postfix-3.4-20180701

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 8a85899c0f680783668ff396d54a6f5f9e5ab046..d57fd3152d9f49e45c06ec38997fbc1b05ff667b 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -23587,3 +23587,10 @@ Apologies for any names omitted.
 
        Documentation: the connection caching limitation for SMTP
        over TLS is now obsolete. File: proto/CONNECTION_CACHE_README.html.
+
+20180701
+
+       Incompatibility: the tlsproxy(8) daemon now requires a zero
+       process limit in master.cf (this setting is provided with
+       the default master.cf file). See RELEASE_NOTES for how to
+       change the tlsproxy process limit. File: tlsproxy/tlsproxy.c.

diff --git a/postfix/README_FILES/TLS_README b/postfix/README_FILES/TLS_README
index 68e0157d1320dcc4f916961f035ce539562fdc6b..da171258c9887e737ffcf3260a85f47128ae2a27 100644 (file)
--- a/postfix/README_FILES/TLS_README
+++ b/postfix/README_FILES/TLS_README
@@ -1436,10 +1436,10 @@ Example:
 C\bCl\bli\bie\ben\bnt\bt-\b-s\bsi\bid\bde\be T\bTL\bLS\bS c\bco\bon\bnn\bne\bec\bct\bti\bio\bon\bn r\bre\beu\bus\bse\be
 
 Historically, the Postfix SMTP client has supported multiple deliveries per
-connection only for plaintext connections. Postfix 3.4 introduces the ability
-to make multiple deliveries per TLS-encrypted connection. This is primarily to
-improve mail delivery performance for destinations that throttle clients when
-they don't combine deliveries.
+plaintext connection. Postfix 3.4 introduces support for multiple deliveries
+per TLS-encrypted connection. Multiple deliveries per connection improve mail
+delivery performance, especially for destinations that throttle clients that
+don't combine deliveries.
 
 To enable multiple deliveries per TLS connection, specify:
 

diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES
index 1020af982c42e32f9043cc8cc38a7075396218ba..3c429a651e0a20d14c299f13787df6dbd89e87c7 100644 (file)
--- a/postfix/RELEASE_NOTES
+++ b/postfix/RELEASE_NOTES
@@ -25,6 +25,21 @@ more recent Eclipse Public License 2.0. Recipients can choose to take
 the software under the license of their choice. Those who are more
 comfortable with the IPL can continue with that license.
 
+Incompatble change with snapshot 20180701
+=========================================
+
+To avoid performance loss under load, the tlsproxy(8) daemon now
+requires a zero process limit in master.cf (this setting is provided
+with the default master.cf file). As tlsproxy(8) processes become
+too busy handling TLS connections, more processes will automatically
+be added. By default, a tlsproxy(8) process will retire after several
+hours.
+
+To set the tlsproxy process limit to zero:
+
+# postconf -F tlsproxy/unix/process_limit=0
+# postfix reload
+
 Major changes with snapshot 20180617
 ====================================
 
@@ -38,15 +53,12 @@ main.cf, or with "tls_connection_reuse=yes" in smtp_tls_policy_maps.
 It supports all Postfix TLS security levels including dane and
 dane-only.
 
-With connection reuse enabled as described above, the Postfix SMTP
-client uses the tlsproxy(8) server to encrypt a connection (even under
-low-traffic conditions). The tlsproxy(8) service was introduced in
-Postfix 2.8, to support STARTTLS in postscreen(8).
-
-Under high-traffic conditions, the Postfix SMTP client will use the
-scache(8) connection cache to store and retrieve open connections.
-This part already existed for plaintext SMTP, and it works in the
-same way for TLS-encrypted connections.
+The implementation of TLS connection reuse relies on the same
+scache(8) service as used for delivering plaintext SMTP mail, the
+same tlsproxy(8) daemon as used by the postscreen(8) service for
+inbound connections, and relies on the same hints from the qmgr(8)
+daemon. It reuses the configuration parameters described in
+CONNECTION_CACHE_README.
 
 The following illustrates how TLS connections are reused:
 

diff --git a/postfix/html/TLS_README.html b/postfix/html/TLS_README.html
index e51923961915b6b836bd70545caeab6a42560701..d4ddae5931b55a995817bdcfb84d605bd87f6cbe 100644 (file)
--- a/postfix/html/TLS_README.html
+++ b/postfix/html/TLS_README.html
@@ -1913,10 +1913,10 @@ when the certificate is needed.  </p>
 <h3><a name="client_tls_reuse">Client-side TLS connection reuse</a> </h3>
 
 <p> Historically, the Postfix SMTP client has supported multiple
-deliveries per connection only for plaintext connections. Postfix
-3.4 introduces the ability to make multiple deliveries per TLS-encrypted
-connection. This is primarily to improve mail delivery performance
-for destinations that throttle clients when they don't combine
+deliveries per plaintext connection. Postfix 3.4 introduces support
+for multiple deliveries per TLS-encrypted connection. Multiple
+deliveries per connection improve mail delivery performance,
+especially for destinations that throttle clients that don't combine
 deliveries. </p>
 
 <p> To enable multiple deliveries per TLS connection, specify:</p>

diff --git a/postfix/proto/TLS_README.html b/postfix/proto/TLS_README.html
index 0aa8fbe834181824f38a6a5f61e4615f30f54321..cca0630d2dfbd7e5698afced1e5383b49c9eaaae 100644 (file)
--- a/postfix/proto/TLS_README.html
+++ b/postfix/proto/TLS_README.html
@@ -1913,10 +1913,10 @@ when the certificate is needed.  </p>
 <h3><a name="client_tls_reuse">Client-side TLS connection reuse</a> </h3>
 
 <p> Historically, the Postfix SMTP client has supported multiple
-deliveries per connection only for plaintext connections. Postfix
-3.4 introduces the ability to make multiple deliveries per TLS-encrypted
-connection. This is primarily to improve mail delivery performance
-for destinations that throttle clients when they don't combine
+deliveries per plaintext connection. Postfix 3.4 introduces support
+for multiple deliveries per TLS-encrypted connection. Multiple
+deliveries per connection improve mail delivery performance,
+especially for destinations that throttle clients that don't combine
 deliveries. </p>
 
 <p> To enable multiple deliveries per TLS connection, specify:</p>

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 0fff4fc05593f20e5d3abee2c553a7e554eb735b..f0bc7ae4d19390f5118961c2a5083c8f30f0c572 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20180624"
+#define MAIL_RELEASE_DATE      "20180701"
 #define MAIL_VERSION_NUMBER    "3.4"
 
 #ifdef SNAPSHOT

diff --git a/postfix/src/tlsproxy/tlsproxy.c b/postfix/src/tlsproxy/tlsproxy.c
index dfcf3e0ce7b94aae39083d842f7b98a1f55ae8dd..5f57c4e3dbd29a1a22c5088654b04d27659e387d 100644 (file)
--- a/postfix/src/tlsproxy/tlsproxy.c
+++ b/postfix/src/tlsproxy/tlsproxy.c
@@ -1331,6 +1331,7 @@ int     main(int argc, char **argv)
                      CA_MAIL_SERVER_SLOW_EXIT(tlsp_drain),
                      CA_MAIL_SERVER_RETIRE_ME,
                      CA_MAIL_SERVER_WATCHDOG(&var_tlsp_watchdog),
+                     CA_MAIL_SERVER_UNLIMITED,
                      0);
 }