)/.PP\n\1/ if ($wantpp);
$block =~ s/ */\n/g;
$block =~ s/ *<\/p>/\n/g;
- $block =~ s/
/\n.nf\n.na\n.ft C\n/g;
- $block =~ s/<\/pre>/\n.fi\n.ad\n.ft R\n/g;
+ $block =~ s//\n.nf\n.na\n/g;
+ $block =~ s/<\/pre>/\n.fi\n.ad\n/g;
$block =~ s/]*>/\n/g;
$block =~ s//\n/g;
#$block =~ s/<\/dl>/\n.PP\n/g;
diff --git a/postfix/proto/mysql_table b/postfix/proto/mysql_table
index e68e0aea8..4274ed4ea 100644
--- a/postfix/proto/mysql_table
+++ b/postfix/proto/mysql_table
@@ -267,6 +267,12 @@
# "not found".
# .sp
# This parameter is available with Postfix 3.2 and later.
+# TLS-RELATED SETTINGS
+# .ad
+# .fi
+# See https://dev.mysql.com/doc/c-api/en/mysql-options.html
+# or https://mariadb.com/kb/en/mysql_optionsv/ for details of
+# the underlying MYSQL_OPT_SSL_* features.
# .IP "\fBtls_cert_file\fR"
# File containing client's X509 certificate.
# .sp
@@ -276,7 +282,7 @@
# .sp
# This parameter is available with Postfix 2.11 and later.
# .IP "\fBtls_CAfile\fR"
-# File containing certificates for all of the X509 Certification
+# File containing X509 certificates for all of the Certification
# Authorities the client will recognize. Takes precedence over
# \fBtls_CApath\fR.
# .sp
diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto
index 36aab443e..34ea749d7 100644
--- a/postfix/proto/postconf.proto
+++ b/postfix/proto/postconf.proto
@@ -1194,7 +1194,8 @@ by an RFC 3463 enhanced status code.
- $rbl_domain
-- The RBL domain where $rbl_what is denylisted.
+- The RBL domain (without any =address-filter) where
+$rbl_what is denylisted.
- $rbl_reason
@@ -3588,7 +3589,10 @@ The default time unit is s (seconds).
Optional lookup tables with RBL or RHSBL response templates. The
table search key is the reject_rbl_* or reject_rhsbl_* argument,
-including any optional "=address-pattern" filter.
+including any optional "=address-filter". With Postfix 3.10
+and later, if the result is "not found" and the search key has the
+form domain=address-filter, then rbl_reply_maps will also
+search with the domain.
By default, Postfix uses the
template as specified with the default_rbl_reply configuration
@@ -3612,20 +3616,26 @@ syntax.
# variables.
secret.zen.dq.spamhaus.net=127.0.0.[2..11]
554 $rbl_class $rbl_what blocked using ZEN - see https://www.spamhaus.org/query/ip/$client_address for details
+
+
+
+ # Postfix ≥ 3.10: if a search key domain=address-filter
+ # is not found, then rbl_reply_maps will also search with the
+ # domain.
secret.zen.dq.spamhaus.net
554 $rbl_class $rbl_what blocked using ZEN - see https://www.spamhaus.org/query/ip/$client_address for details
NOTE: This feature differs from postscreen_dnsbl_reply_map where
-the table search key is a domain name (no "=address" filter,
-no "*weight" factor) and where the lookup result should be
-a domain name (no free text, no $name variables).
+the table search key is only a domain name (no "=address-filter",
+no "*weight" factor) and where the lookup result
+should be only a domain name (no free text, no $name variables).
This feature is available in Postfix 2.0 and later.
-The "=address-pattern" filter is available in Postfix 2.8 and later.
+The "=address-filter" feature is available in Postfix 2.8 and later.
%PARAM receive_override_options
@@ -15451,7 +15461,7 @@ the file is read).
NOTE: This feature differs from the Postfix SMTP server's
rbl_reply_maps feature, where 1) the table search key includes the
-optional "=address" filter, and where 2) the lookup result
+optional "=address-filter", and where 2) the lookup result
contains free text with $name variables.
This feature is available in Postfix 2.8.
diff --git a/postfix/proto/stop b/postfix/proto/stop
index fb1da4859..88bf64609 100644
--- a/postfix/proto/stop
+++ b/postfix/proto/stop
@@ -1606,3 +1606,7 @@ GTEST
javascript
SMFI
RHSBL
+Ajamian
+groff
+MariaDB
+Fuhrer
diff --git a/postfix/proto/stop.spell-cc b/postfix/proto/stop.spell-cc
index a554e48b3..1314e0c0e 100644
--- a/postfix/proto/stop.spell-cc
+++ b/postfix/proto/stop.spell-cc
@@ -1840,3 +1840,4 @@ fhHoqvx
foqvx
ILP
xxfi
+optionsv
diff --git a/postfix/src/global/dict_mysql.c b/postfix/src/global/dict_mysql.c
index 133cc0d44..7d113d299 100644
--- a/postfix/src/global/dict_mysql.c
+++ b/postfix/src/global/dict_mysql.c
@@ -119,6 +119,15 @@
#define DICT_MYSQL_SSL_VERIFY_SERVER_CERT MYSQL_OPT_SSL_VERIFY_SERVER_CERT
#elif MYSQL_VERSION_ID >= 80000
#define DICT_MYSQL_SSL_VERIFY_SERVER_CERT MYSQL_OPT_SSL_MODE
+#endif
+
+ /*
+ * MariaDB Connector/C 3.0.0 lists mysql_options() as deprecated and
+ * recommends using mysql_optionsv() instead. Option names and semantics
+ * have not changed.
+ */
+#if defined(MARIADB_PACKAGE_VERSION_ID) && MARIADB_PACKAGE_VERSION_ID >= 30000
+#define mysql_options mysql_optionsv
#endif
/* need some structs to help organize things */
@@ -598,12 +607,27 @@ static void plmysql_connect_single(DICT_MYSQL *dict_mysql, HOST *host)
mysql_options(host->db, MYSQL_READ_DEFAULT_FILE, dict_mysql->option_file);
if (dict_mysql->option_group && dict_mysql->option_group[0])
mysql_options(host->db, MYSQL_READ_DEFAULT_GROUP, dict_mysql->option_group);
+#if MYSQL_VERSION_ID >= 80035
+ /* Preferred API. */
+ if (dict_mysql->tls_key_file)
+ mysql_options(host->db, MYSQL_OPT_SSL_KEY, dict_mysql->tls_key_file);
+ if (dict_mysql->tls_cert_file)
+ mysql_options(host->db, MYSQL_OPT_SSL_CERT, dict_mysql->tls_cert_file);
+ if (dict_mysql->tls_CAfile)
+ mysql_options(host->db, MYSQL_OPT_SSL_CA, dict_mysql->tls_CAfile);
+ if (dict_mysql->tls_CApath)
+ mysql_options(host->db, MYSQL_OPT_SSL_CAPATH, dict_mysql->tls_CApath);
+ if (dict_mysql->tls_ciphers)
+ mysql_options(host->db, MYSQL_OPT_SSL_CIPHER, dict_mysql->tls_ciphers);
+#else
+ /* Deprecated API. */
if (dict_mysql->tls_key_file || dict_mysql->tls_cert_file ||
dict_mysql->tls_CAfile || dict_mysql->tls_CApath || dict_mysql->tls_ciphers)
mysql_ssl_set(host->db,
dict_mysql->tls_key_file, dict_mysql->tls_cert_file,
dict_mysql->tls_CAfile, dict_mysql->tls_CApath,
dict_mysql->tls_ciphers);
+#endif
#if defined(DICT_MYSQL_SSL_VERIFY_SERVER_CERT)
if (dict_mysql->tls_verify_cert != -1)
mysql_options(host->db, DICT_MYSQL_SSL_VERIFY_SERVER_CERT,
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index d23ed6640..69627fd39 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
-#define MAIL_RELEASE_DATE "20240622"
+#define MAIL_RELEASE_DATE "20240722"
#define MAIL_VERSION_NUMBER "3.10"
#ifdef SNAPSHOT
diff --git a/postfix/src/smtpd/smtpd_check.c b/postfix/src/smtpd/smtpd_check.c
index 6aeda7475..607c6be7c 100644
--- a/postfix/src/smtpd/smtpd_check.c
+++ b/postfix/src/smtpd/smtpd_check.c
@@ -3570,15 +3570,21 @@ static int rbl_reject_reply(SMTPD_STATE *state, const SMTPD_RBL_STATE *rbl,
/*
* Use the server-specific reply template or use the default one.
*/
+ rbl_exp.domain = mystrdup(rbl_domain);
+ (void) split_at(rbl_exp.domain, '=');
if (*var_rbl_reply_maps) {
template = maps_find(rbl_reply_maps, rbl_domain, DICT_FLAG_NONE);
- if (rbl_reply_maps->error)
+ if (template == 0 && rbl_reply_maps->error == 0
+ && strcmp(rbl_domain, rbl_exp.domain) != 0)
+ template = maps_find(rbl_reply_maps, rbl_exp.domain,
+ DICT_FLAG_NONE);
+ if (template == 0 && rbl_reply_maps->error != 0) {
+ myfree(rbl_exp.domain);
reject_server_error(state);
+ }
}
why = vstring_alloc(100);
rbl_exp.state = state;
- rbl_exp.domain = mystrdup(rbl_domain);
- (void) split_at(rbl_exp.domain, '=');
rbl_exp.what = what;
rbl_exp.class = reply_class;
rbl_exp.txt = (rbl->txt == 0 ? "" : rbl->txt);
diff --git a/postfix/src/smtpd/smtpd_check_access b/postfix/src/smtpd/smtpd_check_access
index 788276adf..232e67d79 100644
--- a/postfix/src/smtpd/smtpd_check_access
+++ b/postfix/src/smtpd/smtpd_check_access
@@ -41,6 +41,10 @@ blackholes.mail-abuse.org $rbl_code client=$client
rbl_code=$rbl_code rbl_domain=$rbl_domain rbl_txt=$rbl_txt rbl_what=$rbl_what
rbl_class=$rbl_class
+dnsbltest.porcupine.org=127.0.0.3 $rbl_code service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain=127.0.0.3 ${rbl_reason?; $rbl_reason}
+
+dnsbltest.porcupine.org $rbl_code SERVICE UNAVAILABLE; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason}
+
rhsbl.porcupine.org $rbl_code client=$client
client_address=$client_address
client_name=$client_name helo_name=$helo_name
diff --git a/postfix/src/smtpd/smtpd_check_backup.ref b/postfix/src/smtpd/smtpd_check_backup.ref
index c15be35f3..4beafd3e2 100644
--- a/postfix/src/smtpd/smtpd_check_backup.ref
+++ b/postfix/src/smtpd/smtpd_check_backup.ref
@@ -17,7 +17,7 @@ OK
>>> recipient_restrictions permit_mx_backup,reject
OK
>>> rcpt wietse@wzv.porcupine.org
-./smtpd_check: warning: support for restriction "permit_mx_backup" will be removed from Postfix; instead, use "relay_domains"
+./smtpd_check: warning: support for restriction "permit_mx_backup" will be removed from Postfix; instead, specify "relay_domains"
OK
>>> rcpt wietse@backup.porcupine.org
OK
diff --git a/postfix/src/smtpd/smtpd_deprecated.ref b/postfix/src/smtpd/smtpd_deprecated.ref
index d64f1b3d5..2832460f7 100644
--- a/postfix/src/smtpd/smtpd_deprecated.ref
+++ b/postfix/src/smtpd/smtpd_deprecated.ref
@@ -10,7 +10,7 @@ OK
>>> mail sname@sdomain.example
OK
>>> rcpt rname@rdomain.example
-./smtpd_check: warning: restriction permit_naked_ip_address has been removed in Postfix 3.9; use permit_mynetworks or permit_sasl_authenticated instead
+./smtpd_check: warning: support for restriction "permit_naked_ip_address" has been removed in Postfix 3.9; instead, specify "permit_mynetworks" or "permit_sasl_authenticated"
./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 451 4.3.5 Server configuration error; from= to= proto=SMTP helo=<127.0.0.2>
451 4.3.5 Server configuration error
>>> #
@@ -27,7 +27,7 @@ OK
>>> mail sname@sdomain.example
OK
>>> rcpt rname@rdomain.example
-./smtpd_check: warning: support for restriction "check_relay_domains" has been removed in Postfix 3.9; use "reject_unauth_destination" instead
+./smtpd_check: warning: support for restriction "check_relay_domains" has been removed in Postfix 3.9; instead, specify "reject_unauth_destination"
./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 451 4.3.5 Server configuration error; from= to= proto=SMTP helo=<127.0.0.2>
451 4.3.5 Server configuration error
>>> #
diff --git a/postfix/src/smtpd/smtpd_exp.in b/postfix/src/smtpd/smtpd_exp.in
index 8370404b4..4ddf45b87 100644
--- a/postfix/src/smtpd/smtpd_exp.in
+++ b/postfix/src/smtpd/smtpd_exp.in
@@ -29,6 +29,9 @@ client foo 127.0.0.2
rcpt rname@rdomain
client foo 127.0.0.1
rcpt rname@rdomain
+recipient_restrictions reject_rbl_client,dnsbltest.porcupine.org=127.0.0.3
+client foo 127.0.0.3
+rcpt rname@rdomain
#
# RHSBL sender domain name
#
@@ -60,3 +63,15 @@ recipient_restrictions reject_rhsbl_helo,rhsbl.porcupine.org
helo example.tld
mail sname@sdomain
rcpt rname@rdomain
+#
+# rbl_reply_maps lookup error
+#
+smtpd_delay_reject 0
+mynetworks 127.0.0.0/8,168.100.3.0/28
+relay_domains porcupine.org
+rbl_reply_maps fail:1_rbl_reply_maps
+helo foobar
+mail sname@sdomain
+recipient_restrictions reject_rbl_client,dnsbltest.porcupine.org
+client foo 127.0.0.2
+rcpt rname@rdomain
diff --git a/postfix/src/smtpd/smtpd_exp.ref b/postfix/src/smtpd/smtpd_exp.ref
index 00848a538..38d9daf9a 100644
--- a/postfix/src/smtpd/smtpd_exp.ref
+++ b/postfix/src/smtpd/smtpd_exp.ref
@@ -25,13 +25,13 @@ OK
>>> client spike.porcupine.org 168.100.3.2
OK
>>> rcpt rname@rdomain
-./smtpd_check: warning: support for restriction "reject_maps_rbl" has been removed in Postfix 3.9; use "reject_rbl_client domain-name" instead
+./smtpd_check: warning: support for restriction "reject_maps_rbl" has been removed in Postfix 3.9; instead, specify "reject_rbl_client domain-name"
./smtpd_check: : reject: RCPT from spike.porcupine.org[168.100.3.2]: 451 4.3.5 Server configuration error; from= to= proto=SMTP helo=
451 4.3.5 Server configuration error
>>> client foo 127.0.0.2
OK
>>> rcpt rname@rdomain
-./smtpd_check: warning: support for restriction "reject_maps_rbl" has been removed in Postfix 3.9; use "reject_rbl_client domain-name" instead
+./smtpd_check: warning: support for restriction "reject_maps_rbl" has been removed in Postfix 3.9; instead, specify "reject_rbl_client domain-name"
./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 451 4.3.5 Server configuration error; from= to= proto=SMTP helo=
451 4.3.5 Server configuration error
>>> #
@@ -44,19 +44,26 @@ OK
>>> client foo 127.0.0.2
OK
>>> rcpt rname@rdomain
-./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; DNS blocklist test; from= to= proto=SMTP helo=
-554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; DNS blocklist test
+./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 554 5.7.1 SERVICE UNAVAILABLE; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; DNS blocklist test; from= to= proto=SMTP helo=
+554 5.7.1 SERVICE UNAVAILABLE; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; DNS blocklist test
>>> recipient_restrictions reject_rbl_client,dnsbltest.porcupine.org=127.0.0.2
OK
>>> client foo 127.0.0.2
OK
>>> rcpt rname@rdomain
-./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; DNS blocklist test; from= to= proto=SMTP helo=
-554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; DNS blocklist test
+./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 554 5.7.1 SERVICE UNAVAILABLE; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; DNS blocklist test; from= to= proto=SMTP helo=
+554 5.7.1 SERVICE UNAVAILABLE; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; DNS blocklist test
>>> client foo 127.0.0.1
OK
>>> rcpt rname@rdomain
OK
+>>> recipient_restrictions reject_rbl_client,dnsbltest.porcupine.org=127.0.0.3
+OK
+>>> client foo 127.0.0.3
+OK
+>>> rcpt rname@rdomain
+./smtpd_check: : reject: RCPT from foo[127.0.0.3]: 554 5.7.1 service unavailable; Client host [127.0.0.3] blocked using dnsbltest.porcupine.org=127.0.0.3 ; DNS blocklist test; from= to= proto=SMTP helo=
+554 5.7.1 service unavailable; Client host [127.0.0.3] blocked using dnsbltest.porcupine.org=127.0.0.3 ; DNS blocklist test
>>> #
>>> # RHSBL sender domain name
>>> #
@@ -111,3 +118,26 @@ OK
>>> rcpt rname@rdomain
./smtpd_check: : reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 client=spike.porcupine.org[168.100.3.2] client_address=168.100.3.2 client_name=spike.porcupine.org helo_name=example.tld sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=example.tld rbl_class=Helo command; from= to= proto=SMTP helo=
554 5.7.1 client=spike.porcupine.org[168.100.3.2] client_address=168.100.3.2 client_name=spike.porcupine.org helo_name=example.tld sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=example.tld rbl_class=Helo command
+>>> #
+>>> # rbl_reply_maps lookup error
+>>> #
+>>> smtpd_delay_reject 0
+OK
+>>> mynetworks 127.0.0.0/8,168.100.3.0/28
+OK
+>>> relay_domains porcupine.org
+OK
+>>> rbl_reply_maps fail:1_rbl_reply_maps
+OK
+>>> helo foobar
+OK
+>>> mail sname@sdomain
+OK
+>>> recipient_restrictions reject_rbl_client,dnsbltest.porcupine.org
+OK
+>>> client foo 127.0.0.2
+OK
+>>> rcpt rname@rdomain
+./smtpd_check: warning: fail:1_rbl_reply_maps lookup error for "dnsbltest.porcupine.org"
+./smtpd_check: : reject: RCPT from foo[127.0.0.2]: 451 4.3.5 Server configuration error; from= to= proto=SMTP helo=
+451 4.3.5 Server configuration error