Safety: don't allow an OK access rule lookup result for
|
|
user@domain@postfix-style.virtual.domain. Suggested by
|
|
Victor Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
Bugfix: quote unquoted address localparts that need quoting.
|
|
Files: global/tok822_parse.c, global/quote_82[12]_local.c.
|
|
|
|
Documentation: simplified the advanced content filtering
|
|
example, and included a more advanced example for those
|
|
who want to squeeze out more performance without running
|
|
multiple Postfix instances. Text by Victor Duchovni, Morgan
|
|
Stanley. File: README_FILES/FILTER_README.
|
|
|
|
20020510
|
|
|
|
Feature: header/body filters now log the origin of the
|
|
message that is being rejected. Files: smtpd/smtpd.c,
|
|
qmqpd/qmqpd.c, pickup/pickup.c, cleanup/cleanup_envelope.c,
|
|
cleanup/cleanup_message.c. Requested by Craig Sanders, if
|
|
I remember correctly.
|
|
|
|
Feature: the Postfix SMTP client now passes on MIME body
|
|
type information (8bit, 7bit) received via SMTP, via MIME
|
|
headers, or via the sendmail command line. Files:
|
|
global/deliver_request.c, smtpd/smtpd.c, sendmail/sendmail.c,
|
|
cleanup/cleanup_envelope.c, cleanup/cleanup_message.c,
|
|
cleanup/cleanup_extracted.c, *qmgr/qmgr_message.c,
|
|
*qmgr/qmgr_deliver.c, smtp/smtp_proto.c, lmtp/lmtp_proto.c.
|
|
|
|
20020511
|
|
|
|
Feature: bounces now specify the proper MIME encoding (8bit,
|
|
7bit), depending on the MIME body type information received
|
|
via SMTP, via MIME headers, or via the sendmail command
|
|
line. Files: global/bounce.c, global/defer.c, global/abounce.c,
|
|
bounce/bounce_service.c, bounce/bounce_notify_util.c.
|
|
|
|
20020512
|
|
|
|
Cleanup: the SMTP client logged and bounced the CNAME
|
|
expanded recipient address, and thereby complicated trouble
|
|
shooting. File: src/smtp_proto.c.
|
|
|
|
Bugfix: the SMTP and LMTP clients bounced the quoted
|
|
recipient address, resulting in too much quoting in bounce
|
|
reports. Files: src/smtp_proto.c, lmtp/lmtp_proto.c.
|
|
|
|
20020513
|
|
|
|
Bugfix: the LDAP client used the "wrong" @ character in
|
|
addresses with multiple @. LaMont Jones, HP. File:
|
|
util/dict_ldap.c.
|
|
|
|
Feature: lots of new LDAP stuff: result_filter (filter to
|
|
expand results from queries), chase_referrals, LaMont Jones,
|
|
HP. The LDAP bind timeout now works thanks to Victor
|
|
Duchovni, Morgan Stanley. File: util/dict_ldap.c.
|
|
|
|
Cleanup: specify "resolve_dequoted_address = no" to prevent
|
|
Postfix from looking inside quotes for extra @ etc. characters
|
|
when resolving an address. This behavior is technically
|
|
more correct, but it opens a mail relay loophole with "user
|
|
@domain"@domain when relaying mail to a Sendmail system.
|
|
|
|
20020514
|
|
|
|
Bugfix: the new code for header address quoting sometimes
|
|
did not null terminate strings so that arbitrary garbage
|
|
could appear at the end of message headers. Reported by
|
|
Ralf Hildebrandt. File: global/tok822_parse.c.
|
|
|
|
Safety: user@domain@domain is no longer accepted by the
|
|
permit_mx_backup uce restriction (unless Postfix is configured
|
|
with "resolve_dequoted_address = no"). Victor Duchovni,
|
|
Morgan Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
20020515
|
|
|
|
Workaround: flush the SMTP client output buffer when no
|
|
output has happened for 10+ seconds. This prevents the
|
|
socket from timing out, in case DNS CNAME expansion is
|
|
slow. Problem experienced by Alex Erdelyi, peregrine.com.
|
|
File: smtp/smtp_chat.c. We did the same thing for the SMTP
|
|
server years ago, and one wonders why the coin didn't drop
|
|
at the time that the SMTP client could suffer from a similar
|
|
problem.
|
|
|
|
20020516
|
|
|
|
Updated the FILTER_README file to turn off DNS lookups in
|
|
the SMTP client that feeds mail into a content filter.
|
|
|
|
20020517
|
|
|
|
Cleanup: Mailbox-Line: message header labels should be
|
|
X-Mailbox-Line: labels. Files: smtpd/smtpd.c, qmqpd/qmqpd.c.
|
|
|
|
20020515-21
|
|
|
|
Feature: new MIME parser, written from scratch, that
|
|
recognizes the structure of MIME encapsulated mail. Influenced
|
|
by comments from Victor Duchovni. This code can detect but
|
|
will not decode obscure MIME formats or obscure character
|
|
string encoding that Liviu Daia expresses concern about.
|
|
|
|
MIME header scanning now happens in header_checks, and is
|
|
faster than body_checks could ever be. This also eliminates
|
|
the problem with multi-line MIME headers being matched one
|
|
line at a time. Files: global/mime_state.[hc],
|
|
cleanup/cleanup_message.c.
|
|
|
|
20020521-22
|
|
|
|
Feature: 8-bit to quoted-printable conversion. First use
|
|
in the Postfix SMTP client. File: smtp/smtp_proto.c.
|
|
|
|
Logging: the Postfix SMTP and LMTP clients now report the
|
|
the protocol stage when they report a server reply. File:
|
|
smtp/smtp_proto.c, lmtp/lmtp_proto.c.
|
|
|
|
Bugfix: the SMTP server warned about ignored client attributes
|
|
(these were introduced 20020510) in mail that was submitted
|
|
with "sendmail -bs". File: smtpd/smtpd.c.
|
|
|
|
20020525
|
|
|
|
Feature: separation of header checks into header_checks
|
|
(all primary headers except MIME related headers),
|
|
mime_header_checks (all MIME headers including MIME headers
|
|
at the start of messages) and nested_header_checks (headers
|
|
of attached messages, except MIME related headers).
|
|
|
|
Cleanup: broke out the header value parser from the MIME
|
|
processor so that the code can be reused elsewhere. File:
|
|
global/header_token.c.
|
|
|
|
Compatibility: Postfix now recognizes "name :" as a valid
|
|
message header, but normalizes it to "name:" form or else
|
|
lots of things would break all over the place. Files:
|
|
global/is_header.c, global/mime_state.c.
|
|
|
|
20020526
|
|
|
|
Bugfix: the SMTP server now disallows RCPT TO:<"">, just
|
|
like it disallows RCPT TO:<>. File: smtpd/smtpd.c.
|
|
|
|
Feature: disable_mime_input_processing=yes/no controls
|
|
whether Postfix recognizes (and optionally enforces) MIME
|
|
formats while receiving mail. Default is NO.
|
|
|
|
Feature: disable_mime_output_conversion=yes/no controls
|
|
whether Postfix will convert 8BITMIME to 7BIT mail when
|
|
delivering mail to an SMTP server that does not announce
|
|
8BITMIME support. Default is NO.
|
|
|
|
Feature: strict_8bitmime=yes/no controls whether Postfix
|
|
rejects 8-bit characters in headers and 7-bit body parts.
|
|
This blocks mail from poorly written software, including
|
|
majordomo approval requests that contain a valid 8BITMIME
|
|
email message, as well as mail that is piped into ancient
|
|
/bin/mail implementations that do not MIME format 8-bit
|
|
content. Default is NO.
|
|
|
|
Feature: strict_mime_encoding_domain=yes/no controls whether
|
|
Postfix rejects illegal content transfer encodings for
|
|
multipart/* and message/*. This blocks mail from poorly
|
|
written software. Default is NO.
|
|
|
|
20020527
|
|
|
|
Feature: "FILTER transport:nexthop" in header/body checks.
|
|
After the message is queued, the message is sent through
|
|
a content filter. This requires different cleanup servers
|
|
before and after the filter, with header/body checks turned
|
|
off in the second cleanup server.
|
|
|
|
20020528
|
|
|
|
Feature: strict_7bit_headers and strict_8bitmime_body are
|
|
now separately available. To to turn on both, use
|
|
strict_8bitmime.
|
|
|
|
Cleanup: abandon the use of isspace(3) in the parsing of
|
|
RFC822 message headers. Files: global/lex_822.h and lots
|
|
of little places.
|
|
|
|
Documentation: replace domain.name by domain.tld in the
|
|
example config files. The domain exists. They were getting
|
|
mail from poorly configured Postfix boxes.
|
|
|
|
Bugfix: The Postfix sendmail command did not export the
|
|
MAIL_CONFIG environment setting to the postdrop command.
|
|
File: global/mail_config.h.
|
|
|
|
Incompatibility: by default, turn on the PCRE_DOTALL flag,
|
|
so that PCRE patterns will match multi-line message headers
|
|
without causing pain. Suggested by Michael Tokarev. Also
|
|
documented all those darned undocumented PCRE flags in the
|
|
pcre_table(5) manual page. Files: util/dict_pcre.c,
|
|
proto/pcre_table.
|
|
|
|
20020529
|
|
|
|
Bugfix: mail rejected due to MIME errors was rejected
|
|
without proper logging. Files: global/mime_state.c,
|
|
cleanup/cleanup_message.c.
|
|
|
|
20020531
|
|
|
|
Bugfix: the SMTP client code that prepends '.' to lines
|
|
starting with '.' had to be moved from its old place to
|
|
after the MIME output conversion. Problem found by Mark
|
|
Martinec. File: smtp/smtp_proto.c.
|
|
|
|
20020601
|
|
|
|
Bugfix: the deliver_pass() routine needed updating for the
|
|
extra MIME encoding attribute that was introduced 20020510.
|
|
Patch by Sebastian Schaffert @ wastl.net. File:
|
|
global/deliver_pass.c.
|
|
|
|
20020604
|
|
|
|
Workaround: Solaris non-blocking read() can fail on a socket
|
|
with unread data according to ioctl FIONREAD. Incredible.
|
|
Diagnosis by Max Pashkov. File: smtp/smtp-sink.c.
|
|
|
|
Weird feature: sender-based routing. This will become more
|
|
useful once per-address transport map entries are done.
|
|
File: src/*qmgr/qmgr_message.c.
|
|
|
|
20020605
|
|
|
|
Safety: header_address_token_limit limits the amount of
|
|
memory and CPU that we're willing to spend while parsing
|
|
addresses in message headers. The limit is expressed as a
|
|
number of tokens. File: global/tok822_parse.c
|
|
|
|
20020608
|
|
|
|
Feature: user@domain transport map lookup, based on code
|
|
by Scott Cotton, from several years ago. Adding this code
|
|
now was much less painful than it was in the past. Files:
|
|
global/strip_addr.c, trivial-rewrite/transport.c.
|
|
|
|
20020610
|
|
|
|
Cleanup: making user@domain transport map lookups work with
|
|
sender-based routing was a bit tricky, because the null
|
|
address must be handled sensibly. Files: global/resolve_clnt.c,
|
|
trivial-rewrite/resolve.c. It ain't perfect yet, but close.
|
|
|
|
20020613
|
|
|
|
Bugfix: postsuper -r was broken as of 20020510. The cleanup
|
|
daemon would discard mail with MIME type information. Moved
|
|
a bunch of sanity checks from the cleanup daemon to the
|
|
pickup daemon, so the checks are in one place. Problem
|
|
experienced by Pavol Luptak. Files: pickup/pickup.c,
|
|
cleanup/cleanup_extracted.c.
|
|
|
|
20020705
|
|
|
|
Safety: log a warning when a domain is listed in mydestination
|
|
and (virtual_maps or virtual_mailbox_maps). This configuration
|
|
error causes the Postfix SMTP server to reject recipients
|
|
when the local_recipient_maps feature is enabled. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
200207011
|
|
|
|
Portability: in the master daemon, the default now is to
|
|
enable the signal handler code that writes a byte into a
|
|
pipe, instead of the signal handler code that sets a global
|
|
flag and hopes that select() will somehow wake up. File:
|
|
master/master_sig.c. This is needed for some IRIX and
|
|
UnixWare versions, but it should also produce a robust
|
|
result on all other supported systems.
|
|
|
|
Performance: the default SMTP connection establishment
|
|
timeout is now 30 seconds, instead of the system default
|
|
which can be atrociously large.
|
|
|
|
20020712
|
|
|
|
When DNS lookup fails while delivering mail, report not
|
|
only the domain name but also the DNS record type. This
|
|
should clue in people who ask why Postfix can't find a
|
|
domain while nslookup can. File: dns/dns_lookup.c.
|
|
|
|
20020713
|
|
|
|
Bugfix: undo change made at 20020610 that causes the trivial
|
|
resolver client to loop when an address consists entirely
|
|
of @ and . characters. File: trivial-rewrite/resolve.c.
|
|
|
|
Cleanup: Postfix no longer strips multiple '.' at the end
|
|
of a domain name. One '.' is silently tolerated. Files:
|
|
trivial-rewrite/rewrite.c, trivial-rewrite/resolve.c,
|
|
global/resolve_local.c. This policy is too distributed.
|
|
|
|
20020715
|
|
|
|
Feature: @domain.tld catch-all map entries for the virtual
|
|
mail delivery agent. Files: global/virtual8_maps_find.c,
|
|
virtual/mailbox.c, smtpd/smtpd_check.c.
|
|
|
|
Feature: the virtual mail delivery agent now accepts address
|
|
extensions (user+foo@domain.tld), ignores them when looking
|
|
up users in its tables, but displays them in Delivered-To:
|
|
message headers. File: global/virtual8_maps_find.c.
|
|
|
|
20020716
|
|
|
|
Feature: domain names in a masquerade_domains list can now
|
|
be prefixed with !, in order to disable masquerading for
|
|
that domain name and for its subdomains. File:
|
|
cleanup/cleanup_masquerade.c.
|
|
|
|
20020717
|
|
|
|
Bugfix: Mac OS X niscript (Netinfo) update by Gerben Wierda.
|
|
File: auxiliary/MacOSX/niscript.
|
|
|
|
Feature: The SMTP server reject_unknown_whatever restrictions
|
|
now also attempt to look up AAAA (IPV6 address) records.
|
|
Jun-ichiro itojun Hagino, IIJ labs. Files: smtpd/smtpd_check.c,
|
|
dns/dns_lookup.c.
|
|
|
|
20020718
|
|
|
|
Bugfix: unnecessary lookups for extended addresses by the
|
|
virtual8_maps_find() routine. Victor Duchovni. His patch
|
|
did not work, nor did my own, but the present version should
|
|
be OK. File: global/virtual8_maps_find.c.
|
|
|
|
20020719
|
|
|
|
Workaround: log a warning when an SMTP client name->address
|
|
lookup results in a numeric IP address, and set the client
|
|
hostname to "unknown". Some gethostbyname() implementations
|
|
will actually accept such garbage and thereby allow sites
|
|
to defeat the "reject_unknown_client" restriction. Problem
|
|
reported by Wolfgang Rupprecht, fix based on analysis (but
|
|
not code) by Victor Duchovni.
|
|
|
|
Bugfix: memory leaks in the LDAP client by Victor Duchovni.
|
|
File: util/dict_ldap.c.
|
|
|
|
Bugfix: garbage in verbose "flush" server logging. Victor
|
|
Duchovni. File: flush/flush.c.
|
|
|
|
20020723
|
|
|
|
Incompatibility: smtpd_sasl_local_domain now defaults to
|
|
the null string. File: smtpd/smtpd.c, smtpd/smtpd_sasl_glue.c.
|
|
|
|
20020726
|
|
|
|
Documentation: added GDB debugging instructions for sites
|
|
that do not have X installed on the Postfix machine. Henrik
|
|
Larsson, spambox.dk.
|
|
|
|
20020729
|
|
|
|
Weird: installed RedHat 3.03 inside VMware, and no change
|
|
was needed to build Postfix, except to recognize the Linux
|
|
version.
|
|
|
|
Bugfix: some mailers will announce ESMTP features in their
|
|
HELO (not EHLO) response. Postfix did not ignore them.
|
|
File: smtp/smtp_proto.c.
|
|
|
|
20020731
|
|
|
|
Cleanup: permit_naked_ip_address is unsafe (especially when
|
|
used with smtpd_recipient_restrictions) and will go away.
|
|
Postfix now logs a warning. File: smtpd/smtpd_check.c.
|
|
|
|
20020801
|
|
|
|
Cleanup: the warning message for matched header/body content
|
|
was misleading. File: cleanup/cleanup_message.c.
|
|
|
|
Safety: moved the "postsuper -r ALL" operation after the
|
|
"postsuper -s" check that makes queue file names match
|
|
inode numbers. This avoids loss of mail in the unlikely
|
|
case that someone runs "postsuper -sr ALL" on a queue that
|
|
was copied from another place.
|
|
|
|
Feature: "postsuper -h" to put mail "on hold" and "postsuper
|
|
-H" to release mail that was placed "on hold". This involves
|
|
a new queue, which is appropriately named "hold". Files:
|
|
postsuper/postsuper.c, showq/showq.c.
|
|
|
|
20020803
|
|
|
|
Feature: when a Delivered-To: mail delivery loop is detected,
|
|
send the bounce to the mailing list owner. This required
|
|
changes to the local delivery agent, a new bounce client
|
|
stub, and a new bounce server stub and support routines
|
|
for one recipient bouncing. Files: local/recipient.c,
|
|
global/bounce_log.c, global/bounce.c, bounce/bounce.c,
|
|
bounce/bounce_notify_util.c, bounce/bounce_one_service.c.
|
|
|
|
20020809
|
|
|
|
Bugfix: the 20020531 bugfix could prepend '.' to lines when
|
|
it shouldn't (but only when converting 8-bit mail to 7-bit).
|
|
Problem experienced by Ralf Hildebrandt. File:
|
|
smtp/smtp_proto.c.
|
|
|
|
Bugfix: smtpd_sender_login_maps did not do the @domain etc.
|
|
wild-card lookups that were promised. Problem experienced
|
|
by Sven Michels. File: smtpd/smtpd_check.c.
|
|
|
|
20020810
|
|
|
|
Feature: new smtp-sink command-line options to specify the
|
|
SMTP hostname, to disable ESMTP protocol support, to disable
|
|
8BITMIME support, and to syslog selected commands. File:
|
|
smtpstone/smtp-sink.c.
|
|
|
|
20020814
|
|
|
|
Feature: the queue manager now warns when mail for some
|
|
destination is piling up in the active queue, and suggests
|
|
a variety of remedies. The qmgr_clog_warn_time parameter
|
|
controls the time between warnings, mainly so that I could
|
|
test the code. To disable these warnings, specify
|
|
"qmgr_clog_warn_time = 0". Files: *qmgr/qmgr_entry.c.
|
|
|
|
20020815
|
|
|
|
Paranoia: truncate the DNS response length result value in
|
|
case it is larger than the result buffer length (the resolver
|
|
documentation is vague about this). File: dns/dns_lookup.c.
|
|
|
|
20020816
|
|
|
|
Cleanup: "postqueue -f" now also triggers delivery of mail
|
|
in the maildrop directory. This is needed when the master
|
|
does not frequently wake up the pickup service. Files:
|
|
global/mail_flush.c, postqueue/postqueue.c.
|
|
|
|
20020818
|
|
|
|
Cleanup: the qmgr_site_hog_factor feature is gone (defer
|
|
mail if a site uses up too much space in the active queue).
|
|
Instead, the qmgr_clog_warn_time feature provides better
|
|
solutions. File: qmgr/qmgr_message.c.
|
|
|
|
20020819
|
|
|
|
Feature: new header/body_checks HOLD pattern that causes
|
|
mail to be placed on the "hold" queue for manual inspection.
|
|
Files: global/hold_message.[hc], cleanup/cleanup_message.c.
|
|
|
|
20020820
|
|
|
|
Bugfix: yesterday's HOLD pattern code did not update the
|
|
cleanup server's idea of the queue file name for error
|
|
recovery and for error reporting purposes, so that incomplete
|
|
or content rejected mail would not be deleted from the
|
|
queue, and so that the bouncer would not find the queue
|
|
file.
|
|
|
|
Bugfix: the #ifdef that detects too old LDAP libraries was
|
|
in the wrong place. Victor Duchovni. File: util/dict_ldap.c.
|
|
|
|
Feature: new header/body_checks DISCARD pattern that causes
|
|
mail to be silently discarded. Files: global/cleanup_user.h,
|
|
cleanup/cleanup_message.c, cleanup/cleanup_api.c.
|
|
|
|
Bugfix: the local delivery agent's mailbox duplicate delivery
|
|
eliminator was not updated in the days that address extensions
|
|
were added to Postfix. The other local duplicate eliminators
|
|
probably need revision as well. File: local/mailbox.c.
|
|
|
|
20020821
|
|
|
|
Feature: HOLD and DISCARD actions in SMTPD access tables.
|
|
These requests are propagated to the cleanup daemon. Files:
|
|
cleanup/cleanup_envelope.c smtpd/smtpd_check.c.
|
|
|
|
Cleanup: eliminate unnecessary references to the obsolete
|
|
program_directory configuration parameter (but keep the
|
|
parameter so as to not break existing installations).
|
|
Matthias Andree, many little changes in documentation.
|
|
|
|
20020822
|
|
|
|
Bit Rot: OpenLDAP incompatible change with URL parsing.
|
|
Patches by Will Day, Georgia Tech, and Carsten Hoeger,
|
|
SUSE. File: util/dict_ldap.c.
|
|
|
|
20020823
|
|
|
|
Bugfix: added a missing memset() call to wipe the lookup
|
|
key in dict_db_delete(). This is needed by some Berkeley
|
|
DB implementations. Patch by Katsu Yamamoto, Fujitsu.
|
|
|
|
Bugfix: when permit_mx_backup is unable to make a decision
|
|
due to DNS problems, set the "defer if reject" flag so that
|
|
other restrictions will not cause mail to be rejected.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
Feature: instead of giving up immediately after DNS failure,
|
|
turn on the "defer_if_permit" flag when reject_unknown_hostname,
|
|
reject_unknown_sender_domain or reject_unknown_recipient_domain
|
|
are unable to make a decision, and see if any subsequent
|
|
restrictions would still cause the mail to be rejected.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
Feature: "FILTER transport:nexthop" is now also available
|
|
in SMTPD access tables.
|
|
|
|
20020826
|
|
|
|
Workaround: HP-UX 11 accept() fails with ENOBUFS when the
|
|
client disconnects early. File: sane_accept.c.
|
|
|
|
20020901
|
|
|
|
Cleanup: postfix-install no longer installs all the manual
|
|
pages under $POSTFIXSOURCE/man, so we can generate manual
|
|
pages for smtp-sink etc. File: man/Makefile.in.
|
|
|
|
20020903
|
|
|
|
Bugfix: the rmail script should have been updated when
|
|
Postfix sendmail was changed to recognize `.' as the end
|
|
of input. Problem fix by Christian Kratzer, cksoft.de.
|
|
File: auxiliary/rmail/rmail.
|
|
|
|
Feature: specify "maximal_queue_lifetime = 0" for mail that
|
|
should be returned immediately after the first unsuccessful
|
|
delivery attempt. Files: qmgr/qmgr.c, nqmgr/nqmgr.c.
|
|
|
|
20020904
|
|
|
|
Bugfix: qmail compatibility: qmqpd should support any
|
|
character at the end of the VERP prefix in prefix@host-@[].
|
|
Based on a patch by LaMont Jones, HP.
|
|
|
|
20020905
|
|
|
|
Feature: "smtpd_data_restrictions = reject_unauth_pipelining"
|
|
blocks mail from SMTP clients that send message content
|
|
before Postfix has replied to the DATA command. File:
|
|
smtpd/smtpd.c, smtpd/smtpd_check.c.
|
|
|
|
Bugfix: the LDAP client dumped core in verbose mode.
|
|
Reported by Will Day and others. File: util/dict_ldap.c.
|
|
|
|
20020906
|
|
|
|
Cleanup: dict_regexp module speedups by avoiding unnecessary
|
|
substring overhead while matching strings. Based on a
|
|
suggestion by Liviu Daia. This involved major rewriting of
|
|
the regexp map code. File: util/dict_regexp.c.
|
|
|
|
20020907
|
|
|
|
Feature: IF..ENDIF support based on code by Bert Driehuis.
|
|
This involved a further rewrite of the regexp map code.
|
|
File: util/dict_regexp.c.
|
|
|
|
200209010
|
|
|
|
Bugfix: the SMTP client produced suprious warnings about
|
|
trouble with fallback_relay hosts. File: smtp/smtp_connect.c.
|
|
|
|
Robustness: don't wait with detecting broken SMTP connections
|
|
until reading input. Leandro Santi. File: smtpd/smtpd_chat.c.
|
|
|
|
200209011
|
|
|
|
Workaround: IRIX 6 can't do ioctl FIONREAD on pipes. This
|
|
breaks the in_flow_delay feature. File: util/sys_defs.h.
|
|
|
|
20020912
|
|
|
|
Bugfix: canonical/virtual mapping core dump with a null
|
|
right-hand side address. Report by Jussi Silvennoinen.
|
|
File: global/mail-addr_crunch.c.
|
|
|
|
Feature: IF..ENDIF support based on code by Bert Driehuis.
|
|
This involved a rewrite of the pcre map code similar to
|
|
the regexp map code. File: util/dict_pcre.c.
|
|
|
|
20020917
|
|
|
|
Feature: on Linux, support for PCRE lookup tables is now
|
|
compiled in if the PCRE library code is found under
|
|
/usr/include and /usr/lib. File: makedefs.
|
|
|
|
20020918
|
|
|
|
Documentation: postsuper(1) did not document the -c option.
|
|
|
|
Bugfix: possible longjump() before setjmp(). File:
|
|
smtpd/smtpd.c.
|
|
|
|
Bugfix: pickup should not preserve INSPECT or FILTER records
|
|
from "postsuper -r". File: pickup/pickup.c.
|
|
|
|
20020919
|
|
|
|
Feature: "reject_rbl <domain>" for client address blacklisting
|
|
by LaMont Jones, including $name expansion for per-domain
|
|
customized response messages. The obsolete reject_maps_rbl
|
|
is now a wrapper that uses the new code.
|
|
|
|
20020921
|
|
|
|
Internal: added caching and factored out common code that
|
|
will be used for both reject_rbl and for the upcoming
|
|
reject_rhsbl restriction.
|
|
|
|
20020922
|
|
|
|
Feature: "reject_rhsbl <domain>" for sender domain
|
|
blacklisting. Provides the same per-domain customized
|
|
response message mechanisms with $name expansion as
|
|
reject_rbl.
|
|
|
|
Safety: the smtpd_expansion_filter parameter controls what
|
|
characters are allowed in the expansion of $name macros in
|
|
template RBL responses.
|
|
|
|
Cleanup. In order to make sensible warnings possible when
|
|
expanding a non-existent $name in RBL reply templates,
|
|
mac_expand() had to be changed so that an empty string
|
|
result (i.e. the name does exist) will no longer cause
|
|
${name?text} to succeed. File: util/mac_expand.c.
|
|
|
|
20020923
|
|
|
|
Cleanup. Renamed the RBL features according to a scheme
|
|
that was suggested by Liviu Daia in October 2001. The names
|
|
are reject_rbl_client and reject_rhsbl_sender, respectively.
|
|
Added domain name based reject_rhsbl_client and
|
|
reject_rhsbl_recipient restrictions for completeness. The
|
|
reject_rbl restriction name is still recognized for
|
|
compatibility with systems maintained by LaMont Jones.
|
|
|
|
20020924
|
|
|
|
Bugfix: reject_rhsbl_<mumble> was broken when <mumble> was
|
|
unavailable, causing the restrictions parser to get out if
|
|
sync. Spotted by Ralf Hildebrandt. File: smtpd/smtpd_check.c.
|
|
|
|
20020928
|
|
|
|
Bugfix: missing %s in the 20020923 RBL code. This was not
|
|
exploitable because Postfix implements only a safe subset
|
|
of all printf format operators and because memory for the
|
|
result is dynamically allocated. Victor Duchovni. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
20020929
|
|
|
|
Updated MacOSX support scripts from Gerben Wierda. Files:
|
|
auxiliary/MacOSX/*.
|
|
|
|
20021009
|
|
|
|
Bugfix: SIZE errors should be reported at MAIL FROM time,
|
|
and should not be postponed (with smtpd_delay_reject = yes)
|
|
until RCPT TO time. Reported by Jeroen Scheerder, Utrecht
|
|
University. Files: smtpd/smtpd.c smtpd/smtpd_check.c.
|
|
|
|
20021013
|
|
|
|
When Postfix development started, Linux mail delivery
|
|
software such as procmail did not use kernel locks, and
|
|
Postfix picked one that seemed plausible, namely, flock().
|
|
In the mean time, Linux mail delivery software seems to
|
|
have standardized on fcntl() locks. File: util/sys_defs.h.
|
|
|
|
Feature: body_checks_size_limit parameter to specify how
|
|
much of a message body segment (or attachment, if you prefer
|
|
to use that term) is subjected to body_checks inspection.
|
|
Default limit: 50 kbytes. Files: global/mime_state.c,
|
|
cleanup/cleanup_message.c.
|
|
|
|
20021015
|
|
|
|
Bugfix: the code for missing postmaster/mailer-daemon
|
|
aliases had to be moved after the code that implements the
|
|
luser_relay feature. Files: local/alias.c, local/unknown.c.
|
|
|
|
Weird? The LMTP client lowercased the MAIL FROM and RCPT
|
|
TO addresses. Some remnant of code that someone put in
|
|
there long ago. File: lmtp/lmtp_proto.c.
|
|
|
|
20021024
|
|
|
|
Feature: proxy_interfaces parameter. Specify your NAT or
|
|
other proxy addresses here to avoid mail delivery loops.
|
|
Files: global/mail_params.[hc] global/own_inet_addr.[hc]
|
|
global/resolve_local.c smtp/smtp_addr.c smtpd/smtpd_check.c.
|
|
|
|
Paranoia: defend against a very unlikely false alarm in
|
|
safe_open().
|
|
|
|
20021025
|
|
|
|
Feature: X-Original-To: message headers with the raw original
|
|
envelope recipient.
|
|
|
|
Logging: status=sent/deferred/bounced/ logging now includes
|
|
the original recipient address if it differs from the final
|
|
address.
|
|
|
|
20021026
|
|
|
|
Logging: SMTP UCE reject/warn/hold/discard logging now
|
|
includes queue ID. This will break some logfile analyzers.
|
|
|
|
Logging: SMTP UCE reject/warn/hold/discard logging now
|
|
includes the protocol name and, if available, the hostname
|
|
given in the SMTP HELO or EHLO command.
|
|
|
|
Logging: header/body_checks reject/warn/hold/discard logging
|
|
now includes the protocol name and, if available, the
|
|
hostname given in the SMTP HELO or EHLO command.
|
|
|
|
20021028
|
|
|
|
Bugfix: don't reset state after rejected EHLO. Reset state
|
|
after HELO. Reported by Karthikeyan Bhargavan, upenn.edu.
|
|
Files: smtpd/smtpd.c.
|
|
|
|
20021029
|
|
|
|
Bugfix: local(8) did not prepend an X-Original-To: message
|
|
header while delivering to command, and local(8) did not
|
|
document the X-Original-To: message header.
|
|
|
|
Workaround: DJBDNS produces a bogus A record when given a
|
|
numerical hostname. File: dns/dns_lookup.c.
|
|
|
|
20021030
|
|
|
|
Portability: support for Berkeley DB version 4.0 but not
|
|
for Berkeley DB version 4.1 (yes, the API is different).
|
|
Postfix is now going to be paranoid about the minor version
|
|
number, too. File: util/dict_db.c.
|
|
|
|
Documentation: updated LMTP_README file by Amos Gouaux.
|
|
|
|
20021031
|
|
|
|
Bugfix: (bug introduced 20021026) log NOQUEUE when rejecting
|
|
ETRN, instead of trying to log a non-existent queue ID.
|
|
Victor Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
Cleanup: allow optional text after commands in SMTPD access
|
|
maps. Based on initial effort by Victor Duchovni, Morgan
|
|
Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
Portability: support for Berkeley DB version 4.1. This
|
|
version refuses to open zero-length files. This complicates
|
|
lock management and requires extra code to remove broken
|
|
files. Files: util/dict_db.c, global/mkmap*.[hc].
|
|
|
|
20021101
|
|
|
|
Bugfix: don't complain about out-of-order original recipient
|
|
records for finished recipients. Files: *qmgr/qmgr_message.c,
|
|
cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c.
|
|
|
|
Cleanup: further simplified the mkmap wrapper (used by
|
|
postmap and postalias only) to remove some hurdles for
|
|
Michael Tokarev's CDB support. Files: global/mkmap*.[hc].
|
|
|
|
20021105
|
|
|
|
Postalias now produces YP_LAST_MODIFIED and YP_MASTER_NAME
|
|
records only when NIS support is compiled in. File:
|
|
postalias.c.
|
|
|
|
20021106
|
|
|
|
Postalias now puts $myhostname in the YP_MASTER_NAME record,
|
|
instead of the possibly bogus gethostname() result. File:
|
|
postalias.c.
|
|
|
|
The PCRE map code did not reject non-numeric replacement
|
|
indices in replacement text, and silently treated $text as
|
|
$0. Found by Michael Tokarev. File: dict_pcre.c.
|
|
|
|
20021108
|
|
|
|
Cleanup: the behavior of the SMTP server's defer_if_permit
|
|
flag was changed, in order to maximize the opportunity to
|
|
permanently reject mail without opening opportunities for
|
|
losing legitimate mail. This was done in cooperation with
|
|
Victor Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
The defer_if_permit flag is still set when an UCE reject
|
|
restriction fails due to a temporary (e.g., DNS) problem,
|
|
to prevent unwanted mail from slipping through. However,
|
|
the flag is no longer tested at the end of client, helo or
|
|
sender restrictions. Instead, the flag is now tested at
|
|
the end of the ETRN and recipient restrictions only.
|
|
|
|
The behavior of the warn_if_reject restriction has changed.
|
|
It no longer activates any already made defer_if_permit or
|
|
defer_if_reject decisions (the defer_if_reject flag is set
|
|
when some UCE permit restriction fails due to a temporary
|
|
(DNS) problem, to avoid loss of legitimate mail).
|
|
|
|
Bugfix: instead of setting the defer_if_permit flag, a
|
|
failing reject restriction after warn_if_reject now merely
|
|
logs that it would have caused mail to be deferred.
|
|
|
|
A failing permit restriction after warn_if_reject still
|
|
raises the defer_if_reject flag, to avoid loss of legitimate
|
|
mail.
|
|
|
|
20021109
|
|
|
|
Bugfix: a misguided change to the .forward macro expansion
|
|
filter broke .forward file lookup.
|
|
|
|
Bugfix: missing defer_if_permit test in smtpd_data_restrictions.
|
|
Victor Duchovni. File: smtpd/smtpd_check.c.
|
|
|
|
20021112
|
|
|
|
Robustness: increase the mime_nesting_limit from 20 to 100,
|
|
so that bounces can't loop. Each bounces increases the MIME
|
|
nesting level by one. Ralf Hildebrandt and Victor Duchovni.
|
|
|
|
20021113
|
|
|
|
Robustness: reinstated SMTP client command flushing to
|
|
avoid pipeline stalls. File: smtp/smtp_chat.c.
|
|
|
|
20021114
|
|
|
|
Robustness: distinguish between timeout and "lost connection"
|
|
when the SMTP server is unable to send a reply to the remote
|
|
client. File: smtpd/smtpd_chat.c.
|
|
|
|
20021115
|
|
|
|
Bugfix: initialization error with "*" transport table
|
|
lookup, reported by LaMont Jones. The transport map lookup
|
|
code had grown into a monster and needed to be replaced.
|
|
trivial-rewrite/transport.c.
|
|
|
|
20021115
|
|
|
|
Start implementing recipient verification. For now this is
|
|
done by adding trace flags to queue files. In case of a
|
|
verification request, a delivery agent does not deliver,
|
|
deliver, it just records what would happen.
|
|
|
|
This required instrumenting the bounce/defer/sent logging
|
|
routines to send their data to the right place depending
|
|
on the type of delivery request.
|
|
|
|
20021116
|
|
|
|
New trace service. This is used for reporting if a recipient
|
|
is deliverable (sendmail -bv) and for producing a record
|
|
of delivery attempts (sendmail -v). The report is sent via
|
|
email, using the bounce daemon. Files: global/trace.[hc].
|
|
|
|
This required replacing the bounce/defer logfile format by
|
|
an extensible name=value format. Files: global/bounce_log.c,
|
|
bounce/bounce_append_service.c.
|
|
|
|
20021117
|
|
|
|
New address verification service with simple expiration
|
|
and refresh policy. Storage can be in-core or in permanent
|
|
table. The daemon is appropriately called "verify". Files:
|
|
global/verify_clnt.[hc], verify/verify.c.
|
|
|
|
20021118
|
|
|
|
Cleaning up the code for tracing and verification. Files:
|
|
global/{log_adhoc,bounce,defer,trace,verify}.[hc].
|
|
|
|
20021119
|
|
|
|
New address_verification_negative_cache = yes/no parameter
|
|
controls whether Postfix stores the result of negatieve
|
|
address verification probes. This reduces cache pollution
|
|
but causes Postfix to send a probe for each address
|
|
verification service query. File: verify/verify.c.
|
|
|
|
Added optimistic caching to the verify daemon, so that one
|
|
failed probe will not clobber a known to be good address.
|
|
As long as some probes succeeed, a good address will stay
|
|
cached as OK.
|
|
|
|
Cleaning up of the bounce daemon's code for bounce, delayed
|
|
mail warning and trace notification. Files: bounce/*.[hc],
|
|
global/bounce_log.c.
|
|
|
|
20021120
|
|
|
|
Changed the probe's sender address to "postmaster" so that
|
|
we get better information about the address we're testing.
|
|
File: verify/verify.c.
|
|
|
|
Added some paranoia to the routine that reads data from
|
|
the address verification cache. Ignore data that is obviously
|
|
bogus. File: verify/verify.c.
|
|
|
|
20021121
|
|
|
|
Bugfix: garbage in "user@garbage"@domain address forms may
|
|
cause the SMTP or LMTP client to terminate with a fatal
|
|
error exit because garbage/tcp is not an existing service.
|
|
This cannot be abused to cause the SMTP or LMTP client to
|
|
send data into unauthorized ports. Files: *qmgr/qmgr_message.c,
|
|
trivial-rewrite/resolve.c.
|
|
|
|
20021124
|
|
|
|
Bugfix: don't use same VSTRING buffer for reading and
|
|
writing. File: verify/verify.c.
|
|
|
|
20021128
|
|
|
|
Feature: hashed hold queue support, with hashing turned on
|
|
by default. Omission spotted by Victor Duchovni, Morgan
|
|
Stanley. Files: global/hold_message.c, global/mail_params.h.
|
|
|
|
Bugfix: the LMTP client lost the port(service) information
|
|
when parsing host:port information. Victor Duchovni, Morgan
|
|
Stanley. Fix is to have a new host_port(3) module that does
|
|
the parsing for the SMTP and LMTP clients.
|
|
|
|
Cleanup: host_port() routine that parses host/port information
|
|
more consistently than the existing code in the LMTP and
|
|
SMTP clients. Files: smtp/smtp_connect.c, lmtp/lmtp_connect.c,
|
|
util/host_port.[hc].
|
|
|
|
20021130
|
|
|
|
Cleanup: defer mail when recipient verification takes too
|
|
long. File: smtpd/smtpd_proto.c.
|
|
|
|
Feature: new reject_multi_recipient_bounce restriction, to
|
|
reject "MAIL FROM: <>" with multiple recipients. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
20021201
|
|
|
|
Compatibility: ignore the new Sendmail -A option. File:
|
|
sendmail/sendmail.c.
|
|
|
|
Workaround: sendmail -v now produces no output. You need
|
|
to specify -v -v instead. This is to avoid problems when
|
|
people request verbose mail delivery in their mail.rc file.
|
|
File: sendmail/sendmail.c.
|
|
|
|
20021202
|
|
|
|
Cleanup: hash_queue_depth now defaults to 1 level of
|
|
subdirectories. This makes "mailq" faster on most systems,
|
|
but will result in poorer worst-case performance when lots
|
|
of mail is queued.
|
|
|
|
The check_relay_domains restriction is going away. The SMTP
|
|
server logs a warning and suggests using reject_unauth_destination
|
|
instead.
|
|
|
|
Cleanup: the local(8) and virtual(8) delivery agents did
|
|
not prepend X-Original-To: addresses to maildir files.
|
|
Omission spotted by Matthias Andree.
|
|
|
|
Specify "address_verify_sender=" or "address_verify_sender=<>"
|
|
to use a null sender address while doing address verification
|
|
probes. Beware, doing so may trigger false negatives
|
|
because some sites reject mail from the null sender, even
|
|
though this is required by RFC standards.
|
|
|
|
Bugfix: too many levels of dereferencing while testing for
|
|
missing reject_rbl_mumble domain names. Patrik Rak. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
20021203
|
|
|
|
Bugfix: the FILTER access table action included the FILTER
|
|
command in the filter request, where only the transport+destination
|
|
were expected. Noel Jones. File smtpd/smtpd_check.c.
|
|
|
|
Cleanup: virtual_maps is now called virtual_alias_maps, in
|
|
order to better distinguish it from virtual_mailbox_maps.
|
|
The default value is $virtual_maps for backwards compatibility.
|
|
|
|
New parameters virtual_alias_domains and virtual_mailbox_domains
|
|
for the "domain.tld whatever" lookups. These use the same
|
|
syntax as the mydestination parameter. Default settings
|
|
are backwards compatible with Postfix 1.1.
|
|
|
|
Concept: just like $mydestination+$inet_interfaces control
|
|
what routes to $local_transport, $virtual_mailbox_domains
|
|
now controls what routes to $virtual_transport (default
|
|
transport: virtual), and $relay_domains now controls what
|
|
routes to $relay_transport (default transport: relay, a
|
|
clone of the smtp transport). Everything else routes to
|
|
$default_transport as before. This eliminates the need
|
|
for transport map entries for every virtual(8) domain, and
|
|
avoids performance problems with inbound relay mail. This
|
|
was improvement was suggested by Victor Duchovni. File:
|
|
trivial-rewrite/resolve.c.
|
|
|
|
20021206
|
|
|
|
Cleanup: do allow regexps in aliases, virtual mailbox maps
|
|
but do not allow regular expression substitutions. Files:
|
|
util/dict.h, util/dict_regexp.c, util/dict_pcre.c.
|
|
|
|
20021207
|
|
|
|
Cleanup: deleted the description of sendmail-style virtual
|
|
domains from the virtual(5) manual page. This part of
|
|
Postfix was too confusing.
|
|
|
|
Performance: RFC 2821 blesses the use of CNAME domain names
|
|
in MAIL FROM and RCPT TO. Not having to expand CNAME domain
|
|
names speeds things up a bit. File: smtp/smtp_proto.c.
|
|
|
|
Workaround: exclude error mailer destinations from transport
|
|
mapping lookups :-(. File: trivial-rewrite/resolve.c.
|
|
|
|
Cleanup: relocated_maps lookups are now moved to the
|
|
trivial-rewrite server. As of now, the queue manager no
|
|
longer does any map lookups, so it won't restart when maps
|
|
change. Files: *qmgr/qmgr_message.c, trivial-rewrite/resolve.c.
|
|
|
|
Robustness: because the trivial-rewrite server now does
|
|
many more table lookups, some of which are often LDAP or
|
|
SQL based, trivial-rewrite clients must be be prepared for
|
|
the case that the resolver reports a failure while processing
|
|
a request (when it was unable to access a lookup table).
|
|
Files: trivial-rewrite/resolve.c, local/resolve.c,
|
|
smtpd/smtpd_check.c.
|
|
|
|
Robustness: moving possible LDAP or SQL table lookups into
|
|
the trivial-rewrite server also required that trivial-rewrite
|
|
be running as multiple processes to reduce lookup latencies.
|
|
Files: master/multi-server.c.
|
|
|
|
Workaround: don't discard all the DNS lookup results when
|
|
only one of the results has a malformed name or address.
|
|
File: dns/dns_lookup.c.
|
|
|
|
20021208
|
|
|
|
Cleanup: with the preliminary address domain classification
|
|
concept as implemented by the trivial-rewrite address
|
|
resolver, a lot of table lookups could be eliminated from
|
|
the SMTP server. Files: smtpd/smtpd_check.c.
|
|
|
|
Feature: new relay_recipient_maps parameter, for optional
|
|
maps with all the recipients in the domains that match
|
|
$relay_domains (so you can reject mail for unknown relay
|
|
recipients). This is for consistency with virtual_xx_maps
|
|
and virtual_xx_domains, and with local_recipient_maps and
|
|
the local delivery agent. File: smtpd/smtpd_check.c.
|
|
|
|
Cleanup: removed support for obsolete #number domain forms.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
20021209
|
|
|
|
The Postfix installation procedure no longer sets the
|
|
"chattr +S" bit on Linux queue directories. Wietse has
|
|
gotten too annoyed with naive reviewers who complain about
|
|
performance without having a clue of what they are comparing.
|
|
|
|
"Security": local_recipient_maps is now turned on by default,
|
|
to reject mail for non-existent users at the SMTP port.
|
|
See conf/main.cf for instructions, section REJECTING UNKNOWN
|
|
LOCAL USERS.
|
|
|
|
Safety: detection of missing or inaccessible passwd file
|
|
database, to prevent massive complaints from people who
|
|
suddenly lose all their mail because local_recipient_maps
|
|
is now turned on by default.
|
|
|
|
20021210
|
|
|
|
Feature: recipient address verification, using the code
|
|
that already implements sender address verification. Based
|
|
on suggestion by Matthias Andree. Files: src/smtpd/smtpd.c,
|
|
src/smtpd/smtpd_check.c.
|
|
|
|
20021211
|
|
|
|
Performance: doubled the default process limit (50->100)
|
|
and default queue manager active queue message/recipient
|
|
limits (10k->20k). File: global/mail_params.h.
|
|
|
|
Bugfix: the change that begot us multiple trivial-rewrite
|
|
processes (good) also gave us multiple verify daemons (bad).
|
|
File: conf/post-install.
|
|
|
|
20021212
|
|
|
|
Cleanup: allow transport map lookups to override error
|
|
mailer results (to avoid breaking existing installations),
|
|
and do transport map lookups before relocated map lookups.
|
|
Files: trivial-rewrite/resolve.c, trivial-rewrite/transport.c.
|
|
|
|
Shortened the verify server's negative cache refresh time
|
|
from 12 hours to 2 hours. File: global/mail_params.h.
|
|
|
|
Admin friendliness: the SMTP server now reports "User
|
|
unknown in {local recipient | virtual alias | virtual
|
|
mailbox | relay recipient} table". This will make trouble
|
|
shooting a little easier. Files: smtpd/smtpd_check.c,
|
|
trivial-rewrite/resolve.c.
|
|
|
|
20021213
|
|
|
|
Cleanup: transport map entries with null nexthop ignored
|
|
relayhost settings. Making the code simpler also made it
|
|
more correct. Files: trivial-rewrite/resolve.c,
|
|
trivial-rewrite/transport.c.
|
|
|
|
Feature: "helpful_warnings" (default: yes) that can be
|
|
turned off if you really know what you're doing and want
|
|
to eliminate some unnecessary work.
|
|
|
|
Feature: enforcement of master.cf process limits for
|
|
processes such as qmgr and pickup that must run alone, and
|
|
processes such as cleanup and bounce that must run without
|
|
explicit process count limit. If an incorrect process limit
|
|
is specified in master.cf the service aborts.
|
|
|
|
20021214
|
|
|
|
Cleanup: it looks like we finally get it right with transport
|
|
lookup table entries that either override or specify an
|
|
error transport without updating the nexthop information.
|
|
File: trivial-rewrite/resolve.c.
|
|
|
|
Robustness: don't probe the sender address when probed for
|
|
our own address verification probe sender address. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
Performance: don't do UCE checks (which may result in 4xx
|
|
SMTP reply codes, and thus, repeated delivery attempts)
|
|
when we already know that the recipient does not exist.
|
|
Files: smtpd/smtpd.c, smtpd/smtpd_check.c.
|
|
|
|
20021215
|
|
|
|
Cleanup: further simplification of transport map handling
|
|
after some really fine hair splitting with Victor Duchovni.
|
|
Files: trivial-rewrite/resolve.c, trivial-rewrite/transport.c.
|
|
|
|
20021216
|
|
|
|
Workaround: transform the address local-part into unquoted
|
|
form only when the address domain is local and the local-part
|
|
contains routing operators. Otherwise, we may damage the
|
|
address local-part by inserting space between non-operator
|
|
tokens. Some people use weird addresses and expect them to
|
|
be handled without damage. File: trivial-rewrite/resolve.c.
|
|
|
|
Robustness: scan the resolved recipient address for routing
|
|
operators in the address local-part, even when the local
|
|
MTA does not recognize ! and % as valid operators. File:
|
|
trivial-rewrite/resolve.c.
|
|
|
|
Cleanup: the address rewriting code no longer tries to
|
|
rewrite broken user@ or user@. address forms into even more
|
|
broken forms. bother. File: trivial-rewrite/rewrite.c.
|
|
|
|
Cleanup: the address resolver code now treates forms ending
|
|
in @ in a more rational manner (because the address rewriting
|
|
code no longer messes up by appending .my.domain).
|
|
|
|
Bugfix: a null address local-part before @domain now is
|
|
properly quoted just like the null address. File:
|
|
global/quote_82[12]_local.c.
|
|
|
|
20021217
|
|
|
|
Cleanup: more work on the trivial-rewrite address rewriting
|
|
and address resolving code. New regression tests for address
|
|
rewriting and resolving that make some assumptions about
|
|
main.cf settings. Files: global/Makefile.in (assumptions),
|
|
global/rewrite_clnt.in, global/rewrite_clnt.ref,
|
|
global/resolve_clnt.in, global/resolve_clnt.ref.
|
|
|
|
Safety: configurable SMTPD reject codes for recipients not
|
|
in {local,relay}_recipient,virtual_{alias,mailbox}}_maps,
|
|
aptly named unknown_mumble_reject_code. Postfix installs
|
|
with unknown_local_recipient_reject_code=450, unless the
|
|
site already ran Postfix with local_recipient_maps enabled.
|
|
Files: smtpd/smtpd.c, smtpd/smtpd_check.c, conf/post-install.
|
|
|
|
20021218
|
|
|
|
Feature: specify unverified_recipient_reject_code=250 or
|
|
unverified_sender_reject_code=250 to accept mail for an
|
|
address that is known to bounce. File: smtpd/smtpd_check.c.
|
|
|
|
20021219
|
|
|
|
Bugfix: longjmp() while sending "go away" without setjmp()
|
|
in the QMQP server. Patrik Rak. File: qmqpd/qmqpd.c.
|
|
|
|
Safety: the XVERP extension is restricted to clients listed
|
|
in the authorized_verp_clients list (default: $mynetworks).
|
|
File: smtpd/smtpd.c.
|
|
|
|
Workaround: preliminary IPV6 support in valid_hostliteral().
|
|
File: util/valid_hostname.c.
|
|
|
|
20021220
|
|
|
|
Bugfix: the reject_multi_recipient_bounce restriction had
|
|
an off-by-one error when used in smtpd_data_restrictions.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
Feature: new check_recipient_maps restriction that gives
|
|
finer control over when unknown recipients are rejected.
|
|
As with Postfix 1.1, the default is to do this at the end
|
|
of the recipient restrictions. Sites that want to improve
|
|
performance can put check_recipient_maps at the start of
|
|
the smtpd_client_restrictions list and avoid doing unnecessary
|
|
RBL lookups etc. File: smtpd/smtpd_check.c.
|
|
|
|
Feature: new show_user_unknown_recipient_table parameter
|
|
controls whether or not to reveal the lookup table name in
|
|
"User unknown" responses. The extra detail makes trouble
|
|
shooting easier but also reveals information that is nobody
|
|
elses business.
|
|
|
|
20021221
|
|
|
|
Workaround: don't allow the transport map to override the
|
|
virtual alias class (error:User unknown) result. File:
|
|
trivial-rewrite/transport.c.
|
|
|
|
20030101
|
|
|
|
Documentation update: new-style virtual domains broke the
|
|
advanced content filtering example. Files: FILTER_README,
|
|
RELEASE_NOTES-2.0.
|
|
|
|
20030102
|
|
|
|
Cleanup: use different client instances when the same map
|
|
is opened with different flags. File: global/maps.c.
|
|
|
|
Feature: proxymap server for Postfix table lookups. This
|
|
helps to consolidate the number of open lookup tables (such
|
|
as MYSQL or LDAP), or to overcome chroot restrictions
|
|
(example: specify proxy:unix:passwd.byname to avoid the
|
|
need for a copy of the UNIX passwd file in chroot jails).
|
|
Files: global/dict_proxy.[hc], proxymap/proxymap.c
|
|
|
|
Cleanup: multiservers such as trivial-rewrite and the new
|
|
proxymap server now enforce the max_use total client number
|
|
limit more agressively, by not accepting new connections
|
|
after the limit is reached. Based on a patch by Victor
|
|
Duchovni, Morgan Stanley. File: master/multi_server.c.
|
|
|
|
20030103
|
|
|
|
Cleanup: client stream endpoints not only have an idle time
|
|
limit ($ipc_idle) before a connection is closed, they now
|
|
also have a time to live ($ipc_ttl) to prevent connections
|
|
from becoming too persistent. This allows multi-servers
|
|
such as trivial-rewrite or the proxymap server to refresh
|
|
more frequently on busy systems. File: global/clnt_stream.c.
|
|
|
|
20030104
|
|
|
|
Cleanup: avoid warnings about flag mismatches when the same
|
|
lookup table is listed under both virtual_alias_maps and
|
|
virtual_mailbox_maps. Files: global/virtual8.h, virtual/virtual.c.
|
|
|
|
Bugfix: an obscure memory leak that puzzled me for more
|
|
than a year until I found out how to reproduce it. File:
|
|
util/vstream.c.
|
|
|
|
20030105
|
|
|
|
Cleanup: removed the address syntax check from the queue
|
|
manager, since a better test was implemented recently in
|
|
the trivial-rewrite server. Files: *qmgr/qmgr_message.c.
|
|
|
|
Bugfix: redirect bounce/defer to the address verification
|
|
service where appropriate. Files: *qmgr/qmgr_bounce.c,
|
|
*qmgr/qmgr_defer.c.
|
|
|
|
Bugfix: "no such file or directory" warnings after "postfix
|
|
reload" when a chrooted smtpd reconnects to the proxy
|
|
service. Fix: use "private/proxymap" if possible, otherwise
|
|
use "$queue_dir/private/proxymap". File: global/dict_proxy.c.
|
|
|
|
Robustness: daemons now chdir() to the queue directory
|
|
before running the pre-jail initialization code, so that
|
|
daemons running in stand-alone mode produce more consistent
|
|
results. Files: master/single_server.c, master/multi_server.c.
|
|
master/trigger_server.c.
|
|
|
|
Bugfix: "sendmail -bs" tried to access the proxymap service.
|
|
It should not try to open any user/domain/uce related tables
|
|
at all. File: smtpd/smtpd.c.
|
|
|
|
20030106
|
|
|
|
Bugfix: bouncing to owner-alias was broken, i.e. the mail
|
|
kept being deferred, and when that was fixed, another buglet
|
|
came to light. File: bounce/bounce.c.
|
|
|
|
Robustness: the master no longer aborts with "address
|
|
already in use" when inet_interfaces specifies the same IP
|
|
address multiple times, or when a TCP service in master.cf
|
|
specifies a hostname for which the same IP address is listed
|
|
multiple times. File: master/master_ent.c.
|
|
|
|
20030107
|
|
|
|
Robustness: check that FILTER actions in SMTPD access maps
|
|
or cleanup header/body_checks have plausible syntax. Files:
|
|
smtpd/smtpd_check.c, cleanup/cleanup_message.c.
|
|
|
|
20030109
|
|
|
|
Cleanup: unnecessary "premature end of file on xxx while
|
|
reading yyy" warnings became exposed after some code
|
|
simplification. Files" global/*_clnt.c, global/dict_proxy.c
|
|
|
|
Robustness: undo the change that causes a multi-server
|
|
process to stop accepting new connections while it still
|
|
services existing clients for an extended amount of time.
|
|
We need a better process retirement strategy. File:
|
|
master/multi_server.c.
|
|
|
|
20030110
|
|
|
|
Cleanup: the virtual_mailbox_maps parameter is now optional
|
|
even when virtual_mailbox_domains is. This makes virtual
|
|
mailbox domains more like relay domains and the local
|
|
domain.
|
|
|
|
Portability: the makedefs script now uses the pcre-config
|
|
utility to find out where things are installed.
|
|
|
|
Bugfix: the SMTP server did not recognize the local built-in
|
|
double bounce address as local. Reported by Matthias Andree.
|
|
For safety sake, threw in the local postmaster address as
|
|
well. File: smtpd/smtpd_check.c.
|
|
|
|
20030113
|
|
|
|
Added MAILER-DAEMON to the list of always recognized local
|
|
addresses, since it is generated by Postfix bounces. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
20030114
|
|
|
|
Bugfix: transport_errno was not reset upon successful
|
|
transport map wildcard lookup after an earlier failure.
|
|
Reported by Victor Duchovni. File: trivial-rewrite/transport.c.
|
|
|
|
Cleanup: unnecessary warnings from the proxymap client
|
|
after proxymap server disconnect. File: global/dict_proxy.c.
|
|
|
|
Cleanup: Patrik Rak found a few more chattr invocations
|
|
that were missed 20021209. Files: postfix-install,
|
|
conf/post-install.
|
|
|
|
Cleanup: the pcre-config command can produce null outputs.
|
|
Matthias Andree. File: makedefs.
|
|
|
|
Bugfix: the virtual(8) Makefile included $(AUXLIBS) in the
|
|
dependencies.
|
|
|
|
20030118
|
|
|
|
Typos: some hyperlinks referred to flushd, which is the
|
|
name that was used before the flush service was released.
|
|
Reported by Victor Duchovni.
|
|
|
|
Cleanup: smtpd no longer needed to open relocated_maps.
|
|
|
|
20030119
|
|
|
|
Cleanup: bounce messages used "X-Postfix" even when mail_name
|
|
was set to something other than the default "Postfix" name.
|
|
File: bounce/bounce-notify_util.c.
|
|
|
|
20030120
|
|
|
|
Bugfix: wrong FILTER_README instructions for disabling
|
|
virtual alias mapping in the cleanup server before the
|
|
content filter.
|
|
|
|
Bugfix: wrong FILTER_README instructions for destination-dependent
|
|
filtering, because relay_domains was specified incorrectly.
|
|
|
|
20030122
|
|
|
|
Bugfix: 20021207 (move relocated table lookup from queue
|
|
manager to trivial-rewrite server) broke relocated table
|
|
lookup results with mail not rejected at the SMTP port.
|
|
Files: *qmgr/qmgr_deliver.c, *qmgr/qmgr_message.c.
|
|
|
|
20030123
|
|
|
|
Bugfix: a widely used maildir filename algorithm was broken.
|
|
Postfix now uses TIME.DEVICE_INODE.HOST. Files: local/maildir.c,
|
|
virtual/maildir.c.
|
|
|
|
20030124
|
|
|
|
Cleanup: queue structures no longer overload queue name
|
|
and nexthop destination. Files: *qmgr/qmgr_message.c,
|
|
*qmgr/qmgr_queue.c, *qmgr/qmgr_deliver.c.
|
|
|
|
20030125
|
|
|
|
Feature: "REDIRECT user@domain" action in access maps or
|
|
in header/body_checks causes mail to be sent to the specified
|
|
address instead of the intended recipient(s). I would never
|
|
recommend that people use this to redirect (bounced) SPAM
|
|
to the beneficiaries of an advertisement campaign. Files:
|
|
smtpd/smtpd_check.c, cleanup/cleanup_message.c,
|
|
*qmgr/qmgr_message.c.
|
|
|
|
20030126
|
|
|
|
Update: maildir filename algorithm updated according to
|
|
today's version of http://cr.yp.to/proto/maildir.html.
|
|
|
|
20030127
|
|
|
|
Cleanup: use separate error messages for separate problems
|
|
with computing the list of SASL authentication mechanisms.
|
|
File: smtpd/smtpd_sasl_glue.c.
|
|
|
|
20030130
|
|
|
|
Bugfix: allow $name in default time values. File:
|
|
global/mail_conf_time.c.
|
|
|
|
20030205
|
|
|
|
Feature: allow !, /file/name and map:name in masquerade_exceptions.
|
|
By Liviu Daia. Files:cleanup_init.c, cleanup.h,
|
|
cleanup_masquerade.c.
|
|
|
|
20030219
|
|
|
|
Bugfix: the local pickup daemon skipped unterminated records,
|
|
since they happened to have the same record type code as
|
|
content filtering instructions. Victor Duchovni. Files:
|
|
global/rec_type.h, pickup/pickup.c.
|
|
|
|
Portability: Postfix could block, and thus not enforce
|
|
command execution time limits, while delivering mail to
|
|
command. File: global/pipe_command.c.
|
|
|
|
Bugfix: command execution time limits were not enforced
|
|
because the child process killing code in pipe_command()
|
|
was running with the wrong privileges. Problem reported by
|
|
Ben Rosengart, Panix. File: global/pipe_command.c.
|
|
|
|
Bugfix: duplicate recipient filtering in the cleanup server
|
|
did not eliminate virtual expansion duplicates with the
|
|
same original recipient. File: cleanup/cleanup_out_recipient.c.
|
|
|
|
20030223
|
|
|
|
Cleanup: added postmap/postalias -p option (do not inherit
|
|
the source file permissions when creating a new file), for
|
|
completeness. A feature that can't be turned off is a bug.
|
|
Files: postmap/postmap.c, postalias/postalias.c.
|
|
|
|
Bugfix: smtpd_hard/soft_error_limit off-by-one error, so
|
|
that the real limit was one larger than the configured
|
|
value. File: smtpd/smtpd.c, smtpd/smtpd_chat.c.
|
|
|
|
20030226
|
|
|
|
Safety: proxymap server defense against potential deadlock
|
|
when some library routine wants to open a proxied table.
|
|
Instead, proxymap opens the requested table directly. File:
|
|
proxymap/proxymap.c.
|
|
|
|
Portability: updated AIX 5.x system dependent definitions.
|
|
File: util/sys_defs.h.
|
|
|
|
20030227
|
|
|
|
Bugfix: added mynetworks to the list of proxy_read_maps
|
|
parameter settings that are pre-authorized to use proxied
|
|
table lookups. File: global/mail_params.h.
|
|
|
|
Cleanup: daemons now log what table has changed before
|
|
restarting. Files: dict.c, and anything that invoked
|
|
dict_changed().
|
|
|
|
Cleanup: more consistency in the naming of lookup table
|
|
handles as generated by maps(3) and by match_list(3).
|
|
|
|
20030305
|
|
|
|
Workaround: Postfix removes too long non-address text from
|
|
message headers in order to protect vulnerable Sendmail
|
|
systems against exploitation of the remote buffer overflow
|
|
vulnerability described in CERT advisory CA-2003-07.
|
|
|
|
20030311-19
|
|
|
|
Bugfix: the access map actions HOLD, DISCARD, FILTER and
|
|
REDIRECT were broken with smtpd_delay_reject=no and with
|
|
ETRN. This required re-architecting of the actions code.
|
|
Files: smtpd/smtpd.[hc], smtpd/smtpd_check.c, smtpd/smtpd_state.c.
|
|
|
|
20030315
|
|
|
|
Bugfix: the postsuper manual page documented support for
|
|
the -c command line option, but it was not implemented.
|
|
File: postsuper/postsuper.c.
|
|
|
|
Bugfix: the Postfix 2.0 recipient map checking code broke
|
|
the VRFY command, causing it to reply with status code 252
|
|
for non-existent addresses. This required re-architecting
|
|
the recipient table lookup code. File: smtpd/smtpd_check.c.
|
|
|
|
20030319
|
|
|
|
Feature: configurable limit on virtual alias expansion size
|
|
and nesting depth, via the virtual_alias_expansion_limit
|
|
and virtual_alias_recursion_limit parameters. The default
|
|
limits are compatible with past Postfix versions. Victor
|
|
Duchovni, Morgan Stanley. Files: /sample-resource.cf,
|
|
html/resource.html, cleanup/cleanup.c, cleanup/cleanup_init.c,
|
|
cleanup/cleanup_map1n.c.
|
|
|
|
Feature: the installation procedure records build information
|
|
(by default: in /etc/postfix/makedefs.out).
|
|
|
|
20030324
|
|
|
|
Bugfix: smtp-source flushed too often, causing suboptimal
|
|
performance with smtp-source sending directly into smtp-sink.
|
|
Files: smtpstone/smtp-source.c.
|
|
|
|
20030410
|
|
|
|
Safety: log a fatal error when a net/mask pattern has a
|
|
non-zero host part, so that mail delivery is deferred.
|
|
File: util/match_ops.c.
|
|
|
|
20030411
|
|
|
|
Bugfix: extraneous warning about out-of-order original
|
|
recipient records by Patrik Rak. Files: *qmgr/qmgr_message.c.
|
|
|
|
20030412
|
|
|
|
Workaround: log a warning and reset the queue file time
|
|
stamps when the file system clock is ahead of the local
|
|
clock. File: global/mail_stream.c.
|
|
|
|
20030414
|
|
|
|
Feature: PostgreSQL client module, adopted by LaMont Jones.
|
|
Files: README_FILES/PGSQL_README, util/dict_pgsql.c,
|
|
util/dict_pgsql.h, conf/sample-pgsql-aliases.cf.
|
|
|
|
Cleanup: the generic smtp client/server code in smtp_stream.c
|
|
now has an explicit flush operation, and the smtp-source/sink
|
|
programs are updated to take advantage of this.
|
|
|
|
Cleanup: the file system clock drift detection code now
|
|
runs only once per process instance, to minimize the
|
|
performance impact. File: global/mail_stream.c.
|
|
|
|
Robustness: avoid TIME_WAIT state with smtp/qmqp-source
|
|
client sockets. This puts less strain on local system
|
|
resources.
|
|
|
|
20030415
|
|
|
|
Cleanup: the file system clock drift detection code now
|
|
runs only for incoming mail. File: global/mail_stream.c.
|
|
|
|
20030416
|
|
|
|
Bugfix: missing partial last line when 1) someone submits
|
|
8-bit mail not ending in newline via /usr/sbin/sendmail
|
|
and 2) MIME input processing is turned off, and 3) MIME
|
|
8bit->7bit conversion is requested upon delivery via SMTP.
|
|
|
|
Cleanup: auto-bcc recipients are now added in one place
|
|
(the cleanup server) instead of by individual front-end
|
|
servers (pickup, smtpd, qmqpd). This makes it easier to
|
|
add auto-bcc features that trigger on sender or recipient
|
|
addresses.
|
|
|
|
Cleanup: "sendmail -t" (recipients from headers) is now
|
|
implemented by the sendmail command instead of by the
|
|
cleanup server. This means that the extract_recipient_limit
|
|
configuration parameter is no longer needed. Files:
|
|
sendmail/sendmail.c, cleanup/cleanup_message.c,
|
|
cleanup/cleanup_extracted.c.
|
|
|
|
Compatibility: "sendmail -t" (recipients from headers) now
|
|
accepts command-line recipients instead of complaining.
|
|
The extracted header recipients are added to the command-line
|
|
recipients.
|
|
|
|
Feature: sender/recipient_bcc_maps. These are indexed by
|
|
sender/recipient address and are examined when mail enters
|
|
from outside of Postfix. Files: cleanup/cleanup_addr.c.
|
|
cleanup/cleanup_envelope.c cleanup/cleanup_extracted.c.
|
|
|
|
20030417
|
|
|
|
Feature: the SMTP client now falls back to native name
|
|
service lookups (including /etc/hosts) when a host cannot
|
|
be found in the DNS. This is controlled by a new parameter
|
|
smtp_host_lookup (default: dns, native). Files: smtp/smtp.c,
|
|
smtp/smtp_addr.c.
|
|
|
|
20030418
|
|
|
|
Bugfix: "sendmail -t" broke with unrecognized message
|
|
headers.
|
|
|
|
20030419
|
|
|
|
Feature: "postcat -q" searches the queue for the named
|
|
file.
|
|
|
|
Cleanup: made postcat "record names" output more consistent.
|
|
|
|
20030421
|
|
|
|
Debugging: added some extra detailed error logging to the
|
|
pipe-to-command delivery, to help folks with bizarre file
|
|
truncation problems. File: global/pipe_command.c.
|
|
|
|
20030424
|
|
|
|
Cleanup: readlline() did not terminate the result before
|
|
complaining about lines starting with whitespace.
|
|
|
|
Cleanup: eliminated valid_hostname warning for invalid
|
|
queue file names. File: global/mail_queue.c.
|
|
|
|
Bugfix: lost three lines of code when readying the postcat
|
|
command for release, which broke postcat -q. File:
|
|
postcat/postcat.c.
|
|
|
|
Bugfix: the Postfix sendmail command applied the message
|
|
size limit when running as newaliases. The limiting code
|
|
is now moved to the message enqueuing branch of the code.
|
|
File: sendmail/sendmail.c.
|
|
|
|
Documentation: start of documentation for the algorithm of
|
|
Patrik Rak's clever queue manager scheduler (nqmgr). Files:
|
|
conf/sample-scheduler.cf, README_FILES/SCHEDULER_README.
|
|
|
|
20030429
|
|
|
|
Bugfix: while verifying an address, the LMTP client entered
|
|
a forbidden "next" sender state after the last recipient.
|
|
Fix by Vladimir Davydoff. File: lmtp/lmtp_proto.c.
|
|
|
|
Bugfix: "," was not recognized in proxy_read_maps settings.
|
|
Fix by Leandro Santi. File: proxymap/proxymap.c.
|
|
|
|
20030502
|
|
|
|
Bugfix: defer delivery after .forward etc. file read error.
|
|
File: local/token.c. Problem reported by Ben Rosengart,
|
|
Panix.
|
|
|
|
20030503
|
|
|
|
Bugfix: the Postfix LMTP client used the wrong service
|
|
name, causing trouble with SASL 2.1.13. Daniel Schales,
|
|
Louisiana Tech. File: lmtp/lmtp_sasl_glue.c.
|
|
|
|
20030518
|
|
|
|
Workaround: IRIX select() reports that a non-blocking file
|
|
descriptor is writable while write() transfers zero bytes.
|
|
File: util/vstream.c. Superseded by change 20030523.
|
|
|
|
20030520
|
|
|
|
Cleanup: future time stamps in Received: headers and negative
|
|
delays in delivery agent logging after "postdrop -r",
|
|
because deferred queue files had future file modification
|
|
times. File: src/postsuper/postsuper.c.
|
|
|
|
20030521
|
|
|
|
Cleanup: nqmgr warnings about "recipient count mismatch"
|
|
after "postdrop -r", because the cleanup server did not
|
|
count the "already done" recipients. Problem reported by
|
|
Richard Stockton, Gramma Software. Files:
|
|
cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c.
|
|
|
|
20030523
|
|
|
|
Workaround: IRIX select() reports that a non-blocking file
|
|
descriptor is writable while write() transfers zero bytes.
|
|
File: global/pipe_command.c.
|
|
|
|
20030523-20030605
|
|
|
|
Cleanup: rewrote the queue file record processing loops in
|
|
pickup, cleanup and in [n]qmgr. This code had deteriorated
|
|
a lot as the result of small changes over the years. This
|
|
change brings the code closer to "obviously correct". Files:
|
|
cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c,
|
|
*qmgr/qmgr_message.c.
|
|
|
|
Cleanup: Postfix no longer produces queue files with
|
|
backwards compatibility data for Postfix versions < 1.0
|
|
(a.k.a. 20010228). Files: cleanup/cleanup_extracted.c,
|
|
showq/showq.c.
|
|
|
|
Performance: the queue manager no longer has to examine
|
|
every queue file record before it can start deliveries.
|
|
This helps to avoid thrashing with very large mailing lists.
|
|
Postfix queue files have an extra field in the size record
|
|
with queue manager processing hints. This change is backward
|
|
and forward compatible. Files: cleanup/cleanup_envelope.c,
|
|
cleanup/cleanup_extracted.c, *qmgr/qmgr_message.c.
|
|
|
|
20030528
|
|
|
|
Compatibility: "sendmail -q<time>" without -bd option now
|
|
exits immediately, instead of waiting for input on the
|
|
standard input stream and screwing up system boot sequences.
|
|
File: sendmail/sendmail.c.
|
|
|
|
20030530
|
|
|
|
Bugfix: client access denied with smtpd_delay_reject=no
|
|
broke "sendmail -bs". Fix by Victor Duchovni, Morgan Stanley.
|
|
File: smtpd/smtpd.c.
|
|
|
|
20030531
|
|
|
|
Compatibility: allow <@site,@site:address> route addresses
|
|
in SMTP commands. File: smtpd/smtpd.c.
|
|
|
|
20030605
|
|
|
|
Cleanup: input checks moved from the pickup daemon to the
|
|
postdrop mail submission command; this is to prepare for
|
|
direct mail submission from postdrop->cleanup without going
|
|
through the maildrop directory and the pickup service.
|
|
Files: pickup/pickup.c, postdrop/postdrop.c.
|
|
|
|
Bugfix: the "dead host" backoff timer in the MySQL client
|
|
didn't work. Fix by Leandro Santi. File: util/dict_mysql.c.
|
|
|
|
Bugfix: same problem in the PostgreSQL client. File:
|
|
util/dict_pgsql.c.
|
|
|
|
Workaround: turned off non-blocking write to pipe because
|
|
too many systems give a weird write() result. File:
|
|
global/pipe_command.c.
|
|
|
|
Cleanup: added support for vstream_fseek(.., .., SEEK_END).
|
|
File: util/vstream.c.
|
|
|
|
20030608
|
|
|
|
Feature: separate address resolver controls for address
|
|
verification probe messages: address_verify_{local,virtual,
|
|
relay,default}_transport, address_verify_relayhost, and
|
|
address_verify_transport_maps. The default values are the
|
|
regular versions of the same controls. Files: trivial-rewrite/*,
|
|
global/resolve_clnt.[hc], *qmgr/qmgr_message.c.
|
|
|
|
20030609
|
|
|
|
Workaround: Solaris blocking socket read() may hang. Hernan
|
|
Perez Masci and Leandro Santi. File: smtpd/smtpd.c.
|
|
|
|
Bugfix: the "unread recipient" counter needs to be restored
|
|
after the queue manager has a problem reading a queue file.
|
|
Fix by Patrik Rak. File: nqmgr/qmgr_message.c.
|
|
|
|
20030610
|
|
|
|
Cleanup: the verify server now uses asynchronous submission
|
|
of mail probes, so it will no longer block for in_flow_delay
|
|
seconds when mail arrives faster than it is delivered.
|
|
Still need to make mail_stream_finish() asynchronous in
|
|
order to avoid blocking for trigger_timeout seconds when
|
|
the queue manager is overwhelmed. Files: global/post_mail.c,
|
|
verify/verify.c.
|
|
|
|
Bugfix: removed extraneous sleep() after the last attempt
|
|
to retrieve address verification status. File: smtpd/smtpd.c.
|
|
|
|
20030611
|
|
|
|
Bugfix: the stricter postdrop input filter broke "sendmail
|
|
-bs". Found by Lutz Jaenicke. File: smtpd/smtpd.c.
|
|
|
|
20030614
|
|
|
|
Portability: Dropped support for client side LDAP caching.
|
|
As of release 2.1.13 OpenLDAP no longer supports client
|
|
side caching, it has been deprecated for some time, and
|
|
never worked well. Implemented by Victor Duchovni, Morgan
|
|
Stanley, and further enhanced by Lamont Jones, HP. Files:
|
|
src/util/dict_ldap.c, conf/sample-ldap.cf,
|
|
README_FILES/LDAP_README.
|
|
|
|
Safety: Given suitable invalid database contents, LDAP
|
|
lookups can produce too many results, enter an infinite
|
|
loop in the expansion of "special result attributes" (LDAP
|
|
DNs and LDAP URLs) or just consume excessive server resources
|
|
returning large result sets. Three new (per LDAP map)
|
|
configuration parameters enable one to set limits on
|
|
recursive nesting, result expansion and the server response
|
|
"entry" count. Implemented by Victor Duchovni, Morgan
|
|
Stanley, further enanced by Lamont Jones, HP. Files:
|
|
src/util/dict_ldap.c, conf/sample-ldap.cf,
|
|
README_FILES/LDAP_README.
|
|
|
|
20030616
|
|
|
|
Feature: in mail delivery status reports, report the sender
|
|
address as X-Postfix-Sender. Matthias Andree. File:
|
|
bounce/bounce_notify_util.c.
|
|
|
|
Cleanup: in mail delivery status reports, transform the
|
|
original recipient into xtext format as required by RFC
|
|
1891. Files: bounce/bounce_notify_util.c, util/xtext.[hc].
|
|
|
|
Cleanup: more accurate "postfix check" warning for files
|
|
that miss one or more of the required mode 02111 execute
|
|
permission bits. Matthias Andree. File: conf/postfix-script.
|
|
|
|
20030618
|
|
|
|
After "postfix reload", the master daemon now warns when
|
|
inet_interfaces has changed, and ignores the change, instead
|
|
of passing incorrect information to the smtp server. File:
|
|
master/master_ent.c.
|
|
|
|
20030619
|
|
|
|
Feature: the Postfix SMTP server can send all mail into a
|
|
proxy server, for example a real-time SPAM filter. This
|
|
proxy is supposed to send the mail into another Postfix
|
|
SMTP server process for normal delivery. Files: smtpd/smtpd.c
|
|
smtpd/smtpd_proxy.[hc].
|
|
|
|
20030620
|
|
|
|
Bugfix: a cut-and-paste error caused the proxy server's
|
|
354 status code to be reported when a proxy connection
|
|
broke during the DATA phase. File: smtpd.c.
|
|
|
|
20030620
|
|
|
|
Bugfix: after the last change to postdrop, postcat no longer
|
|
recognized maildrop files as valid. File: postcat/postcat.c.
|
|
|
|
Bugfix: after moving "sendmail -t" address extraction to
|
|
sendmail, "-t" broke multi-line recipient headers. Victor
|
|
Duchovni, Morgan Stanley. File: sendmail/sendmail.c.
|
|
|
|
20030621
|
|
|
|
Workaround: the safe_open(O_CREAT) race condition exploit
|
|
avoiding code tries a little harder when it encounters a
|
|
race condition. File: util/safe_open.c.
|
|
|
|
20030624
|
|
|
|
Bugfix: reject_unverified_address() set the defer_if_reject
|
|
flag when the verify service was unavailable (which never
|
|
happens). Victor Duchovni, Morgan Stanley. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
New parameters address_verify_poll_{count,delay} that
|
|
control how often to poll the address verification service
|
|
for the completion of an address verification request.
|
|
Specify address_verify_poll_count=1 to implement a crude
|
|
form of greylisting, that is, always defer the first delivery
|
|
attempt for an unknown address. File: smtpd/smtpd_check.c.
|
|
|
|
Bugfix: after the last change to postdrop, postcat no longer
|
|
recognized non-maildrop queue files as valid. File:
|
|
postcat/postcat.c.
|
|
|
|
20030629
|
|
|
|
Cleanup: replaced references to "simulated virtual domains"
|
|
by "virtual alias domains". Victor Duchovni, Morgan Stanley.
|
|
|
|
20030630
|
|
|
|
Feature: smtp_quote_rfc821_envelope=(yes|no) to control
|
|
RFC 821 style quoting of MAIL FROM and RCPT TO addresses.
|
|
Files: global/mail_params.h, smtp/smtp.c, smtp/smtp_proto.c.
|
|
|
|
20030701
|
|
|
|
Bugfix: multi-recipient probes triggered a bug in the SMTP
|
|
client. File: smtp/smtp_proto.c.
|
|
|
|
Feature: enable_original_recipient (default: yes) to control
|
|
whether Postfix keeps track of original recipient address
|
|
information. Victor Duchovni, Morgan Stanley. Files:
|
|
cleanup/cleanup.c, cleanup/cleanup_init.c,
|
|
cleanup/cleanup_out_recipient.c, global/log_adhoc.c,
|
|
global/mail_copy.c, *qmgr/qmgr_message.c.
|
|
|
|
Feature: !/pattern/ support for PCRE lookup tables. Victor
|
|
Duchovni, Morgan Stanley. Files: util/dict_pcre.c.
|
|
|
|
Cleanup: allow whitespace after patterns in repexp and pcre
|
|
tables. Victor Duchovni, Morgan Stanley. Files:
|
|
util/dict_pcre.c, util/dict_regexp.c.
|
|
|
|
20030702
|
|
|
|
Feature: CIDR lookup table support, very remotely based on
|
|
code by Jozsef Kadlecsik. Files: proto/cidr_table,
|
|
util/dict_cidr.[hc].
|
|
|
|
Feature: TCP lookup table support, finally finished. Files:
|
|
proto/tcp_table, proto/dict_tcp.[hc].
|
|
|
|
20030705
|
|
|
|
Feature: new receive_override_options parameter controls
|
|
what happens before or after an external content filter:
|
|
rejecting unknown recipients, canonical and virtual address
|
|
mapping, address masquerading, automatic BCC recipients
|
|
and header/body checks. This eliminates the need to configure
|
|
multiple cleanup services in the master.cf file.
|
|
|
|
20030707
|
|
|
|
Feature: context dependent SASL security options (i.e.
|
|
different options when TLS is enabled/disabled). Lutz
|
|
Jaenicke. Files: */*sasl_glue.[hc].
|
|
|
|
20030708
|
|
|
|
Hardened the attr_scan routines for exposure to an untrusted
|
|
environment, in preparation for possible use with SMTP
|
|
policy delegation to an external server.
|
|
|
|
Feature: address filter for RBL lookups, for use with
|
|
multi-valued RBL services. File: smtpd/smtpd_check.c.
|
|
|
|
20030709
|
|
|
|
Cleanup: use off_t instead of int for VSTREAM file offsets.
|
|
This was needed for mailboxes > 2GB on 32-bit systems.
|
|
Files: util/vstream.c, global/mail_copy.c.
|
|
|
|
20030710
|
|
|
|
Support for multiple A and TXT results in RBL lookups.
|
|
Victor Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
Support for attribute-based query-reply protocols. Files:
|
|
util/attr_clnt.[hc], util/auto_clnt.[hc].
|
|
|
|
20030711
|
|
|
|
Support for plain "name=value\n" attribute protocol. Files:
|
|
util/attr_{scan,print}_plain.c.
|
|
|
|
Bugfix: the LMTP session caching code did not reset the
|
|
EHLO server feature list when it needed to reconnect.
|
|
Problem found by Tobias Erbsland.
|
|
|
|
20030712
|
|
|
|
Feature: delegated SMTP policy server. As an example, see
|
|
the greylisting server in examples/smtpd-policy. Specify
|
|
"check_smtpd_policy_service" in smtpd_mumble_restrictions.
|
|
See SMTPD_POLICY_SERVICE_README for details.
|
|
|
|
20030716
|
|
|
|
Bugfix: in the sample policy server, changed "ok" into
|
|
"dunno" so the server can be used in the middle of a
|
|
restriction list.
|
|
|
|
Cleanup: when an RBL reply has multiple TXT records,
|
|
concatenate them up to some reasonable limit, instead of
|
|
selecting one randomly. File: smtpd/smtpd_check.c.
|
|
|
|
Safety: always truncate SMTP server error replies to 512
|
|
bytes. File: smtpd/smtpd_check.c.
|
|
|
|
20030717
|
|
|
|
Documentation: added description of policy_time_limit to
|
|
the SMTPD_POLICY_README document.
|
|
|
|
Documentation: corrected the command time limit parameter
|
|
syntax in the spawn(8) manual page.
|
|
|
|
Feature: defer_if_permit and defer_if_reject actions in
|
|
access tables, mainly for use by the delegated policy
|
|
server. Files: smtpd/smtpd_check.c, proto/access.
|
|
|
|
20030725
|
|
|
|
The dict_pgsql module did not use dict_alloc() and dict_free(),
|
|
causing improper initialization and a memory leak. Leandro
|
|
Santi. File: util/dict_pgsql.c.
|
|
|
|
Cleanup: added open_flags sanity checks to the dict_pgsql
|
|
and dict_mysql modules. These maps must be opened in
|
|
read-only mode.
|
|
|
|
20030731
|
|
|
|
Bugfix: virtual(8) was changed to use mail_addr_find()
|
|
instead of virtual8_maps_find(), but the SMTP server's
|
|
virtual mailbox recipient validation was not updated.
|
|
|
|
20030804
|
|
|
|
Bugfix: the 20030712 safety against invalid DNS results
|
|
was broken. Reported by Ralf Hildebrandt. File:
|
|
dns/dns_lookup.c.
|
|
|
|
20030805-12
|
|
|
|
Safety: the pipe daemon now defers delivery with a warning
|
|
when it is given a non-existent command-line macro name.
|
|
File: pipe/pipe.c.
|
|
|
|
20030810
|
|
|
|
Bugfix: dict_ldap had a few harmless memory leaks. By
|
|
Liviu Daia. File: util/dict_ldap.c.
|
|
|
|
Feature: support for LDAP URLs in the LDAP parameter
|
|
"server_host", if Postfix is linked against OpenLDAP. This
|
|
allows Postfix to connect to LDAP SSL sources. By Liviu
|
|
Daia. File: util/dict_ldap.c.
|
|
|
|
20030811
|
|
|
|
Cleanup: produce a warning when host:port specifies a badly
|
|
formatted numerical port. Files: util/find_inet.c,
|
|
smtp/smtp_connect.c, lmtp/lmtp_connect.c.
|
|
|
|
20030822
|
|
|
|
Feature: the export_environment and import_environment
|
|
parameters now accept name=value information that will be
|
|
entered into the new environment. File: util/clean_env.c.
|
|
|
|
20030823
|
|
|
|
Feature: smtpd_sasl_exceptions_networks parameter to prevent
|
|
Postfix from offering AUTH to clients that match the listed
|
|
networks. Based on code by Ben Rosengart, Panix. Files:
|
|
conf/sample-auth.cf, smtpd/smtpd.c.
|
|
|
|
20030902
|
|
|
|
Portability: the Postfix master resets the file size to
|
|
the largest possible off_t value when the actual limit
|
|
appears to overflow the off_t range. Files: util/sys_defs.h,
|
|
util/file_limit.c. A fine sample of bit banging.
|
|
|
|
20030905
|
|
|
|
Workaround: Solaris 8 select() claims that a non-blocking
|
|
socket is readable and then read() fails with EAGAIN. Files:
|
|
util/timed_read.c and as precautionary measure,
|
|
util/timed_write.c.
|
|
|
|
Bugfix: dict_register() should not be called from dict_open()
|
|
in dict_mysql and dict_pgsql. Liviu Daia. Files:
|
|
util/dict_mysql.c, util/dict_pgsql.c.
|
|
|
|
Feature: LDAP parameters can now be specified in external
|
|
files. This makes it possible to securely store bind
|
|
passwords for plain auth outside of main.cf (which is world
|
|
readable). By Liviu Daia, based on a suggestion by Victor
|
|
Duchovni and Lamont Jones. File: util/dict_ldap.c.
|
|
|
|
Feature: STARTTLS option for LDAP, if Postfix is linked
|
|
against OpenLDAP. By Liviu Daia, amended by Victor Duchovni.
|
|
File: util/dict_ldap.c.
|
|
|
|
Cleanup: connections to LDAP sources are now postponed
|
|
until they are actually needed. By Liviu Daia. File:
|
|
util/dict_ldap.c.
|
|
|
|
20030908
|
|
|
|
The 20030905 Solaris workaround triggers too many warnings.
|
|
TCP sockets are back to blocking, and keepalives are turned
|
|
on to kill off dead sockets, as suggested by Leandro Santi.
|
|
Files: master/{single,multi}_server.c, smtpd/smtpd.c,
|
|
util/sys_defs.h.
|
|
|
|
20030909
|
|
|
|
Bugfix: the LMTP session caching code had problems with
|
|
SASL authentication after the first connection, and pipelining
|
|
was working poorly. Fix by Victor Duchovni, Morgan Stanley.
|
|
Files: lmtp/lmtp.c, lmtp/lmtp_proto.c.
|
|
|
|
20030912
|
|
|
|
Workaround: besides SMTP server sockets, SMTP client sockets
|
|
can also hang on Solaris, as reported by Leandro Santi. In
|
|
order to deal with this at the root, all connection management
|
|
is now done by sane_accept() and sane_connect(). Both turn
|
|
on keepalives on Solaris.
|
|
|
|
20030913
|
|
|
|
Safety: set-gid commands don't trust TZ. File: msg_syslog.c.
|
|
|
|
20030914
|
|
|
|
Address extension propagation wasn't documented enough when
|
|
it was added to Postfix. Based on patches by Roman Neuhauser.
|
|
|
|
Added clarifying notes to main.cf, master.cf and access by
|
|
Dean Gibson.
|
|
|
|
In header/body_checks, DUNNO is now the preferred action
|
|
instead of the now deprecated OK. This may confuse fewer
|
|
people.
|
|
|
|
In header/body_checks, allow text after IGNORE and DUNNO,
|
|
suggested by Victor Duchovni, Morgan Stanley. File:
|
|
src/cleanup/cleanup_message.c.
|
|
|
|
Feature: reject_rhsbl_helo. File: smtpd/smtpd_check.c.
|
|
|
|
Bugfix? The LMTP and SMTP clients now send "MAIL FROM:<sender>
|
|
AUTH=<>" when SASL authenticated. Suggested by by Victor
|
|
Duchovni, Morgan Stanley. Files: smtp/smtp_proto.c,
|
|
lmtp/lmtp_proto.c.
|
|
|
|
20030915
|
|
|
|
Bugfix: mail rejected by the before-queue content filter
|
|
was mis-labeled as a software error; it should be labeled
|
|
as a policy error instead. File: smtpd/smtpd.c.
|
|
|
|
Cleanup: postcat is now null-byte transparent. File:
|
|
postcat/postcat.c.
|
|
|
|
20030916
|
|
|
|
Feature: ``check_{sender,recipient}_mx_access maptype:mapname''
|
|
applies the named Postfix access table to the MX host name
|
|
and IP addresses for the sender or recipient address. If
|
|
no MX record is found, the A record is used instead. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
Feature: ``check_{sender,recipient}_ns_access maptype:mapname''
|
|
applies the named Postfix access table to the DNS server
|
|
hostname and IP addresses for the sender or recipient
|
|
address. If no NS record is found, the parent domain is
|
|
used instead. File: smtpd/smtpd_check.c.
|
|
|
|
20030917
|
|
|
|
Feature: ``check_helo_{ns,mx}_access maptype:mapname'',
|
|
same semantics as sender and recipient.
|
|
|
|
Multiple LDAP lookup tables in the one Postfix process now
|
|
share one LDAP connection. Code by Victor Duchovni, Morgan
|
|
Stanley. File: util/dict_ldap.c.
|
|
|
|
Performance: with prefix_domain specified for an LDAP lookup
|
|
table, lookups of @domain are skipped. Code by Victor
|
|
Duchovni, Morgan Stanley. File: util/dict_ldap.c.
|
|
|
|
Safety: check_mumble_{mx,ns}_access refuses to be used for
|
|
whitelisting. The Postfix SMTP server will reject the
|
|
request with "451 server configuration error" and will log
|
|
a warning explaining why. File: smtpd/smtpd_check.c.
|
|
|
|
20030918
|
|
|
|
Bugfix: check_mumble_ns_access did not correctly look up
|
|
NS records of parent domains, causing mail to be deferred
|
|
with a 450 status code. File: smtpd/smtpd_check.c.
|
|
|
|
20030919
|
|
|
|
Robustness: check_mumble_{mx,ns}_access skip over DNS lookup
|
|
failures instead of deferring mail. This is not as bad as
|
|
it appears to be because the restrictions can't be used
|
|
for whitelisting. File: smtpd/smtpd_check.c.
|
|
|
|
20030920
|
|
|
|
Bugfix: the 20030917 LDAP connection sharing code introduced
|
|
a compilation problem with non-OpenLDAP implementations.
|
|
Fix by Liviu Daia. File: util/dict_ldap.c
|
|
|
|
Compatibility: the LDAP server_host parameter now supports
|
|
all the usual Postfix list element delimiters. Some LDAP
|
|
libraries support just SPACE, others SPACE and ",". Postfix
|
|
now normalizes the host list into a space separated format.
|
|
This is less surprising to Postfix users used to the full
|
|
range of delimeters in other contexts. Implemented by Liviu
|
|
Daia. File: util/dict_ldap.c
|
|
|
|
Bugfix: after returning too old mail, the bounce daemon
|
|
now locks the original queue file and deletes deferred
|
|
recipients, to avoid repeated bounce notifications when
|
|
the queue manager is restarted. Files: bounce/*.[hc],
|
|
global/bounce_log.[hc], global/{bounce,defer}.[hc] and
|
|
everything that invokes these routines including queue
|
|
manager and delivery agents.
|
|
|
|
20030922
|
|
|
|
Feature: "XADDR address hostname" SMTP command, for SMTPD
|
|
restriction debugging, and for sites with fetchmail-like
|
|
software that extracts client information from the first
|
|
Received: header. The smtpd_authorized_xaddr_clients
|
|
parameter specifies what clients are allowed to use XADDR
|
|
(default: none). Files: smtpd/smtpd.c.
|
|
|
|
20031015
|
|
|
|
Workaround: smtpd access maps should not apply subdomain
|
|
name magic to numerical hostnames. File: smtpd/smtpd_check.c.
|
|
|
|
Safety: the local delivery agent now defers delivery when
|
|
alias lookup produces an empty result. File: local/alias.c.
|
|
|
|
20031019
|
|
|
|
Workaround: disable request/reply size limit in attr_scan*.c
|
|
to prevent mail from getting stuck when rewriting a malformed
|
|
message header. This limit was turned on with snapshot
|
|
20030715 to harden the protocol that is used by SMTPD policy
|
|
delegation. A "no code change" workaround is to specify
|
|
"header_size_limit = $line_length_limit". The proper fix
|
|
is to enforce request/reply size limits only for data from
|
|
outside of Postfix. Problem reported by Brandon Mullenberg,
|
|
Dialup USA. Files: util/attr_scan*.c.
|
|
|
|
Feature: "XLOGINFO address hostname" SMTP command, so that
|
|
Postfix daemons behind SMTPD pass-through proxies log useful
|
|
client name/address information instead of localhost[127.0.0.1].
|
|
The smtpd_authorized_xloginfo_clients parameter specifies
|
|
what clients are allowed to use XLOGINFO (default: none).
|
|
Files: smtpd/smtpd.c.
|
|
|
|
Cleanup: renamed the authorized_verp_clients parameter to
|
|
smtpd_authorized_verp_clients for consistency.
|
|
|
|
20031021
|
|
|
|
Workaround: the demo greylist script now uses BTREE instead
|
|
of HASH files for hopefully better stability. The real fix
|
|
is to use a single updater process that serves multiple
|
|
clients. That approach seems to work well with the verify
|
|
daemon. File: examples/smtpd-policy/smtpd-policy.pl.
|
|
|
|
20031022
|
|
|
|
Safety: the SMTP server now warns when the queue_minfree
|
|
value is less than twice the message size limit. File:
|
|
smtpd/smtpd.c.
|
|
|
|
Safety: the SMTP server no longer accepts mail when the
|
|
amount of free space is less than twice the message size
|
|
limit. File: smtpd/smtpd_check.c.
|
|
|
|
Safety: log a warning and defer mail when canonical or
|
|
virtual lookups return a non-address result (like a string
|
|
that contains no address). File: global/mail_addr_map.c.
|
|
|
|
Safety: log a warning and defer mail when any map lookup
|
|
returns an empty string result, and explain that "no result"
|
|
is expected in case of a "not found" condition. This happens
|
|
with incorrectly implemented SQL or LDAP tables. File:
|
|
global/maps_find.c.
|
|
|
|
20031023
|
|
|
|
Bugfix: the MYSQL and PGSQL modules invoked dict_register().
|
|
This was fixed a while ago but never made it into the
|
|
distribution. Files: util/dict*sql.c.
|
|
|
|
Robustness: added three ISSPACE() calls in the smtpd proxy
|
|
parser. File: smtpd/smtpd_proxy.c.
|
|
|
|
20031024
|
|
|
|
Portability: added localhost to mydestination for sites
|
|
that turn off append_dot_mydomain. File: global/mail_params.h.
|
|
|
|
20031027
|
|
|
|
Portability: MacOS X Bind8 compatibility. File: makedefs.
|
|
|
|
20031103
|
|
|
|
Robustness: flush pipelined "." and "quit" replies to avoid
|
|
repeated deliveries in case of a program crash (you know,
|
|
the kind of thing that happens before Postfix release :-).
|
|
File: smtpd/smtpd.c.
|
|
|
|
20031105
|
|
|
|
Portability: turn off NETINFO support for MacOS X Panther
|
|
by default. Files: makedefs, util/sys_defs.h.
|
|
|
|
20031106
|
|
|
|
Feature: the sample greylist policy server is now case
|
|
insensitive. File: examples/smtpd-policy/smtpd-policy.pl.
|
|
|
|
20031103-20031110
|
|
|
|
Feature: preliminary defense against SMTP clients that
|
|
hammer the SMTP server with too many simultaneous or
|
|
successive connection attempts, with a whitelist capability
|
|
to disable the restriction for authorized clients. Most
|
|
work is implemented by a new "anvil" server. Parameters:
|
|
smtpd_client_connection_count_limit, smtpd_client_connection-
|
|
_rate_limit, smtpd_client_connection_limit_exceptions, and
|
|
client_connection_rate_time_unit. Documentation: smtpd(8),
|
|
anvil(8), sample-smtpd.cf. Files: smtpd/smtpd.c,
|
|
global/anvil_clnt.[hc], anvil/anvil.c. The anvil server
|
|
logs peak count and rate information per client when it
|
|
terminates after running out of work or after "postfix
|
|
reload".
|
|
|
|
20031110
|
|
|
|
Cleanup: Postfix now supports the /0 netmask (match every
|
|
address). This is useful as a catch-all pattern at the
|
|
end of a table. Files: util/dict_cidr.c, util/match_ops.c.
|
|
|
|
Cleanup: don't report that $queue_directory/etc/filename
|
|
differs from /etc/filename when /etc/filename does not
|
|
exist. File: conf/postfix-script.
|
|
|
|
20031112
|
|
|
|
Feature: client_connection_status_update_time parameter
|
|
controls periodic logging of maximal connection counts or
|
|
rates. The default logging interval is 10 minutes.
|
|
|
|
Feature: "make makefiles WARN=stuff..." overrides the
|
|
built-in GCC warning options that are used when "make" is
|
|
invoked from within a source subdirectory. Files: makedefs,
|
|
*/Makefile.in.
|
|
|
|
20031125
|
|
|
|
Feature: qmgr logs "queueid: deleted", just like postsuper,
|
|
when it removes a message from the mail queue.
|
|
|
|
Performance: smtpd connects to the cleanup or proxy server
|
|
AFTER the first valid RCPT TO command, instead of after
|
|
the first valid MAIL FROM command. This avoid wasting
|
|
real-time proxy filter resources when mail is stopped by
|
|
the SMTP server's access blocks. File: smtpd/smtpd.c.
|
|
|
|
20031126
|
|
|
|
Bugfix: "panic: mymalloc: requested length 0" when master.cf
|
|
specified an invalid host name or address. Postfix now
|
|
logs more specific information. File: master/master_ent.c.
|
|
Reported by several people.
|
|
|
|
20031125-20031201
|
|
|
|
Feature: XCLIENT support to override the SMTP server's
|
|
client information for logging and/or access control. This
|
|
replaces the short-lived XADDR and XLOGINFO extensions.
|
|
Remotely based on code by Victor Duchovni. See FILTER_README
|
|
and SMTPD_PROXY_README for usage details. Files:
|
|
smtpd/{smtpd,smtpd_check,smtpd_proxy,smtpd_xclient}.c
|
|
smtp/smtp_smtp_proto.c, *qmgr/qmgr_message.c,
|
|
global/deliver_request.c.
|
|
|
|
20031202
|
|
|
|
Cleanup: postfix-files now has support for files that are
|
|
no longer part of Postfix. When upgrading Postfix, the
|
|
post-install script gives the user a reminder. Files:
|
|
conf/postfix-files, conf/post-install.
|
|
|
|
20031203
|
|
|
|
Support for SMTPD access map actions (FILTER, REDIRECT,
|
|
HOLD or DISCARD) that are delegated to the cleanup server,
|
|
but can trigger before the first valid recipient address
|
|
is accepted (and thus, before a cleanup server connection
|
|
is available). Files: smtpd/{smtpd,smtpd_state,smtpd_check}.c.
|
|
|
|
20031204
|
|
|
|
Bugfix: conf/post-install didn't skip non-existent obsolete
|
|
files. Victor Duchovni.
|
|
|
|
Minor cleanups of the xclient error messages; xclient
|
|
command lookup tables. File: smtpd/smtpd.c.
|
|
|
|
20031206
|
|
|
|
Feature: reject_sender_login_mismatch allows multiple owners
|
|
of a sender address. Code by Liviu Daia. Files:
|
|
smtpd/smtpd_check.c and documentation.
|
|
|
|
reject_sender_login_mismatch is now implemented by elementary
|
|
features reject_unauthenticated_sender_login_mismatch
|
|
(reject if the client is not SASL logged in but the sender
|
|
address has an owner in smtpd_sender_login_maps) and
|
|
reject_authenticated_sender_login_mismatch (reject if the
|
|
client is SASL logged in but does not own the sender
|
|
address). Code by Liviu Daia. Files: smtpd/smtpd_check.c
|
|
and documentation.
|
|
|
|
20031207
|
|
|
|
Bugfix: fallback_transport and mailbox_transport were broken
|
|
because the deliver_pass.c module was not updated for the
|
|
changed message delivery protocol.
|
|
|
|
20031211
|
|
|
|
Safety: in dynamically growing data structures, update the
|
|
length info after (instead of before) updating the data
|
|
size. Files: util/argv.c, util/inet_addrlist.c, util/intv.c,
|
|
util/mvect.c, util/vstring.c, global/recipient_list.c,
|
|
*qmgr/qmgr_rcpt_list.c.
|
|
|
|
20031212
|
|
|
|
Cleanup: separate extensions XCLIENT (impersonate SMTP
|
|
client) and XFORWARD (down-stream logging of up-stream MTA
|
|
and/or message information, not necessarily SMTP related).
|
|
The protocol is extensible: the server advertises what
|
|
attributes XCLIENT or XFORWARD will accept, and it is an
|
|
error to send an unsupported attribute. No xtext encoding
|
|
is used, since no attribute currently needs it. See also:
|
|
XCLIENT_README and XFORWARD_README.
|
|
|
|
20031214
|
|
|
|
Feature: XFORWARD support in the LMTP client.
|
|
|
|
20031215
|
|
|
|
Safety: updated mail_queue_id_ok() for long fast flush
|
|
logfile names. File: global/mail_queue.c.
|
|
|
|
Robustness: save and restore the resolver _res.options
|
|
settings before and after DNS lookup, to avoid surprises
|
|
in third-party code. This may eliminate some "localhost
|
|
not found" problems. File: dns/dns_lookup.c.
|
|
|
|
20031216
|
|
|
|
Cleanup: easier to parse mailq output (no more space
|
|
between short queue ID and message status). File:
|
|
showq/showq.c.
|
|
|
|
20031216-21
|
|
|
|
Cleanup: the SMTP client now moves on to the next MX host
|
|
or fallback relay when delivery fails in the middle of an
|
|
SMTP session. This includes both broken connections and
|
|
4xx SMTP server replies. Files: smtp/smtp.c, smtp_rcpt.c,
|
|
smtp/smtp_connect.c, smtp_trouble.c.
|
|
|
|
Configuration parameters: smtp_mx_address_limit (limit the
|
|
list of IP addresses from MX lookup), and smtp_mx_session_limit
|
|
(limit the number of actual SMTP sessions per delivery
|
|
attempt, ignoring unusable MX IP addresses).
|
|
|
|
The new code centers around a mark-and-sweep algorithm
|
|
(replacing code that twiddled the rcpt->offset structure
|
|
member), with paranoid sanity checks to ensure that every
|
|
recipient is explicitly accounted for.
|
|
|
|
20031217
|
|
|
|
Update: LDAP client logging (Liviu Daia) and LDAP client
|
|
documentation (Victor Duchovni). Files: util/dict_ldap.c,
|
|
conf/sample-ldap.cf, README_FILES/LDAP_README.
|
|
|
|
20031222
|
|
|
|
Cleanup: shaved half the worst-case bits off the cleanup
|
|
duplicate address filter footprint. After discussion with
|
|
Victor Duchovni. File: cleanup/cleanup_out_recipient.c.
|
|
|
|
Safety: added "mail loops to myself" logic for destinations
|
|
that don't have an MX host. File: smtp/smtp_addr.c.
|
|
|
|
20031223
|
|
|
|
Workaround: turn off "mail loops to myself" for non-MX
|
|
destinations because it breaks SMTP-based content filters.
|
|
Fix is to turn off loop detection when a non-default TCP
|
|
port is specified. File: smtp/smtp_addr.c.
|
|
|
|
Bugfix: restore errno after write failure in SIGCHLD handler.
|
|
Leandro Santi (who got the idea from Hernan Perez Masci).
|
|
File: master/master_sig.c.
|
|
|
|
Bugfix: the auto_clnt module disconnected too early, causing
|
|
unnecessary work by the anvil server.
|
|
|
|
Cleanup: eliminated binary hashes from anvil server. Anvil
|
|
client information is now stored on top of its VSTREAM.
|
|
|
|
20031226
|
|
|
|
Feature: bounce_queue_lifetime parameter (default:
|
|
$maximal_queue_life_time) that bounds the time that
|
|
MAILER-DAEMON messages spend in the queue before they are
|
|
considered undeliverable.
|
|
|
|
Feature: disable "mail loops back to myself" protection
|
|
when SMTP mail is sent to a non-standard port. This makes
|
|
setting up content filters less painful.
|
|
|
|
Cleanup: disallow bare x.x.x.x numeric IP addresses in
|
|
email addresses. The form user@[x.x.x.x] is still allowed.
|
|
|
|
Cleanup: cleaned up the naming of internal symbols in the
|
|
SMTP client.
|
|
|
|
20031231
|
|
|
|
Bugfix: stricter address syntax test broke "sendmail -bs".
|
|
File: smtpd/smtpd.c.
|
|
|
|
20040101
|
|
|
|
Cleanup: the Postfix SMTP server rejects a MAIL FROM address
|
|
that matches a local, virtual or relay domain, while the
|
|
address is not listed in the corresponding local, virtual
|
|
or relay recipient table.
|
|
|
|
Feature: the reject_unlisted_sender(recipient) SMTPD access
|
|
restriction rejects an address that matches a local, virtual
|
|
or relay domain, while the address is not listed in the
|
|
corresponding local, virtual or relay recipient table.
|
|
|
|
Compatibility: the check_recipient_maps restriction works
|
|
like reject_unlisted_recipient, but will eventually be
|
|
removed from Postfix.
|
|
|
|
20040102
|
|
|
|
Misc documentation cleanup by Loic Minier.
|
|
|
|
20040104
|
|
|
|
Workaround: MacOSX dumps core on the 20030913 TZ censoring
|
|
code. We explictly set TZ=UTC, which will produce incorrect
|
|
results when "mailq" formatting is moved from the showq
|
|
daemon to the postqueue command. File: msg_syslog.c.
|
|
|
|
Feature: after mail is requeued with "postsuper -r", the
|
|
pickup server logs the old queue ID together with the new
|
|
queue ID. Victor Duchovni. File: pickup/pickup.c.
|
|
|
|
Feature: smtpd_sasl_application_name parameter (default:
|
|
smtpd) to control the name of the SASL configuration file
|
|
used by the Postfix SMTP server. Liviu Daia. Files:
|
|
mail_params.h, smtpd.c, smtpd_sasl_glue.c.
|
|
|
|
Cleanup: the LDAP client configuration parser is now shared
|
|
between the LDAP, MySQL, and PGSQL clients. Liviu Daia.
|
|
Files: global/cfgparser.[hc], global/dict_ldap.c,
|
|
global/dict_mysql.c, global/dict_pgsql.c and documentation.
|
|
|
|
Cleanup: moved "util" modules with dependencies on higher-level
|
|
"global" code from the util directory to the global directory:
|
|
util/dict_open.c, global/cfgparser.[hc], global/dict_ldap.c,
|
|
global/dict_mysql.c, global/dict_pgsql.c, global/mail_dict.c.
|
|
|
|
Cleanup: the new queue manager nqmgr replaces the default
|
|
queue manager qmgr, leaving behind a hard link for backwards
|
|
compatibility. The old queue manager remains available as
|
|
as oqmgr but will eventually be removed.
|
|
|
|
Bugfix: vstring_get() etc. now return VSTREAM_EOF when they
|
|
terminate prematurely, instead of returning the last
|
|
character stored. This avoids mis-leading warnings. File:
|
|
global/vstring_vstream.c.
|
|
|
|
20040105
|
|
|
|
Cleanup: don't bother the flush daemon while deferring mail
|
|
if the destination is not "fast flush" eligible. File:
|
|
global/flush_clnt.c.
|
|
|
|
Safety: the SMTP server flushes recipients to the cleanup
|
|
server in order to avoid SMTP timeouts when virtual or
|
|
canonical expansions take a lot of time. File smtpd/smtpd.c.
|
|
|
|
Safety: add warnings to postmap and postalias when table
|
|
lookup results in an empty string.
|
|
|
|
20040110
|
|
|
|
Example: script to run qmail-local from Postfix by Ron
|
|
Bickers.
|
|
|
|
Change: queue minfree limit is now 1.5 * message size limit.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
Bugfix: apply hostname restriction even when host address
|
|
lookup fails in check_{sender,recipient}_{ns,mx}_access.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
20040115
|
|
|
|
Performance: allow delivery concurrency to increase even
|
|
while mail is deferred, as long as the delivery agent does
|
|
not report really serious trouble with the destination.
|
|
Files: *qmgr/qmgr_deliver.c.
|
|
|
|
Cleanup: in postfix-files, symbolic links and hard links
|
|
are now first-class citizens with explicit mention of source
|
|
and destination pathnames. Files: postfix-install,
|
|
conf/postfix-files, conf/post-install.
|
|
|
|
20040116
|
|
|
|
Cleanup: sendmail -v caused one mail delivery report upon
|
|
every delivery attempt, not just the first one. The fix is
|
|
to "kill" a queue file record after the first delivery
|
|
attempt. This means a new record type. Files: *qmgr/qmgr_active.c,
|
|
*qmgr/qmgr_message.c, global/rec_type.c.
|
|
|
|
Cleanup: in anticipation of other built-in rate limiters,
|
|
the client_connection_rate_time_unit parameter is renamed
|
|
to client_rate_time_unit.
|
|
|
|
Documentation: finished the HOSTING_README file with an
|
|
overview of methods to host domains with Postfix.
|
|
|
|
20040119
|
|
|
|
Bugfix: anvil (count and rate limiting) server race condition
|
|
could result in dangling pointer. Postfix erases memory
|
|
after allocating and before freeing, so it is extremely
|
|
unlikely that this could be used to bring harmful data into
|
|
the anvil server. File anvil/anvil.c.
|
|
|
|
20040120
|
|
|
|
Cleanup: new header_checks(5) and body_checks(5) manual
|
|
pages. The sample-regexp* and sample-pcre* files are no
|
|
longer needed and have been removed, as are the default
|
|
*_table configuration files.
|
|
|
|
Cleanup: support for the non-standard Errors-To: header is
|
|
removed. File: cleanup/cleanup_message.c.
|
|
|
|
20040121
|
|
|
|
Feature: "PREPEND headername: headervalue" action in Postfix
|
|
access maps, to facilitate external policy servers that
|
|
label mail instead of rejecting it. Files: smtpd/smtpd.c,
|
|
smtpd/smtpd_check.c.
|
|
|
|
20040122
|
|
|
|
UNDO the 20040104 change (vstring_get() etc. return
|
|
VSTREAM_EOF when they terminate prematurely, instead of
|
|
returning the last character stored, to avoid mis-leading
|
|
warnings). File: global/vstring_vstream.c.
|
|
|
|
Portability: test -e is not portable. File: conf/postfix-script.
|
|
|
|
Misc. documentation fixes by Victor Duchovni.
|
|
|
|
Documentation: the README files are now hyperlinked, and
|
|
are referenced in the on-line manual pages.
|
|
|
|
Bugfix: the pickup daemon now strokes the watchdog frequently
|
|
to prevent the watchdog from barking when mail arrives
|
|
faster than it can be picked up. File: pickup/pickup.c.
|
|
|
|
20040123
|
|
|
|
Feature: set smtpd_reject_unlisted_{sender,recipient}=no
|
|
to turn off automatic rejection of non-existent local,
|
|
virtual or relay addresses. This way it can be made
|
|
conditional for local clients, always on for remote clients.
|
|
Files: global/mail_params.h, smtpd/smtpd.c, smtpd/smtpd_check.c.
|
|
|
|
20040124
|
|
|
|
Feature: PREPEND in header/body_checks, for message tagging.
|
|
File: cleanup/cleanup_message.c.
|
|
|
|
20040126
|
|
|
|
Safety: handle the case that main.cf is updated while it
|
|
is being read. File: util/dict.c.
|
|
|
|
Feature: "instance" attribute that links policy etc. queries
|
|
to the same message instance.
|
|
|
|
Cleanup: the mynetworks setting may now be empty. File:
|
|
global/mail_params.c.
|
|
|
|
20040127
|
|
|
|
Bugfix: missing flush_init() call. Introduced 20040105.
|
|
File: postqueue/postqueue.c.
|
|
|
|
20040128
|
|
|
|
Cleanup: clnt_stream derived classes now try to detect that
|
|
the server has disconnected before sending data and warning
|
|
about an error. File: global/clnt_stream.c.
|
|
|
|
20040202
|
|
|
|
Bugfix: changed mis-leading warning about text>4096 characters
|
|
into "unexpected end-of-input". File: util/attr_scan0.c.
|
|
|
|
20040201
|
|
|
|
Feature: sasl_method, sasl_username and sasl_sender attributes
|
|
in smtpd policy queries. Files: src/smtpd/smtpd_check.c.
|
|
|
|
20040204
|
|
|
|
Safety: smtpd_soft_error_limit now determines when
|
|
$smtpd_error_sleep_time starts to take effect.
|
|
|
|
Cleanup: local(8) and virtual(8) will now create maildirs
|
|
in a world-writable directory. Files: util/make_dirs.c.
|
|
|
|
Bugfix: don't panic on a corrupt queue file. File:
|
|
*qmgr/qmgr_message.c.
|
|
|
|
20040205
|
|
|
|
Cleanup: sample-filter.cf is gone. Better documentation is
|
|
available with "man header_checks".
|
|
|
|
20040209
|
|
|
|
Bugfix: when delivery to smtpd_proxy_filter fails, report
|
|
"451 Queue file write error" instead of repeating the
|
|
previous "354 End data with <CR><LF>.<CR><LF>" response.
|
|
File: smtpd/smtpd.c.
|
|
|
|
20040220
|
|
|
|
Compatibility: accept and ignore the sendmail -bh and -bH
|
|
mode of operation requests.
|
|
|
|
20040302
|
|
|
|
Bugfix: SMTPD proxy didn't send QUIT as the result of code
|
|
duplication. Evidence reported by Mark Martinec. File:
|
|
smtpd/smtpd.c.
|
|
|
|
20040311
|
|
|
|
Bugfix: bad address syntax was passed to transport map
|
|
lookups. Problem reported by Andrei Koulik. File:
|
|
util/match_ops.c, trivial-rewrite/resolve.c.
|
|
|
|
20040324
|
|
|
|
Portability: ekkoBSD support by Philip Reynolds. Files:
|
|
makedefs, util/sys_defs.h.
|
|
|
|
20040325
|
|
|
|
Cleanup: smtp_skip_4xx_greeting and smtp_skip_5xx_greeting
|
|
functionality is moved from connection management to SMTP
|
|
protocol processing, so that Postfix now logs the server
|
|
response when a server refuses to provide service. Files:
|
|
smtp/smtp_connect.c, smtp/smtp_proto.c.
|
|
|
|
Cleanup: smtp_skip_4xx_greeting is no longer configurable;
|
|
it is now permanently turned on.
|
|
|
|
20040326
|
|
|
|
Workaround: in the trivial-rewrite server, turn on the code
|
|
to strip trailing "." while rewriting addresses, and change
|
|
the address resolver to strip trailing "." in a compatible
|
|
manner. This does not eliminate the problem that the SMTP
|
|
server may use a different address for recipient validation
|
|
than what the cleanup server uses for virtual alias mapping.
|
|
|
|
20040329
|
|
|
|
Bugfix: the SMTP server did not log client (and SASL)
|
|
information with the real-time content filter was enabled.
|
|
Files: smtpd/smtpd.c, smtpd/smtpd_sasl_proto.c.
|
|
|
|
Compatibility: smtpd_reject_unlisted_sender is turned off
|
|
by default, to avoid trouble with with in-house software
|
|
that sends out mail software with an unreplyable address.
|
|
|
|
20040331
|
|
|
|
Bugfix: postdrop should not abandon mail submission after
|
|
receiving a SIGHUP signal when SIGHUP was ignored by the
|
|
parent process. Victor Duchovni, Morgan Stanley. File:
|
|
postdrop/postdrop.c.
|
|
|
|
Bugfix: parsing bug in PgSQL dictionaries causing UNIX
|
|
sockets to be ignored. Liviu Daia. Files: global/dict*sql.c.
|
|
|
|
Performance: allow MySQL and PgSQL database connections to
|
|
be closed when idle for more than 1 minute; Liviu Daia.
|
|
Files: global/dict*sql.c.
|
|
|
|
20040401
|
|
|
|
Sanity: the SMTP server no longer accepts sender or recipient
|
|
addresses that end in the "@" null domain, as well as
|
|
addresses that rewrite into such a form. Specify
|
|
"resolve_null_domain=yes" to get the old behavior back.
|
|
File: trivial-rewrite/resolve.c.
|
|
|
|
20040402
|
|
|
|
Cleanup: added WARN action support for access maps, for
|
|
consistency with the WARN action in header and body checks.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
20040407
|
|
|
|
Bugfix: missing return statement at the end of the
|
|
FREE_MEMORY_AND_RETURN error handling macro. Adi Prasaja.
|
|
File: trivial-rewrite/resolve.c.
|
|
|
|
20040411
|
|
|
|
Future proofing: client_rate_time_unit is renamed to
|
|
anvil_rate_time_unit, so that it is no longer limited to
|
|
clients only. File: src/global/mail_params.h.
|
|
|
|
Cleanup: postalias and postmap now log problems to syslogd.
|
|
Files: postalias/postalias.c, postmap/postmap.c.
|
|
|
|
20040413
|
|
|
|
Feature: "postfix set-permissions" (re)sets ownership and
|
|
access permissions of Postfix files and directories.
|
|
|
|
Feature: "postfix upgrade-configuration" updates main.cf
|
|
and master.cf. This is for people who people copy over
|
|
their old files after installing a newer Postfix version.
|
|
|
|
Feature: HTML files are now optionally installed under
|
|
control of the html_directory configuration parameter.
|
|
Files: postfix-install, conf/postfix-files, conf/post-install.
|
|
|
|
Cleanup: README file installation is now optional. Files:
|
|
postfix-install, conf/postfix-files, conf/post-install.
|
|
|
|
20040414
|
|
|
|
Cleanup: references to sample-mumble.cf files removed,
|
|
conf/mumble_table files removed, new commands added to
|
|
conf/postfix-script.
|
|
|
|
Cleanups: function declared in but used as void, missing
|
|
include file, missing const qualifier, unused variable.
|
|
Matthias Andree. Files: bounce/bounce_notify_util.c,
|
|
bounce/bounce_service.h, postlog/postlog.c, smtpd/smtpd_check.c,
|
|
util/attr_scan64.c.
|
|
|
|
Bugfix: more robust version of SIGHUP test of 20040331.
|
|
Victor Duchovni, Morgan Stanley. File: postdrop/postdrop.c.
|
|
|
|
Safety: added NOCLOBBER qualifiers to local variables that
|
|
might be clobbered by longjmp(). Files: util/sys_defs.h,
|
|
smtp/smtp_proto.c, lmtp/lmtp_proto.c, smtpd/smtpd_check.c,
|
|
smtpstone/smtp-source.c.
|
|
|
|
Bugfix: sub-level Makefiles no longer turned on the extra
|
|
compiler warnings. Files: Makefile.in.*, makedefs.*.
|
|
|
|
20040415
|
|
|
|
Bugfix: the LMTP client attempted to reuse a connection
|
|
after timeout, causing protocol synchronization errors.
|
|
Reported by Rob Mueller. File: lmtp/lmtp.c.
|
|
|
|
20040416
|
|
|
|
Cleanup: non-delivery reports now include the original
|
|
recipient information. File: bounce/bounce_notify_util.c.
|
|
|
|
20040415-18
|
|
|
|
Typos: many documentation fixes by Rob Foehl.
|
|
|
|
20040418
|
|
|
|
Cleanup: "int" versus "const int" prototype mismatch between
|
|
the DICT sequence method prototype and possible implementations.
|
|
Files: util/dict_db.c, util/dict_dbm.c.
|
|
|
|
20040419
|
|
|
|
Bugfix: the code that rejects client/helo RESTRICTIONS with
|
|
smtpd_delay_reject=no looked at the wrong evidence and
|
|
rejected client/helo ACCESS MAP lookups instead. Michael
|
|
Tokarev. Files: smtpd/smtpd.c, smtpd/smtpd_check.c.
|
|
|
|
Bugfix: missing # in master.cf in optional submission
|
|
service.
|
|
|
|
20040420
|
|
|
|
Bugfix: smtpd logged the client too often. Michael Tokarev.
|
|
File: smtpd/smtpd.c.
|
|
|
|
Cleanup: client_event_status_update_time renamed to
|
|
anvil_status_update_time. Files: mantools/postlink,
|
|
proto/postconf.proto, anvil/anvil.c.
|
|
|
|
20040421
|
|
|
|
Workaround: allow pipelined SMTP clients to overshoot the
|
|
SMTP server recipient limit without triggering the server
|
|
hard error limit. The SMTP server does not count "too many
|
|
recipients" towards the hard error limit, as long as the
|
|
number of excess recipients stays within a configurable
|
|
overshoot limit (default: smtpd_recipient_overshoot_limit
|
|
= 1000). Solution in cooperation with Victor Duchovni.
|
|
Files: smtpd/smtpd.c, smtpd/smtpd_state.c, smtpd/smtpd.h.
|
|
|
|
20040502
|
|
|
|
Missing test for a never used flag (the problematic and
|
|
thus never completed INSPECT feature that doesn't re-inject
|
|
mail into Postfix). Victor Duchovni, Morgan Stanley. File:
|
|
virtual/virtual.c.
|
|
|
|
20040503
|
|
|
|
Bugfix: missing "sasl enabled" guard in the SMTPD policy
|
|
client. File: smtpd/smtpd_check.c.
|
|
|
|
20040606
|
|
|
|
Portability. UnixWare has strcasecmp() in strings.h. Patch
|
|
by Andreas Winkelmann. File: util/sys_defs.h.
|
|
|
|
Portability. The postlink script is transformed from sed(1)
|
|
to perl(1).
|
|
|
|
20040608
|
|
|
|
Portability. Introduced SET_H_ERRNO() macro for compilation
|
|
environments where h_errno can't be used as an lvalue.
|
|
Files: util/sys_defs.h, dns/dns_lookup.c.
|
|
|
|
Portability. Eliminate assumption on bits per byte from
|
|
vbuf_print.c.
|
|
|
|
20040614
|
|
|
|
Bugfix: the SMTP client did not reset per-session EHLO,
|
|
SASL, and history information when opening a connection to
|
|
an alternate SMTP server. This is the result of abstraction
|
|
no longer matching function. Reported and diagnosed by
|
|
Victor Duchovni, Morgan Stanley.
|
|
|
|
Bugfix: non-portable reuse of variadic argument lists.
|
|
Fix by Victor Duchovni, Morgan Stanley. Files: global/bounce.c,
|
|
global/defer.c, global/sent.c, global/trace.c, global/verify.c.
|
|
|
|
Portability: NetBSD 2.0 has changed from statfs to statvfs.
|
|
John Heasley. File: util/sys_defs.h.
|
|
|
|
Documentation: typo fixes by IKEDA Nozomu.
|
|
|
|
20040616
|
|
|
|
Bugfix: one missed variadic argument list fix. Victor
|
|
Duchovni, Morgan Stanley. File: global/verify.c.
|
|
|
|
Bugfix: the resolver client cache should be context dependent
|
|
because address verification probes may use a different
|
|
route than normal mail deliveries. File: global/resolve_clnt.c.
|
|
|
|
Safety: added similar context dependence to the address
|
|
rewriting client in order to avoid trouble when Postfix is
|
|
changed. File: global/rewrite_clnt.c.
|
|
|
|
Bugfix: space in HELO commands could end up in XFORWARD
|
|
commands. File: smtpd/smtpd.c.
|
|
|
|
20040619
|
|
|
|
Code reorganization: in preparation for SMTP session caching,
|
|
the SMTP client data structures were changed from the
|
|
original "one session per delivery request" model to an
|
|
explicit "multiple sessions per delivery request" model.
|
|
This uncovered ESMTP and SASL missing re-initialization
|
|
problems that were fixed in past week. Design by Victor
|
|
and Wietse, initial implementation by Victor Duchovni.
|
|
|
|
20040620
|
|
|
|
Future proofing: after the reorganization of SMTP request
|
|
state and session state, added code to the smtp client
|
|
error handling routines to more consistently deal with the
|
|
possibility that session information is not available.
|
|
|
|
20040621
|
|
|
|
Feature: directory=pathname option for the pipe(8) delivery
|
|
agent. This allows a command to run from a fixed directory.
|
|
Failure to change directory causes delivery to be deferred.
|
|
Files: pipe/pipe.c.
|
|
|
|
Feature: command_execution_directory for local(8) delivery
|
|
to external command. This supports the usual $home etc.
|
|
expansions, subject to filtering with the character set
|
|
specified with $execution_directory_expansion_filter.
|
|
Failure to change directory causes delivery to be deferred.
|
|
Files: global/mail_params.h, local/command.c.
|
|
|
|
Support for external command execution directory. Files:
|
|
global/pipe_command.[hc].
|
|
|
|
20040622
|
|
|
|
Safety: when mail is delivered to a transport with per-delivery
|
|
recipient limit of 1, split the recipient address on the
|
|
recipient delimiter if one is defined, so that extended
|
|
addresses don't get extra delivery concurrency slots.
|
|
Files: *qmgr/qmgr_message.c.
|
|
|
|
20040623
|
|
|
|
Workaround for fragile clients: add microsecond time to
|
|
maildir filename. Files: virtual/maildir.c, local/maildir.c.
|
|
|
|
20040628-20040701
|
|
|
|
SMTP connection caching work with Victor Duchovni.
|
|
|
|
New module (later renamed to global/scache_single.c) for
|
|
protocol-independent session caching. The initial
|
|
implementation supports in-process, single-session caching
|
|
only. A later version will support a central session cache
|
|
daemon. Some more work is needed for passivation/activation
|
|
of session attributes.
|
|
|
|
New function vstream_fdclose() to destroy a VSTREAM while
|
|
leaving the underlying file(s) open. Files: util/vstream.[hc].
|
|
|
|
New function dns_rr_remove() to remove one record from a
|
|
resource record list. Some more work is needed to turn the
|
|
list into a doubly-linked one. Files: dns/dns.h, dns/dns_rr.c.
|
|
|
|
Restructuring of the SMTP protocol engine for session
|
|
caching. File: smtp/smtp_proto.c.
|
|
|
|
Restructuring of the connection management module, and
|
|
first implementation of SMTP connection caching. To enable,
|
|
specify an smtp_connection_cache_time value greater than
|
|
zero. The time unit is seconds. File: smtp/smtp_connect.c.
|
|
|
|
New code to passivate and re-activate SMTP_SESSION objects,
|
|
and isolation of session save/lookup in its own module.
|
|
Files: smtp/smtp_session.c, smtp/smtp_reuse.c.
|
|
|
|
Refinement: smtp_cache_reuse_limit parameter to bound the
|
|
number of times a session may be reused.
|
|
|
|
Refinements: when a session comes from the cache, give it
|
|
back to the cache anyway (even when it will not be listed
|
|
under the next-hop destination name).
|
|
|
|
Future refinements should also include a bound on the number
|
|
of consecutive and total non-delivering uses and other
|
|
statistics.
|
|
|
|
20040714
|
|
|
|
Bugfix: the code to eliminate the local MTA from the MX
|
|
address list did not handle the case that inet_interfaces
|
|
produced a less preferred match than proxy_interfaces.
|
|
Victor Duchovni, Morgan Stanley. File: smtp/smtp_addr.c.
|
|
|
|
20040715
|
|
|
|
Resume work on SMTP session caching. All good sessions
|
|
are now cached under their IP address. As before, only the
|
|
first good session per delivery request is cached under
|
|
the original next-hop destination.
|
|
|
|
At this point, SMTP session caching works, with a session
|
|
cache client module that uses in-process session caching.
|
|
This is sufficient to demonstrate that the SMTP client is
|
|
ready for session caching.
|
|
|
|
20040716
|
|
|
|
New modules to send file descriptors from one process into
|
|
another one. This will be needed for implementing a central
|
|
connection cache manager daemon. Most systems use UNIX-domain
|
|
sockets as the transport for this. On Solaris we use streams
|
|
instead. Applications are supposed to invoke LOCAL_SEND_FD()
|
|
and LOCAL_RECV_FD(). Files: {unix,streams}_{send,recv}_fd.c.
|
|
|
|
20040717
|
|
|
|
First implementation of a session caching client API that
|
|
actually sends to/receives from a caching server process.
|
|
The old in-process, single-session caching functionality
|
|
is preserved as global/scache_single.c, so that we can use
|
|
it for bootstrapping the session cache server. File:
|
|
global/scache_clnt.c.
|
|
|
|
First implementation of the scache session cache server,
|
|
using the same in-process session caching code that was
|
|
used to bootstrap the SMTP client. File: scache/scache.c.
|
|
|
|
20040718
|
|
|
|
Performance: the default RSET timeouts are reduced from
|
|
120s to 20s. Perhaps there should be different RSET timeout
|
|
for address probes and for session cache checks. File:
|
|
global/mail_params.h.
|
|
|
|
20040719
|
|
|
|
Multi-session connection cache module. Implementing this
|
|
was actually the easiest part of the entire connection
|
|
caching project. File: global/scache_multi.c.
|
|
|
|
20040720
|
|
|
|
Bugfix: event_drain() falsely reported a single-entry timer
|
|
queue as empty. File: util/events.c.
|
|
|
|
Completed the multi-session cache support for SMTP. The
|
|
code can be stress tested with a driver program that reads
|
|
commands from a script. It is not practical to manually
|
|
test the effects of collisions in the time or in name space
|
|
domains. File: global/scache.c.
|
|
|
|
20040721
|
|
|
|
Feature: the session cache server now logs cache hit and
|
|
miss statistics every $session_cache_status_update_time
|
|
seconds (default: 600s), as well as upon process exit.
|
|
File: scache/scache.c.
|
|
|
|
20040722
|
|
|
|
Workaround: LINUX 2.4 has trouble with mixed data and file
|
|
descriptor traffic on UNIX-domain stream sockets.
|
|
Specifically, it cannot handle data write (read) followed
|
|
by file descriptor send (receive): the receiver hangs in
|
|
recvmsg(). Workaround is to insert an intervening read
|
|
(write) operation. Presumably, LINUX 2.4 is confusing the
|
|
data and file descriptor. Lucky Ralf Hildebrandt. Files:
|
|
util/sys_defs.h, global/scache_clnt.c, scache/scache.c.
|
|
|
|
20040723
|
|
|
|
Safety: spawn(8) now rejects a user with the -1 UID or GID
|
|
value, so that commands will not end up running as root.
|
|
Files: util/spawn_command.c, spawn/spawn.c.
|
|
|
|
User interface: parameter smtp_connection_cache_domains
|
|
renamed to smtp_connection_cache_destinations. Destinations
|
|
listed here must be specified without [] or :port. File:
|
|
smtp/smtp_connect.c.
|
|
|
|
Bugfix: "421 Timeout exceeded" wasn't guarded by setjmp().
|
|
Victor Duchovni, Morgan Stanley. File: smtpd/smtpd.c.
|
|
|
|
20040729
|
|
|
|
Feature: enable SMTP session caching temporarily while a
|
|
postfix is able to schedule back-to-back deliveries.
|
|
Parameter: smtp_connection_cache_on_demand (default:
|
|
yes). Files: smtp/smtp_connect.c, *qmgr/qmgr_entry.c,
|
|
*qmgr/qmgr_queue.c, *qmgr/qmgr_deliver.c.
|
|
|
|
Feature: smtp-source -N option to generate unique recipient
|
|
addresses for (trivial-rewrite) stress testing. Victor
|
|
Duchovni, Morgan Stanley. File: smtpstone/smtp-source.c.
|
|
|
|
20040730
|
|
|
|
Safety: disallow "opportunistic session caching" when the
|
|
queue manager is unable to schedule back-to-back deliveries.
|
|
File: *qmgr/qmgr_entry.c.
|
|
|
|
20040731
|
|
|
|
Hysteresis: turn on "opportunistic session caching" when
|
|
back-to-back deliveries happen, but don't turn if off
|
|
until both concurrent and back-to-back delivery ends.
|
|
|
|
20040801
|
|
|
|
Workaround: disable session caching for Linux < 2.2 (does
|
|
not work) or Glibc < 2 (does not compile). Files:
|
|
util/sys_defs.h, util/unix_{recv,send}_fd.c.
|
|
|
|
Portability: h_errno is not an lvalue in the UnixWare 7.1
|
|
multi-threaded environment. Olivier PRENANT.
|
|
|
|
20040812
|
|
|
|
Bugfix: update SMTP server error counter when a client is
|
|
denied access with smtpd_delay_reject=no.
|
|
|
|
20040816
|
|
|
|
Bugfix: The smtp_chat_cmd() forced output flushing code in
|
|
the SMTP client could run before an I/O error handler was
|
|
set up. Problem diagnosed by Victor Duchovni, Morgan
|
|
Stanley. The fix is to disable the smtp_chat_cmd() forced
|
|
output flushing code as it duplicates better code in
|
|
smtp_loop(). File: smtp/smtp_chat.c.
|
|
|
|
Safety: set up an I/O error handler before the smtp_loop()
|
|
protocol engine starts; this handler logs a warning in case
|
|
it ever runs, because that means someone broke ESMTP command
|
|
pipelining. File: smtp/smtp_proto.c.
|
|
|
|
Feature: canonical_classes parameter by Kimmo Suominen, to
|
|
control what addresses are rewritten by canonical_maps.
|
|
Files: cleanup/cleanup_addr.c, cleanup/cleanup_message.c.
|
|
|
|
20040817
|
|
|
|
Bugfix: update the vstream I/O time AFTER the completion
|
|
of an I/O request, so that time-sensitive applications
|
|
don't force flush output too soon and possibly trigger
|
|
NAGLE delays. Problem diagnosed by Victor Duchovni, Morgan
|
|
Stanley. File: util/vstream.c.
|
|
|
|
Portability: avoid postmap/postalias test file name clashes
|
|
on Windows. Ian Lance Taylor (of Taylor UUCP fame).
|
|
|
|
20040823
|
|
|
|
Bugfix: vstream_popen() did not close the child pipe
|
|
after failure to fork(). File: util/vstream_popen.c.
|
|
|
|
20040826
|
|
|
|
Feature: support for systems with closefrom(), and emulation
|
|
for those without. Andrew Brown. Files: util/sys_defs.h,
|
|
util/sys_compat.c.
|
|
|
|
20040827
|
|
|
|
Feature: {sender,recipient}_canonical_classes parameters,
|
|
which give better control than sender_canonical_classes.
|
|
Files: cleanup/cleanup_addr.c, cleanup/cleanup_message.c.
|
|
|
|
Feature: the proxymap client now recognizes when a map
|
|
can't be proxied, and will open it directly instead. This
|
|
makes proxy maps easier to use for virtual mailbox domains.
|
|
File: global/dict_proxy.c.
|
|
|
|
Feature: smtp_sasl_mechanism_filter restricts what remote
|
|
SMTP server mechanism names the Postfix SMTP client passes
|
|
on to the SASL library. Victor Duchovni, Morgan Stanley.
|
|
Files: smtp/smtp.c. smtp/smtp_sasl_glue.c, smtp/smtp_sasl_proto.c.
|
|
|
|
20040828
|
|
|
|
User interface: when no recipients are specified, the
|
|
Postfix sendmail command now terminates with status EX_USAGE
|
|
instead of accepting the mail first and bouncing it later.
|
|
This gives more direct feedback in case of a common client
|
|
configuration error. File: sendmail/sendmail.c.
|
|
|
|
20040829
|
|
|
|
Portability: Solaris closefrom() support didn't work for
|
|
non-SUN compilers. Victor Duchovni, Morgan Stanley.
|
|
|
|
20040830
|
|
|
|
Feature: the scache(8) session cache manager now logs the
|
|
peak counts of destinations, endpoints and sessions. Files:
|
|
scache/scache.c, global/scache*c.
|
|
|
|
20040831
|
|
|
|
Portability: disable session caching support on SCO 5
|
|
because of incompatible sockets API. File: util/sys_defs.h.
|
|
|
|
20040913
|
|
|
|
Bugfix (introduced 20020803): sent the wrong bounce message
|
|
type when a Delivered-To: loop was detected for a mailing
|
|
list alias. Nicolas Riendeau. File: bounce_notify_util.c.
|
|
|
|
20040918
|
|
|
|
Feature: authorized_flush_users, authorized_mailq_users,
|
|
authorized_submit_users to restrict what users can flush
|
|
the queue, list the queue, or submit mail locally. Based
|
|
on code by Victor Duchovni, Morgan Stanley. Files:
|
|
sendmail/sendmail.c, postdrop/postdrop.c, postqueue/postqueue.c,
|
|
global/user_acl.[hc].
|
|
|
|
Feature: discard(8) mail delivery agent. Victor Duchovni,
|
|
Morgan Stanley. File: discard/discard.c.
|
|
|
|
20041002
|
|
|
|
Long overdue, a master(5) manual page based on an initial
|
|
version by Magnus Baeck.
|
|
|
|
By popular demand, a postfix-manuals.html web page with
|
|
totally useless links to UNIX-style manual pages (the same
|
|
information should already be available simply by typing
|
|
"apropos postfix"). To keep newbies from getting completely
|
|
lost due to information overload, the document starts with
|
|
a list of actually useful pointers to Postfix introductions,
|
|
duplicated from the already existing documents.html.
|
|
|
|
20041006
|
|
|
|
Bugfix: "sendmail -bv" did not reject the -t option. File:
|
|
sendmail/sendmail.c.
|
|
|
|
20041007
|
|
|
|
Feature: SASL authentication attributes are now stored in
|
|
queue files and passed on to delivery agents, by Leandro
|
|
Santi. Files: deliver_pass.c, deliver_request.c,
|
|
qmgr_deliver.c, qmgr_message.c, pipe.c, smtpd.c.
|
|
|
|
20041009
|
|
|
|
Feature: per SMTP client message rate limit and recipient
|
|
rate limit, by Ragnar Lonn, GHN network technologies.
|
|
Files: smtpd/smtpd.c, anvil/anvil.c, global/anvil_clnt.[hc].
|
|
|
|
Incompatibility: smtpd_client_connection_limit_exceptions
|
|
renamed to smtpd_client_event_limit_exceptions, because it
|
|
now also controls message and recipient rate limit control.
|
|
|
|
20041013
|
|
|
|
Portability: AIX 5.1/GCC.
|
|
|
|
20041014-23
|
|
|
|
Postfix no longer appends the local domain to header
|
|
addresses from remote clients. Instead, Postfix either
|
|
does not rewrite those headers at all, or it appends the
|
|
domain specified with the new remote_header_rewrite_domain
|
|
parameter.
|
|
|
|
Postfix still appends $@myorigin or .$mydomain to headers
|
|
from the Postfix sendmail command, or from clients listed
|
|
with the new local_header_rewrite_clients parameter (default:
|
|
permit_mynetworks, permit_sasl_authenticated).
|
|
|
|
These changes affect the SMTP server (including XFORWARD
|
|
support), the cleanup server (do or don't rewrite headers),
|
|
the trivial-rewrite server (append local domain or surrogate
|
|
remote domain to incomplete addresses), the queue manager
|
|
(send additional attributes to delivery agents), the LMTP
|
|
and SMTP clients (XFORWARD support), and the local delivery
|
|
agent (preserve XFORWARD attributes when forwarding mail).
|
|
|
|
20041016
|
|
|
|
Bugfix: attr_clnt_request() did not properly skip hash
|
|
table arguments. Luc Pardon, Skopos Consulting. File:
|
|
util/attr_clnt.c.
|
|
|
|
20041018
|
|
|
|
The NIS+ module by Geoff Gibbs is now part of Postfix.
|
|
Files: util/dict_nisplus.c, proto/nisplus_table.
|
|
|
|
20041019
|
|
|
|
Support for Errors-To: is permanently removed.
|
|
|
|
20041022
|
|
|
|
Bugfix: "smtp_connection_cache_on_demand=no" could crash
|
|
the SMTP client. File: smtp/smtp_connect.c.
|
|
|
|
Robustness: extra sanity checks. Files: util/dict_db.c,
|
|
util/dict_dbm.c, dict_nis.c.
|
|
|
|
20041025
|
|
|
|
Initial merge of Lutz Jaenicke's TLS patch. Initial rewrite
|
|
of tlsmgr to eliminate some code duplication and to postpone
|
|
calls into OpenSSL until after dropping privileges.
|
|
|
|
20041030
|
|
|
|
Compatibility: "session cache" renamed to "connection cache"
|
|
to avoid confusion with the TLS session cache.
|
|
|
|
20041102
|
|
|
|
Feature: smtpd_end_of_data_restrictions allow you to specify
|
|
restrictions at the end of the SMTP DATA command. The syntax
|
|
is identical to that of the smtpd_data_restrictions feature.
|
|
This introduces a new END-OF-DATA protocol state for the
|
|
external policy server. Files: proto/SMTPD_POLICY_README.html,
|
|
proto/SMTPD_ACCESS_README.html, smtpd/smtpd_check.c.
|
|
|
|
20041111
|
|
|
|
Cleanup: terminate the dict_eval() result buffer for verbose
|
|
logging. Victor Duchovni, Morgan Stanley. File: util/dict.c.
|
|
|
|
20041112
|
|
|
|
Cleanup: be more careful when saving and restoring resolver(3)
|
|
options to avoid problems with an HP-UX security patch
|
|
(change introduced 20031215). File: dns/dns_lookup.c.
|
|
|
|
20041115
|
|
|
|
Bugfix: the test for "no debugger_command" was wrong.
|
|
Leandro Santi. File: global/debugger_command.c.
|
|
|
|
20040117
|
|
|
|
Robustness: the master-child protocol now includes a process
|
|
generation number besides the child process ID. The process
|
|
generation number is incremented by one each time the master
|
|
creates a child process. Child-to-master status updates
|
|
with the wrong generation number are ignored, instead of
|
|
triggering a consistency error in the master server. Files:
|
|
master/*server.c, master/master_status.c, master/master_spawn.c.
|
|
|
|
20041118
|
|
|
|
Bugfix: the "local_header_rewrite_clients" feature (20041023)
|
|
did not recognize "bare" lookup tables as documented. Victor
|
|
Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.
|
|
|
|
Bugfix: the "local_header_rewrite_clients" feature (20041023)
|
|
was broken because the local delivery agent passed on a
|
|
bogus attribute value when forwarding internally generated
|
|
mail, causing the mail to be rejected by the cleanup server.
|
|
File: local/dotforward.c.
|
|
|
|
Bugfix: the "local_header_rewrite_clients" feature (20041023)
|
|
was broken because the pickup server always overwrote origin
|
|
information. Files: pickup/pickup.c, cleanup/cleanup_state.c,
|
|
*qmgr/qmgr_message.c.
|
|
|
|
Workaround: enable the "can't write before sending a file
|
|
descriptor" workaround for Solaris. Problem reported by
|
|
Victor Duchovni for Solaris 2.5.1, but we play safe and
|
|
enable it unconditionally.
|
|
|
|
20041120
|
|
|
|
The TLS support routines are moved to a "tls" directory,
|
|
and are published via the "libtls.a" object library.
|
|
|
|
20041122
|
|
|
|
Infrastructure: support for binary attribute values
|
|
(ATTR_TYPE_DATA) in Postfix IPC messages. Files:
|
|
util/attr_scan*c, util/attr_print*c.
|
|
|
|
20041123-20041205
|
|
|
|
TLS support: via a process of gradual transformation,
|
|
decomposed Lutz Jaenicke's pfixtls.c into separate modules
|
|
for clients, servers, certificate verification, session
|
|
caching, and PRNG management. Global variables were eliminated
|
|
so that the code now supports multiple client and/or server
|
|
contexts in the same process. Files: tls/*.[hc].
|
|
|
|
20041205
|
|
|
|
TLS support: eliminated shared access (and locking) of the
|
|
TLS PRNG exchange file and TLS session caches. Instead,
|
|
Postfix uses a client-server protocol, and the tlsmgr
|
|
becomes the sole mediator. This eliminated the need for
|
|
1000+ lines of SDBM support, and eliminated the need for
|
|
running a persistent tlsmgr process on systems don't enable
|
|
TLS in main.cf.
|
|
|
|
20041124
|
|
|
|
Feature: configurable list of forbidden SMTP commands
|
|
(default: smtpd_forbidden_commands = CONNECT, GET, POST)
|
|
after which the Postfix SMTP server disconnects immediately.
|
|
The SMTP server always disconnects immediately when the
|
|
client sends a message header instead of an SMTP command.
|
|
Magnus Baeck. File: smtpd/smtpd.c.
|
|
|
|
20041207
|
|
|
|
CDB support by Michael Tokarev, documentation by Victor
|
|
Duchovni. Files: util/dict_cdb.[hc], global/mkmap_cdb.c.
|
|
|
|
20041209
|
|
|
|
Completed support for the Berkeley DB sequence operator.
|
|
This is needed for finding and deleting old entries in TLS
|
|
session databases. File: util/dict_db.c.
|
|
|
|
Bugfix: the DBM client's sequence operator used exclusive
|
|
locking instead of shared locking. File: util/dict_dbm.c.
|
|
|
|
Feature: dump an entire database with the new postmap/postalias
|
|
"-s" option. This works only for database types with Postfix
|
|
sequence operator support: hash, btree, dbm, and sdbm.
|
|
Files: postmap/postmap.c, postalias/postalias.c.
|
|
|
|
20041212
|
|
|
|
Solaris 10/ix86 chroot setup script update by J.D. Bronson.
|
|
|
|
TLS support: cosmetic changes to comments and messages;
|
|
completed the code for the master -> tlsmgr trigger handshake,
|
|
so that the master no longer complains about trigger
|
|
responses timing out.
|
|
|
|
20041213
|
|
|
|
Updated the SDBM dictionary interface. It had fallen behind
|
|
with the Postfix dictionary interfaces that were already
|
|
bundled with Postfix. Files: util/dict_sdbm.[hc].
|
|
|
|
Cleanup: "postconf -m" (show all available map types) now
|
|
produces sorted output. File: util/dict_open.c.
|
|
|
|
20041215
|
|
|
|
No bugfix: tests with the new "postmap -s" feature show
|
|
that SDBM first/next operations never worked with Postfix/TLS
|
|
patch 20040829 (verified with the 20040829 dict_sdbm.c
|
|
module on Linux and FreeBSD). The code stops after finding
|
|
one database element. Other SDBM versions found on the
|
|
Internet will find all database entries, but report an I/O
|
|
error after the last database element is found. All this
|
|
would be easy enough to fix, but the SDBM library is not
|
|
part of Postfix, and never will be.
|
|
|
|
Bugfix: the sequence operator in the DBM and SDBM clients
|
|
released the shared lock after reading the next key but
|
|
before reading the corresponding value. This was never a
|
|
problem, because the sequence operator was used only in
|
|
the Postfix/TLS patch. This used the SDBM sequence operator
|
|
which didn't work as discussed above. Files: util/dict_dbm.c,
|
|
util/dict_sdbm.c.
|
|
|
|
Feature: the local(8) and pipe(8) delivery agents now make
|
|
the following attributes available upon delivery (with
|
|
local(8) names must be spelled in upper case): client_hostname,
|
|
client_address, client_protocol, client_helo, sasl_method,
|
|
sasl_sender, sasl_username. Files: local/command.c,
|
|
pipe/pipe.c, and lots of documentation.
|
|
|
|
20041216
|
|
|
|
"postcat -o" now prints queue file record offsets; this is
|
|
useful for debugging. File: postcat/postcat.c.
|
|
|
|
NON-PRODUCTION Bugfix: (bug introduced while adopting the
|
|
Postfix/TLS patch): the new TLS certification call-back
|
|
routine expects that the peer hostname is in
|
|
tlscontext->peername_save, but the TLS server code never
|
|
updated this field. File: tls/tls_server.c.
|
|
|
|
20041218
|
|
|
|
Feature: selective suppression of SMTP extensions (pipelining,
|
|
starttls, auth, etc.); this is useful to work around broken
|
|
clients or servers. Specify a list of EHLO keywords with
|
|
the smtp(d)_discard_ehlo_keywords parameters, or specify
|
|
one or more lookup tables, indexed by remote network address,
|
|
with the smtp(d)_discard_ehlo_keyword_address_maps parameters.
|
|
EHLO keyword lists are case insensitive. Files:
|
|
util/name_mask.[hc], global/ehlo_mask.[hc], smtpd/smtpd.c,
|
|
smtp/smtp.c, smtp/smtp_proto.c.
|
|
|
|
20041219
|
|
|
|
Bugfix: postcat without -o was broken. File: postcat/postcat.c.
|
|
|
|
20041220
|
|
|
|
NON-PRODUCTION Bugfix: (bug introduced while adopting
|
|
Postfix/TLS patch): don't call smtp_flush() after return
|
|
from vstream_setjmp(), we'll call you. File: smtpd/smtpd.c.
|
|
|
|
Dummy VSTREAM read-write routines. Files: util/dummy_read.c,
|
|
util/dummy_write.c.
|
|
|
|
20041221
|
|
|
|
Fixes for TLS_README by Victor Duchovni. File:
|
|
proto/TLS_README.html.
|
|
|
|
NON-PRODUCTION Bugfix: (bug introduced while adopting
|
|
Postfix/TLS patch). The client code had become too similar
|
|
to the server implementation, and also required a host
|
|
certificate and key. Fix by Victor Duchovni. File:
|
|
tls/tls_client.c.
|
|
|
|
20041221
|
|
|
|
Bugfix: further postcat corner cases.
|
|
|
|
20041223
|
|
|
|
Cosmetic: don't log disconnect events as I/O errors.
|
|
File: tls/tls_bio_ops.c.
|
|
|
|
20041221-9
|
|
|
|
Infrastructure: unified IPv4/IPv6 name/address API so that
|
|
Postfix can support IPv6 without #ifdef INET6 everywhere.
|
|
In particular, we allow #ifdef in libraries but avoid it
|
|
in applications. Files: util/myaddrinfo.[hc],
|
|
util/sock_addr.[hc], dns/dns_rr_to_pa.c, dns/dns_sa_to_rr.c,
|
|
dns/dns_rr_eq_sa.c, dns/dns_rr_to_sa.c, inet_proto.[hc].
|
|
|
|
Postfix no longer attempts to deliver mail via IPv6 when
|
|
the system has no IPv6 connectivity. Network protocol
|
|
support is now selected with the "inet_protocols" configuration
|
|
parameter, instead of "inet_interfaces". The "inet_protocols"
|
|
parameter also controls what DNS lookups Postfix will do.
|
|
|
|
Infrastructure: eliminated two host/port parsing routines.
|
|
Only one survives: host_port(), in an extended form that
|
|
allows for missing host or missing service information but
|
|
not both. File: util/host_port.c.
|
|
|
|
20041229
|
|
|
|
Milestone: Postfix with the unified IPv4/IPv6 socket/name
|
|
API builds without compiler error on IPv4-only system and
|
|
actually works.
|
|
|
|
20041228
|
|
|
|
Bugfix: SMTPD_PROXY_README incorrectly claimed that ":port"
|
|
in master.cf causes a server to listen only on "localhost"
|
|
without exposing the service to the network. Instead,
|
|
":port" causes a client to connect to "localhost".
|
|
|
|
20041231
|
|
|
|
Linux workaround: when mynetworks isn't set, a chrooted
|
|
process could not read the IPv6 address information from
|
|
/proc. We now invoke own_inet_addr() before chrooting,
|
|
while processing main.cf. File: global/mail_params.c.
|
|
|
|
20050101
|
|
|
|
Workaround for (Linux) systems without IPV6_V6ONLY support
|
|
(RFC 3493). When Postfix listened on an IPv4 wild-card
|
|
smtp socket, the IPv6 wild-card smtp listener would fail
|
|
with EADDRINUSE (and vice versa). File: util/myaddrinfo.c.
|
|
|
|
20050103
|
|
|
|
Safety: when the IPV6 netmask can't be determined, assume
|
|
/128 (host only). File: util/inet_addr_local.c.
|
|
|
|
20050104
|
|
|
|
Re-implemented IPv6 support for net/mask pattern matching.
|
|
Files: util/cidr_match.[hc], util/dict_cidr.c,
|
|
util/match_ops.[hc], proto/cidr_table.
|
|
|
|
20050105
|
|
|
|
Moved mask_addr() to its own module so that it could also
|
|
be called by mynetworks() and inet_addr_local() to remove
|
|
non-zero host bits from IPv6 network/mask patterns. File:
|
|
util/mask_addr.c.
|
|
|
|
20050108
|
|
|
|
Re-implemented IPv6 support for network interface lookup
|
|
via the Linux /proc file system. File: util/inet_addr_local.c.
|
|
|
|
20050111
|
|
|
|
Feature: specify "inet_interfaces = loopback-only" for
|
|
servers that must listen on local interfaces only, without
|
|
having to specify IPv4 and/or IPv6 addresses in main.cf or
|
|
master.cf. File: global/own_inet_addr.c.
|
|
|
|
Workaround: AIX 5.1 getaddrinfo() can't handle a null host
|
|
argument with AI_PASSIVE. Instead we specify an explicit
|
|
protocol family, a host of "::" or "0.0.0.0", and turn off
|
|
IPV6_V6ONLY. Files: util_myaddrinfo.c, util/inet_listen.c.
|
|
|
|
Workaround: AIX 5.1 getaddrinfo() can't handle a "0" service
|
|
argument. Instead we specify "1". Files: util/inet_addr_host.c.
|
|
|
|
20050113
|
|
|
|
Cleanup: now that the over-all structure is proving itself,
|
|
clean up some internal APIs to increase robustness and get
|
|
rid of some clumsiness. Mainly, the getaddrinfo(3) interface.
|
|
|
|
Start-up performance: the hash_queue_names default setting
|
|
is reduced from eight directories to just defer and deferred.
|
|
This reduces time for checking the Postfix queue. Files:
|
|
conf/post-install, global/mail_params.h.
|
|
|
|
20050114
|
|
|
|
Further cleanup: eliminate duplicate IPv6 results when the
|
|
mynetworks value is generated by Postfix. More documentation
|
|
of the new internal APIs.
|
|
|
|
Performance: reduced start-up delay by moving warning-only
|
|
startup checks into the background. File: conf/postfix-script.
|
|
|
|
20050115
|
|
|
|
Further hardening of the IPv6 support: don't trust system
|
|
libraries to protect Postfix against malformed IPv6 address
|
|
literals. Their syntax is complex enough that errors are
|
|
likely. Files: global/resolve_local.c, util/valid_hostname.c.
|
|
|
|
Further cleanup: RFC 2821 requires the IPv6: prefix with
|
|
IPv6 address strings. The smtp and qmqp servers maintain
|
|
separate address instances, the bare address and the RFC
|
|
2821 compatible form, and use each where appropriate. This
|
|
strict separation simplifies address syntax checks as well
|
|
as the implementation of XCLIENT and XFORWARD.
|
|
|
|
20050116
|
|
|
|
Infrastructure: new valid_mailhost_addr() routine to verify
|
|
that an address literal satisfies RFC 2821. An IPv4 address
|
|
is in dotted-quad decimal form, and an IPv6 address is in
|
|
hexadecimal form, with the "IPv6:" prefix. Files:
|
|
global/valid_mailhost_addr.[hc].
|
|
|
|
Further cleanup: valid_hostname() no longer allows network
|
|
addresses or numerical domain names. While it made some
|
|
sense with IPv4 dotted quad decimal forms, with IPv6 it
|
|
just made no sense anymore. Again, being stricter actually
|
|
simplifies code. Files: util/valid_hostname.c and a
|
|
surprisingly small number of valid_hostname() callers that
|
|
did not reject numerical forms.
|
|
|
|
Bugfix: in the Postfix 2.2 SMTP client, the debug_peer_init()
|
|
call was moved to the after-chroot initialization.
|
|
|
|
20050117
|
|
|
|
Performance: reduced start-up delay by moving warning-only
|
|
startup checks into the background; they now start after
|
|
one minute to allow the system to finish booting. File:
|
|
conf/postfix-script.
|
|
|
|
Milestone: first non-non-production snapshot with IPv6.
|
|
|
|
20050119
|
|
|
|
Milestone: first non-non-production snapshot with TLS.
|
|
|
|
20050124
|
|
|
|
Workaround: don't send mail to $fallback_relay if Postfix
|
|
is MX host for the next-hop destination. This is, however,
|
|
a partial solution. The documentation has been updated to
|
|
cover all the cases where a fallback_relay could interfere
|
|
with the operation of a backup or primary MX host. Files:
|
|
smtp/smtp_addr.c, smtp/smtp_connect.c.
|
|
|
|
20050127
|
|
|
|
Configuration: Postfix daemons that need privileged operation
|
|
(such as local, pipe, or spawn) now log a fatal error when
|
|
they are configured in master.cf as unprivileged.
|
|
|
|
20050130
|
|
|
|
Cleanup: simplified the handling of receive_override_options
|
|
settings. Files: pickup/pickup.c, smtpd/smtpd.c, qmqpd/qmqpd.c,
|
|
global/input_transp.c.
|
|
|
|
Feature: permit_inet_interfaces allows a request when the
|
|
client matches $inet_interfaces. This is used for generic
|
|
access restrictions and for header address rewriting control.
|
|
Files: global/mail_params.h, smtpd/smtpd_check.c.
|
|
|
|
Cleanup: by default, message header address rewriting is
|
|
now enabled only for mail that originates from the machine
|
|
itself. Files: global/mail_params.h, smtpd/smtpd_check.c.
|
|
|
|
20050131
|
|
|
|
Bugfix: when extracting recipients from message headers,
|
|
the Postfix sendmail command produced output records longer
|
|
than $line_length_limit, causing postdrop to reject the
|
|
mail. Diagnosis by Victor Duchovni. File: sendmail/sendmail.c.
|
|
|
|
20050202
|
|
|
|
Cleanup: explicit Makefile targets for "make package" and
|
|
"make non-interactive-package" to create ready-to-install
|
|
packages for distribution to other systems. Added extra
|
|
sanity checks to prevent attempts to overwrite your running
|
|
Postfix instance. Files: Makefile.in, proto/PACKAGE_README.
|
|
|
|
Cleanup: when bounce_queue_lifetime > maximal_queue_lifetime,
|
|
it is adjusted to maximal_queue_lifetime, and a warning is
|
|
logged. Files: *qmgr/qmgr.c.
|
|
|
|
20050203
|
|
|
|
Cleanup: trivial-rewrite now restarts more timely after
|
|
changes in lookup tables. Of the all the alternatives
|
|
tested, the simplest one produces the most bang for the
|
|
buck. The other code is left in place for illustrative
|
|
purposes. File: trivial-rewrite/trivial-rewrite.c.
|
|
|
|
Cleanup: sendmail no longer ignores null command-line
|
|
recipients. File: sendmail/sendmail.c.
|
|
|
|
Cleanup: "postfix start" background checks moved back to
|
|
the foreground so they can be stopped more easily. File:
|
|
conf/postfix-script.
|
|
|
|
20050204
|
|
|
|
Feature: REPLACE command in header/body_checks (implemented
|
|
as a combination of PREPEND and IGNORE) by Bastiaan Bakker.
|
|
File: cleanup/cleanup_message.c.
|
|
|
|
Cleanup: linted the manual pages for consistency in the
|
|
way manuals are referenced, and in the presentation of
|
|
command examples. Files: mantools/manlint, mantools/fixman,
|
|
mantools/postconf2man.
|
|
|
|
20050205
|
|
|
|
Cleanup: updated the mass-deletion example in the postsuper
|
|
manual.
|
|
|
|
20050206
|
|
|
|
Cleanup: don't count a [45]XX SMTP server greeting towards
|
|
the mx_session_limit setting. File: smtp/smtp_connect.c.
|
|
|
|
Feature: output address rewriting in the SMTP client. The
|
|
smtp_generic_maps parameter specifies an address mapping
|
|
that happens only when mail is delivered via SMTP. This is
|
|
typically used for hosts without a valid domain name, that
|
|
use something like localdomain.local instead. This feature
|
|
can replace local mail addresses by valid Internet mail
|
|
addresses when mail needs to go across the Internet, but
|
|
not when mail is sent between accounts on the local machine.
|
|
Files: smtp/smtp_proto.c, smtp/smtp_map11.c.
|
|
|
|
Cleanup: don't panic in mymalloc() when master can't find
|
|
any IP addresses. LaMont Jones. File: master/master_ent.c.
|
|
|
|
20050207
|
|
|
|
Documentation: added a generic(5) manual page for consistency
|
|
with the already existing table driven mechanisms, added
|
|
references to or examples of the new generic mapping.
|
|
|
|
Bugfix: the header_checks REPLACE action mis-handled
|
|
multi-line replacement text in message headers, for example:
|
|
/(.*)/ REPLACE X-$1. File: cleanup/cleanup_message.c.
|
|
|
|
Bugfix: the header_checks REPLACE action should not drop
|
|
the input when the action is NOT executed. File:
|
|
cleanup/cleanup_message.c.
|
|
|
|
Bugfix? Cleanup? Documentation? main.cf now implements
|
|
${name[?:]value} as promised in the postconf(5) manual.
|
|
Implemented by deleting the macro processor in dict_eval(),
|
|
and using the one in mac_expand() instead. File: util/dict.c.
|
|
|
|
20050208
|
|
|
|
Feature: check_ccert_access maptype:mapname for access(5)
|
|
control, based on code by Victor Duchovni. File:
|
|
smtpd/smtpd_check.c and documentation.
|
|
|
|
Safety: don't allow unlimited message size with limited
|
|
mailbox size. File: local/local.c, virtual/virtual.c.
|
|
|
|
Feature: new smtpd policy attributes ccert_subject,
|
|
ccert_issuer and ccert_fingerprint, with TLS client
|
|
certificate information, but only when verification was
|
|
successful. Files: src/smtpd/smtpd_check.c.
|
|
|
|
Cleanup: corrected the address verification data flow in
|
|
the ADDRESS_VERIFICATION_README illustration.
|
|
|
|
20050209
|
|
|
|
Cleanup: the smtp generic mapping did syntax check on the
|
|
input address instead of the result. These tests were not
|
|
going to be useful in any case, because mail_addr_map()
|
|
canonicalizes the lookup result, including @dom1->@dom2
|
|
mapping. File: smtp_map11.c.
|
|
|
|
Cleanup: made the generic mapping documentation consistent
|
|
with the implementation.
|
|
|
|
Cleanup: documented the myorigin/mydomain address rewriting
|
|
in canonical, generic and virtual alias maps.
|
|
|
|
Feature: updated LDAP and *SQL query interfaces using a
|
|
common infrastructure so that all have the same feature set
|
|
where possible. Victor Duchovni and many others. This code
|
|
was tested separately and was merged into the main stream
|
|
20050308. Files: global/db_common.[hc], global/dict_ldap.c,
|
|
global/dict_mysql.c, global/dict_pgsql.c, plus documentation.
|
|
|
|
20050210
|
|
|
|
Bugfix: spurious fallback_relay warnings after 20050202.
|
|
Victor Duchovni. File: smtp/smtp_connect.c.
|
|
|
|
Bugfix: (introduced while adopting Postfix/TLS patch) the
|
|
TLS cache scan stopped after expiring one entry. Victor
|
|
Duchovni. File: tls/tls_scache.c.
|
|
|
|
Safety: delete-behind when removing expired entries from
|
|
TLS session caches. With some maps the enumeration method
|
|
mis-behaves when the current entry is deleted. File:
|
|
tls/tls_scache.c.
|
|
|
|
20050211
|
|
|
|
Cleanup: the "generics" feature (output address rewriting)
|
|
is renamed to "generic", for consistency with "canonical"
|
|
and "virtual".
|
|
|
|
20050212
|
|
|
|
Cleanup: remove old trace(8) logfile before attempting
|
|
delivery (and after locking the message file exclusively).
|
|
Files: *qmgr/qmgr_message.c.
|
|
|
|
Cleanup: don't parse-then-regenerate message headers when
|
|
no address is changed by address rewriting operations. This
|
|
behavior was copied from the SMTP client's generic mapping
|
|
code. Files: cleanup/cleanup_rewrite.c, cleanup/cleanup_map11.c,
|
|
cleanup/cleanup_masquerade.c, cleanup/cleanup_message.c..
|
|
|
|
20050215
|
|
|
|
Bugfix: don't chmod queue files while running "postfix
|
|
set-permissions". This prevents mail from being labeled as
|
|
"corrupt" when a live Postfix system is upgraded. Found
|
|
by Victor Duchovni. File: conf/post-install.
|
|
|
|
20050216
|
|
|
|
Feature: in smtpd?_discard_ehlo_keyword(s|_address_maps)
|
|
specify the pseudo keyword "silent-discard" in order to
|
|
avoid logging that some EHLO keyword is being suppressed.
|
|
File: global/ehlo_mask.[hc].
|
|
|
|
20050217
|
|
|
|
Bugfix: typo in tls_server.c, breaking CApath. Fix by
|
|
Philipp Morger. File: tls/tls_server.c.
|
|
|
|
20050227
|
|
|
|
Bugfix (bug introduced 20040331): with SIGHUP ignored, the
|
|
postdrop signal handler would effectively ignore SIGINT,
|
|
SIGQUIT and SIGTERM. Simplified the overly-conservative
|
|
protection against nested signals in postdrop, and added
|
|
some future proofing comments. File: postdrop/postdrop.c
|
|
|
|
Cleanup: when address rewriting is enabled, don't change
|
|
the capitalization of header labels, i.e. don't replace
|
|
FROM: or CC: by From: or Cc:. Files: cleanup/cleanup_message.c,
|
|
smtp/smtp_proto.c.
|
|
|
|
20050228
|
|
|
|
Cleanup/portability: missing #includes and bad prototypes.
|
|
Matthias Andree, Carsten Hoeger, and others.
|
|
|
|
20050302
|
|
|
|
Workaround: make TLS session caching work with perverse
|
|
sites that have multiple servers per hostname or even
|
|
multiple servers per IP address, but no shared TLS session
|
|
cache. The SMTP client TLS session cache is now indexed by
|
|
(server hostname, server address, server port, server helo
|
|
hostname). After an idea by Victor Duchovni. Files:
|
|
smtp/smtp_proto.c, tls/tls_client.c.
|
|
|
|
20050303
|
|
|
|
Bugfix (bug inherited from Postfix/TLS patch): a rare 9kbyte
|
|
memory leak when in-memory TLS session information expires;
|
|
found by setting the expiry time shorter than the time to
|
|
deliver one or two messages with a very slow machine. This
|
|
was due to a missing SSL_SESSION_free() call in the "new
|
|
session" call-back routines. Found by Victor Duchovni.
|
|
Files: tls/tls_client.c, tls/tls_server.c.
|
|
|
|
Workaround: OpenSSL is overly agressive when purging a
|
|
not-yet expired entry from a full in-memory cache: it also
|
|
purges the entry from the on-disk server session cache.
|
|
Workaround is to let only the tlsmgr purge entries from the
|
|
on-disk server session cache. Found by Victor Duchovni.
|
|
File: tls/tls_server.c.
|
|
|
|
20050304
|
|
|
|
Postfix releases are now signed with Wietse's new PGP key.
|
|
The old key was getting a bit short for today's standards.
|
|
The new public key can be found on the Postfix download
|
|
webpage. As proof of authenticity the new PGP key is signed
|
|
with Wietse's old PGP key.
|
|
|
|
Cleanup: check_mumble_{ns,mx}_access no longer attempt to
|
|
do MX or NS lookups for address literals. An address literal
|
|
is treated as its own MX host; there is no meaningful
|
|
equivalent for NS access control. File: smtpd/smtpd_check.c.
|
|
|
|
20050310
|
|
|
|
Bugfix: the AIX and SUN compilers rightfully complained
|
|
about non-portable code in the "new" LDAP/SQL client. File:
|
|
global/db_common.c.
|
|
|
|
Workaround: some systems no longer recognize "tail +2" as
|
|
valid command syntax. Instead they require "improved" syntax
|
|
that is not valid on several other systems that Postfix
|
|
builds on. So we have to stop using the tail command.
|
|
Files: Makefile.in, src/*/Makefile.in.
|
|
|
|
20050312
|
|
|
|
Bugfix: the TLS session cache cleaning code didn't always
|
|
delete the right entry. Problem found by Victor Duchovni,
|
|
more problems found by Wietse. File: tls/tls_scache.c.
|
|
|
|
20050314
|
|
|
|
Portability: Berkeley DB changed API from version 2.5 to
|
|
2.6. Rob Foehl. File: util/dict_db.c.
|
|
|
|
20050315
|
|
|
|
Bugfix: when <unistd.h> is included, read is a reserved
|
|
identifier. File: smtpstone/smtp-source.c.
|
|
|
|
20050321-27
|
|
|
|
Support for RFC 3463 enhanced status codes. See also the
|
|
ENHANCED_STATUS_README (a hacker's guide) for background.
|
|
|
|
New module to pass around (status code + text) instead of
|
|
just text. File: Files: global/dsn_util.c.
|
|
|
|
Status-related lookup tables now have an extra column for
|
|
enhanced status codes. Files: global/sys_exits.c,
|
|
global/cleanup_strerror.c.
|
|
|
|
Cleanup: centralized mapping of errno values to delivery
|
|
status codes after failed delivery to mailbox, maildir, or
|
|
file. Error codes EAGAIN, and ESTALE are 4.2.0 temporary
|
|
errors; ENOSPC is a 4.3.0 temporary error; and EDQUOT and
|
|
EFBIG are 5.2.2 hard errors. For backwards compatibility,
|
|
the result of other errors depends on the delivery agent:
|
|
with local(8) everything else is a 5.2.0 hard error, and
|
|
with virtual(8) everything else is soft 4.2.0 error. File:
|
|
global/mbox_open.c.
|
|
|
|
20050324
|
|
|
|
Workaround: gcc -W (version 3.4.2 [FreeBSD] 20040728) no
|
|
longer warns about missing return statements. What a time
|
|
waste.
|
|
|
|
Workaround: gcc -E (version 3.4.2 [FreeBSD] 20040728) output
|
|
has changed, causing too much "make depend" output.
|
|
|
|
20050325
|
|
|
|
Bugfix: when bouncing mail that was submitted with Postfix
|
|
sendmail, the cleanup daemon ignored the reason specified
|
|
in header/body_checks, and always produced a generic reason.
|
|
File: cleanup/cleanup_api.c.
|
|
|
|
Workaround: don't announce pipelining support when the
|
|
smtp-sink test program is configured to fail specific
|
|
commands with -r or -f (the fix is to build a proper SMTP
|
|
state engine into the smtp-sink test program). File:
|
|
smtpstone/smtp-sink.c.
|
|
|
|
20050326
|
|
|
|
Update: more PCRE error codes. File: util/dict_pcre.c.
|
|
|
|
20050327
|
|
|
|
Bugfix: the SMTP and LMTP clients did not ask the queue
|
|
manager to reduce destination concurrency when "lost
|
|
connection" or "connection timed out" happened AFTER Postfix
|
|
received the server greeting. Files: smtp/smtp_trouble.c,
|
|
lmtp/lmtp-trouble.c.
|
|
|
|
Workaround: FreeBSD has incompatibly changed the output
|
|
format from "od", breaking regression test portability.
|
|
|
|
The TLS client session cache ID is now derived from the
|
|
server IP address, TCP Port, and server HELO hostname
|
|
if available. File: smtp/smtp_proto.c.
|
|
|
|
20050328
|
|
|
|
Cleanup: the REPLACE action is no longer implemented as
|
|
PREPEND+IGNORE. The result remains in the input stream,
|
|
and is subject to address rewriting and other processing
|
|
where applicable. File: cleanup/cleanup_message.c.
|
|
|
|
Feature: the TLS server name verification status is moved
|
|
out of the TLS session cache. This not only simplifies the
|
|
client-side TLS cache implementation, but also provides
|
|
better cache support for clients that connect to multiple
|
|
independent MTAs under the same DNS hostname or IP address,
|
|
provided that each MTA replies with a unique name in the
|
|
EHLO response. Patch by Victor Duchovni. Files: tlsmgr/tlsmgr.c,
|
|
tls/tls_verify.c, tls/tls_session.c, tls/tls_server.c,
|
|
tls/tls_scache.h, tls/tls_scache.c, tls/tls_misc.c,
|
|
tls/tls_mgr.h, tls/tls_mgr.c, tls/tls_client.c, tls/tls.h,
|
|
smtp/smtp_proto.c.
|
|
|
|
20050330
|
|
|
|
Bugfix: in some compilation environments the SMTP and LMTP
|
|
clients could ignore enhanced status codes in server replies.
|
|
Bug introduced 20050329 while polishing working code. Files:
|
|
smtp/smtp_chat.c, lmtp/lmtp_chat.c.
|
|
|
|
Feature: add enhanced status code support to the smtp-sink
|
|
test program. File: smtpstone/smtp-sink.c.
|
|
|
|
20050331
|
|
|
|
Workarounds for ancient gcc compilers that can't handle
|
|
valid C. Bugs reported by Victor Duchovni. Files:
|
|
util/sys_defs.h, global/dsn_util.h, tls/tls_client.c.
|
|
|
|
Bugfix: when delivery to command failed, command output was
|
|
not reported. Fix was to enable format checks for the new
|
|
dsn_vstring_update() module. File: global/dsn_util.h,
|
|
global/pipe_command.c.
|
|
|
|
20050401
|
|
|
|
Cleanup: ignore incorrect enhanced status codes (such as
|
|
5xx reply followed by a 4.x.x status), and don't look for
|
|
enhanced status codes unless the server replies with a
|
|
[245]XX reply. Files: smtp/smtp_chat.c, lmtp/lmtp_chat.c.
|
|
|
|
20050402
|
|
|
|
Feature: enhanced status code support for errors found by
|
|
the MIME processor. Files: global/mime_state.c,
|
|
cleanup/cleanup_message.c, smtp/smtp_proto.c.
|
|
|
|
Cleanup: updated error messages about MIME processing errors
|
|
in the SMTP client. These errors are no longer specific to
|
|
8bit->7bit conversion; they can also happen with generic
|
|
address mapping. File: smtp/smtp_proto.c.
|
|
|
|
Safety: SASL 2.1.19 has a version lookup routine that we
|
|
can use to detect compile time / run time version mis-matches
|
|
(also known as DLL hell). Files: src/smtpd/smtpd_sasl_glue.c,
|
|
src/smtp/smtp_sasl_glue.c, src/lmtp/lmtp_sasl_glue.c.
|
|
|
|
20050404
|
|
|
|
Typo: missing comma after dsn=x.yy.zz logging. File:
|
|
global/log_adhoc.c.
|
|
|
|
Feature: specify "smtpd_sasl_authenticated_header = yes"
|
|
to report the SASL login name in the Received: message
|
|
header, so that the login name is shared with the whole
|
|
world. Based on code by Branko F. Gracnar. Files:
|
|
smtpd/smtpd.c, and documentation.
|
|
|
|
20050407
|
|
|
|
@%^!#& Thanks to inadequate SASL documentation the client
|
|
could negotiate a security layer where none was desired.
|
|
Better documentation has become available since Postfix
|
|
SASL support was implemented, and now Postfix needs to be
|
|
fixed. Files: */*_sasl_glue.c.
|
|
|
|
20050409
|
|
|
|
Safety: the CDB map now logs a warning when the source file
|
|
is newer than the indexed file, just like the Berkeley DB
|
|
and DBM maps. Michael Tokarev. File: util/dict_cdb.c.
|
|
|
|
20040411
|
|
|
|
Portability: put the SASL DLL Hell guard after the declarations
|
|
instead of before. Reported by Marcus Grando. Files:
|
|
smtp/smtp_sasl_glue.c, lmtp/lmtp_sasl_glue.c.
|
|
|
|
20050412
|
|
|
|
Infrastructure: change the disposition or other properties
|
|
of an embryonic queue file. This is currently used only to
|
|
place mail on hold. After code by Victor Duchovni. Files:
|
|
global/mail_stream.[hc], cleanup/cleanup_api.c.
|
|
|
|
Bugfix: while updating the cleanup_flush() infrastructure
|
|
eliminated a portability problem that was introduced when
|
|
"REJECT text" support was added. File: cleanup/cleanup.c.
|
|
|
|
20050413
|
|
|
|
Portability: don't mix socket message send/receive calls
|
|
with socket stream read/write calls. The fact that you can
|
|
get away with it only on some stacks implies that there is
|
|
no long-term guarantee. Specify -DCAN_WRITE_BEFORE_SENDING_FD
|
|
if you feel brave. File: util/sys_defs.h.
|
|
|
|
Robustness: re-compile all object files after the "make
|
|
makefiles" options have changed. Files: src/*/Makefile.in.
|
|
|
|
Tweaking: reply with 5.3.4 when the message size exceeds
|
|
the mail system message_size_limit, instead of 5.2.3 which
|
|
is a mailbox specific status. File: smtpd/smtpd_check.c.
|
|
|
|
20050417
|
|
|
|
Safety: don't call syslog from a user-triggered signal
|
|
handler. File: postdrop/postdrop.c.
|
|
|
|
20050421
|
|
|
|
Bugfix: don't panic when the fall-back relay can't be used
|
|
because the local MTA is MX for the destination. File:
|
|
smtp/smtp_connect.c.
|
|
|
|
20050422
|
|
|
|
Bugfix: don't panic when the fall-back relay can't be used
|
|
because it was already tried via a cached session. Produce
|
|
a default excuse instead. File: smtp/smtp_connect.c.
|
|
|
|
Bugfix: postsuper could lose an error message after reporting
|
|
a fatal error. File: postsuper/postsuper.c.
|
|
|
|
20050426
|
|
|
|
Bugfix: simplified and improved the 20050422 fall-back relay
|
|
fix. File: smtp/smtp_connect.c.
|
|
|
|
20050427
|
|
|
|
Final solution for the 20050422 fall-back relay problem:
|
|
truncate the fall-back host list when the local MTA is MX
|
|
for some destination. Files: util/argv.c, smtp/smtp_connect.c.
|
|
|
|
Cleanup: extra dsn_vstring_update_dsn() routine to shut up
|
|
GCC complaints about valid code. Files: src/global/dsn_util.c,
|
|
src/global/mbox_open.c, src/lmtp/lmtp_addr.c, src/smtp/smtp_addr.c,
|
|
src/smtp/smtp_connect.c.
|
|
|
|
20050429
|
|
|
|
The Postfix SMTP server now announces ENHANCEDSTATUSCODES
|
|
support in the EHLO response, as described in RFC 2034.
|
|
File: smtpd/smtpd.c.
|
|
|
|
20050503
|
|
|
|
Propagate enhanced status code from error(8) mailer to SMTP
|
|
server replies. File: smtpd/smtpd_check.c.
|
|
|
|
Cleanup: more consistent format of smtpd warning logging,
|
|
so that it is easier to sort. Files: smtpd/smtpd.c,
|
|
smtpd/smtpd_check.c.
|
|
|
|
20050504
|
|
|
|
Yikes. People are exposing the smtp-sink test program to
|
|
hostile environments, while it was designed for controlled
|
|
environments. Completed the support for write timeouts,
|
|
added support for read timeouts, and added a missing exception
|
|
handler for the 220 server greeting. File: smtpstone/smtp-sink.c.
|
|
|
|
20050506
|
|
|
|
Cleanup: with "REJECT 4.X.Y ..." actions in header/body_checks,
|
|
change the SMTP server reply code from 550 into 450, instead
|
|
of having the SMTP server change the DSN into 5.X.Y. File:
|
|
smtpd/smtpd.c.
|
|
|
|
20050510
|
|
|
|
Usability: when reporting a sender address problem, transform
|
|
a recipient DSN status (e.g., 4.1.1-4.1.6) into the
|
|
corresponding sender DSN status, and vice versa; and when
|
|
reporting a non-address problem, transform a sender or
|
|
recipient DSN status into a generic non-address DSN status
|
|
(e.g., 4.0.0). This transformation may be needed when the
|
|
same access table or RBL reply template are used for client,
|
|
helo, sender, or recipient restrictions; or when the same
|
|
error mailer information is used for senders or recipients.
|
|
Files: smtpd/smtpd_check.c, smtpd/smtpd_dsn_fix.[hc].
|
|
|
|
20050512
|
|
|
|
Feature: support for more SASL logging call-backs, if these
|
|
are defined in the compile-time environment. Files:
|
|
smtpd/smtpd_sasl_glue.c, smtp/smtp_sasl_glue.c.
|
|
|
|
20050513
|
|
|
|
Workaround: Postfix now uses "localdomain" as the default
|
|
domain name when $myhostname is not in "host.domain" form.
|
|
Files: global/mail_params.[hc].
|
|
|
|
---------
|
|
|
|
20050415-20050615
|
|
|
|
As of 20050525, DSN support does not involve new queue file
|
|
record types, so you can switch back to older Postfix
|
|
versions. Older non-production releases did introduce queue
|
|
file incompatibilty.
|
|
|
|
DSN support is selected via the SMTP port by extra parameters
|
|
to the MAIL FROM and RCPT TO commands, and with the Postfix
|
|
sendmail command with new command-line options: -N (specify
|
|
notification options such as "never", "success", "delay"
|
|
or "failure") and -V (specify an envelope ID that identifies
|
|
the mail submission transaction). VERP support now uses
|
|
-XV instead of -V.
|
|
|
|
The implementation piggy-backs on the trace(8) service that
|
|
was already used for "sendmail -v" (verbose delivery) and
|
|
for "sendmail -bv" (what-if) reports. You can no longer
|
|
requests these functions together with DSN support.
|
|
|
|
All this means revision of bounce/defer/trace client
|
|
interfaces, of the bounce service, the record reading loops
|
|
in postdrop, cleanup(8) and qmgr(8), the queue manager to
|
|
delivery agent protocol, and some extra SMTP protocol
|
|
parameters in smtpd(8), lmtp(8) and smtp(8).
|
|
|
|
New code module: global/dsn_smtp.[hc] for RFC 3461 related
|
|
information (but this may still change).
|
|
|
|
Feature: "sendmail -G" is no longer a no-op. Message headers
|
|
are treated as if the message has a remote origin. Files:
|
|
sendmail/sendmail.c, postdrop/postdrop.c.
|
|
|
|
Feature: automatic BCC senders are now created as if they
|
|
were received with NOTIFY=NEVER, in case it helps. File:
|
|
cleanup/cleanup_addr.c
|
|
|
|
Compatibility: with large bounces, send message headers
|
|
only, instead of truncating MIME messages in the middle.
|
|
|
|
20050517
|
|
|
|
Bugfix: in a DSN report, the original recipient should not
|
|
be xtext encoded. File: bounce/bounce_notify_util.c.
|
|
|
|
20050523
|
|
|
|
Bugfix: mymalloc() panic with mistyped server host list.
|
|
File: global/dict_pgsql.c.
|
|
|
|
20050525
|
|
|
|
Feature: specify delay_warning_time=1 to get immediate
|
|
notification of delay. File: qmgr/qmgr_active.c.
|
|
|
|
20050526
|
|
|
|
Reset the Postfix original recipient when delivering to
|
|
mailing list.
|
|
|
|
20050601
|
|
|
|
Modified the master backgrounding procedure to not abort
|
|
when the master is already a process group leader. This
|
|
happens when people bypass or modify the official Postfix
|
|
start-up procedure. Jacek Konieczny. File: master/master.c.
|
|
|
|
20050602
|
|
|
|
Sanity check: don't report "address in use" when some Postfix
|
|
socket is a directory. File: util/unix_listen.c.
|
|
|
|
20050613
|
|
|
|
Now that the over-all structure of the code is proving
|
|
itself, interfaces can be cleaned up. This means nicer names
|
|
for variables, functions and data structures, and dedicated
|
|
read/write routines for recipient and DSN information.
|
|
These remove a lot of clutter from the bounce client and
|
|
server code. Files: dsn_print.c dsb_scan.c, rcpt_print.c,
|
|
rcpt_buf.c.
|
|
|
|
For Sendmail compatibility, the Postfix sendmail -V option
|
|
no longer controls VERP usage, but is used to specify the
|
|
DSN envelope ID. In order to provide a smooth transition,
|
|
backwards compatibility code recognizes when -V is being
|
|
used for VERP control. It will do the right thing, and
|
|
warns the user to use -XV instead. File: sendmail/sendmail.c.
|
|
|
|
20050614
|
|
|
|
The cleanup server writes bounce (delivery failure) and
|
|
trace (success) records, but it no longer requests sender
|
|
notification. That is now handled by the queue manager.
|
|
The reason is that the cleanup server must be able to abort
|
|
a request including its bounce and trace logfiles, so it
|
|
must not take actions that can't be undone.
|
|
|
|
20050615
|
|
|
|
Cleanup: the SMTP client now sends QUIT when the initial
|
|
HELO handshake fails. it still doesn't send QUIT when the
|
|
server greets with a [45]XX code, as that is handled in the
|
|
connection management code before a session context exists.
|
|
File: smtp/smtp_connect.c.
|
|
|
|
Cleanup: made the quote_821_local() routine "const" clean.
|
|
File: global/quote_821_local.[hc].
|
|
|
|
20050616
|
|
|
|
Bugfix: missing or mis-placed va_end() macros, found in
|
|
Postfix 2.3 code review. Files: util/netstring.c,
|
|
util/myaddrinfo.c, util/attr_clnt.c, util/vstream.c.
|
|
|
|
|
|
Bugfix: the SMTP server now separates the message size check
|
|
from the queue space check, so that the size check can be
|
|
done before an SMTPD proxy filter. Files: smtpd/smtpd.c,
|
|
smtpd/smtpd_check.c.
|
|
|
|
20050617
|
|
|
|
Postdrop didn't recognize the new recipient attributes.
|
|
File: postdrop/postdrop.c.
|
|
|
|
Feature: configurable MAILER-DAEMON replacement for the
|
|
null sender address that is used by the pipe(8) delivery
|
|
agent on the command line and in message headers. Command-line
|
|
address quoting is disabled when the replacement is empty.
|
|
File: pipe/pipe.c.
|
|
|
|
20050618
|
|
|
|
With virtual aliasing enabled, Postfix would always report
|
|
successful alias expansion, even when no alias was expanded.
|
|
File: cleanup/cleanup_out_recipient.c.
|
|
|
|
20050621
|
|
|
|
Portability: file descriptor passing is available for Tru64
|
|
UNIX, but not for AIX4 and IRIX6. Albert Chin. File:
|
|
util/sys_defs.h.
|
|
|
|
20050622
|
|
|
|
Cleanup: the DNS lookup code now accommodates name server
|
|
replies longer than 4 kbytes, with a hard upper limit of
|
|
32kbytes. For safety reasons, the number of MX host addresses
|
|
that the SMTP client will try was reduced from unlimited
|
|
to just 5, so that Postfix won't spend forever trying to
|
|
connect to dozens and dozens of bogus MX hosts. Files:
|
|
dns/dns_lookup.c, global/mail_params.h.
|
|
|
|
Cleanup: the code that handles a 4xx or 5xx SMTP server
|
|
greeting was moved from the connection management module
|
|
to the protocol engine, for cleaner error handling. This
|
|
means that the failed session now counts towards the limit
|
|
on the total number of SMTP sessions per domain name (default:
|
|
smtp_mx_session_limit = 2). Files: smtp/smtp_connect.c,
|
|
smtp/smtp_proto.c.
|
|
|
|
20050623
|
|
|
|
Cleanup: generalized the delegated attribute scan/print
|
|
interfaces, and updated the deliver_pass module with delegated
|
|
attribute scan/print support. Files: util/attr_scan0.c,
|
|
util/attr_print0.c, global/dsb_scan.c, global/dsn_print.c,
|
|
global/rcpt_buf,c global/rcpt_print.c, global/deliver_pass.c.
|
|
|
|
Added delegated attribute scan/print function support to
|
|
the base64 and plain attribute I/O encodings. Files:
|
|
util/attr_scan_plain.c util/attr_print_plain.c.
|
|
|
|
20050624
|
|
|
|
Added "." to the list commands that smtp-sink can "break"
|
|
(by disconnecting, or by responding with a 4XX or 5XX reply
|
|
code). File: smtpstone/smtp-sink.c.
|
|
|
|
20050625
|
|
|
|
Safety: allow only 4.x.x and 5.x.x enhanced status codes
|
|
in header/body_checks REJECT actions. File:
|
|
cleanup/cleanup_message.c.
|
|
|
|
20050627
|
|
|
|
Code cleanup: generalized the smtp-sink code that simulates
|
|
server errors. File: smtpstone/smtp-sink.c.
|
|
|
|
20050629
|
|
|
|
Code cleanup: the smtp_mx_session_limit setting (per delivery
|
|
request session count limit) now ignores sessions that fail
|
|
to complete the TCP, SMTP, EHLO or TLS handshake (was: TCP
|
|
and SMTP). File: smtp/smtp_proto.c.
|
|
|
|
20050630
|
|
|
|
Updated the example spf.pl script to version 1.06.
|
|
|
|
Portability: the file descriptor passing code broke on LP64
|
|
systems (inherited from Stevens Network Programming). Files:
|
|
util/unix_send_fd.c, util/unix_recv_fd.c.
|
|
|
|
20050706
|
|
|
|
Robustness: the SMTP client now disables connection caching
|
|
when it is unable to communicate with the scache(8) server,
|
|
instead of looping forever. File: global/scache_clnt.c.
|
|
|
|
Portability: after sending a socket, the scache(8) server
|
|
now waits for an ACK from the connection cache client before
|
|
closing the socket that it just sent. Files: scache/scache.c,
|
|
global/scache_clnt.c.
|
|
|
|
20050708
|
|
|
|
Bugfix: missing returns in 20050706 caching disabling code
|
|
(in error handling code that never executes). File:
|
|
global/scache_clnt.c.
|
|
|
|
Portability: use explicitly unsigned operands when doing
|
|
bit-wise shift operations on data larger than a character.
|
|
|
|
20050709-15
|
|
|
|
Migration of data object sizes and offsets from int->ssize_t
|
|
and unsigned->size_t for better portability to LP64 and
|
|
LLP64 systems where *size_t is 64 bits wide. This change
|
|
has no effect on 32-bit systems.
|
|
|
|
This change not only eliminated some obscure portability
|
|
bugs (see two paragraphs down), it also eliminated many
|
|
unnecessary conversions back and forth between 32-bit and
|
|
64-bit integers, because all relevant system library functions
|
|
take *size_t arguments or return *size_t results.
|
|
|
|
Simply changing every data object size or offset to size_t
|
|
(which is unsigned!) would be dangerous. A lot of code was
|
|
written assuming signed arithmetic and rejects negative
|
|
lengths, which can happen as the result of integer overflow.
|
|
|
|
Portability: on LP64 systems, integer expressions are int,
|
|
but sizeof() and pointer difference expressions are larger.
|
|
The above changes fixed a few discrepancies with function
|
|
calls where *size_t was passed while the old code expected
|
|
an int: clean_env() versus argv_addn(), and code that sent
|
|
binary blobs via the TLS session cache manager protocol.
|
|
|
|
20050711
|
|
|
|
Bugfix: don't include <> when auto-generating an ORCPT
|
|
address from a client RCPT TO command. File: smtpd.c.
|
|
|
|
20050712
|
|
|
|
Cleanup: cleanup_out_recipient() still generated DSN records
|
|
that were incompatible with pre-DSN Postfix versions. File:
|
|
cleanup/cleanup_out_recipient.c.
|
|
|
|
20050716
|
|
|
|
Bugfix: the smtpd_sasl_authenticated_header code did not
|
|
check if SASL was actually enabled. File: smtpd/smtpd.c.
|
|
|
|
20050720
|
|
|
|
Feature: reverse client hostname. This is set at connection
|
|
time with information from the SMTP client address->name
|
|
mapping, and can be overruled with the REVERSE_NAME attribute
|
|
in the XCLIENT command. File: smtpd/smtpd_peer.c.
|
|
|
|
Cleanup: renaming of several confusing restriction names:
|
|
reject_unknown_client -> reject_unknown_client_hostname,
|
|
reject_unknown_hostname -> reject_unknown_helo_hostname,
|
|
reject_invalid_hostname -> reject_invalid_helo_hostname,
|
|
and reject_non_fqdn_hostname -> reject_non_fqdn_helo_hostname.
|
|
The old names are still recognized and documented. Files:
|
|
global/mail_params.h, smtpd/smtpd.c, smtpd/smtpd_check.c.
|
|
|
|
Feature: reject_unknown_reverse_client_hostname. This rejects
|
|
clients that have no address to name mapping (unlike the
|
|
reject_unknown_client_hostname feature which requires that
|
|
the address->name and name->address mappings resolve to the
|
|
client IP address). Files: global/mail_params.h,
|
|
smtpd/smtpd_peer.c, smtpd/smtpd.c, smtpd/smtpd_check.c.
|
|
|
|
20050726
|
|
|
|
Horror: total rewrite of DNS client error handling because
|
|
some misguided proposal attempts to give special meaning
|
|
to some syntactically invalid MX hostname lookup result.
|
|
Not only that, people expect sensible results with
|
|
reject_unknown_sender_domain etc. Files: dns/dns_lookup.c,
|
|
smtp/smtp_addr.c smtpd/smtpd_check.c, lmtp/lmtp_addr.c.
|
|
|
|
Cleanup: HOLD action executes only once, to reduce noise
|
|
in the logfile. Files: cleanup/cleanup_message.c, smtpd/smtpd.c.
|
|
|
|
20050806
|
|
|
|
Workaround: accept(2) fails with EPROTO when the client
|
|
already disconnected (SunOS 5.5.1). File: sane_accept.c.
|
|
|
|
20050815
|
|
|
|
Workaround: old Solaris compilers can't link an archive
|
|
without globally visible symbols. File: tls/tls_misc.c.
|
|
|
|
20050825
|
|
|
|
Feature: message_reject_characters and message_strip_characters
|
|
specify what characters in message content Postfix will
|
|
reject or remove. Based on patch by John Fawcett. Files:
|
|
cleanup/cleanup_message.c, cleanup/cleanup_init.c.
|
|
|
|
Safety: when the cleanup server rejects the content of mail
|
|
that is submitted with the Postfix sendmail command, or
|
|
re-queued with "postsuper -r", strip the message body from
|
|
the bounce message to reduce the risks from harmful content.
|
|
Files: cleanup/cleanup_envelope.c, cleanup/cleanup_bounce.c.
|
|
|
|
Feature: the smtpd_proxy_filter parameter value can now be
|
|
prefixed with "unix:" (for UNIX-domain socket) and "inet:"
|
|
(for TCP socket). TCP sockets are the default. Patch by
|
|
Edwin Kremer. File: smtpd/smtpd_proxy.c.
|
|
|
|
20050828
|
|
|
|
Bugfix: after adding DSN support, error notification was
|
|
broken for too large mail that was submitted with the Postfix
|
|
sendmail command, forwarded by the local(8) delivery agent,
|
|
or re-queued with "postsuper -r". The message would be saved
|
|
to the "corrupt" queue.
|
|
|
|
The mistake was to leave the truncated message in the
|
|
incoming queue and to ask the queue manager to notify the
|
|
sender; this was not possible because the queue manager
|
|
cannot (and should not) handle truncated queue files.
|
|
|
|
The fix is to have the cleanup server send the bounce
|
|
message, just like it did before DSN support was added. As
|
|
a side effect, Postfix will no longer send DSN_SUCCESS
|
|
notices after virtual aliasing, when the cleanup server
|
|
bounces all the recipients of the message anyway. This
|
|
could be called a feature. File: cleanup/cleanup_bounce.c.
|
|
|
|
Also needed for this fix: a new vstream_fpurge() routine
|
|
that discards unread/written data from a VSTREAM. It's
|
|
needed before cleanup_bounce() can seek to the start of the
|
|
queue file after a file size error. File: util/vstream.c.
|
|
|
|
20050920
|
|
|
|
Cleanup: removed the legacy "tls_info" structure, factored
|
|
out common code for peer_CN and issuer_CN lookup, and added
|
|
sanity check to not verify subject common names that contain
|
|
nulls or that are execessively long. Patch by Victor Duchovni.
|
|
Files: tls_client.c, tls_server.c, tls_session.c, tls_misc.c,
|
|
tls_verify.c.
|
|
|
|
20050922
|
|
|
|
Bugfix: the *SQL clients did not uniformly choose the
|
|
database host from the available pool of servers due to an
|
|
off-by-one error, so that the "last" available server was
|
|
not selected. Leandro Santi. Files: dict_mysql.c, dict_pgsql.c.
|
|
|
|
Update: common code factored out into db_common.c, and
|
|
adoption of Liviu Daia's connection aware MySQL quoting.
|
|
Patch by Victor Duchovni. Files: dict_ldap.c, dict_mysql.c,
|
|
dict_pgsql.c, db_common.c.
|
|
|
|
20050923
|
|
|
|
Safety: don't update the local(8) delivery agent's idea of
|
|
the Delivered-To: address while expanding aliases or .forward
|
|
files. When an alias or .forward file changes the Delivered-To:
|
|
address, it ties up one queue file and one cleanup process
|
|
instance while mail is being forwarded. To get the old
|
|
behavior, specify "frozen_delivered_to = no". Problem
|
|
reported by Michael Tokarev, but found independently by
|
|
others. Files: local/local.c, local/aliases.c, local/dotforward.c,
|
|
local/mailbox.c, local/maildir.c.
|
|
|
|
Logging: additional SASL debug logging by Andreas Winkelmann.
|
|
Files: */*sasl_glue.c.
|
|
|
|
20050929
|
|
|
|
Paranoia: don't ignore garbage in SMTP or LMTP server replies
|
|
when ESMTP command pipelining is turned on. For example,
|
|
after sending ".<CR><LF>QUIT<CR><LF>", Postfix could recognize
|
|
the server's 2XX QUIT reply as a 2XX END-OF-DATA reply after
|
|
garbage, causing mail to be lost. The SMTP and LMTP clients
|
|
now report a remote protocol error and defer delivery.
|
|
Files: smtp/smtp_chat.c, smtp/smtp_trouble.c, lmtp/lmtp_chat.c,
|
|
lmtp/lmtp_trouble.c.
|
|
|
|
Performance: specify "smtpd_peername_lookup = no" to disable
|
|
client hostname lookups in the SMTP server. All clients are
|
|
treated as "unknown". This should be used only under extreme
|
|
conditions where DNS lookup latencies are critical. File:
|
|
smtpd/smtpd_peer.c.
|
|
|
|
20051010
|
|
|
|
Feature: smtpd_client_new_tls_session_rate_limit parameter
|
|
to limit the number of new (i.e. uncached) TLS sessions
|
|
that a remote SMTP client may negotiate per unit time. This
|
|
feature, which is off by default, can limit the CPU load
|
|
due to expensive crypto operations. Files: global/anvil_clnt.c,
|
|
anvil/anvil.c, smtpd/smtpd.c.
|
|
|
|
Cleanup: eliminated massive code duplication in the anvil
|
|
server that resulted from adding similar features one at a
|
|
time. File: anvil/anvil.c.
|
|
|
|
20051011
|
|
|
|
Bugfix: raise the "policy violation" flag when a client
|
|
request exceeds a concurrency or rate limit. File:
|
|
smtpd/smtpd.c.
|
|
|
|
Bugfix (cut-and-paste error): don't reply with 421 (too
|
|
many MAIL FROM or RCPT TO commands) when we aren't closing
|
|
the connection. File: smtpd/smtpd.c.
|
|
|
|
20051012
|
|
|
|
Polishing: content of comments and sequence of code blocks
|
|
in the anvil server, TLS request rate error message in the
|
|
smtp server, and documentation, but no changes in code.
|
|
Files: anvil/anvil.c, smtpd/smtpd.c.
|
|
|
|
20051013
|
|
|
|
Horror: some systems have basename() and dirname() and some
|
|
don't; some implementations modify their input and some
|
|
don't; and some implementations use a private buffer that
|
|
is overwritten upon the next call. Postfix will use its own
|
|
safer versions called sane_basename() and sane_dirname().
|
|
These never modify the input, and allow the caller to control
|
|
how memory is allocated for the result. File:
|
|
util/sane_basename.c.
|
|
|
|
Feature: "sendmail -C path-to-main.cf" and "sendmail -C
|
|
config_directory" now do what one would expect. File:
|
|
sendmail/sendmail.c.
|
|
|
|
Bugfix: don't do smtpd_end_of_data_restrictions after the
|
|
transaction failed due to, e.g., a write error. File:
|
|
smtpd/smtpd.c.
|
|
|
|
Cleanup: the SMTP server now enforces the message_size_limit
|
|
even when the client did not send SIZE information with the
|
|
MAIL FROM command. This protects before-queue content
|
|
filters against over-size messages. File: smtpd/smtpd.c.
|
|
|
|
20051017
|
|
|
|
Bugfix: after DSN support was added, smtp_skip_5xx_greeting
|
|
no longer recognized a 5xx SMTP status as a 4xx one. Found
|
|
by Ralf Hildebrandt. Fix: use the enhanced status code
|
|
instead of the SMTP reply code to choose between permanent
|
|
or transient errors. File: smtp/smtp_trouble.c.
|
|
|
|
Feature: smtp-sink can hard-reject, soft-reject or simply
|
|
drop connection requests. File: smtpstone/smtp-sink.c.
|
|
|
|
Documentation: clarified the processing of server replies,
|
|
specifically the reply code and the enhanced status code,
|
|
in smtp_chat.c.
|
|
|
|
20051024
|
|
|
|
Performance: new smtp_connection_reuse_time_limit parameter to
|
|
limit connection reuse by elapsed time, instead of limiting
|
|
the number of deliveries per connection. Bounding by time
|
|
favors delivery over connections that perform well, while
|
|
bounding by number of deliveries allows slow connections
|
|
to drag down the performance. Insight and initial
|
|
implementation by Victor Duchovni, Morgan Stanley. Files:
|
|
smtp_connect.c, smtp_session.c,
|
|
|
|
Bugfix: the next-hop logical destination information for
|
|
connection caching was reset only after a good non-TLS
|
|
connection, so that cached connections to non-TLS backup
|
|
servers could suck away traffic from TLS primary servers
|
|
(the Postfix SMTP client cannot cache an open TLS connection).
|
|
Found during code review. This is fixed with multi-valued
|
|
connection caching state: expired, cachable, non-cachable,
|
|
and bad. Files: smtp_connect.c, smtp_trouble.c.
|
|
|
|
Bugfix: adding support for "sendmail -C" broke "sendmail
|
|
-q". File: sendmail/sendmail.c.
|
|
|
|
20051101
|
|
|
|
Migration from a single "arrival time" stamp to a structure
|
|
with time stamps from different stages of message delivery.
|
|
The first iteration merely replaces "arrival time" stamps
|
|
by a structure or pointer to structure, and uses only the
|
|
arrival time field of that structure. This is an extensive
|
|
but straightforward transformation, based on example by
|
|
Victor Duchovni, Morgan Stanley. Files: anything that
|
|
invokes bounce_append etc., the log_adhoc module, and
|
|
anything that sends or receives a delivery request.
|
|
|
|
20051102
|
|
|
|
Completion of support for time stamps from different stages
|
|
of message delivery. The information is now logged as
|
|
"delays=a/b/c/d" where a=time before queue manager, including
|
|
message transmission; b=time in queue manager; c=connection
|
|
setup including DNS, HELO and TLS; d=message transmission
|
|
time. Unlike Victor's example which used time differences,
|
|
this implementation uses absolute times. The decision of
|
|
what numbers to subtract actually depends on program history,
|
|
so we want to do it in one place. Files: global/log_adhoc.c,
|
|
smtp/smtp_connect.c, smtp/smtp_proto.c, smtp/smtp_trouble.c,
|
|
lmtp/lmtp_proto.c, lmtp/lmtp_trouble.c.
|
|
|
|
20051103
|
|
|
|
Refinement of time stamping and delays formatting. The
|
|
hand-off time is now stamped in the delivery agent, so that
|
|
time is properly attributed when a transport is saturated
|
|
or throttled. Delays are now logged if larger than 0.01
|
|
second. Files: *qmgr/qmgr_deliver.c, global/deliver_request.c,
|
|
global/log_adhoc.c.
|
|
|
|
20051104
|
|
|
|
New parameter delay_logging_time_resolution (default: 10000
|
|
microseconds, or 0.01 second) that controls the detail in
|
|
the new "delays=a/b/c/d" logging. Specify a power of 10
|
|
in the range from 1 to 100000. File: global/log_adhoc.c.
|
|
Parameter renamed 20051108.
|
|
|
|
20051105
|
|
|
|
All delay logging now has sub-second resolution. This means
|
|
updating all code that reads or updates the records that
|
|
specify when mail arrived, and ensuring that mail submitted
|
|
with older Postfix versions produces sensible results.
|
|
Files: global/post_mail.c, global/mail_timeofday.[hc],
|
|
global/log_adhoc.c, postdrop/postdrop.c, pickup/pickup.c,
|
|
cleanup/cleanup_envelope.c, cleanup/cleanup_message.c,
|
|
smtpd/smtpd.c, qmqpd/qmqpd.c, *qmgr/qmgr_message.c,
|
|
*qmgr/qmgr_active.c, local/forward.c.
|
|
|
|
20051106
|
|
|
|
The SMTP client logs the remote server port in the form of
|
|
relay=hostname[hostaddr]:port to the local maillog file.
|
|
The port number is NOT included in DSN status reports,
|
|
because remote users have no need to know such internal
|
|
information. Files: smtp/smtp_session.c, smtp/smtp_proto.c,
|
|
smtp/smtp_trouble.c.
|
|
|
|
Cleanup: encapsulated queue file time read/write operations
|
|
with a few simple macros, to make future changes in time
|
|
representation less painful.
|
|
|
|
20051108
|
|
|
|
Cleanup: eliminated floating point operations from the
|
|
ad-hoc delay logging code. Files: util/format_tv.[hc],
|
|
global/log_adhoc.c.
|
|
|
|
The delay logging resolution is now controlled with the
|
|
delay_logging_resolution_limit parameter, which specifies
|
|
the maximal number of digits after the decimal point.
|
|
|
|
Bugfix: two messages could get the same message ID due to
|
|
a race condition. This time window was increased when queue
|
|
file creation was postponed from MAIL FROM until the first
|
|
accepted RCPT TO. The window is closed again. Found by
|
|
Victor. Files: global/mail_stream.c, global/mail_queue.c,
|
|
cleanup/cleanup_message.c.
|
|
|
|
20051109
|
|
|
|
qshape.pl updated for extra microsecond time field in Postfix
|
|
queue files.
|
|
|
|
Cleanup: removed obsolete code that handles rejected/dropped
|
|
connections before the HELO handshake. File: smtp/smtp_connect.c.
|
|
|
|
Bugfix: XCLIENT broke when reverse hostname support was added.
|
|
Fix by Tomoyuki Sakurai. File: smtpd/smtpd.c.
|
|
|
|
20051110
|
|
|
|
Workaround: don't set the delay warning timer for messages
|
|
from inside or from outside that have the null sender as
|
|
recipient. This was a waste of time, because the warning
|
|
would always be discarded. File: cleanup/cleanup_envelope.c.
|
|
|
|
Feature: the built-in mail delivery status notification
|
|
text is now implemented by built-in templates. Files:
|
|
bounce/bounce_template.c, bounce/bounce_notify_util.c.
|
|
|
|
20051112
|
|
|
|
Feature: configurable bounce message templates based on
|
|
contribution by Nicolas Riendeau. I kept the general format
|
|
of his templates, but placed them together in one file to
|
|
reduce process initialization overhead (most requests to
|
|
the bounce daemon are not for sending bounce messages).
|
|
Files: bounce/bounce_template.c, bounce/dict_ml.c (to be
|
|
moved to library if useful enough). A sample bounce message
|
|
template file is installed as $config_directory/bounce.cf.default.
|
|
|
|
20051113
|
|
|
|
Feature: "postconf -b filename" to preview the non-default
|
|
bounce message templates with $name expansions in the text.
|
|
The actual work is of course done by the bounce daemon.
|
|
|
|
20051114
|
|
|
|
Feature: -V option to make Postfix daemons to log to stderr.
|
|
This is used when a daemon is invoked in stand-alone mode
|
|
by a (non-daemon) command.
|
|
|
|
Feature: "postconf -t" displays DSN templates, headers and
|
|
all; use postconf -t ''" to view built-ins.
|
|
|
|
Cleanup: renamed fail_template into failure_template.
|
|
|
|
20051117
|
|
|
|
Cleanup: bounce template code reorg, no functionality change.
|
|
Files: bounce/bounce_template.[hc], bounce/bounce_templates.c,
|
|
bounce/bounce_notify_util.c.
|
|
|
|
20051118
|
|
|
|
Bugfix: new bounce template code did not return after
|
|
template syntax error. File: bounce/bounce_template.c
|
|
|
|
Safety: permit_mx_backup now requires that the local MTA
|
|
is not listed as primary MX for the recipient domain. This
|
|
prevents mail loops when someone points the primary MX
|
|
record to Postfix.
|
|
|
|
20051119
|
|
|
|
Workaround: some SMTP servers announce multiple but different
|
|
lists of SASL methods. Postfix now concatenates the lists
|
|
instead of logging a warning and remembering only one. File:
|
|
smtp/smtp_sasl_proto.c.
|
|
|
|
Bugfix: the queue manager did not write a per-recipient
|
|
defer logfile record when the delivery agent crashed between
|
|
receiving a delivery request, and reporting the delivery
|
|
status to the queue manager. Found while redesigning the
|
|
code that handles unavailable transports or destinations.
|
|
Files: *qmgr/qmgr_deliver.c.
|
|
|
|
20051121
|
|
|
|
Workaround: do not build the bounce.cf.default template
|
|
while compiling Postfix - it breaks when the default
|
|
mail_owner etc. accounts don't exist. Reported by Liviu
|
|
Daia.
|
|
|
|
Compatibility: added permit_auth_destination emulation to
|
|
the permit_mx_backup feature. This avoids surprises with
|
|
sites that used permit_mx_backup to authorize all their
|
|
incoming mail.
|
|
|
|
20051122-24
|
|
|
|
Feature: sender_dependent_relayhost_maps, lookup tables that specify
|
|
a sender-dependent override for the relayhost parameter
|
|
setting. The lookup is done in the trivial-rewrite server,
|
|
instead of the queue manager where it does not belong.
|
|
Files: global/resolve_clnt.c, global/tok822_resolve.c,
|
|
trivial-rewrite/resolve.c, trivial-rewrite/transport.c,
|
|
*qmgr/qmgr_message.c.
|
|
|
|
Also: address_verify_sender_dependent_relayhost_maps for
|
|
completeness.
|
|
|
|
20051124
|
|
|
|
Feature: specify "smtp_sender_dependent_authentication =
|
|
yes" to enable sender-dependent SASL passwords. This disables
|
|
SMTP connection caching to ensure that mail from different
|
|
senders is delivered with the appropriate credentials. This
|
|
is an extended version of a patch by Mathias Hasselmann.
|
|
Files: smtp/smtp_connect.c, smtp/smtp_sasl_glue.c.
|
|
|
|
20051126
|
|
|
|
Workaround: log warning when REDIRECT or FILTER are used
|
|
in smtpd_end_of_data_restrictions. File: smtpd/smtpd_check.c.
|
|
|
|
Log warning when REDIRECT, FILTER, HOLD and DISCARD are
|
|
used in smtpd_etrn_restrictions. File: smtpd/smtpd_check.c.
|
|
|
|
20051128
|
|
|
|
Bugfix: moved code around from one place to another to make
|
|
REDIRECT, FILTER, HOLD and DISCARD access(5) table actions
|
|
work in smtpd_end_of_data_restrictions. PREPEND will not
|
|
be fixed; it must be specified before the message content
|
|
is received. Files: smtpd/smtpd.c, smtpd/smtpd_check.c,
|
|
cleanup/cleanup_extracted.c, pickup/pickup.c.
|
|
|
|
Safety: abort if the SMTP or QMQP server runs with non-postfix
|
|
privileges while it's connected to the network. Files:
|
|
smtpd/smtpd_peer.c, qmqpd/qmqpd_peer.c.
|
|
|
|
20051201
|
|
|
|
Bugfix: the LMTP client would reuse a session after negative
|
|
reply to the RSET command (which may happen when client and
|
|
server somehow get out of sync). Problem found by Christian
|
|
Theune. Files: lmtp/lmtp.c, lmtp/lmtp_proto.c.
|
|
|
|
20051202
|
|
|
|
Bugfix: the 20051128 code move for "smtpd_end_of_data_restrictions"
|
|
broke "postsuper -r".
|
|
|
|
20051202-3
|
|
|
|
Cleanup: the SMTP client now also implements the LMTP
|
|
protocol. Files: smtp/smtp.c, smtp/smtp_connect.c,
|
|
smtp/smtp_proto.c, smtp/smtp_dsn.c, smtp_state.c,
|
|
smtp_sasl_glue.c.
|
|
|
|
As before, the LMTP behavior is controlled with parameters
|
|
named lmtp_xxx instead of smtp_xxx. However there are now
|
|
a lot more lmtp_xxx parameters :-) With few exceptions, all
|
|
SMTP features are now also available with LMTP. The exceptions
|
|
are related to the HELO and EHLO commands, which exist in
|
|
SMTP only. There are equivalent LHLO command parameters
|
|
where it makes sense.
|
|
|
|
20051206
|
|
|
|
SMTP+LMTP client connection management code rewritten to
|
|
support UNIX-domain socket connections.
|
|
|
|
20051207
|
|
|
|
Bugfix: race condition in the connection caching protocol,
|
|
found while adding connection caching for UNIX-domain sockets
|
|
(used for LMTP delivery). This was introduced with the
|
|
20050706 workaround, and may the same problem that Jussi
|
|
Silvennoinen experienced (in Postfix 2.2.6) with SMTP after
|
|
an upgrade. Files: scache/scache.c.
|
|
|
|
Bugfix: smtp-sink and qmqp-sink didn't ignore SIGPIPE.
|
|
|
|
20051208
|
|
|
|
Robustness: reduced timeouts in the connection caching
|
|
client, so that a malfunctioning service does not prevent
|
|
mail delivery. This uses similar code that already exists
|
|
for the anvil(8) client and the tlsmgr(8) client. Files:
|
|
global/scache_clnt.c, smtp/smtp.c.
|
|
|
|
To make reduced connection caching client timeouts possible,
|
|
connection management was moved from the attr_clnt(3) module
|
|
to the auto_clnt(3) module where it belongs. The auto_clnt(3)
|
|
module is now a full alternative for the clnt_stream(3)
|
|
module. Files: util/auto_clnt.c, util/attr_clnt.c.
|
|
|
|
Bugfix: the best_mx_transport, mailbox_transport and
|
|
fallback_transport features did not write a per-recipient
|
|
defer logfile record when the target delivery agent was
|
|
broken. This the analog of queue manager bugfix 20051119.
|
|
Files: global/deliver_pass.c.
|
|
|
|
20051210
|
|
|
|
Cleanup: simplified the SMTP/LMTP connection management
|
|
logic for address list and fallback relay processing.
|
|
Still need to simplify deferred recipient handling.
|
|
|
|
20051212
|
|
|
|
Bugfix: after a failed TLS session, the 20051210 SMTP client
|
|
code cleanup broke sessions with backup servers, causing the
|
|
client to get out of step with the backup server. This in
|
|
turn exposed a one-year old missing exception handling
|
|
context in the EHLO handstake after sending STARTTLS. Victim
|
|
was Ralf Hildebrandt, detectives Victor Duchovni and Wietse.
|
|
File: smtp/smtp_proto.c.
|
|
|
|
20051213
|
|
|
|
Bugfix: *SQL, proxy and LDAP map types were not defined in
|
|
user-land commands such as postqueue. Leandro Santi. File:
|
|
postqueue/postqueue.c.
|
|
|
|
20051212-14
|
|
|
|
Server-side plug-in interface for SASL authentication. This
|
|
uses Cyrus SASL by default, so nothing has changed except
|
|
error messages may be more informative. Files:
|
|
smtpd/smtpd_sasl_proto.c smtpd/smtpd_sasl_glue.c,
|
|
xsasl/xsasl_server.[hc], xsasl/cyrus_server.[hc]
|
|
xsasl/cyrus_strerror.c, xsasl/cyrus_log.c, xsasl/cyrus_security.c.
|
|
|
|
20051215
|
|
|
|
Portability: IRIX 6.5.28 defines sa_len as a macro, so it
|
|
can't be used as a variable identifier. Zach McDanel. Files:
|
|
dns/dns_rr_to_sa.c, smtpd/smtpd_peer.c, qmqpd/qmqpd_peer.c.
|
|
|
|
20051216
|
|
|
|
Cleanup: removed some scar tissue that was introduced with
|
|
server-side SASL plug-in support. Files: smtpd_sasl_proto.c,
|
|
smtpd_sasl_glue.c.
|
|
|
|
Client-side plug-in interface for SASL authentication. This
|
|
uses Cyrus SASL by default, so nothing has changed except
|
|
error messages may be more informative. Files: smtp_sasl_glue.c,
|
|
xsasl/xsasl_client.[hc], xsasl/cyrus_client.[hc].
|
|
|
|
20051217
|
|
|
|
Bugfix: when a SASL client password is required by a specific
|
|
server, defer delivery when no server-announced mechanism
|
|
survives the smtp_sasl_mechanism_filter, instead of ignoring
|
|
the SASL announcement and trying to deliver the mail over
|
|
an unauthenticated connection and risking that mail will
|
|
be rejected. File: smtp/smtp_sasl_proto.c, smtp/smtp_proto.c.
|
|
|
|
Portability: zero the "struct msg" just in case. Both purify
|
|
(Linux) and valgrind (FreeBSD) complain about uninitialized
|
|
bits. Files: util/unix_{send,recv}_fd.c.
|
|
|
|
20051219
|
|
|
|
Cleanup: generic smtpd_sasl_path, smtp_sasl_path and
|
|
lmtp_sasl_path configuration parameters; simplified the
|
|
SASL plug-in API, and made initial provisions for SASL
|
|
session encryption. Files: xsasl/*.[hc].
|
|
|
|
Feature: "postconf -a" lists the available SASL server
|
|
plug-in types, and "postconf -A" does the same for the
|
|
client. Files: postconf.c, xsasl_{client,server}.c.
|
|
|
|
Feature: new SMTPD policy attributes "encryption_protocol",
|
|
"encryption_cipher" and "encryption_keysize", to distinguish
|
|
plaintext from encrypted connections.
|
|
|
|
20051221
|
|
|
|
Privacy: the new Cyrus SASL server plug-in replaces "no
|
|
user" errors by "authentication failed" errors. File:
|
|
xsasl/xsasl_cyrus_server.c.
|
|
|
|
Safety: the Postfix SMTP client no longer uses CNAME expanded
|
|
hostnames for logging, SASL password lookup, TLS policy
|
|
decisions, or TLS certificate verification. Instead it
|
|
uses the name of the recipient domain, or the host or domain
|
|
name specified in Postfix configuration files. Of course
|
|
this won't prevent cheating with hostnames that appear in
|
|
MX lookup results. To avoid that you will have to suppress
|
|
MX lookups with explicit [hostname] entries in transport
|
|
maps. Files: dns/dns_lookup.c, dns/dns_rr.c.
|
|
|
|
20051222
|
|
|
|
Feature: Dovecot SASL authentication (server side) plug-in
|
|
by Timo Sirainen. This builds without external library
|
|
dependencies and is therefore compiled in by default.
|
|
Files: xsasl/xsasl_dovecot_server.[hc].
|
|
|
|
Safety: set the default LANG=C, instead of deleting LANG
|
|
from the environment and assuming the right thing will
|
|
happen. File: global/mail_params.h.
|
|
|
|
Safety: always add the ISASCII() requirement to the ISXXX()
|
|
macros, because they are used for protocol and policy
|
|
enforcement. File: util/sys_defs.h.
|
|
|
|
Bugfix: null pointer in the 20051219 policy delegation
|
|
crypto attributes. File: smtpd/smtpd_check.c.
|
|
|
|
Compatibility: "resolve_numeric_domain = yes" will accept
|
|
addresses with numeric domains instead of rejecting them as
|
|
invalid. Files: trivial-rewrite/resolve.c, util/vstring.c.
|
|
|
|
Bugfix: 20051219 "postconf -A" produced "postconf -a" output.
|
|
Andreas Winkelmann.
|
|
|
|
20051225
|
|
|
|
Bugfix: the regexp map cleverly avoided scanning constant
|
|
lookup results for non-existent $number expressions, but
|
|
failed to subject those results to the necessary $$ -> $
|
|
replacement. Files: util/dict_regexp.c.
|
|
|
|
Performance: the pcre map did not optimize constant lookup
|
|
results; they were always scanned for non-existent $number
|
|
expressions. File: util/dict_pcre.c.
|
|
|
|
This round of edits eliminates architectural differences
|
|
between the pcre and regexp table implementations. The
|
|
remaining difference is that regexp tables still support
|
|
the obsolete "/pattern1/!/pattern2/ action" syntax, for
|
|
backwards compatibility with Postfix 2.0 and earlier.
|
|
|
|
20051227
|
|
|
|
Bugfix: the 20051222 ISASCII paranoia broke the strcasecmp()
|
|
workaround for Solaris. File: util/strcasecmp.c.
|
|
|
|
Bitrot: SunOS4 pre-dates size_t, ssize_t, getsid(). File:
|
|
src/util/sys_defs.h. The SunOS4 tests had been suspended
|
|
due to what turned out to be a broken AUI-to-UTP transceiver.
|
|
|
|
Bugfix: the 20061226 cosmetic change broke non-IPV6 support
|
|
(example: sockaddr_to_hostaddr: Unknown error: success).
|
|
File: util/myaddrinfo.c.
|
|
|
|
20051229
|
|
|
|
The following workaround was removed 20060103.
|
|
|
|
Workaround: when mail is still queued after 3000 seconds,
|
|
the SMTP client no longer pipelines the DOT+QUIT commands.
|
|
The 20050929 paranoia about malformed server replies
|
|
eliminated a rare occurrence of "lost mail" with sites that
|
|
mis-implement DOT+QUIT pipelining, but resulted in a larger
|
|
occurrence of repeated deliveries to sites with a different
|
|
DOT+QUIT pipelining bug. The time threshold is set with the
|
|
smtp_dot_quit_workaround_threshold_time parameter. Files:
|
|
smtp/smtp_proto.c, smtp/smtp.c.
|
|
|
|
Feature: mailbox_transport_maps and fallback_transport_maps
|
|
to search delivery transports by recipient name. Files:
|
|
local/mailbox.c, local/unknown.c.
|
|
|
|
Feature: the master daemon now logs a warning when all
|
|
servers are busy that may accept remote connections, and
|
|
suggests to either increase the process count or to reduce
|
|
the service time per client. Files: master/master_ent.c,
|
|
master/master_avail.c.
|
|
|
|
20051231
|
|
|
|
Bugfix: the anvil server would terminate after "max_idle"
|
|
seconds, even when this was less than the anvil_rate_time_unit
|
|
interval. File: anvil/anvil.c.
|
|
|
|
20060102
|
|
|
|
Deleted the 20051229 dot-quit bug workaround. Automatically
|
|
deferring delivery created "no delivery" and "repeated
|
|
delivery" problems; and automatically turning off pipelining
|
|
for delayed mail was a bad workaround for a bad workaround.
|
|
The administrator still has the option to turn off pipelining
|
|
by hand if loss of mail is a concern.
|
|
|
|
20060103
|
|
|
|
Bugfix: the 20051217 fix (when a SASL client password is
|
|
found, defer delivery when no server-announced mechanism
|
|
survives the smtp_sasl_mechanism_filter) did the mechanism
|
|
test too early, so that it could trip up with deliveries
|
|
to servers that we don't have a SASL password for. Files:
|
|
smtp/smtp_sasl_proto.c, smtp/smtp_proto.c.
|
|
|
|
20060104
|
|
|
|
Safety: new "smtp_cname_overrides_servername" parameter.
|
|
The default value ("no") is NOT backwards compatible. This
|
|
avoids surprises with the hostname that is used for logging,
|
|
SASL password lookup, TLS policy decisions, or TLS certificate
|
|
verification. The change makes the 20051221 behavior more
|
|
configurable. Files: smtp/smtp_addr.c, smtp/smtp_connect.c,
|
|
proto/postconf.proto.
|
|
|
|
20060105
|
|
|
|
Cleanup: removed the unused DSN "code" attribute; removed
|
|
surrogate SMTP replies for errors that were not reported
|
|
by a remote SMTP server, making several DSN-related functions
|
|
and macros redundant; cleaned up some bizarre code for DSN
|
|
attribute memory management in the SMTP client.
|
|
|
|
20060106
|
|
|
|
Cleanup: eliminated the global smtp_errno variable, which
|
|
had become redundant after introducing DSN support. Files:
|
|
smtp/smtp_addr.c, smtp/smtp_connect.c.
|
|
|
|
20060107
|
|
|
|
Cleanup: removed more bizarre code for DSN attribute memory
|
|
management in the queue manager, bounce server, and in
|
|
delivery agents.
|
|
|
|
20060109
|
|
|
|
Bugfix: smtp_sasl_tls_opts was unimplemented. File:
|
|
smtp/smtp_sasl_proto.c.
|
|
|
|
Cleanup: more bounce logfile code cleanup. Files:
|
|
global/bounce_log.c, bounce/bounce_notify_util.c,
|
|
bounce/bounce.c, bounce/bounce_notify_verp.c,
|
|
bounce/bounce_one_service.c, showq/showq.c
|
|
|
|
20060110
|
|
|
|
Cleanup: more bounce logfile code cleanup. Files:
|
|
global/bounce_log.c, bounce/bounce_notify_util.c.
|
|
|
|
Bugfix: the VERP bouncer never handled the case of a missing
|
|
bounce logfile. Found while doing more logfile code cleanup.
|
|
File: bounce/bounce_notify_verp.c.
|
|
|
|
Feature: smtp_sasl_tls_verified_security_options for
|
|
connections where the server certificate passed verification.
|
|
The default value is $smtp_sasl_tls_security_options, which
|
|
in turn defaults to $smtp_sasl_security_options.
|
|
|
|
20060111
|
|
|
|
Optimization: mystrdup() and mystrndup() now return a pointer
|
|
to a fixed read-only memory location instead of allocating
|
|
memory for zero-length null-terminated strings. This saves
|
|
lots of memory for unused recipient attributes. If this
|
|
change causes problems (for example, you have an ancient
|
|
sscanf() implementation that writes to its input) then
|
|
compile Postfix with -DNO_SHARED_EMPTY_STRINGS.
|
|
|
|
Cleanup: eliminated null pointer members in DSN structures.
|
|
Instead we now use the optimized mystrdup() for empty
|
|
strings. For safety sake we keep the tests for null pointers
|
|
in input, but we always produce empty strings on output.
|
|
Files: global/dsn.c, global/dsn.h, global/dsn_buf.h,
|
|
global/dsn_print.c.
|
|
|
|
Cleanup: eliminated ad-hoc code for passing recipients in
|
|
the queue manager delivery request protocol. Postfix now
|
|
uses proper object activation/passivation instead. Files:
|
|
*qmgr/qmgr_deliver.c, global/deliver_request.c,
|
|
global/deliver_pass.c.
|
|
|
|
20060112
|
|
|
|
Feature: to simplify debugging the bounce server logs the
|
|
old and new queue ID when notifying the sender or postmaster.
|
|
Files: global/post_mail.c, bounce/bounce_notify_service.c,
|
|
bounce/bounce_one_service.c, bounce/bounce_notify_verp.c,
|
|
bounce/bounce_warn_service.c, bounce/bounce_trace_service.c.
|
|
|
|
Fudge: when translating recipient DSN codes into sender DSN
|
|
codes, map sender address problems that have no DSN code
|
|
to *.1.7 (Bad sender's mailbox address syntax) instead of
|
|
*.1.0 (Other address status) because that loses the distinction
|
|
between sender and recipient. File: smtpd/smtpd_dsn_fix.c.
|
|
|
|
20060113
|
|
|
|
Cleanup: preserve upper case information of address localpart
|
|
or extension when mapping one address to another with
|
|
non-regexp/pcre tables. Files: global/mail_addr_find.c,
|
|
global/maps_find.c.
|
|
|
|
20060115
|
|
|
|
Bugfix: don't ignore the per-site policy when SSL library
|
|
initialization fails. Introduced after adopting the TLS
|
|
patch. File: smtp/smtp_session.c.
|
|
|
|
20060117
|
|
|
|
[withdrawn 20060126] Safety: daemon processes that need no
|
|
privileges now insist that they are configured to run without
|
|
privileges. Files: master/single_server.c, master/multi_server.c,
|
|
master/trigger_server.c.
|
|
|
|
Cleanup: preserve upper case information of address localpart
|
|
or extension when mapping addresses via regexp/pcre tables.
|
|
This requires that Postfix does not case fold the search
|
|
string when searching regexp or pcre tables, so that $number
|
|
substitutions produce the expected result.
|
|
|
|
In order to get a consistent handling of table operations,
|
|
the search string case folding logic was moved from the
|
|
application to the individual lookup table modules; the
|
|
application specifies its case folding preference when it
|
|
opens a table, and the table folds the search or update
|
|
string as needed.
|
|
|
|
Files: everything that opens a map or multiple maps (to
|
|
specify the case folding preference), and everything that
|
|
contained ad-hoc code to lowercase search strings (which
|
|
is no longer needed).
|
|
|
|
Bugfix: as a side effect of this revision of all code that
|
|
opens tables, the postmap/postalias -n/-N options are no
|
|
longer silently ignored when the -q (query) and -d (delete)
|
|
options are specified. Files: postmap/postmap.c,
|
|
postalias/postalias.c.
|
|
|
|
Safety: don't allow $number substitution in transport maps
|
|
or sender-dependent relayhost maps.
|
|
|
|
Cleanup: smtp_sasl_passwd_maps lookup keys are folded to
|
|
lowercase before searching tables such as btree:, dbm: or
|
|
hash: that have fixed-case fields. File: smtp/smtp_sasl_glue.c.
|
|
|
|
Bugfix: per-sender relayhost maps were not locked for shared
|
|
access.
|
|
|
|
20060119
|
|
|
|
Cleanup: don't look up parent domain substrings in regexp/pcre
|
|
like tables while searching a hostname in a domain/namaddr_list.
|
|
File: util/match_ops.c.
|
|
|
|
20060120
|
|
|
|
Cleanup: multiple boolean variables were replaced by a
|
|
single TLS enforcement level (none, may, encrypt, verify).
|
|
With Victor Duchovni. Files: smtp_session.c, smtp_proto.c,
|
|
smtp.h.
|
|
|
|
Cleanup: the SMTP per-site policy table was re-implemented
|
|
in terms of enforcement levels instead of multiple boolean
|
|
variables. This greatly simplified the code and led to the
|
|
elimination of non-intuitive behavior as documented next.
|
|
With Victor Duchovni. Files: smtp_session.c, smtp.h.
|
|
|
|
Bugfix: a TLS per-site MUST_NOPEERMATCH policy could not
|
|
override a main.cf MUST (with peer match) policy, while a
|
|
per-site NONE policy could.
|
|
|
|
Bugfix: a combined TLS per-site (host, next-hop) policy of
|
|
(NONE, MAY) would change the strongest main.cf MUST policy
|
|
into NONE, while it changed all weaker main.cf policies
|
|
into MAY. The result is now NONE for all main.cf policy
|
|
settings.
|
|
|
|
20060123
|
|
|
|
Feature: recipient_count attribute in SMTPD policy protocol.
|
|
This is available only in the DATA and END-OF-MESSAGE stage.
|
|
Based on code by Guo Black. Files: smtpd_check.c.
|
|
|
|
Cleanup: renamed MUMBLE_NUM to MUMBLE_INT to make type
|
|
discrepancies more explicit.
|
|
|
|
Bugfix: change 20051208 broke when a connection could not
|
|
be established. File: util/auto_clnt.c.
|
|
|
|
20060124
|
|
|
|
Bugfix: the virtual(8) delivery agent did not insist on
|
|
privileged operation as it should; this broke change 20060117.
|
|
Ralf Hildebrandt. File: virtual/virtual.c.
|
|
|
|
Bugfix: the TLS sasl security options (change 20060110)
|
|
should also be #ifdef USE_TLS, and not only #ifdef
|
|
USE_SASL_AUTH. Such feature interference is difficult to
|
|
find in testing. Liviu Daia. File: smtp/smtp_sasl_proto.c.
|
|
|
|
20060126
|
|
|
|
Undo: change 20060117 (unprivileged operation test) broke
|
|
"sendmail -bs", "postconf -b", "postconf -t", and probably
|
|
more. Files: master/{single,multi,trigger}_server.c.
|
|
|
|
20060130
|
|
|
|
Bugfix: an empty remote_header_rewrite_domain value caused
|
|
trivial-rewrite to dereference a null pointer, but only in
|
|
regression tests, not in production. Envelope addresses are
|
|
by definition rewritten in the local domain context, because
|
|
an address without domain is equivalent to an address in
|
|
the local domain; and header addresses are rewritten in the
|
|
remote context only when remote_header_rewrite_domain is
|
|
non-empty. File: trivial-rewrite/rewrite.c.
|
|
|
|
20060131
|
|
|
|
Cleanup: regression tests are now separated into "make
|
|
tests" for unprivileged tests, and "make root_tests" for
|
|
tests that require privileges to connect to the Postfix
|
|
internal sockets. Files Makefile.in, src/*/Makefile.in.
|
|
|
|
20060201
|
|
|
|
Bugfix: despite efforts to treat malformed domain names as
|
|
hard errors (change 20050726) they were still processed as
|
|
soft errors. File: dns/dns_lookup.c.
|
|
|
|
20060203
|
|
|
|
Bugfix: smtpd core dump when SASL was compiled in, turned
|
|
off (smtpd_sasl_auth_enable = no) and permit_sasl_authenticated
|
|
was specified in local_header_rewrite_clients. Victor
|
|
Duchovni. File: smtpd/smtpd_check.c.
|
|
|
|
Cleanup: don't complain about useless SASL or TLS "permit"
|
|
restrictions when SASL or TLS aren't compiled in, but do
|
|
reject mail when reject_plaintext_session is specified while
|
|
TLS isn't compiled in. File: smtpd/smtpd_check.c.
|
|
|
|
20060204
|
|
|
|
Bugfix: disable the content_filter feature for user-requested
|
|
"sendmail -bv" probes, just like it is disabled for probes
|
|
generated by Postfix itself. File: *qmgr/qmgr_message.c.
|
|
|
|
20060207
|
|
|
|
Robustness: place the "do we have TLS" guards within method
|
|
implementations, instead of putting them around method
|
|
invocations. File: smtpd/smtpd_check.c.
|
|
|
|
Bugfix: duplicate the cleanup(8) DSN envelope ID syntax
|
|
check in smtpd(8), so that clients get better error replies.
|
|
File: smtpd/smtpd_check.c.
|
|
|
|
Bugfix: change 20060203 broke the reject_plaintext_session
|
|
feature.
|
|
|
|
The trivial-rewrite and proxymap multi-server processes now
|
|
terminate soon after all their clients disconnect, instead
|
|
of waiting for another 100 seconds. This allows the processes
|
|
to refresh more frequently on low-traffic systems.
|
|
|
|
Cleanup: smtpd_delay_open_until_valid_rcpt (default: yes)
|
|
controls whether Postfix delays the start of a mail transaction
|
|
until after the first valid recipient, or if it starts a
|
|
transaction immediately after MAIL FROM. File: smtpd/smtpd.c.
|
|
|
|
20060217
|
|
|
|
Bugfix: don't terminate with a non-standard exit status
|
|
when the pipe-to-command feature has a problem before it
|
|
executes the command. File: global/pipe_command.c.
|
|
|
|
20060223
|
|
|
|
Bugfix: detect integer overflow when multiplying time values
|
|
with non-trivial time units. File: global/conv_time.c.
|
|
|
|
20060307
|
|
|
|
Bugfix: reset the msg_cleanup() fatal error handler in child
|
|
processes. See also change 20060217. Files: postlock/postlock.c,
|
|
master/multi_server.c, global/mail_run.c, util/vstream_popen.c.
|
|
|
|
20060310
|
|
|
|
Bugfix: the MIME processor assumed that input was null
|
|
terminated. This broke with CRLF input to the "sendmail -t"
|
|
command in Postfix 2.1 and later (see change 20030416).
|
|
Found by Leandro Santi. Based on patch by Victor Duchovni.
|
|
Files: global/mime_state.c, global/is_header.c.
|
|
|
|
20060313
|
|
|
|
Cleanup: the message arrival time (start of the receive
|
|
transaction) no longer controls message expiration or
|
|
delivery attempts. Instead, expiration and delivery are
|
|
now controlled by the time when the cleanup server creates
|
|
a queue file. This closes a problem that was introduced
|
|
with the 20051104 change that introduced higher-resolution
|
|
delay time keeping: as a result, "postsuper -r" could no
|
|
longer manipulate the mail expiration schedule, so that
|
|
mail "on hold" could expire too soon.
|
|
|
|
20060315
|
|
|
|
Workaround. the PCRE library reports an inappropriate error
|
|
code (invalid substring) when $number refers to a valid ()
|
|
expression that matches the null string. This caused fatal
|
|
run-time errors. File: dict_pcre.c.
|
|
|
|
20060324
|
|
|
|
Cleanup: eliminated name collisions between global and local
|
|
variables, and other forms of shadowing. Documented switch
|
|
fall-throughs with /* FALLTHROUGH */ where this wasn't
|
|
already done. Replaced (var = expr) by (var = expr) != 0
|
|
where this wasn't already done.
|
|
|
|
20060324
|
|
|
|
Bugfix: mis-placed parenthesis in a before-filter error
|
|
test. A filter timeout was mis-reported as lost connection.
|
|
Found in code review. File: smtpd/smtpd_proxy.c.
|
|
|
|
20060327
|
|
|
|
Cleanup: the SQL and LDAP clients now log a warning when
|
|
they skip an empty lookup result, so that humans don't have
|
|
to wonder why Postfix doesn't find all the database entries.
|
|
File: global/db_common.c.
|
|
|
|
Moved SMTP/LMTP parameter initialization from global/mail_params.c
|
|
to the combined smtp/lmtp delivery agent. Added missing
|
|
lmtp parameters.
|
|
|
|
20060328
|
|
|
|
Feature: configurable chroot directive for the pipe(8)
|
|
delivery agent, by Przemyslaw Wegrzyn. Files:
|
|
global/pipe_command.c, pipe/pipe.c.
|
|
|
|
Bugfix: cut-and-paste error: lmtp_connection_cache_limit
|
|
was left with the name of smtp_connection_cache_limit.
|
|
Reported by Victor? File: src/global/mail_params.h.
|
|
|
|
20060329
|
|
|
|
More extensible interface for TLS client/server library,
|
|
now passes property structures that combine all the relevant
|
|
parameters in one type-safe structure.
|
|
|
|
TLS session cache activity logging now takes place at TLS
|
|
log level 2 or greater.
|
|
|
|
20060403
|
|
|
|
Cleanup: made fcntl/flock handling consistent with respect
|
|
to EINTR (reported by Carlo Contavalli). However, Postfix
|
|
is not meant to be signal safe. Only the master daemon
|
|
handles signals without terminating, and it uses only a
|
|
small subset of Postfix library routines. File: util/myflock.c.
|
|
|
|
Bugfix: the pipe-to-command error message was lost when the
|
|
command could not be executed. File: global/pipe_command.c.
|
|
|
|
20060404
|
|
|
|
Bugfix in sanity check: after reading a record from the
|
|
address verification database, a sanity check did not reject
|
|
a record with all-zero time stamp fields. Such records are
|
|
never written; the test is there just in case something is
|
|
broken, so that Postfix will not blindly march on and create
|
|
chaos. The sanity check tested pointer values, instead of
|
|
dereferencing the pointers. Found by Coverity. File:
|
|
verify/verify.c.
|
|
|
|
Bugfix in sanity check: when the maildir delivery routine
|
|
opens an output file it looks up the file attributes via
|
|
the file handle it just got. There is a sanity check that
|
|
detects if the attribute lookup fails, an error that never
|
|
happens. The code that handles the impossible error did not
|
|
close the output file. This would cause a virtual or local
|
|
delivery agent to waste up to 100 file descriptors. But
|
|
for that error to happen the system would have to be so
|
|
sick that you would have more serious problems than a file
|
|
descriptor leak. Found by Coverity. Files: local/maildir.c,
|
|
virtual/maildir.c.
|
|
|
|
20060405
|
|
|
|
Bugfix: the MIME parser assumed input is null terminated
|
|
when reporting errors. Fix by Leandro Santi. Files:
|
|
global/mime_state.c, cleanup/cleanup_message.c.
|
|
|
|
20060411
|
|
|
|
Bugfix: the SMTP server logged no warning when for some
|
|
reason the TLS engine was unavailable in wrappermode. Victor
|
|
Duchovni. File: smtpd/smtpd.c.
|
|
|
|
20060417
|
|
|
|
Cleanup: when SMTP access table lookup fails, reply with
|
|
4xx instead of aborting with a fatal run-time error. The
|
|
old behavior assumes local file access, and is inappropriate
|
|
with deployment of LDAP and SQL tables. File: smtpd/smtpd_check.c.
|
|
|
|
20060423
|
|
|
|
Bugfix: postcat did not print the attribute value of records
|
|
containing a named attribute. File: postcat/postcat.c.
|
|
|
|
20060430
|
|
|
|
Bugfix: dangling pointer in a function that has no caller.
|
|
Found by Coverity. File: tls/tls_prng_exch.c.
|
|
|
|
Bugfix: the workaround for CA-2003-07 (Sendmail) did not
|
|
null terminate the address before logging a warning. Reported
|
|
by Kris Kennaway. File: global/tok822_parse.c.
|
|
|
|
20060301-20060515
|
|
|
|
Sendmail 8 Milter support, distributed across the smtpd(8)
|
|
server for SMTP commands, and the cleanup(8) server for
|
|
content inspection and manipulation. The code supports all
|
|
requests to add/delete recipients, and to add/delete/replace
|
|
message headers, but does not yet support requests to replace
|
|
the message body. See MILTER_README for more. Files:
|
|
smtpd/smtpd.c, smtpd/smtpd_milter.c, cleanup/cleanup_api.c,
|
|
cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c,
|
|
cleanup/cleanup_milter.c, milter/milter.c, milter/milter8.c.
|
|
|
|
That's 89 lines in smtpd, 1010 lines in cleanup, and 2449
|
|
lines of library support, comments not included.
|
|
|
|
A simple test Milter application for use in regression tests
|
|
is in src/milter/test-milter.c. Queue file modifications are
|
|
tested with a driver at the end src/cleanup/cleanup_milter.c
|
|
that reads commands from a script.
|
|
|
|
To make debugging easier, uncomment the "#define msg_verbose
|
|
2" lines at the top of cleanup_milter.c or milter8.c. This
|
|
produces logging without making everything else verbose.
|
|
|
|
20060510
|
|
|
|
Preliminary TLS_README and postconf(5) changes completed.
|
|
Victor Duchovni.
|
|
|
|
Added smtp_tls_policy_maps and smtp_tls_protocols features
|
|
to the smtp/lmtp client, changed smtp_tls_cipherlist to
|
|
only apply when TLS is mandatory. Victor Duchovni.
|
|
|
|
20060512
|
|
|
|
Destinations that share a common server may have distinct
|
|
TLS protocol and cipherlist requirements, with mandatory
|
|
TLS add the protocol and cipherlist values to the TLS session
|
|
lookup key. Victor Duchovni.
|
|
|
|
20060516
|
|
|
|
Portability: __float80 alignment, by Albert Chin. File:
|
|
util/sys_defs.h.
|
|
|
|
Further testing of Milter support uncovered typos; a missing
|
|
null pointer test while cleaning up after content miltering;
|
|
the need for a workaround to not bounce+delete local
|
|
submission after it triggers a temporary reject Milter
|
|
action.
|
|
|
|
Workaround: don't bounce+delete a local submission after
|
|
it triggers a "reject 4.x.x" action in header/body_checks.
|
|
This means an SMTP client now sees "queue file write error"
|
|
instead of the text from the "reject 4.x.x text" action.
|
|
File: cleanup/cleanup_message.c.
|
|
|
|
Workaround: OpenSSL 0.9.8[ab] with zlib support interoperability
|
|
problem. Victor Duchovni. Files: tls/tls_client.c,
|
|
tls/tls_misc.c, tls/tls_server.c.
|
|
|
|
Added smtpd_tls_protocols parameter to complement
|
|
smtp_tls_protocols. Victor Duchovni.
|
|
|
|
20060517
|
|
|
|
The smtp_tls_policy_maps table now implements parent domain
|
|
matching for destinations that are bare domains (without
|
|
enclosing [] or optional :port suffix). This allows one to
|
|
set TLS policy for a domain and all sub-domains. Victor
|
|
Duchovni.
|
|
|
|
20060519
|
|
|
|
The same parameter can bind to different variables in
|
|
different daemons. Ignore the variable name when eliminating
|
|
duplicates in extract.awk. Victor Duchovni.
|
|
|
|
20060523
|
|
|
|
Improved handling of smtp_tls_protocols and smtpd_tls_protocols,
|
|
names now processed via name_mask(3) and canonicalized prior
|
|
to use in the SMTP/LMTP client TLS session lookup key. Also
|
|
simplifies the corresponding code in the TLS driver. Victor
|
|
Duchovni.
|
|
|
|
20060524
|
|
|
|
Cleanup: send ETRN command parameter when using check_policy
|
|
in the context of an ETRN command. Joshua Goodall. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
20060601
|
|
|
|
Bugfix (bug introduced 20051118): permit_mx_backup authorized
|
|
domains without secondary MX records. Joshua Goodall. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
20060601
|
|
|
|
Fixed default value of LMTP TLS client certificate parameters,
|
|
using the SMTP values as a default was wrong. Victor Duchovni.
|
|
|
|
20060603
|
|
|
|
Different transports may have different CAfile or CApath
|
|
settings. We need to add the transport name to the TLS
|
|
session lookup key so that sessions verified with one set
|
|
of trusted roots are not inadvertantly considered verified
|
|
for another. Victor Duchovni.
|
|
|
|
20060604
|
|
|
|
Cleanup: minor fluff found with the BEAM source code analyzer.
|
|
Files: global/quote_821_local.c, global/quote_822_local.c,
|
|
master/master_spawn.c, pickup/pickup.c, util/match_ops.c,
|
|
util/safe_open.c, xsasl/xsasl_cyrus_client.c.
|
|
|
|
20060606
|
|
|
|
Safety: mail receiving daemons (smtpd, qmqpd) now pass
|
|
actual client name/addres/helo attributes in addition to
|
|
the attributes used for logging (xforward). This prevents
|
|
Milter applications from treating qmqpd mail as if it
|
|
originated locally, and prevents incorrect Milter decisions
|
|
after "postsuper -r". Files: smtpd/smtpd.c, qmqpd/qmqpd.c,
|
|
cleanup/cleanup_envelope.c, cleanup/cleanup_milter.c,
|
|
cleanup/cleanup_state.c, global/post_mail.c, *qmgr/qmgr_message.c,
|
|
*qmgr/qmgr_deliver.c, global/deliver_request.c,
|
|
global/deliver_pass.c, local/forward.c.
|
|
|
|
Bugfix: qmgr panic after queue file corruption by Mailscanner.
|
|
Files: *qmgr/qmgr_message.c.
|
|
|
|
Bugfix: XCLIENT didn't work with smtpd_delay_reject=no
|
|
(problem reported by Joshua Goodall). To make XCLIENT work
|
|
correctly with built-in restrictions and with Milter
|
|
applications, the SMTP server now jumps back to the very
|
|
start (the 220 phase) of an SMTP session. File: smtpd/smtpd.c.
|
|
|
|
20060606
|
|
|
|
Portability: Some systems no longer support the traditional
|
|
"sort +0 -2 +3". Victor Duchovni.
|
|
|
|
20060607
|
|
|
|
Portability: Found by BEAM static code analyzer. SSL options
|
|
(long) were stored as int.
|
|
|
|
20060610
|
|
|
|
Cleanup: XCLIENT and XFORWARD attribute values are now sent
|
|
as xtext encoded strings. For backwards compatibility,
|
|
Postfix will still accept unencoded attribute values. Files:
|
|
smtpd/smtpd.c, smtpd/smtpd_proxy.c, smtp/smtp_proto.c.
|
|
|
|
20060611
|
|
|
|
Robustness: additional sanity checks for common database
|
|
routines. Viktor Dukhovni. File: global/db_common.c.
|
|
|
|
Portability: LDAP 2.3 API support. Viktor Dukhovni. File:
|
|
global/dict_ldap.c.
|
|
|
|
Security: the PostgreSQL client was updated after the
|
|
PostgreSQL developers made major database API changes in
|
|
response to PostgreSQL security issues. This breaks support
|
|
for PGSQL versions prior to 8.1.4, 8.0.8, 7.4.13, and 7.3.15.
|
|
Support for these requires major code changes which are not
|
|
possible in the time that is left for the Postfix 2.3 stable
|
|
release.
|
|
|
|
Specific PostgreSQL client changes: use connection-aware
|
|
quoting, and more robust PQexec() result handling. Previous
|
|
versions of the dict_pgsql driver didn't check the status
|
|
of the result pointer, and certain exceptional events can
|
|
be mis-interpreted as an empty result set. Fixes by Leandro
|
|
Santi. File: global/dict_pgsql.c.
|
|
|
|
20060612
|
|
|
|
Changed smtp security level parsing and level->name conversion
|
|
to use name_code(3). Victor Duchovni.
|
|
|
|
Implemented new smtp_tls_security_level parameter, to replace
|
|
the unnecessarily complex smtp_use_tls, smtp_enforce_tls
|
|
and smtp_tls_enforce_peername parameters. The main.cf
|
|
security level settings are now consistent with the new
|
|
policy table. Victor Duchovni.
|
|
|
|
The smtp_sasl_tls_verified_security_options feature is not
|
|
yet complete, added #ifdef SNAPSHOT and changed documentation
|
|
to delay introduction until Postfix 2.4. Victor Duchovni.
|
|
|
|
20060614
|
|
|
|
Merged in Victor's work including the new TLS policy table
|
|
and a complete set of configuration parameters for the LMTP
|
|
personality of the unified SMTP/LMTP client.
|
|
|
|
Allow mandatory TLS encryption with LMTP over UNIX-domain
|
|
sockets. Victor Duchovni.
|
|
|
|
Safety: improved code to avoid I/O on connections after the
|
|
TLS handshake fails. Victor Duchovni.
|
|
|
|
20060615
|
|
|
|
Cosmetic patch for const strings. Stefan Huehner.
|
|
|
|
Other cosmetic changes, mainly whitespace.
|
|
|
|
20060616
|
|
|
|
The qshape.pl script was updated for the pointer records
|
|
that were introduced to support message content modification
|
|
by Milter applications. Victor Duchovni.
|
|
|
|
20060620
|
|
|
|
Feature: Substantially better cipherlist specification
|
|
interface and support for anonymous ciphers when certificates
|
|
are not needed. The primary interface in main.cf and the
|
|
policy table selects one of 5 grades for mandatory TLS with
|
|
smtp(8) or lmtp(8) or for all TLS sessions with smtpd(8).
|
|
The levels are "high", "medium" (or better), "low" (or
|
|
better), "export" (or better) and "null". The underlying
|
|
definitions of these levels are configurable, but users are
|
|
strongly encouraged to not change those definitions. Victor
|
|
Duchovni.
|
|
|
|
20060626
|
|
|
|
Bugfix: the Milter reply syntax checker was off by one.
|
|
File: milter/milter8.c.
|
|
|
|
Workaround: disable SMTP connection cache lookup by server
|
|
IP address when the tls_per_site policy table is enabled.
|
|
This is a workaround for a shortcoming in the SMTP connection
|
|
cache implementation, which retrieves the server hostname
|
|
from the cached connection. Since this server name is not
|
|
obtained in a secure manner, it must not be allowed to
|
|
control the tls_per_site policy. File: smtp/smtp_reuse.c.
|
|
|
|
20060627
|
|
|
|
Cleanup: mumble_mandatory_tls_mumble parameters renamed to
|
|
mumble_tls_mandatory_mumble; added _mandatory_ qualifier
|
|
to names of parameters that affect only mandatory TLS.
|
|
|
|
20060630
|
|
|
|
Features promoted from SNAPSHOT to STABLE: the "sleep"
|
|
pseudo restriction; Postfix daemons now read the local
|
|
timezone file before chrooting; trivial-rewrite now detects
|
|
table changes every 10 seconds, so it restarts more timely.
|
|
|
|
Features that stay #ifdef SNAPSHOT: tcp_table,
|
|
lmtp_sasl_tls_verified_security_options, and
|
|
smtp_sasl_tls_verified_security_options.
|
|
|
|
Compatibility: Sendmail does not send its own Received:
|
|
header to Milter applications. Offsets in header replace
|
|
requests are relative to the message content as received
|
|
(i.e. without our own Received: header), while offsets in
|
|
header insert requests are relative to the message as
|
|
delivered (i.e. they include our own Received: header).
|
|
This explains why dk-filter would sign our own Received:
|
|
header but place the signature between our own Received:
|
|
header and the rest of the message, violating the draft
|
|
domainkeys spec.
|
|
|
|
20060702
|
|
|
|
Cleanup: more graceful handling of queue file read/write
|
|
errors while processing milter message modification requests.
|
|
Files: cleanup/cleanup_milter.c, milter/milter8.c.
|
|
|
|
20060703
|
|
|
|
Debugging: the Postfix milter client gives more context
|
|
when it experiences trouble while talking to an uncooperative
|
|
Milter application. File: milter/milter8.c.
|
|
|
|
Compatibility: with OpenBSD 2.7 and later, the alias file
|
|
is now in /etc/mail/aliases.
|
|
|
|
20060704
|
|
|
|
Bugfix: the Milter client skipped zero-length body lines.
|
|
File: milter/milter8.c.
|
|
|
|
Feature (just this one): RFC 3834 "Auto-Submitted:" message
|
|
header in DSNs. File: bounce/bounce_notify_util.c.
|
|
|
|
20060705
|
|
|
|
Portability: LP64 systems required a few ssize_t->int casts
|
|
in debug logging statements. Files: milter/test_milter.c,
|
|
cleanup/cleanup_milter.c.
|
|
|
|
Cleanup: comments, error messages, and crumbling interfaces.
|
|
|
|
20060707
|
|
|
|
Workaround: apparently, Solaris gettimeofday() can return
|
|
out-of range microsecond values. File: src/global/log_adhoc.c.
|
|
|
|
Robustness: the SMTPD policy client now encodes the
|
|
ccert_subject and ccert-issuer attributes as xtext. Some
|
|
characters are replaced by +XX, where XX is the two-digit
|
|
hexadecimal code for the character value. File:
|
|
smtpd/smtpd_check.c.
|
|
|
|
Safety: the SMTP/LMTP client now defers delivery when a
|
|
SASL password exists, but the server does not offer SASL
|
|
authentication. Mail could be rejected otherwise. This may
|
|
become an issue now that Postfix retries delivery in plaintext
|
|
after an opportunistic TLS handshake fails. Specify
|
|
"smtp_sasl_auth_enforce = no" to deliver mail anyway. File:
|
|
smtp/smtp_proto.c. See workaround 20060711 for sender-dependent
|
|
SASL passwords. This was undone with the 20060719 workaround.
|
|
|
|
20060709
|
|
|
|
Cleanup: the new single smtpd_tls_security_level parameter
|
|
obsoletes the multiple smtpd_use_tls and smtpd_enforce_tls
|
|
parameters. This is done for consistency with the Postfix
|
|
SMTP client. In the Postfix SMTP server, the levels "verify"
|
|
and "secure" are currently not applicable, and are treated
|
|
as "encrypt", after logging a warning. Files: smtpd/smtpd.c,
|
|
tls/tls_level.c, smtp/smtp_session.c.
|
|
|
|
Compatibility: don't send the first (blank) body line to
|
|
Milter applications. This broke domain key etc. signatures
|
|
when verified by non-Postfix MTAs. File: milter/milter8.c.
|
|
|
|
20060710
|
|
|
|
Cleanup: more consistency between smtpd(8) and smtp(8) TLS
|
|
configuration interfaces: smtpd_tls_mandatory_exclude_ciphers,
|
|
smtpd_tls_mandatory_ciphers, smtpd_tls_mandatory_protocols.
|
|
By Victor. Files:smtpd/smtpd.c.
|
|
|
|
Cleanup: to support domainkey signing of bounces and
|
|
Postmaster notices, enable content inspection of Postfix-
|
|
generated mail with the new internal_mail_filter_classes
|
|
feature. This is disabled by default, because it is not
|
|
yet safe enough. Files: global/int_filt.[hc] and everything
|
|
that calls post_mail_fopen*().
|
|
|
|
20060711
|
|
|
|
Cleanup: smtpd_tls_mumble -> smtpd_tls_mandatory_mumble,
|
|
and finer control over the Postfix SMTP server TLS ciphers,
|
|
all this for consistency with the same functionality in the
|
|
Postfix SMTP client. Victor Duchovni.
|
|
|
|
Compatibility: Sendmail's milter client handles whitespace
|
|
after the header label and ":" in an interesting manner.
|
|
It eats one space (not tab). File: milter/milter8.c.
|
|
|
|
Workaround: if sender-dependent SASL passwords are enabled,
|
|
don't defer delivery when a SASL password exists but the
|
|
server doesn't announce SASL support. File: smtp/smtp_proto.c.
|
|
This was undone with the 20060719 workaround.
|
|
|
|
Cleanup: format of cleanup milter reject messages. File:
|
|
cleanup_milter.c.
|
|
|
|
Bugfix: file/memory leak if a transfer of multiple milters
|
|
from smtpd to cleanup broke in the middle. Found by Coverity.
|
|
File: milter/milter.c.
|
|
|
|
20060716
|
|
|
|
Bugfix: "sendmail -bs" panic caused by a missing
|
|
SMTPD_STATE_ALONE() guard before a milter_abort() call.
|
|
File: smtpd/smtpd.c.
|
|
|
|
Bugfix (bug introduced with Postfix 2.2): the Postfix SMTP
|
|
client enforced Mandatory TLS only when talking to an ESMTP
|
|
server; enforcement did not happen if Postfix could somehow
|
|
be forced to send HELO instead of EHLO. Victor Duchovni.
|
|
File: src/smtp/smtp_proto.c.
|
|
|
|
20060718
|
|
|
|
Bugfix (bug introduced 20060711): null pointer bug when
|
|
rejecting SMTP mail with Milter application. File:
|
|
cleanup/cleanup_milter.c.
|
|
|
|
Workaround (problem introduced in 200605/200606 TLS update):
|
|
the Postfix SMTP server now issues TLS session IDs even
|
|
when TLS session caching is turned off, otherwise MS Outlook
|
|
fails to deliver mail. There may also be interoperability
|
|
issues with other MTAs that we haven't discovered yet.
|
|
Specify "smtpd_tls_always_issue_session_ids = no" to disable
|
|
the workaround. Victor Duchovni. Files: smtpd/smtpd.c,
|
|
tls/tls_server.c.
|
|
|
|
20060719
|
|
|
|
Cleanup: the smtp_sasl_auth_enforce feature is gone. It was
|
|
meant to work around a problem that was introduced with
|
|
plaintext fallback after a failed TLS handshake. Unfortunately,
|
|
it created more problems than it solved. We now address the
|
|
underlying problem more directly as described next. File:
|
|
smtp/smtp_proto.c.
|
|
|
|
Safety: don't fall back to plaintext delivery after failed
|
|
TLS handshake, when the Postfix SMTP client would have
|
|
attempted to log in with SASL after successful TLS handshake.
|
|
This avoids undesirable behavior regardless of whether the
|
|
server does support SASL over plaintext (unexpected password
|
|
disclosure) and whether the server doesn't support SASL
|
|
over plaintext (insufficient mail relay permission). Files:
|
|
smtp/smtp_connect.c, smtp/smtp_session.c, smtp/smtp_proto.c.
|
|
|
|
20060720
|
|
|
|
Compatibility: replace %% in milter replies by %, and strip
|
|
single (i.e. invalid) % characters. File: milter/milter8.c.
|
|
|
|
Compatibility: $_ macro support for Milter applications.
|
|
Files: smtpd/smtpd.c, smtpd/smtpd_milter.c,
|
|
cleanup/cleanup_state.c, cleanup/cleanup_milter.c.
|
|
|
|
20060721
|
|
|
|
Safety: disable Milter processing after "postsuper -r". If
|
|
the mail has been filtered there is no need to do it again.
|
|
Moreover, when mail has passed through an external content
|
|
filter, we don't have sufficient information to reproduce
|
|
the exact same SMTP events and Sendmail macros that Milters
|
|
received when the mail originally arrived in Postfix. This
|
|
change does not affect Milter applications that run behind
|
|
an after-queue content filter. File: pickup/pickup.c.
|
|
|
|
Bugfix: Milters received a truncated ORCPT=xxx parameter
|
|
due to destructive parsing of something that didn't have
|
|
to be preserved before Milter support was added to Postfix.
|
|
File: smtpd/smtpd.c.
|
|
|
|
20060724
|
|
|
|
Bugfix: when updating the same header multiple times, the
|
|
Postfix Milter client created a queue file that caused
|
|
delivery agents to loop. File: cleanup/cleanup_milter.c.
|
|
|
|
20060725
|
|
|
|
Bugfix: damaged queue file record after a Milter request
|
|
to modify a message header when 1) it was the last header
|
|
in the unmodified message, and 2) the old header was less
|
|
than 15 characters long. File: cleanup/cleanup_milter.c.
|
|
|
|
Bugfix: don't panic in smtp_rcpt_cleanup() after detecting
|
|
a damaged queue file record. File: smtp/smtp_proto.c.
|
|
|
|
20060726
|
|
|
|
Bugfix: the 20051013 change to enforce the message size
|
|
limit in the SMTP server didn't work for size limits close
|
|
enough to INT_MAX. File: smtpd/smtpd.c.
|
|
|
|
Bugfix: after an SMTP client was rejected with "smtpd_delay_reject
|
|
= no", the SMTP server would panic as it generated spurious
|
|
Milter requests for unrecognized commands. File: smtpd/smtpd.c.
|
|
|
|
20060727
|
|
|
|
Cleanup: change redundant milter_abort() and milter_disc_event()
|
|
calls into NO-OPs. This avoids unnecessary panic() events
|
|
for completely harmless conditions. File: milter/milter8.c.
|
|
|
|
20060805
|
|
|
|
Bugfix (introduced Postfix 2.3): #ifdef damage caused
|
|
smtp_sasl_start() to be invoked twice. Reported by C-J
|
|
Lofstedt. File: smtp/smtp_sasl_proto.c.
|
|
|
|
20060806
|
|
|
|
Postfix no longer announces its name in delivery status
|
|
notifications. Users believe that Wietse provides a free
|
|
helpdesk service that solves all their email problems.
|
|
Credits to Jonathan Balester. File: bounce/bounce_templates.c.
|
|
|
|
20060807
|
|
|
|
Bugfix (introduced Postfix 2.2): when upgrading from Postfix
|
|
< 2.2 with the third-party TLS patch, the post-install
|
|
upgrade procedure didn't put a "?" in the existing tlsmgr
|
|
entry, causing tlsmgr to repeatedly start and exit when TLS
|
|
support was not compiled in. File: conf/post-install.
|
|
|
|
20060812
|
|
|
|
Bugfix (introduced Postfix < alpha): safety mechanism in
|
|
mail_date() didn't work. Found in code review. File:
|
|
global/mail_date.c.
|
|
|
|
20060822
|
|
|
|
Added missing logging for "message to large" etc. Files:
|
|
smtpd/smtpd.c, cleanup/cleanup_milter.c.
|
|
|
|
20060823
|
|
|
|
Bugfix (introduced Postfix 2.2): segfault when vstream_fclose()
|
|
attempted to flush unwritten output, after vstream_fdclose()
|
|
had already disconnected the stream from its file descriptor.
|
|
File: util/vstream.c.
|
|
|
|
Bugfix (introduced Postfix 2.2): vstream_fdclose() did not
|
|
flush unwritten output before disconnecting a stream from
|
|
its file descriptor(s). File: util/vstream.c.
|
|
|
|
20060825
|
|
|
|
Bugfix (introduced Postfix 2.3): with headers-only mail, a
|
|
Milter "header insert" action corrupted the queue file. The
|
|
cleanup server executed some end-of-body action before the
|
|
end-of-header actions. File: cleanup/cleanup_message.c.
|
|
|
|
Robustness: mail delivery agents now detect loops in queue
|
|
files. Files with too many backward jumps are saved to the
|
|
"corrupt" directory. File: global/record.c.
|