From: Wietse Venema Date: Tue, 14 Sep 2010 05:00:00 +0000 (-0500) Subject: postfix-2.8-20100914 X-Git-Tag: v2.8.0-RC1~25 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7674e07fe64057d64b1110242f3626c30321c2d2;p=thirdparty%2Fpostfix.git postfix-2.8-20100914 --- diff --git a/postfix/.indent.pro b/postfix/.indent.pro index a8b07760b..88762a3a4 100644 --- a/postfix/.indent.pro +++ b/postfix/.indent.pro @@ -194,6 +194,7 @@ -TPOSTMAP_KEY_STATE -TPOST_MAIL_STATE -TPRIVATE_STR_TABLE +-TPS_CALL_BACK_ENTRY -TPS_DNSBL_HEAD -TPS_DNSBL_SCORE -TPS_DNSBL_SITE diff --git a/postfix/HISTORY b/postfix/HISTORY index 2e4cf235d..36a2f2329 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -15973,10 +15973,22 @@ Apologies for any names omitted. 20100912 Feature: bare newline detection in postscreen. Real spambots - don't make this mistake but poorly-written software often does. - File: postscreen/smtpd.c. + don't make this mistake anymore, but poorly-written software + still does. File: postscreen/smtpd.c. Documentation: POSTSCREEN_README including instructions for turning postscreen(8) on without blocking mail, and more. Trimmed the text in the postscreen(8) manpage. File: proto/POSTSCREEN_README.html, postscreen/postscreen.c. + +20100914 + + Cleanup: the "postscreen_greet_wait" delay now ends as soon + as both the pregreet and DNSBL tests complete (the postscreen + documentation mentions in history/credits that the program + started as a crude prototype). The default postscreen_dnsbl_ttl + caching time is now reduced to 1h from 24h, allowing + postscreen to catch up on DNSBL updates more quickly. If + this increases the database update frequency too much then + we'll need to make dnsbl result non-cachable. Files: + postscreen/postscreen_dnsbl.c, global/mail_params.h. diff --git a/postfix/README_FILES/DATABASE_README b/postfix/README_FILES/DATABASE_README index 0e4e85d8b..22d5801e6 100644 --- a/postfix/README_FILES/DATABASE_README +++ b/postfix/README_FILES/DATABASE_README @@ -255,8 +255,8 @@ To find out what database types your Postfix system supports, use the "ppooss tteexxtthhaasshh (read-only) This produces similar results as hash: files, except that you don't have to run the postmap(1) command before you can use the file, and - that it does not detect changes after the file is read. The lookup - table name is "texthash:filename", where the file name is taken + that texthash: does not detect changes after the file is read. The + lookup table name is "texthash:filename", where the file name is taken literally; no suffix is appended. uunniixx (read-only) A limited way to query the UNIX authentication database. The following diff --git a/postfix/README_FILES/POSTSCREEN_README b/postfix/README_FILES/POSTSCREEN_README index c5ee1dad0..1e4077ac9 100644 --- a/postfix/README_FILES/POSTSCREEN_README +++ b/postfix/README_FILES/POSTSCREEN_README @@ -5,25 +5,15 @@ PPoossttffiixx PPoossttssccrreeeenn HHoowwttoo IInnttrroodduuccttiioonn The Postfix postscreen(8) server performs triage on multiple inbound SMTP -connections in parallel. While one postscreen(8) process keeps spambots away -from Postfix SMTP server processes, more Postfix SMTP server processes remain -available for legitimate clients. +connections in parallel. While a single postscreen(8) process keeps spambots +away from Postfix SMTP server processes, more Postfix SMTP server processes +remain available for legitimate clients. By doing these checks in a single postscreen(8) process, Postfix can avoid wasting one SMTP server process per connection. A side benefit of postscreen (8)'s DNSBL lookups is that DNS records are already cached before the Postfix SMTP server looks them up later. -postscreen(8) maintains a temporary whitelist for clients that have passed a -number of tests. When an SMTP client IP address is whitelisted, postscreen(8) -hands off the connection immediately to a Postfix SMTP server process. This -minimizes the overhead for legitimate mail. - -By default, postscreen(8) logs statistics and hands off every connection to a -Postfix SMTP server process, while excluding clients in mynetworks from all -tests (primarily, to avoid problems with non-standard SMTP implementations in -network appliances). This mode is useful for non-destructive testing. - Topics in this document: * Introduction @@ -161,10 +151,14 @@ effect on SMTP clients that correctly implement the protocol. To avoid problems with poorly-implemented SMTP engines in network appliances or network testing tools, either exclude them from all tests with the -postscreen_whitelist_networks feature or else specify an empty teaser banner -with: +postscreen_whitelist_networks feature or else specify an empty teaser banner: + +/etc/postfix/main.cf: + # Exclude broken clients by whitelisting. $mynetworks is default. + postscreen_whitelist_networks = $mynetworks, 192.168.254.0/24 /etc/postfix/main.cf: + # Disable the teaser banner (try whitelisting first if you can). postscreen_greet_banner = When an SMTP client sends a command before the postscreen_greet_wait time has diff --git a/postfix/html/DATABASE_README.html b/postfix/html/DATABASE_README.html index 5e2e59425..b2166e9cb 100644 --- a/postfix/html/DATABASE_README.html +++ b/postfix/html/DATABASE_README.html @@ -383,9 +383,9 @@ number.
This produces similar results as hash: files, except that you don't have to run the postmap(1) command before you can use the -file, and that it does not detect changes after the file is read. -The lookup table name is "texthash:filename", where the file name -is taken literally; no suffix is appended.
+file, and that texthash: does not detect changes after the file is +read. The lookup table name is "texthash:filename", where the file +name is taken literally; no suffix is appended.
unix (read-only)
diff --git a/postfix/html/POSTSCREEN_README.html b/postfix/html/POSTSCREEN_README.html index a22148f6a..f76d1050c 100644 --- a/postfix/html/POSTSCREEN_README.html +++ b/postfix/html/POSTSCREEN_README.html @@ -18,9 +18,10 @@

Introduction

The Postfix postscreen(8) server performs triage on multiple -inbound SMTP connections in parallel. While one postscreen(8) process -keeps spambots away from Postfix SMTP server processes, more Postfix -SMTP server processes remain available for legitimate clients.

+inbound SMTP connections in parallel. While a single postscreen(8) +process keeps spambots away from Postfix SMTP server processes, +more Postfix SMTP server processes remain available for legitimate +clients.

By doing these checks in a single postscreen(8) process, Postfix can avoid wasting one SMTP server process per connection. A side @@ -28,18 +29,6 @@ benefit of postscreen(8)'s DNSBL lookups is that already cached before the Postfix SMTP server looks them up later.

-

postscreen(8) maintains a temporary whitelist for clients that -have passed a number of tests. When an SMTP client IP address is -whitelisted, postscreen(8) hands off the connection immediately to -a Postfix SMTP server process. This minimizes the overhead for -legitimate mail.

- -

By default, postscreen(8) logs statistics and hands off every -connection to a Postfix SMTP server process, while excluding clients -in mynetworks from all tests (primarily, to avoid problems with -non-standard SMTP implementations in network appliances). This mode -is useful for non-destructive testing.

-

Topics in this document: