- install PREFIX/sbin/qshape
Updated postfix to 2.2.9
Most of this patch hardens the TLS implementation against DNS-based
attacks, and eliminates some anomalies from the TLS per-site policy
engine. See the TLS_README document for tips on how to avoid
DNS-based attacks that can change the server hostname that Postfix
uses for logging, for TLS per-site policies, and for server
certificate verification.
The patch also adds a workaround that prevents Postfix from repeatedly
trying to deliver mail to domains with a malformed MX record (for
example, with a null MX hostname). Postfix 2.2.9 bounces such mail
immediately.
Postfix 2.2.8 backs out a workaround for broken servers/firewalls
that created more problems than it solved.
- The Postfix 2.2.6 paranoia about malformed remote server replies
caused "multiple delivery" problems or "no delivery" problems with
broken servers/firewalls. Postfix still logs a warning but no longer
defers delivery.
Postfix 2.2.5 addresses some portability problems with LP64 platforms
that broke SMTP connection caching, and makes SMTP connection
caching more failure tolerant. These fixes are back-ported from
the experimental (2.3) release series.
The connection caching protocol has changed, so you will need to
"postfix reload" after upgrading.
20050517
Bugfix: in a DSN report, the original recipient should not
be xtext encoded. File: bounce/bounce_notify_util.c.
20050523
Bugfix: mymalloc() panic with mistyped server host list.
File: global/dict_pgsql.c.
20040530
Bugfix: TLS MUST_NOPEERMATCH didn't work (inherited from
TLS patch), and a dangling pointer in the corresponding
error handling. File: smtp/smtp_proto.c.
20050615
Cleanup: the SMTP client now sends QUIT when the initial
HELO handshake fails. it still doesn't send QUIT when the
server greets with a [45]XX code, as that is handled in the
connection management code before a session context exists.
File: smtp/smtp_connect.c.
20050616
Bugfix: missing or mis-placed va_end() macros, found in
Postfix 2.3 code review. Files: util/netstring.c,
util/myaddrinfo.c, util/attr_clnt.c, util/vstream.c.
20050621
Portability: file descriptor passing is available for Tru64
UNIX, but AIX4 and IRIX6 will have to do without. This means
no SMTP connection caching for those platforms. Albert
Chin. File: util/sys_defs.h.
- SASL inter-operability problem causing Sendmail servers to hang up on Postfix.
- Panic when a fall-back relay could not be used for a variety of reasons.
- A more usable REPLACE action in header/body_checks. The old
version produced unexpected results.
- Portability to HP-UX.
- Two harmless defects in the SMTP and LMTP clients that go back
to before the first Postfix release, and that were found while
doing code maintenance on the experimental release.
New features since 2.1.x:
- built-in IPv6 and TLS (we no longer use patches--beware config changes!)
- more sophisticated LDAP/MySQL/PostgreSQL support, with freeform queries
- SMTP client-side connection reuse
- by default, no longer rewrite message headers in mail from remote clients
- can use your ISP account name for mail destined outside your machine
- can selectively turn off ESMTP features in client or server
- remote SMTP client resource control (the anvil server)
- support for CDB, SDBM and NIS+ databases is now built into Postfix
- new SMTP access control features
- and more
Caution:
- You MUST stop 2.1.x and earlier versions before upgrading.
- Use the postfix upgrade program to upgrade your main.cf/master.cf.
type. All platforms now support the "hash" map type as a result.
Remove the explicit dependencies on db4 and db2 on non-Linux and Linux,
respectively. Bump the PKGREVISION.
- The code to eliminate the local MTA from an MX address list did
not handle the case that the local MTA could appear with different
MX preferences in both inet_interfaces and proxy_interfaces.
- The SMTP server's kiss-of-death message "421 Timeout exceeded"
wasn't guarded by setjmp().
- The SMTP server didn't update the per-session error counter when
a client was denied access with smtpd_delay_reject=no.
- The Postfix sendmail command leaked file descriptors when it was
unable to execute the postdrop mail submission command.
- The bounce daemon sent the wrong type of bounce message when a
- Plus some portability, safety and documentation fixes.
<nameser8_compat.h> before <resolv.h> if it's defined.
Along with Johnny's recent buildlink3 fixes, this fixes the build
for me on Mac OS X Server 10.3.4. Should address pkg/26584.
framework and also by explicitly specifying more default values for
Postfix parameters. Also pass -I/usr/pkg/include/sasl to the compiler
when building using Cyrus SASLv2, which allows me to remove the patches
that added an unnecessary USE_SASL2_AUTH check.
* Bugfix: Misplaced myfree() caused a small memory leak.
* Removed the colon (:) from the characters XFORWARD replaces by
a question mark (IPv6 addresses looked like 2001?610?1108?5010?1
in logging).
- The postdrop mail submission command could die with SIGHUP and
abort mail submission. This was observed with mail from cron jobs.
- The MySQL client aborted with complaints about multiple attempts
to register the same lookup table. This was observed in the proxymap
daemon.
- As a workaround for agressive SMTP command pipelining clients,
the Postfix SMTP server now allows SMTP clients to overshoot the
SMTP server recipient limit without triggering the server hard
error limit, as long as the number of excess recipients stays within
a hard-coded overshoot limit of 1000. If you have such clients then
you also need to specify "smtpd_error_sleep_time = 0" or else
performance will be poor.
- The LMTP client attempted to reuse a connection after timeout,
causing protocol synchronization errors.
- The trivial-rewrite server could core dump after temporary table
lookup failure. This was not observed in Postfix 2.0.
- When mail is submitted at a high rate with the Postfix sendmail
command, the pickup daemon is keps busy long enough that it it
terminated by the watchdog timer (a feature that prevents Postfix
from locking up permanently).
- Malformed addresses in SMTP commands could result in table looks
with zero-length search strings, causing trouble with NIS lookups.
- A change in the line reading routines caused unexpected results
with lines ending in EOF. This change is undone.
- A portability problem with the test command ("test -e" is not
supported on older systems, while "test -f" does the job).
- Portability to MacOSX: Bind8 compatibility, core dumps in mailq
and postdrop, and changes in netinfo support.
- Elimination of some DNS lookup problems in third-party library
routines (typically resulting in localhost not being found).
- More agressive delivery to sites that defer a lot of mail.
- Correction of a few obscure error messages.
- Several small documentation fixes.
- Minor fixes for robustness problems that no-one has experienced.
