From: Wietse Venema Date: Tue, 2 May 2017 05:00:00 +0000 (-0500) Subject: postfix-3.3-20170502 X-Git-Tag: v3.3.0-RC1~26 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5195b24cee635ccedf47da4b102d81ae9bfd83ba;p=thirdparty%2Fpostfix.git postfix-3.3-20170502 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index 3b7a72b5b..f7f806d8e 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -22923,7 +22923,7 @@ Apologies for any names omitted. 20170206 - Bugfix (introduced: Postfix 3.0): when check_mumble_a_access + Bugfix (introduced: Postfix 3.0): check_mumble_a_access did not handle [ipaddress], unlike check_mumble_mx_access. When check_mumble_a_access was introduced, some condition was not updated. Reported by James (postfix_tracker). File: @@ -22942,3 +22942,30 @@ Apologies for any names omitted. Cleanup: typofixes from klemens. The only change in compiled code is in one identical mysql error message that also appears in the pgsql client. Files: about 50. + +20170221 + + Compatibility fix (introduced: Postfix 3.1): some Milter + applications do not recognize macros sent as {name} when macros + have single-character names. Postfix now sends such macros + without {} as it has done historically. Viktor Dukhovni. File: + milter/milter.c. + +20170228 + + Documentation: re-word scary warnings at the top of SASL_README + and TLS_README. + +20170402 + + Bugfix (introduced: Postfix 3.2): restore the SMTP server + receive override options at the end of an SMTP session, + after the options may have been modified by an smtpd_milter_maps + setting of "DISABLE". Problem report by Christian Rößner, + root cause analysis by Viktor Dukhovni. File: smtpd/smtpd.c. + +20170430 + + Safety net: append a null byte to vstring buffers, so that + C-style string operations won't scribble past the end. File: + vstring.[hc]. diff --git a/postfix/INSTALL b/postfix/INSTALL index f2a38d314..10e69408c 100644 --- a/postfix/INSTALL +++ b/postfix/INSTALL @@ -612,7 +612,7 @@ The following is an extensive list of names and values. |_______________________________|_____________________________________________| | |Specifies options for the postfix-install | |POSTFIX_INSTALL_OPTS=-option...|command, separated by whitespace. Currently, | -| |the only supported option is "-keep-new- | +| |the only supported option is "-keep-build- | | |mtime". | |_______________________________|_____________________________________________| | |Specifies non-default compiler options for | diff --git a/postfix/README_FILES/INSTALL b/postfix/README_FILES/INSTALL index c0168593f..14e61caf0 100644 --- a/postfix/README_FILES/INSTALL +++ b/postfix/README_FILES/INSTALL @@ -612,7 +612,7 @@ The following is an extensive list of names and values. |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ | | |Specifies options for the postfix-install | |POSTFIX_INSTALL_OPTS=-option...|command, separated by whitespace. Currently, | -| |the only supported option is "-keep-new- | +| |the only supported option is "-keep-build- | | |mtime". | |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ | | |Specifies non-default compiler options for | diff --git a/postfix/README_FILES/SASL_README b/postfix/README_FILES/SASL_README index c4b22a2e6..0c4248038 100644 --- a/postfix/README_FILES/SASL_README +++ b/postfix/README_FILES/SASL_README @@ -2,14 +2,6 @@ PPoossttffiixx SSAASSLL HHoowwttoo ------------------------------------------------------------------------------- -WWaarrnniinngg - -People who go to the trouble of installing Postfix may have the expectation -that Postfix is more secure than some other mailers. The Cyrus SASL library -contains a lot of code. With this, Postfix becomes as secure as other mail -systems that use the Cyrus SASL library. Dovecot provides an alternative that -may be worth considering. - HHooww PPoossttffiixx uusseess SSAASSLL aauutthheennttiiccaattiioonn SMTP servers need to decide whether an SMTP client is authorized to send mail @@ -30,6 +22,12 @@ configuration files will belong to Postfix, while other configuration files belong to the specific SASL implementation that Postfix will use. This document covers both the Postfix and non-Postfix configuration. +NOTE: People who go to the trouble of installing Postfix may have the +expectation that Postfix is more secure than some other mailers. The Cyrus SASL +library contains a lot of code. With this, Postfix becomes as secure as other +mail systems that use the Cyrus SASL library. Dovecot provides an alternative +that may be worth considering. + You can read more about the following topics: * Configuring SASL authentication in the Postfix SMTP server diff --git a/postfix/README_FILES/TLS_README b/postfix/README_FILES/TLS_README index 8a328b262..15b5e52c3 100644 --- a/postfix/README_FILES/TLS_README +++ b/postfix/README_FILES/TLS_README @@ -2,25 +2,17 @@ PPoossttffiixx TTLLSS SSuuppppoorrtt ------------------------------------------------------------------------------- -WWAARRNNIINNGG - -By turning on TLS support in Postfix, you not only get the ability to encrypt -mail and to authenticate remote SMTP clients or servers. You also turn on -thousands and thousands of lines of OpenSSL library code. Assuming that OpenSSL -is written as carefully as Wietse's own code, every 1000 lines introduce one -additional bug into Postfix. - WWhhaatt PPoossttffiixx TTLLSS ssuuppppoorrtt ddooeess ffoorr yyoouu Transport Layer Security (TLS, formerly called SSL) provides certificate-based authentication and encrypted sessions. An encrypted session protects the information that is transmitted with SMTP mail or with SASL authentication. - NOTE: This document describes a TLS user interface that was introduced - with Postfix version 2.3. Support for an older user interface is documented - in TLS_LEGACY_README, which also describes the differences between Postfix - and the third-party patch on which Postfix version 2.2 TLS support was - based. +NOTE: By turning on TLS support in Postfix, you not only get the ability to +encrypt mail and to authenticate remote SMTP clients or servers. You also turn +on hundreds of thousands of lines of OpenSSL library code. Assuming that +OpenSSL is written as carefully as Wietse's own code, every 1000 lines +introduce one additional bug into Postfix. Topics covered in this document: diff --git a/postfix/WISHLIST b/postfix/WISHLIST index 23db493c9..a6de35407 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -6,6 +6,10 @@ Wish list: Disable -DSNAPSHOT and -DNONPROD in makedefs. + Merge in the code to relax smtp_mx_address_limit if 'strict' + enforcement would result in the elimination of one IP address + family. + Convert postalias(1) to store external-form keys, and convert aliases(5) to perform external-first lookup with fallback to internal form, to make it consistent with the rest of Postfix. @@ -15,6 +19,9 @@ Wish list: In the bounce daemon, set util_utf8_enable if returning an SMTPUTF8 message. + Merge in the code to check database client configuration + files for unknown or duplicate settings. + Add a header_body_checks extension callback in smtp_proto.c that implements the PASS action. diff --git a/postfix/html/INSTALL.html b/postfix/html/INSTALL.html index 016ea8221..2ee35cdf9 100644 --- a/postfix/html/INSTALL.html +++ b/postfix/html/INSTALL.html @@ -883,7 +883,7 @@ Specify OPT= to turn off optimization. POSTFIX_INSTALL_OPTS=-option... Specifies options for the postfix-install command, separated by whitespace. Currently, the only supported option is -"-keep-new-mtime". +"-keep-build-mtime". SHLIB_CFLAGS=flags Specifies non-default compiler options for building Postfix dynamically-linked diff --git a/postfix/html/SASL_README.html b/postfix/html/SASL_README.html index bc5311fa7..4b1290223 100644 --- a/postfix/html/SASL_README.html +++ b/postfix/html/SASL_README.html @@ -15,15 +15,6 @@
-

Warning

- -

People who go to the trouble of installing Postfix may have the -expectation that Postfix is more secure than some other mailers. -The Cyrus SASL library contains a lot of code. With this, Postfix -becomes as secure as other mail systems that use the Cyrus SASL -library. Dovecot provides an alternative that may be worth -considering.

-

How Postfix uses SASL authentication

SMTP servers need to decide whether an SMTP client is authorized @@ -47,6 +38,13 @@ configuration files belong to the specific SASL implementation that Postfix will use. This document covers both the Postfix and non-Postfix configuration.

+

NOTE: People who go to the trouble of installing Postfix may +have the expectation that Postfix is more secure than some other +mailers. The Cyrus SASL library contains a lot of code. With this, +Postfix becomes as secure as other mail systems that use the Cyrus +SASL library. Dovecot provides an alternative that may be worth +considering.

+

You can read more about the following topics: