package: postfix A new upstream release (patch 6) is available for postfix 2.2.
CHANGES IN 2.2 PATCH LEVEL 6: 20050806 Workaround: accept(2) fails with EPROTO when the client already disconnected (SunOS 5.5.1). File: sane_accept.c. 20050815 Workaround: old Solaris compilers can't link an archive without globally visible symbols. File: tls/tls_misc.c. 20050825 Feature: message_reject_characters and message_strip_characters specify what characters in message content Postfix will reject or remove. Based on patch by John Fawcett. Files: cleanup/cleanup_message.c, cleanup/cleanup_init.c. Safety: when the cleanup server rejects the content of mail that is submitted with the Postfix sendmail command, or re-queued with "postsuper -r", strip the message body from the bounce message to reduce the risks from harmful content. Files: cleanup/cleanup_envelope.c, cleanup/cleanup_bounce.c. Feature: the smtpd_proxy_filter parameter value can now be prefixed with "unix:" (for UNIX-domain socket) and "inet:" (for TCP socket). TCP sockets are the default. Patch by Edwin Kremer. File: smtpd/smtpd_proxy.c. 20050828 Bugfix: after adding DSN support, error notification was broken for too large mail that was submitted with the Postfix sendmail command, forwarded by the local(8) delivery agent, or re-queued with "postsuper -r". The message would be saved to the "corrupt" queue. The mistake was to leave the truncated message in the incoming queue and to ask the queue manager to notify the sender; this was not possible because the queue manager cannot (and should not) handle truncated queue files. The fix is to have the cleanup server send the bounce message, just like it did before DSN support was added. As a side effect, Postfix will no longer send DSN_SUCCESS notices after virtual aliasing, when the cleanup server bounces all the recipients of the message anyway. This could be called a feature. File: cleanup/cleanup_bounce.c. Also needed for this fix: a new vstream_fpurge() routine that discards unread/written data from a VSTREAM. It's needed before cleanup_bounce() can seek to the start of the queue file after a file size error. File: util/vstream.c. 20050920 Cleanup: removed the legacy "tls_info" structure, factored out common code for peer_CN and issuer_CN lookup, and added sanity check to not verify subject common names that contain nulls or that are execessively long. Patch by Victor Duchovni. Files: tls_client.c, tls_server.c, tls_session.c, tls_misc.c, tls_verify.c. 20050922 Bugfix: the *SQL clients did not uniformly choose the database host from the available pool of servers due to an off-by-one error, so that the "last" available server was not selected. Leandro Santi. Files: dict_mysql.c, dict_pgsql.c. Update: common code factored out into db_common.c, and adoption of Liviu Daia's connection aware MySQL quoting. Patch by Victor Duchovni. Files: dict_ldap.c, dict_mysql.c, dict_pgsql.c, db_common.c. 20050923 Safety: don't update the local(8) delivery agent's idea of the Delivered-To: address while expanding aliases or .forward files. When an alias or .forward file changes the Delivered-To: address, it ties up one queue file and one cleanup process instance while mail is being forwarded. To get the old behavior, specify "frozen_delivered_to = no". Problem reported by Michael Tokarev, but found independently by others. Files: local/local.c, local/aliases.c, local/dotforward.c, local/mailbox.c, local/maildir.c. Logging: additional SASL debug logging by Andreas Winkelmann. Files: */*sasl_glue.c. 20050929 Paranoia: don't ignore garbage in SMTP or LMTP server replies when ESMTP command pipelining is turned on. For example, after sending ".<CR><LF>QUIT<CR><LF>", Postfix could recognize the server's 2XX QUIT reply as a 2XX END-OF-DATA reply after garbage, causing mail to be lost. The SMTP and LMTP clients now report a remote protocol error and defer delivery. Files: smtp/smtp_chat.c, smtp/smtp_trouble.c, lmtp/lmtp_chat.c, lmtp/lmtp_trouble.c. Performance: specify "smtpd_peername_lookup = no" to disable client hostname lookups in the SMTP server. All clients are treated as "unknown". This should be used only under extreme conditions where DNS lookup latencies are critical. File: smtpd/smtpd_peer.c. 20051010 Feature: smtpd_client_new_tls_session_rate_limit parameter to limit the number of new (i.e. uncached) TLS sessions that a remote SMTP client may negotiate per unit time. This feature, which is off by default, can limit the CPU load due to expensive crypto operations. Files: global/anvil_clnt.c, anvil/anvil.c, smtpd/smtpd.c. Cleanup: eliminated massive code duplication in the anvil server that resulted from adding similar features one at a time. File: anvil/anvil.c. 20051011 Bugfix: raise the "policy violation" flag when a client request exceeds a concurrency or rate limit. File: smtpd/smtpd.c. Bugfix (cut-and-paste error): don't reply with 421 (too many MAIL FROM or RCPT TO commands) when we aren't closing the connection. File: smtpd/smtpd.c. 20051012 Polishing: content of comments and sequence of code blocks in the anvil server, TLS request rate error message in the smtp server, and documentation, but no changes in code. Files: anvil/anvil.c, smtpd/smtpd.c. 20051013 Horror: some systems have basename() and dirname() and some don't; some implementations modify their input and some don't; and some implementations use a private buffer that is overwritten upon the next call. Postfix will use its own safer versions called sane_basename() and sane_dirname(). These never modify the input, and allow the caller to control how memory is allocated for the result. File: util/sane_basename.c. Feature: "sendmail -C path-to-main.cf" and "sendmail -C config_directory" now do what one would expect. File: sendmail/sendmail.c. Bugfix: don't do smtpd_end_of_data_restrictions after the transaction failed due to, e.g., a write error. File: smtpd/smtpd.c. Cleanup: the SMTP server now enforces the message_size_limit even when the client did not send SIZE information with the MAIL FROM command. This protects before-queue content filters against over-size messages. File: smtpd/smtpd.c. 20051017 Bugfix: after DSN support was added, smtp_skip_5xx_greeting no longer recognized a 5xx SMTP status as a 4xx one. Found by Ralf Hildebrandt. Fix: use the enhanced status code instead of the SMTP reply code to choose between permanent or transient errors. File: smtp/smtp_trouble.c. Feature: smtp-sink can hard-reject, soft-reject or simply drop connection requests. File: smtpstone/smtp-sink.c. Documentation: clarified the processing of server replies, specifically the reply code and the enhanced status code, in smtp_chat.c. 20051024 Performance: new smtp_connection_reuse_time_limit parameter to limit connection reuse by elapsed time, instead of limiting the number of deliveries per connection. Bounding by time favors delivery over connections that perform well, while bounding by number of deliveries allows slow connections to drag down the performance. Insight and initial implementation by Victor Duchovni, Morgan Stanley. Files: smtp_connect.c, smtp_session.c, Bugfix: the next-hop logical destination information for connection caching was reset only after a good non-TLS connection, so that cached connections to non-TLS backup servers could suck away traffic from TLS primary servers (the Postfix SMTP client cannot cache an open TLS connection). Found during code review. This is fixed with multi-valued connection caching state: expired, cachable, non-cachable, and bad. Files: smtp_connect.c, smtp_trouble.c. Bugfix: adding support for "sendmail -C" broke "sendmail -q". File: sendmail/sendmail.c. 20051101 Migration from a single "arrival time" stamp to a structure with time stamps from different stages of message delivery. The first iteration merely replaces "arrival time" stamps by a structure or pointer to structure, and uses only the arrival time field of that structure. This is an extensive but straightforward transformation, based on example by Victor Duchovni, Morgan Stanley. Files: anything that invokes bounce_append etc., the log_adhoc module, and anything that sends or receives a delivery request. 20051102 Completion of support for time stamps from different stages of message delivery. The information is now logged as "delays=a/b/c/d" where a=time before queue manager, including message transmission; b=time in queue manager; c=connection setup including DNS, HELO and TLS; d=message transmission time. Unlike Victor's example which used time differences, this implementation uses absolute times. The decision of what numbers to subtract actually depends on program history, so we want to do it in one place. Files: global/log_adhoc.c, smtp/smtp_connect.c, smtp/smtp_proto.c, smtp/smtp_trouble.c, lmtp/lmtp_proto.c, lmtp/lmtp_trouble.c. 20051103 Refinement of time stamping and delays formatting. The hand-off time is now stamped in the delivery agent, so that time is properly attributed when a transport is saturated or throttled. Delays are now logged if larger than 0.01 second. Files: *qmgr/qmgr_deliver.c, global/deliver_request.c, global/log_adhoc.c. 20051104 New parameter delay_logging_time_resolution (default: 10000 microseconds, or 0.01 second) that controls the detail in the new "delays=a/b/c/d" logging. Specify a power of 10 in the range from 1 to 100000. File: global/log_adhoc.c. Parameter renamed 20051108. 20051105 All delay logging now has sub-second resolution. This means updating all code that reads or updates the records that specify when mail arrived, and ensuring that mail submitted with older Postfix versions produces sensible results. Files: global/post_mail.c, global/mail_timeofday.[hc], global/log_adhoc.c, postdrop/postdrop.c, pickup/pickup.c, cleanup/cleanup_envelope.c, cleanup/cleanup_message.c, smtpd/smtpd.c, qmqpd/qmqpd.c, *qmgr/qmgr_message.c, *qmgr/qmgr_active.c, local/forward.c. 20051106 The SMTP client logs the remote server port in the form of relay=hostname[hostaddr]:port to the local maillog file. The port number is NOT included in DSN status reports, because remote users have no need to know such internal information. Files: smtp/smtp_session.c, smtp/smtp_proto.c, smtp/smtp_trouble.c. Cleanup: encapsulated queue file time read/write operations with a few simple macros, to make future changes in time representation less painful. 20051108 Cleanup: eliminated floating point operations from the ad-hoc delay logging code. Files: util/format_tv.[hc], global/log_adhoc.c. The delay logging resolution is now controlled with the delay_logging_resolution_limit parameter, which specifies the maximal number of digits after the decimal point. Bugfix: two messages could get the same message ID due to a race condition. This time window was increased when queue file creation was postponed from MAIL FROM until the first accepted RCPT TO. The window is closed again. Found by Victor. Files: global/mail_stream.c, global/mail_queue.c, cleanup/cleanup_message.c. 20051109 qshape.pl updated for extra microsecond time field in Postfix queue files. Cleanup: removed obsolete code that handles rejected/dropped connections before the HELO handshake. File: smtp/smtp_connect.c. Bugfix: XCLIENT broke when reverse hostname support was added. Fix by Tomoyuki Sakurai. File: smtpd/smtpd.c. 20051110 Workaround: don't set the delay warning timer for messages from inside or from outside that have the null sender as recipient. This was a waste of time, because the warning would always be discarded. File: cleanup/cleanup_envelope.c. Feature: the built-in mail delivery status notification text is now implemented by built-in templates. Files: bounce/bounce_template.c, bounce/bounce_notify_util.c. 20051112 Feature: configurable bounce message templates based on contribution by Nicolas Riendeau. I kept the general format of his templates, but placed them together in one file to reduce process initialization overhead (most requests to the bounce daemon are not for sending bounce messages). Files: bounce/bounce_template.c, bounce/dict_ml.c (to be moved to library if useful enough). A sample bounce message template file is installed as $config_directory/bounce.cf.default. 20051113 Feature: "postconf -b filename" to preview the non-default bounce message templates with $name expansions in the text. The actual work is of course done by the bounce daemon. 20051114 Feature: -V option to make Postfix daemons to log to stderr. This is used when a daemon is invoked in stand-alone mode by a (non-daemon) command. Feature: "postconf -t" displays DSN templates, headers and all; use postconf -t ''" to view built-ins. Cleanup: renamed fail_template into failure_template. 20051117 Cleanup: bounce template code reorg, no functionality change. Files: bounce/bounce_template.[hc], bounce/bounce_templates.c, bounce/bounce_notify_util.c. 20051118 Bugfix: new bounce template code did not return after template syntax error. File: bounce/bounce_template.c Safety: permit_mx_backup now requires that the local MTA is not listed as primary MX for the recipient domain. This prevents mail loops when someone points the primary MX record to Postfix. 20051119 Workaround: some SMTP servers announce multiple but different lists of SASL methods. Postfix now concatenates the lists instead of logging a warning and remembering only one. File: smtp/smtp_sasl_proto.c. Bugfix: the queue manager did not write a per-recipient defer logfile record when the delivery agent crashed between receiving a delivery request, and reporting the delivery status to the queue manager. Found while redesigning the code that handles unavailable transports or destinations. Files: *qmgr/qmgr_deliver.c. 20051121 Workaround: do not build the bounce.cf.default template while compiling Postfix - it breaks when the default mail_owner etc. accounts don't exist. Reported by Liviu Daia. Compatibility: added permit_auth_destination emulation to the permit_mx_backup feature. This avoids surprises with sites that used permit_mx_backup to authorize all their incoming mail. 20051122-24 Feature: sender_dependent_relayhost_maps, lookup tables that specify a sender-dependent override for the relayhost parameter setting. The lookup is done in the trivial-rewrite server, instead of the queue manager where it does not belong. Files: global/resolve_clnt.c, global/tok822_resolve.c, trivial-rewrite/resolve.c, trivial-rewrite/transport.c, *qmgr/qmgr_message.c. Also: address_verify_sender_dependent_relayhost_maps for completeness. 20051124 Feature: specify "smtp_sender_dependent_authentication = yes" to enable sender-dependent SASL passwords. This disables SMTP connection caching to ensure that mail from different senders is delivered with the appropriate credentials. This is an extended version of a patch by Mathias Hasselmann. Files: smtp/smtp_connect.c, smtp/smtp_sasl_glue.c. 20051126 Workaround: log warning when REDIRECT or FILTER are used in smtpd_end_of_data_restrictions. File: smtpd/smtpd_check.c. Log warning when REDIRECT, FILTER, HOLD and DISCARD are used in smtpd_etrn_restrictions. File: smtpd/smtpd_check.c. 20051128 Bugfix: moved code around from one place to another to make REDIRECT, FILTER, HOLD and DISCARD access(5) table actions work in smtpd_end_of_data_restrictions. PREPEND will not be fixed; it must be specified before the message content is received. Files: smtpd/smtpd.c, smtpd/smtpd_check.c, cleanup/cleanup_extracted.c, pickup/pickup.c. Safety: abort if the SMTP or QMQP server runs with non-postfix privileges while it's connected to the network. Files: smtpd/smtpd_peer.c, qmqpd/qmqpd_peer.c. 20051201 Bugfix: the LMTP client would reuse a session after negative reply to the RSET command (which may happen when client and server somehow get out of sync). Problem found by Christian Theune. Files: lmtp/lmtp.c, lmtp/lmtp_proto.c. 20051202 Bugfix: the 20051128 code move for "smtpd_end_of_data_restrictions" broke "postsuper -r". Open problems: "postsuper -r" no longer resets the message arrival time, because pickup(8) no longer overrides queue file time stamp information. This can be a problem when mail "on hold" is released after a long time. Is it safe to cache a connection after it has been used for more than some number of address verification probes? Access map actions such as FILTER and REDIRECT don't work in smtpd_end_of_data_restrictions (or anything else that generates additional queue file records after the message content is stored). Try to recognize that Resent- headers appear in blocks, newest block first. But don't break on incorrect header block organization. Hard limits on cache sizes (anvil, specifically). Laptop friendliness: make the qmgr remember when the next deferred queue scan needs to be done, and have the pickup server stat() the maildrop directory before searching it. Mapping from errno to diagnostic text. Or do we just slap an SMTP code in front of what is now reported as X-Postfix. Or do we punt the issue and issue X-Postfix for all errors except SMTP? Low: replace_sender/replace_recipient actions in access maps? Feature: need "soft-bounce before fall-back relay" for SOHO type operations, so they can send direct mail without having to route everything through a provider. Med: disable header address rewriting after XCLIENT? Introduce a better concept of original submission? Low: configurable order of local(8) delivery methods. Med: local and remote source port and IP address for smtpd policy hook. Med: smtp_connect_timeout_budget (default: 3x smtp_connect_timeout) to limit the total time spent trying to connect. Med: transform IPv4-in-IPv6 address literals to IPv4 form when comparing against local IP addresses? Med: transform IPv4-in-IPv6 address literals to IPv4 form when eliminating MX mailer loops? Med: Postfix requires [] around IPv6 address information in match lists such as mynetworks, debug_peer_list etc., but the [] must not be specified in access(5) maps. Other places don't care. For now, this gotcha is documented in IPV6_README and in postconf(5) with each feature that may use IPv6 address information. The general recommendation is not to use [] unless absolutely necessary. Med: the partial address matching of IPv6 addresses in access(5) maps is a bit lame: it repeatedly truncates the last ":octetpair" from the printable address representation until a match is found or until truncation is no longer possible. Since one or more ":" are usually omitted from the printable IPv6 address representation, this does not really try all the possibilities that one might expect to be tried. For now, this gotcha is documented in access(5). Med: the TLS certificate verification depth parameters never worked. Med: eliminate the tls_info data structure. Low: reject HELO with any domain name or IP address that this MTA is the final destination for. Low: should the Delivered-To: test in local(8) be configurable? Low: make mail_addr_find() lookup configurable. Low: update events.c so that 1-second timer requests do not suffer from rounding errors. This is needed for 1-second SMTP session caching time limits. A 1-second interval would become arbitrarily short when an event is scheduled just before the current second rolls over. Low: configurable internal/system locking method. Low: make sure CCARGS -I options come at the end. Low: add INSTALL section for pre-existing Postfix systems. Low: add INSTALL section for pre-existing RPM Postfixes. Low: disallow smtpd_recipient_limit < 100 (the RFC minimum). Low: noise filter: allow smtp(8) to retry immediately if all MXes return a quick ECONNRESET or 4xx reply during the initial handshake. Retry once? How many times? Low: make post-install a "postfix-only script" so it can take data from the environment instead of main.cf. Low: randomize deferred mail backoff. Med: separate ulimit for delivery to command? Med: option to open queue file early, after MAIL FROM. This would allow correlation of rejected RCPT TO requests with accepted requests for the same mail transaction. Med: silly queue file bit so that the queue manager doesn't skip files when fast flush is requested while a queue scan is in progress. The bit is set by the flush server and is reset when the mail is deferred, so that it survives queue manager restart. It's not clear, however, how one would unthrottle disabled transports or queues. Med: postsuper -r should do something with recipients in bounce logfiles, to make sure the sender will be notified. To be perfectly safe, no process other than the queue manager should move a queue file from the active queue. Low: postsuper re-run after renaming files, but only a limited number of times. Low: smtp-source may block when sending large test messages. Med: make qmgr recipient bounce/defer activity asynchronous or add a multi-recipient operation that reduces overhead. One possibility is to pass delivery requests to a retry(8) delivery agent which is error(8) in disguise, and which calls defer_append() instead of bounce_append(). Low: postmap/postalias should not try to open a bogus file when given an unsupported dictionary type. Med: find a way to log the sender address when MAIL FROM is rejected due to lack of disk space. Low: revise other local delivery agent duplicate filters. Low: all table lookups should consistently use internalized (unquoted) or externalized (quoted) forms as lookup keys. smtpd, qmgr, local, etc. use unquoted address forms as keys. cleanup uses quoted forms. Low: have a configurable list of errno values for mailbox or maildir delivery that result in deferral rather than bouncing mail. Low: after reorganizing configuration parameters, add flags to all parameters whose value can be read from file. Medium: need in-process caching for map lookups. LDAP servers seem to need this in particular. Need a way to expire cached results that are too old. Low: generic showq protocol, to allow for more intelligent processing than just mailq. Maybe marry this with postsuper. Low: default domain for appending to unqualified recipients, so that unqualified names can be delivered locally. Low: The $process_id_directory setting is not used anywhere in Postfix. Problem reported by Michael Smith, texas.net. This should be documented, or better, the code should warn about attempts to set read-only parameters. Low: postconf -e edits parameters that postconf won't list. Low: while converting 8bit text to quoted-printable, perhaps use =46rom to avoid having to produce >From when delivering to mailbox. virtual_mailbox_path expression like forward_path, so that people can specify prefix and suffix. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
