This document has hints and tips for those who manage their -own Postfix distribution for internal use, and for those who maintain -Postfix distributions for general use.
+own Postfix binary distribution for internal use, and for those who +maintain Postfix binary distributions for general use.You can use one of the following commands to generate base64 encoded authentication information:
+Using a recent version of the bash shell:
+ +++ ++% echo -ne '\000username\000password' | openssl base64 ++
Some other shells support similar syntax.
+ +Using the printf command:
+ +++ ++% printf '\0%s\0%s' 'username' 'password' | openssl base64 +% printf '\0%s\0%s' 'username' 'password' | mmencode ++
The mmencode command is part of the metamail +software.
+ +Using Perl MIME::Base64:
+ +
+
+% perl -MMIME::Base64 -e \
+ 'print encode_base64("\0username\0password");'
+
+
+
+MIME::Base64 is available from http://www.cpan.org/.
+ +Using the gen-auth script:
+% gen-auth plain @@ -1501,23 +1538,7 @@ password:The gen-auth Perl script was written by John Jetmore and can be found at http://jetmore.org/john/code/gen-auth.
--- --% printf '\0username\0password' | mmencode --The mmencode command is part of the metamail -software.
- --- --% perl -MMIME::Base64 -e \ - 'print encode_base64("\0username\0password");' --MIME::Base64 is available from http://www.cpan.org/.
+
GSSAPI and LOGIN:
diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 817eaa6b8..1914a2ce5 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -7810,6 +7810,8 @@ Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). The default time unit is s (seconds). +/etc/postfix/main.cf: - smtp_sasl_mechanism_filter = !gssapi, !login, static:all + smtp_sasl_mechanism_filter = !gssapi, !login, static:all
This feature is available in Postfix 2.8 and later.
+ @@ -7843,6 +7845,8 @@ Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). The default time unit is s (seconds). +This feature is available in Postfix 2.8 and later.
+ diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index 4aecf46e1..c8467e669 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -4502,6 +4502,8 @@ a request before it is terminated by a built-in watchdog timer. .PP Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). The default time unit is s (seconds). +.PP +This feature is available in Postfix 2.8 and later. .SH qmgr_fudge_factor (default: 100) Obsolete feature: the percentage of delivery resources that a busy mail system will use up for delivery of a large mailing list @@ -4517,6 +4519,8 @@ software either retries or aborts the operation. .PP Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). The default time unit is s (seconds). +.PP +This feature is available in Postfix 2.8 and later. .SH qmgr_message_active_limit (default: 20000) The maximal number of messages in the active queue. .SH qmgr_message_recipient_limit (default: 20000) diff --git a/postfix/postfix-install b/postfix/postfix-install index f936b81a0..775b0acfe 100644 --- a/postfix/postfix-install +++ b/postfix/postfix-install @@ -305,7 +305,7 @@ esac install_root_prompt="the prefix for installed file names. Specify this ONLY if you are building ready-to-install packages for -distribution to other machines." +distribution to OTHER machines. See PACKAGE_README for instructions." tempdir_prompt="a directory for scratch files while installing Postfix. You must have write permission in this directory." diff --git a/postfix/proto/PACKAGE_README.html b/postfix/proto/PACKAGE_README.html index cf5ee523d..1698f9a7a 100644 --- a/postfix/proto/PACKAGE_README.html +++ b/postfix/proto/PACKAGE_README.html @@ -20,8 +20,8 @@This document has hints and tips for those who manage their -own Postfix distribution for internal use, and for those who maintain -Postfix distributions for general use.
+own Postfix binary distribution for internal use, and for those who +maintain Postfix binary distributions for general use.You can use one of the following commands to generate base64 encoded authentication information:
+Using a recent version of the bash shell:
+ +++ ++% echo -ne '\000username\000password' | openssl base64 ++
Some other shells support similar syntax.
+ +Using the printf command:
+ +++ ++% printf '\0%s\0%s' 'username' 'password' | openssl base64 +% printf '\0%s\0%s' 'username' 'password' | mmencode ++
The mmencode command is part of the metamail +software.
+ +Using Perl MIME::Base64:
+ +
+
+% perl -MMIME::Base64 -e \
+ 'print encode_base64("\0username\0password");'
+
+
+
+MIME::Base64 is available from http://www.cpan.org/.
+ +Using the gen-auth script:
+% gen-auth plain @@ -1501,23 +1538,7 @@ password:The gen-auth Perl script was written by John Jetmore and can be found at http://jetmore.org/john/code/gen-auth.
--- --% printf '\0username\0password' | mmencode --The mmencode command is part of the metamail -software.
- --- --% perl -MMIME::Base64 -e \ - 'print encode_base64("\0username\0password");' --MIME::Base64 is available from http://www.cpan.org/.
+
This feature is available in Postfix 2.8 and later.
+ %PARAM qmgr_daemon_timeout 1000sHow much time a Postfix queue manager process may take to handle @@ -13541,6 +13543,8 @@ Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). The default time unit is s (seconds).
+This feature is available in Postfix 2.8 and later.
+ %PARAM tls_preempt_cipherlist no With SSLv3 and later, use the server's cipher preference order
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 03e67d803..697904f2a 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
-#define MAIL_RELEASE_DATE "20110615"
+#define MAIL_RELEASE_DATE "20110706"
#define MAIL_VERSION_NUMBER "2.9"
#ifdef SNAPSHOT
diff --git a/postfix/src/global/smtp_reply_footer.c b/postfix/src/global/smtp_reply_footer.c
index 5018a4706..6e460f442 100644
--- a/postfix/src/global/smtp_reply_footer.c
+++ b/postfix/src/global/smtp_reply_footer.c
@@ -15,8 +15,8 @@
/* const char *(*lookup) (const char *name, char *context);
/* char *context;
/* DESCRIPTION
-/* smtp_reply_footer() expands a reply template to an existing
-/* reply text.
+/* smtp_reply_footer() expands a reply template, and appends
+/* the result to an existing reply text.
/*
/* Arguments:
/* .IP buffer
diff --git a/postfix/src/smtpd/smtpd_check.c b/postfix/src/smtpd/smtpd_check.c
index 2e14dae0d..46ee5a055 100644
--- a/postfix/src/smtpd/smtpd_check.c
+++ b/postfix/src/smtpd/smtpd_check.c
@@ -1220,13 +1220,15 @@ static int reject_unknown_mailhost(SMTPD_STATE *state, const char *name,
static int permit_auth_destination(SMTPD_STATE *state, char *recipient);
-/* permit_tls_clientcerts - OK/DUNNO for message relaying */
+/* permit_tls_clientcerts - OK/DUNNO for message relaying, or set dict_errno */
static int permit_tls_clientcerts(SMTPD_STATE *state, int permit_all_certs)
{
#ifdef USE_TLS
const char *found;
+ dict_errno = 0;
+
if (!state->tls_context)
return SMTPD_CHECK_DUNNO;
@@ -1251,6 +1253,8 @@ static int permit_tls_clientcerts(SMTPD_STATE *state, int permit_all_certs)
msg_info("relay_clientcerts: No match for fingerprint '%s'",
state->tls_context->peer_fingerprint);
}
+#else
+ dict_errno = 0;
#endif
return (SMTPD_CHECK_DUNNO);
}
@@ -3958,8 +3962,12 @@ static int generic_checks(SMTPD_STATE *state, ARGV *restrictions,
#endif
} else if (strcasecmp(name, PERMIT_TLS_ALL_CLIENTCERTS) == 0) {
status = permit_tls_clientcerts(state, 1);
+ if (dict_errno != 0)
+ reject_dict_retry(state, reply_name);
} else if (strcasecmp(name, PERMIT_TLS_CLIENTCERTS) == 0) {
status = permit_tls_clientcerts(state, 0);
+ if (dict_errno != 0)
+ reject_dict_retry(state, reply_name);
} else if (strcasecmp(name, REJECT_UNKNOWN_RCPTDOM) == 0) {
if (state->recipient)
status = reject_unknown_address(state, state->recipient,
@@ -4106,13 +4114,19 @@ void smtpd_check_rewrite(SMTPD_STATE *state)
}
if (strcasecmp(name, PERMIT_INET_INTERFACES) == 0) {
status = permit_inet_interfaces(state);
+ /* dict errors are fatal */
} else if (strcasecmp(name, PERMIT_MYNETWORKS) == 0) {
status = permit_mynetworks(state);
+ /* dict errors are fatal */
} else if (is_map_command(state, name, CHECK_ADDR_MAP, &cpp)) {
if ((dict = dict_handle(*cpp)) == 0)
msg_panic("%s: dictionary not found: %s", myname, *cpp);
+ dict_errno = 0;
+ /* for now, dict errors are fatal */
if (dict_get(dict, state->addr) != 0)
status = SMTPD_CHECK_OK;
+ else if (dict_errno != 0)
+ msg_fatal("%s: table lookup error", *cpp);
} else if (strcasecmp(name, PERMIT_SASL_AUTH) == 0) {
#ifdef USE_SASL_AUTH
if (smtpd_sasl_is_active(state))
@@ -4121,8 +4135,18 @@ void smtpd_check_rewrite(SMTPD_STATE *state)
#endif
} else if (strcasecmp(name, PERMIT_TLS_ALL_CLIENTCERTS) == 0) {
status = permit_tls_clientcerts(state, 1);
+ /* for now, dict errors are fatal */
+#ifdef USE_TLS
+ if (dict_errno != 0)
+ msg_fatal("%s: table lookup error", var_smtpd_relay_ccerts);
+#endif
} else if (strcasecmp(name, PERMIT_TLS_CLIENTCERTS) == 0) {
status = permit_tls_clientcerts(state, 0);
+ /* for now, dict errors are fatal */
+#ifdef USE_TLS
+ if (dict_errno != 0)
+ msg_fatal("%s: table lookup error", var_smtpd_relay_ccerts);
+#endif
} else {
msg_warn("parameter %s: invalid request: %s",
VAR_LOC_RWR_CLIENTS, name);
diff --git a/postfix/src/util/sys_defs.h b/postfix/src/util/sys_defs.h
index bbe370f2b..422219055 100644
--- a/postfix/src/util/sys_defs.h
+++ b/postfix/src/util/sys_defs.h
@@ -1547,6 +1547,9 @@ typedef int pid_t;
* Bit banging!! There is no official constant that defines the INT_MAX
* equivalent of the off_t type. Wietse came up with the following macro
* that works as long as off_t is some two's complement number.
+ *
+ * Note, however, that C99 permits signed integer representations other than
+ * two's complement.
*/
#include