diff --git a/postfix/HISTORY b/postfix/HISTORY index fa98c069b..b67c988ee 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -28446,7 +28446,7 @@ Apologies for any names omitted. connection target (the PostgreSQL URI parser decides what is allowed). The dbname setting is now optional if the hosts setting specifies only URIs. Files: util/valid_uri_scheme.[hc], - proto/pgsql_table. + proto/pgsql_table, global/dict_pgsql.c. 202141026 @@ -28467,3 +28467,33 @@ Apologies for any names omitted. of sessions per SMTP server process (max_use), and on the number file handles per process (managed with sysctl). File: xsasl/xsasl_dovecot_server.c. + +20241031 + + Logging: the Dovecot SASL client logging for "Invalid + authentication mechanism" now includes the name of that + mechanism. File: xsasl/xsasl_dovecot_server.c + +20241104 + + Logging: when a message transaction is canceled (i.e. + started but not completed), the cleanup server now logs + "queueid: canceled". This provides a clear signal to logfile + collation tools. File: cleanup/cleanup_api.c. + +20241028 + + Documentation: TLSRPT_README, section "Delivering TLSRPT + summaries via email". File: proto/TLSRPT_README.html. + +20241107 + + Documentation: tweaked text for smtpd_delay_open_until_valid_rcpt. + File: proto/postconf.proto. + +20241111 + + Bugfix (defect introduced: Postfix 3.10, date 20241025): + dict_pgsql_open() returned NULL when "hosts" specified a + non-URI target and "dbname" was not set. Instead, it should + return a surrogate dictionary. File: global/dict_pgsql.c. diff --git a/postfix/README_FILES/TLSRPT_README b/postfix/README_FILES/TLSRPT_README index c84309897..14ecf3b80 100644 --- a/postfix/README_FILES/TLSRPT_README +++ b/postfix/README_FILES/TLSRPT_README @@ -181,15 +181,16 @@ request that TLS enforcement will be disabled when submitting an email message. Options: - * Do nothing. When TLS security enforcement is required, a persistent - enforcement failure will delay the delivery of a TLSRPT summary until the - problem is addressed, or until the message expires in the mail queue. Keep - in mind that TLSRPT is not a real-time monitoring service; it takes on - average 12 hours before a failure is reported through TLSRPT. + * Do nothing. When TLS security enforcement is required but fails, a TLSRPT + summary message will be delayed until the problem is addressed, or until + the message expires in the mail queue. Keep in mind that TLSRPT is not a + real-time monitoring service; it takes on average 12 hours before a failure + is reported through TLSRPT. - * Exclude the sender of TLSRPT summaries from TLS enforcement. Implement the - configuration below on outbound MTA instances (replace noreply-smtp-tls- - reporting@example.com with your actual report generator's sender address): + * Exclude the sender of TLSRPT summaries from TLS security enforcement. + Implement the configuration below on outbound MTA instances (replace + noreply-smtp-tls-reporting@example.com with your actual report generator's + sender address): /etc/postfix/main.cf: # Limitation: this setting is overruled with transport_maps. @@ -199,7 +200,7 @@ Options: /etc/postfix/master.cf: # service name type private unpriv chroot wakeup maxproc command - allow-plaintext unix - - n - - smtp + allow-plaintext unix - - - - - smtp -o { smtp_tls_security_level = may } -o { smtp_tls_policy_maps = static:may } diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 660f33511..a0e19efe2 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -26,6 +26,12 @@ now also distributed with the more recent Eclipse Public License license of their choice. Those who are more comfortable with the IPL can continue with that license. +[Feature 20241104] + +The cleanup server now logs "queueid: canceled" when a message +transaction is started but not completed. This provides a clear +signal to logfile collation tools. + [Feature 20240926] Support for the TLSRPT protocol (defined in RFC 8460). With this, diff --git a/postfix/WISHLIST b/postfix/WISHLIST index c84db73bb..6a6cb0d51 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -8,16 +8,25 @@ Wish list: Add a mail_version chek to each pluggable database client. - Add an option for a built-in JSON generator. This would - simplify TLSRPT adoption by eliminating a build-time and - run-time dependency on the libtlsrpt client library. Prior - art: this approach was previously used to implement Postfix - Milter support. + relay_recipient_maps empty should default to 'no valid + recipients'. Subject to compatibility level. + + Make a reason available for messages placed on 'hold'. + + relay_recipient_maps empty should default to 'no valid + recipients'. Subject to compatibility level. + + Add an option for a TLSRPT built-in JSON generator. This + would simplify TLSRPT adoption by eliminating a build-time + and run-time dependency on the libtlsrpt client library. + Prior art: this approach was previously used to implement + Postfix Milter support. Make TLSRPT support pluggable (postfix-tlsrpt.so, like postfix-ldap.so, postfix-mysql.so and so on). This avods a hard install-time dependency on sys4 libtlsrpt. The sys4 - code would still be a build-time dependency. + code would still be a required build-time dependency, but + it would become an optional install-time dependency. Add smtp_tlsrpt_allow_list feature (default: static:all) to limit the domains for which Postfix generates TLSRPT daily summaries. diff --git a/postfix/html/TLSRPT_README.html b/postfix/html/TLSRPT_README.html index a1fc10f24..6bbc0be28 100644 --- a/postfix/html/TLSRPT_README.html +++ b/postfix/html/TLSRPT_README.html @@ -276,14 +276,15 @@ when submitting an email message.