From bd2811a2ed50cf78a21393c570ea29f74e4cc1f9 Mon Sep 17 00:00:00 2001 From: Wietse Venema Date: Wed, 7 Jul 2010 00:00:00 -0500 Subject: [PATCH] postfix-2.8-20100707 --- postfix/HISTORY | 15 ++++++++---- postfix/README_FILES/LDAP_README | 37 +++++++++++++++------------- postfix/README_FILES/QSHAPE_README | 7 ++++++ postfix/RELEASE_NOTES | 8 +++--- postfix/WISHLIST | 6 +++++ postfix/conf/postfix-files | 2 ++ postfix/html/LDAP_README.html | 39 ++++++++++++++++-------------- postfix/html/QSHAPE_README.html | 7 ++++++ postfix/html/SQLITE_README.html | 2 +- postfix/html/postconf.5.html | 9 +++++-- postfix/html/sqlite_table.5.html | 8 +++--- postfix/man/man5/postconf.5 | 9 +++++-- postfix/mantools/postlink | 2 +- postfix/proto/LDAP_README.html | 39 ++++++++++++++++-------------- postfix/proto/QSHAPE_README.html | 7 ++++++ postfix/proto/postconf.proto | 9 +++++-- postfix/src/global/mail_version.h | 2 +- postfix/src/oqmgr/qmgr_message.c | 3 +++ postfix/src/qmgr/qmgr_message.c | 3 +++ postfix/src/tls/tls_misc.c | 1 + 20 files changed, 140 insertions(+), 75 deletions(-) diff --git a/postfix/HISTORY b/postfix/HISTORY index 747e4440a..ae9005eb4 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -15823,11 +15823,12 @@ Apologies for any names omitted. 20100610 - Bugfix: Postfix no longer appends the system default CAs - to the lists specified with *_tls_CAfile or with *_tls_CApath. - This prevents third-party certificates from being trusted - and given mail relay permission with permit_tls_all_clientcerts. - This change may break valid configurations that do not use + Bugfix (introduced Postfix 2.2): Postfix no longer appends + the system default CA certificates to the lists specified + with *_tls_CAfile or with *_tls_CApath. This prevents + third-party certificates from being trusted and given mail + relay permission with permit_tls_all_clientcerts. This + change may break valid configurations that do not use permit_tls_all_clientcerts. To get the old behavior, specify "tls_append_default_CA = yes". Files: tls/tls_certkey.c, tls/tls_misc.c, global/mail_params.h. proto/postconf.proto, @@ -15855,3 +15856,7 @@ Apologies for any names omitted. Cleanup: SQLite read-only driver and documentation. Files: global/dict_sqlite.c, proto/mysql_table, proto/SQLITE_README.html. + +20100707 + + Completed the 20100610 bugfix. File: tls/tls_misc.c. diff --git a/postfix/README_FILES/LDAP_README b/postfix/README_FILES/LDAP_README index 043b311a2..12ae27530 100644 --- a/postfix/README_FILES/LDAP_README +++ b/postfix/README_FILES/LDAP_README @@ -232,8 +232,8 @@ settings, timeouts, ...) we have: search_base = dc=example, dc=com query_filter = mail=%s result_attribute = memberaddr - $ postmap -q agroup@example.com ldap:simple.cf - auser@example.org,buser@example.org + $ postmap -q agroup@example.com ldap:/etc/postfix/simple.cf \ + auser@example.org,buser@example.org We search "dc=example, dc=com". The "mail" attribute is used in the query_filter to locate the right group, the "result_attribute" setting @@ -261,8 +261,8 @@ example data. query_filter = mail=%s result_attribute = maildrop special_result_attribute = memberdn - $ postmap -q agroup@example.com ldap:special.cf - auser@mailhub.example.com,buser@mailhub.example.com + $ postmap -q agroup@example.com ldap:/etc/postfix/special.cf \ + auser@mailhub.example.com,buser@mailhub.example.com Note: if the desired member object result attribute is always also present in the group, you get surprising results: the expansion also returns the address @@ -288,12 +288,15 @@ expanded. query_filter = mail=%s result_attribute = maildrop special_result_attribute = memberdn - $ postmap -q auser@example.com ldap:no_expand.cf ldap:expand.cf - auser@mailhub.example.com - $ postmap -q agroup@example.com ldap:no_expand.cf ldap:expand.cf - auser@mailhub.example.com,buser@mailhub.example.com - $ postmap -q bgroup@example.com ldap:no_expand.cf ldap:expand.cf - bgroup@mlm.example.com + $ postmap -q auser@example.com \ + ldap:/etc/postfix/no_expand.cf ldap:/etc/postfix/expand.cf \ + auser@mailhub.example.com + $ postmap -q agroup@example.com \ + ldap:/etc/postfix/no_expand.cf ldap:/etc/postfix/expand.cf \ + auser@mailhub.example.com,buser@mailhub.example.com + $ postmap -q bgroup@example.com \ + ldap:/etc/postfix/no_expand.cf ldap:/etc/postfix/expand.cf \ + bgroup@mlm.example.com Non-group objects and groups with delayed expansion (those that have a maildrop attribute) are rewritten to a single maildrop value. Groups that don't have a @@ -312,15 +315,15 @@ assume that forwarded groups are never nested inside expanded groups. special_result_attribute = memberdn terminal_result_attribute = maildrop leaf_result_attribute = mail - $ postmap -q auser@example.com ldap:fancy.cf - auser@mailhub.example.com - $ postmap -q cuser@example.com ldap:fancy.cf - cuser@example.com - $ postmap -q agroup@example.com ldap:fancy.cf + $ postmap -q auser@example.com ldap:/etc/postfix/fancy.cf \ + auser@mailhub.example.com + $ postmap -q cuser@example.com ldap:/etc/postfix/fancy.cf \ + cuser@example.com + $ postmap -q agroup@example.com ldap:/etc/postfix/fancy.cf \ auser@mailhub.example.com,buser@mailhub.example.com,auser@example.org,buser@example.org - $ postmap -q bgroup@example.com ldap:fancy.cf - bgroup@mlm.example.com + $ postmap -q bgroup@example.com ldap:/etc/postfix/fancy.cf \ + bgroup@mlm.example.com Above, delayed expansion is enabled via "terminal_result_attribute", which, if present, is used as the sole result and all other expansion is suppressed. diff --git a/postfix/README_FILES/QSHAPE_README b/postfix/README_FILES/QSHAPE_README index 4a56b6166..eddcc9847 100644 --- a/postfix/README_FILES/QSHAPE_README +++ b/postfix/README_FILES/QSHAPE_README @@ -366,6 +366,7 @@ delivery attempts. /etc/postfix/main.cf: transport_maps = hash:/etc/postfix/transport slow_destination_rate_delay = 1 + slow_destination_concurrency_failed_cohort_limit = 100 /etc/postfix/transport: example.com slow: @@ -380,6 +381,12 @@ delivery attempts. $slow_destination_rate_delay seconds between deliveries to the same destination. + IMPORTANT!! The large slow_destination_concurrency_failed_cohort_limit + value is needed. This prevents Postfix from deferring all mail for the same + destination after only one connection or handshake error (the reason for + this is that non-zero slow_destination_rate_delay forces a per-destination + concurrency of 1). + * Earlier Postfix versions: o In the transport map entry for the problem destination, specify a dead diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 76830b67c..304f401b8 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -17,10 +17,10 @@ before proceeding. Incompatibility with snapshot 20100610 ====================================== -Postfix no longer appends the system-supplied default CAs to the -lists specified with *_tls_CAfile or with *_tls_CApath. This prevents -third-party certificates from being trusted and given mail relay -permission with permit_tls_all_clientcerts. +Postfix no longer appends the system-supplied default CA certificates +to the lists specified with *_tls_CAfile or with *_tls_CApath. This +prevents third-party certificates from being trusted and given mail +relay permission with permit_tls_all_clientcerts. Unfortunately this change may break certificate verification on sites that don't use permit_tls_all_clientcerts. Specify diff --git a/postfix/WISHLIST b/postfix/WISHLIST index 285221991..b92af354e 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -2,6 +2,12 @@ Wish list: Remove this file from the stable release. + Update history in manpage/readme for SQLite driver. + + Make postconf aware of magical suffixes (the ones that + combine with transport names) and show them in "postconf + -n" output. Making this work with "postconf -d" is trickier. + Need a regular expression table to translate address verification responses into hard/soft/accept reply codes. diff --git a/postfix/conf/postfix-files b/postfix/conf/postfix-files index baccc02a6..2f0552bed 100644 --- a/postfix/conf/postfix-files +++ b/postfix/conf/postfix-files @@ -280,6 +280,7 @@ $readme_directory/SCHEDULER_README:f:root:-:644 $readme_directory/SMTPD_ACCESS_README:f:root:-:644 $readme_directory/SMTPD_POLICY_README:f:root:-:644 $readme_directory/SMTPD_PROXY_README:f:root:-:644 +$readme_directory/SOHO_README:f:root:-:644 $readme_directory/STANDARD_CONFIGURATION_README:f:root:-:644 $readme_directory/STRESS_README:f:root:-:644 $readme_directory/TLS_LEGACY_README:f:root:-:644 @@ -330,6 +331,7 @@ $html_directory/SCHEDULER_README.html:f:root:-:644 $html_directory/SMTPD_ACCESS_README.html:f:root:-:644 $html_directory/SMTPD_POLICY_README.html:f:root:-:644 $html_directory/SMTPD_PROXY_README.html:f:root:-:644 +$html_directory/SOHO_README.html:f:root:-:644 $html_directory/STANDARD_CONFIGURATION_README.html:f:root:-:644 $html_directory/STRESS_README.html:f:root:-:644 $html_directory/TLS_LEGACY_README.html:f:root:-:644 diff --git a/postfix/html/LDAP_README.html b/postfix/html/LDAP_README.html index 2a9483aa2..ac1239b8b 100644 --- a/postfix/html/LDAP_README.html +++ b/postfix/html/LDAP_README.html @@ -336,8 +336,8 @@ related settings (hosts, ports, bind settings, timeouts, ...) we have: search_base = dc=example, dc=com query_filter = mail=%s result_attribute = memberaddr - $ postmap -q agroup@example.com ldap:simple.cf - auser@example.org,buser@example.org + $ postmap -q agroup@example.com ldap:/etc/postfix/simple.cf \ + auser@example.org,buser@example.org @@ -369,8 +369,8 @@ assume for the moment that groups never have a "maildrop" (the "bgroup" query_filter = mail=%s result_attribute = maildrop special_result_attribute = memberdn - $ postmap -q agroup@example.com ldap:special.cf - auser@mailhub.example.com,buser@mailhub.example.com + $ postmap -q agroup@example.com ldap:/etc/postfix/special.cf \ + auser@mailhub.example.com,buser@mailhub.example.com @@ -400,12 +400,15 @@ never nested members of groups that are directly expanded.

query_filter = mail=%s result_attribute = maildrop special_result_attribute = memberdn - $ postmap -q auser@example.com ldap:no_expand.cf ldap:expand.cf - auser@mailhub.example.com - $ postmap -q agroup@example.com ldap:no_expand.cf ldap:expand.cf - auser@mailhub.example.com,buser@mailhub.example.com - $ postmap -q bgroup@example.com ldap:no_expand.cf ldap:expand.cf - bgroup@mlm.example.com + $ postmap -q auser@example.com \ + ldap:/etc/postfix/no_expand.cf ldap:/etc/postfix/expand.cf \ + auser@mailhub.example.com + $ postmap -q agroup@example.com \ + ldap:/etc/postfix/no_expand.cf ldap:/etc/postfix/expand.cf \ + auser@mailhub.example.com,buser@mailhub.example.com + $ postmap -q bgroup@example.com \ + ldap:/etc/postfix/no_expand.cf ldap:/etc/postfix/expand.cf \ + bgroup@mlm.example.com @@ -429,14 +432,14 @@ expanded groups.

special_result_attribute = memberdn terminal_result_attribute = maildrop leaf_result_attribute = mail - $ postmap -q auser@example.com ldap:fancy.cf - auser@mailhub.example.com - $ postmap -q cuser@example.com ldap:fancy.cf - cuser@example.com - $ postmap -q agroup@example.com ldap:fancy.cf - auser@mailhub.example.com,buser@mailhub.example.com,auser@example.org,buser@example.org - $ postmap -q bgroup@example.com ldap:fancy.cf - bgroup@mlm.example.com + $ postmap -q auser@example.com ldap:/etc/postfix/fancy.cf \ + auser@mailhub.example.com + $ postmap -q cuser@example.com ldap:/etc/postfix/fancy.cf \ + cuser@example.com + $ postmap -q agroup@example.com ldap:/etc/postfix/fancy.cf \ + auser@mailhub.example.com,buser@mailhub.example.com,auser@example.org,buser@example.org + $ postmap -q bgroup@example.com ldap:/etc/postfix/fancy.cf \ + bgroup@mlm.example.com diff --git a/postfix/html/QSHAPE_README.html b/postfix/html/QSHAPE_README.html index f20746688..185862a98 100644 --- a/postfix/html/QSHAPE_README.html +++ b/postfix/html/QSHAPE_README.html @@ -507,6 +507,7 @@ the same destination.

/etc/postfix/main.cf: transport_maps = hash:/etc/postfix/transport slow_destination_rate_delay = 1 + slow_destination_concurrency_failed_cohort_limit = 100 /etc/postfix/transport: example.com slow: @@ -524,6 +525,12 @@ the same destination.

$slow_destination_rate_delay seconds between deliveries to the same destination.

+

IMPORTANT!! The large slow_destination_concurrency_failed_cohort_limit +value is needed. This prevents Postfix from deferring all mail for +the same destination after only one connection or handshake error +(the reason for this is that non-zero slow_destination_rate_delay +forces a per-destination concurrency of 1).

+

  • Earlier Postfix versions: