The "encryption_*" attributes (Postfix 2.3 and later) specify information about how the connection is encrypted. With - plaintext connections the protocol and cypher attributes are + plaintext connections the protocol and cipher attributes are empty and the keysize is zero.
diff --git a/postfix/html/smtpd.8.html b/postfix/html/smtpd.8.html index 1ecc28658..4304450d9 100644 --- a/postfix/html/smtpd.8.html +++ b/postfix/html/smtpd.8.html @@ -20,11 +20,15 @@ SMTPD(8) SMTPD(8) queue file. For this mode of operation, the program expects to be run from the master(8) process manager. - Alternatively, the SMTP server takes an established con- - nection on standard input and deposits messages directly - into the maildrop queue. In this so-called stand-alone - mode, the SMTP server can accept mail even while the mail - system is not running. + Alternatively, the SMTP server be can run in stand-alone + mode; this is traditionally obtained with "sendmail -bs". + When the SMTP server runs stand-alone with non $mail_owner + privileges, it receives mail even while the mail system is + not running, deposits messages directly into the maildrop + queue, and disables the SMTP server's access policies. As + of Postfix version 2.3, the SMTP server refuses to receive + mail from the network when it runs with non $mail_owner + privileges. The SMTP server implements a variety of policies for con- nection requests, and for parameters given to HELO, ETRN, @@ -232,7 +236,7 @@ SMTPD(8) SMTPD(8) Report the SASL authenticated user name in the smtpd(8) Received message header. - smtpd_sasl_path (smtpd) + smtpd_sasl_path (smtpd) Implementation-specific information that is passed through to the SASL plug-in implementation that is selected with smtpd_sasl_type. diff --git a/postfix/man/man8/smtpd.8 b/postfix/man/man8/smtpd.8 index 9b030aa9c..2a8762e81 100644 --- a/postfix/man/man8/smtpd.8 +++ b/postfix/man/man8/smtpd.8 @@ -19,11 +19,15 @@ daemon, and is placed into the \fBincoming\fR queue as one single queue file. For this mode of operation, the program expects to be run from the \fBmaster\fR(8) process manager. -Alternatively, the SMTP server takes an established -connection on standard input and deposits messages directly -into the \fBmaildrop\fR queue. In this so-called stand-alone -mode, the SMTP server can accept mail even while the mail -system is not running. +Alternatively, the SMTP server be can run in stand-alone +mode; this is traditionally obtained with "\fBsendmail +-bs\fR". When the SMTP server runs stand-alone with non +$\fBmail_owner\fR privileges, it receives mail even while +the mail system is not running, deposits messages directly +into the \fBmaildrop\fR queue, and disables the SMTP server's +access policies. As of Postfix version 2.3, the SMTP server +refuses to receive mail from the network when it runs with +non $\fBmail_owner\fR privileges. The SMTP server implements a variety of policies for connection requests, and for parameters given to \fBHELO, ETRN, MAIL FROM, VRFY\fR diff --git a/postfix/proto/SMTPD_POLICY_README.html b/postfix/proto/SMTPD_POLICY_README.html index 24e8cd8cc..8e8a70836 100644 --- a/postfix/proto/SMTPD_POLICY_README.html +++ b/postfix/proto/SMTPD_POLICY_README.html @@ -152,7 +152,7 @@ encryption_keysize=256The "encryption_*" attributes (Postfix 2.3 and later) specify information about how the connection is encrypted. With - plaintext connections the protocol and cypher attributes are + plaintext connections the protocol and cipher attributes are empty and the keysize is zero.
diff --git a/postfix/src/global/mail_proto.h b/postfix/src/global/mail_proto.h index 2612900dc..2ffcc128a 100644 --- a/postfix/src/global/mail_proto.h +++ b/postfix/src/global/mail_proto.h @@ -135,7 +135,7 @@ extern char *mail_pathname(const char *, const char *); #define MAIL_ATTR_CCERT_ISSSUER "ccert_issuer" #define MAIL_ATTR_CCERT_FINGERPRINT "ccert_fingerprint" #define MAIL_ATTR_CRYPTO_PROTOCOL "encryption_protocol" -#define MAIL_ATTR_CRYPTO_CYPHER "encryption_cipher" +#define MAIL_ATTR_CRYPTO_CIPHER "encryption_cipher" #define MAIL_ATTR_CRYPTO_KEYSIZE "encryption_keysize" /* diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index b2924d7be..70e7badf7 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20051220" +#define MAIL_RELEASE_DATE "20051221" #define MAIL_VERSION_NUMBER "2.3" #ifdef SNAPSHOT diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c index f0c37f90d..9457a1505 100644 --- a/postfix/src/smtpd/smtpd.c +++ b/postfix/src/smtpd/smtpd.c @@ -13,11 +13,15 @@ /* single queue file. For this mode of operation, the program /* expects to be run from the \fBmaster\fR(8) process manager. /* -/* Alternatively, the SMTP server takes an established -/* connection on standard input and deposits messages directly -/* into the \fBmaildrop\fR queue. In this so-called stand-alone -/* mode, the SMTP server can accept mail even while the mail -/* system is not running. +/* Alternatively, the SMTP server be can run in stand-alone +/* mode; this is traditionally obtained with "\fBsendmail +/* -bs\fR". When the SMTP server runs stand-alone with non +/* $\fBmail_owner\fR privileges, it receives mail even while +/* the mail system is not running, deposits messages directly +/* into the \fBmaildrop\fR queue, and disables the SMTP server's +/* access policies. As of Postfix version 2.3, the SMTP server +/* refuses to receive mail from the network when it runs with +/* non $\fBmail_owner\fR privileges. /* /* The SMTP server implements a variety of policies for connection /* requests, and for parameters given to \fBHELO, ETRN, MAIL FROM, VRFY\fR diff --git a/postfix/src/smtpd/smtpd_check.c b/postfix/src/smtpd/smtpd_check.c index 5c4b07a19..ec1f60385 100644 --- a/postfix/src/smtpd/smtpd_check.c +++ b/postfix/src/smtpd/smtpd_check.c @@ -3304,7 +3304,7 @@ static int check_policy_service(SMTPD_STATE *state, const char *server, #define IF_ENCRYPTED(x) ((state->tls_context && ((x) != 0)) ? (x) : "") ATTR_TYPE_STR, MAIL_ATTR_CRYPTO_PROTOCOL, IF_ENCRYPTED(state->tls_context->protocol), - ATTR_TYPE_STR, MAIL_ATTR_CRYPTO_CYPHER, + ATTR_TYPE_STR, MAIL_ATTR_CRYPTO_CIPHER, IF_ENCRYPTED(state->tls_context->cipher_name), ATTR_TYPE_NUM, MAIL_ATTR_CRYPTO_KEYSIZE, state->tls_context->cipher_usebits, diff --git a/postfix/src/util/inet_addr_local.c b/postfix/src/util/inet_addr_local.c index 617c3820b..249d150a9 100644 --- a/postfix/src/util/inet_addr_local.c +++ b/postfix/src/util/inet_addr_local.c @@ -488,7 +488,8 @@ static int ial_procnet_ifinet6(INET_ADDR_LIST *addr_list, inet_addr_list_append(addr_list, SOCK_ADDR_PTR(&addr)); memset((char *) &mask.sin6_addr, ~0, sizeof(mask.sin6_addr)); - mask_addr((char *) &mask.sin6_addr, sizeof(mask.sin6_addr), plen); + mask_addr((unsigned char *) &mask.sin6_addr, + sizeof(mask.sin6_addr), plen); inet_addr_list_append(mask_list, SOCK_ADDR_PTR(&mask)); } vstring_free(addrbuf); diff --git a/postfix/src/xsasl/README b/postfix/src/xsasl/README index 6755b6709..7962ded1b 100644 --- a/postfix/src/xsasl/README +++ b/postfix/src/xsasl/README @@ -90,7 +90,7 @@ To add your own SASL implementation, say, FOOBAR: - Create the Postfix makefiles from the top-level directory: % make makefiles CCARGS='-DUSE_SASL_AUTH -DUSE_FOOBAR_SASL \ - -DDEF_CLIENT_SASL_TYPE=\"foobar\" -DDEF_SERVER_TYPE=\"foobar\" \ + -DDEF_CLIENT_SASL_TYPE=\"foobar\" -DDEF_SERVER_SASL_TYPE=\"foobar\" \ -I/some/where/include' AUXLIBS='-L/some/where/lib -lfoobar' Yes, you can have different default SASL implementation types for diff --git a/postfix/src/xsasl/xsasl_cyrus_server.c b/postfix/src/xsasl/xsasl_cyrus_server.c index 40147e48b..f9ecbe1b6 100644 --- a/postfix/src/xsasl/xsasl_cyrus_server.c +++ b/postfix/src/xsasl/xsasl_cyrus_server.c @@ -462,6 +462,8 @@ static int xsasl_cyrus_server_auth_response(int sasl_status, myname, xsasl_cyrus_strerror(sasl_status)); return (XSASL_AUTH_MORE); } else { + if (sasl_status == SASL_NOUSER) /* privacy */ + sasl_status = SASL_BADAUTH; vstring_strcpy(reply, xsasl_cyrus_strerror(sasl_status)); return (XSASL_AUTH_FAIL); }