Logged with compatibility_level < 3.11:
+ + + ++
If such a message is logged in the context of a legitimate request, the system administrator should make the backwards-compatible setting permanent in main.cf or master.cf, as detailed in the @@ -120,7 +131,8 @@ to "no". This could result in unexpected non-delivery of email after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises.
-As long as the append_dot_mydomain parameter is left at +
As long as the append_dot_mydomain parameter is left unspecified +at its implicit default value, and the compatibility_level setting is less than 1, Postfix may log one of the following messages:
@@ -178,7 +190,7 @@ after updating Postfix from an older version. The backwards-compatibility safety net is designed allow the administrator to choose if they want to keep the old behavior. -As long as a master.cf chroot field is left at its +
As long as a master.cf chroot field is left unspecified at its implicit default value, and the compatibility_level setting is less than 1, Postfix may log the following message while it reads the master.cf file:
@@ -218,7 +230,8 @@ from an older Postfix version. The backwards-compatibility safety net is designed to prevent such surprises.When the compatibility_level less than 1, and the -smtpd_relay_restrictions parameter is left at its implicit default +smtpd_relay_restrictions parameter is left unspecified at its +implicit default setting, Postfix may log the following message:
@@ -250,7 +263,8 @@ addresses from clients that don't request SMTPUTF8 support, after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises. -keep evaluating smtpd_recipient_restrictions before smtpd_relay_restrictions, as long as the compatibility_level is less than 3.6, and the smtpd_relay_before_recipient_restrictions -parameter is left at its implicit default setting. As a reminder, +parameter is left unspecified at its implicit default setting. As +a reminder, Postfix may log the following message:As long as the smtputf8_enable parameter is left at its implicit +
As long as the smtputf8_enable parameter is left unspecified +at its implicit default value, and the compatibility_level setting is less than 1, Postfix logs a warning each time an SMTP command uses a non-ASCII address localpart without requesting SMTPUTF8 support:
@@ -293,7 +307,8 @@ Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises.As long as the mynetworks and mynetworks_style parameters are -left at their implicit default values, and the compatibility_level +left unspecified at their implicit default values, and the +compatibility_level setting is less than 2, the Postfix SMTP server may log one of the following messages:
@@ -333,7 +348,8 @@ denied' errors or ETRN errors after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises. -As long as the relay_domains parameter is left at its implicit +
As long as the relay_domains parameter is left unspecified at +its implicit default value, and the compatibility_level setting is less than 2, Postfix may log one of the following messages.
@@ -408,7 +424,8 @@ secure digest of the client certificate. with the "sha256" digests of the expected client certificate or public key. -As long as the smtpd_tls_fingerprint_digest parameter is left at its +
As long as the smtpd_tls_fingerprint_digest parameter is left +unspecified at its implicit default value, and the compatibility_level setting is less than 3.6, Postfix logs a warning each time a client certificate or public key fingerprint is (potentially) used for access control:
@@ -455,7 +472,8 @@ policies in the TLS policy table to specify matching "sha256" digests of the expected server certificates or public keys.As long as the smtp_tls_fingerprint_digest (or LMTP equivalent) -parameter is left at its implicit default value, and the +parameter is left unspecified at its implicit default value, and +the compatibility_level setting is less than 3.6, Postfix logs a warning each time the "fingerprint" security level is used to specify matching "md5" digests of trusted server certificates or public keys:
@@ -499,7 +517,8 @@ command, and both support the same features.
@@ -533,7 +552,8 @@ the changes in logging could affect logfile analysis tools.+To avoid breaking existing logfile analysis tools, Postfix will keep logging the deprecated form, as long as the respectful_logging parameter -is left at its implicit default value, and the compatibility_level +is left unspecified at its implicit default value, and the +compatibility_level setting is less than 3.6. As a reminder, Postfix may log the following when a remote SMTP client is allowlisted or denylisted:
@@ -555,6 +575,38 @@ system administrator should make the backwards-compatible setting
Postfix version 3.11 changes the default value for +smtp_tlsrpt_skip_reused_handshakes from "yes" to "no". The +backwards-compatibility safety net is designed to prevent an +unexpected change in reporting behavior when Postfix is updated +from an older version.
+ +As long as the smtp_tlsrpt_skip_reused_handshakes parameter is +left unspecified at its implicit default value, and the compatibility_level +setting is less than 3.11, Postfix will log a reminder that it is +using the backwards-compatible default:
+ +++ ++postfix/smtp[388157] using backwards-compatible default setting + smtp_tlsrpt_skip_reused_handshakes=yes ++
To keep the old default setting, the system administrator should +make the backwards-compatible setting "smtp_tlsrpt_skip_reused_handshakes += yes" permanent in main.cf: + +
+++# postconf smtp_tlsrpt_skip_reused_handshakes=yes +# postfix reload ++
Backwards compatibility is turned off by updating the
diff --git a/postfix/html/SMTPUTF8_README.html b/postfix/html/SMTPUTF8_README.html
index 10f22e4e6..cb42d06a0 100644
--- a/postfix/html/SMTPUTF8_README.html
+++ b/postfix/html/SMTPUTF8_README.html
@@ -375,7 +375,7 @@ Firefox and Chrome web browsers. Specify "
This affects the conversion of domain names that contain for
-example the German sz (ß) and the Greek zeta (ς). See
+example the German sz (ß) and the Greek (final) sigma (ς). See
https://unicode.org/cldr/utility/idna.jsp for more examples. By default, Postfix does not report the TLSRPT status for
-a TLS handshake that reuses a previously-negotiated TLS session
-(there would be no new information to report). Specify
-"smtp_tlsrpt_skip_reused_handshakes = no" to report the TLSRPT
-status for all TLS handshakes. This may be useful for troubleshooting.
- With TLSRPT enabled, the Postfix SMTP client reports the
+TLSRPT status for all TLS handshakes (the default as of Postfix
+3.11). Specify "smtp_tlsrpt_skip_reused_handshakes = yes" (the
+default with Postfix 3.10) to skip reporting TLS handshakes that
+reuse a previously-negotiated TLS session as there would be no new
+information to report. Postfix logging for certificate verification failures may
differ between new or reused TLS sessions. Credits
diff --git a/postfix/html/TLSRPT_README.html b/postfix/html/TLSRPT_README.html
index 6d3746e4c..3a361d712 100644
--- a/postfix/html/TLSRPT_README.html
+++ b/postfix/html/TLSRPT_README.html
@@ -286,12 +286,12 @@ Untrusted TLS connection reused to mail.example.com[ipaddr]:25:
TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
-
Postfix supports MTA-STS though an smtp_tls_policy_maps policy +
Postfix supports MTA-STS through an smtp_tls_policy_maps policy plugin, which replies with a TLS security level and name=value attributes with certificate matching requirements. Postfix 3.10 and later extend the policy plugin response with additional name=value diff --git a/postfix/html/lmdb_table.5.html b/postfix/html/lmdb_table.5.html index 60624494e..ac0221335 100644 --- a/postfix/html/lmdb_table.5.html +++ b/postfix/html/lmdb_table.5.html @@ -56,24 +56,25 @@ LMDB_TABLE(5) LMDB_TABLE(5) SYNCHRONIZATION The Postfix LMDB adapter does not use LMDB's built-in locking scheme, - because that would require world-writable lockfiles and would violate - the Postfix security model. Instead, Postfix uses fcntl(2) locks with - whole-file granularity. Programs that use LMDB's built-in locking pro- - tocol will corrupt a Postfix LMDB database or will read garbage. + because that would require world-writable lockfiles and therefore vio- + late the Postfix security model. Instead, Postfix uses fcntl(2) locks + with whole-file granularity. Programs that use LMDB's built-in locking + protocol will corrupt a Postfix LMDB database or will read garbage. Every Postfix LMDB database read or write transaction must be protected - from start to end with a shared or exclusive fcntl(2) lock. A writer - may atomically downgrade an exclusive lock to a shared lock, but it - must hold an exclusive lock while opening another write transaction. + from start to end with a shared or exclusive fcntl(2) lock. A process + may atomically downgrade an exclusive lock to a shared lock before + opening a database read transaction, but it must hold an exclusive lock + while opening a write transaction. - Note that fcntl(2) locks do not protect transactions within the same - process against each other. If a program cannot avoid making simulta- - neous database requests, then it must protect its transactions with + Note that fcntl(2) locks do not protect transactions within the same + process against each other. If a program cannot avoid making simulta- + neous database requests, then it must protect its transactions with in-process locks, in addition to the per-process fcntl(2) locks. CONFIGURATION PARAMETERS - Short-lived programs automatically pick up changes to main.cf. With - long-running daemon programs, Use the command "postfix reload" after a + Short-lived programs automatically pick up changes to main.cf. With + long-running daemon programs, Use the command "postfix reload" after a configuration change. lmdb_map_size (16777216) diff --git a/postfix/html/memcache_table.5.html b/postfix/html/memcache_table.5.html index 42796b717..47c9aa396 100644 --- a/postfix/html/memcache_table.5.html +++ b/postfix/html/memcache_table.5.html @@ -99,18 +99,30 @@ MEMCACHE_TABLE(5) MEMCACHE_TABLE(5) time. Smaller values are relative to the time of the update. MEMCACHE KEY PARAMETERS + key_digest (default: empty) + After processing the key_format setting, and before sending a + request to the memcache server, run the key through the named + message digest algorithm and convert the result to lowercase + hexadecimal characters. This prevents a database access error + when keys may exceed the memcache server's key length limit + (usually, 250 bytes). Specify the name of a message digest algo- + rithm that is supported by OpenSSL, for example, sha256. + + This feature is available in Postfix 3.11 and later, and + requires that Postfix is built with TLS support. + key_format (default: %s) - Format of the lookup and update keys that the Postfix memcache - client sends to the memcache server. By default, these are the - same as the lookup and update keys that the memcache client + Format of the lookup and update keys that the Postfix memcache + client sends to the memcache server. By default, these are the + same as the lookup and update keys that the memcache client receives from Postfix applications. - NOTE 1: The key_format feature is not used for backup database + NOTE 1: The key_format feature is not used for backup database requests. - NOTE 2: When multiple tables share the same memcache database, - each table should prepend its own unique string to the lookup - key. Otherwise, automatic postscreen(8) or verify(8) cache + NOTE 2: When multiple tables share the same memcache database, + each table should prepend its own unique string to the lookup + key. Otherwise, automatic postscreen(8) or verify(8) cache cleanup may not work. Examples: @@ -126,37 +138,37 @@ MEMCACHE_TABLE(5) MEMCACHE_TABLE(5) %s This is replaced by the memcache client input key. %u When the input key is an address of the form user@domain, - %u is replaced by the SQL quoted local part of the - address. Otherwise, %u is replaced by the entire search - string. If the localpart is empty, a lookup is silently - suppressed and returns no results (an update is skipped + %u is replaced by the SQL quoted local part of the + address. Otherwise, %u is replaced by the entire search + string. If the localpart is empty, a lookup is silently + suppressed and returns no results (an update is skipped with a warning). %d When the input key is an address of the form user@domain, %d is replaced by the domain part of the address. Other- - wise, a lookup is silently suppressed and returns no + wise, a lookup is silently suppressed and returns no results (an update is skipped with a warning). %[SUD] The upper-case equivalents of the above expansions behave - in the key_format parameter identically to their + in the key_format parameter identically to their lower-case counter-parts. - %[1-9] The patterns %1, %2, ... %9 are replaced by the corre- - sponding most significant component of the input key's - domain. If the input key is user@mail.example.com, then + %[1-9] The patterns %1, %2, ... %9 are replaced by the corre- + sponding most significant component of the input key's + domain. If the input key is user@mail.example.com, then %1 is com, %2 is example and %3 is mail. If the input key - is unqualified or does not have enough domain components - to satisfy all the specified patterns, a lookup is - silently suppressed and returns no results (an update is + is unqualified or does not have enough domain components + to satisfy all the specified patterns, a lookup is + silently suppressed and returns no results (an update is skipped with a warning). domain (default: no domain list) - This feature can significantly reduce database server load. - Specify a list of domain names, paths to files, or "type:table" - databases. When specified, only fully qualified search keys - with a *non-empty* localpart and a matching domain are eligible - for lookup or update: bare 'user' lookups, bare domain lookups - and "@domain" lookups are silently skipped (updates are skipped + This feature can significantly reduce database server load. + Specify a list of domain names, paths to files, or "type:table" + databases. When specified, only fully qualified search keys + with a *non-empty* localpart and a matching domain are eligible + for lookup or update: bare 'user' lookups, bare domain lookups + and "@domain" lookups are silently skipped (updates are skipped with a warning). Example: domain = example.com, hash:/etc/postfix/searchdomains @@ -169,30 +181,30 @@ MEMCACHE_TABLE(5) MEMCACHE_TABLE(5) The maximal memcache reply line length in bytes. max_try (default: 2) - The number of times to try a memcache command before giving up. - The memcache client does not retry a command when the memcache + The number of times to try a memcache command before giving up. + The memcache client does not retry a command when the memcache server accepts no connection. retry_pause (default: 1) The time in seconds before retrying a failed memcache command. timeout (default: 2) - The time limit for sending a memcache command and for receiving + The time limit for sending a memcache command and for receiving a memcache reply. BUGS - The Postfix memcache client cannot be used for security-sensitive + The Postfix memcache client cannot be used for security-sensitive tables such as alias_maps (these may contain "|command and "/file/name" - destinations), or virtual_uid_maps, virtual_gid_maps and virtual_mail- - box_maps (these specify UNIX process privileges or "/file/name" desti- - nations). In a typical deployment a memcache database is writable by - any process that can talk to the memcache server; in contrast, secu- - rity-sensitive tables must never be writable by the unprivileged Post- + destinations), or virtual_uid_maps, virtual_gid_maps and virtual_mail- + box_maps (these specify UNIX process privileges for "/file/name" desti- + nations). In a typical deployment a memcache database is writable by + any process that can talk to the memcache server; in contrast, secu- + rity-sensitive tables must never be writable by the unprivileged Post- fix user. The Postfix memcache client requires additional configuration when used - as postscreen(8) or verify(8) cache. For details see the backup and - ttl parameter discussions in the MEMCACHE MAIN PARAMETERS section + as postscreen(8) or verify(8) cache. For details see the backup and + ttl parameter discussions in the MEMCACHE MAIN PARAMETERS section above. SEE ALSO diff --git a/postfix/html/mysql_table.5.html b/postfix/html/mysql_table.5.html index c75906641..8c8e5588e 100644 --- a/postfix/html/mysql_table.5.html +++ b/postfix/html/mysql_table.5.html @@ -61,16 +61,15 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) TCP you have to specify hosts = 127.0.0.1 - NOTE: if the hosts setting specifies one server, this client - assumes that the target is a load balancer and will reconnect - immediately after a single failure, instead of failing all - requests temporarily. With older versions of this client, spec- - ify the same server twice. + NOTE: if the hosts setting specifies only one server, this + client assumes that the target is a load balancer and will + reconnect immediately after a single failure. With Postfix ver- + sions 3.9 and earlier, specify the same server twice. user password - The user name and password to log into the mysql server. Exam- + The user name and password to log into the mysql server. Exam- ple: user = someone password = some_password @@ -79,15 +78,15 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) dbname = customer_database charset (default: utf8mb4) - The default MySQL client character set; this also implies the + The default MySQL client character set; this also implies the collation order. - This parameter is available with Postfix 3.9 and later. With - earlier Postfix versions, the default was chosen by the MySQL + This parameter is available with Postfix 3.9 and later. With + earlier Postfix versions, the default was chosen by the MySQL implementation (utf8mb4 as of MySQL 8.0, latin1 historically). idle_interval (default: 60) - The number of seconds after which an idle database connection + The number of seconds after which an idle database connection will be closed. This feature is available in Postfix 3.9 and later. @@ -96,11 +95,10 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) The number of seconds that a database connection will be skipped after an error. - NOTE: if the hosts setting specifies one server, this client - assumes that the target is a load balancer and will reconnect - immediately after a single failure, instead of failing all - requests temporarily. With older versions of this client, spec- - ify the same server twice. + NOTE: if the hosts setting specifies only one server, this + client assumes that the target is a load balancer and will + reconnect immediately after a single failure. With Postfix ver- + sions 3.9 and earlier, specify the same server twice. This feature is available in Postfix 3.9 and later. diff --git a/postfix/html/pgsql_table.5.html b/postfix/html/pgsql_table.5.html index e44279000..cab95ff89 100644 --- a/postfix/html/pgsql_table.5.html +++ b/postfix/html/pgsql_table.5.html @@ -65,16 +65,15 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) URI, the Postfix PostgreSQL client will ignore the dbname, user, and password settings for that connection. - NOTE: if the hosts setting specifies one server, this client - assumes that the target is a load balancer and will reconnect - immediately after a single failure, instead of failing all - requests temporarily. With older versions of this client, spec- - ify the same server twice. + NOTE: if the hosts setting specifies only one server, this + client assumes that the target is a load balancer and will + reconnect immediately after a single failure. With Postfix ver- + sions 3.9 and earlier, specify the same server twice. user password - The user name and password to log into the pgsql server. Exam- + The user name and password to log into the pgsql server. Exam- ple: user = someone password = some_password @@ -85,25 +84,25 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) dbname The database name on the servers. Example: dbname = customer_database - The dbname setting is ignored for hosts connections that are + The dbname setting is ignored for hosts connections that are specified as an URI. The dbname setting is required with Postfix 3.10 and later, when - hosts specifies any non-URI connection; it is always required + hosts specifies any non-URI connection; it is always required with earlier Postfix versions. encoding - The encoding used by the database client. The default setting + The encoding used by the database client. The default setting is: encoding = UTF8 - Historically, the database client was hard coded to use LATIN1 + Historically, the database client was hard coded to use LATIN1 in an attempt to disable multibyte character support. This feature is available in Postfix 3.8 and later. idle_interval (default: 60) - The number of seconds after which an idle database connection + The number of seconds after which an idle database connection will be closed. This feature is available in Postfix 3.9 and later. @@ -112,11 +111,10 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) The number of seconds that a database connection will be skipped after an error. - NOTE: if the hosts setting specifies one server, this client - assumes that the target is a load balancer and will reconnect - immediately after a single failure, instead of failing all - requests temporarily. With older versions of this client, spec- - ify the same server twice. + NOTE: if the hosts setting specifies only one server, this + client assumes that the target is a load balancer and will + reconnect immediately after a single failure. With Postfix ver- + sions 3.9 and earlier, specify the same server twice. This feature is available in Postfix 3.9 and later. diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 03d029cd0..0d63f28ee 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -20,7 +20,7 @@ if (hash && isChrome) { setTimeout(function() { window.location.hash = ""; window.location.hash = hash; - }, 1000); + }, 1500); } @@ -3349,7 +3349,7 @@ with older Postfix versions).
when converting UTF-8 domain names to/from the ASCII form that is used for DNS lookups. Specify "yes" for compatibility with Postfix ≤ 3.1 (not recommended). This affects the conversion of domain -names that contain for example the German sz and the Greek zeta. +names that contain for example the German sz and the Greek sigma. See https://unicode.org/cldr/utility/idna.jsp for more examples. @@ -14870,13 +14870,11 @@ requirements for MTA-STS smtp_tlsDo not report the TLSRPT status for TLS protocol handshakes -that reuse a previously-negotiated TLS session (there is no new -information to report). Report the TLSRPT status only for "new" TLS -sessions. Set this to "no" to log the TLSRPT status of all TLS -handshakes, for example to troubleshoot Postfix TLSRPT support. +
When set to "yes", report the TLSRPT status only for "new" TLS +sessions. When set to "no", also report the TLSRPT status for TLS +protocol handshakes that reuse a previously-negotiated TLS session.
Note: if an SMTP over TLS connection is reused, there is no diff --git a/postfix/man/man5/lmdb_table.5 b/postfix/man/man5/lmdb_table.5 index c4c74d634..eec44147f 100644 --- a/postfix/man/man5/lmdb_table.5 +++ b/postfix/man/man5/lmdb_table.5 @@ -72,16 +72,17 @@ postscreen(8) services. .fi The Postfix LMDB adapter does not use LMDB's built\-in locking scheme, because that would require world\-writable lockfiles -and would violate the Postfix security model. Instead, +and therefore violate the Postfix security model. Instead, Postfix uses fcntl(2) locks with whole\-file granularity. Programs that use LMDB's built\-in locking protocol will corrupt a Postfix LMDB database or will read garbage. Every Postfix LMDB database read or write transaction must be protected from start to end with a shared or exclusive -fcntl(2) lock. A writer may atomically downgrade an exclusive -lock to a shared lock, but it must hold an exclusive lock -while opening another write transaction. +fcntl(2) lock. A process may atomically downgrade an exclusive +lock to a shared lock before opening a database read transaction, +but it must hold an exclusive lock while opening a write +transaction. Note that fcntl(2) locks do not protect transactions within the same process against each other. If a program cannot diff --git a/postfix/man/man5/memcache_table.5 b/postfix/man/man5/memcache_table.5 index 430f73c51..8d90a3df3 100644 --- a/postfix/man/man5/memcache_table.5 +++ b/postfix/man/man5/memcache_table.5 @@ -112,6 +112,17 @@ time. Smaller values are relative to the time of the update. .nf .ad .fi +.IP "\fBkey_digest (default: empty)\fB" +After processing the \fBkey_format\fR setting, and before sending +a request to the memcache server, run the key through the named +message digest algorithm and convert the result to lowercase +hexadecimal characters. This prevents a database access error +when keys may exceed the memcache server's key length limit +(usually, 250 bytes). Specify the name of a message digest +algorithm that is supported by OpenSSL, for example, \fBsha256\fR. + +This feature is available in Postfix 3.11 and later, and requires +that Postfix is built with TLS support. .IP "\fBkey_format (default: %s)\fB" Format of the lookup and update keys that the Postfix memcache client sends to the memcache server. @@ -207,7 +218,7 @@ tables such as \fBalias_maps\fR (these may contain "\fI|command\fR and "\fI/file/name\fR" destinations), or \fBvirtual_uid_maps\fR, \fBvirtual_gid_maps\fR and \fBvirtual_mailbox_maps\fR (these specify UNIX process -privileges or "\fI/file/name\fR" destinations). In a typical +privileges for "\fI/file/name\fR" destinations). In a typical deployment a memcache database is writable by any process that can talk to the memcache server; in contrast, security\-sensitive tables must never be writable by the diff --git a/postfix/man/man5/mysql_table.5 b/postfix/man/man5/mysql_table.5 index 865f9d07f..3cca85eb2 100644 --- a/postfix/man/man5/mysql_table.5 +++ b/postfix/man/man5/mysql_table.5 @@ -77,11 +77,10 @@ localhost over TCP you have to specify hosts = 127.0.0.1 .fi -NOTE: if the \fBhosts\fR setting specifies one server, this client -assumes that the target is a load balancer and will reconnect -immediately after a single failure, instead of failing all -requests temporarily. With older versions of this client, -specify the same server twice. +NOTE: if the \fBhosts\fR setting specifies only one server, +this client assumes that the target is a load balancer and +will reconnect immediately after a single failure. With Postfix +versions 3.9 and earlier, specify the same server twice. .IP "\fBuser\fR" .IP "\fBpassword\fR" The user name and password to log into the mysql server. @@ -112,11 +111,10 @@ This feature is available in Postfix 3.9 and later. The number of seconds that a database connection will be skipped after an error. -NOTE: if the \fBhosts\fR setting specifies one server, this client -assumes that the target is a load balancer and will reconnect -immediately after a single failure, instead of failing all -requests temporarily. With older versions of this client, -specify the same server twice. +NOTE: if the \fBhosts\fR setting specifies only one server, +this client assumes that the target is a load balancer and +will reconnect immediately after a single failure. With Postfix +versions 3.9 and earlier, specify the same server twice. This feature is available in Postfix 3.9 and later. .IP "\fBquery\fR" diff --git a/postfix/man/man5/pgsql_table.5 b/postfix/man/man5/pgsql_table.5 index 51df7338e..1deaa3fe8 100644 --- a/postfix/man/man5/pgsql_table.5 +++ b/postfix/man/man5/pgsql_table.5 @@ -81,11 +81,10 @@ NOTE: if the \fBhosts\fR setting specifies a PostgreSQL connection URI, the Postfix PostgreSQL client will ignore the \fBdbname\fR, \fBuser\fR, and \fBpassword\fR settings for that connection. -NOTE: if the \fBhosts\fR setting specifies one server, this client -assumes that the target is a load balancer and will reconnect -immediately after a single failure, instead of failing all -requests temporarily. With older versions of this client, -specify the same server twice. +NOTE: if the \fBhosts\fR setting specifies only one server, +this client assumes that the target is a load balancer and +will reconnect immediately after a single failure. With Postfix +versions 3.9 and earlier, specify the same server twice. .IP "\fBuser\fR" .IP "\fBpassword\fR" The user name and password to log into the pgsql server. @@ -129,11 +128,10 @@ This feature is available in Postfix 3.9 and later. The number of seconds that a database connection will be skipped after an error. -NOTE: if the \fBhosts\fR setting specifies one server, this client -assumes that the target is a load balancer and will reconnect -immediately after a single failure, instead of failing all -requests temporarily. With older versions of this client, -specify the same server twice. +NOTE: if the \fBhosts\fR setting specifies only one server, +this client assumes that the target is a load balancer and +will reconnect immediately after a single failure. With Postfix +versions 3.9 and earlier, specify the same server twice. This feature is available in Postfix 3.9 and later. .IP "\fBquery\fR" diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index afb9cc97b..24351183c 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -2079,7 +2079,7 @@ Enable 'transitional' compatibility between IDNA2003 and IDNA2008, when converting UTF\-8 domain names to/from the ASCII form that is used for DNS lookups. Specify "yes" for compatibility with Postfix <= 3.1 (not recommended). This affects the conversion of domain -names that contain for example the German sz and the Greek zeta. +names that contain for example the German sz and the Greek sigma. See https://unicode.org/cldr/utility/idna.jsp for more examples. .PP This feature is available in Postfix 3.2 and later. @@ -9921,12 +9921,10 @@ See TLSRPT_README for configuration examples and additional requirements for MTA\-STS smtp_tls_policy_maps plugins. .PP This feature is available in Postfix >= 3.10. -.SH smtp_tlsrpt_skip_reused_handshakes (default: yes) -Do not report the TLSRPT status for TLS protocol handshakes -that reuse a previously\-negotiated TLS session (there is no new -information to report). Report the TLSRPT status only for "new" TLS -sessions. Set this to "no" to log the TLSRPT status of all TLS -handshakes, for example to troubleshoot Postfix TLSRPT support. +.SH smtp_tlsrpt_skip_reused_handshakes (default: Postfix >= 3.11: no, Postfix 3.10: yes) +When set to "yes", report the TLSRPT status only for "new" TLS +sessions. When set to "no", also report the TLSRPT status for TLS +protocol handshakes that reuse a previously\-negotiated TLS session. .PP Note: if an SMTP over TLS connection is reused, there is no second etc. TLS handshake to report. diff --git a/postfix/proto/COMPATIBILITY_README.html b/postfix/proto/COMPATIBILITY_README.html index 801d0d9a5..d0fd5d902 100644 --- a/postfix/proto/COMPATIBILITY_README.html +++ b/postfix/proto/COMPATIBILITY_README.html @@ -102,6 +102,17 @@ default setting respectful_logging=no
Logged with compatibility_level < 3.11:
+ + + ++
If such a message is logged in the context of a legitimate request, the system administrator should make the backwards-compatible setting permanent in main.cf or master.cf, as detailed in the @@ -120,7 +131,8 @@ to "no". This could result in unexpected non-delivery of email after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises.
-As long as the append_dot_mydomain parameter is left at +
As long as the append_dot_mydomain parameter is left unspecified +at its implicit default value, and the compatibility_level setting is less than 1, Postfix may log one of the following messages:
@@ -178,7 +190,7 @@ after updating Postfix from an older version. The backwards-compatibility safety net is designed allow the administrator to choose if they want to keep the old behavior. -As long as a master.cf chroot field is left at its +
As long as a master.cf chroot field is left unspecified at its implicit default value, and the compatibility_level setting is less than 1, Postfix may log the following message while it reads the master.cf file:
@@ -218,7 +230,8 @@ from an older Postfix version. The backwards-compatibility safety net is designed to prevent such surprises.When the compatibility_level less than 1, and the -smtpd_relay_restrictions parameter is left at its implicit default +smtpd_relay_restrictions parameter is left unspecified at its +implicit default setting, Postfix may log the following message:
@@ -250,7 +263,8 @@ addresses from clients that don't request SMTPUTF8 support, after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises. -keep evaluating smtpd_recipient_restrictions before smtpd_relay_restrictions, as long as the compatibility_level is less than 3.6, and the smtpd_relay_before_recipient_restrictions -parameter is left at its implicit default setting. As a reminder, +parameter is left unspecified at its implicit default setting. As +a reminder, Postfix may log the following message:As long as the smtputf8_enable parameter is left at its implicit +
As long as the smtputf8_enable parameter is left unspecified +at its implicit default value, and the compatibility_level setting is less than 1, Postfix logs a warning each time an SMTP command uses a non-ASCII address localpart without requesting SMTPUTF8 support:
@@ -293,7 +307,8 @@ Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises.As long as the mynetworks and mynetworks_style parameters are -left at their implicit default values, and the compatibility_level +left unspecified at their implicit default values, and the +compatibility_level setting is less than 2, the Postfix SMTP server may log one of the following messages:
@@ -333,7 +348,8 @@ denied' errors or ETRN errors after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises. -As long as the relay_domains parameter is left at its implicit +
As long as the relay_domains parameter is left unspecified at +its implicit default value, and the compatibility_level setting is less than 2, Postfix may log one of the following messages.
@@ -408,7 +424,8 @@ secure digest of the client certificate. with the "sha256" digests of the expected client certificate or public key. -As long as the smtpd_tls_fingerprint_digest parameter is left at its +
As long as the smtpd_tls_fingerprint_digest parameter is left +unspecified at its implicit default value, and the compatibility_level setting is less than 3.6, Postfix logs a warning each time a client certificate or public key fingerprint is (potentially) used for access control:
@@ -455,7 +472,8 @@ policies in the TLS policy table to specify matching "sha256" digests of the expected server certificates or public keys.As long as the smtp_tls_fingerprint_digest (or LMTP equivalent) -parameter is left at its implicit default value, and the +parameter is left unspecified at its implicit default value, and +the compatibility_level setting is less than 3.6, Postfix logs a warning each time the "fingerprint" security level is used to specify matching "md5" digests of trusted server certificates or public keys:
@@ -499,7 +517,8 @@ command, and both support the same features.
@@ -533,7 +552,8 @@ the changes in logging could affect logfile analysis tools.+To avoid breaking existing logfile analysis tools, Postfix will keep logging the deprecated form, as long as the respectful_logging parameter -is left at its implicit default value, and the compatibility_level +is left unspecified at its implicit default value, and the +compatibility_level setting is less than 3.6. As a reminder, Postfix may log the following when a remote SMTP client is allowlisted or denylisted:
@@ -555,6 +575,38 @@ system administrator should make the backwards-compatible setting
Postfix version 3.11 changes the default value for +smtp_tlsrpt_skip_reused_handshakes from "yes" to "no". The +backwards-compatibility safety net is designed to prevent an +unexpected change in reporting behavior when Postfix is updated +from an older version.
+ +As long as the smtp_tlsrpt_skip_reused_handshakes parameter is +left unspecified at its implicit default value, and the compatibility_level +setting is less than 3.11, Postfix will log a reminder that it is +using the backwards-compatible default:
+ +++ ++postfix/smtp[388157] using backwards-compatible default setting + smtp_tlsrpt_skip_reused_handshakes=yes ++
To keep the old default setting, the system administrator should +make the backwards-compatible setting "smtp_tlsrpt_skip_reused_handshakes += yes" permanent in main.cf: + +
+++# postconf smtp_tlsrpt_skip_reused_handshakes=yes +# postfix reload ++
Backwards compatibility is turned off by updating the diff --git a/postfix/proto/SMTPUTF8_README.html b/postfix/proto/SMTPUTF8_README.html index 5948f85fc..e2713c41b 100644 --- a/postfix/proto/SMTPUTF8_README.html +++ b/postfix/proto/SMTPUTF8_README.html @@ -375,7 +375,7 @@ Firefox and Chrome web browsers. Specify "enable_idna2003_compatibility = yes" to get the historical behavior.
This affects the conversion of domain names that contain for -example the German sz (ß) and the Greek zeta (ς). See +example the German sz (ß) and the Greek (final) sigma (ς). See https://unicode.org/cldr/utility/idna.jsp for more examples.
By default, Postfix does not report the TLSRPT status for -a TLS handshake that reuses a previously-negotiated TLS session -(there would be no new information to report). Specify -"smtp_tlsrpt_skip_reused_handshakes = no" to report the TLSRPT -status for all TLS handshakes. This may be useful for troubleshooting. -
+With TLSRPT enabled, the Postfix SMTP client reports the +TLSRPT status for all TLS handshakes (the default as of Postfix +3.11). Specify "smtp_tlsrpt_skip_reused_handshakes = yes" (the +default with Postfix 3.10) to skip reporting TLS handshakes that +reuse a previously-negotiated TLS session as there would be no new +information to report.
Postfix logging for certificate verification failures may differ between new or reused TLS sessions.
@@ -373,7 +373,7 @@ generator's sender address):Postfix supports MTA-STS though an smtp_tls_policy_maps policy +
Postfix supports MTA-STS through an smtp_tls_policy_maps policy plugin, which replies with a TLS security level and name=value attributes with certificate matching requirements. Postfix 3.10 and later extend the policy plugin response with additional name=value diff --git a/postfix/proto/lmdb_table b/postfix/proto/lmdb_table index 5bbbc14d3..ad81a4622 100644 --- a/postfix/proto/lmdb_table +++ b/postfix/proto/lmdb_table @@ -60,16 +60,17 @@ # .fi # The Postfix LMDB adapter does not use LMDB's built-in locking # scheme, because that would require world-writable lockfiles -# and would violate the Postfix security model. Instead, +# and therefore violate the Postfix security model. Instead, # Postfix uses fcntl(2) locks with whole-file granularity. # Programs that use LMDB's built-in locking protocol will # corrupt a Postfix LMDB database or will read garbage. # # Every Postfix LMDB database read or write transaction must # be protected from start to end with a shared or exclusive -# fcntl(2) lock. A writer may atomically downgrade an exclusive -# lock to a shared lock, but it must hold an exclusive lock -# while opening another write transaction. +# fcntl(2) lock. A process may atomically downgrade an exclusive +# lock to a shared lock before opening a database read transaction, +# but it must hold an exclusive lock while opening a write +# transaction. # # Note that fcntl(2) locks do not protect transactions within # the same process against each other. If a program cannot diff --git a/postfix/proto/memcache_table b/postfix/proto/memcache_table index c97a9b449..6d4240394 100644 --- a/postfix/proto/memcache_table +++ b/postfix/proto/memcache_table @@ -102,6 +102,17 @@ # MEMCACHE KEY PARAMETERS # .ad # .fi +# .IP "\fBkey_digest (default: empty)\fB" +# After processing the \fBkey_format\fR setting, and before sending +# a request to the memcache server, run the key through the named +# message digest algorithm and convert the result to lowercase +# hexadecimal characters. This prevents a database access error +# when keys may exceed the memcache server's key length limit +# (usually, 250 bytes). Specify the name of a message digest +# algorithm that is supported by OpenSSL, for example, \fBsha256\fR. +# +# This feature is available in Postfix 3.11 and later, and requires +# that Postfix is built with TLS support. # .IP "\fBkey_format (default: %s)\fB" # Format of the lookup and update keys that the Postfix # memcache client sends to the memcache server. @@ -193,7 +204,7 @@ # "\fI|command\fR and "\fI/file/name\fR" destinations), or # \fBvirtual_uid_maps\fR, \fBvirtual_gid_maps\fR and # \fBvirtual_mailbox_maps\fR (these specify UNIX process -# privileges or "\fI/file/name\fR" destinations). In a typical +# privileges for "\fI/file/name\fR" destinations). In a typical # deployment a memcache database is writable by any process # that can talk to the memcache server; in contrast, # security-sensitive tables must never be writable by the diff --git a/postfix/proto/mysql_table b/postfix/proto/mysql_table index fc1c238c8..d93d405a8 100644 --- a/postfix/proto/mysql_table +++ b/postfix/proto/mysql_table @@ -67,11 +67,10 @@ # hosts = 127.0.0.1 # .fi # -# NOTE: if the \fBhosts\fR setting specifies one server, this client -# assumes that the target is a load balancer and will reconnect -# immediately after a single failure, instead of failing all -# requests temporarily. With older versions of this client, -# specify the same server twice. +# NOTE: if the \fBhosts\fR setting specifies only one server, +# this client assumes that the target is a load balancer and +# will reconnect immediately after a single failure. With Postfix +# versions 3.9 and earlier, specify the same server twice. # .IP "\fBuser\fR" # .IP "\fBpassword\fR" # The user name and password to log into the mysql server. @@ -102,11 +101,10 @@ # The number of seconds that a database connection will be # skipped after an error. # -# NOTE: if the \fBhosts\fR setting specifies one server, this client -# assumes that the target is a load balancer and will reconnect -# immediately after a single failure, instead of failing all -# requests temporarily. With older versions of this client, -# specify the same server twice. +# NOTE: if the \fBhosts\fR setting specifies only one server, +# this client assumes that the target is a load balancer and +# will reconnect immediately after a single failure. With Postfix +# versions 3.9 and earlier, specify the same server twice. # # This feature is available in Postfix 3.9 and later. # .IP "\fBquery\fR" diff --git a/postfix/proto/pgsql_table b/postfix/proto/pgsql_table index cba9e45f4..edc50b619 100644 --- a/postfix/proto/pgsql_table +++ b/postfix/proto/pgsql_table @@ -71,11 +71,10 @@ # URI, the Postfix PostgreSQL client will ignore the \fBdbname\fR, # \fBuser\fR, and \fBpassword\fR settings for that connection. # -# NOTE: if the \fBhosts\fR setting specifies one server, this client -# assumes that the target is a load balancer and will reconnect -# immediately after a single failure, instead of failing all -# requests temporarily. With older versions of this client, -# specify the same server twice. +# NOTE: if the \fBhosts\fR setting specifies only one server, +# this client assumes that the target is a load balancer and +# will reconnect immediately after a single failure. With Postfix +# versions 3.9 and earlier, specify the same server twice. # .IP "\fBuser\fR" # .IP "\fBpassword\fR" # The user name and password to log into the pgsql server. @@ -119,11 +118,10 @@ # The number of seconds that a database connection will be # skipped after an error. # -# NOTE: if the \fBhosts\fR setting specifies one server, this client -# assumes that the target is a load balancer and will reconnect -# immediately after a single failure, instead of failing all -# requests temporarily. With older versions of this client, -# specify the same server twice. +# NOTE: if the \fBhosts\fR setting specifies only one server, +# this client assumes that the target is a load balancer and +# will reconnect immediately after a single failure. With Postfix +# versions 3.9 and earlier, specify the same server twice. # # This feature is available in Postfix 3.9 and later. # .IP "\fBquery\fR" diff --git a/postfix/proto/postconf.html.prolog b/postfix/proto/postconf.html.prolog index cb91af190..73cfb1607 100644 --- a/postfix/proto/postconf.html.prolog +++ b/postfix/proto/postconf.html.prolog @@ -20,7 +20,7 @@ if (hash && isChrome) { setTimeout(function() { window.location.hash = ""; window.location.hash = hash; - }, 1000); + }, 1500); } diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index 4aef0b2d3..b1130e134 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -17765,7 +17765,7 @@ Milter support should be disabled.
when converting UTF-8 domain names to/from the ASCII form that is used for DNS lookups. Specify "yes" for compatibility with Postfix ≤ 3.1 (not recommended). This affects the conversion of domain -names that contain for example the German sz and the Greek zeta. +names that contain for example the German sz and the Greek sigma. See https://unicode.org/cldr/utility/idna.jsp for more examples. @@ -19521,13 +19521,11 @@ requirements for MTA-STS smtp_tls_policy_maps plugins.This feature is available in Postfix ≥ 3.10.
-%PARAM smtp_tlsrpt_skip_reused_handshakes yes +%PARAM smtp_tlsrpt_skip_reused_handshakes Postfix ≥ 3.11: no, Postfix 3.10: yes -Do not report the TLSRPT status for TLS protocol handshakes -that reuse a previously-negotiated TLS session (there is no new -information to report). Report the TLSRPT status only for "new" TLS -sessions. Set this to "no" to log the TLSRPT status of all TLS -handshakes, for example to troubleshoot Postfix TLSRPT support. +
When set to "yes", report the TLSRPT status only for "new" TLS +sessions. When set to "no", also report the TLSRPT status for TLS +protocol handshakes that reuse a previously-negotiated TLS session.
Note: if an SMTP over TLS connection is reused, there is no
diff --git a/postfix/proto/stop b/postfix/proto/stop
index 7c06d7ee4..ef6aab0a2 100644
--- a/postfix/proto/stop
+++ b/postfix/proto/stop
@@ -1674,3 +1674,11 @@ MLKEM
cleartext
redacted
subclassed
+nosleep
+preload
+memcached
+Geert
+Hendrickx
+typofix
+LD
+PRELOAD
diff --git a/postfix/proto/stop.double-cc b/postfix/proto/stop.double-cc
index e80d33312..0179fe90f 100644
--- a/postfix/proto/stop.double-cc
+++ b/postfix/proto/stop.double-cc
@@ -343,3 +343,4 @@ additional_info additional_info
ignored ignored
USE_TLSRPT USE_TLSRPT
encoded encoded text can contain only alpha digit
+ossl_digest_new ossl_digest_new returns NULL after error ossl_digest_data
diff --git a/postfix/proto/stop.double-history b/postfix/proto/stop.double-history
index 62e45e6b2..782732fda 100644
--- a/postfix/proto/stop.double-history
+++ b/postfix/proto/stop.double-history
@@ -166,3 +166,8 @@ proto proto socketmap_table
global mail_params h smtpd smtpd c
global mail_params h proto postconf proto smtp smtp c
proto postconf proto proto TLS_README html
+ the command line Files postmap postmap c postalias postalias c
+ verification in progress File verify verify c
++ address failed File verify verify c
+ address failed File verify verify c
+ address failed due to a database error File verify verify c
diff --git a/postfix/proto/stop.spell-cc b/postfix/proto/stop.spell-cc
index 3fa8e9528..506c2d2c8 100644
--- a/postfix/proto/stop.spell-cc
+++ b/postfix/proto/stop.spell-cc
@@ -1860,3 +1860,7 @@ XXXSENDOPTS
xtra
HAPROXY
SRVR
+DGST
+DIGEST
+OSSL
+ossl
diff --git a/postfix/src/global/Makefile.in b/postfix/src/global/Makefile.in
index 8a2e26ca0..dfc28b631 100644
--- a/postfix/src/global/Makefile.in
+++ b/postfix/src/global/Makefile.in
@@ -1223,10 +1223,12 @@ dict_memcache.o: ../../include/argv.h
dict_memcache.o: ../../include/auto_clnt.h
dict_memcache.o: ../../include/check_arg.h
dict_memcache.o: ../../include/dict.h
+dict_memcache.o: ../../include/hex_code.h
dict_memcache.o: ../../include/match_list.h
dict_memcache.o: ../../include/msg.h
dict_memcache.o: ../../include/myflock.h
dict_memcache.o: ../../include/mymalloc.h
+dict_memcache.o: ../../include/ossl_digest.h
dict_memcache.o: ../../include/stringops.h
dict_memcache.o: ../../include/sys_defs.h
dict_memcache.o: ../../include/vbuf.h
diff --git a/postfix/src/global/dict_memcache.c b/postfix/src/global/dict_memcache.c
index f249f68e9..09c5cb658 100644
--- a/postfix/src/global/dict_memcache.c
+++ b/postfix/src/global/dict_memcache.c
@@ -50,9 +50,11 @@
/* Utility library. */
+#include