MILTER bugfix:
When a milter replied with ACCEPT at or before the first RCPT
command, the cleanup server would apply the non_smtpd_milters
setting as if the message was a local submission. Problem
reported by Jukka Salmi.
MILTER bugfix:
Problem with header updates after body updates. Reported by
Jose-Marcio Martins da Cruz.
MILTER robustness:
Assorted cleanups to harden error handling in the Postfix Milter
client.
SASL workaround for Postfix SMTP client:
Some non-Cyrus SASL SMTP servers require SASL login without
authzid (authoriZation ID), i.e. the client must send only the
authcid (authentiCation ID) + the authcid's password. This is
now the default Postfix SMTP client behavior.
Loopback TCP performance workaround:
Some systems exhibited poor SMTP and Milter performance with
loopback (127.0.0.1) connections. Problem reported by Mark
Martinec.
MILTER bugfix:
When a milter replied with ACCEPT at or before the first RCPT
command, the cleanup server would apply the non_smtpd_milters
setting as if the message was a local submission. Problem
reported by Jukka Salmi.
MILTER bugfix:
Problem with header updates after body updates. Reported by
Jose-Marcio Martins da Cruz.
MILTER robustness:
Assorted cleanups to harden error handling in the Postfix Milter
client.
SASL workaround for Postfix SMTP client:
Some non-Cyrus SASL SMTP servers require SASL login without
authzid (authoriZation ID), i.e. the client must send only the
20070425
Bugfix: don't falsely report "lost connection from
localhost[127.0.0.1]" when Postfix is being portscanned.
Files: smtpd/smtpd_peer.c, qmqpd/qmqpd_peer.c.
20070430
Robustness: recommend a "0" process limit for policy servers
to avoid "connection refused" problems when the smtpd
process limit exceeds the default process limit. File:
proto/SMTPD_POLICY_README.html.
20070501
Safety: when IPv6 (or IPv4) is turned off, don't treat an
IPv6 (or IPv4) connection from e.g. inetd as if it comes
from localhost[127.0.0.1]. Files: smtpd/smtpd_peer.c,
qmqpd/qmqpd_peer.c.
20070508
Bugfix: Content-Transfer-Encoding: attribute values are
case insensitive. File: src/cleanup/cleanup_message.c.
20070514
Bugfix: mailbox_transport(_maps) and fallback_transport(_maps)
were broken when used with the error(8) or discard(8)
transports. Cause: insufficient documentation. Files:
error/error.c, discard/discard.c.
20070520
Bugfix (problem introduced Postfix 2.3): when DSN support
was introduced it broke "agressive" recipient duplicate
elimination with "enable_original_recipient = no". File:
cleanup/cleanup_out_recipient.c.
20070529
Bugfix (introduced Postfix 2.3): the sendmail/postdrop
commands would hang when trying to submit a message larger
than the per-message size limit. File: postdrop/postdrop.c.
20070530
Sabotage the saboteur who insists on breaking Postfix by
adding gethostbyname() calls that cause maildir delivery
to fail when the machine name is not found in /etc/hosts,
or that cause Postfix processes to hang when the network
is down.
20070531
Portability: Victor helpfully pointed out that change
20070425 broke on non-IPv6 systems. Files: smtpd/smtpd_peer.c,
qmqpd/qmqpd_peer.c.
20070331
Bugfix (introduced Postfix 2.3): segfault with HOLD action
in access/header_checks/body_checks on 64-bit platforms.
File: cleanup/cleanup_api.c.
20070402
Portability (introduced 20070325): the fix for hardlinks
and symlinks in postfix-install forgot to work around shells
where "IFS=/ command" makes the IFS setting permanent. This
is allowed by some broken standard, and affects Solaris.
File: postfix-install.
Portability (introduced 20070212): the workaround for
non-existent library bugs with descriptors >= FD_SETSIZE
broke with "fcntl F_DUPFD: Invalid argument" on 64-bit
Solaris. Files: master/multi_server.c, *qmgr/qmgr_transport.c.
20070421
Cleanup: on (Linux) platforms that cripple signal handlers
with deadlock, "postfix stop" now forcefully stops all the
processes in the master's process group, not just the master
process alone. File: conf/postfix-script.
The footprint of new features with Postfix 2.4.0 is significantly
smaller than with earlier releases. And that is the whole point of
approaching completeness: fewer visible changes.
Below is a brief summary of what has changed. See the RELEASE_NOTES
file for more, including compatibility issues that may affect your
site. The HISTORY file gives a blow-by-blow account of what happened
over the past year.
Wietse
- Postfix can now manage thousands of connections without needing
special main.cf, master.cf, or compile-time tweaks, on systems with
BSD kqueue, Solaris /dev/poll, or Linux epoll support.
- Milter support for message body replacement. The resulting queue
files are backwards compatible with Postfix 2.3. The existing Milter
support for message header manipulations was revised and is now
implemented by much simpler code.
- Minor improvements in TLS session cache management and in the
implementation of certificate fingerprint based authentication. A
more extensive revision of TLS internals will appear first in Postfix
2.5 snapshots.
- Improvements in queue manager performance when deferring large
amounts of mail, or when delivering mail with lots of recipients.
- Workarounds for SMTP servers that reply and hang up prematurely,
for file system clocks that are out of sync, and for broken kernel
lock management in POP servers.
- postmap support for NIS maps was broken with Postfix 2.3.
- Workaround to avoid breaking digital signatures for malformed
MIME attachments.
- Incorrect handling of ![address] forms in match lists. such as
mynetworks, inet_interfaces etc.
- On Redhat Linux, a Postfix daemon could lock up while logging a
warning from a signal handler before exiting. This is remedied
by a low-cost re-entrancy guard for signal handlers that never
return.
- Message headers longer than 65535 broke the Milter protocol. To
make matters worse the cleanup server could then dereference a
null pointer. When Milter support is enabled, the length of each
message header is now limited to 60000.
- Several fixes to improve worst-case behavior of the (new) queue
manager with multi-recipient mail. The queue manager now reads
new recipients earlier from the queue file, instead of becoming
starved while waiting for the slowest in-memory recipients to
complete; and it now reads recipients in smaller chunks to avoid
spending too much time not talking to delivery agents.
- With remote SMTP server tarpit delays larger than the Postfix
SMTP client's smtp_rset_timeout (default: 20s), the client would
get out of sync with the server while reusing a connection. The
symptoms were "recipient rejected .. in reply to DATA".
- On FreeBSD 6.2, some Postfix daemon processes would complain once
with "Error 0" after "postfix reload" and then recover. This
warning is now logged only when the problem persists.
configuration variables look exactly like the ones produced by the
configure scripts.
Added POSTFIX_QUEUE_DIR to BUILD_DEFS to make it visible why VARBASE can
be configured.
Postfix 2.3 Patch 04 fixes minor problems as detailed in the change
history below. The patch as well as complete source code tarballs
were uploaded last week to the mirrors listed at http://www.postfix.org/
20060831
Bugfix (introduced with initial implementation): missing
"dict_errno = 0" caused mis-leading error messages after
non-error lookup failure. Victor Duchovni. File:
util/dict_cidr.c.
Robustness: the default TLS cipher lists were changed from
!foo:ALL into ALL:!foo. Victor Duchovni. Files:
global/mail_params.h and documentation.
20060902
Bugfix (introduced Postfix 2.3): the LMTP client stripped
"inet": from the next-hop destination, but still used the
complete next-hop from the delivery request. File:
smtp/smtp_connect.c.
20060903
Cleanup: record loop detection. File: global/record.c.
20060929
Workaround: AIX 5.[1-3] getaddrinfo() creates socket address
structures with a non-zero port value. This breaks the
smtp_bind_address etc. features, and breaks inet_interfaces
settings with only one IP address. Problem reported by
Hamish Marson. Files: util/sock_addr.[hc], util/myaddrinfo.c.
Bugfix (introduced with the Postfix TLS patch): memory leak
in verify_extract_peer(). The OpenSSL documentation provides
no information on how subjectAltNames are managed. Sam
Rushing, ironport. File: tls/tls_client.c.
Bugfix (introduced with Postfix 2.2): smtp_generic_maps
turned on MIME conversion. File: smtp/smtp_proto.c.
Workaround: don't send SIZE information in the MAIL FROM
command when message content will be subject to 8bit ->
quoted-printable conversion. File: smtp/smtp_proto.c.
20061002
Compatibility: Sendmail now invokes the Milter connect
action with the verified hostname instead of the name
obtained with PTR lookup. File: smtpd/smtpd.c.
20061004
Cleanup: force space between mailq queueid+status and file
size items. File: showq/showq.c.
20061015
Cleanup: convert the Milter {mail_addr} and {rcpt_addr}
macro values to external form. File: smtpd/smtpd_milter.c.
Cleanup: the Milter {mail_addr} and {rcpt_addr} macros are
now available with non-SMTP mail. File: cleanup/cleanup_milter.c.
Cleanup: convert addresses in Milter recipient add/delete
requests to internal form. File: cleanup/cleanup_milter.c.
Cleanup: with non-SMTP mail, convert addresses in simulated
MAIL FROM and RCPT TO events to external form. File:
cleanup/cleanup_milter.c.
20061017
Cleanup: removed spurious warning when the cleanup server
attempts to bounce mail with soft_bounce=yes. Problem
reported by Ralf Hildebrandt. File: cleanup/cleanup_bounce.c.
Bugfix: null pointer bug when receiving a non-protocol
response on a cached SMTP/LMTP connection. Report by Brian
Kantor. Fix by Victor Duchovni. File: smtp/smtp_reuse.c.
in post-extract.
I exchanges few mails with Wietse and he refused to fix the "==" lines and
instructed me to simply remove the offending file. Instead of having a patch
for a file which is not used by pkgsrc I think it makes sense to remove it.
- File corruption while executing a Milter "header insert" action
with headers-only mail (found with dk-filter). Delivery agents
would go into an infinite loop because some queue file update
had been done in the wrong order. As a precaution, delivery
agents now detect such loops, and the queue manager now saves
such mail to the "corrupt" directory.
- Segmentation fault in the SMTP client while saving a cached
connection with unsent data. Postfix indexed some table with -1,
because some I/O cleanup had been done in the wrong order. The
same problem should exist in Postfix 2.2.
- Postfix no longer announces its name in delivery status notifications.
All other details of the default bounce text remain unchanged.
The reason for this change is that too many people believe that
Wietse provides a free helpdesk service that solves all their
email problems.
- Corrupted queue file after a request to modify a short message
header, when that header was the last one in the message.
- Panic after spurious Milter request when a client was rejected
with "smtpd_delay_reject = no".
- The Milter client is now more tolerant for redundant "data cleanup"
requests. This avoids panic() calls for harmless conditions.
Main changes in TLS support:
- The Postfix SMTP client enforced mandatory TLS only when talking
to an ESMTP server; enforcement did not happen if Postfix could
somehow be forced to send HELO instead of EHLO. This problem also
exists in Postfix 2.2, where it is is fixed with Postfix 2.2
patch 11. This is minor compared to the DNS spoofing issues that
were fixed with Postfix 2.2.10.
- Workaround for an interoperability problem introduced with Postfix
2.3. Some buggy TLS client implementations were unable to deliver
mail because the Postfix SMTP server didn't send a TLS session
ID. To disable the workaround specify "smtpd_tls_always_issue_session_ids
= no"; this allows non-buggy TLS clients to save some space.
Main changes in Milter support:
- Safety measure. After "postsuper -r", mail is no longer inspected
by the Milters specified with the non_smtpd_milters parameter.
This measure prevents a bad interaction with external content
filters: Milters would receive incorrect SMTP client information,
and could be tricked into signing or allowing untrusted messages.
This change does not affect Milter applications that run behind
an after-queue content filter. The behavior is detailed in the
postsuper(1) manual page.
This is the first version in the 2.3.x series, please see the release notes
for full list of changes since 2.2.x before upgrading your current
installation.
$smtp_sasl_security_options (as documented in postconf(5)) instead of
$var_smtp_sasl_opts, which is never defined. This is a bug that exists
in the Postfix-2.2.x series but has been fixed in the (current)
Postfix-2.3.x series. This fixes PR pkg/29631 by Christoph Badura.
Bump the PKGREVISION to 1.
- "sendmail -t" did not remove the CR from lines ending in CRLF.
- Workaround for fatal errors in PCRE maps when an expression in
() matches empty text (the PCRE library returns an inappropriate
error code).
- Fixes for non-security bugs that Coverity found in code that
handles impossible error conditions.
- install PREFIX/sbin/qshape
Updated postfix to 2.2.9
Most of this patch hardens the TLS implementation against DNS-based
attacks, and eliminates some anomalies from the TLS per-site policy
engine. See the TLS_README document for tips on how to avoid
DNS-based attacks that can change the server hostname that Postfix
uses for logging, for TLS per-site policies, and for server
certificate verification.
The patch also adds a workaround that prevents Postfix from repeatedly
trying to deliver mail to domains with a malformed MX record (for
example, with a null MX hostname). Postfix 2.2.9 bounces such mail
immediately.
Postfix 2.2.8 backs out a workaround for broken servers/firewalls
that created more problems than it solved.
- The Postfix 2.2.6 paranoia about malformed remote server replies
caused "multiple delivery" problems or "no delivery" problems with
broken servers/firewalls. Postfix still logs a warning but no longer
defers delivery.
backslashes anymore. A single backslash is enough. Changed the
definition in all affected packages. For those that are not caught, an
additional check is placed into bsd.pkginstall.mk.
Postfix 2.2.5 addresses some portability problems with LP64 platforms
that broke SMTP connection caching, and makes SMTP connection
caching more failure tolerant. These fixes are back-ported from
the experimental (2.3) release series.
The connection caching protocol has changed, so you will need to
"postfix reload" after upgrading.
20050517
Bugfix: in a DSN report, the original recipient should not
be xtext encoded. File: bounce/bounce_notify_util.c.
20050523
Bugfix: mymalloc() panic with mistyped server host list.
File: global/dict_pgsql.c.
20040530
Bugfix: TLS MUST_NOPEERMATCH didn't work (inherited from
TLS patch), and a dangling pointer in the corresponding
error handling. File: smtp/smtp_proto.c.
20050615
Cleanup: the SMTP client now sends QUIT when the initial
HELO handshake fails. it still doesn't send QUIT when the
server greets with a [45]XX code, as that is handled in the
connection management code before a session context exists.
File: smtp/smtp_connect.c.
20050616
Bugfix: missing or mis-placed va_end() macros, found in
Postfix 2.3 code review. Files: util/netstring.c,
util/myaddrinfo.c, util/attr_clnt.c, util/vstream.c.
20050621
Portability: file descriptor passing is available for Tru64
UNIX, but AIX4 and IRIX6 will have to do without. This means
no SMTP connection caching for those platforms. Albert
Chin. File: util/sys_defs.h.
- SASL inter-operability problem causing Sendmail servers to hang up on Postfix.
- Panic when a fall-back relay could not be used for a variety of reasons.
- A more usable REPLACE action in header/body_checks. The old
version produced unexpected results.
- Portability to HP-UX.
- Two harmless defects in the SMTP and LMTP clients that go back
to before the first Postfix release, and that were found while
doing code maintenance on the experimental release.
New features since 2.1.x:
- built-in IPv6 and TLS (we no longer use patches--beware config changes!)
- more sophisticated LDAP/MySQL/PostgreSQL support, with freeform queries
- SMTP client-side connection reuse
- by default, no longer rewrite message headers in mail from remote clients
- can use your ISP account name for mail destined outside your machine
- can selectively turn off ESMTP features in client or server
- remote SMTP client resource control (the anvil server)
- support for CDB, SDBM and NIS+ databases is now built into Postfix
- new SMTP access control features
- and more
Caution:
- You MUST stop 2.1.x and earlier versions before upgrading.
- Use the postfix upgrade program to upgrade your main.cf/master.cf.
