diff --git a/postfix/HISTORY b/postfix/HISTORY index 0b653fac5..eca95e4d5 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -16828,3 +16828,16 @@ Apologies for any names omitted. Cleanup: removed the PSC_STATE_FLAG_CACHE_EXPIRED flag. Nothing uses this anymore. Files: postscreen/postscreen.h, postscreen/postscreen_state.c, postscreen/postscreen_tests.c. + +20110614 + + Linux kernel version 3 support. Linus Torvalds has reset + the counters for reasons not related to changes in code. + Files: makedefs, util/sys_defs.h. + +20110615 + + Workaround: some Spamhaus RHSBL rejects lookups with "No + IP queries" even if the name has an alphanumerical prefix. + We play safe, and skip both RHSBL and RHSWL queries for + names ending in a numerical suffix. File: smtpd/smtpd_check.c. diff --git a/postfix/README_FILES/MULTI_INSTANCE_README b/postfix/README_FILES/MULTI_INSTANCE_README index 80a086c2b..3ac94733f 100644 --- a/postfix/README_FILES/MULTI_INSTANCE_README +++ b/postfix/README_FILES/MULTI_INSTANCE_README @@ -327,7 +327,7 @@ This uses the postmulti(1) command to invoke postconf(1) in the context (MAIL_CONFIG=/etc/postfix-out) of the output instance. * Lines 1-2: With "authorized_submit_users = root", the superuser can test - the postix-out instance with "postmulti -i postfix-out -x sendmail -bv + the postfix-out instance with "postmulti -i postfix-out -x sendmail -bv recipient...", but otherwise local submission remains disabled. * Lines 1-2: With "master_service_disable =", the "inet" listeners are re- diff --git a/postfix/WISHLIST b/postfix/WISHLIST index 2bc3bc716..4f0ce0cae 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -15,7 +15,30 @@ Wish list: close-on-exec flags. This could be a way to mitigate the impact of memory/file leaks, and to implement "postfix reload" support for master(8) features that currently don't - support this. + support this. + + Sub-second time resolution. The first benefit is to make + per-destination rate delays more usable. Other applications + will come up once the support exists. The straightforward + approach is to represent all time intervals in milliseconds, + and to update all code that makes system calls with a time + argument (as well as the compiled-in upper and lower time + parameter bounds, which are currently in seconds). + Unfortunately, that limits he maximum time interval to less + than 25 days on 32-bit systems, and is likely to break + compatibility (for starters, it cannot even deal with the + compiled-in 100d upper bound on the queue file lifetime). + A second option is to have a "compatibility" time base + switch between milliseconds and seconds; this means extra + changes to all code that makes system calls with a time + argument, and the way that the compiled-in upper and lower + bounds are specified. Some of this can be encapsulated in + macros like time_to_sec(t), time_to_msec(t) and sec_to_time(t). + Finally, it is relatively easy to replace the events(3) + interface to use "double" for the time delay arguments, but + it is a major pain to convert all main.cf time parameters + into doubles (converting only some leads to a documentation + nightmare). postscreen: wait for DNS completion after early HANGUP and log DNSBL. @@ -34,7 +57,6 @@ Wish list: whitelisting database before the primary MX connection is closed, because a client may still make a mistake. - Don't forget Apple's code donation for fetching mail from IMAP server. diff --git a/postfix/html/MULTI_INSTANCE_README.html b/postfix/html/MULTI_INSTANCE_README.html index 9bd65467f..d4874bae9 100644 --- a/postfix/html/MULTI_INSTANCE_README.html +++ b/postfix/html/MULTI_INSTANCE_README.html @@ -420,7 +420,7 @@ context (MAIL_CONFIG=/etc/postfix-out) of the output instance.
Lines 1-2: With "authorized_submit_users = root", the -superuser can test the postix-out instance with "postmulti -i +superuser can test the postfix-out instance with "postmulti -i postfix-out -x sendmail -bv recipient...", but otherwise local submission remains disabled.
diff --git a/postfix/html/TLS_README.html b/postfix/html/TLS_README.html index b1cda2227..5093f1773 100644 --- a/postfix/html/TLS_README.html +++ b/postfix/html/TLS_README.html @@ -865,9 +865,9 @@ cipher from a list supplied by the server.By default, the OpenSSL server selects the client's most preferred cipher that the server supports. With SSLv3 and later, the server may choose its own most preferred cipher that is supported (offered) -by the client. Setting "tls_preempt_cipherlist = yes" enables server +by the client. Setting "tls_preempt_cipherlist = yes" enables server cipher preferences. The default OpenSSL behaviour applies with -"tls_preempt_cipherlist = no".
+"tls_preempt_cipherlist = no".While server cipher selection may in some cases lead to a more secure or performant cipher choice, there is some risk of interoperability diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 44e6ebf5d..817eaa6b8 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -15404,7 +15404,7 @@ instead of the client's cipher preference order.
By default, the OpenSSL server selects the client's most preferred cipher that the server supports. With SSLv3 and later, the server may choose its own most preferred cipher that is supported (offered) by -the client. Setting "tls_preempt_cipherlist = yes" enables server cipher +the client. Setting "tls_preempt_cipherlist = yes" enables server cipher preferences.
While server cipher selection may in some cases lead to a more secure
diff --git a/postfix/html/smtpd.8.html b/postfix/html/smtpd.8.html
index adf5300f9..8bcd08697 100644
--- a/postfix/html/smtpd.8.html
+++ b/postfix/html/smtpd.8.html
@@ -158,7 +158,7 @@ SMTPD(8) SMTPD(8)
smtpd_per_record_deadline (normal: no, overload: yes)
Change the behavior of the smtpd_timeout time
limit, from a time limit per read or write system
- call, to a time limit to send or receive a complete
+ call, to a time limit to read or write a complete
record (an SMTP command line, SMTP response line,
SMTP message content line, or TLS protocol mes-
sage).
@@ -568,7 +568,7 @@ SMTPD(8) SMTPD(8)
Available in Postfix version 2.8 and later:
- tls_preempt_cipherlist (no)
+ tls_preempt_cipherlist (no)
With SSLv3 and later, use the server's cipher pref-
erence order instead of the client's cipher prefer-
ence order.
@@ -857,7 +857,7 @@ SMTPD(8) SMTPD(8)
smtpd_per_record_deadline (normal: no, overload: yes)
Change the behavior of the smtpd_timeout time
limit, from a time limit per read or write system
- call, to a time limit to send or receive a complete
+ call, to a time limit to read or write a complete
record (an SMTP command line, SMTP response line,
SMTP message content line, or TLS protocol mes-
sage).
diff --git a/postfix/makedefs b/postfix/makedefs
index 282eabcd4..bdfb150da 100644
--- a/postfix/makedefs
+++ b/postfix/makedefs
@@ -340,6 +340,33 @@ EOF
fi;;
esac
;;
+ Linux.3*) SYSTYPE=LINUX3
+ if [ -f /usr/include/db.h ]
+ then
+ : we are all set
+ elif [ -f /usr/include/db/db.h ]
+ then
+ CCARGS="$CCARGS -I/usr/include/db"
+ else
+ # On a properly installed system, Postfix builds
+ # by including
Lines 1-2: With "authorized_submit_users = root", the -superuser can test the postix-out instance with "postmulti -i +superuser can test the postfix-out instance with "postmulti -i postfix-out -x sendmail -bv recipient...", but otherwise local submission remains disabled.
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index efb44e55a..03e67d803 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20110605" +#define MAIL_RELEASE_DATE "20110615" #define MAIL_VERSION_NUMBER "2.9" #ifdef SNAPSHOT diff --git a/postfix/src/smtpd/Makefile.in b/postfix/src/smtpd/Makefile.in index 44792befb..dfcd674c2 100644 --- a/postfix/src/smtpd/Makefile.in +++ b/postfix/src/smtpd/Makefile.in @@ -38,7 +38,7 @@ update: ../../libexec/$(PROG) cp $(PROG) ../../libexec SMTPD_CHECK_OBJ = smtpd_state.o smtpd_peer.o smtpd_xforward.o smtpd_dsn_fix.o \ - smtpd_resolve.o + smtpd_resolve.o smtpd_expand.o smtpd_token: smtpd_token.c $(LIBS) $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIBS) $(SYSLIBS) diff --git a/postfix/src/smtpd/smtpd_check.c b/postfix/src/smtpd/smtpd_check.c index 0768c61b7..2e14dae0d 100644 --- a/postfix/src/smtpd/smtpd_check.c +++ b/postfix/src/smtpd/smtpd_check.c @@ -3192,6 +3192,7 @@ static const SMTPD_RBL_STATE *find_dnsxl_domain(SMTPD_STATE *state, const char *domain; const char *reply_addr; const char *byte_codes; + const char *suffix; /* * Extract the domain, tack on the RBL domain name and query the DNS for @@ -3203,7 +3204,16 @@ static const SMTPD_RBL_STATE *find_dnsxl_domain(SMTPD_STATE *state, return (SMTPD_CHECK_DUNNO); } else domain = what; - if (domain[0] == 0) + + /* + * XXX Some Spamhaus RHSBL rejects lookups with "No IP queries" even if + * the name has an alphanumerical prefix. We play safe, and skip both + * RHSBL and RHSWL queries for names ending in a numerical suffix. + */ + if (domain[0] == 0 || valid_hostname(domain, DONT_GRIPE) == 0) + return (SMTPD_CHECK_DUNNO); + suffix = strrchr(domain, '.'); + if (alldig(suffix == 0 ? domain : suffix + 1)) return (SMTPD_CHECK_DUNNO); query = vstring_alloc(100); @@ -3834,8 +3844,7 @@ static int generic_checks(SMTPD_STATE *state, ARGV *restrictions, name); else { cpp += 1; - if (state->helo_name - && valid_hostname(state->helo_name, DONT_GRIPE)) + if (state->helo_name) status = reject_rbl_domain(state, *cpp, state->helo_name, SMTPD_NAME_HELO); } @@ -5239,6 +5248,7 @@ int main(int argc, char **argv) string_init(); int_init(); smtpd_check_init(); + smtpd_expand_init(); smtpd_state_init(&state, VSTREAM_IN, "smtpd"); state.queue_id = "