From: Wietse Venema Date: Sun, 1 May 2011 05:00:00 +0000 (-0500) Subject: postfix-2.9-20110501 X-Git-Tag: v2.9.0-RC1~45 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0d004a6d614f0b3e53bc091b71eda6f3ccccf3b5;p=thirdparty%2Fpostfix.git postfix-2.9-20110501 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index 6b1ca9886..35735c497 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -15616,7 +15616,7 @@ Apologies for any names omitted. for the "virtual:" transport to "/etc/postfix/virtual:". Symptom reported by Christoph Anton Mitterer. -20200102 +20100102 Workaround: don't report bogus Berkeley DB close errors as fatal errors. All operations before close are already error @@ -16753,3 +16753,54 @@ Apologies for any names omitted. Bitrot: text about queue ID reuse in the postsuper manpage. File: postsuper/postsuper.c. + +20110328 + + Cleanup: don't log warnings about socket shutdown() errors + after a connection breaks. Postfix calls shutdown() to avoid + unnecessary socket write timeouts. This is only an optimization, + and failure is not critical. File: global/smtp_stream.c. + +20110411 + + Cleanup: postscreen(8) and verify(8) daemons now lock their + respective cache file exclusively upon open, to avoid massive + cache corruption by unsupported sharing. Files: util/dict.h, + util/dict_open.c, verify/verify.c, postscreen/postscreen.c. + +20110414 + + Bugfix (introduced with Postfix SASL patch 20000314): don't + reuse a server Cyrus SASL handle after authentication + failure. File: smtpd/smtpd_proto.c. + +20110418 + + Bugfix (introduced Postfix 2.3 and Postfix 2.7): the Milter + client reported some "file too large" errors as temporary + errors. Problem reported by Michael Tokarev. Files: + milter/milter8.c, cleanup/cleanup_milter.c. + +20110420 + + Performance: a high load of DSN success notification requests + could stall the queue manager. Solution: make the trace + client asynchronous, just like the bounce and defer clients. + Problem reported by Eduardo M. Stelmaszczyk of terra.com.br. + Files: global/abounce.[hc], *qmgr/qmgr_active.c (the + qmgr_active.c files are identical). + +20110421 + + Cleanup: updated abounce warning message, and added a safety + timeout to abounce() etc. requests. File: global/abounce.c. + +20110426 + + Bugfix (introduced in Postfix 1.1, duplicated in Postfix + 2.3, unrelated mistake in Postfix 2.7): the local(8) delivery + agent ignored table lookup errors in mailbox_command_maps, + mailbox_transport_maps, fallback_transport_maps and (while + bouncing mail to alias) alias owner lookup. Problem reported + by William Ono. Files: local/command.c, local/mailbox.c, + local/unknown.c, local/bounce_workaround.c. diff --git a/postfix/README_FILES/OVERVIEW b/postfix/README_FILES/OVERVIEW index ee271e61b..637ea9842 100644 --- a/postfix/README_FILES/OVERVIEW +++ b/postfix/README_FILES/OVERVIEW @@ -370,8 +370,12 @@ queues. While postscreen(8) keeps the zombies away, more smtpd(8) processes remain available for legitimate clients. + postscreen(8) maintains a temporary whitelist for clients that pass its + tests; by allowing whitelisted clients to skip tests, postscreen(8) + minimizes its impact on legitimate email traffic. + The postscreen(8) server is available with Postfix 2.8 and later. To keep - the implementation simple, postscreen(8) delegates DNS white/backlist + the implementation simple, postscreen(8) delegates DNS white/blacklist lookups to dnsblog(8) server processes, and delegates TLS encryption/ decryption to tlsproxy(8) server processes. This delegation is invisible to the remote SMTP client, and is not shown in the diagram below. diff --git a/postfix/README_FILES/POSTSCREEN_README b/postfix/README_FILES/POSTSCREEN_README index 19df31b0a..71fb3eb33 100644 --- a/postfix/README_FILES/POSTSCREEN_README +++ b/postfix/README_FILES/POSTSCREEN_README @@ -9,6 +9,10 @@ connections at the same time. While a single postscreen(8) process keeps zombies away from Postfix SMTP server processes, more Postfix SMTP server processes remain available for legitimate clients. +postscreen(8) maintains a temporary whitelist for clients that pass its tests; +by allowing whitelisted clients to skip tests, postscreen(8) minimizes its +impact on legitimate email traffic. + postscreen(8) should not be used on SMTP ports that receive mail from end-user clients (MUAs). In a typical deployment, postscreen(8) is used on the "port 25" service, while MUA clients submit mail via the submission service. @@ -83,10 +87,10 @@ focused on. GGeenneerraall ooppeerraattiioonn The postscreen(8) triage process involves a number of tests, in the order as -described below. Some tests introduce a delay of a few seconds. Once a client -passes a test, its IP address is whitelisted from 24 hours for simple tests, to -1 week for complex tests. Whitelisting minimizes the impact of postscreen(8)'s -tests on legitimate mail clients. +described below. Some tests introduce a delay of a few seconds. postscreen(8) +maintains a temporary whitelist for clients that pass its tests; by allowing +whitelisted clients to skip tests, postscreen(8) minimizes its impact on +legitimate email traffic. By default, postscreen(8) hands off all connections to a Postfix SMTP server process after logging its findings. This mode is useful for non-destructive @@ -448,14 +452,16 @@ ddrroopp (default for non-SMTP commands) OOtthheerr eerrrroorrss -When an SMTP client hangs up unexpectedly during any tests, postscreen(8) logs -this as: +When an SMTP client hangs up unexpectedly, postscreen(8) logs this as: HHAANNGGUUPP aafftteerr time ffrroomm [address]:port iinn test name Translation: the SMTP client at [address]:port disconnected unexpectedly, time seconds after the start of the test named test name. +There is no punishment for hanging up. A client that hangs up without sending +the QUIT command can still pass all postscreen(8) tests. + The following errors are reported by the built-in SMTP engine. This engine never accepts mail, therefore it has per-session limits on the number of commands and on the session length. diff --git a/postfix/WISHLIST b/postfix/WISHLIST index ebcbabc1e..f2a13b73f 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -11,11 +11,13 @@ Wish list: Don't forget Apple's code donation for fetching mail from IMAP server. - Simplify postscreen logic: set the noforward flag if the - client made an unforgivable error. Individual "fail" flags - are needed only to avoid logging the same offense multiple - times. Individual "pass" flags are still needed as proof - that the client didn't skip tests by hanging up early. + Simplify postscreen logic. Individual "fail" flags help to + avoid repeated testing/logging the same mistake. Individual + "pass" flags provide evidence that the client didn't skip + tests by hanging up early. The current global "noforward" + flag implements the wrong model: instead we need an indicator + that a client has passed all tests or that all mistakes + were forgiven. In the SMTP server, check if the connection is closed before replying to ".", and discard the message if the reply can't @@ -23,17 +25,14 @@ Wish list: duplication, and may even prevent the delivery of some spam. http://www.exim.org/lurker/message/20070416.103159.9d5ff0ce.en.html + Find out how to reproduce Berkeley DB bogus ENOENT errors. + postscreen does not log this with Berkeley DB 1 (FreeBSD + 4..8), 4.7.25 (Ubuntu 9.04) and 4.8.24 (Ubuntu 10.04). + postconf command-line option to show the compile-time settings (CCARGS, AUXLIBS) in case binary packages don't install the makedefs.out file. - propagate alias owner from pcre, regexp, cidr, texthash, - etc. databases, i.e. set the owner property at open time; - it can't be looked up at run-time with fstat(dict->stat_fd) - because there is no open file. What about *SQL, LDAP, etc.? - Maybe use the source of the configuration file? We can reuse - that to enforce root ownership of main/master.cf files. - events.c: cache the side effects of file descriptor event enable/disable operations in user space, and do bulk kernel updates at event_loop() time. This can eliminate costly @@ -85,10 +84,6 @@ Wish list: This would apply to postmaster notices and bounce messages (DKIM), and address verification (BATV). - As postscreen implements more ESMTP keywords, need to copy - inter-operability features from smtpd to filter keywords - and command syntax. - Consistency: in postconf.proto make
..
tags bold. postscreen(8): listen on multiple IP addresses and enforce diff --git a/postfix/html/OVERVIEW.html b/postfix/html/OVERVIEW.html index 0f55aa157..1393e26d0 100644 --- a/postfix/html/OVERVIEW.html +++ b/postfix/html/OVERVIEW.html @@ -737,9 +737,14 @@ those numbers were 92% and 95%, respectively. While smtpd(8) processes remain available for legitimate clients.

+

postscreen(8) maintains a temporary whitelist for clients that +pass its tests; by allowing whitelisted clients to skip tests, +postscreen(8) minimizes its impact on legitimate email traffic. +

+

The postscreen(8) server is available with Postfix 2.8 and later. To keep the implementation simple, postscreen(8) delegates -DNS white/backlist lookups to dnsblog(8) server processes, and +DNS white/blacklist lookups to dnsblog(8) server processes, and delegates TLS encryption/decryption to tlsproxy(8) server processes. This delegation is invisible to the remote SMTP client, and is not shown in the diagram below.

diff --git a/postfix/html/POSTSCREEN_README.html b/postfix/html/POSTSCREEN_README.html index d20d13672..6b501fdec 100644 --- a/postfix/html/POSTSCREEN_README.html +++ b/postfix/html/POSTSCREEN_README.html @@ -23,6 +23,11 @@ process keeps zombies away from Postfix SMTP server processes, more Postfix SMTP server processes remain available for legitimate clients.

+

postscreen(8) maintains a temporary whitelist for clients that +pass its tests; by allowing whitelisted clients to skip tests, +postscreen(8) minimizes its impact on legitimate email traffic. +

+

postscreen(8) should not be used on SMTP ports that receive mail from end-user clients (MUAs). In a typical deployment, postscreen(8) is used on the "port 25" service, while MUA clients @@ -121,10 +126,10 @@ and that is the problem that postscreen(8) is fo

The postscreen(8) triage process involves a number of tests, in the order as described below. Some tests introduce a delay of -a few seconds. Once a client passes a test, its IP address is -whitelisted from 24 hours for simple tests, to 1 week for complex -tests. Whitelisting minimizes the impact of postscreen(8)'s tests -on legitimate mail clients.

+a few seconds. postscreen(8) maintains a temporary whitelist for +clients that pass its tests; by allowing whitelisted clients to +skip tests, postscreen(8) minimizes its impact on legitimate email +traffic.

By default, postscreen(8) hands off all connections to a Postfix SMTP server process after logging its findings. This mode is useful @@ -606,8 +611,8 @@ feature.

Other errors

-

When an SMTP client hangs up unexpectedly during any tests, -postscreen(8) logs this as:

+

When an SMTP client hangs up unexpectedly, postscreen(8) logs +this as: 

     HANGUP after time from [address]:port in test name
@@ -617,6 +622,10 @@ feature. 
 unexpectedly, time seconds after the start of the
 test named test name. 

 
+
 There is no punishment for hanging up. A client that hangs up
+without sending the QUIT command can still pass all postscreen(8)
+tests. 

+