Lines 1-2: With "authorized_submit_users = root", the
-superuser can test the postix-out instance with "postmulti -i
+superuser can test the postfix-out instance with "postmulti -i
postfix-out -x sendmail -bv recipient...", but otherwise local
submission remains disabled.
diff --git a/postfix/html/TLS_README.html b/postfix/html/TLS_README.html
index b1cda2227..5093f1773 100644
--- a/postfix/html/TLS_README.html
+++ b/postfix/html/TLS_README.html
@@ -865,9 +865,9 @@ cipher from a list supplied by the server.
By default, the OpenSSL server selects the client's most preferred
cipher that the server supports. With SSLv3 and later, the server
may choose its own most preferred cipher that is supported (offered)
-by the client. Setting "tls_preempt_cipherlist = yes" enables server
+by the client. Setting "tls_preempt_cipherlist = yes" enables server
cipher preferences. The default OpenSSL behaviour applies with
-"tls_preempt_cipherlist = no".
+"tls_preempt_cipherlist = no".
While server cipher selection may in some cases lead to a more secure
or performant cipher choice, there is some risk of interoperability
diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html
index 44e6ebf5d..817eaa6b8 100644
--- a/postfix/html/postconf.5.html
+++ b/postfix/html/postconf.5.html
@@ -15404,7 +15404,7 @@ instead of the client's cipher preference order.
By default, the OpenSSL server selects the client's most preferred
cipher that the server supports. With SSLv3 and later, the server may
choose its own most preferred cipher that is supported (offered) by
-the client. Setting "tls_preempt_cipherlist = yes" enables server cipher
+the client. Setting "tls_preempt_cipherlist = yes" enables server cipher
preferences.
While server cipher selection may in some cases lead to a more secure
diff --git a/postfix/html/smtpd.8.html b/postfix/html/smtpd.8.html
index adf5300f9..8bcd08697 100644
--- a/postfix/html/smtpd.8.html
+++ b/postfix/html/smtpd.8.html
@@ -158,7 +158,7 @@ SMTPD(8) SMTPD(8)
smtpd_per_record_deadline (normal: no, overload: yes)
Change the behavior of the smtpd_timeout time
limit, from a time limit per read or write system
- call, to a time limit to send or receive a complete
+ call, to a time limit to read or write a complete
record (an SMTP command line, SMTP response line,
SMTP message content line, or TLS protocol mes-
sage).
@@ -568,7 +568,7 @@ SMTPD(8) SMTPD(8)
Available in Postfix version 2.8 and later:
- tls_preempt_cipherlist (no)
+ tls_preempt_cipherlist (no)
With SSLv3 and later, use the server's cipher pref-
erence order instead of the client's cipher prefer-
ence order.
@@ -857,7 +857,7 @@ SMTPD(8) SMTPD(8)
smtpd_per_record_deadline (normal: no, overload: yes)
Change the behavior of the smtpd_timeout time
limit, from a time limit per read or write system
- call, to a time limit to send or receive a complete
+ call, to a time limit to read or write a complete
record (an SMTP command line, SMTP response line,
SMTP message content line, or TLS protocol mes-
sage).
diff --git a/postfix/makedefs b/postfix/makedefs
index 282eabcd4..bdfb150da 100644
--- a/postfix/makedefs
+++ b/postfix/makedefs
@@ -340,6 +340,33 @@ EOF
fi;;
esac
;;
+ Linux.3*) SYSTYPE=LINUX3
+ if [ -f /usr/include/db.h ]
+ then
+ : we are all set
+ elif [ -f /usr/include/db/db.h ]
+ then
+ CCARGS="$CCARGS -I/usr/include/db"
+ else
+ # On a properly installed system, Postfix builds
+ # by including and by linking with -ldb
+ echo "No include file found." 1>&2
+ echo "Install the appropriate db*-devel package first." 1>&2
+ echo "See the RELEASE_NOTES file for more information." 1>&2
+ exit 1
+ fi
+ SYSLIBS="-ldb"
+ for name in nsl resolv
+ do
+ for lib in /usr/lib64 /lib64 /usr/lib /lib
+ do
+ test -e $lib/lib$name.a -o -e $lib/lib$name.so && {
+ SYSLIBS="$SYSLIBS -l$name"
+ break
+ }
+ done
+ done
+ ;;
GNU.0*|GNU/kFreeBSD.[567]*)
SYSTYPE=GNU0
# Postfix no longer needs DB 1.85 compatibility
diff --git a/postfix/mantools/postlink b/postfix/mantools/postlink
index eb1baec77..cbb5167b7 100755
--- a/postfix/mantools/postlink
+++ b/postfix/mantools/postlink
@@ -683,7 +683,7 @@ while (<>) {
s;\btls_null_cipherlist\b;$&;g;
s;\btls_eecdh_strong_curve\b;$&;g;
s;\btls_eecdh_ultra_curve\b;$&;g;
- s;\btls_preempt_cipherlist\b;$&;g;
+ s;\btls_preempt_cipherlist\b;$&;g;
s;\btls_disable_workarounds\b;$&;g;
s;\btls_append_default_CA\b;$&;g;
diff --git a/postfix/proto/MULTI_INSTANCE_README.html b/postfix/proto/MULTI_INSTANCE_README.html
index 1e5196adb..375c58cab 100644
--- a/postfix/proto/MULTI_INSTANCE_README.html
+++ b/postfix/proto/MULTI_INSTANCE_README.html
@@ -420,7 +420,7 @@ context (MAIL_CONFIG=/etc/postfix-out) of the output instance.
-
Lines 1-2: With "authorized_submit_users = root", the
-superuser can test the postix-out instance with "postmulti -i
+superuser can test the postfix-out instance with "postmulti -i
postfix-out -x sendmail -bv recipient...", but otherwise local
submission remains disabled.
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index efb44e55a..03e67d803 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
-#define MAIL_RELEASE_DATE "20110605"
+#define MAIL_RELEASE_DATE "20110615"
#define MAIL_VERSION_NUMBER "2.9"
#ifdef SNAPSHOT
diff --git a/postfix/src/smtpd/Makefile.in b/postfix/src/smtpd/Makefile.in
index 44792befb..dfcd674c2 100644
--- a/postfix/src/smtpd/Makefile.in
+++ b/postfix/src/smtpd/Makefile.in
@@ -38,7 +38,7 @@ update: ../../libexec/$(PROG)
cp $(PROG) ../../libexec
SMTPD_CHECK_OBJ = smtpd_state.o smtpd_peer.o smtpd_xforward.o smtpd_dsn_fix.o \
- smtpd_resolve.o
+ smtpd_resolve.o smtpd_expand.o
smtpd_token: smtpd_token.c $(LIBS)
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIBS) $(SYSLIBS)
diff --git a/postfix/src/smtpd/smtpd_check.c b/postfix/src/smtpd/smtpd_check.c
index 0768c61b7..2e14dae0d 100644
--- a/postfix/src/smtpd/smtpd_check.c
+++ b/postfix/src/smtpd/smtpd_check.c
@@ -3192,6 +3192,7 @@ static const SMTPD_RBL_STATE *find_dnsxl_domain(SMTPD_STATE *state,
const char *domain;
const char *reply_addr;
const char *byte_codes;
+ const char *suffix;
/*
* Extract the domain, tack on the RBL domain name and query the DNS for
@@ -3203,7 +3204,16 @@ static const SMTPD_RBL_STATE *find_dnsxl_domain(SMTPD_STATE *state,
return (SMTPD_CHECK_DUNNO);
} else
domain = what;
- if (domain[0] == 0)
+
+ /*
+ * XXX Some Spamhaus RHSBL rejects lookups with "No IP queries" even if
+ * the name has an alphanumerical prefix. We play safe, and skip both
+ * RHSBL and RHSWL queries for names ending in a numerical suffix.
+ */
+ if (domain[0] == 0 || valid_hostname(domain, DONT_GRIPE) == 0)
+ return (SMTPD_CHECK_DUNNO);
+ suffix = strrchr(domain, '.');
+ if (alldig(suffix == 0 ? domain : suffix + 1))
return (SMTPD_CHECK_DUNNO);
query = vstring_alloc(100);
@@ -3834,8 +3844,7 @@ static int generic_checks(SMTPD_STATE *state, ARGV *restrictions,
name);
else {
cpp += 1;
- if (state->helo_name
- && valid_hostname(state->helo_name, DONT_GRIPE))
+ if (state->helo_name)
status = reject_rbl_domain(state, *cpp, state->helo_name,
SMTPD_NAME_HELO);
}
@@ -5239,6 +5248,7 @@ int main(int argc, char **argv)
string_init();
int_init();
smtpd_check_init();
+ smtpd_expand_init();
smtpd_state_init(&state, VSTREAM_IN, "smtpd");
state.queue_id = "";
diff --git a/postfix/src/smtpd/smtpd_check.ref b/postfix/src/smtpd/smtpd_check.ref
index 50c85f7e3..898997125 100644
--- a/postfix/src/smtpd/smtpd_check.ref
+++ b/postfix/src/smtpd/smtpd_check.ref
@@ -82,7 +82,7 @@ OK
>>> helo_restrictions permit_naked_ip_address,reject_invalid_hostname,reject_unknown_hostname
OK
>>> helo 123.123.123.123
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
OK
>>> #
>>> # Test the sender restrictions
@@ -317,73 +317,73 @@ OK
>>> helo_restrictions permit_naked_ip_address,reject_non_fqdn_hostname
OK
>>> helo [1.2.3.4]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
OK
>>> helo [321.255.255.255]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[321.255.255.255]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[321.255.255.255]>
501 5.5.2 <[321.255.255.255]>: Helo command rejected: invalid ip address
>>> helo [0.255.255.255]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[0.255.255.255]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[0.255.255.255]>
501 5.5.2 <[0.255.255.255]>: Helo command rejected: invalid ip address
>>> helo [1.2.3.321]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1.2.3.321]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1.2.3.321]>
501 5.5.2 <[1.2.3.321]>: Helo command rejected: invalid ip address
>>> helo [1.2.3]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1.2.3]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1.2.3]>
501 5.5.2 <[1.2.3]>: Helo command rejected: invalid ip address
>>> helo [1.2.3.4.5]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1.2.3.4.5]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1.2.3.4.5]>
501 5.5.2 <[1.2.3.4.5]>: Helo command rejected: invalid ip address
>>> helo [1..2.3.4]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1..2.3.4]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1..2.3.4]>
501 5.5.2 <[1..2.3.4]>: Helo command rejected: invalid ip address
>>> helo [.1.2.3.4]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[.1.2.3.4]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[.1.2.3.4]>
501 5.5.2 <[.1.2.3.4]>: Helo command rejected: invalid ip address
>>> helo [1.2.3.4.5.]
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1.2.3.4.5.]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1.2.3.4.5.]>
501 5.5.2 <[1.2.3.4.5.]>: Helo command rejected: invalid ip address
>>> helo 1.2.3.4
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
OK
>>> helo 321.255.255.255
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <321.255.255.255>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<321.255.255.255>
501 5.5.2 <321.255.255.255>: Helo command rejected: invalid ip address
>>> helo 0.255.255.255
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <0.255.255.255>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<0.255.255.255>
501 5.5.2 <0.255.255.255>: Helo command rejected: invalid ip address
>>> helo 1.2.3.321
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1.2.3.321>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1.2.3.321>
501 5.5.2 <1.2.3.321>: Helo command rejected: invalid ip address
>>> helo 1.2.3
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1.2.3>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1.2.3>
501 5.5.2 <1.2.3>: Helo command rejected: invalid ip address
>>> helo 1.2.3.4.5
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1.2.3.4.5>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1.2.3.4.5>
501 5.5.2 <1.2.3.4.5>: Helo command rejected: invalid ip address
>>> helo 1..2.3.4
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1..2.3.4>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1..2.3.4>
501 5.5.2 <1..2.3.4>: Helo command rejected: invalid ip address
>>> helo .1.2.3.4
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <.1.2.3.4>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<.1.2.3.4>
501 5.5.2 <.1.2.3.4>: Helo command rejected: invalid ip address
>>> helo 1.2.3.4.5.
-./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks instead
+./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead
./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1.2.3.4.5.>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1.2.3.4.5.>
501 5.5.2 <1.2.3.4.5.>: Helo command rejected: invalid ip address
>>> #
diff --git a/postfix/src/smtpd/smtpd_dnswl.in b/postfix/src/smtpd/smtpd_dnswl.in
index 891e0c75f..147dbcaca 100644
--- a/postfix/src/smtpd/smtpd_dnswl.in
+++ b/postfix/src/smtpd/smtpd_dnswl.in
@@ -54,3 +54,7 @@ client example.tld 168.100.189.2
rcpt rname@rdomain
# Authorized destination - accept.
rcpt wietse@porcupine.org
+# Numeric TLD - dunno.
+rcpt wietse@12345
+rcpt wietse@12345.porcupine.org
+rcpt wietse@porcupine.12345
diff --git a/postfix/src/smtpd/smtpd_dnswl.ref b/postfix/src/smtpd/smtpd_dnswl.ref
index fc8940546..14d989874 100644
--- a/postfix/src/smtpd/smtpd_dnswl.ref
+++ b/postfix/src/smtpd/smtpd_dnswl.ref
@@ -83,3 +83,12 @@ OK
>>> # Authorized destination - accept.
>>> rcpt wietse@porcupine.org
OK
+>>> # Numeric TLD - dunno.
+>>> rcpt wietse@12345
+./smtpd_check: : reject: RCPT from example.tld[168.100.189.2]: 554 5.7.1 : Relay access denied; to= proto=SMTP helo=
+554 5.7.1 : Relay access denied
+>>> rcpt wietse@12345.porcupine.org
+OK
+>>> rcpt wietse@porcupine.12345
+./smtpd_check: : reject: RCPT from example.tld[168.100.189.2]: 554 5.7.1 : Relay access denied; to= proto=SMTP helo=
+554 5.7.1 : Relay access denied
diff --git a/postfix/src/smtpd/smtpd_exp.ref b/postfix/src/smtpd/smtpd_exp.ref
index c4d518afa..7a41e21bd 100644
--- a/postfix/src/smtpd/smtpd_exp.ref
+++ b/postfix/src/smtpd/smtpd_exp.ref
@@ -49,8 +49,8 @@ OK
>>> client foo 127.0.0.2
OK
>>> rcpt rname@rdomain
-./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org=127.0.0.2; from= to= proto=SMTP helo=
-554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org=127.0.0.2
+./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; from= to= proto=SMTP helo=
+554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org
>>> client foo 127.0.0.1
OK
>>> rcpt rname@rdomain
diff --git a/postfix/src/util/sys_defs.h b/postfix/src/util/sys_defs.h
index 4688f9be0..bbe370f2b 100644
--- a/postfix/src/util/sys_defs.h
+++ b/postfix/src/util/sys_defs.h
@@ -708,7 +708,7 @@ extern int initgroups(const char *, int);
/*
* LINUX.
*/
-#ifdef LINUX2
+#if defined(LINUX2) || defined(LINUX3)
#define SUPPORTED
#include
#define UINT32_TYPE unsigned int