From: Wietse Venema Date: Fri, 30 Mar 2012 05:00:00 +0000 (-0500) Subject: postfix-2.10-20120330 X-Git-Tag: v2.10.0-RC1~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=99ff75430d5c908879caffc1125680ed68019021;p=thirdparty%2Fpostfix.git postfix-2.10-20120330 --- diff --git a/postfix/.indent.pro b/postfix/.indent.pro index 74d52d46f..634794f72 100644 --- a/postfix/.indent.pro +++ b/postfix/.indent.pro @@ -98,6 +98,7 @@ -TDICT_REGEXP_PRESCAN_CONTEXT -TDICT_REGEXP_RULE -TDICT_SDBM +-TDICT_SOCKMAP -TDICT_SQLITE -TDICT_STACK -TDICT_SURROGATE diff --git a/postfix/HISTORY b/postfix/HISTORY index 4a35978d6..cd821774e 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -17684,3 +17684,16 @@ Apologies for any names omitted. postconf -X option to exclude parameters from main.cf (require two-finger action, because this is irreversible). Files: postconf/postconf.[hc], postconf/postconf_edit.c. + +20120317 + + Feature: Sendmail-style socketmap. Files: util/dict_sockmap.[hc], + util/netstring.[hc], proto/DATABASE_README.html, + postconf/postconf.c. + +20120330 + + Workaround: specify "\c" at the start of an smtp_reject_footer + template to suppress the line break between the reply text + and the footer text. Files: global/smtp_reply_footer.c, + proto/postconf.proto. diff --git a/postfix/README_FILES/DATABASE_README b/postfix/README_FILES/DATABASE_README index 18e898250..79181be35 100644 --- a/postfix/README_FILES/DATABASE_README +++ b/postfix/README_FILES/DATABASE_README @@ -246,6 +246,11 @@ To find out what database types your Postfix system supports, use the "ppooss with the postmap(1) or postalias(1) command. The lookup table name as used in "sdbm:table" is the database file name without the ".dir" or ".pag" suffix. + ssoocckkeettmmaapp (read-only) + Query a Sendmail-style socketmap server. The name of the table + specifies iinneett:host:port:socketmap-name for a TCP-based server, or + uunniixx:pathname:socketmap-name for a UNIX-domain server. In both cases + socketmap-name is the name of the socketmap. ssqqlliittee (read-only) Perform SQLite database lookups. Configuration details are given in sqlite_table(5). diff --git a/postfix/README_FILES/POSTSCREEN_README b/postfix/README_FILES/POSTSCREEN_README index fee091a25..650114a71 100644 --- a/postfix/README_FILES/POSTSCREEN_README +++ b/postfix/README_FILES/POSTSCREEN_README @@ -190,16 +190,23 @@ whitelist, postscreen(8) can implement a number of whitelist tests, before it grants the client a temporary whitelist status that allows it to talk to a Postfix SMTP server process. -By listening on both primary and backup MX addresses, postscreen(8) can deny -the temporary whitelist status to clients that connect only to backup MX hosts -(an old spammer trick to take advantage of backup MX hosts with weaker anti- -spam policies than primary MX hosts). +When postscreen(8) is configured to monitor all primary and backup MX +addresses, it can refuse to whitelist clients that connect to a backup MX +address only (an old spammer trick to take advantage of backup MX hosts with +weaker anti-spam policies than primary MX hosts). + + NOTE: The following solution is for small sites. Larger sites would have to + share the postscreen(8) cache between primary and backup MTAs, which would + introduce a common point of failure. * First, configure the host to listen on both primary and backup MX addresses. Use the appropriate ifconfig command for the local operating system, or update the appropriate configuration files and "refresh" the network protocol stack. + Second, configure Postfix to listen on the new IP address (this step is + needed when you have specified inet_interfaces in main.cf). + * Then, configure postscreen(8) to deny the temporary whitelist status on the backup MX address(es). An example for Wietse's server is: diff --git a/postfix/WISHLIST b/postfix/WISHLIST index 51cc7d047..177c81f0e 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -5,7 +5,15 @@ Wish list: Remove this file from the stable release. Things to do after the stable release: + + Connection cache protocol: avoid mixing mail streams + with different source IP address reputations. For example, + allow additional tags upon store operations that can be + specified in requests. + smtpd: make implicit sender/recipient checks play along + with defer_if_reject. + postscreen: in the dummy SMTP engine, log the protocol state at time of violation (like smtpd, set state->where initially to CONNECT, then update it with the name of the last "known" diff --git a/postfix/conf/master.cf b/postfix/conf/master.cf index dfc3eb002..849f1599b 100644 --- a/postfix/conf/master.cf +++ b/postfix/conf/master.cf @@ -17,13 +17,21 @@ smtp inet n - n - - smtpd # -o syslog_name=postfix/submission # -o smtpd_tls_security_level=encrypt # -o smtpd_sasl_auth_enable=yes -# -o smtpd_client_restrictions=permit_sasl_authenticated,reject +# -o smtpd_reject_unlisted_recipient=no +# -o smtpd_client_restrictions=$mua_client_restrictions +# -o smtpd_helo_restrictions=$mua_helo_restrictions +# -o smtpd_sender_restrictions=$mua_sender_restrictions +# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject # -o milter_macro_daemon_name=ORIGINATING #smtps inet n - n - - smtpd # -o syslog_name=postfix/smtps # -o smtpd_tls_wrappermode=yes # -o smtpd_sasl_auth_enable=yes -# -o smtpd_client_restrictions=permit_sasl_authenticated,reject +# -o smtpd_reject_unlisted_recipient=no +# -o smtpd_client_restrictions=$mua_client_restrictions +# -o smtpd_helo_restrictions=$mua_helo_restrictions +# -o smtpd_sender_restrictions=$mua_sender_restrictions +# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject # -o milter_macro_daemon_name=ORIGINATING #628 inet n - n - - qmqpd pickup fifo n - n 60 1 pickup diff --git a/postfix/html/DATABASE_README.html b/postfix/html/DATABASE_README.html index 20cd53acf..bf1447b01 100644 --- a/postfix/html/DATABASE_README.html +++ b/postfix/html/DATABASE_README.html @@ -370,6 +370,15 @@ created with the postmap(1) or +
socketmap (read-only)
+ +
Query a Sendmail-style socketmap server. The name of the table +specifies inet:host:port:socketmap-name +for a TCP-based server, or +unix:pathname:socketmap-name for a UNIX-domain +server. In both cases socketmap-name is the name of the +socketmap.
+
sqlite (read-only)
Perform SQLite database lookups. Configuration details are given diff --git a/postfix/html/POSTSCREEN_README.html b/postfix/html/POSTSCREEN_README.html index 1718f0e2d..d60f5aeff 100644 --- a/postfix/html/POSTSCREEN_README.html +++ b/postfix/html/POSTSCREEN_README.html @@ -249,12 +249,17 @@ or temporary whitelist, postscreen(8) can implem whitelist tests, before it grants the client a temporary whitelist status that allows it to talk to a Postfix SMTP server process.

-

By listening on both primary and backup MX addresses, postscreen(8) -can deny the temporary whitelist status to clients that connect -only to backup MX hosts (an old spammer trick to take advantage of -backup MX hosts with weaker anti-spam policies than primary MX +

When postscreen(8) is configured to monitor all primary and +backup MX addresses, it can refuse to whitelist clients that connect +to a backup MX address only (an old spammer trick to take advantage +of backup MX hosts with weaker anti-spam policies than primary MX hosts).

+

NOTE: The following solution is for small sites. +Larger sites would have to share the postscreen(8) cache between +primary and backup MTAs, which would introduce a common point of +failure.

+
+
socketmap (read-only)
+ +
Query a Sendmail-style socketmap server. The name of the table +specifies inet:host:port:socketmap-name +for a TCP-based server, or +unix:pathname:socketmap-name for a UNIX-domain +server. In both cases socketmap-name is the name of the +socketmap.
+
sqlite (read-only)
Perform SQLite database lookups. Configuration details are given diff --git a/postfix/proto/POSTSCREEN_README.html b/postfix/proto/POSTSCREEN_README.html index 2deaeafd6..a3fb9d025 100644 --- a/postfix/proto/POSTSCREEN_README.html +++ b/postfix/proto/POSTSCREEN_README.html @@ -249,12 +249,17 @@ or temporary whitelist, postscreen(8) can implement a number of whitelist tests, before it grants the client a temporary whitelist status that allows it to talk to a Postfix SMTP server process.

-

By listening on both primary and backup MX addresses, postscreen(8) -can deny the temporary whitelist status to clients that connect -only to backup MX hosts (an old spammer trick to take advantage of -backup MX hosts with weaker anti-spam policies than primary MX +

When postscreen(8) is configured to monitor all primary and +backup MX addresses, it can refuse to whitelist clients that connect +to a backup MX address only (an old spammer trick to take advantage +of backup MX hosts with weaker anti-spam policies than primary MX hosts).

+

NOTE: The following solution is for small sites. +Larger sites would have to share the postscreen(8) cache between +primary and backup MTAs, which would introduce a common point of +failure.

+