diff --git a/postfix/HISTORY b/postfix/HISTORY index 867090235..3da460d7d 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -26207,7 +26207,7 @@ Apologies for any names omitted. Cleanup: unit tests. File: cleanup/cleanup_milter.c. - Cleamup: disable hash-table seed in unit tests. Many + Cleanup: disable hash-table seed in unit tests. Many Makefiles, some unit test 'reference' files. Bugfix (documented but not implemented since Postfix 2.2): @@ -26234,7 +26234,7 @@ Apologies for any names omitted. mantools/check-spell-install-proto-text. Cleanup: for consistent parameter naming (tlsproxy_client_xxx - correspnds to smtp_tls_xxx), renamed tlsproxy_client_level + corresponds to smtp_tls_xxx), renamed tlsproxy_client_level to tlsproxy_client_security_level, and tlsproxy_client_policy to tlsproxy_client_policy_maps, with backwards-compatible defaults and updated documentation. Problem reported by @@ -26258,7 +26258,7 @@ Apologies for any names omitted. 20220128 - Clenaup: standardize on FNV hash, after having verified + Cleanup: standardize on FNV hash, after having verified that collisions will change with the hash seed value, and that the collision rate is low. Files: util/htable.c, util/hash_fnv.[hc]. @@ -26399,9 +26399,99 @@ Apologies for any names omitted. 20220421 Bugfix (introduced: Postfix 3.7): reverted an overly complex - change in the postscreen SMTP engine from 20211023, that - was segfaulting on malformed input, where the Postfix 3.6 - implementation worked properly. The purpose of the change - was to prevent complaints about "malformed UTF8" from Postfix - lookup tables. Replaced the change with a trivial guard. - File: postscreen/postscreen_smtpd.c. + change in the postscreen SMTP engine from 20211023, and + replaced it with a much simpler change. The bad change was + segfaulting on some systems after receiving malformed input + (for example, TLS "hello"). File: postscreen/postscreen_smtpd.c. + + Under conditions described below, the postscreen program + attempted to read through an uninitialized 'const' pointer. + The pointer value depended on the compiler type and compiler + options, but crucially, it did not depend on network inputs. + + The conditions were that SMTPUTF8 support was enabled (the + default), and that postscreen received non-UTF8 input, for + example, a TLS or RDP handshake request. + + Depending on compiler details, the result of the read + operation could be uninteresting, a combined memory leak + and file handle leak, or a segmentation violation (signal + 11). + + The segmentation violation result was reported by Michael + Grimm who used a FreeBSD 13.1 early version. The result was + "uninteresting" with FreeBSD 13.0. Both FreeBSD systems use + Clang instead of GCC. The result was also "uninteresting" + on Linux-based systems that use GCC, or on a few older + systems that use GCC. + +20220427 + + Cleanup: incorrect error message after postscreen received + a STARTTLS command with too many arguments. File: + postscreen/postscreen_smtpd.c. + +20220429 + + Noise: shut up a useless warning. File: cleanup_map1n.c. + + Documentation: IPv6 support, by Pau Amma. Files: proto/INSTALL, + proto/IPV6_README.html. + +20220501 + + Cleanup: merged the infrastructure that "knows" which tables + are created with "postmap" or "postalias", with infrastructure + that has other information about lookup tables. The old design + pre-dated dynamically-loaded table drivers, and was difficult + to maintain. + + The following files were moved from the "global" directory to + the "util" directory: src/util/mkmap.h, src/util/mkmap_cdb.c, + src/util/mkmap_db.c, src/util/mkmap_dbm.c, src/util/mkmap_fail.c, + src/util/mkmap_lmdb.c, src/util/mkmap_open.c, + src/util/mkmap_sdbm.c. + + The corresponding postfix-xxx.so shared objects are now created + by util/Makefile instead of global/Makefile. There is no change + in how these files are installed or deployed. + + Other files affected by this change: src/util/dict_open.c, + src/global/dynamicmaps.c, src/global/mail_version.h, + src/global/header_body_checks.h, src/global/maps.c, + src/global/dict_proxy.h, src/util/dict.c, src/util/dict_dbm.h, + src/util/dict_fail.h, src/util/dict_db.h, src/util/dict_lmdb.h, + src/util/dict_cdb.h, src/util/dict_sdbm.h, src/util/dict.h, + src/global/mail_dict.c, src/postalias/postalias.c, + src/postmap/postmap.c. + + Portability: variable declaration after code. File: + global/compat_level.c. + +20220504 + + Documentation: dymap_init() description. File: + global/dynamicmaps.c. + +20220506 + + Added an argv_uniq() function to deduplicate same-value + adjacent array elements. Added a ton of tests to validate + the argv implementation. File: util/argv.c. + + Cleanup: the dict_mapnames() function (used in "postconf + -m") now deduplicates dictionary type names. File: + util/dict_open.c. + +20220507 + + Documentation: inverted the paragraph about "known" addresses, + in the descriptions of smtpd_reject_unlisted_sender and + smtpd_reject_unlisted_recipient. File: proto/postconf.proto. + + Documentation: added the HISTORY file to the pre-release-checks. + Files: mantools/check-double-history, mantools/check-spell-history, + proto/stop.double-history, proto/stop.spell-history. + + Documentation: added POSTLOG_SERVICE and POSTLOG_HOSTNAME + to the import_environment description. File: proto/postconf.proto. diff --git a/postfix/INSTALL b/postfix/INSTALL index 4ab046d40..17a8cf744 100644 --- a/postfix/INSTALL +++ b/postfix/INSTALL @@ -567,7 +567,7 @@ The following is an extensive list of names and values. || |Do not build with IPv6 support. By default, | || |IPv6 support is compiled in on platforms that| || |are known to have IPv6 support. Note: this | -||-DNO_IPV6 |directive is for debugging And testing only. | +||-DNO_IPV6 |directive is for debugging and testing only. | || |It is not guaranteed to work on all | || |platforms. If you don't want IPv6 support, | || |set "inet_protocols = ipv4" in main.cf. | diff --git a/postfix/Makefile.in b/postfix/Makefile.in index aa6c7ad9c..5bc7a7cb1 100644 --- a/postfix/Makefile.in +++ b/postfix/Makefile.in @@ -116,7 +116,8 @@ manpages: # Some checks require a bin/postconf executable. pre-release-checks: typo-check missing-proxy-read-maps-check \ - postlink-check postfix-files-check + postlink-check postfix-files-check check-spell-history \ + check-double-history postfix-files-check: mantools/check-postfix-files | diff /dev/null - @@ -148,6 +149,12 @@ double-install-proto-text: double-proto-html: mantools/check-double-proto-html | diff /dev/null - +check-spell-history: + mantools/check-spell-history | diff /dev/null - + +check-double-history: + mantools/check-double-history | diff /dev/null - + # The build-time shlib_directory setting must take precedence over # the installed main.cf settings, otherwise we can't update an # installed system from dynamicmaps=yes<->dynamicmaps=no or from diff --git a/postfix/README_FILES/INSTALL b/postfix/README_FILES/INSTALL index e9d4f0695..e97c95c2d 100644 --- a/postfix/README_FILES/INSTALL +++ b/postfix/README_FILES/INSTALL @@ -567,7 +567,7 @@ The following is an extensive list of names and values. || |Do not build with IPv6 support. By default, | || |IPv6 support is compiled in on platforms that| || |are known to have IPv6 support. Note: this | -||-DNO_IPV6 |directive is for debugging And testing only. | +||-DNO_IPV6 |directive is for debugging and testing only. | || |It is not guaranteed to work on all | || |platforms. If you don't want IPv6 support, | || |set "inet_protocols = ipv4" in main.cf. | diff --git a/postfix/README_FILES/IPV6_README b/postfix/README_FILES/IPV6_README index a29560c47..188003be8 100644 --- a/postfix/README_FILES/IPV6_README +++ b/postfix/README_FILES/IPV6_README @@ -43,7 +43,8 @@ Postfix version 2.2 supports IPv4 and IPv6 on the following platforms: On other platforms Postfix will simply use IPv4 as it has always done. -See below for tips how to port Postfix IPv6 support to other environments. +See "IPv6 Support for unsupported platforms" for tips to port Postfix IPv6 +support to other environments. CCoonnffiigguurraattiioonn @@ -83,6 +84,9 @@ configuration work with Postfix. Note 2: on older Linux and Solaris systems, the setting "inet_protocols = ipv6" will not prevent Postfix from accepting IPv4 connections. + For an unsupported test option to build Postfix without IPv6 support, see + the NO_IPV6 option in the INSTALL document. + * The other new parameter is smtp_bind_address6. This sets the local interface address for outgoing IPv6 SMTP connections, just like the smtp_bind_address parameter does for IPv4: diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 84541eda0..d49dbde13 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -24,3 +24,11 @@ historical IBM Public License 1.0, it is now also distributed with the more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. + +Incompatible changes with snapshot 20220507 +=========================================== + +Most global/mkmap*.[hc] files have moved to the util directory; +only global/mkmap_proxy.* remains. The old file organization was +designed before support for dynamically-loadable databases was +added, and the code suffered from complexity. diff --git a/postfix/WISHLIST b/postfix/WISHLIST index 4dccddda9..d0c3589c4 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -9,13 +9,18 @@ Wish list: Scan Postfix code with github.com/googleprojectzero/weggli (depends on "rust"). + Enforce var_line_limit in util/attr_scan*c. + Can tests use LD_PRELOAD to inject fake modules such as fake_dns(3), fake_msg(3), fake_myaddrinfo(3) and so on? One limitation is that functions etc. in a preloaded object always take precedence, even in code that is not being tested. - '%l' support. ef7c661c-d86a-2366-6a73-ec8d51d75012@dev.snart.me + '%l' support, similar to %D in the Dovecot LDAP driver. + Subject: Feature request: '%l' expansion for ldap_table, + Date: Tue, 5 Apr 2022. Message-ID: + WARN_IF_REJECT like prefix that disables the error counter increment. diff --git a/postfix/html/INSTALL.html b/postfix/html/INSTALL.html index 2070e3467..acf7b5572 100644 --- a/postfix/html/INSTALL.html +++ b/postfix/html/INSTALL.html @@ -837,7 +837,7 @@ unreachable code. -DNO_IPV6 Do not build with IPv6 support. By default, IPv6 support is compiled in on platforms that are known to have IPv6 support. Note: this directive is for debugging -And testing only. It is not guaranteed to work on all platforms. +and testing only. It is not guaranteed to work on all platforms. If you don't want IPv6 support, set "inet_protocols = ipv4" in main.cf. diff --git a/postfix/html/IPV6_README.html b/postfix/html/IPV6_README.html index acf24b901..0b6b79359 100644 --- a/postfix/html/IPV6_README.html +++ b/postfix/html/IPV6_README.html @@ -78,8 +78,8 @@ platforms:

On other platforms Postfix will simply use IPv4 as it has always done.

-

See below for tips how to port Postfix -IPv6 support to other environments.

+

See "IPv6 Support for unsupported platforms" +for tips to port Postfix IPv6 support to other environments.

Configuration

@@ -128,6 +128,9 @@ on a software distribution with IPv6 support, "ipv4" otherwise.

"inet_protocols = ipv6" will not prevent Postfix from accepting IPv4 connections.

+

For an unsupported test option to build Postfix without IPv6 +support, see the NO_IPV6 option in the INSTALL document.

+

  • The other new parameter is smtp_bind_address6. This sets the local interface address for outgoing IPv6 SMTP connections, just like the smtp_bind_address parameter diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 837a5d38a..acfea50b1 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -4047,6 +4047,16 @@ environment. Examples of relevant environment variables:

    Needed to make "postfix -c" work.
    +
    POSTLOG_SERVICE
    + +
    Needed to make "maillog_file" work during daemon +process initialization.
    + +
    POSTLOG_HOSTNAME
    + +
    Needed to make "maillog_file" work during daemon +process initialization.
    +

    Specify a list of names and/or name=value pairs, separated by @@ -16602,8 +16612,9 @@ access restriction is specified. This prevents the Postfix queue from filling up with undeliverable MAILER-DAEMON messages.

    -

    An address is always considered "known" when it matches a -virtual(5) alias or a canonical(5) mapping. +

    An address is considered "unknown" when it does not match a +virtual(5) alias or a canonical(5) mapping, and one of the following +conditions holds: