diff --git a/postfix/HISTORY b/postfix/HISTORY
index 959d9afc9..3234dffae 100644
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -27184,3 +27184,31 @@ Apologies for any names omitted.
This problem was reported first in the context of TLSA
record lookups. Files: util/valid_hostname.[hc],
dns/dns_lookup.c.
+
+20230929
+
+ Bugfix (defect introduced Postfix 2.5, 20080104): the Postfix
+ SMTP server was waiting for a client command instead of
+ replying immediately, after a client certificate verification
+ error in TLS wrappermode. Reported by Andreas Kinzler. File:
+ smtpd/smtpd.c.
+
+20231006
+
+ Usability: the Postfix SMTP server now attempts to log the
+ SASL username after authentication failure. In Postfix
+ logging, this appends ", sasl_username=xxx" after the reason
+ for SASL authentication failure. The logging replaces an
+ unavailable reason with "(reason unavailable)", and replaces
+ an unavailable sasl_username with "(unavailable)". Based
+ on code by Jozsef Kadlecsik. Files: xsasl/xsasl_server.c,
+ xsasl/xsasl_cyrus_server.c, smtpd/smtpd_sasl_glue.c.
+
+20231026
+
+ Bugfix (defect introduced: Postfix 2.11): in forward_path,
+ the expression ${recipient_delimiter} would expand to an
+ empty string when a recipient address had no recipient
+ delimiter. Fixed by restoring Postfix 2.10 behavior to use
+ a configured recipient delimiter value. Reported by Tod
+ A. Sandman. Files: proto/postconf.proto, local/local_expand.c.
diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html
index f94385236..62f451be0 100644
--- a/postfix/html/postconf.5.html
+++ b/postfix/html/postconf.5.html
@@ -3761,7 +3761,10 @@ filtered with the character set that is specified with the
$recipient_delimiter
The address extension delimiter that was found in the recipient
-address (Postfix 2.11 and later), or the system-wide recipient
+address (Postfix 2.11 and later), or the 'first' delimiter specified
+with the system-wide recipient address extension delimiter (Postfix
+3.5.22, 3.5.12, 3.7.8, 3.8.3 and later). Historically, this was
+always the system-wide recipient
address extension delimiter (Postfix 2.10 and earlier).
${name?value}
diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5
index 0c9e3ef53..039d2fb65 100644
--- a/postfix/man/man5/postconf.5
+++ b/postfix/man/man5/postconf.5
@@ -2388,7 +2388,10 @@ The entire recipient localpart.
.br
.IP "\fB$recipient_delimiter\fR"
The address extension delimiter that was found in the recipient
-address (Postfix 2.11 and later), or the system\-wide recipient
+address (Postfix 2.11 and later), or the 'first' delimiter specified
+with the system\-wide recipient address extension delimiter (Postfix
+3.5.22, 3.5.12, 3.7.8, 3.8.3 and later). Historically, this was
+always the system\-wide recipient
address extension delimiter (Postfix 2.10 and earlier).
.br
.IP "\fB${name?value}\fR"
diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto
index 0112c70d2..ef6c420fb 100644
--- a/postfix/proto/postconf.proto
+++ b/postfix/proto/postconf.proto
@@ -1764,7 +1764,10 @@ forward_expansion_filter parameter.
$recipient_delimiter
The address extension delimiter that was found in the recipient
-address (Postfix 2.11 and later), or the system-wide recipient
+address (Postfix 2.11 and later), or the 'first' delimiter specified
+with the system-wide recipient address extension delimiter (Postfix
+3.5.22, 3.5.12, 3.7.8, 3.8.3 and later). Historically, this was
+always the system-wide recipient
address extension delimiter (Postfix 2.10 and earlier).
${name?value}
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 5045613f1..03c5b3b4e 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
-#define MAIL_RELEASE_DATE "20230901"
-#define MAIL_VERSION_NUMBER "3.8.2"
+#define MAIL_RELEASE_DATE "20231101"
+#define MAIL_VERSION_NUMBER "3.8.3"
#ifdef SNAPSHOT
#define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE
diff --git a/postfix/src/local/local_expand.c b/postfix/src/local/local_expand.c
index af2de45e1..ff9c3d6ff 100644
--- a/postfix/src/local/local_expand.c
+++ b/postfix/src/local/local_expand.c
@@ -138,6 +138,8 @@ static const char *local_expand_lookup(const char *name, int mode, void *ptr)
} else if (STREQ(name, "recipient_delimiter")) {
rcpt_delim[0] =
local->state->msg_attr.local[strlen(local->state->msg_attr.user)];
+ if (rcpt_delim[0] == 0)
+ rcpt_delim[0] = var_rcpt_delim[0];
rcpt_delim[1] = 0;
return (rcpt_delim[0] ? rcpt_delim : 0);
#if 0
diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c
index 16e4d10e3..9f1cc2cef 100644
--- a/postfix/src/smtpd/smtpd.c
+++ b/postfix/src/smtpd/smtpd.c
@@ -5198,15 +5198,16 @@ static void smtpd_start_tls(SMTPD_STATE *state)
if (requirecert && TLS_CERT_IS_TRUSTED(state->tls_context) == 0) {
/*
- * Fetch and reject the next command (should be EHLO), then
- * disconnect (side-effect of returning "421 ...".
+ * In non-wrappermode, fetch the next command (should be EHLO). Reply
+ * with 421, then disconnect (as a side-effect of replying with 421).
*/
cert_present = TLS_CERT_IS_PRESENT(state->tls_context);
msg_info("NOQUEUE: abort: TLS from %s: %s",
state->namaddr, cert_present ?
"Client certificate not trusted" :
"No client certificate presented");
- smtpd_chat_query(state);
+ if (var_smtpd_tls_wrappermode == 0)
+ smtpd_chat_query(state);
smtpd_chat_reply(state, "421 4.7.1 %s Error: %s",
var_myhostname, cert_present ?
"Client certificate not trusted" :
diff --git a/postfix/src/smtpd/smtpd_sasl_glue.c b/postfix/src/smtpd/smtpd_sasl_glue.c
index 2c5271916..2dc6aad31 100644
--- a/postfix/src/smtpd/smtpd_sasl_glue.c
+++ b/postfix/src/smtpd/smtpd_sasl_glue.c
@@ -340,9 +340,11 @@ int smtpd_sasl_authenticate(SMTPD_STATE *state,
}
}
if (status != XSASL_AUTH_DONE) {
- msg_warn("%s: SASL %s authentication failed: %s",
- state->namaddr, sasl_method,
- STR(state->sasl_reply));
+ sasl_username = xsasl_server_get_username(state->sasl_server);
+ msg_warn("%s: SASL %.100s authentication failed: %s, sasl_username=%.100s",
+ state->namaddr, sasl_method, *STR(state->sasl_reply) ?
+ STR(state->sasl_reply) : "(reason unavailable)",
+ sasl_username ? sasl_username : "(unavailable)");
/* RFC 4954 Section 6. */
if (status == XSASL_AUTH_TEMP)
smtpd_chat_reply(state, "454 4.7.0 Temporary authentication failure: %s",
diff --git a/postfix/src/xsasl/xsasl_cyrus_server.c b/postfix/src/xsasl/xsasl_cyrus_server.c
index 89e1fc9a0..4bf2ed212 100644
--- a/postfix/src/xsasl/xsasl_cyrus_server.c
+++ b/postfix/src/xsasl/xsasl_cyrus_server.c
@@ -625,16 +625,15 @@ static const char *xsasl_cyrus_server_get_username(XSASL_SERVER *xp)
/*
* XXX Do not free(serverout).
*/
- sasl_status = sasl_getprop(server->sasl_conn, SASL_USERNAME, &serverout);
- if (sasl_status != SASL_OK || serverout == 0) {
- msg_warn("%s: sasl_getprop SASL_USERNAME botch: %s",
- myname, xsasl_cyrus_strerror(sasl_status));
- return (0);
- }
if (server->username)
myfree(server->username);
- server->username = mystrdup(serverout);
- printable(server->username, '?');
+ sasl_status = sasl_getprop(server->sasl_conn, SASL_USERNAME, &serverout);
+ if (sasl_status != SASL_OK || serverout == 0) {
+ server->username = 0;
+ } else {
+ server->username = mystrdup(serverout);
+ printable(server->username, '?');
+ }
return (server->username);
}