diff options
| author | christos <christos@NetBSD.org> | 2022-10-08 16:08:59 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2022-10-08 16:08:59 +0000 |
| commit | 281658b6bfa0a8ac5a4659b5717a08d266d07a18 (patch) | |
| tree | 373f844827d20f00322de3f7978dca166380045d /external/ibm-public | |
| parent | 28ff0a710fe4355dc655e09e94a85051b96b45ae (diff) | |
Import Postfix-3.7.3 (previous version was 3.5.2)
This is the Postfix 3.7 (stable) release.
The stable Postfix release is called postfix-3.7.x where 3=major
release number, 7=minor release number, x=patchlevel. The stable
release never changes except for patches that address bugs or
emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called
postfix-3.8-yyyymmdd where yyyymmdd is the release date (yyyy=year,
mm=month, dd=day). Patches are never issued for snapshot releases;
instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd)
specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 3.5 or earlier, read RELEASE_NOTES-3.6
before proceeding.
License change
---------------
This software is distributed with a dual license: in addition to the
historical IBM Public License 1.0, it is now also distributed with the
more recent Eclipse Public License 2.0. Recipients can choose to take
the software under the license of their choice. Those who are more
comfortable with the IPL can continue with that license.
Bugfix for messages not delivered after "warning: Unexpected record type 'X'
============================================================================
Due to a bug introduced in Postfix 3.7.0, a message could falsely
be flagged as corrupt with "warning: Unexpected record type 'X'".
Such messages were moved to the "corrupt" queue directory, where
they may still be found. See below for instructions to deal with
these falsely flagged messages.
This could happen for messages with 5000 or more recipients, or
with fewer recipients on a busy mail server. The problem was first
reported by Frank Brendel, reproduced by John Alex.
A file in the "corrupt" queue directory may be inspected with the
command "postcat /var/spool/postfix/corrupt/<filename>. If delivery
of the file is still desired, the file can be moved back to
/var/spool/postfix/incoming after updating Postfix and executing
"postfix reload".
Major changes - configuration
-----------------------------
[Feature 20210605] Support to inline the content of small cidr:,
pcre:, and regexp: tables in Postfix parameter values.
Example:
smtpd_forbidden_commands =
CONNECT GET POST regexp:{{/^[^A-Z]/ Thrash}}
This is the new smtpd_forbidden_commands default value. It will
immediately disconnect a remote SMTP client when a command does not
start with a letter (a-z or A-Z).
The basic syntax is:
/etc/postfix/main.cf:
parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } ..
/etc/postfix/master.cf:
.. -o { parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. } ..
where map-type is one of cidr, pcre, or regexp.
Postfix ignores whitespace after '{' and before '}', and writes each
rule as one text line to a nameless in-memory file:
in-memory file:
rule-1
rule-2
..
Postfix parses the result as if it is a file in /etc/postfix.
Note: if a rule contains $, specify $$ to keep Postfix from trying
to do $name expansion as it evaluates the parameter value.
Major changes - lmdb support
----------------------------
[Feature 20210605] Overhauled the LMDB client's error handling, and
added integration tests for future-proofing. There are no visible
changes in documented behavior.
Major changes - logging
-----------------------
[Feature 20210815] To make the maillog_file feature more useful,
the postlog(1) command is now set-gid postdrop, so that unprivileged
programs can use it to write logging through the postlogd(8) daemon.
This required hardening the postlog(1) command against privilege
escalation attacks. DO NOT turn on the set-gid bit with older
postlog(1) implementations.
Major changes - pcre2 support
-----------------------------
[Feature 20211127] Support for the pcre2 library (the legacy pcre
library is no longer maintained). The Postfix build procedure
automatically detects if the pcre2 library is installed, and if it
is unavailable, the Postfix build procedure will detect if the
legacy pcre library is installed. See PCRE_README if you need to
build Postfix with a specific library.
Visible differences: some error messages may have a different text,
and the 'X' pattern flag is no longer supported with pcre2.
Major changes - security
------------------------
[Feature 20220102] Postfix programs now randomize the initial state
of in-memory hash tables, to defend against hash collision attacks
involving a large number of attacker-chosen lookup keys. Presently,
the only known opportunity for such attacks involves remote SMTP
client IPv6 addresses in the anvil(8) service. The attack would
require making hundreds of short-lived connections per second from
thousands of different IP addresses, because the anvil(8) service
drops inactive counters after 100s. Other in-memory hash tables
with attacker-chosen lookup keys are by design limited in size. The
fix is cheap, and therefore implemented for all Postfix in-memory
hash tables. Problem reported by Pascal Junod.
[Feature 20211030] The postqueue command now sanitizes non-printable
characters (such as newlines) in strings before they are formatted
as json or as legacy output. These outputs are piped into other
programs that are run by administrative users. This closes a
hypothetical opportunity for privilege escalation.
[Feature 20210815] Updated defense against remote clients or servers
that 'trickle' SMTP or LMTP traffic, based on per-request deadlines
and minimum data rates.
Per-request deadlines:
The new {smtpd,smtp,lmtp}_per_request_deadline parameters replace
{smtpd,smtp,lmtp}_per_record_deadline, with backwards compatible
default settings. This defense is enabled by default in the Postfix
SMTP server in case of overload.
The new smtpd_per_record_deadline parameter limits the combined
time for the Postfix SMTP server to receive a request and to send
a response, while the new {smtp,lmtp}_per_record_deadline parameters
limit the combined time for the Postfix SMTP or LMTP client to send
a request and to receive a response.
Minimum data rates:
The new smtpd_min_data_rate parameter enforces a minimum plaintext
data transfer rate for DATA and BDAT requests, but only when
smtpd_per_record_deadline is enabled. After a read operation transfers
N plaintext bytes (possibly after TLS decryption), and after the
DATA or BDAT request deadline is decreased by the elapsed time of
that read operation, the DATA or BDAT request deadline is increased
by N/smtpd_min_data_rate seconds. However, the deadline is never
increased beyond the smtpd_timeout value. The default minimum data
rate is 500 (bytes/second) but is still subject to change.
The new {smtp,lmtp}_min_data_rate parameters enforce the corresponding
minimum DATA transfer rates for the Postfix SMTP and LMTP client.
Major changes - tls support
---------------------------
[Cleanup 20220121] The new tlsproxy_client_security_level parameter
replaces tlsproxy_client_level, and the new tlsproxy_client_policy_maps
parameter replaces tlsproxy_client_policy. This is for consistent
parameter naming (tlsproxy_client_xxx corresponds to smtp_tls_xxx).
This change was made with backwards-compatible default settings.
[Feature 20210926] Postfix was updated to support OpenSSL 3.0.0 API
features, and to work around OpenSSL 3.0.0 bit-rot (avoid using
deprecated API features).
Other code health
-----------------
[typos] Typo fixes by raf.
[pre-release checks] Added pre-release checks to detect a) new typos
in documentation and source-code comments, b) missing entries in
the postfix-files file (some documentation would not be installed),
c) missing rules in the postlink script (some text would not have
a hyperlink in documentation), and d) missing map-based $parameter
names in the proxy_read_maps default value (the proxymap daemon
would not automatically authorize some proxied maps).
[memory stream] Improved support for memory-based streams made it
possible to inline small cidr:, pcre:, and regexp: maps in Postfix
parameter values, and to eliminate some ad-hoc code that converted
tlsproxy(8) protocol data to or from serialized form.
*************************************************************************
This is the Postfix 3.6 (stable) release.
The stable Postfix release is called postfix-3.6.x where 3=major
release number, 6=minor release number, x=patchlevel. The stable
release never changes except for patches that address bugs or
emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called
postfix-3.7-yyyymmdd where yyyymmdd is the release date (yyyy=year,
mm=month, dd=day). Patches are never issued for snapshot releases;
instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd)
specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 3.4 or earlier, read RELEASE_NOTES-3.5
before proceeding.
License change
---------------
This software is distributed with a dual license: in addition to the
historical IBM Public License 1.0, it is now also distributed with the
more recent Eclipse Public License 2.0. Recipients can choose to take
the software under the license of their choice. Those who are more
comfortable with the IPL can continue with that license.
Major changes - internal protocol identification
------------------------------------------------
[Incompat 20200920] Internal protocols have changed. You need to
"postfix stop" before updating, or before backing out to an earlier
release, otherwise long-running daemons (pickup, qmgr, verify, tlsproxy,
postscreen) may fail to communicate with the rest of Postfix, causing
mail delivery delays until Postfix is restarted.
This change does not affect message files in Postfix queue directories,
only the communication between running Postfix programs.
With this change, every Postfix internal service, including the postdrop
command, announces the name of its protocol before doing any other I/O.
Every Postfix client program, including the Postfix sendmail command,
will verify that the protocol name matches what it is supposed to be.
The purpose of this change is to produce better error messages, for
example, when someone configures the discard daemon as a bounce
service in master.cf, or vice versa.
This change may break third-party programs that implement a
Postfix-internal protocol such as qpsmtpd. Such programs have never
been supported. Fortunately, this will be an easy fix: look at the
first data from the cleanup daemon: if it is a protocol announcement,
you're talking to Postfix 3.6 or later. That's the only real change.
Major changes - tls
-------------------
[Incompat 20200705] The minimum supported OpenSSL version is 1.1.1,
which will reach the end of life by 2023-09-11. Postfix 3.6 is
expected to reach the end of support in 2025. Until then, Postfix
will be updated as needed for compatibility with OpenSSL.
The default fingerprint digest has changed from md5 to sha256 (Postfix
3.6 with compatibility_level >= 3.6). With a lower compatibility_level
setting, Postfix defaults to using md5, and logs a warning when a Postfix
configuration specifies no explicit digest type.
Export-grade Diffie-Hellman key exchange is no longer supported,
and the tlsproxy_tls_dh512_param_file parameter is ignored,
[Feature 20200906] The tlstype.pl helper script by Viktor Dukhovni
reports TLS information per message delivery. This processes output
from the collate.pl script. See auxiliary/collate/README.tlstype and
auxiliary/collate/tlstype.pl.
Major changes - compatibility level
-----------------------------------
[Feature 20210109] Starting with Postfix version 3.6, the compatibility
level is "3.6". In future Postfix releases, the compatibility level will
be the Postfix version that introduced the last incompatible change. The
level is formatted as 'major.minor.patch', where 'patch' is usually
omitted and defaults to zero. Earlier compatibility levels are 0, 1 and 2.
This also introduces main.cf and master.cf support for the <=level,
<level, and other operators to compare compatibility levels. With the
standard <=, <, etc. operators, compatibility level 3.10 would be less
than 3.9, which is undesirable.
Major changes - services(5) override
------------------------------------
[Feature 20210418] Postfix no longer uses the services(5) database
to look up the TCP ports for SMTP and LMTP services. Instead, this
information is configured with the new known_tcp_ports configuration
parameter (default: lmtp=24, smtp=25, smtps=submissions=465,
submission=587). When a service is not specified in known_tcp_ports,
Postfix will still query the services(5) database.
Major changes - local_login_sender_maps
---------------------------------------
[Feature 20201025] Fine-grained control over the envelope sender address
for submission with the Postfix sendmail (or postdrop) commands.
The local_login_sender_maps parameter (default: static:*) specifies
a list of lookup tables that are searched by the UNIX login name, and
that return a list of allowed envelope sender patterns separated by
space or comma. The default is backwards-compatible: every user may
specify any sender envelope address.
This feature is enforced by the postdrop command. When no UNIX login
name is available, the postdrop command will prepend "uid:" to the
numerical UID and use that instead.
This feature ignores address extensions in the user-specified
envelope sender address.
Besides the special pattern "*" which allows any sender address,
there are "<>" which matches an empty sender address, and the
"@domain" wildcard pattern. More information about those can be found
in the postconf(5) manpage.
Example:
/etc/postfix/main.cf:
# Allow root and postfix full control, anyone else can only
# send mail as themselves. Use "uid:" followed by the numerical
# UID when the UID has no entry in the UNIX password file.
local_login_sender_maps =
inline:{ { root = *}, { postfix = * } },
pcre:/etc/postfix/login_senders
/etc/postfix/login_senders:
# Allow both the bare username and the user@domain forms.
/(.+)/ $1 $1@example.com
Major changes - order of relay and recipient restrictions
---------------------------------------------------------
[Incompat 20210131] With smtpd_relay_before_recipient_restrictions=yes,
the Postfix SMTP server will evaluate smtpd_relay_restrictions before
smtpd_recipient_restrictions. This is the default behavior with
compatibility_level >= 3.6.
This change makes the implemented behavior consistent with existing
documentation. There is a backwards-compatibility warning that allows
users to freeze historical behavior. See COMPATIBILITY_README for
details.
Major changes - respectful logging
----------------------------------
[Feature 20210220] Postfix version 3.6 deprecates terminology
that implies white is better than black. Instead, Postfix prefers
'allowlist', 'denylist', and variations on those words. This change
affects Postfix documentation, and postscreen parameters and logging.
To keep the old postscreen logging set "respectful_logging = no"
in main.cf.
Noel Jones assisted with the initial transition.
Changes in documentation
------------------------
Postfix documentation was updated to use 'allowlist', 'denylist', etc.
These documentation changes do not affect Postfix behavior.
Changes in parameter names
--------------------------
The following postscreen parameters replace names that contain 'blacklist'
or 'whitelist':
postscreen_allowlist_interfaces
postscreen_denylist_action
postscreen_dnsbl_allowlist_threshold
These new parameters have backwards-compatible default settings
that support the old parameter names, so that the name change should
not affect Postfix behavior. This means that existing management tools
that use the old parameter names should keep working as before.
This compatibility safety net may break when some management tools
use the new parameter names, and some use the old names, such that
different tools will disagree on how Postfix works.
Changes in logging
------------------
The following logging replaces forms that contain 'blacklist' or
'whitelist':
postfix/postscreen[pid]: ALLOWLIST VETO [address]:port
postfix/postscreen[pid]: ALLOWLISTED [address]:port
postfix/postscreen[pid]: DENYLISTED [address]:port
To avoid breaking logfile analysis tools, Postfix keeps logging the old
forms by default, as long as the compatibility_level parameter setting
is less than 3.6, and the respectful_logging parameter is not explicitly
configured. As a reminder, Postfix will log the following:
postfix/postscreen[pid]: Using backwards-compatible default setting
respectful_logging=no for client [address]:port
To keep logging the old form, make the setting "respectful_logging =
no" permanent in main.cf, for example:
# postconf "respectful_logging = no"
# postfix reload
To stop the reminder, configure the respectful_logging parameter to
"yes" or "no", or configure "compatibility_level = 3.6".
Major changes - threaded bounces
--------------------------------
[Feature 20201205] Support for threaded bounces. This allows mail
readers to present a non-delivery, delayed delivery, or successful
delivery notification in the same email thread as the original
message.
Unfortunately, this also makes it easy for users to mistakenly delete
the whole email thread (all related messages), instead of deleting
only the delivery status notification.
To enable, specify "enable_threaded_bounces = yes".
Other changes - smtpd_sasl_mechanism_list
-----------------------------------------
[Feature 20200906] The smtpd_sasl_mechanism_list parameter (default:
!external, static:rest) prevents confusing errors when a SASL backend
announces EXTERNAL support which Postfix does not support.
Other changes - delivery logging
--------------------------------
[Incompat 20200531] Postfix delivery agents now log an explicit record
when delegating delivery to a different Postfix delivery agent.
For example, with "best_mx_transport = local", an SMTP delivery
agent will now log when a recipient will be delivered locally. This
makes the delegating delivery agent visible, where it would otherwise
have remained invisible, which would complicate troubleshooting.
postfix/smtp[pid]: queueid: passing <recipient> to transport=local
This will usually be followed by logging for an actual delivery:
postfix/local[pid]: queueid: to=<recipient>, relay=local, ...
Other examples: the local delivery agent will log a record that it
defers mailbox delivery through mailbox_transport or through
fallback_transport.
Other changes - error logging
-----------------------------
[Incompat 20200531] Postfix programs will now log "Application error"
instead of "Success" or "Unknown error: 0" when an operation fails with
errno == 0, i.e., the error originates from non-kernel code.
Other changes - dns lookups
---------------------------
[Feature 20200509] The threadsafe resolver API (res_nxxx() calls)
is now the default, not because the API is threadsafe, but because
this is the API where new features are being added.
To build old style, build with:
make makefiles CCARGS="-DNO_RES_NCALLS..."
This is the default for systems that are known not to support the
threadsafe resolver API.
Diffstat (limited to 'external/ibm-public')
475 files changed, 21581 insertions, 4669 deletions
diff --git a/external/ibm-public/postfix/dist/HISTORY b/external/ibm-public/postfix/dist/HISTORY index 5b806f7f98b..f95aa3be4e5 100644 --- a/external/ibm-public/postfix/dist/HISTORY +++ b/external/ibm-public/postfix/dist/HISTORY @@ -7269,7 +7269,7 @@ Apologies for any names omitted. 20021119 New address_verification_negative_cache = yes/no parameter - controls whether Postfix stores the result of negatieve + controls whether Postfix stores the result of negative address verification probes. This reduces cache pollution but causes Postfix to send a probe for each address verification service query. File: verify/verify.c. @@ -7559,7 +7559,7 @@ Apologies for any names omitted. rewrite broken user@ or user@. address forms into even more broken forms. bother. File: trivial-rewrite/rewrite.c. - Cleanup: the address resolver code now treates forms ending + Cleanup: the address resolver code now treats forms ending in @ in a more rational manner (because the address rewriting code no longer messes up by appending .my.domain). @@ -8611,7 +8611,7 @@ Apologies for any names omitted. libraries support just SPACE, others SPACE and ",". Postfix now normalizes the host list into a space separated format. This is less surprising to Postfix users used to the full - range of delimeters in other contexts. Implemented by Liviu + range of delimiters in other contexts. Implemented by Liviu Daia. File: util/dict_ldap.c Bugfix: after returning too old mail, the bounce daemon @@ -8968,7 +8968,7 @@ Apologies for any names omitted. 20040104 Workaround: MacOSX dumps core on the 20030913 TZ censoring - code. We explictly set TZ=UTC, which will produce incorrect + code. We explicitly set TZ=UTC, which will produce incorrect results when "mailq" formatting is moved from the showq daemon to the postqueue command. File: msg_syslog.c. @@ -11119,7 +11119,7 @@ Apologies for any names omitted. Cleanup: removed the legacy "tls_info" structure, factored out common code for peer_CN and issuer_CN lookup, and added sanity check to not verify subject common names that contain - nulls or that are execessively long. Patch by Victor Duchovni. + nulls or that are excessively long. Patch by Victor Duchovni. Files: tls_client.c, tls_server.c, tls_session.c, tls_misc.c, tls_verify.c. @@ -15560,7 +15560,7 @@ Apologies for any names omitted. Cleanup: the postscreen daemon now applies the permanent whitelist first. It is a safety feature that prevents mail - from being blocked. File: postscreeb/postscreen.c. + from being blocked. File: postscreen/postscreen.c. 20091224 @@ -15883,7 +15883,7 @@ Apologies for any names omitted. This code was started in Postfix 2.1, but it was never finished due to time constraints. Files: smtpd/smtpd.[hc] smtpd/smtpd_proxy.c, smtpd/smtpd_sasl_proto.c, - *qmgr/qmgr_messsage.c, *qmgr/qmgr_deliver.c, + *qmgr/qmgr_message.c, *qmgr/qmgr_deliver.c, global/deliver_request.[hc], global/mail_proto.h, global/deliver_pass.c, smtp/smtp_proto.c. @@ -16531,7 +16531,7 @@ Apologies for any names omitted. Cleaned up and finalized read/write deadline support. Once this code has been fielded it can go into Postfix 2.8.1, and made available as optional patch for earlier releases. - Further refinements have only dimishing returns and can + Further refinements have only diminishing returns and can evolve in the 2.9 release cycle. File: util/vstream.c. 20110128 @@ -17642,7 +17642,7 @@ Apologies for any names omitted. Cleanup: when multiple DNSBLs block an SMTP client, the postscreen "reject" message now gives credit to the DNSBL with the largest weight, instead of the DNSBL that replies - first. File: postscreen/postscreeb_dnsbl.c. + first. File: postscreen/postscreen_dnsbl.c. Cleanup: memcache_table(5) manpage. File proto/memcache_table. @@ -19113,7 +19113,7 @@ Apologies for any names omitted. dict_sockmap.c, dict_regexp.c, dict_pcre.c, dict_lmdb.c, dict_dbm.c, dict_cidr.c, dict_cdb.c. - Cleanup: warning message after canonical/virtal/etc. + Cleanup: warning message after canonical/virtual/etc. table lookup error. Files: cleanup/cleanup_addr.c, cleanup/cleanup_map11.c, cleanup/cleanup_map1n.c, cleanup/cleanup_masquerade.c, cleanup/cleanup_message.c, @@ -19381,13 +19381,13 @@ Apologies for any names omitted. posttls-finger/posttls-finger.c, tls/tls_misc.c, tls/tls_rsa.c. Cleanup: DANE support: Reduce #ifdef clutter to improve - redability and maintability. Viktor Dukhovni. File: + redability and maintainability. Viktor Dukhovni. File: tls/tls_dane.c. Future proofing: Tolerate disappearance of named bug-workaround bits without invalidating user configurations. When support for a bug workaround is removed from OpenSSL, the corresponding - bit is defined as zero (i.e. NOOP) intstead of causing + bit is defined as zero (i.e. NOOP) instead of causing programs to break. Viktor Dukhovni. File: tls/tls_misc.c. 20131217 @@ -19734,7 +19734,7 @@ Apologies for any names omitted. libglobal or dynamicmaps maps. File: postdrop/postdrop.c. Cleanup: moved dynamicmaps initialization from parameter - inititialization (mail_conf_suck()) to dictionary initialization + initialization (mail_conf_suck()) to dictionary initialization (mail_dict_init()). A benefit of this is that dynamicmaps.cf is no longer read by programs that don't use Postfix lookup tables. Files: global/mail_conf.[hc], global/mail_dict.c. @@ -20142,7 +20142,7 @@ Apologies for any names omitted. This implements the syntax of SMTP commands and DSN delivery status notifications. It does not address the problem that the same domain name may show up in different forms: an - UTF8-encoded name with non-ASCII charaters, or an IDNA-encoded + UTF8-encoded name with non-ASCII characters, or an IDNA-encoded (xn--mumble) name with ASCII-only characters. This means that access policies, mydestination, virtual_*_domains and relay_domans will have to understand both forms in order @@ -20624,7 +20624,7 @@ Apologies for any names omitted. 20141011 Cleanup: replaced cryptic macros X_SMTP() and SMTP_X() with - more descripive names: LMTP_SMTP_SUFFIX() and VAR_LMTP_SMTP(). + more descriptive names: LMTP_SMTP_SUFFIX() and VAR_LMTP_SMTP(). Files: smtp/smtp.c, smtp/smtp.h, smtp/smtp_chat.c, smtp/smtp_connect.c, smtp/smtp_proto.c, smtp/smtp_sasl_glue.c, smtp/smtp_sasl_proto.c, smtp/smtp_tls_policy.c. @@ -21377,7 +21377,7 @@ Apologies for any names omitted. Cleanup: apply printable() to all bounce(8) service string-valued protocol fields. File: bounce/bounce.c. - Apparenly the UCI 4.8 ucasemap_utf8FoldCase() function does + Apparently the UCI 4.8 ucasemap_utf8FoldCase() function does not complain about UTF-8 syntax errors, so we add our own redundant check. File: util/casefold.c. @@ -22721,7 +22721,7 @@ Apologies for any names omitted. configuration directory: the default configuration directory, a directory that is listed in the default main.cf file with alternate_config_directories or multi_instance_directories, - or the command must be invoked with root priveleges. This + or the command must be invoked with root privileges. This mitigates a problem with the PHP mail() function. Files: global/mail_conf.[hc], sendmail/sendmail.c. @@ -24672,6 +24672,13 @@ Apologies for any names omitted. check_ccert_access. Files: smtpd/smtpd_check.c, proto/postconf.proto. +20200407 + + Helper script by Viktor Dukhovni to report TLS information + per message delivery. This processes output from the + collate.pl script. Files: auxiliary/collate/README.tlstype, + auxiliary/collate/tlstype.pl. + 20200416 Workaround for broken builds after an incompatible change @@ -24681,12 +24688,15 @@ Apologies for any names omitted. change in GLIBC 2.31. This avoids the need for new options in /etc/resolv.conf. Files: dns/dns.h, dns/dns_lookup.c. + Misc fixes for gcc 'multiple definition' errors. Files: + master/master_vars.c, smtp/smtp.c, proxymap/proxymap.c. + 20200419 - Bugfix: segfault in the tlsproxy client role when the server - role was disabled. This typically happens on systems that - do not receive mail, after configuring connection reuse for - outbound TLS. Found during program maintenance. File: + Bugfix (introduced: Postfix 3.4): segfault in the tlsproxy + client role when the server role was disabled. This typically + happens with a first-time Postfix install and after configuring + only outbound TLS. Found during program maintenance. File: tlsproxy/tlsproxy.c. 20200420 @@ -24701,18 +24711,50 @@ Apologies for any names omitted. authentic. This broke DANE support without a clear explanation. File: makedefs. +20200425 + + Robustness: enable the socket option SO_REUSEPORT_LB or + SO_REUSEPORT on systems that support it. It allows multiple + processes to create distinct listen sockets for the same + address and port, and makes Postfix easier to restart. + However, with a SHARED listen socket as used in Postfix, + kernel-based load balancing does not help, and Postfix still + requires locking to avoid waking up multiple processes when + a connection arrives. Files: util/inet_listen.c, + +20200502 + + Documentation: update SNI support status in TLS_README. + File: proto/TLS_READNE.html. + +20200503 + + Portability: declaration should be before executable + statement. File: util/msg_logger.c. + + Portability: replace res_xxx() calls with res_nxxx() not + because those are threadsafe, but because new features are + being added there. To build old style, build with "make + makefiles CCARGS="-DNO_RES_NCALLS...". Files: makedefs. + util/sys_defs.h, dns/dns_lookup.c. + + Portability: libc-musl does not have res_nxxx() support, + so it builds with -DNO_RES_NCALLS. + 20200505 Noise suppression: shut up a compiler that special-cases string literals. Viktor Dukhovni. File smtpd/smtpd_check.c. + Portability: not all supported systems have ldd(1). Viktor + Dukhovni. File: makedefs. + 20200509 - Bugfix (introduced: Postfix 3.5): maillog_file_rotate_suffix + Bugfix (introduced: Postfix 3.4): maillog_file_rotate_suffix default value used the minute instead of the month. Reported by Larry Stone. Files: conf/postfix-tls-script, proto/MAILLOG_README.html, proto/postconf.proto. - global/mail_params.h, postfix/postfix.c. 20200510 @@ -24725,6 +24767,10 @@ Apologies for any names omitted. Noise suppression: avoid "SSL_Shutdown:shutdown while in init" warnings. File: tls/tls_session.c. + Debugging: with a single -v, the cleanup server now also + logs output envelope records, so that one -v option shows + the input and output. File: cleanup_out.c. + 20200515 Bugfix (introduced: Postfix 2.2): a TLS error for a PostgreSQL @@ -24737,3 +24783,1618 @@ Apologies for any names omitted. session may cause a false 'lost connection' error for a concurrent TLS session in the same tlsproxy process. File: tlsproxy/tlsproxy.c. + +20200518 + + Documentation: updated the wording of recent HISTORY entries, + based on the text in the 20200516 stable releases. + +20200521 + + Cleanup: the value of __RES (defined in resolv.h) determines + whether the res_nxxx() API is available. Credit to Rich + Felker. Files: util/sys_defs.h, dns/dns_lookup.c. + +20200522 + + Cleanup: the postconf command builds with -fno-common. + Files: makedefs, Makefile.in, postconf/extract.awk, + postconf/install_vars.h. + +20200523 + + Cleanup: the 20200503 change did not prevent direct access + to the obsolete h_errno variable in smtpd_checks.c. This + variable may still be updated, but we should not count on + that. Files: dns/dns.h, dns/dns_lookup.c, smtpd/smtpd_check.c. + + Cleanup: unit tests now build with -fno-common. Files: + global/server_acl.c, smtpd/smtpd_check.c, global/strip_addr.c, + proxymap/proxymap.c. + +20200525 + + Documentation: revised text about TLS connection reuse. + File: proto/CONNECTION_CACHE_README.html + +20200530 + + Bugfix (introduced: Postfix 3.1): "postfix tls deploy-server-cert" + did not handle a missing optional argument. File: + conf/postfix-tls-script. + +20200531 + + Debugging: per-nexthop SMTP client "debug peer" logging so + that we can also see what happens before, between, and after + SMTP sessions; add explicit SMTP client debug logging for + non-DNS host lookups. Files: smtp/smtp.c, proto/postconf.proto, + smtp/smtp_addr.c, smtp/smtp.c, smtp/smtp.h, smtp/smtp_session.c, + smtp/smtp_state.c. + + Postfix delivery agents now log an explicit record when + delegating delivery to a different Postfix delivery agent. + Example: "postfix/smtp[pid] queueid: passing <recipient> + to transport=local". This makes the delegating delivery + agent visible, where it would otherwise have remained + invisible, which would complicate troubleshooting. File: + global/deliver_pass.c. + +20200610 + + Respectful code: replace 'slave' in internal identifiers + and comments, and make the master(5) description more + consistent with that in master(8). Postfix does not have a + master/slave architecture, and these identifiers and comments + were just poorly worded. Files: conf/postmulti-script, + html/master.5.html, man/man5/master.5, proto/master, + global/dsb_scan.c, global/dsb_scan.h, global/dsn_print.c, + global/dsn_print.h, global/msg_stats.h, global/msg_stats_print.c, + global/msg_stats_scan.c, global/rcpt_buf.c, global/rcpt_buf.h, + global/rcpt_print.c, global/rcpt_print.h, milter/milter.h, + milter/milter_macros.c, tls/tls_proxy.h, + tls/tls_proxy_client_print.c, tls/tls_proxy_client_scan.c, + tls/tls_proxy_context_print.c, tls/tls_proxy_context_scan.c, + tls/tls_proxy_server_print.c, tls/tls_proxy_server_scan.c, + util/argv_attr.h, util/argv_attr_print.c, util/argv_attr_scan.c, + util/attr.h, util/attr_print0.c, util/attr_print64.c, + util/attr_print_plain.c, util/attr_scan0.c, util/attr_scan64.c, + util/attr_scan_plain.c. + + Bugfix (introduced: Postfix 3.4): in the Postfix SMTP server, + the SNI callback reported an error when it was called a + second time. This happened after the server-side TLS engine + sent a TLSv1.3 HelloRetryRequest (HRR) to a remote SMTP + client. Reported by Ján Máté, fixed by Viktor Dukhovni. + File: tls/tls_misc.c. + +20200617 + + Bugfix (introduced: Postfix 3.4): the connection_reuse + attribute in smtp_tls_policy_maps resulted in an "invalid + attribute name" error. Fix by Thorsten Habich. File: + smtp/smtp_tls_policy.c. + +20200618 + + Documentation: documented that smtp_line_length_limit=0 + disables the feature, and made this more explicit in the + code by using the ENFORCING_SIZE_LIMIT macro. Files: + proto/postconf.proto, smtp/smtp_proto.c. + +20200619 + + Bugfix (introduced: Postfix 3.4): SMTP over TLS connection + reuse was broken for configurations that use explicit trust + anchors. Reported by Thorsten Habich. Cause: the tlsproxy + client was sending a zero certificate length. File: + tls/tls_proxy_client_print.c. + + Bugfix: posttls-finger reported a conflict betwen -X and + -r when only -X was used. File: posttls-finger/posttls-finger.c. + +20200620 + + Bugfix (introduced: Postfix 3.4): SMTP over TLS connection + reuse was broken for configurations that use explicit trust + anchors. Reported by Thorsten Habich. Fixed by calling DANE + initialization unconditionally (WTF). File: tlsproxy/tlsproxy.c. + +20200626 + + Typo: in postconf(5) documentation, AAAAA should be AAAA. + Christian Franke. File: proto/postconf.proto. + + Bugfix (introduced: Postfix 2.11): The Postfix smtp(8) + client did not send the right SNI name when the TLSA base + domain was a secure CNAME expansion of the MX hostname (or + non-MX nexthop domain). Domains with CNAME expanded MX hosts + are not conformant with RFC5321, and so are rare. Even more + rare are MX hosts with TLSA records for their CNAME expansion. + For this to matter, the remote SMTP server would also have + to select its certificate based on the SNI name in such a + way that the original MX host would yield a different + certificate. Among the ~2 million hosts in the DANE survey, + none meet the conditions for returning a different certificate + for the expanded CNAME. Therefore, sending the correct SNI + name should not break existing mail flows. Fixed by Viktor + Dukhovni. File: src/tls/tls_client.c. + +20200705 + + Cleanup: OpenSSL-1.1.1 is the minimum supported version. + This is an LTS (long-term support) version that will reach + the end of life by 2023-09-11. This removes support for + export ciphers. + + This also changes the Postfix default fingerprint digest + from MD5 to SHA256, but only when the compatibility_level + is set to '3' or higher. + + Code by Viktor Dukhovni. Files: global/mail_params.c, + global/mail_params.h, posttls-finger/posttls-finger.c, + proto/COMPATIBILITY_README.html, proto/TLS_README.html, + proto/postconf.proto, smtp/smtp.c, smtp/smtp_tls_policy.c, + smtpd/smtpd.c, smtpd/smtpd_check.c, tls/Makefile.in, + tls/tls.h, tls/tls_certkey.c, tls/tls_client.c, tls/tls_dane.c, + tls/tls_dh.c, tls/tls_misc.c, tls/tls_rsa.c, tls/tls_server.c, + tls/tls_verify.c. + +20200710 + + Security: added a section to the sendmail(1) manpage for + security researchers and application developers, with an + example of using '--' to disable command option processing + for user-specified data. File sendmail/sendmail.c. + + Error reporting: added '--' to a postalias command line to + make an obsecure error message less confusing. File + sendmail/sendmail.c. + + Conversion from Postfix built-in DANE support to OpenSSL + DANE support. Code by Viktor Dukhovni. Files: + posttls-finger/posttls-finger.c, proto/postconf.proto, + smtp/smtp.c, smtp/smtp_proto.c, smtp/smtp_tls_policy.c, + tls/Makefile.in, tlsproxy/tlsproxy.c, tls/tls_client.c, + tls/tls_dane.c, tls/tls_fprint.c, tls/tls.h, tls/tls_misc.c, + tls/tls_proxy_client_print.c, tls/tls_proxy_client_scan.c, + tls/tls_proxy_context_print.c, tls/tls_proxy_context_scan.c, + tls/tls_proxy.h, tls/tls_verify.c, util/hex_code.c. + + Bugfix (introduced: Postfix 3.0): minor memory leaks in the + Postfix TLS library, found during tests. File: tls/tls_misc.c. + +20200712 + + Cleanup: non-TLS builds were failing. File: util/tls_misc.c. + + Bugfix (introduced: Postfix 3.0): 4kbyte per session memory + leak in the Postfix TLS library, found during tests. File: + tls/tls_misc.c. + +20200718 + + Cleanup TLS library: coding style, additional error message, + additional handling of internationalized domain name, and + dropping an unused variable. Files: tls.h, tls_dane.c, + tls_proxy_client_scan.c, tls_client.c. + + Noise suppression: shut up compilers that warn about + sizeof("text"). File: smtpstone/smtp-sink.c. + +20200719 + + Cleanup old API: mymemdup() should return "void *", the + same value type as its main argument, and the same result + type as mymalloc(). In a future update we can remove all + the noisy but unnecessary casts of their result values to + character pointer. Files: util/mymalloc.c, util/mymalloc.h. + + Cleanup: don't split the sendmail -oA option value on comma + or whitespace, before passing the value to the postalias + command line. This results in unexpected behavior. File: + sendmail/sendmail.c. + + Documentation: updated the manpage of the unprivileged(!) + sendmail(1) command with instructions to avoid privilege + esclation attacks in naive programs that run Postfix programs + with user-specified arguments. File: sendmail/sendmail.c. + +20200720 + + Bugfix (introduced: postfix 3.4): nullpointer dereference + in debug logging when tlsproxy is unavailable. File: + posttls-finger/posttls-finger.c. + + Final cleanups of the peername matching code. File: + tls/tls_client.c. + +202000725 + + Documentation of how to set the minimum and maximum allowed + TLS protocol versions (these override system-wide OpenSSL + configuration), some related code cleanups including better + warning messages. Viktor Dukhovni. Files: proto/TLS_README.html, + proto/postconf.proto, global/mail_params.h, + posttls-finger/posttls-finger.c, tls/tls.h, tls/tls_client.c, + tls/tls_fprint.c, tls/tls_misc.c, tls/tls_server.c. + + The Postfix TLS library did not override the system-wide + OpenSSL configuration of allowed TLS protocol versions, for + sessions where the remote SMTP client sends SNI. File: + tls/tls_server.c. + +20200726 + + Code health: the tls_get_signature_params() function reused + variable names for different objects that have up to three + different life-cycle management models. To avoid more + accidents we now use distinct names for distinct purposes. + File: tls/tls_misc.c. + +20200727 + + Code health: inet_proto_info() should return a const pointer. + This is global data that callers should not change. Files: + cleanup/cleanup_milter.c, global/haproxy_srvr.c, + global/mynetworks.c, global/normalize_mailhost_addr.c, + global/own_inet_addr.c, postscreen/postscreen_endpt.c, + posttls-finger/posttls-finger.c, qmqpd/qmqpd_peer.c, + smtpd/smtpd_check.c, smtpd/smtpd_peer.c, smtp/smtp_addr.c, + smtpstone/smtp-sink.c, util/inet_addr_host.c, + util/inet_addr_list.c, util/inet_addr_local.c, util/inet_connect.c, + util/inet_listen.c, util/inet_proto.c, util/inet_proto.h. + +20200728 + + Code health: deleted a mis-spelled macro from code and + documentation. Files: bounce/bounce_template.[hc]. + +20200829 + + Other debt: updated the encoding in HTML from us-ascii to + utf-8. Files: mantools/makemanidx, mantools/make_soho_readme, + mantools/man2html, mantools/readme2html, proto/*_README.html, + proto/INSTALL.html, proto/postconf.html.prolog, html/index.html. + +20200830 + + Refactor: moved the SASL mechanism filter code from the + Postfix SMTP client to a library module, so that it can be + reused in the Postfix SMTP server. Files: smtp/smtp_sasl_proto.c, + global/sacl_mech_filter.[hc]. + + Bugfix (introduced: Postfix 2.0): smtp_sasl_mechanism_filter + ignored table lookup errors, treating them as 'not found'. + Found while refactoring code. File: smtp/smtp_sasl_proto.c. + + Feature: smtpd_sasl_mechanism_list (default: !external, + static:rest) to avoid confusing errors when a SASL backend + wants to anounce EXTERNAL support for which Postfix support + does not exist. Files: smtpd/smtpd.[hc], smtpd_sasl_glue.[hc], + global/mail_params.h, proto/postconf.proto, mantools/postlink. + +20200906 + + Cleanup: missing file. File: src/postqueue/.indent.pro. + + Cleanup: uninitialized value in unit test code. File: + global/haproxy_srvr.c. + + Cleanup: duplicate 'const' in argument declaration. File: + src/global/sasl_mech_filter.c. + +20200906-18 + + Other debt: internal protocol identification. Each server + sends the name of the internal protocol that it implements, + and each client logs a warning if it receives the wrong + protocol name. With this, a client-server mismatch results + in a better error message. It is a good idea to "postfix + stop" before updating, or before backing out to an earlier + relase. To make this work consistently, a few internal + protocols were converted from "client speaks first" to + "server speaks first". Files: anvil/anvil.c, bounce/bounce.c, + cleanup/cleanup.c, flush/flush.c, global/abounce.c, + global/anvil_clnt.c, global/bounce.c, global/clnt_stream.c, + global/clnt_stream.h, global/defer.c, global/deliver_pass.c, + global/deliver_request.c, global/dict_proxy.c, global/flush_clnt.c, + global/mail_command_client.c, global/mail_proto.h, + global/mail_stream.c, global/mail_version.h, global/post_mail.c, + global/resolve_clnt.c, global/rewrite_clnt.c, global/scache_clnt.c, + global/trace.c, global/verify_clnt.c, local/forward.c, + master/event_server.c, master/mail_server.h, master/multi_server.c, + oqmgr/qmgr_deliver.c, pickup/pickup.c, postdrop/postdrop.c, + postqueue/postqueue.c, postscreen/postscreen_starttls.c, + proxymap/proxymap.c, qmgr/qmgr_deliver.c, scache/scache.c, + showq/showq.c, tls/tls_mgr.c, tls/tls_proxy_clnt.c, + tlsmgr/tlsmgr.c, tlsproxy/tlsproxy.c, + trivial-rewrite/trivial-rewrite.c, util/attr.h, util/attr_clnt.c, + util/attr_clnt.h, util/attr_print0.c, util/attr_print64.c, + util/attr_print_plain.c, util/attr_scan0.c, util/attr_scan64.c, + util/attr_scan_plain.c, util/auto_clnt.c, util/auto_clnt.h, + verify/verify.c. + + Debt: during the conversion of some internal protocols to + "server speaks first", took the opportunity to improve how + event-driven client implementations handle a server that + is locked up. Files: global/abounce.c, + postscreen/postscreen_starttls.c. + +20200919 + + Cleanup: eliminated a silly optimization for lazy clients + that read the "server speaks first" protocol announcement + after sending a client request. Files: src/anvil/anvil.c, + src/bounce/bounce.c, src/flush/flush.c, src/global/abounce.c, + src/global/anvil_clnt.c, src/global/deliver_pass.c, + src/global/deliver_request.c, src/global/dict_proxy.c, + src/global/mail_command_client.c, src/global/mail_stream.c, + src/global/resolve_clnt.c, src/global/rewrite_clnt.c, + src/global/scache_clnt.c, src/global/verify_clnt.c, + src/local/forward.c, src/oqmgr/qmgr_deliver.c, src/pickup/pickup.c, + src/postqueue/postqueue.c, src/postscreen/postscreen_starttls.c, + src/proxymap/proxymap.c, src/qmgr/qmgr_deliver.c, + src/scache/scache.c, src/showq/showq.c, src/tlsmgr/tlsmgr.c, + src/tlsproxy/tlsproxy.c, src/tls/tls_mgr.c, + src/tls/tls_proxy_clnt.c, src/trivial-rewrite/trivial-rewrite.c, + src/verify/verify.c. + + Cleanup: factored out some duplicate showq client code. + File: postqueue/postqueue.c. + +20200920 + + Cleanup: deleted the percentm module. It was obsoleted in + 19971027 by the vbuf_print() string formatter for VSTREAM + and VSTRING objects. Files: util/percentm.[hc]. + + Cleanup: replaced hard-coded 'private' with named constant. + File: global/scache_clnt.c. + + Bugfix (introduced: Postfix 2.3): when deleting a recipient + with a milter, delete the recipient from the duplicate + filter, so that the recipient can be added back. Files: + global/been_here.[hc], cleanup/cleanup_milter.c, + cleanup/Makefile.in, lots of cleanup unit test files. + +20200925 + + Cleanup: vstream_fseek() support for reading or writing + memory buffer streams, and minor cleanups in VSTREAM support + for reading/writing VSTRINGs. Also added unit tests. Files: + util/vstream.c, util/vstring.h. + + Bugfix (introduced: before Postfix alpha): the code that + looks for Delivered-To: headers ignored headers longer than + $line_length_limit. Also added unit tests. File: + global/delivered_hdr.c. + +20200930 + + Feature: when a Postfix program makes a DNS query that + requests DNSSEC validation (usually for Postfix DANE support) + but the DNS response is not DNSSEC validated, Postfix will + send a DNS query configured with the "dnssec_probe" parameter + to determine if DNSSEC support is available, and logs a + warning if it is not. By default, the probe has type "ns" + and domain name ".". The probe is sent once per process + lifetime. Files: dns/dns.h, dns/dns_lookup.c, dns/dns_sec.c, + test_dns_lookup.c, global/mail_params.[hc], mantools/postlink.. + +20201003 + + The makedefs script no longer disables DNSSEC when Postfix + is built with libc-musl. Instead Postfix will rely on the + new dnssec_probe feature, and will log a warning when Postfix + requests DNSSEC validation, but the infrastructure does not + validate DNSSEC signatures. File: makedefs. + + Cleanup: some wordsmithing of warnings when DNSSEC validation + is unavailable. File: dns/dns_sec.c. + + Cleanup: add missing warnings for libpostfix version + mismatches. This will help folks with build processes that + mistakenly run newly-built Postfix installation commands + with previously-installed libpostfix files. Files: + postcat/postcat.c, postconf/postconf.c, postkick/postkick.c, + postlock/postlock.c. + + Documentation: hyperlink occurrences of the info_log_address_format + parameter name in daemon manpages. + +20201005 + + Cleanup: move the submit_users check after the postdrop + initializations that strip the environment, set up signal + handlers, etc. File: postdrop/postdrop.c. + + Documentation: descriptions of Postfix TLS wrappermode + support. File: proto/TLS_README.html, proto/SASL_README.html. + +20201011 + + Bugfix (introduced: Postfix 2.8): save a copy of the + postscreen_dnsbl_reply_map lookup result. This has no effect + when the recommended texthash: look table is used, but it + may avoid stale data with other lookup tables. File: + postscreen/postscreen_dnsbl.c. + +20201015 + + Documentation: simplified the recipient_delimiter + description. File: proto/postconf.proto. + +20201022 + + Bugfix (introduced: Postfix 2.2): after processing an + XCLIENT command, the smtps service was waiting for a TLS + handshake. Found by Aki Tuomi. File: smtpd/smtpd.c. + +20201025 + + Feature: local_login_sender_maps to lock down the envelope + sender addresses that the postdrop command will accept. The + default is backwards compatible. Developed with input from + Demi M. Obenour. Files: postdrop/postdrop.c, global/mail_params.h, + global/local_sender_login_match.[hc], + global/local_sender_login_match.in, + global/local_sender_login_match.ref, global/quote_822_local.c, + global/quote_822_local.in, global/quote_822_local.ref, + mantools/postlink, proto/postconf.proto. + + Bugfix (introduced: Postfix 2.3): static maps did not free + their casefolding buffer. File: util/dict_static.c. + +20201026 + + Cleanup: changed the postdrop numerical UID prefix from "#" + to "uid:", and tweaked some local_login_sender_maps + documentation. Files: proto/postconf.proto, postdrop/postdrop.c. + +20201031 + + Cleanup: don't split a space-comma separated address list + on space or comma inside a quoted string. Files: util/mystrtok.c, + util/mystrtok.ref, global/login_sender_match.c. + +20201101 + + Cleanup: the default "smtp_tls_dane_insecure_mx_policy = dane" + was forcing too many A/AAAA lookups for MX hosts in DANE mode. + The default is now "dane" when smtp_tls_security_level is "dane". + otherwise it is "may". File: global/mail_params.h. + +20201104 + + Bugfix (introduced: Postfix 3.5): the Postfix SMTP client + broke message headers longer than $line_length_limit, causing + subsequent header content to become message body content. + Reported by Andreas Weigel, fix by Viktor Dukhovni. File: + smtp/smtp_proto.c. + + Added missing employer attributions to .c and .h files. + +20201116 + + Documentation: document that check_mumble_mx_access will + look up A or AAAA records when a domain name has no MX + record, just like the Postfix SMTP client would. File: + proto/postconf.proto. + +20201122 + + Cleanup: log "Application error" instead of "Success" or + "Unknown error: 0" when an operation fails with errno == + 0. File: util/vbuf_print.c. + +20201125 + + Documentation: in the cleanup(8) description of message + transformations, mention how some transformations are + controlled with the local_header_rewrite_clients, + always_add_missing_headers, and message_drop_headers parameter + settings. File: cleanup/cleanup.c. + +20201129 + + Cleanup: future-proofing a condition in delivered_hdr_init(). + The code was not wrong, but the new code is more consistent + with new code in the bounce daemon where the difference does + matter. File: global/delivered_hdr.c + +20201205 + + Testing: generic test_main() routine to initialize configuration + parameters before running a test routine. Files: + global/test_main.[hc]. + + Feature: specify "enable_threaded_bounces = yes" to enable + bounce messages that link to the original message with a + References: and In-Reply_to: header. Based on code by Andreas + Thienemann. See RELEASE_NOTES for caveats. Files: + proto/postconf.proto, bounce/bounce_notify_tester.c, many + test data files to exercise corner cases. + +20201220 + + Infrastructure: support to add custom comparison operators + for Postfix configuration files. This will be used to implement + custom comparison operators for compatibility_level values + that contain both the Postfix major and minor version and + maybe patchlevel. Files: util/alldig.c, util/stringops.h, + util/mac_expand.[hc] and test files. + +20210102 + + Infrastructure: support for the <=level, <level, and other + operators to compare compatibility levels. With the standard + <=, <, etc. operators, compatibility level 3.10 would be + less than 3.9 which is undesirable. Files: global/compat_level.[hc] + and test files. + +20210107 + + Documentation: added lmdb to the postmap/postalias pages. + Files: postmap/postmap.c, postalias/postalias.c. + +20210109 + + Feature: support for compatibility levels of the form + "major.minor.patch". Files: global/mail_params.[hc], + master/master_ent.c, postconf/postconf.c, postfix/postfix.c, + proto/COMPATIBILITY_README.html, proto/postconf.proto. + +20210110 + + Documentation: the postfix(1) manpage missed some changes + that were introduced in the Postfix 3.0 development + cycle. File:postfix/postfix.c. + + Bugfix: the 20210109 change broke 'postfix reload' for the + master daemon. File: global/mail_params.c. + +20210111 + + Cleanup: compiler warning for casting '0' to the wrong type + (zero impact). File: dns/dns_sec.c . + + Cleanup: after back-porting the dnssec_probe implementation + to Postfix 3.5 and earlier versions, forward-ported some + comment and documentation changes to the 3.6 releases. + Files: proto/postconf.proto, RELEASE_NOTES, dns/dns.h. + +20210113 + + Workaround: STRREF() macro to shut up compiler warnings for + legitimate expressions involving string constants. Files: + util.stringops.h, flush/flush.c. + +20210130 + + Feature: with smtpd_relay_before_recipient_restrictions=yes, + the Postfix SMTP server will evaluate smtpd_relay_restrictions + before smtpd_recipient_restrictions. This is the default + behavior with compatibility_level >= 3.6. This makes the + implemented behavior consistent with existing documentation. + There is a backwards-compatibility warning that allows users + to freeze historical behavior. Files: mantools/postlink, + proto/COMPATIBILITY_README.html, proto/postconf.proto, + global/mail_params.c, global/mail_params.h, smtpd/smtpd.c, + smtpd/smtpd_check.c. + +20210201 + + Flipped a bit in the smtpd_relay_before_recipient_restrictions + implementation. File: smtpd/smtpd_check.c. + +20210206 + + Documentation: the inet_protocols default setting is compile-time + dependent. Files: proto/postconf.proto, proto/IPV6_README.html, + and documentation in smtpd/smtpd.c, smtp/smtp.c, master/master.c. + +20210212 + + Documentation: added a jq example to the postsuper(1) manpage. + File: postsuper/postsuper.c. + +20210216 + + Respectful code: avoid using terminology that implies white + is better than black. Instead, use 'allowlist', 'denylist', + and variations on those words. This continues work started + with Noel Jones a year ago. + + Documentation: replaced white/blacklist with allow/denylist, + except in parameter names and logging. Files: + proto/ADDRESS_VERIFICATION_README.html, proto/cidr_table, + proto/OVERVIEW.html, proto/postconf.proto, + proto/POSTSCREEN_README.html, proto/SMTPD_ACCESS_README.html, + proto/SMTPD_POLICY_README.html, proto/STRESS_README.html, + dns/dns_lookup.c, dnsblog/dnsblog.c, global/server_acl.c, + postfix/postfix.c, postscreen/postscreen.c, + postscreen/postscreen_dnsbl.c, postscreen/postscreen_early.c, + postscreen/postscreen.h, postscreen/postscreen_misc.c, + postscreen/postscreen_smtpd.c, postscreen/postscreen_tests.c, + proxymap/proxymap.c, smtpd/smtpd.c, smtpd/smtpd_check.c, + smtpd/smtpd_dnswl.in, smtpd/smtpd_dnswl.ref, tlsproxy/tlsproxy.c, + verify/verify.c. + +20210220 + + Renamed postscreen_dnsbl_whitelist_threshold, + postscreen_blacklist_action, and postscreen_whitelist_interfaces, + with backwards-compatible default settings, and updated + documentation. + + Forked POSTSCREEN_README for readability, to avoid deprecated + parameter names and logging examples. The historical parameter + names and logging are still described in POSTSCREEN_3_5_README. + Files: proto/Makefile.in, proto/POSTSCREEN_3_5_README.html, + proto/POSTSCREEN_README.html. + + Renamed internal variables with names that contain 'white' or + 'black'. Files: postscreen/postscreen.c, postscreen/postscreen.h. + + Feature: respectful_logging configuration parameter (the + default depends on the compatibility_level) to choose + between respectful and deprecated logging formats. Files: + mantools/postlink, proto/postconf.proto, global/mail_params.[hc], + postscreen/postscreen.c, proto/COMPATIBILITY_README. + +20210224 + + Typo: the "respectful_logging" parameter had a typo and a + "postscreen_" prefix that should have been deleted. File: + global/mail_params.h + +20210313 + + Documentation: enable_threaded_bounces also applies to + "success" and "delay" delivery status notiifications. File: + proto/postconf.proto. + +20210403 + + Missing null pointer checks (introduced: Postfix 3.4) after + an internal I/O error during the smtp(8) to tlsproxy(8) + handshake. Found by Coverity, reported by Jaroslav Skarvada. + Based on fix by Viktor Dukhovni. File: tls/tls_proxy_client_scan.c. + + Null pointer bug (introduced: Postfix 3.0) and memory leak + (introduced: Postfix 3.4) after an inline: table syntax + error in main.cf or master.cf. Found by Coverity, reported + by Jaroslav Skarvada. Based on fix by Viktor Dukhovni. File: + util/dict_inline.c. + + Incomplete null pointer check (introduced: Postfix 2.10) + after truncated HaProxy version 1 handshake message. Found + by Coverity, reported by Jaroslav Skarvada. Fix by Viktor + Dukhovni. File: global/haproxy_srvr.c. + +20210404 + + Unbroke a ton of regression tests after DNS-related changes. + +20210406 + + More specific warnings for incorrect net/mask syntax. Files: + util/cidr_match.c, util/dict_cidr.ref. + +20210410 + + Documentation: updated containerization suggestions in + the postfix(1) manpage. File: postfix/postfix.c. + + Documentation: added text and ASCII art to illustrate how + tlsproxy(8) is used for outbound SMTP connection caching + and for inbound postscreen(8) TLS support. File: + proto/OVERVIEW.html. + + Documentation: added text and ASCII art to illustrate how + postlogd(8) provides an alternative to syslog logging. + File: proto/OVERVIEW.html. + +20210411 + + Updated the missing null pointer check (introduced: Postfix + alpha) after null argv[0] value. File: global/mail_task.c. + + Cleanup: added a test case for a missing haproxy v1 protocol + type, and improved the haproxy parser error messages. File: + global/haproxy_srvr.c. + + Documentation: updated examples and TLS configuration. File + proto/CONNECTION_CACHE_README.html. + +20210418 + + Bitrot: new "known_tcp_ports" configuration parameter to + reduce Postfix dependency on the services(5) database. + There is no agreement about the name of the port 465 service: + the intersection of different systems is reportedly empty. + By default, Postfix now "knows" the port numbers for SMTP + services. Files: proto/postconf.proto, global/Makefile.in, + global/config_known_tcp_ports.c, global/config_known_tcp_ports.h, + global/config_known_tcp_ports.ref, global/mail_params.c, + global/mail_params.h, global/mail_version.h, + global/namadr_list.ref, master/master.c, + posttls-finger/Makefile.in, posttls-finger/posttls-finger.c, + smtp/Makefile.in, smtp/smtp.c, smtp/smtp_connect.c, + smtpd/smtpd.c, util/Makefile.in, util/find_inet.c, + util/known_tcp_ports.c, util/known_tcp_ports.h, + util/known_tcp_ports.ref, util/myaddrinfo.c. + +20210419 + + Bugfix (bug introduced 20210102): panic in some postconf + commands due to duplicate initialization of compatibility + level comparison operators. File: global/compat_level.c. + + Cleanup: stricter parsing of known_tcp_port settings. Files: + util/argv_split_at.c, util/argv.h, global/config_known_tcp_ports.c. + +20210420 + + Documentation: typofixes by Paul Menzel. File: RELEASE_NOTES. + + Documentation: numeric IP address examples. File: conf/master.cf. + + Documentation: added "-Wl,-R,/path/to/directory" hints to + optional build instructions. Files: proto/DB_README.html, + proto/LDAP_README.html, proto/LMDB_README.html, + proto/MYSQL_README.html, proto/PGSQL_README.html, + proto/SASL_README.html, proto/SQLITE_README.html, + proto/TLS_README.html. + +20210422 + + Cleanup: in the Postfix SMTP and LMTP client, prepend Return-Path + and other headers in the same order as in other Postfix delivery + agents. Adi Prasaja. File: smtp/smtp_proto.c. + +20210428 + + Documentation: update by Paul Menzel. File: proto/SASL_README.html. + +20210529 + + Cleanup: simplified master.cf stanzas for the submission + and submissions (formerly: smtps) services, to avoid + surprising warnings for undefined mua_smtpd_xxx_restrictions + parameters. File: conf/master.cf. + + Bugfix (introduced: Postfix 2.11): "postmap lmdb:/file/name" + handled duplicate keys ungracefully, with a dangling pointer + resulting in a double free() call with lmdb versions 0.9.17 + and later. Reported by Adi Prasaja, root cause analysis by + Howard Chu. In addition, "postmap lmdb:/file/name" forgot + entries stored up to and including the duplicate key. File: + util/slmdb.c. + +20210605 + + Fixed a few more potential dangling pointer cases in the + LMDB client, future-proofing code paths that sofar aren't + used. File: util/slmdb.c. + + Added LMDB integration tests using the postmmap command. + Files: postmap/Makefile.in, postmap/lmdb_abb, postmap/lmdb_abb.ref. + + Cleanup: reset errno in the fail: database methods for + consistent error messages. File: util/dict_fail.c. + + Cleanup: new vstream_control() option to give a memory stream + ownership of the underlying VSTRING. This simplifies resource + management for read-only streams. Files: util/vstream.[hc]. + + Cleanup: extpar() returns an error in case of a missing + initial '{', instead of aborting. This simplifies the + implementation of some callers. File: util/extpar.c. + + Feature: inline pcre, regexp, and cidr table definition in main.cf + or master.cf, to improve their usability in matchlists. Files: + util/dict_stream.c, util/dict.h, util/dict_pcre.c, + util/dict_regexp.c, util/dict_cidr.c, and test files. + + The smtpd_forbidden_commands default setting now also inludes + a regular expression regexp:{{/^[^A-Z]/ Bogus}} for bogus inputs. + File: global/mail_params.h. + +20210606 + + Cleanup: "Postfix is running with backwards-compatible..." + did not make sense when Postfix is down. File: postfix/postfix.c. + + Cleanup: the postscreen BDAT handler now replies with "need + MAIL command" when the client did not provide a sender address. + File: postscreen/postscreen_smtpd.c. + + Typo: silent_discard should be silent-discard. File: + proto/BDAT_README.html. + +20210610 + + Cleanup: escape non-printable characters in non-SMTP commands, + instead of replacing them with '?'. File: smtpd/smtpd.c. + + Misc typofixes by Viktor Dukhovni. Files: conf/master.cf, + proto/regexp_table, proto/cidr_table. + + Cleanup: simplify the LMDB error recovery code. File: + util/slmdb.c. + +20210615 + + Bugfix (introduced: Postfix 3.4): the texthash: map + implementation did not support "postmap -F" behavior. + Reported by Christopher Gurnee, who also found the missing + code in the postmap source. File: util/dict_thash.c. + + Cleanup: documentation for the postmap -F option. File: + postmap/postmap.c. + + Cleanup: simplify the LMDB error recovery code. File: + util/slmdb.c. + +20210623 + + Cleanup: the known_tcp_ports parameter was not hyperlinked. + File: mantools/postlink. + + Bugfix: some strtou?l() calls had no 'errno=0' statement + before the call. Fixed with strtou?l() wrapper functions + that reset errno before calling strtou?l(), and calling + these from code that did not explicitly reset errno. Other + strtou?l() can be migrated later. Problem reported by David + Bohman. Files: util/sane_strtol.[hc], global/compat_level.c, + postscreen/postscreen_tests.c, util/mac_expand.c. + +20210705 + + Bugfix (introduced: Postfix 3.3): "null pointer read" error + in the cleanup daemon when "header_from_format = standard" + (the default as of Postfix 3.3) and email was submitted + with /usr/sbin/sendmail without From: header, and an all-space + full name was specified in 1) the password file, 2) with + "sendmail -F", or 3) with the NAME environment variable. + Found by Renaud Metrich. File: cleanup/cleanup_message.c. + +20210708 + + Bugfix (introduced: 1999): the Postfix SMTP server was + sending all session transcripts to the error_notice_recipient, + instead of sending transcripts of bounced mail to the + bounce_notice_recipient. Reported by Hans van Zijst. File: + smtpd/smtpd_chat.c. + +20210713 + + Bugfix (introduced: Postfix 2.4): false "too many reverse + jump" warnings in the showq daemon. The loop detection code + was comparing memory addresses instead of queue file names. + It now properly compares strings. Reported by Mehmet Avcioglu. + File: global/record.c. + +20210724 + + Cleanup: missing const in the 20210713 bugfix. File: + global/record.c. + +20210728 + + Bitrot: GLIBC 2.34 has closefrom(), and of course their + interface is different. File: util/sys_defs.h. + +20210804 + + Cleanup: replace ad-hoc object-to-VSTRING serialization with + attr_print*() based serialization. Files: tls/tls_proxy.h, + tls/tls_proxy_client_misc.c, tlsproxy.c/tlsproxy.c. + + Cleanup: left-over code from a DANE on/off workaround. File: + tlsproxy.c/tlsproxy.c. + +20210806 + + Constified the object argument of functions that write objects + to VSTREAM. Files: global/bounce.c, global/defer.c, + global/deliver_pass.c, global/deliver_request.c, + global/dsn_print.c, global/dsn_print.h, + global/msg_stats.h, global/msg_stats_print.c, + global/rcpt_print.c, global/rcpt_print.h, global/trace.c, + milter/milter8.c, milter/milter.c, milter/milter.h, + milter/milter_macros.c, oqmgr/qmgr_deliver.c, + qmgr/qmgr_deliver.c, tls/tls_proxy_client_misc.c, + tls/tls_proxy_client_print.c, tls/tls_proxy_context_print.c, + tls/tls_proxy.h, tls/tls_proxy_server_print.c, util/argv_attr.h, + util/argv_attr_print.c, util/attr.h. + +20210810 + + Pedantism: the Postfix SMTP server now replies with status + 500 when a command is not recogized (status 502 is applicable + when a command is recognized but not implemented). File: + smtpd/smtpd.c. + + Wordsmithing: in inet_connect() replaced "host/service xxx/yyy + not found" with "host or service xxx:yyy not found". The former + suggests UNIX-domain pathname syntax which is confusing. File: + until/inet_connect.c. + +20210815 + + To make the maillog_file feature more useful, the postlog(1) + command is now set-gid postdrop, so that unprivileged + programs can write logging through the postlogd(8) daemon. + Adopted some code from postqueue(1) and postdrop(1) to + harden postlog(1) against privilege escalation attacks. + Files: postlog/postlog.c, conf/postfix-files. + + Hardening: specify smtpd_per_request_deadline=yes to limit + the combined amount of time to receive a complete SMTP + request and to send a complete SMTP response. Specify + smtpd_min_data_rate to enforce a minimum data rate during + DATA and BDAT. This replaces smtpd_per_record_deadline; the + new smtpd_per_request_deadline parameter has a backwards- + compatible default value. + + Hardening: specify {smtp,lmtp}_per_request_deadline=yes to + limit the combined amount of time to send a complete SMTP + request and to receive a complete SMTP response. Specify + {smtp,lmtp}_min_data_rate to enforce a minimum data rate + during DATA. This replaces {smtp,lmtp}_per_record_deadline. + The new {smtp,lmtp}_per_request_deadline parameters have a + backwards-compatible default value. + + Minor text and code cleanups. File: postlog/postlog.c. + +20210925 + + Prevent sharing of xxx_tls_session_cache_database instances + between different Postfix instances when a database is + not multi-writer safe. Like postscreen(8) and verify(8), + open such a database with a permanent lock, and raise + a fatal error when that database is already opened as + xxx_tls_session_cache_database. File: src/tls/tls_scache.c. + + Bugfix (bug introduced: Postfix 2.10): postconf -x produced + incorrect output, because different functions were implicitly + sharing a buffer for intermediate results. Reported by raf, root + cause analysis by Viktor Dukhovni, and Wietse eliminated the + underlying anti-pattern. Files: postconf/postconf_builtin.c, + postconf/postconf_dbms.c, postconf/postconf_lookup.c, + postconf/postconf_main.c, postconf/postconf_master.c. + + Documentation: missing lmtp_tls_wrappermode parameter + documentation. Viktor Dukhovni. Files: mantools/postlink, + proto/postconf.proto. + +20210926 + + OpenSSL 3.0.0 feature and bitrot updates. Viktor Dukhovni. + Files: proto/FORWARD_SECRECY_README.html, proto/postconf.proto, + tls/tls_client.c, tls/tls_dh.c, tls/tls.h, tls/tls_misc.c, + tls/tls_server.c/^+ + + Cleanup: don't hyperlink text that is already hyperlinked. + File: mantools/postlink. + +20211002 + + Bugfix (introduced: Postfix 3.3): the header_from_format + feature was not implemented for From: headers from the + bounce daemon, and for Postfix SMTP server and client + postmaster notifications. Reported by Vladimir Mishonov. + Files: bounce/bounce.c, bounce/bounce_notify_util_tester.c, + bounce/bounce_service.h, bounce/bounce_template.c, + bounce/bounce_template.h, bounce/bounce_templates.c, + cleanup/cleanup.h, cleanup/cleanup_init.c, + cleanup/cleanup_message.c, smtp/lmtp_params.c, smtp/smtp.c, + smtp/smtp.h, smtp/smtp_chat.c, smtp/smtp_params.c, + smtpd/smtpd.c, smtpd/smtpd.h, smtpd/smtpd_chat.c, and test + data. + +20211006 + + Documentation: http://tools.ietf.org/html/rfc[0-9]+ sometimes + does not redirect to the https site. Max-Julian Pogner. + Fixed by updating mantools/postlink and rebuilding the HTML + files that reference RFCs. + +20211016 + + Documentation: clarified the difference between private and + public services in master.cf. File: proto/master. + +20211022 + + Bugfix (introduced: Postfix 3.6): the known_tcp_ports setting + had no effect. Reported by Peter. The feature wasn't fully + implemented. Files: config_known_tcp_ports.c, mail_params.c, + posttls-finger/posttls-finger.c, smtp/smtp_connect.c, + util/find_inet.c, util/myaddrinfo.c. + +20211023 + + Documentation: fixed a jq example in the postsuper manpage, to + delete the quotes around a queue ID. File: postsuper/postsuper.c. + + Cleanup: with "smtputf8_enable = yes" (the default), the + postscreen(8) dummy SMTP engine will no longer log a "non-UTF-8 + key" warning when a remote SMTP client sends garbage. Instead, + postscreen(8) will reject the command with the same server + response as smtpd(8). File: postscreen/postscreen_smtpd.c. + +20211025 + + Bugfix (introduced: Postfix 3.6): mangled warning where a + hostname and warning message ran together. Viktor Dukhovni. + File: tls/tls_dane.c. + +20211026 + + Feature: with "smtp_bind_address_enforce = yes" the Postfix + SMTP client will defer delivery when it is unable to apply + the smtp_bind_address or smtp_bind_address6 setting. By + default, the Postfix SMTP client continues with delivery, + after logging a warning. File: src/smtp/smtp_connect.c. + +20211027 + + Documentation: readability fix for the text about automatic + or explicit daemon restart (postfix reload) after LMDB table + change. raj. File: proto/lmdb_table. + + Safety: the postqueue command now sanitizes strings before they + are formatted as json output or legacy output. These outputs are + piped into other programs that are run by administrative + users. This closes a hypothetical opportunity for privilege + escalation. Files: util/attr.h, util/attr_scan*.c, + postqueue/showq_json.c, postqueue/showq_compat.c. + +20211030 + + Bugfix: check_ccert_access worked as expected, but produced + a spurious warning when Postfix was built without SASL + support. Fix by Brad Barden. File: smtpd/smtpd_check.c. + +20211102 + + Bugfix for smtp_bind_address_enforce (change 20211026), file + descriptor leak. Found by Viktor. File: smtp/smtp_connect.c. + +20211105 + + Bugfix (introduced: Postfix 2.4): queue file corruption + after a Milter (for example, MIMEDefang) made a request to + replace the message body with a copy of that message body + plus additional text (for example, a SpamAssassin report). + + The most likely impacts were a) the queue manager reporting + a fatal error resulting in email delivery delays, or b) the + queue manager reporting the corruption and moving the message + to the corrupt queue for damaged messages. + + However, a determined adversary could craft an email message + that would trigger the bug, and insert a content filter + destination or a redirect email address into its queue file. + Postfix would then deliver the message headers there, in + most cases without delivering the message body. With enough + experimentation, an attacker could make Postfix deliver + both the message headers and body. + + The details of a successful attack depend on the Milter + implementation, and on the Postfix and Milter configuration + details; these can be determined remotely through + experimentation. Failed experiments may be detected when + the queue manager terminates with a fatal error, or when + the queue manager moves damaged files to the "corrupt" queue + as evidence. + + Technical details: when Postfix executes a "replace body" + Milter request it will reuse queue file storage that was + used by the existing email message body. If the new body + is larger, Postfix will append body content to the end of + the queue file. The corruption happened when a Milter (for + example, MIMEDefang) made a request to replace the body of + a message with a new body that contained a copy of the + original body plus some new text, and the original body + contained a line longer than $line_length_limit bytes (for + example, an image encoded in base64 without hard or soft + line breaks). In queue files, Postfix stores a long text + line as multiple records with up to $line_length_limit bytes + each. Unfortunately, Postfix's "replace body" support did + not account for the additional queue file space needed to + store the second etc. record headers. And thus, the last + record(s) of a long text line could overwrite one or more + queue file records immediately after the space that was + previously occupied by the original message body. + + Problem report by Benoît Panizzon. + +20211107 + + Additional postcat flags for debuging a corrupted queue + file (-s: skip to offset; -r: don't follow pointer records). + File: postcat/postcat.c. + +20211110 + + Minor edits of 20211107 postcat changes. File: postcat.c. + + Regression prevention: added sanity check in the queue file + editing code. File: cleanup/cleanup_body_edit.c + + Regression prevention: copied a queue file record typecheck + from the pickup daemon. Files: *qmgr/qmgr_message.c. + +20211115 + + Bugfix (introduced: 20210708): duplicate bounce_notice_recipient + entries in postconf output. The fix to send SMTP session + transcripts to bounce_notice_recipient was incomplete. + Reported by Vincent Lefevre. File: smtpd/smtpd.c. + +20211127 + + Feature: support for the pcre2 library (the legacy pcre + library is still supported). See RELEASE_NOTES for details. + Files: makedefs, util/dict_open.c, util.dict_pcre.c, + proto/pcre_table, proto/PCRE_README.html. + +20211129 + + Portability: defines for FreeBSD <= 14.x, OpenBSD 7.x, NetBSD <= + 10.x. Brad Smith. Files: makedefs, util/sys_defs.h. + +20211202 + + Cleanup: warning messages when a Diffie-Hellman parameter + file cannot be opened or parsed. Viktor Dukhovni. File: + tls/tls_dh.c. + +20211204 + + Cleanup: parameter descriptions in manpages were frozen in the + past. Files: proto/aliases, src/local/local.c, src/pipe/pipe.c, + src/qmqpd/qmqpd.c, src/trivial-rewrite/trivial-rewrite.c. + + Documentation: added a "howto tip" to the stock main.cf + file. File: conf/main.cf + +20211211 + + Logging: the Postfix SMTP client logs an info message when it + breaks a long line with "<CR><LF><SP>". + +20211216 + + Bugfix (introduced: Postfix 3.0): the proxymap daemon did not + automatically authorize proxied maps inside pipemap (example: + pipemap:{proxy:maptype:mapname, ...}) or inside unionmap. Problem + reported by Mirko Vogt. Files: proxymap/proxymap.c. + +20211218 + + Typo fixes based on automated scans of C source code comments. + Verified that the .o files have not changed. Files: + bounce/bounce_notify_util.c, cleanup/cleanup_api.c, + cleanup/cleanup_message.c, dns/dns_lookup.c, flush/flush.c, + global/compat_level.c, global/db_common.c, + global/deliver_request.c, global/dict_ldap.c, global/dict_sqlite.c, + global/dynamicmaps.c, global/mail_conf_time.c, global/mail_copy.c, + global/mail_params.h, global/mail_proto.h, global/memcache_proto.c, + global/normalize_mailhost_addr.c, global/quote_822_local.c, + global/test_main.c, global/verify.c, global/verify_sender_addr.c, + local/unknown.c, master/dgram_server.c, master/event_server.c, + master/multi_server.c, master/single_server.c, + master/trigger_server.c, oqmgr/qmgr_entry.c, + postconf/postconf_dbms.c, postconf/postconf_master.c, + postconf/postconf_user.c, postdrop/postdrop.c, postmap/postmap.c, + postmulti/postmulti.c, postqueue/showq_compat.c, + postscreen/postscreen_smtpd.c, postscreen/postscreen_starttls.c, + posttls-finger/posttls-finger.c, proxymap/proxymap.c, + qmgr/qmgr_entry.c, qmqpd/qmqpd_peer.c, smtp/smtp.h, + smtp/smtp_proto.c, smtpd/smtpd_check.c, smtpd/smtpd_peer.c, + tls/tls_certkey.c, tls/tls_client.c, tls/tls_fprint.c, + tls/tls_misc.c, tls/tls_server.c, tlsmgr/tlsmgr.c, + tlsproxy/tlsproxy.c, trivial-rewrite/resolve.c, + trivial-rewrite/transport.c, trivial-rewrite/trivial-rewrite.c, + util/argv.c, util/dict_cache.c, util/dict_cdb.c, util/dict_file.c, + util/dict_random.c, util/dict_random.h, util/dict_thash.c, + util/dup2_pass_on_exec.c, util/edit_file.c, util/extpar.c, + util/gccw.c, util/mac_expand.c, util/mac_expand.h, + util/myaddrinfo.c, util/name_mask.c, util/sane_link.c, + util/sane_rename.c, util/unix_dgram_connect.c, + util/unix_dgram_listen.c, util/unix_pass_fd_fix.c, + util/vstring.c, xsasl/xsasl_dovecot_server.c. + + Typo fixes based on automated scans of other files. Files: + auxiliary/qshape/qshape.pl, conf/post-install, + conf/postmulti-script, makedefs, postfix-install, + proto/postconf.proto, TLS_ACKNOWLEDGEMENTS, TLS_CHANGES. + + Documentation: added a note to the cidr_table manpage that + with an inline CIDR map, "$" needs to be specified as "$$" + to avoid $name expansion surprises. File: proto/cidr_table. + +20211220 + + Bugfix (introduced: Postfix 2.5): off-by-one error while + writing a string terminator. This code had passed all memory + corruption tests, presumably because it wrote over an + alignment padding byte, or over an adjacent character byte + that was never read. Reported by Robert Siemer. Files: + *qmgr/qmgr_feedback.c. + + Typo fixes from Raf, based on manual inspection. Verified + that the .o files have not changed. Files: conf/main.cf, + mantools/postlink, proto/ADDRESS_REWRITING_README.html, + proto/BACKSCATTER_README.html, + proto/BASIC_CONFIGURATION_README.html, proto/BDAT_README.html, + proto/BUILTIN_FILTER_README.html, proto/COMPATIBILITY_README.html, + proto/CONNECTION_CACHE_README.html, proto/DATABASE_README.html, + proto/DEBUG_README.html, proto/FORWARD_SECRECY_README.html, + proto/INSTALL.html, proto/IPV6_README.html, proto/LDAP_README.html, + proto/LINUX_README.html, proto/MAILLOG_README.html, + proto/MILTER_README.html, proto/MULTI_INSTANCE_README.html, + proto/MYSQL_README.html, proto/POSTSCREEN_3_5_README.html, + proto/POSTSCREEN_README.html, proto/QSHAPE_README.html, + proto/SASL_README.html, proto/SCHEDULER_README.html, + proto/SMTPD_ACCESS_README.html, proto/SMTPD_POLICY_README.html, + proto/SMTPD_PROXY_README.html, proto/SMTPUTF8_README.html, + proto/SQLITE_README.html, proto/STANDARD_CONFIGURATION_README.html, + proto/STRESS_README.html, proto/TLS_LEGACY_README.html, + proto/TLS_README.html, proto/TUNING_README.html, + proto/VIRTUAL_README.html, proto/access, proto/canonical, + proto/generic, proto/ldap_table, proto/master, proto/mysql_table, + proto/pgsql_table, proto/postconf.proto, proto/relocated, + proto/sqlite_table, proto/transport, proto/virtual, + global/mail_version.h, local/local.c, pipe/pipe.c, + postalias/postalias.c, postconf/postconf.c, postfix/postfix.c, + postmap/postmap.c, postmulti/postmulti.c, + posttls-finger/posttls-finger.c, sendmail/sendmail.c, + smtpstone/smtp-sink.c, tlsproxy/tlsproxy.c, + trivial-rewrite/trivial-rewrite.c, virtual/virtual.c. + +20211221 + + Documentation: reverted some postconf(5) changes from + "Specify a non-zero time value" to "Specify a non-negative + time value". File: proto/postconf.proto. + + Documentation: reverted "destination concurrency limit" to + "destination recipient limit". File: proto/SCHEDULER_README.html. + + Documentation: rephrased conditional $name expositions for + forward_path and command_execution_directory. File: + local/local.c. + + Documentation: added Postfix 3.0 syntax to postconf(5) + descriptions of command_execution_directory, default_rbl_reply, + forward_path, luser_relay, recipient_delimiter. File: + proto/postconf.proto. + + Documentation: updated descriptions of smtpd_error_sleep_time + and smtpd_soft_error_limit. File: proto/postconf.proto. + + Fixed non-UTF8 quotes in TLS_CHANGES that caused nvi to + truncate the file. + + Fixed a remaining typo in util/load_lib.c. + +20211222 + + Added a top-level 'make typo-check' target to automate + the typo checks (this only works on Wietse's development + system, because it depends on specific implementations of + spell and lynx). Files: Makefile.in, mantools/comment.c, + mantools/deroff, mantools/check-double-cc, + mantools/check-double-install-proto-text, + mantools/check-double-proto-html, mantools/check-spell-cc, + mantools/check-spell-install-proto-text, + mantools/check-spell-proto-html, proto/stop, proto/stop.double-cc, + proto/stop.double-install-proto-text, proto/stop.double-proto-html, + proto/stop.spell-cc, proto/stop.spell-proto-html. + + Cleanup: manpages don't need \' - that causes groff to emit + non-ASCII text (depending on the locale). Christian Goettsche. + Files: sendmail/sendmail.c, spawn/spawn.c. + +20211223 + + Report unsupported usage. Do not link Postfix database + plugins against libpostfix-util or libpostfix-global. This + introduces false build dependencies. File: makedefs. + + Report unsupported usage. Do not build with LD_LIBRARY_PATH. + File: makedefs. + + Documented the implementation-dependent mailbox_size_limit + and message_size_limit maximal values. File: proto/postconf.proto. + + Cleanup: make typo-check tests portable across differernt + spellcheck implementations. Files: proto/stop.spell-proto-html, + proto/stop.spell-cc. + + Cleanup: added missing parameters to the mantools/postlink + script, based on output from the mantools/check-postlink + script. + + Cleanup: added missing _maps parameter names to the + proxy_read_maps default value, based on output from the + mantools/missing-proxy-read-maps script. File: + global/mail_params.h. + + Sanity: added LANG=C to the typo-check scripts to get + consistent output. Files: mantools/check-spell-proto-html, + mantools/check-spell-install-proto-text, mantools/check-spell-cc, + mantools/check-double-proto-html, + mantools/check-double-install-proto-text, mantools/check-double-cc. + +20211224 + + Cleanup: some compilter complains about indentation in a + multiline macro. File: util/dict_db.c. + +20211231 + + Cleanup: informative error message after failure to connect + to 'dovecot' socket. File: src/xsasl/xsasl_dovecot_server.c. + +20220101 + + Cleanup: AppArmor may return EPERM for permission errors. + This could result in a false "mail system is down" error + message from the postqueue command. File: postqueue/postqueue.c. + +202220102 + + Cleanup: log the reason why the postqueue command thinks + that the mail system is down, in case some security software + or kernel bug emits a weird error. File: postqueue/postqueue.c. + + Robustness: randomize the initial state of Postfix in-memory + hash tables, to defend against collision attacks involving + a large number of attacker-chosen lookup keys. Presently, + the only known opportunity for such attacks involves remote + SMTP client IPv6 addresses in the anvil service. Other + tables with attacker-chosen lookup keys are limited in size. + The fix is cheap, and therefore implemented for all Postfix + in-memory hash tables. Problem reported by Pascal Junod. + File: util/htable.c. + +20210103 + + Documentation: CIDR example for mynetworks. Scott Kitterman. + File: proto/postconf.proto. + + Updated the hash function to make the distance between + colliding inputs seed-dependent, which is really the only + property that we needed. File: util/htable.c. + +20210105 + + Cleanup: deleting the \ before \' broke other things. Now + we need to escape \ at the start of an nroff input line. + Files: mantools/postconf2man, mantools/srctoman. + +20220107 + + Updated the hash function to avoid losing state when an + input byte is 0 (can never happen with a null-terminated + string, but makes the hash function usable in other contexts. + File: util/htable.c. + +20220116 + + Added more pre-release checks: missing postlink rules, + missing maps in proxy_read_maps. File: Makefile.in. + +20220117 + + Cleanup: the nullmx_reject_code parameter was removed from + Postfix 3.0 before it was released, but the manpage was not + updated. File: proto/postconf.proto. + + Cleanup: after seeking past the end of a writable memory-backed + VSTREAM (i.e. backed by a VSTRING), write nulls over the + newly allocated bytes. This behavior is compatible with + seeking past the end of a writable regular file. File: + util/vstream.c. + + Cleanup: unit tests. File: cleanup/cleanup_milter.c. + + Cleamup: disable hash-table seed in unit tests. Many + Makefiles, some unit test 'reference' files. + + Bugfix (documented but not implemented since Postfix 2.2): + missing support for [address] in smtp_bind_address and + smtp_bind_address6. Reported by Vincent Pelletier. File: + smtp/smtp_connect.c. + +20220119 + + Cleanup: the 20211211 change could result in logfile spam. + Added a 1-bit counter to log "breaking long line" only once per + delivery request. File: smtp/smtp_proto.c. + +20220121 + + Cleanup: added a pre-release check for missing entries + in postfix-files. Problem reported by Jaroslav Skarvada. + Files: Makefile.in, conf/postfix-files, + mantools/check-postfix-files. Deleted: CYRUS_README. + + Cleanup: added the RELEASE_NOTES file to the pre-release + checks, after Viktor Dukhovni reported a typo. Files: + mantools/check-double-install-proto-text, + mantools/check-spell-install-proto-text. + + Cleanup: for consistent parameter naming (tlsproxy_client_xxx + correspnds to smtp_tls_xxx), renamed tlsproxy_client_level + to tlsproxy_client_security_level, and tlsproxy_client_policy + to tlsproxy_client_policy_maps, with backwards-compatible + defaults and updated documentation. Problem reported by + Raf. Files: global/mail_params.h, mantools/postlink, + postconf/postconf_builtin.c. + +20220123 + + Documentation: added LINUX_README sections for logging in + a container, and for systemd logging workarounds. File: + proto/LINUX_README.hmtl. + +20220126 + + Added defensive logging while waiting for the master daemon + to initialize in the background. File: master/master_monitor.c. + +20220127 + + Cleanup: smtpprox hyperlink. File: proto/FILTER_README.html. + +20220128 + + Clenaup: standardize on FNV hash, after having verified + that collisions will change with the hash seed value, and + that the collision rate is low. Files: util/htable.c, + util/hash_fnv.[hc]. + +20220129 + + Cleanup: factored out the non-cryptographic seeder. Files: + ldseed.[hc]. + +20220130 + + Cleanup: added a binhash unit test, and updated the htable + unit test. Files: util/Makefile.in, util/binhash.[hc], + util/htable.c. + + Cleanup: names of hash_fnv(3) build options. File: hash:fnv.c. + +20220202 + + Bitrot: Berkeley DB 18 is like Berkeley DB 6. Yasuhiro + Kimura. File: util/dict_db.c. + +20220217 + + Typo (introduced: Postfix.3.7): "pcre2 --libs" should be + "pcre2 --libs8". Reported by Carlos Velasco. File + proto/PCRE_README.html. + +20220322 + + Cleanup: added missing _checks, _reply_footer, _reply_filter, + _command_filter, and _delivery_status_filter parameter names + to the proxy_read_maps default value. Files: global/mail_params.h, + mantools/missing-proxy-read-maps. + +20220330 + + Documentation: updated the postlogd(8) daemon manpage, + adding that the Postfix >= 3.7 postlog(1) command can run + with setgid permissions. File: postlogd/postlogd.c. + +20220404 + + Bugfix: in an internal client module, "host or service not + found" was a fatal error, causing the milter_default_action + setting to be ignored. It is now a non-fatal error. The + same client is used by many Postfix clients (smtpd_proxy, + dovecot auth, tcp_table, memcache, socketmap, and so on). + Problem reported by Christian Degenkolb. File: util/inet_connect.c. + +20220415 + + Cleanup (problem introduced: Postfix 3.0): with dynamic map + loading enabled, an attempt to create a map with "postmap + regexp:path" would result in a bogus error message "Is the + postfix-regexp package installed?" instead of "unsupported + map type for this operation". This happened with all built-in + map types (static, cidr, etc.) that have no 'bulk create' + support. Problem reported by Greg Klanderman. File: + global/dynamicmaps.c. + +20220417 + + Cleanup (problem introduced: Postfix 2.7): milter_header_checks + maps are now opened before the cleanup server enters the + chroot jail. Problem reported by Jesper Dybdal. Files: + cleanup/cleanup.h, cleanup/cleanup_init.c, + cleanup/cleanup_milter.c, cleanup/cleanup_state.c. + +20220421 + + Bugfix (introduced: Postfix 3.7): reverted an overly complex + change in the postscreen SMTP engine from 20211023, and + replaced it with a much simpler change. The bad change was + segfaulting on some systems after receiving malformed input + (for example, TLS "hello"). File: postscreen/postscreen_smtpd.c. + + Under conditions described below, the postscreen program + attempted to read through an uninitialized 'const' pointer. + The pointer value depended on the compiler type and compiler + options, but crucially, it did not depend on network inputs. + + The conditions were that SMTPUTF8 support was enabled (the + default), and that postscreen received non-UTF8 input, for + example, a TLS or RDP handshake request. Depending on + compiler details, the result of the read operation could + be uninteresting, a combined memory leak and file handle + leak, or a segmentation violation (signal 11). + + The segmentation violation result was reported by Michael + Grimm who used a FreeBSD 13.1 early version. The result was + "uninteresting" with FreeBSD 13.0. Both FreeBSD systems use + Clang instead of GCC. The result was also "uninteresting" + on Linux-based systems that use GCC, or on a few older + systems that use GCC. + +20220719 + + Cleanup: Postfix 3.5.0 introduced debug logging noise in + map_search_create(). Files: global/map_search.c. + +20220724 + + Workaround: in a TLS server disable Postfix's 1-element + internal session cache, to work around an OpenSSL 3.0 + regression that broke TLS handshakes. It is rarely useful. + Report by Spil Oss, fix by Viktor Dukhovni. File: + tls/tls_server.c. + +20220905 + + Cleanup: Postfix 3.3.0 introduced an uninitialized + verify_append() request status in case of a null original + recipient address. File: global/verify.c. + +20220906 + + Cleanup: Postfix 3.7.1 introduced a missing msg_panic() + argument (in code that never executes). File: + cleanup/cleanup_milter.c. + +20221006 + + Bugfix (introduced: Postfix 3.7.0). A message could falsely + be flagged as corrupt with "warning: Unexpected record type + 'X'". Such messages were moved to the "corrupt" queue directory, + where they may still be found. See below for instructions to + deal with these falsely flagged messages. + + This could happen for messages with 5000 or more recipients, + or with fewer recipients on a busy mail server. Problem + reported by Frank Brendel, reproduced by John Alex. Files: + qmgr/qmgr_message.c, oqmgr/qmgr_message.c. + + A file in the "corrupt" queue directory may be inspected + with the command "postcat /var/spool/postfix/corrupt/<filename>. + If delivery of the file is still desired, the file can be + moved back to /var/spool/postfix/incoming after updating + Postfix and executing "postfix reload". diff --git a/external/ibm-public/postfix/dist/INSTALL b/external/ibm-public/postfix/dist/INSTALL index 10e69408c8b..4ab046d40d1 100644 --- a/external/ibm-public/postfix/dist/INSTALL +++ b/external/ibm-public/postfix/dist/INSTALL @@ -331,7 +331,7 @@ install" or "make upgrade". # make upgrade meta_directory=/usr/libexec/postfix ... # make install meta_directory=/usr/libexec/postfix ... -As with the command "make makefiles, the command "make install/upgrade +As with the command "make makefiles", the command "make install/upgrade name=value..." will replace the string MAIL_VERSION at the end of a configuration parameter value with the Postfix release version. Do not try to specify something like $mail_version on this command line. This produces @@ -593,6 +593,9 @@ The following is an extensive list of names and values. ||-DNO_POSIX_GETPW_R |getpwuid_r. By default Postfix uses these | || |where they are known to be available. | ||______________________________|_____________________________________________| +||-DNO_RES_NCALLS |Do not build with the threadsafe resolver(5) | +|| |API (res_ninit() etc.). | +||______________________________|_____________________________________________| || |Use setjmp()/longjmp() instead of sigsetjmp | ||-DNO_SIGSETJMP |()/siglongjmp(). By default, Postfix uses | || |sigsetjmp()/siglongjmp() when they are known | @@ -1085,6 +1088,7 @@ Finally, build the indexed aliases file with one of the following commands: # newaliases # sendmail -bi + # postalias /etc/aliases (pathname is system dependent!) 11 - To chroot or not to chroot diff --git a/external/ibm-public/postfix/dist/Makefile.in b/external/ibm-public/postfix/dist/Makefile.in index bffe77d5ef8..aa6c7ad9c72 100644 --- a/external/ibm-public/postfix/dist/Makefile.in +++ b/external/ibm-public/postfix/dist/Makefile.in @@ -1,7 +1,7 @@ # To test with valgrind: -# make -i tests VALGRIND="valgrind --tool=memcheck --log-file=/some/where.%p" +# make -i tests NORANDOMIZE="" VALGRIND="valgrind --tool=memcheck --log-file=/some/where.%p" SHELL = /bin/sh -WARN = -Wmissing-prototypes -Wformat -Wno-comment -fcommon +WARN = -Wmissing-prototypes -Wformat -Wno-comment -fno-common OPTS = 'WARN=$(WARN)' DIRS = src/util src/global src/dns src/tls src/xsasl src/master src/milter \ src/postfix src/fsstone src/smtpstone \ @@ -114,7 +114,39 @@ manpages: (set -e; echo "[$$i]"; cd $$i; $(MAKE) -f Makefile.in $(OPTS) MAKELEVEL=) || exit 1; \ done </dev/null -printfck: update +# Some checks require a bin/postconf executable. +pre-release-checks: typo-check missing-proxy-read-maps-check \ + postlink-check postfix-files-check + +postfix-files-check: + mantools/check-postfix-files | diff /dev/null - + +postlink-check: + $(SHLIB_ENV) mantools/check-postlink | diff /dev/null - + +missing-proxy-read-maps-check: + $(SHLIB_ENV) mantools/missing-proxy-read-maps | diff /dev/null - + +typo-check: spell-cc spell-install-proto-text spell-proto-html \ + double-cc double-install-proto-text double-proto-html + +spell-cc: + mantools/check-spell-cc | diff /dev/null - + +spell-install-proto-text: + mantools/check-spell-install-proto-text | diff /dev/null - + +spell-proto-html: + mantools/check-spell-proto-html | diff /dev/null - + +double-cc: + mantools/check-double-cc | diff /dev/null - + +double-install-proto-text: + mantools/check-double-install-proto-text | diff /dev/null - + +double-proto-html: + mantools/check-double-proto-html | diff /dev/null - # The build-time shlib_directory setting must take precedence over # the installed main.cf settings, otherwise we can't update an diff --git a/external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README b/external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README index a0ccc204001..78237b9ec06 100644 --- a/external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README +++ b/external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README @@ -280,8 +280,8 @@ address manipulations: Rewrite "user@host" to "user@host.$mydomain" This feature is controlled by the boolean append_dot_mydomain parameter - (default: yes). The purpose is to get consistent treatment of different - forms of the same hostname. + (default: Postfix ≥ 3.0: no, Postfix < 3.0: yes). The purpose is to + get consistent treatment of different forms of the same hostname. NOTE: Postfix versions 2.2 and later rewrite message headers from remote SMTP clients only if the client matches the diff --git a/external/ibm-public/postfix/dist/README_FILES/BACKSCATTER_README b/external/ibm-public/postfix/dist/README_FILES/BACKSCATTER_README index 2870d11f8dc..8095df27c34 100644 --- a/external/ibm-public/postfix/dist/README_FILES/BACKSCATTER_README +++ b/external/ibm-public/postfix/dist/README_FILES/BACKSCATTER_README @@ -200,8 +200,8 @@ CCaavveeaattss email addresses as username@example.com, messages with DSN turned on will trigger the REJECT action in the previous section. - If you have such clients then you can to exclude their Message-ID strings - with the two "Message-ID:.* <!&!" patterns that are shown in the previous + If you have such clients then you can exclude their Message-ID strings with + the two "Message-ID:.* <!&!" patterns that are shown in the previous section. Otherwise you will not be able to use the two backscatter rules to stop forged Message ID strings. Of course this workaround may break the next time Outlook is changed. @@ -260,8 +260,9 @@ techniques to recognize forgeries. Recognizing virus scanner mail is an error prone process, because there is a lot of variation in report formats. The following is only a small example of message header patterns. For a large collection of header and body patterns -that recognize virus notification email, see http://www.dkuug.dk/keld/virus/ or -http://www.t29.dk/antiantivirus.txt. +that recognize virus notification email, see https://web.archive.org/web/ +20100317123907/http://std.dkuug.dk/keld/virus/ or http://www.t29.dk/ +antiantivirus.txt. /etc/postfix/header_checks: /^Subject: *Your email contains VIRUSES/ DISCARD virus notification diff --git a/external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README b/external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README index cfd8851107b..4bc4d845df4 100644 --- a/external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README +++ b/external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README @@ -173,7 +173,7 @@ mail from outside an authorized network block. This is explained in the SASL_README and TLS_README documents. IMPORTANT: If your machine is connected to a wide area network then the -"mynetworks_style = host" setting may be too friendly. +"mynetworks_style = subnet" setting may be too friendly. Examples (specify only one of the following): @@ -188,13 +188,13 @@ You can specify the trusted networks in the main.cf file, or you can let Postfix do the work for you. The default is to let Postfix do the work. The result depends on the mynetworks_style parameter value. - * Specify "mynetworks_style = host" when Postfix should forward mail from - only the local machine. + * Specify "mynetworks_style = host" (the default when compatibility_level >= + 2) when Postfix should forward mail from only the local machine. - * Specify "mynetworks_style = subnet" (the default) when Postfix should - forward mail from SMTP clients in the same IP subnetworks as the local - machine. On Linux, this works correctly only with interfaces specified with - the "ifconfig" command. + * Specify "mynetworks_style = subnet" (the default when compatibility_level < + 2) when Postfix should forward mail from SMTP clients in the same IP + subnetworks as the local machine. On Linux, this works correctly only with + interfaces specified with the "ifconfig" or "ip" command. * Specify "mynetworks_style = class" when Postfix should forward mail from SMTP clients in the same IP class A/B/C networks as the local machine. diff --git a/external/ibm-public/postfix/dist/README_FILES/BDAT_README b/external/ibm-public/postfix/dist/README_FILES/BDAT_README index 2dc1df35ce6..6ed565ccdd3 100644 --- a/external/ibm-public/postfix/dist/README_FILES/BDAT_README +++ b/external/ibm-public/postfix/dist/README_FILES/BDAT_README @@ -23,7 +23,7 @@ BDAT support is enabled by default. To disable BDAT support globally: # The logging alternative: smtpd_discard_ehlo_keywords = chunking # The non-logging alternative: - smtpd_discard_ehlo_keywords = chunking, silent_discard + smtpd_discard_ehlo_keywords = chunking, silent-discard Specify '-o smtpd_discard_ehlo_keywords=' in master.cf for the submission and smtps services, if you have clients that benefit from CHUNKING support. @@ -119,6 +119,6 @@ Postfix's CHUNKING announcement as described above. In RFC 4468, the authors write that a client may pipeline commands, and that after sending BURL LAST or BDAT LAST, a client must wait for the server's -response. But as this text does not appear in RFC 3030 which defines BDAT, is -it a useless restriction that Postfix will not enforce. +response. But as this text does not appear in RFC 3030 which defines BDAT, it +is a useless restriction that Postfix will not enforce. diff --git a/external/ibm-public/postfix/dist/README_FILES/BUILTIN_FILTER_README b/external/ibm-public/postfix/dist/README_FILES/BUILTIN_FILTER_README index 5ed04169de4..2ce639df538 100644 --- a/external/ibm-public/postfix/dist/README_FILES/BUILTIN_FILTER_README +++ b/external/ibm-public/postfix/dist/README_FILES/BUILTIN_FILTER_README @@ -300,9 +300,9 @@ CCoonnffiigguurriinngg hheeaaddeerr//bbooddyy cchheecc The following information applies to Postfix 2.1. Earlier Postfix versions do not support the receive_override_options feature. -If you are MX service provider and want to apply disable head/body checks for -some domains, you can configure ONE Postfix instance with multiple SMTP server -IP addresses in master.cf. Each address provides a different service. +If you are an MX service provider and want to enable header/body checks only +for some domains, you can configure ONE Postfix instance with multiple SMTP +server IP addresses in master.cf. Each address provides a different service. /etc/postfix.master.cf: # ================================================================= diff --git a/external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README b/external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README index 20674ff6c82..55182b7f66f 100644 --- a/external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README +++ b/external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README @@ -27,14 +27,16 @@ compatible settings need to be made permanent in main.cf or master.cf, before turning off the backwards-compatibility safety net as described at the end of this document. -The following messages may be logged: +Logged with compatibility_level < 1: * Using backwards-compatible default setting append_dot_mydomain=yes * Using backwards-compatible default setting chroot=y - * Using backwards-compatible default setting smtpd_relay_restrictions = - (empty) +Logged with compatibility_level < 2: + + * Using backwards-compatible default setting "smtpd_relay_restrictions = + (empty)" * Using backwards-compatible default setting mynetworks_style=subnet @@ -42,6 +44,19 @@ The following messages may be logged: * Using backwards-compatible default setting smtputf8_enable=no +Logged with compatibility_level < 3.6: + + * Using backwards-compatible default setting smtpd_tls_fingerprint_digest=md5 + + * Using backwards-compatible default setting smtp_tls_fingerprint_digest=md5 + + * Using backwards-compatible default setting lmtp_tls_fingerprint_digest=md5 + + * Using backwards-compatible default setting + smtpd_relay_before_recipient_restrictions=no + + * Using backwards-compatible default setting respectful_logging=no + If such a message is logged in the context of a legitimate request, the system administrator should make the backwards-compatible setting permanent in main.cf or master.cf, as detailed in the sections that follow. @@ -141,7 +156,7 @@ UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee dd The mynetworks_style default value has changed from "subnet" to "host". This parameter is used to implement the "permit_mynetworks" feature. The change -could in unexpected 'access denied' errors after Postfix is updated from an +could cause unexpected 'access denied' errors after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises. @@ -210,7 +225,7 @@ domain names. UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg ssmmttppuuttff88__eennaabbllee==nnoo -The smtputf8_enable default value has changed from "no" to "yes. With the new +The smtputf8_enable default value has changed from "no" to "yes". With the new "yes" setting, the Postfix SMTP server rejects non-ASCII addresses from clients that don't request SMTPUTF8 support, after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such @@ -236,6 +251,126 @@ setting "smtputf8_enable = no" permanent in main.cf: # ppoossttccoonnff ssmmttppuuttff88__eennaabbllee==nnoo # ppoossttffiixx rreellooaadd +UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg ssmmttppdd__ttllss__ffiinnggeerrpprriinntt__ddiiggeesstt==mmdd55 + +The smtpd_tls_fingerprint_digest default value has changed from "md5" to +"sha256". With the new "sha256" setting, the Postfix SMTP server avoids using +the deprecated "md5" algorithm and computes a more secure digest of the client +certificate. + +If you're using the default "md5" setting, or even an explicit "sha1" (also +deprecated) setting, you should consider switching to "sha256". This will +require updating any associated lookup table keys with the "sha256" digests of +the expected client certificate or public key. + +As long as the smtpd_tls_fingerprint_digest parameter is left at its implicit +default value, and the compatibility_level setting is less than 3.6, Postfix +logs a warning each time a client certificate or public key fingerprint is +(potentially) used for access control: + + postfix/smtpd[27560]: using backwards-compatible default setting + smtpd_tls_fingerprint_digest=md5 to compute certificate fingerprints + +Since any client certificate fingerprints are passed in policy service lookups, +and Postfix doesn't know whether the fingerprint will be used, the warning may +also be logged when policy lookups are performed for connections that used a +client certificate, even if the policy service does not in fact examine the +client certificate. To reduce the noise somewhat, such warnings are issued at +most once per smtpd(8) process instance. + +If you prefer to stick with "md5", you can suppress the warnings by making that +setting explicit. After addressing any other compatibility warnings, you can +update your compatibility level. + + # ppoossttccoonnff ssmmttppdd__ttllss__ffiinnggeerrpprriinntt__ddiiggeesstt==mmdd55 + # ppoossttffiixx rreellooaadd + +UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg ssmmttpp__ttllss__ffiinnggeerrpprriinntt__ddiiggeesstt==mmdd55 + +The smtp_tls_fingerprint_digest and lmtp_tls_fingerprint_digest default values +have changed from "md5" to "sha256". With the new "sha256" setting, the Postfix +SMTP and LMTP client avoids using the deprecated "md5" algorithm and computes a +more secure digest of the server certificate. + +If you're using the default "md5" setting, or even an explicit "sha1" (also +deprecated) setting, you should consider switching to "sha256". This will +require updating any "fingerprint" security level policies in the TLS policy +table to specify matching "sha256" digests of the expected server certificates +or public keys. + +As long as the smtp_tls_fingerprint_digest (or LMTP equivalent) parameter is +left at its implicit default value, and the compatibility_level setting is less +than 3.6, Postfix logs a warning each time the "fingerprint" security level is +used to specify matching "md5" digests of trusted server certificates or public +keys: + + postfix/smtp[27560]: using backwards-compatible default setting + smtp_tls_fingerprint_digest=md5 to compute certificate fingerprints + +If you prefer to stick with "md5", you can suppress the warnings by making that +setting explicit. After addressing any other compatibility warnings, you can +update your compatibility level. + + # ppoossttccoonnff ''ssmmttpp__ttllss__ffiinnggeerrpprriinntt__ddiiggeesstt == mmdd55'' \\ + ''llmmttpp__ttllss__ffiinnggeerrpprriinntt__ddiiggeesstt == mmdd55'' + # ppoossttffiixx rreellooaadd + +UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg +ssmmttppdd__rreellaayy__bbeeffoorree__rreecciippiieenntt__rreessttrriiccttiioonnss==nnoo + +The smtpd_relay_before_recipient_restrictions feature was introduced in Postfix +version 3.6, to evaluate smtpd_relay_restrictions before +smtpd_recipient_restrictions. Historically, smtpd_relay_restrictions was +evaluated after smtpd_recipient_restrictions, contradicting documented +behavior. + + Background: smtpd_relay_restrictions is primarily designed to enforce a + mail relaying policy, while smtpd_recipient_restrictions is primarily + designed to enforce spam blocking policy. Both are evaluated while replying + to the RCPT TO command, and both support the same features. + +To maintain compatibility with earlier versions, Postfix will keep evaluating +smtpd_recipient_restrictions before smtpd_relay_restrictions, as long as the +compatibility_level is less than 3.6, and the +smtpd_relay_before_recipient_restrictions parameter is left at its implicit +default setting. As a reminder, Postfix may log the following message: + + postfix/smtpd[54696]: using backwards-compatible default setting + smtpd_relay_before_recipient_restrictions=no to reject recipient + "user@example.com" from client "host.example.net[10.0.0.2]" + +If Postfix should keep evaluating smtpd_recipient_restrictions before +smtpd_relay_restrictions, then the system administrator should make the +backwards-compatible setting "smtpd_relay_before_recipient_restrictions=no" +permanent in main.cf: + + # ppoossttccoonnff ssmmttppdd__rreellaayy__bbeeffoorree__rreecciippiieenntt__rreessttrriiccttiioonnss==nnoo + # ppoossttffiixx rreellooaadd + +UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg rreessppeeccttffuull__llooggggiinngg==nnoo + +Postfix version 3.6 deprecates configuration parameter names and logging that +suggest white is better than black. Instead it prefers 'allowlist, 'denylist', +and variations of those words. While the renamed configuration parameters have +backwards-compatible default values, the changes in logging could affect +logfile analysis tools. + +To avoid breaking existing logfile analysis tools, Postfix will keep logging +the deprecated form, as long as the respectful_logging parameter is left at its +implicit default value, and the compatibility_level setting is less than 3.6. +As a reminder, Postfix may log the following when a remote SMTP client is +allowlisted or denylisted: + + postfix/postscreen[22642]: Using backwards-compatible default setting + respectful_logging=no for client [address]:port + +If Postfix should keep logging the deprecated form, then the system +administrator should make the backwards-compatible setting "respectful_logging += no" permanent in main.cf. + + # ppoossttccoonnff ""rreessppeeccttffuull__llooggggiinngg == nnoo"" + # ppoossttffiixx rreellooaadd + TTuurrnniinngg ooffff tthhee bbaacckkwwaarrddss--ccoommppaattiibbiilliittyy ssaaffeettyy nneett Backwards compatibility is turned off by updating the compatibility_level @@ -252,3 +387,13 @@ For N specify the number that is logged in your postfix(1) warning message: Sites that don't care about backwards compatibility may set "compatibility_level = 9999" at their own risk. +Starting with Postfix version 3.6, the compatibility level in the above warning +message is the Postfix version that introduced the last incompatible change. +The level is formatted as major.minor.patch, where patch is usually omitted and +defaults to zero. Earlier compatibility levels are 0, 1 and 2. + +NOTE: Postfix 3.6 also introduces support for the "<level", "<=level", and +other operators to compare compatibility levels. With the standard operators +"<", "<=", etc., compatibility level "3.10" would be smaller than "3.9" which +is undesirable. + diff --git a/external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README b/external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README index bd2fd03084e..f578fb7d189 100644 --- a/external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README +++ b/external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README @@ -7,9 +7,6 @@ IInnttrroodduuccttiioonn This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later. -See Client-side TLS connection reuse for how this connection cache is used to -implement multiple deliveries per TLS-encrypted connection. - Topics covered in this document: * What SMTP connection caching can do for you @@ -22,8 +19,9 @@ Topics covered in this document: WWhhaatt SSMMTTPP ccoonnnneeccttiioonn ccaacchhiinngg ccaann ddoo ffoorr yyoouu With SMTP connection caching, Postfix can deliver multiple messages over the -same SMTP connection. By default, Postfix 2.2 reuses an SMTP connection -automatically when a destination has high volume of mail in the active queue. +same SMTP connection. By default, Postfix 2.2 reuses a plaintext SMTP +connection automatically when a destination has high volume of mail in the +active queue. SMTP Connection caching is a performance feature. Whether or not it actually improves performance depends on the conditions: @@ -32,9 +30,15 @@ improves performance depends on the conditions: mail to a destination with multiple mail servers, because it can help Postfix to skip over a non-responding server. + * SMTP Connection caching can also help with receivers that impose rate + limits on new connections. + * Otherwise, the benefits of SMTP connection caching are minor: it eliminates the latency of the TCP handshake (SYN, SYN+ACK, ACK), plus the latency of the SMTP initial handshake (220 greeting, EHLO command, EHLO response). + With TLS-encrypted connections, this can save an additional two roundtrips + that would otherwise be needed to send STARTTLS and to resume a TLS + session. * SMTP Connection caching gives no gains with respect to SMTP session tear- down. The Postfix smtp(8) client normally does not wait for the server's @@ -55,27 +59,16 @@ For an overview of how Postfix delivers mail, see the Postfix architecture OVERVIEW document. The Postfix connection cache is shared among Postfix mail delivering processes. -This maximizes the opportunity to reuse an open connection. Other MTAs such as -Sendmail or exim have a non-shared connection cache. Here, a connection can be -reused only by the mail delivering process that creates the connection. To get -the same performance improvement as with a shared connection cache, non-shared +This maximizes the opportunity to reuse an open connection. Some MTAs such as +Sendmail have a non-shared connection cache. Here, a connection can be reused +only by the mail delivering process that creates the connection. To get the +same performance improvement as with a shared connection cache, non-shared connections need to be kept open for a longer time. The scache(8) server, introduced with Postfix version 2.2, maintains the shared connection cache. With Postfix version 2.2, only the smtp(8) client has support to access this cache. - /-- smtp(8) --> Internet - - qmgr(8) - | - \-- | smtp(8) --> Internet - | - ^ - | - - scache(8) - When SMTP connection caching is enabled (see next section), the smtp(8) client does not disconnect after a mail transaction, but gives the connection to the scache(8) server which keeps the connection open for a limited amount of time. @@ -85,10 +78,42 @@ client continues with some other mail delivery request. Meanwhile, any smtp(8) client process can ask the scache(8) server for that cached connection and reuse it for mail delivery. + /-- smtp(8) --> Internet + + qmgr(8) + | + \-- | smtp(8) + | + | ^ + v | + + scache(8) + +With TLS connection reuse (Postfix 3.4 and later), the Postfix smtp(8) client +connects to a remote SMTP server and sends plaintext EHLO and STARTTLS +commands, then inserts a tlsproxy(8) process into the connection as shown +below. + +After delivering mail, the smtp(8) client hands over the open smtp(8)-to- +tlsproxy(8) connection to the scache(8) server, and continues with some other +mail delivery request. Meanwhile, any smtp(8) client process can ask the scache +(8) server for that cached connection and reuse it for mail delivery. + + /-- smtp(8) --> tlsproxy(8) --> Internet + + qmgr(8) + | + \-- | smtp(8) + | + | ^ + v | + + scache(8) + The connection cache can be searched by destination domain name (the right-hand side of the recipient address) and by the IP address of the host at the other end of the connection. This allows Postfix to reuse a connection even when the -remote host is mail server for domains with different names. +remote host is a mail server for domains with different names. CCoonnnneeccttiioonn ccaacchhee ccoonnffiigguurraattiioonn @@ -134,6 +159,9 @@ The Postfix smtp(8) client supports two connection caching strategies: smtp_connection_cache_destinations = hotmail.com, ... smtp_connection_cache_destinations = static:all (not recommended) + See Client-side TLS connection reuse to enable multiple deliveries over a + TLS-encrypted connection (Postfix version 3.4 and later). + CCoonnnneeccttiioonn ccaacchhee ssaaffeettyy mmeecchhaanniissmmss Connection caching must be used wisely. It is anti-social to keep an unused diff --git a/external/ibm-public/postfix/dist/README_FILES/DATABASE_README b/external/ibm-public/postfix/dist/README_FILES/DATABASE_README index 99e10a7555c..3fd88c3e6cc 100644 --- a/external/ibm-public/postfix/dist/README_FILES/DATABASE_README +++ b/external/ibm-public/postfix/dist/README_FILES/DATABASE_README @@ -58,7 +58,7 @@ With some tables, however, Postfix needs to know only if the lookup key exists. Any non-empty lookup result value may be used here: the lookup result is not used. Examples are the local_recipient_maps that determine what local recipients Postfix accepts in mail from the network, the mydestination -parameter that specifies what domains Postfix delivers locally, or the +parameter that specifies what domains Postfix delivers locally for, or the mynetworks parameter that specifies the IP addresses of trusted clients or client networks. Technically, these are lists, not tables. Despite the difference, Postfix lists are described here because they use the same @@ -221,8 +221,8 @@ To find out what database types your Postfix system supports, use the "ppooss to create a database file for just a few fixed elements. See also the static: map type. iinntteerrnnaall - A non-shared, in-memory hash table. Its content are lost when a process - terminates. + A non-shared, in-memory hash table. Its contents are lost when a + process terminates. llmmddbb OpenLDAP LMDB database. This is available only on systems with support for LMDB databases. Public database files are created with the postmap diff --git a/external/ibm-public/postfix/dist/README_FILES/DB_README b/external/ibm-public/postfix/dist/README_FILES/DB_README index 869218e4e4b..2d0ac934710 100644 --- a/external/ibm-public/postfix/dist/README_FILES/DB_README +++ b/external/ibm-public/postfix/dist/README_FILES/DB_README @@ -65,6 +65,9 @@ something like: AUXLIBS="-L/usr/local/BerkeleyDB/lib -ldb" % make +If your Berkeley DB shared library is in a directory that the RUN-TIME linker +does not know about, add a "-Wl,-R,/path/to/directory" option after "-ldb". + Solaris needs this: % make makefiles CCARGS="-DHAS_DB -I/usr/local/BerkeleyDB/include" \ diff --git a/external/ibm-public/postfix/dist/README_FILES/DEBUG_README b/external/ibm-public/postfix/dist/README_FILES/DEBUG_README index a277d96636a..3a895c743de 100644 --- a/external/ibm-public/postfix/dist/README_FILES/DEBUG_README +++ b/external/ibm-public/postfix/dist/README_FILES/DEBUG_README @@ -386,12 +386,12 @@ When reporting a problem, be sure to include the following information. o "ppoossttccoonnff --MMff" (Postfix 2.9 or later). - * Better, provide output from the ppoossttffiinnggeerr tool. This can be found at http: - //ftp.wl0.org/SOURCES/postfinger. + * Better, provide output from the ppoossttffiinnggeerr tool. This can be found at + https://github.com/ford--prefect/postfinger. * If the problem is SASL related, consider including the output from the - ssaassllffiinnggeerr tool. This can be found at http://postfix.state-of-mind.de/ - patrick.koetter/saslfinger/. + ssaassllffiinnggeerr tool. This can be found at https://packages.debian.org/ + search?keywords=sasl2-bin. * If the problem is about too much mail in the queue, consider including output from the qqsshhaappee tool, as described in the QSHAPE_README file. diff --git a/external/ibm-public/postfix/dist/README_FILES/FILTER_README b/external/ibm-public/postfix/dist/README_FILES/FILTER_README index bbe2adba11e..4a76bb9b5bb 100644 --- a/external/ibm-public/postfix/dist/README_FILES/FILTER_README +++ b/external/ibm-public/postfix/dist/README_FILES/FILTER_README @@ -282,8 +282,8 @@ This content filter receives unfiltered mail with SMTP on localhost port 10025, and sends filtered mail back into Postfix with SMTP on localhost port 10026. For non-SMTP capable content filtering software, Bennett Todd's SMTP proxy -implements a nice PERL/SMTP content filtering framework. See: http:// -bent.latency.net/smtpprox/. +implements a nice PERL/SMTP content filtering framework. See: https:// +web.archive.org/web/20151022025756/http://bent.latency.net/smtpprox/. In the figure below, names followed by a number represent Postfix commands or daemon programs. See the OVERVIEW document for an introduction to the Postfix diff --git a/external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README b/external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README index 0d3fb12c720..3eb707cc8f8 100644 --- a/external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README +++ b/external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README @@ -121,7 +121,7 @@ Exchange servers and is not recommended for now. EEDDHH SSeerrvveerr ssuuppppoorrtt -Postfix >= 2.2 support 1024-bit-prime EDH out of the box, with no additional +Postfix >= 2.2 supports 1024-bit-prime EDH out of the box, with no additional configuration, but you may want to override the default prime to be 2048 bits long, and you may want to regenerate your primes periodically. See the quick- start section for details. With Postfix >= 3.1 the out of the box (compiled-in) @@ -153,7 +153,7 @@ recommended configuration to work around this issue. EEEECCDDHH SSeerrvveerr ssuuppppoorrtt -Postfix >= 2.6 support NIST P-256 EECDH when built with OpenSSL >= 1.0.0. When +Postfix >= 2.6 supports NIST P-256 EECDH when built with OpenSSL >= 1.0.0. When the remote SMTP client also supports EECDH and implements the P-256 curve, forward secrecy just works. @@ -248,8 +248,18 @@ security against pre-computation attacks and for compatibility with Debian- patched Exim SMTP clients that require a >= 2048-bit length for the non-export prime. -Execute as root (prime group generation can take a few seconds to a few -minutes): +With Postfix >= 3.7 built against OpenSSL version is 3.0.0 or later, when the +value of smtpd_tls_dh1024_param_file is either empty or "aauuttoo", the EDH +parameter selection is delegated to the OpenSSL library, which selects +appropriate parameters based on the TLS handshake. This choice is likely to be +the most interoperable with SMTP clients using various TLS libraries, and +custom local parameters are no longer recommended when using Postfix >= 3.7 +built against OpenSSL 3.0.0. Just leave smtpd_tls_dh1024_param_file at its +default value (both in main.cf(5) and any master.cf(5) overrides, and let +OpenSSL do the work. + +Otherwise, execute as root (prime group generation can take a few seconds to a +few minutes): # cd /etc/postfix # umask 022 @@ -259,7 +269,8 @@ minutes): # chmod 644 dh512.pem dh1024.pem dh2048.pem The Postfix SMTP server EDH parameter files are not secret, after all these -parameters are sent to all remote SMTP clients in the clear. Mode 0644 is fine. +parameters are sent to all remote SMTP clients in the clear. Mode 0644 is +appropriate. You can improve security against pre-computation attacks further by regenerating the Postfix SMTP server EDH parameters periodically (an hourly or @@ -401,7 +412,7 @@ with one of these prefixes. This pattern is likely to persist until some new key-exchange mechanism is invented that also supports forward secrecy. The actual key length and raw algorithm key length are generally the same with -non-export ciphers, but may they differ for the legacy export ciphers where the +non-export ciphers, but they may differ for the legacy export ciphers where the actual key is artificially shortened. Starting with TLS 1.3 the cipher name no longer contains enough information to diff --git a/external/ibm-public/postfix/dist/README_FILES/IPV6_README b/external/ibm-public/postfix/dist/README_FILES/IPV6_README index 872756ee91b..a29560c472e 100644 --- a/external/ibm-public/postfix/dist/README_FILES/IPV6_README +++ b/external/ibm-public/postfix/dist/README_FILES/IPV6_README @@ -69,38 +69,19 @@ configuration work with Postfix. /etc/postfix/main.cf: # You must stop/start Postfix after changing this parameter. - inet_protocols = ipv4 (DEFAULT: enable IPv4 only) inet_protocols = all (enable IPv4, and IPv6 if supported) + inet_protocols = ipv4 (enable IPv4 only) inet_protocols = ipv4, ipv6 (enable both IPv4 and IPv6) inet_protocols = ipv6 (enable IPv6 only) - By default, Postfix uses IPv4 only, because most systems aren't attached to - an IPv6 network. - - o On systems with combined IPv4/IPv6 stacks, attempts to deliver mail via - IPv6 would always fail with "network unreachable", and those attempts - would only slow down Postfix. - - o Linux kernels don't even load IPv6 protocol support by default. Any - attempt to use it would fail immediately. + The default is compile-time dependent: "all" when Postfix is built on a + software distribution with IPv6 support, "ipv4" otherwise. Note 1: you must stop and start Postfix after changing the inet_protocols configuration parameter. - Note 2: if you see error messages like the following, then you're running - Linux and need to turn on IPv6 in the kernel: see http://www.ipv6.org/ for - hints and tips. Unlike other systems, Linux does not have a combined stack - for IPv4 and IPv6, and IPv6 protocol support is not loaded by default. - - postconf: warning: inet_protocols: IPv6 support is disabled: Address - family not supported by protocol - postconf: warning: inet_protocols: configuring for IPv4 support only - - Note 3: on older Linux and Solaris systems, the setting "inet_protocols = - ipv6" will not prevent Postfix from accepting IPv4 connections. Postfix - will present the client IP addresses in IPv6 format, though. In all other - cases, Postfix always presents IPv4 client IP addresses in the traditional - dotted quad IPv4 format. + Note 2: on older Linux and Solaris systems, the setting "inet_protocols = + ipv6" will not prevent Postfix from accepting IPv4 connections. * The other new parameter is smtp_bind_address6. This sets the local interface address for outgoing IPv6 SMTP connections, just like the @@ -117,7 +98,7 @@ configuration work with Postfix. mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [fe80::]/10 [2001: 240:587::]/64 - If you did specify the mynetworks parameter value in main.cf, you need + If you did specify the mynetworks parameter value in main.cf, you need to update the mynetworks value to include the IPv6 networks the system is in. Be sure to specify IPv6 address information inside "[]", like this: @@ -137,8 +118,8 @@ KKnnoowwnn LLiimmiittaattiioonnss IPv4 outgoing connection attempts is configurable with the smtp_address_preference parameter. - * Postfix versions before 2.6 do not support DNSBL (real-time blackhole list) - lookups for IPv6 client IP addresses. + * Postfix versions before 2.6 do not support DNSBL (DNS blocklist) lookups + for IPv6 client IP addresses. * IPv6 does not have class A, B, C, etc. networks. With IPv6 networks, the setting "mynetworks_style = class" has the same effect as the setting @@ -165,8 +146,8 @@ Strik and others, but differs in a few minor ways. * main.cf: Specify "inet_interfaces = loopback-only" to listen on loopback network interfaces only. - * The lmtp_bind_address and lmtp_bind_address6 features were omitted. The - Postfix LMTP client will be absorbed into the SMTP client, so there is no + * The lmtp_bind_address and lmtp_bind_address6 features were omitted. Postfix + version 2.3 merged the LMTP client into the SMTP client, so there was no reason to keep adding features to the LMTP client. * The SMTP server now requires that IPv6 addresses in SMTP commands are diff --git a/external/ibm-public/postfix/dist/README_FILES/LDAP_README b/external/ibm-public/postfix/dist/README_FILES/LDAP_README index 6723356360a..eeef565a6d8 100644 --- a/external/ibm-public/postfix/dist/README_FILES/LDAP_README +++ b/external/ibm-public/postfix/dist/README_FILES/LDAP_README @@ -54,6 +54,9 @@ this in the top level of your Postfix source tree should work: % make makefiles CCARGS="-I/usr/local/include -DHAS_LDAP" \ AUXLIBS_LDAP="-L/usr/local/lib -lldap -L/usr/local/lib -llber" +If your LDAP shared library is in a directory that the RUN-TIME linker does not +know about, add a "-Wl,-R,/path/to/directory" option after "-lldap". + Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_LDAP. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically- loaded LDAP database client, but only the new AUXLIBS_LDAP variable supports @@ -391,7 +394,7 @@ NNootteess aanndd tthhiinnggss ttoo tthhiinnkk aabboouu query_filter = (&(mailacceptinggeneralid=%s)(!(|(maildrop="*|*") (maildrop="*:*")(maildrop="*/*")))) - * And for that matter, even for aliases, you may not want users able to + * And for that matter, even for aliases, you may not want users to be able to specify their maildrops as programs, includes, etc. This might be particularly pertinent on a "sealed" server where they don't have local UNIX accounts, but exist only in LDAP and Cyrus. You might allow the fun diff --git a/external/ibm-public/postfix/dist/README_FILES/LINUX_README b/external/ibm-public/postfix/dist/README_FILES/LINUX_README index a8569c7bb1f..b8288798fb8 100644 --- a/external/ibm-public/postfix/dist/README_FILES/LINUX_README +++ b/external/ibm-public/postfix/dist/README_FILES/LINUX_README @@ -4,10 +4,10 @@ PPoossttffiixx aanndd LLiinnuuxx HHoosstt llooookkuupp iissssuueess -By default Linux /etc/hosts lookups do not support multiple IP address per +By default Linux /etc/hosts lookups do not support multiple IP addresses per hostname. This causes warnings from the Postfix SMTP server that "hostname XXX does not resolve to address YYY", and is especially a problem with hosts that -have both IPv4 and IPv6 addresses. To fix, turn on support for multiple IP +have both IPv4 and IPv6 addresses. To fix this, turn on support for multiple IP addresses: /etc/host.conf: @@ -42,11 +42,17 @@ file for further information. PPrrooccmmaaiill iissssuueess -On RedHat Linux 7.1 and later pprrooccmmaaiill no longer has permission to write the +On RedHat Linux 7.1 and later pprrooccmmaaiill no longer has permission to write to the mail spool directory. Workaround: # chmod 1777 /var/spool/mail +LLooggggiinngg iinn aa ccoonnttaaiinneerr + +When running Postfix inside a container, you can use stdout logging as +described in MAILLOG_README. Alternatives: run syslogd inside the container, or +mount the host's syslog socket inside the container. + SSyyssllooggdd ppeerrffoorrmmaannccee LINUX ssyyssllooggdd uses synchronous writes by default. Because of this, ssyyssllooggdd can @@ -59,3 +65,10 @@ synchronous mail logfile writes by editing /etc/syslog.conf and by prepending a Send a "kkiillll --HHUUPP" to the ssyyssllooggdd to make the change effective. +OOtthheerr llooggggiinngg ppeerrffoorrmmaannccee iissssuueess + +LINUX ssyysstteemmdd intercepts all logging and enforces its own rate limits before +handing off requests to a backend such as rrssyyssllooggdd or ssyysslloogg--nngg. On a busy mail +server this can result in information loss. As a workaround, you can use +Postfix's built-in logging as described in MAILLOG_README. + diff --git a/external/ibm-public/postfix/dist/README_FILES/LMDB_README b/external/ibm-public/postfix/dist/README_FILES/LMDB_README index e63640f51c0..193880b5161 100644 --- a/external/ibm-public/postfix/dist/README_FILES/LMDB_README +++ b/external/ibm-public/postfix/dist/README_FILES/LMDB_README @@ -31,6 +31,9 @@ support, use something like: AUXLIBS_LMDB="-L/usr/local/lib -llmdb" % make +If your LMDB shared library is in a directory that the RUN-TIME linker does not +know about, add a "-Wl,-R,/path/to/directory" option after "-llmdb". + Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_LMDB. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically- loaded LMDB database client, but only the new AUXLIBS_LMDB variable supports diff --git a/external/ibm-public/postfix/dist/README_FILES/MAILLOG_README b/external/ibm-public/postfix/dist/README_FILES/MAILLOG_README index d0849bb73c4..ec63b96fece 100644 --- a/external/ibm-public/postfix/dist/README_FILES/MAILLOG_README +++ b/external/ibm-public/postfix/dist/README_FILES/MAILLOG_README @@ -73,7 +73,7 @@ implements the following steps: Notes: - * This command will not rotate a logfile with pathname under the /dev + * This command will not rotate a logfile with a pathname under the /dev directory, such as /dev/stdout. * This command does not (yet) remove old logfiles. @@ -86,7 +86,7 @@ Background: as well as non-daemon programs for local mail submission or Postfix management. - * Logging to Postfix logfile or stdout requires the Postfix postlogd(8) + * Logging to the Postfix logfile or stdout requires the Postfix postlogd(8) service. This ensures that simultaneous logging from different programs will not get mixed up. diff --git a/external/ibm-public/postfix/dist/README_FILES/MILTER_README b/external/ibm-public/postfix/dist/README_FILES/MILTER_README index 6cdea837dda..9e866d4cc59 100644 --- a/external/ibm-public/postfix/dist/README_FILES/MILTER_README +++ b/external/ibm-public/postfix/dist/README_FILES/MILTER_README @@ -163,7 +163,7 @@ The general syntax for listening sockets is as follows: Connect to the local UNIX-domain server that is bound to the specified pathname. If the smtpd(8) or cleanup(8) process runs chrooted, an absolute pathname is interpreted relative to the Postfix queue - directory. + directory. On many systems, llooccaall is a synonym for uunniixx iinneett::host::port Connect to the specified TCP port on the specified local or remote @@ -507,7 +507,7 @@ queue ID, sender, or recipient). To force a macro to be sent even when its value has not been updated, you may specify macro default values with the milter_macro_defaults parameter. Specify zero or more name=value pairs separated by comma or whitespace; you may even -specify macro names that Postfix does know about! +specify macro names that Postfix does not know about! WWoorrkkaarroouunnddss diff --git a/external/ibm-public/postfix/dist/README_FILES/MULTI_INSTANCE_README b/external/ibm-public/postfix/dist/README_FILES/MULTI_INSTANCE_README index 7e930f25c35..1f261f6c04f 100644 --- a/external/ibm-public/postfix/dist/README_FILES/MULTI_INSTANCE_README +++ b/external/ibm-public/postfix/dist/README_FILES/MULTI_INSTANCE_README @@ -196,7 +196,7 @@ running "make"), then start and test the null-client: testing EOF -The test message should be delivered the members of the "mtaadmin" address +The test message should be delivered to the members of the "mtaadmin" address group (or whatever address group you choose) with the following headers: From: mtaadmin+root=mta1@example.com @@ -294,7 +294,7 @@ injection SMTP service. Typical additions include: smtpd_relay_restrictions = smtpd_recipient_restrictions = permit_mynetworks, reject - # Tolerate occasional high latency in the content filter. + # Tolerate occasional high latency in the content filter. # smtpd_timeout = 1200s diff --git a/external/ibm-public/postfix/dist/README_FILES/MYSQL_README b/external/ibm-public/postfix/dist/README_FILES/MYSQL_README index b8304c2212d..5a728fb06e2 100644 --- a/external/ibm-public/postfix/dist/README_FILES/MYSQL_README +++ b/external/ibm-public/postfix/dist/README_FILES/MYSQL_README @@ -29,7 +29,6 @@ The Postfix MySQL client utilizes the mysql client library, which can be obtained from: http://www.mysql.com/downloads/ - http://sourceforge.net/projects/mysql/ In order to build Postfix with mysql map support, you will need to add - DHAS_MYSQL and -I for the directory containing the mysql headers, and the @@ -39,6 +38,9 @@ mysqlclient library (and libm) to AUXLIBS_MYSQL, for example: 'CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include' \ 'AUXLIBS_MYSQL=-L/usr/local/mysql/lib -lmysqlclient -lz -lm' +If your MySQL shared library is in a directory that the RUN-TIME linker does +not know about, add a "-Wl,-R,/path/to/directory" option after "-lmysqlclient". + Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_MYSQL. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically- loaded MySQL database client, but only the new AUXLIBS_MYSQL variable supports @@ -129,5 +131,5 @@ CCrreeddiittss configuration feature. * Liviu Daia with further refinements from Jose Luis Tallon and Victor Duchovni developed the common query, result_format, domain and - expansion_limit interface for LDAP, MySQL and PosgreSQL. + expansion_limit interface for LDAP, MySQL and PostgreSQL. diff --git a/external/ibm-public/postfix/dist/README_FILES/OVERVIEW b/external/ibm-public/postfix/dist/README_FILES/OVERVIEW index 637ea984208..71976d46b6f 100644 --- a/external/ibm-public/postfix/dist/README_FILES/OVERVIEW +++ b/external/ibm-public/postfix/dist/README_FILES/OVERVIEW @@ -282,16 +282,41 @@ queues. Postfix version 2.2 and later. More information about this feature is in the CONNECTION_CACHE_README document. - /-- smtp(8) --> Internet + /-- smtp(8) --> Internet + + qmgr(8) + | + \-- | smtp(8) + | + | ^ + v | + + scache(8) + + A Postfix smtp(8) client can reuse a TLS-encrypted connection (with + "smtp_tls_connection_reuse = yes"). This can greatly reduce the overhead of + connection setup and improves message delivery rates. After a Postfix smtp + (8) client connects to a remote SMTP server and sends plaintext EHLO and + STARTTLS commands, the smtp(8) client inserts a tlsproxy(8) process into + the connection as shown below. + + After the mail transaction completes, the Postfix smtp(8) client gives the + smtp(8)-to-tlsproxy(8) connection to the scache(8) server, which keeps the + connection open for a limited amount of time. The smtp(8) client continues + with some other mail delivery request. Meanwhile, any Postfix smtp(8) + client can ask the scache(8) server for that cached connection and reuse it + for mail delivery. + + /-- smtp(8) --> tlsproxy(8) --> Internet - qmgr(8) | - | - \-- | smtp(8) --> Internet - | - ^ - | + qmgr(8) + | + \-- | smtp(8) + | + | ^ + v | - scache(8) + scache(8) * The showq(8) servers list the Postfix queue status. This is the queue listing service that does the work for the mailq(1) and postqueue(1) @@ -324,7 +349,7 @@ queues. <---seed--- ---seed---> Network-> smtpd(8) tlsmgr(8) smtp(8) ->Network - <-session-> <-session-> + <-session-> <-session-> / | \ | @@ -342,11 +367,9 @@ queues. This process is described in the ADDRESS_VERIFICATION_README document. The verify(8) service is available with Postfix version 2.1 and later. - probe Postfix message -> mail - queue - Network -> smtpd(8) <-> verify(8) -> + Network -> smtpd(8) <-> verify(8) -> queue | v @@ -356,7 +379,6 @@ queues. ^ agents | v - Address verification @@ -370,33 +392,51 @@ queues. While postscreen(8) keeps the zombies away, more smtpd(8) processes remain available for legitimate clients. - postscreen(8) maintains a temporary whitelist for clients that pass its - tests; by allowing whitelisted clients to skip tests, postscreen(8) + postscreen(8) maintains a temporary allowlist for clients that pass its + tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. The postscreen(8) server is available with Postfix 2.8 and later. To keep - the implementation simple, postscreen(8) delegates DNS white/blacklist + the implementation simple, postscreen(8) delegates DNS allow/denylist lookups to dnsblog(8) server processes, and delegates TLS encryption/ decryption to tlsproxy(8) server processes. This delegation is invisible to - the remote SMTP client, and is not shown in the diagram below. + the remote SMTP client. + + zombie + + \ + + zombie - tlsproxy(8) - - smtpd(8) + + \ / + + other --- postscreen(8) + + / \ - zombie + other - - smtpd(8) - \ + / - zombie - - smtpd(8) + zombie - \ / + * The postlogd(8) server provides an alternative to syslog logging, which + remains the default. This feature is available with Postfix version 3.4 or + later, and supports the following modes: - other --- postscreen(8) + o Logging to file, which addresses a usability problem with MacOS, and + eliminates information loss caused by systemd rate limits. - / \ + commands -> postlogd(8) -> /path/to/file + or daemons - other - - smtpd(8) + o Logging to stdout, which eliminates a syslog dependency when Postfix + runs inside a container. - / + commands -> postlogd(8) -> stdout inherited + or daemons from "postfix start-fg" - zombie + See MAILLOG_README for details and limitations. PPoossttffiixx ssuuppppoorrtt ccoommmmaannddss diff --git a/external/ibm-public/postfix/dist/README_FILES/PCRE_README b/external/ibm-public/postfix/dist/README_FILES/PCRE_README index 788859a5e96..6dffb4b5c44 100644 --- a/external/ibm-public/postfix/dist/README_FILES/PCRE_README +++ b/external/ibm-public/postfix/dist/README_FILES/PCRE_README @@ -14,33 +14,42 @@ A description of how to use pcre tables, including examples, is given in the pcre_table(5) manual page. Information about PCRE itself can be found at http:/ /www.pcre.org/. -BBuuiillddiinngg PPoossttffiixx wwiitthh PPCCRREE ssuuppppoorrtt +UUssiinngg PPoossttffiixx ppaacckkaaggeess wwiitthh PPCCRREE ssuuppppoorrtt + +To use pcre with Debian GNU/Linux's Postfix, or with Fedora or RHEL Postfix, +all you need is to install the postfix-pcre package and you're done. There is +no need to recompile Postfix. + +BBuuiillddiinngg PPoossttffiixx ffrroomm ssoouurrccee wwiitthh PPCCRREE ssuuppppoorrtt These instructions assume that you build Postfix from source code as described -in the INSTALL document. Some modification may be required if you build Postfix -from a vendor-specific source package. +in the INSTALL document. -Note: to use pcre with Debian GNU/Linux's Postfix, all you need is to install -the postfix-pcre package and you're done. There is no need to recompile -Postfix. +To build Postfix from source with pcre support, you need a pcre library. +Install a vendor package, or download the source code from locations in https:/ +/www.pcre.org/ and build that yourself. -In some future, Postfix will have a plug-in interface for adding map types. -Until then, you need to compile PCRE support into Postfix. +Postfix can build with the pcre2 library or the legacy pcre library. It's +probably easiest to let the Postfix build procedure pick one. The following +commands will first discover if the pcre2 library is installed, and if that is +not available, will discover if the legacy pcre library is installed. -First of all, you need the PCRE library (Perl Compatible Regular Expressions), -which can be obtained from: + $ make -f Makefile.init makefiles + $ make - ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/. +To build Postfix explicitly with a pcre2 library (Postfix 3.7 and later): -NOTE: pcre versions prior to 2.06 cannot be used. + $ make -f Makefile.init makefiles \ + "CCARGS=-DHAS_PCRE=2 `pcre2-config --cflags`" \ + "AUXLIBS_PCRE=`pcre2-config --libs8`" + $ make -In order to build Postfix with PCRE support you need to add -DHAS_PCRE and a - -I option for the PCRE include file to CCARGS, and add the path to the PCRE -library to AUXLIBS_PCRE, for example: +To build Postfix explicitly with a legacy pcre library (all Postfix versions): - make -f Makefile.init makefiles \ - "CCARGS=-DHAS_PCRE `pcre-config --cflags`" \ + $ make -f Makefile.init makefiles \ + "CCARGS=-DHAS_PCRE=1 `pcre-config --cflags`" \ "AUXLIBS_PCRE=`pcre-config --libs`" + $ make Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_PCRE. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically- diff --git a/external/ibm-public/postfix/dist/README_FILES/PGSQL_README b/external/ibm-public/postfix/dist/README_FILES/PGSQL_README index 7f6323a54ac..ae9c3bff562 100644 --- a/external/ibm-public/postfix/dist/README_FILES/PGSQL_README +++ b/external/ibm-public/postfix/dist/README_FILES/PGSQL_README @@ -36,6 +36,9 @@ For example: 'CCARGS=-DHAS_PGSQL -I/usr/local/include/pgsql' \ 'AUXLIBS_PGSQL=-L/usr/local/lib -lpq' +If your PostgreSQL shared library is in a directory that the RUN-TIME linker +does not know about, add a "-Wl,-R,/path/to/directory" option after "-lpq". + Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_PGSQL. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically- loaded PostgreSQL database client, but only the new AUXLIBS_PGSQL variable diff --git a/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_3_5_README b/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_3_5_README new file mode 100644 index 00000000000..ab67800bef3 --- /dev/null +++ b/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_3_5_README @@ -0,0 +1,863 @@ +PPoossttffiixx PPoossttssccrreeeenn HHoowwttoo ((PPoossttffiixx 22..88 -- 33..55)) + +------------------------------------------------------------------------------- + +IInnttrroodduuccttiioonn + +This document describes features that are available in Postfix 2.8 - 3.5. + +The Postfix postscreen(8) daemon provides additional protection against mail +server overload. One postscreen(8) process handles multiple inbound SMTP +connections, and decides which clients may talk to a Postfix SMTP server +process. By keeping spambots away, postscreen(8) leaves more SMTP server +processes available for legitimate clients, and delays the onset of server +overload conditions. + +postscreen(8) should not be used on SMTP ports that receive mail from end-user +clients (MUAs). In a typical deployment, postscreen(8) handles the MX service +on TCP port 25, while MUA clients submit mail via the submission service on TCP +port 587 which requires client authentication. Alternatively, a site could set +up a dedicated, non-postscreen, "port 25" server that provides submission +service and client authentication, but no MX service. + +postscreen(8) maintains a temporary allowlist for clients that pass its tests; +by allowing allowlisted clients to skip tests, postscreen(8) minimizes its +impact on legitimate email traffic. + +postscreen(8) is part of a multi-layer defense. + + * As the first layer, postscreen(8) blocks connections from zombies and other + spambots that are responsible for about 90% of all spam. It is implemented + as a single process to make this defense as inexpensive as possible. + + * The second layer implements more complex SMTP-level access checks with + Postfix SMTP servers, policy daemons, and Milter applications. + + * The third layer performs light-weight content inspection with the Postfix + built-in header_checks and body_checks. This can block unacceptable + attachments such as executable programs, and worms or viruses with easy-to- + recognize signatures. + + * The fourth layer provides heavy-weight content inspection with external + content filters. Typical examples are Amavisd-new, SpamAssassin, and Milter + applications. + +Each layer reduces the spam volume. The general strategy is to use the less +expensive defenses first, and to use the more expensive defenses only for the +spam that remains. + +Topics in this document: + + * Introduction + * The basic idea behind postscreen(8) + * General operation + * Quick tests before everything else + * Tests before the 220 SMTP server greeting + * Tests after the 220 SMTP server greeting + * Other errors + * When all tests succeed + * Configuring the postscreen(8) service + * Historical notes and credits + +TThhee bbaassiicc iiddeeaa bbeehhiinndd ppoossttssccrreeeenn((88)) + +Most email is spam, and most spam is sent out by zombies (malware on +compromised end-user computers). Wietse expects that the zombie problem will +get worse before things improve, if ever. Without a tool like postscreen(8) +that keeps the zombies away, Postfix would be spending most of its resources +not receiving email. + +The main challenge for postscreen(8) is to make an is-a-zombie decision based +on a single measurement. This is necessary because many zombies try to fly +under the radar and avoid spamming the same site repeatedly. Once postscreen(8) +decides that a client is not-a-zombie, it allowlists the client temporarily to +avoid further delays for legitimate mail. + +Zombies have challenges too: they have only a limited amount of time to deliver +spam before their IP address becomes denylisted. To speed up spam deliveries, +zombies make compromises in their SMTP protocol implementation. For example, +they speak before their turn, or they ignore responses from SMTP servers and +continue sending mail even when the server tells them to go away. + +postscreen(8) uses a variety of measurements to recognize zombies. First, +postscreen(8) determines if the remote SMTP client IP address is denylisted. +Second, postscreen(8) looks for protocol compromises that are made to speed up +delivery. These are good indicators for making is-a-zombie decisions based on +single measurements. + +postscreen(8) does not inspect message content. Message content can vary from +one delivery to the next, especially with clients that (also) send legitimate +email. Content is not a good indicator for making is-a-zombie decisions based +on single measurements, and that is the problem that postscreen(8) is focused +on. + +GGeenneerraall ooppeerraattiioonn + +For each connection from an SMTP client, postscreen(8) performs a number of +tests in the order as described below. Some tests introduce a delay of a few +seconds. postscreen(8) maintains a temporary allowlist for clients that pass +its tests; by allowing allowlisted clients to skip tests, postscreen(8) +minimizes its impact on legitimate email traffic. + +By default, postscreen(8) hands off all connections to a Postfix SMTP server +process after logging its findings. This mode is useful for non-destructive +testing. + +In a typical production setting, postscreen(8) is configured to reject mail +from clients that fail one or more tests, after logging the helo, sender and +recipient information. + +Note: postscreen(8) is not an SMTP proxy; this is intentional. The purpose is +to keep zombies away from Postfix, with minimal overhead for legitimate +clients. + +QQuuiicckk tteessttss bbeeffoorree eevveerryytthhiinngg eellssee + +Before engaging in SMTP-level tests. postscreen(8) queries a number of local +deny and allowlists. These tests speed up the handling of known clients. + + * Permanent allow/denylist test + * Temporary allowlist test + * MX Policy test + +PPeerrmmaanneenntt aallllooww//ddeennyylliisstt tteesstt + +The postscreen_access_list parameter (default: permit_mynetworks) specifies a +permanent access list for SMTP client IP addresses. Typically one would specify +something that allowlists local networks, followed by a CIDR table for +selective allow- and denylisting. + +Example: + +/etc/postfix/main.cf: + postscreen_access_list = permit_mynetworks, + cidr:/etc/postfix/postscreen_access.cidr + +/etc/postfix/postscreen_access.cidr: + # Rules are evaluated in the order as specified. + # Denylist 192.168.* except 192.168.0.1. + 192.168.0.1 permit + 192.168.0.0/16 reject + +See the postscreen_access_list manpage documentation for more details. + +When the SMTP client address matches a "permit" action, postscreen(8) logs this +with the client address and port number as: + + WWHHIITTEELLIISSTTEEDD [address]:port + +The allowlist action is not configurable: immediately hand off the connection +to a Postfix SMTP server process. + +When the SMTP client address matches a "reject" action, postscreen(8) logs this +with the client address and port number as: + + BBLLAACCKKLLIISSTTEEDD [address]:port + +The postscreen_blacklist_action parameter specifies the action that is taken +next. See "When tests fail before the 220 SMTP server greeting" below. + +TTeemmppoorraarryy aalllloowwlliisstt tteesstt + +The postscreen(8) daemon maintains a temporary allowlist for SMTP client IP +addresses that have passed all the tests described below. The +postscreen_cache_map parameter specifies the location of the temporary +allowlist. The temporary allowlist is not used for SMTP client addresses that +appear on the permanent access list. + +By default the temporary allowlist is not shared with other postscreen(8) +daemons. See Sharing the temporary allowlist below for alternatives. + +When the SMTP client address appears on the temporary allowlist, postscreen(8) +logs this with the client address and port number as: + + PPAASSSS OOLLDD [address]:port + +The action is not configurable: immediately hand off the connection to a +Postfix SMTP server process. The client is excluded from further tests until +its temporary allowlist entry expires, as controlled with the postscreen_*_ttl +parameters. Expired entries are silently renewed if possible. + +MMXX PPoolliiccyy tteesstt + +When the remote SMTP client is not on the static access list or temporary +allowlist, postscreen(8) can implement a number of allowlist tests, before it +grants the client a temporary allowlist status that allows it to talk to a +Postfix SMTP server process. + +When postscreen(8) is configured to monitor all primary and backup MX +addresses, it can refuse to allowlist clients that connect to a backup MX +address only (an old spammer trick to take advantage of backup MX hosts with +weaker anti-spam policies than primary MX hosts). + + NOTE: The following solution is for small sites. Larger sites would have to + share the postscreen(8) cache between primary and backup MTAs, which would + introduce a common point of failure. + + * First, configure the host to listen on both primary and backup MX + addresses. Use the appropriate ifconfig or ip command for the local + operating system, or update the appropriate configuration files and + "refresh" the network protocol stack. + + Second, configure Postfix to listen on the new IP address (this step is + needed when you have specified inet_interfaces in main.cf). + + * Then, configure postscreen(8) to deny the temporary allowlist status on the + backup MX address(es). An example for Wietse's server is: + + /etc/postfix/main.cf: + postscreen_whitelist_interfaces = !168.100.189.8 static:all + + Translation: allow clients to obtain the temporary allowlist status on all + server IP addresses except 168.100.189.8, which is a backup MX address. + +When a non-allowlisted client connects the backup MX address, postscreen(8) +logs this with the client address and port number as: + + CCOONNNNEECCTT ffrroomm [address]:port ttoo [[116688..110000..118899..88]]::2255 + WWHHIITTEELLIISSTT VVEETTOO [address]:port + +Translation: the client at [address]:port connected to the backup MX address +168.100.189.8 while it was not allowlisted. The client will not be granted the +temporary allowlist status, even if passes all the allowlist tests described +below. + +TTeessttss bbeeffoorree tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg + +The postscreen_greet_wait parameter specifies a short time interval before the +"220 text..." server greeting, where postscreen(8) can run a number of tests in +parallel. + +When a good client passes these tests, and no "deep protocol tests" are +configured, postscreen(8) adds the client to the temporary allowlist and hands +off the "live" connection to a Postfix SMTP server process. The client can then +continue as if postscreen(8) never even existed (except of course for the short +postscreen_greet_wait delay). + + * Pregreet test + * DNS Allow/denylist test + * When tests fail before the 220 SMTP server greeting + +PPrreeggrreeeett tteesstt + +The SMTP protocol is a classic example of a protocol where the server speaks +before the client. postscreen(8) detects zombies that are in a hurry and that +speak before their turn. This test is enabled by default. + +The postscreen_greet_banner parameter specifies the text portion of a "220- +text..." teaser banner (default: $smtpd_banner). Note that this becomes the +first part of a multi-line server greeting. The postscreen(8) daemon sends this +before the postscreen_greet_wait timer is started. The purpose of the teaser +banner is to confuse zombies so that they speak before their turn. It has no +effect on SMTP clients that correctly implement the protocol. + +To avoid problems with poorly-implemented SMTP engines in network appliances or +network testing tools, either exclude them from all tests with the +postscreen_access_list feature or else specify an empty teaser banner: + +/etc/postfix/main.cf: + # Exclude broken clients by allowlisting. Clients in mynetworks + # should always be allowlisted. + postscreen_access_list = permit_mynetworks, + cidr:/etc/postfix/postscreen_access.cidr + +/etc/postfix/postscreen_access.cidr: + 192.168.254.0/24 permit + +/etc/postfix/main.cf: + # Disable the teaser banner (try allowlisting first if you can). + postscreen_greet_banner = + +When an SMTP client sends a command before the postscreen_greet_wait time has +elapsed, postscreen(8) logs this as: + + PPRREEGGRREEEETT count aafftteerr time ffrroomm [address]:port text... + +Translation: the client at [address]:port sent count bytes before its turn to +speak. This happened time seconds after the postscreen_greet_wait timer was +started. The text is what the client sent (truncated to 100 bytes, and with +non-printable characters replaced with C-style escapes such as \r for carriage- +return and \n for newline). + +The postscreen_greet_action parameter specifies the action that is taken next. +See "When tests fail before the 220 SMTP server greeting" below. + +DDNNSS AAllllooww//ddeennyylliisstt tteesstt + +The postscreen_dnsbl_sites parameter (default: empty) specifies a list of DNS +blocklist servers with optional filters and weight factors (positive weights +for denylisting, negative for allowlisting). These servers will be queried in +parallel with the reverse client IP address. This test is disabled by default. + + CAUTION: when postscreen rejects mail, its SMTP reply contains the DNSBL + domain name. Use the postscreen_dnsbl_reply_map feature to hide "password" + information in DNSBL domain names. + +When the postscreen_greet_wait time has elapsed, and the combined DNSBL score +is equal to or greater than the postscreen_dnsbl_threshold parameter value, +postscreen(8) logs this as: + + DDNNSSBBLL rraannkk count ffoorr [address]:port + +Translation: the SMTP client at [address]:port has a combined DNSBL score of +count. + +The postscreen_dnsbl_action parameter specifies the action that is taken when +the combined DNSBL score is equal to or greater than the threshold. See "When +tests fail before the 220 SMTP server greeting" below. + +WWhheenn tteessttss ffaaiill bbeeffoorree tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg + +When the client address matches the permanent denylist, or when the client +fails the pregreet or DNSBL tests, the action is specified with +postscreen_blacklist_action, postscreen_greet_action, or +postscreen_dnsbl_action, respectively. + +iiggnnoorree (default) + Ignore the failure of this test. Allow other tests to complete. Repeat this + test the next time the client connects. This option is useful for testing + and collecting statistics without blocking mail. +eennffoorrccee + Allow other tests to complete. Reject attempts to deliver mail with a 550 + SMTP reply, and log the helo/sender/recipient information. Repeat this test + the next time the client connects. +ddrroopp + Drop the connection immediately with a 521 SMTP reply. Repeat this test the + next time the client connects. + +TTeessttss aafftteerr tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg + +In this phase of the protocol, postscreen(8) implements a number of "deep +protocol" tests. These tests use an SMTP protocol engine that is built into the +postscreen(8) server. + +Important note: these protocol tests are disabled by default. They are more +intrusive than the pregreet and DNSBL tests, and they have limitations as +discussed next. + + * The main limitation of "after 220 greeting" tests is that a new client must + disconnect after passing these tests (reason: postscreen is not a proxy). + Then the client must reconnect from the same IP address before it can + deliver mail. The following measures may help to avoid email delays: + + o Allow "good" clients to skip tests with the + postscreen_dnsbl_whitelist_threshold feature (Postfix 2.11 and later). + This is especially effective for sites such as Google that never retry + immediately from the same IP address. + + o Small sites: Configure postscreen(8) to listen on multiple IP + addresses, published in DNS as different IP addresses for the same MX + hostname or for different MX hostnames. This avoids mail delivery + delays with clients that reconnect immediately from the same IP + address. + + o Large sites: Share the postscreen(8) cache between different Postfix + MTAs with a large-enough memcache_table(5). Again, this avoids mail + delivery delays with clients that reconnect immediately from the same + IP address. + + * postscreen(8)'s built-in SMTP engine does not implement the AUTH, XCLIENT, + and XFORWARD features. If you need to make these services available on port + 25, then do not enable the tests after the 220 server greeting. + + * End-user clients should connect directly to the submission service, so that + they never have to deal with postscreen(8)'s tests. + +The following "after 220 greeting" tests are available: + + * Command pipelining test + * Non-SMTP command test + * Bare newline test + * When tests fail after the 220 SMTP server greeting + +CCoommmmaanndd ppiippeelliinniinngg tteesstt + +By default, SMTP is a half-duplex protocol: the sender and receiver send one +command and one response at a time. Unlike the Postfix SMTP server, postscreen +(8) does not announce support for ESMTP command pipelining. Therefore, clients +are not allowed to send multiple commands. postscreen(8)'s deep protocol test +for this is disabled by default. + +With "postscreen_pipelining_enable = yes", postscreen(8) detects zombies that +send multiple commands, instead of sending one command and waiting for the +server to reply. + +This test is opportunistically enabled when postscreen(8) has to use the built- +in SMTP engine anyway. This is to make postscreen(8) logging more informative. + +When a client sends multiple commands, postscreen(8) logs this as: + + CCOOMMMMAANNDD PPIIPPEELLIINNIINNGG ffrroomm [address]:port aafftteerr command: text + +Translation: the SMTP client at [address]:port sent multiple SMTP commands, +instead of sending one command and then waiting for the server to reply. This +happened after the client sent command. The text shows part of the input that +was sent too early; it is not logged with Postfix 2.8. + +The postscreen_pipelining_action parameter specifies the action that is taken +next. See "When tests fail after the 220 SMTP server greeting" below. + +NNoonn--SSMMTTPP ccoommmmaanndd tteesstt + +Some spambots send their mail through open proxies. A symptom of this is the +usage of commands such as CONNECT and other non-SMTP commands. Just like the +Postfix SMTP server's smtpd_forbidden_commands feature, postscreen(8) has an +equivalent postscreen_forbidden_commands feature to block these clients. +postscreen(8)'s deep protocol test for this is disabled by default. + +With "postscreen_non_smtp_command_enable = yes", postscreen(8) detects zombies +that send commands specified with the postscreen_forbidden_commands parameter. +This also detects commands with the syntax of a message header label. The +latter is a symptom that the client is sending message content after ignoring +all the responses from postscreen(8) that reject mail. + +This test is opportunistically enabled when postscreen(8) has to use the built- +in SMTP engine anyway. This is to make postscreen(8) logging more informative. + +When a client sends non-SMTP commands, postscreen(8) logs this as: + + NNOONN--SSMMTTPP CCOOMMMMAANNDD ffrroomm [address]:port aafftteerr command: text + +Translation: the SMTP client at [address]:port sent a command that matches the +postscreen_forbidden_commands parameter, or that has the syntax of a message +header label (text followed by optional space and ":"). The "aafftteerr command" +portion is logged with Postfix 2.10 and later. + +The postscreen_non_smtp_command_action parameter specifies the action that is +taken next. See "When tests fail after the 220 SMTP server greeting" below. + +BBaarree nneewwlliinnee tteesstt + +SMTP is a line-oriented protocol: lines have a limited length, and are +terminated with <CR><LF>. Lines ending in a "bare" <LF>, that is newline not +preceded by carriage return, are not allowed in SMTP. postscreen(8)'s deep +protocol test for this is disabled by default. + +With "postscreen_bare_newline_enable = yes", postscreen(8) detects clients that +send lines ending in bare newline characters. + +This test is opportunistically enabled when postscreen(8) has to use the built- +in SMTP engine anyway. This is to make postscreen(8) logging more informative. + +When a client sends bare newline characters, postscreen(8) logs this as: + + BBAARREE NNEEWWLLIINNEE ffrroomm [address]:port aafftteerr command + +Translation: the SMTP client at [address]:port sent a bare newline character, +that is newline not preceded by carriage return. The "aafftteerr command" portion is +logged with Postfix 2.10 and later. + +The postscreen_bare_newline_action parameter specifies the action that is taken +next. See "When tests fail after the 220 SMTP server greeting" below. + +WWhheenn tteessttss ffaaiill aafftteerr tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg + +When the client fails the pipelining, non-SMTP command or bare newline tests, +the action is specified with postscreen_pipelining_action, +postscreen_non_smtp_command_action or postscreen_bare_newline_action, +respectively. + +iiggnnoorree (default for bare newline) + Ignore the failure of this test. Allow other tests to complete. Do NOT + repeat this test before the result from some other test expires. This + option is useful for testing and collecting statistics without blocking + mail permanently. +eennffoorrccee (default for pipelining) + Allow other tests to complete. Reject attempts to deliver mail with a 550 + SMTP reply, and log the helo/sender/recipient information. Repeat this test + the next time the client connects. +ddrroopp (default for non-SMTP commands) + Drop the connection immediately with a 521 SMTP reply. Repeat this test the + next time the client connects. This action is compatible with the Postfix + SMTP server's smtpd_forbidden_commands feature. + +OOtthheerr eerrrroorrss + +When an SMTP client hangs up unexpectedly, postscreen(8) logs this as: + + HHAANNGGUUPP aafftteerr time ffrroomm [address]:port iinn test name + +Translation: the SMTP client at [address]:port disconnected unexpectedly, time +seconds after the start of the test named test name. + +There is no punishment for hanging up. A client that hangs up without sending +the QUIT command can still pass all postscreen(8) tests. + +The following errors are reported by the built-in SMTP engine. This engine +never accepts mail, therefore it has per-session limits on the number of +commands and on the session length. + + CCOOMMMMAANNDD TTIIMMEE LLIIMMIITT ffrroomm [address]:port aafftteerr command + +Translation: the SMTP client at [address]:port reached the per-command time +limit as specified with the postscreen_command_time_limit parameter. The +session is terminated immediately. The "aafftteerr command" portion is logged with +Postfix 2.10 and later. + + CCOOMMMMAANNDD CCOOUUNNTT LLIIMMIITT ffrroomm [address]:port aafftteerr command + +Translation: the SMTP client at [address]:port reached the per-session command +count limit as specified with the postscreen_command_count_limit parameter. The +session is terminated immediately. The "aafftteerr command" portion is logged with +Postfix 2.10 and later. + + CCOOMMMMAANNDD LLEENNGGTTHH LLIIMMIITT ffrroomm [address]:port aafftteerr command + +Translation: the SMTP client at [address]:port reached the per-command length +limit, as specified with the line_length_limit parameter. The session is +terminated immediately. The "aafftteerr command" portion is logged with Postfix 2.10 +and later. + +When an SMTP client makes too many connections at the same time, postscreen(8) +rejects the connection with a 421 status code and logs: + + NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: ttoooo mmaannyy ccoonnnneeccttiioonnss + +The postscreen_client_connection_count_limit parameter controls this limit. + +When an SMTP client connects after postscreen(8) has reached a connection count +limit, postscreen(8) rejects the connection with a 421 status code and logs: + + NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: aallll ssccrreeeenniinngg ppoorrttss bbuussyy + NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: aallll sseerrvveerr ppoorrttss bbuussyy + +The postscreen_pre_queue_limit and postscreen_post_queue_limit parameters +control these limits. + +WWhheenn aallll tteessttss ssuucccceeeedd + +When a new SMTP client passes all tests (i.e. it is not allowlisted via some +mechanism), postscreen(8) logs this as: + + PPAASSSS NNEEWW [address]:port + +Where [address]:port are the client IP address and port. Then, postscreen(8) +creates a temporary allowlist entry that excludes the client IP address from +further tests until the temporary allowlist entry expires, as controlled with +the postscreen_*_ttl parameters. + +When no "deep protocol tests" are configured, postscreen(8) hands off the +"live" connection to a Postfix SMTP server process. The client can then +continue as if postscreen(8) never even existed (except for the short +postscreen_greet_wait delay). + +When any "deep protocol tests" are configured, postscreen(8) cannot hand off +the "live" connection to a Postfix SMTP server process in the middle of the +session. Instead, postscreen(8) defers mail delivery attempts with a 4XX +status, logs the helo/sender/recipient information, and waits for the client to +disconnect. The next time the client connects it will be allowed to talk to a +Postfix SMTP server process to deliver its mail. postscreen(8) mitigates the +impact of this limitation by giving deep protocol tests a long expiration time. + +CCoonnffiigguurriinngg tthhee ppoossttssccrreeeenn((88)) sseerrvviiccee + +postscreen(8) has been tested on FreeBSD [4-8], Linux 2.[4-6] and Solaris 9 +systems. + + * Turning on postscreen(8) without blocking mail + * postscreen(8) TLS configuration + * Blocking mail with postscreen(8) + * Turning off postscreen(8) + * Sharing the temporary allowlist + +TTuurrnniinngg oonn ppoossttssccrreeeenn((88)) wwiitthhoouutt bblloocckkiinngg mmaaiill + +To enable the postscreen(8) service and log client information without blocking +mail: + + 1. Make sure that local clients and systems with non-standard SMTP + implementations are excluded from any postscreen(8) tests. The default is + to exclude all clients in mynetworks. To exclude additional clients, for + example, third-party performance monitoring tools (these tend to have + broken SMTP implementations): + + /etc/postfix/main.cf: + # Exclude broken clients by allowlisting. Clients in mynetworks + # should always be allowlisted. + postscreen_access_list = permit_mynetworks, + cidr:/etc/postfix/postscreen_access.cidr + + /etc/postfix/postscreen_access.cidr: + 192.168.254.0/24 permit + + 2. Comment out the "smtp inet ... smtpd" service in master.cf, including any + "-o parameter=value" entries that follow. + + /etc/postfix/master.cf: + #smtp inet n - n - - smtpd + # -o parameter=value ... + + 3. Uncomment the new "smtpd pass ... smtpd" service in master.cf, and + duplicate any "-o parameter=value" entries from the smtpd service that was + commented out in the previous step. + + /etc/postfix/master.cf: + smtpd pass - - n - - smtpd + -o parameter=value ... + + 4. Uncomment the new "smtp inet ... postscreen" service in master.cf. + + /etc/postfix/master.cf: + smtp inet n - n - 1 postscreen + + 5. Uncomment the new "tlsproxy unix ... tlsproxy" service in master.cf. This + service implements STARTTLS support for postscreen(8). + + /etc/postfix/master.cf: + tlsproxy unix - - n - 0 tlsproxy + + 6. Uncomment the new "dnsblog unix ... dnsblog" service in master.cf. This + service does DNSBL lookups for postscreen(8) and logs results. + + /etc/postfix/master.cf: + dnsblog unix - - n - 0 dnsblog + + 7. To enable DNSBL lookups, list some DNS blocklist sites in main.cf, + separated by whitespace. Different sites can have different weights. For + example: + + /etc/postfix/main.cf: + postscreen_dnsbl_threshold = 2 + postscreen_dnsbl_sites = zen.spamhaus.org*2 + bl.spamcop.net*1 b.barracudacentral.org*1 + + Note: if your DNSBL queries have a "secret" in the domain name, you must + censor this information from the postscreen(8) SMTP replies. For example: + + /etc/postfix/main.cf: + postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply + + /etc/postfix/dnsbl_reply: + # Secret DNSBL name Name in postscreen(8) replies + secret.zen.dq.spamhaus.net zen.spamhaus.org + + The texthash: format is similar to hash: except that there is no need to + run postmap(1) before the file can be used, and that it does not detect + changes after the file is read. It is new with Postfix version 2.8. + + 8. Read the new configuration with "postfix reload". + +Notes: + + * Some postscreen(8) configuration parameters implement stress-dependent + behavior. This is supported only when the default value is stress-dependent + (that is, "postconf -d parametername" output shows "parametername = $ + {stress?something}${stress:something}" or "parametername = ${stress? + {something}:{something}}"). Other parameters always evaluate as if the + stress value is the empty string. + + * See "Tests before the 220 SMTP server greeting" for details about the + logging from these postscreen(8) tests. + + * If you run Postfix 2.6 or earlier you must stop and start the master daemon + ("postfix stop; postfix start"). This is needed because the Postfix "pass" + master service type did not work reliably on all systems. + +ppoossttssccrreeeenn((88)) TTLLSS ccoonnffiigguurraattiioonn + +postscreen(8) TLS support is available for remote SMTP clients that aren't +allowlisted, including clients that need to renew their temporary allowlist +status. When a remote SMTP client requests TLS service, postscreen(8) invisibly +hands off the connection to a tlsproxy(8) process. Then, tlsproxy(8) encrypts +and decrypts the traffic between postscreen(8) and the remote SMTP client. One +tlsproxy(8) process can handle multiple SMTP sessions. The number of tlsproxy +(8) processes slowly increases with server load, but it should always be much +smaller than the number of postscreen(8) TLS sessions. + +TLS support for postscreen(8) and tlsproxy(8) uses the same parameters as with +smtpd(8). We recommend that you keep the relevant configuration parameters in +main.cf. If you must specify "-o smtpd_mumble=value" parameter overrides in +master.cf for a postscreen-protected smtpd(8) service, then you should specify +those same parameter overrides for the postscreen(8) and tlsproxy(8) services. + +BBlloocckkiinngg mmaaiill wwiitthh ppoossttssccrreeeenn((88)) + +For compatibility with smtpd(8), postscreen(8) implements the soft_bounce +safety feature. This causes Postfix to reject mail with a "try again" reply +code. + + * To turn this on for all of Postfix, specify "soft_bounce = yes" in main.cf. + + * To turn this on for postscreen(8) only, append "-o soft_bounce=yes" (note: + NO SPACES around '=') to the postscreen entry in master.cf. + +Execute "postfix reload" to make the change effective. + +After testing, do not forget to remove the soft_bounce feature, otherwise +senders won't receive their non-delivery notification until many days later. + +To use the postscreen(8) service to block mail, edit main.cf and specify one or +more of: + + * "postscreen_dnsbl_action = enforce", to reject clients that are on DNS + blocklists, and to log the helo/sender/recipient information. With good + DNSBLs this reduces the amount of load on Postfix SMTP servers + dramatically. + + * "postscreen_greet_action = enforce", to reject clients that talk before + their turn, and to log the helo/sender/recipient information. This stops + over half of all known-to-be illegitimate connections to Wietse's mail + server. It is backup protection for zombies that haven't yet been + denylisted. + + * You can also enable "deep protocol tests", but these are more intrusive + than the pregreet or DNSBL tests. + + When a good client passes the "deep protocol tests", postscreen(8) adds the + client to the temporary allowlist but it cannot hand off the "live" + connection to a Postfix SMTP server process in the middle of the session. + Instead, postscreen(8) defers mail delivery attempts with a 4XX status, + logs the helo/sender/recipient information, and waits for the client to + disconnect. + + When the good client comes back in a later session, it is allowed to talk + directly to a Postfix SMTP server. See "Tests after the 220 SMTP server + greeting" above for limitations with AUTH and other features that clients + may need. + + An unexpected benefit from "deep protocol tests" is that some "good" + clients don't return after the 4XX reply; these clients were not so good + after all. + + Unfortunately, some senders will retry requests from different IP + addresses, and may never get allowlisted. For this reason, Wietse stopped + using "deep protocol tests" on his own internet-facing mail server. + + * There is also support for permanent denylisting and allowlisting; see the + description of the postscreen_access_list parameter for details. + +TTuurrnniinngg ooffff ppoossttssccrreeeenn((88)) + +To turn off postscreen(8) and handle mail directly with Postfix SMTP server +processes: + + 1. Comment out the "smtp inet ... postscreen" service in master.cf, including + any "-o parameter=value" entries that follow. + + /etc/postfix/master.cf: + #smtp inet n - n - 1 postscreen + # -o parameter=value ... + + 2. Comment out the "dnsblog unix ... dnsblog" service in master.cf. + + /etc/postfix/master.cf: + #dnsblog unix - - n - 0 dnsblog + + 3. Comment out the "smtpd pass ... smtpd" service in master.cf, including any + "-o parameter=value" entries that follow. + + /etc/postfix/master.cf: + #smtpd pass - - n - - smtpd + # -o parameter=value ... + + 4. Comment out the "tlsproxy unix ... tlsproxy" service in master.cf, + including any "-o parameter=value" entries that follow. + + /etc/postfix/master.cf: + #tlsproxy unix - - n - 0 tlsproxy + # -o parameter=value ... + + 5. Uncomment the "smtp inet ... smtpd" service in master.cf, including any "- + o parameter=value" entries that may follow. + + /etc/postfix/master.cf: + smtp inet n - n - - smtpd + -o parameter=value ... + + 6. Read the new configuration with "postfix reload". + +SShhaarriinngg tthhee tteemmppoorraarryy aalllloowwlliisstt + +By default, the temporary allowlist is not shared between multiple postscreen +(8) daemons. To enable sharing, choose one of the following options: + + * A non-persistent memcache: temporary allowlist can be shared between + postscreen(8) daemons on the same host or different hosts. Disable cache + cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) + daemons because memcache: has no first-next API (but see example 4 below + for memcache: with persistent backup). This requires Postfix 2.9 or later. + + # Example 1: non-persistent memcache: allowlist. + /etc/postfix/main.cf: + postscreen_cache_map = memcache:/etc/postfix/postscreen_cache + postscreen_cache_cleanup_interval = 0 + + /etc/postfix/postscreen_cache: + memcache = inet:127.0.0.1:11211 + key_format = postscreen:%s + + * A persistent lmdb: temporary allowlist can be shared between postscreen(8) + daemons that run under the same master(8) daemon, or under different master + (8) daemons on the same host. Disable cache cleanup + (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons except + one that is responsible for cache cleanup. This requires Postfix 2.11 or + later. + + # Example 2: persistent lmdb: allowlist. + /etc/postfix/main.cf: + postscreen_cache_map = lmdb:$data_directory/postscreen_cache + # See note 1 below. + # postscreen_cache_cleanup_interval = 0 + + * Other kinds of persistent temporary allowlist can be shared only between + postscreen(8) daemons that run under the same master(8) daemon. In this + case, temporary allowlist access must be shared through the proxymap(8) + daemon. This requires Postfix 2.9 or later. + + # Example 3: proxied btree: allowlist. + /etc/postfix/main.cf: + postscreen_cache_map = + proxy:btree:/var/lib/postfix/postscreen_cache + # See note 1 below. + # postscreen_cache_cleanup_interval = 0 + + # Example 4: proxied btree: allowlist with memcache: accelerator. + /etc/postfix/main.cf: + postscreen_cache_map = memcache:/etc/postfix/postscreen_cache + proxy_write_maps = + proxy:btree:/var/lib/postfix/postscreen_cache + ... other proxied tables ... + # See note 1 below. + # postscreen_cache_cleanup_interval = 0 + + /etc/postfix/postscreen_cache: + # Note: the $data_directory macro is not defined in this context. + memcache = inet:127.0.0.1:11211 + backup = proxy:btree:/var/lib/postfix/postscreen_cache + key_format = postscreen:%s + + Note 1: disable cache cleanup (postscreen_cache_cleanup_interval = 0) in + all postscreen(8) daemons except one that is responsible for cache cleanup. + + Note 2: postscreen(8) cache sharing via proxymap(8) requires Postfix 2.9 or + later; earlier proxymap(8) implementations don't support cache cleanup. + +HHiissttoorriiccaall nnootteess aanndd ccrreeddiittss + +Many ideas in postscreen(8) were explored in earlier work by Michael Tokarev, +in OpenBSD spamd, and in MailChannels Traffic Control. + +Wietse threw together a crude prototype with pregreet and dnsbl support in June +2009, because he needed something new for a Mailserver conference presentation +in July. Ralf Hildebrandt ran this code on several servers to collect real- +world statistics. This version used the dnsblog(8) ad-hoc DNS client program. + +Wietse needed new material for a LISA conference presentation in November 2010, +so he added support for DNSBL weights and filters in August, followed by a +major code rewrite, deep protocol tests, helo/sender/recipient logging, and +stress-adaptive behavior in September. Ralf Hildebrandt ran this code on +several servers to collect real-world statistics. This version still used the +embarrassing dnsblog(8) ad-hoc DNS client program. + +Wietse added STARTTLS support in December 2010. This makes postscreen(8) usable +for sites that require TLS support. The implementation introduces the tlsproxy +(8) event-driven TLS proxy that decrypts/encrypts the sessions for multiple +SMTP clients. + +The tlsproxy(8) implementation led to the discovery of a "new" class of +vulnerability (CVE-2011-0411) that affected multiple implementations of SMTP, +POP, IMAP, NNTP, and FTP over TLS. + +postscreen(8) was officially released as part of the Postfix 2.8 stable release +in January 2011. + diff --git a/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README b/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README index 78da5dd88a6..9467e68f6c7 100644 --- a/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README +++ b/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README @@ -4,7 +4,8 @@ PPoossttffiixx PPoossttssccrreeeenn HHoowwttoo IInnttrroodduuccttiioonn -This document describes features that are available in Postfix 2.8 and later. +This document describes features that are available in Postfix 3.6 and later. +See POSTSCREEN_3_5_README.html for Postfix versions 2.8 - 3.5. The Postfix postscreen(8) daemon provides additional protection against mail server overload. One postscreen(8) process handles multiple inbound SMTP @@ -20,8 +21,8 @@ port 587 which requires client authentication. Alternatively, a site could set up a dedicated, non-postscreen, "port 25" server that provides submission service and client authentication, but no MX service. -postscreen(8) maintains a temporary whitelist for clients that pass its tests; -by allowing whitelisted clients to skip tests, postscreen(8) minimizes its +postscreen(8) maintains a temporary allowlist for clients that pass its tests; +by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. postscreen(8) is part of a multi-layer defense. @@ -70,17 +71,17 @@ not receiving email. The main challenge for postscreen(8) is to make an is-a-zombie decision based on a single measurement. This is necessary because many zombies try to fly under the radar and avoid spamming the same site repeatedly. Once postscreen(8) -decides that a client is not-a-zombie, it whitelists the client temporarily to +decides that a client is not-a-zombie, it allowlists the client temporarily to avoid further delays for legitimate mail. Zombies have challenges too: they have only a limited amount of time to deliver -spam before their IP address becomes blacklisted. To speed up spam deliveries, +spam before their IP address becomes denylisted. To speed up spam deliveries, zombies make compromises in their SMTP protocol implementation. For example, they speak before their turn, or they ignore responses from SMTP servers and continue sending mail even when the server tells them to go away. postscreen(8) uses a variety of measurements to recognize zombies. First, -postscreen(8) determines if the remote SMTP client IP address is blacklisted. +postscreen(8) determines if the remote SMTP client IP address is denylisted. Second, postscreen(8) looks for protocol compromises that are made to speed up delivery. These are good indicators for making is-a-zombie decisions based on single measurements. @@ -95,8 +96,8 @@ GGeenneerraall ooppeerraattiioonn For each connection from an SMTP client, postscreen(8) performs a number of tests in the order as described below. Some tests introduce a delay of a few -seconds. postscreen(8) maintains a temporary whitelist for clients that pass -its tests; by allowing whitelisted clients to skip tests, postscreen(8) +seconds. postscreen(8) maintains a temporary allowlist for clients that pass +its tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. By default, postscreen(8) hands off all connections to a Postfix SMTP server @@ -114,18 +115,18 @@ clients. QQuuiicckk tteessttss bbeeffoorree eevveerryytthhiinngg eellssee Before engaging in SMTP-level tests. postscreen(8) queries a number of local -black and whitelists. These tests speed up the handling of known clients. +deny and allowlists. These tests speed up the handling of known clients. - * Permanent white/blacklist test - * Temporary whitelist test + * Permanent allow/denylist test + * Temporary allowlist test * MX Policy test -PPeerrmmaanneenntt wwhhiittee//bbllaacckklliisstt tteesstt +PPeerrmmaanneenntt aallllooww//ddeennyylliisstt tteesstt The postscreen_access_list parameter (default: permit_mynetworks) specifies a permanent access list for SMTP client IP addresses. Typically one would specify -something that whitelists local networks, followed by a CIDR table for -selective white- and blacklisting. +something that allowlists local networks, followed by a CIDR table for +selective allow- and denylisting. Example: @@ -135,7 +136,7 @@ Example: /etc/postfix/postscreen_access.cidr: # Rules are evaluated in the order as specified. - # Blacklist 192.168.* except 192.168.0.1. + # Denylist 192.168.* except 192.168.0.1. 192.168.0.1 permit 192.168.0.0/16 reject @@ -144,49 +145,55 @@ See the postscreen_access_list manpage documentation for more details. When the SMTP client address matches a "permit" action, postscreen(8) logs this with the client address and port number as: - WWHHIITTEELLIISSTTEEDD [address]:port + AALLLLOOWWLLIISSTTEEDD [address]:port -The whitelist action is not configurable: immediately hand off the connection + Use the respectful_logging configuration parameter to select a deprecated + form of this logging. + +The allowlist action is not configurable: immediately hand off the connection to a Postfix SMTP server process. When the SMTP client address matches a "reject" action, postscreen(8) logs this with the client address and port number as: - BBLLAACCKKLLIISSTTEEDD [address]:port + DDEENNYYLLIISSTTEEDD [address]:port + + Use the respectful_logging configuration parameter to select a deprecated + form of this logging. -The postscreen_blacklist_action parameter specifies the action that is taken +The postscreen_denylist_action parameter specifies the action that is taken next. See "When tests fail before the 220 SMTP server greeting" below. -TTeemmppoorraarryy wwhhiitteelliisstt tteesstt +TTeemmppoorraarryy aalllloowwlliisstt tteesstt -The postscreen(8) daemon maintains a temporary whitelist for SMTP client IP +The postscreen(8) daemon maintains a temporary allowlist for SMTP client IP addresses that have passed all the tests described below. The postscreen_cache_map parameter specifies the location of the temporary -whitelist. The temporary whitelist is not used for SMTP client addresses that +allowlist. The temporary allowlist is not used for SMTP client addresses that appear on the permanent access list. -By default the temporary whitelist is not shared with other postscreen(8) -daemons. See Sharing the temporary whitelist below for alternatives. +By default the temporary allowlist is not shared with other postscreen(8) +daemons. See Sharing the temporary allowlist below for alternatives. -When the SMTP client address appears on the temporary whitelist, postscreen(8) +When the SMTP client address appears on the temporary allowlist, postscreen(8) logs this with the client address and port number as: PPAASSSS OOLLDD [address]:port The action is not configurable: immediately hand off the connection to a Postfix SMTP server process. The client is excluded from further tests until -its temporary whitelist entry expires, as controlled with the postscreen_*_ttl +its temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. Expired entries are silently renewed if possible. MMXX PPoolliiccyy tteesstt When the remote SMTP client is not on the static access list or temporary -whitelist, postscreen(8) can implement a number of whitelist tests, before it -grants the client a temporary whitelist status that allows it to talk to a +allowlist, postscreen(8) can implement a number of allowlist tests, before it +grants the client a temporary allowlist status that allows it to talk to a Postfix SMTP server process. When postscreen(8) is configured to monitor all primary and backup MX -addresses, it can refuse to whitelist clients that connect to a backup MX +addresses, it can refuse to allowlist clients that connect to a backup MX address only (an old spammer trick to take advantage of backup MX hosts with weaker anti-spam policies than primary MX hosts). @@ -195,31 +202,34 @@ weaker anti-spam policies than primary MX hosts). introduce a common point of failure. * First, configure the host to listen on both primary and backup MX - addresses. Use the appropriate ifconfig command for the local operating - system, or update the appropriate configuration files and "refresh" the - network protocol stack. + addresses. Use the appropriate ifconfig or ip command for the local + operating system, or update the appropriate configuration files and + "refresh" the network protocol stack. Second, configure Postfix to listen on the new IP address (this step is needed when you have specified inet_interfaces in main.cf). - * Then, configure postscreen(8) to deny the temporary whitelist status on the + * Then, configure postscreen(8) to deny the temporary allowlist status on the backup MX address(es). An example for Wietse's server is: /etc/postfix/main.cf: - postscreen_whitelist_interfaces = !168.100.189.8 static:all + postscreen_allowlist_interfaces = !168.100.189.8 static:all - Translation: allow clients to obtain the temporary whitelist status on all + Translation: allow clients to obtain the temporary allowlist status on all server IP addresses except 168.100.189.8, which is a backup MX address. -When a non-whitelisted client connects the backup MX address, postscreen(8) +When a non-allowlisted client connects the backup MX address, postscreen(8) logs this with the client address and port number as: CCOONNNNEECCTT ffrroomm [address]:port ttoo [[116688..110000..118899..88]]::2255 - WWHHIITTEELLIISSTT VVEETTOO [address]:port + AALLLLOOWWLLIISSTT VVEETTOO [address]:port + + Use the respectful_logging configuration parameter to select a deprecated + form of this logging. Translation: the client at [address]:port connected to the backup MX address -168.100.189.8 while it was not whitelisted. The client will not be granted the -temporary whitelist status, even if passes all the whitelist tests described +168.100.189.8 while it was not allowlisted. The client will not be granted the +temporary allowlist status, even if passes all the allowlist tests described below. TTeessttss bbeeffoorree tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg @@ -229,13 +239,13 @@ The postscreen_greet_wait parameter specifies a short time interval before the parallel. When a good client passes these tests, and no "deep protocol tests" are -configured, postscreen(8) adds the client to the temporary whitelist and hands +configured, postscreen(8) adds the client to the temporary allowlist and hands off the "live" connection to a Postfix SMTP server process. The client can then continue as if postscreen(8) never even existed (except of course for the short postscreen_greet_wait delay). * Pregreet test - * DNS White/blacklist test + * DNS Allow/denylist test * When tests fail before the 220 SMTP server greeting PPrreeggrreeeett tteesstt @@ -256,8 +266,8 @@ network testing tools, either exclude them from all tests with the postscreen_access_list feature or else specify an empty teaser banner: /etc/postfix/main.cf: - # Exclude broken clients by whitelisting. Clients in mynetworks - # should always be whitelisted. + # Exclude broken clients by allowlisting. Clients in mynetworks + # should always be allowlisted. postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr @@ -265,7 +275,7 @@ postscreen_access_list feature or else specify an empty teaser banner: 192.168.254.0/24 permit /etc/postfix/main.cf: - # Disable the teaser banner (try whitelisting first if you can). + # Disable the teaser banner (try allowlisting first if you can). postscreen_greet_banner = When an SMTP client sends a command before the postscreen_greet_wait time has @@ -282,11 +292,11 @@ return and \n for newline). The postscreen_greet_action parameter specifies the action that is taken next. See "When tests fail before the 220 SMTP server greeting" below. -DDNNSS WWhhiittee//bbllaacckklliisstt tteesstt +DDNNSS AAllllooww//ddeennyylliisstt tteesstt The postscreen_dnsbl_sites parameter (default: empty) specifies a list of DNS blocklist servers with optional filters and weight factors (positive weights -for blacklisting, negative for whitelisting). These servers will be queried in +for denylisting, negative for allowlisting). These servers will be queried in parallel with the reverse client IP address. This test is disabled by default. CAUTION: when postscreen rejects mail, its SMTP reply contains the DNSBL @@ -308,9 +318,9 @@ tests fail before the 220 SMTP server greeting" below. WWhheenn tteessttss ffaaiill bbeeffoorree tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg -When the client address matches the permanent blacklist, or when the client +When the client address matches the permanent denylist, or when the client fails the pregreet or DNSBL tests, the action is specified with -postscreen_blacklist_action, postscreen_greet_action, or +postscreen_denylist_action, postscreen_greet_action, or postscreen_dnsbl_action, respectively. iiggnnoorree (default) @@ -341,9 +351,9 @@ discussed next. deliver mail. The following measures may help to avoid email delays: o Allow "good" clients to skip tests with the - postscreen_dnsbl_whitelist_threshold feature (Postfix 2.11 and later). - This is especially effective for sites such as Google that never retry - immediately from the same IP address. + postscreen_dnsbl_allowlist_threshold feature. This is especially + effective for large providers that usually don't retry from the same IP + address. o Small sites: Configure postscreen(8) to listen on multiple IP addresses, published in DNS as different IP addresses for the same MX @@ -526,14 +536,14 @@ control these limits. WWhheenn aallll tteessttss ssuucccceeeedd -When a new SMTP client passes all tests (i.e. it is not whitelisted via some +When a new SMTP client passes all tests (i.e. it is not allowlisted via some mechanism), postscreen(8) logs this as: PPAASSSS NNEEWW [address]:port Where [address]:port are the client IP address and port. Then, postscreen(8) -creates a temporary whitelist entry that excludes the client IP address from -further tests until the temporary whitelist entry expires, as controlled with +creates a temporary allowlist entry that excludes the client IP address from +further tests until the temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. When no "deep protocol tests" are configured, postscreen(8) hands off the @@ -558,7 +568,7 @@ systems. * postscreen(8) TLS configuration * Blocking mail with postscreen(8) * Turning off postscreen(8) - * Sharing the temporary whitelist + * Sharing the temporary allowlist TTuurrnniinngg oonn ppoossttssccrreeeenn((88)) wwiitthhoouutt bblloocckkiinngg mmaaiill @@ -572,8 +582,8 @@ mail: broken SMTP implementations): /etc/postfix/main.cf: - # Exclude broken clients by whitelisting. Clients in mynetworks - # should always be whitelisted. + # Exclude broken clients by allowlisting. Clients in mynetworks + # should always be allowlisted. postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr @@ -642,8 +652,9 @@ Notes: * Some postscreen(8) configuration parameters implement stress-dependent behavior. This is supported only when the default value is stress-dependent (that is, "postconf -d parametername" output shows "parametername = $ - {stress?something}${stress:something}"). Other parameters always evaluate - as if the stress value is the empty string. + {stress?something}${stress:something}" or "parametername = ${stress? + {something}:{something}}"). Other parameters always evaluate as if the + stress value is the empty string. * See "Tests before the 220 SMTP server greeting" for details about the logging from these postscreen(8) tests. @@ -655,7 +666,7 @@ Notes: ppoossttssccrreeeenn((88)) TTLLSS ccoonnffiigguurraattiioonn postscreen(8) TLS support is available for remote SMTP clients that aren't -whitelisted, including clients that need to renew their temporary whitelist +allowlisted, including clients that need to renew their temporary allowlist status. When a remote SMTP client requests TLS service, postscreen(8) invisibly hands off the connection to a tlsproxy(8) process. Then, tlsproxy(8) encrypts and decrypts the traffic between postscreen(8) and the remote SMTP client. One @@ -697,13 +708,13 @@ more of: their turn, and to log the helo/sender/recipient information. This stops over half of all known-to-be illegitimate connections to Wietse's mail server. It is backup protection for zombies that haven't yet been - blacklisted. + denylisted. * You can also enable "deep protocol tests", but these are more intrusive than the pregreet or DNSBL tests. When a good client passes the "deep protocol tests", postscreen(8) adds the - client to the temporary whitelist but it cannot hand off the "live" + client to the temporary allowlist but it cannot hand off the "live" connection to a Postfix SMTP server process in the middle of the session. Instead, postscreen(8) defers mail delivery attempts with a 4XX status, logs the helo/sender/recipient information, and waits for the client to @@ -719,10 +730,10 @@ more of: after all. Unfortunately, some senders will retry requests from different IP - addresses, and may never get whitelisted. For this reason, Wietse stopped + addresses, and may never get allowlisted. For this reason, Wietse stopped using "deep protocol tests" on his own internet-facing mail server. - * There is also support for permanent blacklisting and whitelisting; see the + * There is also support for permanent denylisting and allowlisting; see the description of the postscreen_access_list parameter for details. TTuurrnniinngg ooffff ppoossttssccrreeeenn((88)) @@ -765,18 +776,18 @@ processes: 6. Read the new configuration with "postfix reload". -SShhaarriinngg tthhee tteemmppoorraarryy wwhhiitteelliisstt +SShhaarriinngg tthhee tteemmppoorraarryy aalllloowwlliisstt -By default, the temporary whitelist is not shared between multiple postscreen +By default, the temporary allowlist is not shared between multiple postscreen (8) daemons. To enable sharing, choose one of the following options: - * A non-persistent memcache: temporary whitelist can be shared between + * A non-persistent memcache: temporary allowlist can be shared between postscreen(8) daemons on the same host or different hosts. Disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons because memcache: has no first-next API (but see example 4 below for memcache: with persistent backup). This requires Postfix 2.9 or later. - # Example 1: non-persistent memcache: whitelist. + # Example 1: non-persistent memcache: allowlist. /etc/postfix/main.cf: postscreen_cache_map = memcache:/etc/postfix/postscreen_cache postscreen_cache_cleanup_interval = 0 @@ -785,32 +796,32 @@ By default, the temporary whitelist is not shared between multiple postscreen memcache = inet:127.0.0.1:11211 key_format = postscreen:%s - * A persistent lmdb: temporary whitelist can be shared between postscreen(8) + * A persistent lmdb: temporary allowlist can be shared between postscreen(8) daemons that run under the same master(8) daemon, or under different master (8) daemons on the same host. Disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons except one that is responsible for cache cleanup. This requires Postfix 2.11 or later. - # Example 2: persistent lmdb: whitelist. + # Example 2: persistent lmdb: allowlist. /etc/postfix/main.cf: postscreen_cache_map = lmdb:$data_directory/postscreen_cache # See note 1 below. # postscreen_cache_cleanup_interval = 0 - * Other kinds of persistent temporary whitelist can be shared only between + * Other kinds of persistent temporary allowlist can be shared only between postscreen(8) daemons that run under the same master(8) daemon. In this - case, temporary whitelist access must be shared through the proxymap(8) + case, temporary allowlist access must be shared through the proxymap(8) daemon. This requires Postfix 2.9 or later. - # Example 3: proxied btree: whitelist. + # Example 3: proxied btree: allowlist. /etc/postfix/main.cf: postscreen_cache_map = proxy:btree:/var/lib/postfix/postscreen_cache # See note 1 below. # postscreen_cache_cleanup_interval = 0 - # Example 4: proxied btree: whitelist with memcache: accelerator. + # Example 4: proxied btree: allowlist with memcache: accelerator. /etc/postfix/main.cf: postscreen_cache_map = memcache:/etc/postfix/postscreen_cache proxy_write_maps = @@ -860,3 +871,6 @@ POP, IMAP, NNTP, and FTP over TLS. postscreen(8) was officially released as part of the Postfix 2.8 stable release in January 2011. +Noel Jones helped with the Postfix 3.6 transition towards respectful +documentation. + diff --git a/external/ibm-public/postfix/dist/README_FILES/QSHAPE_README b/external/ibm-public/postfix/dist/README_FILES/QSHAPE_README index 311797a6f6f..eba722e1317 100644 --- a/external/ibm-public/postfix/dist/README_FILES/QSHAPE_README +++ b/external/ibm-public/postfix/dist/README_FILES/QSHAPE_README @@ -68,11 +68,11 @@ sender domain distribution for captured spam in the "hold" queue: When the output is a terminal intermediate results showing the top 20 domains (-n option) are displayed after every 1000 messages (-N option) and the final output also shows only the top 20 domains. This makes qshape useful even when -the deferred queue is very large and it may otherwise take prohibitively long -to read the entire deferred queue. +the "deferred" queue is very large and it may otherwise take prohibitively long +to read the entire "deferred" queue. -By default, qshape shows statistics for the union of both the incoming and -active queues which are the most relevant queues to look at when analyzing +By default, qshape shows statistics for the union of both the "incoming" and +"active" queues which are the most relevant queues to look at when analyzing performance. One can request an alternate list of queues: @@ -80,8 +80,8 @@ One can request an alternate list of queues: $ qshape deferred $ qshape incoming active deferred -this will show the age distribution of the deferred queue or the union of the -incoming active and deferred queues. +this will show the age distribution of the "deferred" queue or the union of the +"incoming", "active" and "deferred" queues. Command line options control the number of display "buckets", the age limit for the smallest bucket, display of parent domain counts and so on. The "-h" option @@ -96,16 +96,16 @@ recipient counts, approximately when a burst of mail started, and when it stopped. The problem destinations or sender domains appear near the top left corner of -the output table. Remember that the active queue can accommodate up to 20000 +the output table. Remember that the "active" queue can accommodate up to 20000 ($qmgr_message_active_limit) messages. To check whether this limit has been reached, use: $ qshape -s active (show sender statistics) -If the total sender count is below 20000 the active queue is not yet saturated, -any high volume sender domains show near the top of the output. +If the total sender count is below 20000 the "active" queue is not yet +saturated, any high volume sender domains show near the top of the output. -With oqmgr(8) the active queue is also limited to at most 20000 recipient +With oqmgr(8) the "active" queue is also limited to at most 20000 recipient addresses ($qmgr_message_recipient_limit). To check for exhaustion of this limit use: @@ -142,19 +142,19 @@ forget to include the top 10 or 20 lines of qshape(1) output. EExxaammppllee 11:: HHeeaalltthhyy qquueeuuee -When looking at just the incoming and active queues, under normal conditions -(no congestion) the incoming and active queues are nearly empty. Mail leaves -the system almost as quickly as it comes in or is deferred without congestion -in the active queue. +When looking at just the "incoming" and "active" queues, under normal +conditions (no congestion) the "incoming" and "active" queues are nearly empty. +Mail leaves the system almost as quickly as it comes in or is deferred without +congestion in the "active" queue. - $ qshape (show incoming and active queue status) + $ qshape (show "incoming" and "active" queue status) T 5 10 20 40 80 160 320 640 1280 1280+ TOTAL 5 0 0 0 1 0 0 0 1 1 2 meri.uwasa.fi 5 0 0 0 1 0 0 0 1 1 2 -If one looks at the two queues separately, the incoming queue is empty or -perhaps briefly has one or two messages, while the active queue holds more +If one looks at the two queues separately, the "incoming" queue is empty or +perhaps briefly has one or two messages, while the "active" queue holds more messages and for a somewhat longer time: $ qshape incoming @@ -173,8 +173,8 @@ EExxaammppllee 22:: DDeeffeerrrreedd qquueeuuee ffuulll This is from a server where recipient validation is not yet available for some of the hosted domains. Dictionary attacks on the unvalidated domains result in bounce backscatter. The bounces dominate the queue, but with proper tuning they -do not saturate the incoming or active queues. The high volume of deferred mail -is not a direct cause for alarm. +do not saturate the "incoming" or "active" queues. The high volume of deferred +mail is not a direct cause for alarm. $ qshape deferred | head @@ -192,8 +192,8 @@ is not a direct cause for alarm. The domains shown are mostly bulk-mailers and all the volume is the tail end of the time distribution, showing that short term arrival rates are moderate. Larger numbers and lower message ages are more indicative of current trouble. -Old mail still going nowhere is largely harmless so long as the active and -incoming queues are short. We can also see that the groups.msn.com +Old mail still going nowhere is largely harmless so long as the "active" and +"incoming" queues are short. We can also see that the groups.msn.com undeliverables are low rate steady stream rather than a concentrated dictionary attack that is now over. @@ -215,7 +215,7 @@ messages are bounces. EExxaammppllee 33:: CCoonnggeessttiioonn iinn tthhee aaccttiivvee qquueeuuee This example is taken from a Feb 2004 discussion on the Postfix Users list. -Congestion was reported with the active and incoming queues large and not +Congestion was reported with the "active" and "incoming" queues large and not shrinking despite very large delivery agent process limits. The thread is archived at: http://groups.google.com/ groups?threadm=c0b7js$2r65$1@FreeBSD.csie.NCTU.edu.tw and http:// @@ -224,7 +224,7 @@ archives.neohapsis.com/archives/postfix/2004-02/thread.html#1371 Using an older version of qshape(1) it was quickly determined that all the messages were for just a few destinations: - $ qshape (show incoming and active queue status) + $ qshape (show "incoming" and "active" queue status) T A 5 10 20 40 80 160 320 320+ TOTAL 11775 9996 0 0 1 1 42 94 221 1420 @@ -232,10 +232,10 @@ messages were for just a few destinations: lists.sourceforge.net 2313 2313 0 0 0 0 0 0 0 0 gzd.gotdns.com 102 0 0 0 0 0 0 0 2 100 -The "A" column showed the count of messages in the active queue, and the -numbered columns showed totals for the deferred queue. At 10000 messages -(Postfix 1.x active queue size limit) the active queue is full. The incoming -was growing rapidly. +The "A" column showed the count of messages in the "active" queue, and the +numbered columns showed totals for the "deferred" queue. At 10000 messages +(Postfix 1.x "active" queue size limit) the "active" queue is full. The +"incoming" queue was growing rapidly. With the trouble destinations clearly identified, the administrator quickly found and fixed the problem. It is substantially harder to glean the same @@ -246,7 +246,7 @@ by looking at the queue one message at a time. EExxaammppllee 44:: HHiigghh vvoolluummee ddeessttiinnaattiioonn bbaacckklloogg When a site you send a lot of email to is down or slow, mail messages will -rapidly build up in the deferred queue, or worse, in the active queue. The +rapidly build up in the "deferred" queue, or worse, in the "active" queue. The qshape output will show large numbers for the destination domain in all age buckets that overlap the starting time of the problem: @@ -258,14 +258,14 @@ buckets that overlap the starting time of the problem: ... Here the "highvolume.com" destination is continuing to accumulate deferred -mail. The incoming and active queues are fine, but the deferred queue started -growing some time between 1 and 2 hours ago and continues to grow. +mail. The "incoming" and "active" queues are fine, but the "deferred" queue +started growing some time between 1 and 2 hours ago and continues to grow. If the high volume destination is not down, but is instead slow, one might see -similar congestion in the active queue. Active queue congestion is a greater -cause for alarm; one might need to take measures to ensure that the mail is -deferred instead or even add an access(5) rule asking the sender to try again -later. +similar congestion in the "active" queue. "Active" queue congestion is a +greater cause for alarm; one might need to take measures to ensure that the +mail is deferred instead or even add an access(5) rule asking the sender to try +again later. If a high volume destination exhibits frequent bursts of consecutive connections refused by all MX hosts or "421 Server busy errors", it is possible @@ -456,7 +456,7 @@ Congestion in this queue is indicative of an excessive local message submission rate or perhaps excessive CPU consumption in the cleanup(8) service due to excessive body_checks, or (Postfix >= 2.3) high latency milters. -Note, that once the active queue is full, the cleanup service will attempt to +Note, that once the "active" queue is full, the cleanup service will attempt to slow down message injection by pausing $in_flow_delay for each message. In this case "maildrop" queue congestion may be a consequence of congestion downstream, rather than a problem in its own right. @@ -504,18 +504,18 @@ and notifies the queue manager of new mail arrival. The queue manager ignores incomplete queue files whose mode is 0600, as these are still being written by cleanup. -The queue manager scans the incoming queue bringing any new mail into the -"active" queue if the active queue resource limits have not been exceeded. By -default, the active queue accommodates at most 20000 messages. Once the active -queue message limit is reached, the queue manager stops scanning the incoming -(and deferred, see below) queue. +The queue manager scans the "incoming" queue bringing any new mail into the +"active" queue if the "active" queue resource limits have not been exceeded. By +default, the "active" queue accommodates at most 20000 messages. Once the +"active" queue message limit is reached, the queue manager stops scanning the +"incoming" queue (and the "deferred" queue, see below). -Under normal conditions the incoming queue is nearly empty (has only mode 0600 -files), with the queue manager able to import new messages into the active -queue as soon as they become available. +Under normal conditions the "incoming" queue is nearly empty (has only mode +0600 files), with the queue manager able to import new messages into the +"active" queue as soon as they become available. -The incoming queue grows when the message input rate spikes above the rate at -which the queue manager can import messages into the active queue. The main +The "incoming" queue grows when the message input rate spikes above the rate at +which the queue manager can import messages into the "active" queue. The main factors slowing down the queue manager are disk I/O and lookup queries to the trivial-rewrite service. If the queue manager is routinely not keeping up, consider not using "slow" lookup services (MySQL, LDAP, ...) for transport @@ -540,8 +540,8 @@ but is not strong enough to deflect an excessive input rate from many sources at the same time. If a server is being hammered from multiple directions, consider raising the -in_flow_delay to 10 seconds, but only if the incoming queue is growing even -while the active queue is not full and the trivial-rewrite service is using a +in_flow_delay to 10 seconds, but only if the "incoming" queue is growing even +while the "active" queue is not full and the trivial-rewrite service is using a fast transport lookup mechanism. TThhee ""aaccttiivvee"" qquueeuuee @@ -549,8 +549,8 @@ TThhee ""aaccttiivvee"" qquueeuuee The queue manager is a delivery agent scheduler; it works to ensure fast and fair delivery of mail to all destinations within designated resource limits. -The active queue is somewhat analogous to an operating system's process run -queue. Messages in the active queue are ready to be sent (runnable), but are +The "active" queue is somewhat analogous to an operating system's process run +queue. Messages in the "active" queue are ready to be sent (runnable), but are not necessarily in the process of being sent (running). While most Postfix administrators think of the "active" queue as a directory on @@ -562,9 +562,9 @@ below) do not occupy memory; they are safely stored on disk waiting for their turn to be processed. The envelope information for messages in the "active" queue is managed in memory, allowing the queue manager to do global scheduling, allocating available delivery agent processes to an appropriate message in the -active queue. +"active" queue. -Within the active queue, (multi-recipient) messages are broken up into groups +Within the "active" queue, (multi-recipient) messages are broken up into groups of recipients that share the same transport/nexthop combination; the group size is capped by the transport's recipient concurrency limit. @@ -577,14 +577,14 @@ per-recipient concurrency limits rather than per-domain concurrency limits. Per-recipient limits are appropriate when performing final delivery to mailboxes rather than when relaying to a remote server. -Congestion occurs in the active queue when one or more destinations drain +Congestion occurs in the "active" queue when one or more destinations drain slower than the corresponding message input rate. -Input into the active queue comes both from new mail in the "incoming" queue, +Input into the "active" queue comes both from new mail in the "incoming" queue, and retries of mail in the "deferred" queue. Should the "deferred" queue get really large, retries of old mail can dominate the arrival rate of new mail. Systems with more CPU, faster disks and more network bandwidth can deal with -larger deferred queues, but as a rule of thumb the deferred queue scales to +larger "deferred" queues, but as a rule of thumb the "deferred" queue scales to somewhere between 100,000 and 1,000,000 messages with good performance unlikely above that "limit". Systems with queues this large should typically stop accepting new mail, or put the backlog "on hold" until the underlying issue is @@ -592,14 +592,14 @@ fixed (provided that there is enough capacity to handle just the new mail). When a destination is down for some time, the queue manager will mark it dead, and immediately defer all mail for the destination without trying to assign it -to a delivery agent. In this case the messages will quickly leave the active -queue and end up in the deferred queue (with Postfix < 2.4, this is done +to a delivery agent. In this case the messages will quickly leave the "active" +queue and end up in the "deferred" queue (with Postfix < 2.4, this is done directly by the queue manager, with Postfix >= 2.4 this is done via the "retry" delivery agent). When the destination is instead simply slow, or there is a problem causing an -excessive arrival rate the active queue will grow and will become dominated by -mail to the congested destination. +excessive arrival rate the "active" queue will grow and will become dominated +by mail to the congested destination. The only way to reduce congestion is to either reduce the input rate or increase the throughput. Increasing the throughput requires either increasing @@ -635,7 +635,7 @@ per second. The best way to avoid bottlenecks when one or more MX hosts is non-responsive is to use connection caching. Connection caching was introduced with Postfix 2.2 and is by default enabled on demand for destinations with a backlog of mail -in the active queue. When connection caching is in effect for a particular +in the "active" queue. When connection caching is in effect for a particular destination, established connections are re-used to send additional messages, this reduces the number of connections made per message delivery and maintains good throughput even in the face of partial unavailability of the destination's @@ -664,73 +664,75 @@ a separate delivery agent pool to these destinations and allows separate tuning of timeouts and concurrency limits. Another common cause of congestion is unwarranted flushing of the entire -deferred queue. The deferred queue holds messages that are likely to fail to be -delivered and are also likely to be slow to fail delivery (time out). As a -result the most common reaction to a large deferred queue (flush it!) is more -than likely counter-productive, and typically makes the congestion worse. Do -not flush the deferred queue unless you expect that most of its content has -recently become deliverable (e.g. relayhost back up after an outage)! +"deferred" queue. The "deferred" queue holds messages that are likely to fail +to be delivered and are also likely to be slow to fail delivery (time out). As +a result the most common reaction to a large "deferred" queue (flush it!) is +more than likely counter-productive, and typically makes the congestion worse. +Do not flush the "deferred" queue unless you expect that most of its content +has recently become deliverable (e.g. relayhost back up after an outage)! Note that whenever the queue manager is restarted, there may already be -messages in the active queue directory, but the "real" active queue in memory -is empty. In order to recover the in-memory state, the queue manager moves all -the active queue messages back into the incoming queue, and then uses its -normal incoming queue scan to refill the active queue. The process of moving -all the messages back and forth, redoing transport table (trivial-rewrite(8) -resolve service) lookups, and re-importing the messages back into memory is -expensive. At all costs, avoid frequent restarts of the queue manager (e.g. via -frequent execution of "postfix reload"). +messages in the "active" queue directory, but the "real" "active" queue in +memory is empty. In order to recover the in-memory state, the queue manager +moves all the "active" queue messages back into the "incoming" queue, and then +uses its normal "incoming" queue scan to refill the "active" queue. The process +of moving all the messages back and forth, redoing transport table (trivial- +rewrite(8) resolve service) lookups, and re-importing the messages back into +memory is expensive. At all costs, avoid frequent restarts of the queue manager +(e.g. via frequent execution of "postfix reload"). TThhee ""ddeeffeerrrreedd"" qquueeuuee When all the deliverable recipients for a message are delivered, and for some recipients delivery failed for a transient reason (it might succeed later), the -message is placed in the deferred queue. +message is placed in the "deferred" queue. -The queue manager scans the deferred queue periodically. The scan interval is -controlled by the queue_run_delay parameter. While a deferred queue scan is in -progress, if an incoming queue scan is also in progress (ideally these are -brief since the incoming queue should be short), the queue manager alternates +The queue manager scans the "deferred" queue periodically. The scan interval is +controlled by the queue_run_delay parameter. While a "deferred" queue scan is +in progress, if an "incoming" queue scan is also in progress (ideally these are +brief since the "incoming" queue should be short), the queue manager alternates between looking for messages in the "incoming" queue and in the "deferred" -queue. This "round-robin" strategy prevents starvation of either the incoming -or the deferred queues. +queue. This "round-robin" strategy prevents starvation of either the "incoming" +or the "deferred" queues. -Each deferred queue scan only brings a fraction of the deferred queue back into -the active queue for a retry. This is because each message in the deferred -queue is assigned a "cool-off" time when it is deferred. This is done by time- -warping the modification time of the queue file into the future. The queue file -is not eligible for a retry if its modification time is not yet reached. +Each "deferred" queue scan only brings a fraction of the "deferred" queue back +into the "active" queue for a retry. This is because each message in the +"deferred" queue is assigned a "cool-off" time when it is deferred. This is +done by time-warping the modification time of the queue file into the future. +The queue file is not eligible for a retry if its modification time is not yet +reached. The "cool-off" time is at least $minimal_backoff_time and at most $maximal_backoff_time. The next retry time is set by doubling the message's age in the queue, and adjusting up or down to lie within the limits. This means that young messages are initially retried more often than old messages. -If a high volume site routinely has large deferred queues, it may be useful to -adjust the queue_run_delay, minimal_backoff_time and maximal_backoff_time to +If a high volume site routinely has large "deferred" queues, it may be useful +to adjust the queue_run_delay, minimal_backoff_time and maximal_backoff_time to provide short enough delays on first failure (Postfix >= 2.4 has a sensibly low minimal backoff time by default), with perhaps longer delays after multiple failures, to reduce the retransmission rate of old messages and thereby reduce -the quantity of previously deferred mail in the active queue. If you want a +the quantity of previously deferred mail in the "active" queue. If you want a really low minimal_backoff_time, you may also want to lower queue_run_delay, but understand that more frequent scans will increase the demand for disk I/O. -One common cause of large deferred queues is failure to validate recipients at -the SMTP input stage. Since spammers routinely launch dictionary attacks from -unrepliable sender addresses, the bounces for invalid recipient addresses clog -the deferred queue (and at high volumes proportionally clog the active queue). -Recipient validation is strongly recommended through use of the +One common cause of large "deferred" queues is failure to validate recipients +at the SMTP input stage. Since spammers routinely launch dictionary attacks +from unrepliable sender addresses, the bounces for invalid recipient addresses +clog the "deferred" queue (and at high volumes proportionally clog the "active" +queue). Recipient validation is strongly recommended through use of the local_recipient_maps and relay_recipient_maps parameters. Even when bounces drain quickly they inundate innocent victims of forgery with unwanted email. To avoid this, do not accept mail for invalid recipients. When a host with lots of deferred mail is down for some time, it is possible -for the entire deferred queue to reach its retry time simultaneously. This can -lead to a very full active queue once the host comes back up. The phenomenon -can repeat approximately every maximal_backoff_time seconds if the messages are -again deferred after a brief burst of congestion. Perhaps, a future Postfix -release will add a random offset to the retry time (or use a combination of -strategies) to reduce the odds of repeated complete deferred queue flushes. +for the entire "deferred" queue to reach its retry time simultaneously. This +can lead to a very full "active" queue once the host comes back up. The +phenomenon can repeat approximately every maximal_backoff_time seconds if the +messages are again deferred after a brief burst of congestion. Perhaps, a +future Postfix release will add a random offset to the retry time (or use a +combination of strategies) to reduce the odds of repeated complete "deferred" +queue flushes. CCrreeddiittss diff --git a/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES b/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES index c121e7f014c..167b87b33bc 100644 --- a/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES +++ b/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES @@ -1,19 +1,19 @@ -This is the Postfix 3.5 (stable) release. +This is the Postfix 3.7 (stable) release. -The stable Postfix release is called postfix-3.5.x where 3=major -release number, 5=minor release number, x=patchlevel. The stable +The stable Postfix release is called postfix-3.7.x where 3=major +release number, 7=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called -postfix-3.6-yyyymmdd where yyyymmdd is the release date (yyyy=year, +postfix-3.8-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. -If you upgrade from Postfix 3.3 or earlier, read RELEASE_NOTES-3.4 +If you upgrade from Postfix 3.5 or earlier, read RELEASE_NOTES-3.6 before proceeding. License change @@ -25,141 +25,175 @@ more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. -libc-musl workaround for Postfix 3.2.15, 3.3.10, 3.4.12, and 3.5.2 ------------------------------------------------------------------- +Bugfix for messages not delivered after "warning: Unexpected record type 'X' +============================================================================ -Security: this release disables DANE support on Linux systems with -libc-musl, because libc-musl provides no indication whether DNS -responses are authentic. This broke DANE support without a clear -explanation. +Due to a bug introduced in Postfix 3.7.0, a message could falsely +be flagged as corrupt with "warning: Unexpected record type 'X'". -Major changes - multiple relayhost in SMTP ------------------------------------------- +Such messages were moved to the "corrupt" queue directory, where +they may still be found. See below for instructions to deal with +these falsely flagged messages. -[Feature 20200111] the Postfix SMTP and LMTP client support a list -of nexthop destinations separated by comma or whitespace. These -destinations will be tried in the specified order. +This could happen for messages with 5000 or more recipients, or +with fewer recipients on a busy mail server. The problem was first +reported by Frank Brendel, reproduced by John Alex. -The list form can be specified in relayhost, transport_maps, -default_transport, and sender_dependent_default_transport_maps. +A file in the "corrupt" queue directory may be inspected with the +command "postcat /var/spool/postfix/corrupt/<filename>. If delivery +of the file is still desired, the file can be moved back to +/var/spool/postfix/incoming after updating Postfix and executing +"postfix reload". -Examples: -/etc/postfix/main.cf: - relayhost = foo.example, bar.example - default_transport = smtp:foo.example, bar.example. - -NOTE: this is an SMTP and LMTP client feature. It does not work for -other Postfix delivery agents. +Major changes - configuration +----------------------------- -Major changes - certificate access ----------------------------------- +[Feature 20210605] Support to inline the content of small cidr:, +pcre:, and regexp: tables in Postfix parameter values. -[Feature 20190517] Search order support for check_ccert_access. -Search order support for other tables is in design (canonical_maps, -virtual_alias_maps, transport_maps, etc.). +Example: -The following check_ccert_access setting uses the built-in search -order: it first looks up the client certificate fingerprint, then -the client certificate public-key fingerprint, and it stops when a -decision is made. + smtpd_forbidden_commands = + CONNECT GET POST regexp:{{/^[^A-Z]/ Thrash}} -/etc/postfix/main.cf: - smtpd_mumble_restrictions = - ... - check_ccert_access hash:/etc/postfix/ccert-access - ... +This is the new smtpd_forbidden_commands default value. It will +immediately disconnect a remote SMTP client when a command does not +start with a letter (a-z or A-Z). -The following setting, with explicit search order, produces the -exact same result: +The basic syntax is: /etc/postfix/main.cf: - smtpd_mumble_restrictions = - ... - check_ccert_access { - hash:/etc/postfix/ccert-access { - search_order = cert_fingerprint, pubkey_fingerprint } } - ... - -Support is planned for other certificate features. - -Major changes - dovecot usability ---------------------------------- - -[Feature 20190615] The SMTP+LMTP delivery agent can now prepend -Delivered-To, X-Original-To and Return-Path headers, just like the -pipe(8) and local(8) delivery agents. - -This uses the "flags=DORX" command-line flags in master.cf. See the -smtp(8) manpage for details. - -This obsoletes the "lmtp_assume_final = yes" setting, and replaces -it with "flags=...X...", for consistency with the pipe(8) delivery -agent. + parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. -Major changes - forced expiration ---------------------------------- +/etc/postfix/master.cf: + .. -o { parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. } .. -[Feature 20200202] Support to force-expire email messages. This -introduces new postsuper(1) command-line options to request expiration, -and additional information in mailq(1) or postqueue(1) output. +where map-type is one of cidr, pcre, or regexp. -The forced-to-expire status is stored in a queue file attribute. -An expired message is returned to the sender when the queue manager -attempts to deliver that message (note that Postfix will never -deliver messages in the hold queue). +Postfix ignores whitespace after '{' and before '}', and writes each +rule as one text line to a nameless in-memory file: -The postsuper(1) -e and -f options both set the forced-to-expire -queue file attribute. The difference is that -f will also release -a message if it is in the hold queue. With -e, such a message would -not be returned to the sender until it is released with -f or -H. +in-memory file: + rule-1 + rule-2 + .. -In the mailq(1) or postqueue(1) -p output, a forced-to-expire message -is indicated with # after the queue file name. In postqueue(1) JSON -output, there is a new per-message field "forced_expire" (with value -true or false) that shows the forced-to-expire status. +Postfix parses the result as if it is a file in /etc/postfix. -Major changes - haproxy2 protocol ---------------------------------- +Note: if a rule contains $, specify $$ to keep Postfix from trying +to do $name expansion as it evaluates the parameter value. -[Feature 20200112] Support for the haproxy v2 protocol. The Postfix -implementation supports TCP over IPv4 and IPv6, as well as non-proxied -connections; the latter are typically used for heartbeat tests. +Major changes - lmdb support +---------------------------- -The haproxy v2 protocol introduces no additional Postfix configuration. -The Postfix smtpd(8) and postscreen(8) daemons accept both v1 and -v2 protocol versions. +[Feature 20210605] Overhauled the LMDB client's error handling, and +added integration tests for future-proofing. There are no visible +changes in documented behavior. Major changes - logging ----------------------- -[Incompat 20191109] Postfix daemon processes now log the from= and -to= addresses in external (quoted) form in non-debug logging (info, -warning, etc.). This means that when an address localpart contains -spaces or other special characters, the localpart will be quoted, -for example: - - from=<"name with spaces"@example.com> - -Older Postfix versions would log the internal (unquoted) form: - - from=<name with spaces@example.com> - -The external and internal forms are identical for the vast majority -of email addresses that contain no spaces or other special characters -in the localpart. - -Specify "info_log_address_format = internal" for backwards -compatibility. - -The logging in external form is consistent with the address form -that Postfix 3.2 and later prefer for table lookups. It is therefore -the more useful form for non-debug logging. - -Major changes - IP address normalization ----------------------------------------- +[Feature 20210815] To make the maillog_file feature more useful, +the postlog(1) command is now set-gid postdrop, so that unprivileged +programs can use it to write logging through the postlogd(8) daemon. +This required hardening the postlog(1) command against privilege +escalation attacks. DO NOT turn on the set-gid bit with older +postlog(1) implementations. + +Major changes - pcre2 support +----------------------------- + +[Feature 20211127] Support for the pcre2 library (the legacy pcre +library is no longer maintained). The Postfix build procedure +automatically detects if the pcre2 library is installed, and if it +is unavailable, the Postfix build procedure will detect if the +legacy pcre library is installed. See PCRE_README if you need to +build Postfix with a specific library. + +Visible differences: some error messages may have a different text, +and the 'X' pattern flag is no longer supported with pcre2. + +Major changes - security +------------------------ + +[Feature 20220102] Postfix programs now randomize the initial state +of in-memory hash tables, to defend against hash collision attacks +involving a large number of attacker-chosen lookup keys. Presently, +the only known opportunity for such attacks involves remote SMTP +client IPv6 addresses in the anvil(8) service. The attack would +require making hundreds of short-lived connections per second from +thousands of different IP addresses, because the anvil(8) service +drops inactive counters after 100s. Other in-memory hash tables +with attacker-chosen lookup keys are by design limited in size. The +fix is cheap, and therefore implemented for all Postfix in-memory +hash tables. Problem reported by Pascal Junod. + +[Feature 20211030] The postqueue command now sanitizes non-printable +characters (such as newlines) in strings before they are formatted +as json or as legacy output. These outputs are piped into other +programs that are run by administrative users. This closes a +hypothetical opportunity for privilege escalation. + +[Feature 20210815] Updated defense against remote clients or servers +that 'trickle' SMTP or LMTP traffic, based on per-request deadlines +and minimum data rates. + +Per-request deadlines: + +The new {smtpd,smtp,lmtp}_per_request_deadline parameters replace +{smtpd,smtp,lmtp}_per_record_deadline, with backwards compatible +default settings. This defense is enabled by default in the Postfix +SMTP server in case of overload. + +The new smtpd_per_record_deadline parameter limits the combined +time for the Postfix SMTP server to receive a request and to send +a response, while the new {smtp,lmtp}_per_record_deadline parameters +limit the combined time for the Postfix SMTP or LMTP client to send +a request and to receive a response. + +Minimum data rates: + +The new smtpd_min_data_rate parameter enforces a minimum plaintext +data transfer rate for DATA and BDAT requests, but only when +smtpd_per_record_deadline is enabled. After a read operation transfers +N plaintext bytes (possibly after TLS decryption), and after the +DATA or BDAT request deadline is decreased by the elapsed time of +that read operation, the DATA or BDAT request deadline is increased +by N/smtpd_min_data_rate seconds. However, the deadline is never +increased beyond the smtpd_timeout value. The default minimum data +rate is 500 (bytes/second) but is still subject to change. + +The new {smtp,lmtp}_min_data_rate parameters enforce the corresponding +minimum DATA transfer rates for the Postfix SMTP and LMTP client. + +Major changes - tls support +--------------------------- + +[Cleanup 20220121] The new tlsproxy_client_security_level parameter +replaces tlsproxy_client_level, and the new tlsproxy_client_policy_maps +parameter replaces tlsproxy_client_policy. This is for consistent +parameter naming (tlsproxy_client_xxx corresponds to smtp_tls_xxx). +This change was made with backwards-compatible default settings. + +[Feature 20210926] Postfix was updated to support OpenSSL 3.0.0 API +features, and to work around OpenSSL 3.0.0 bit-rot (avoid using +deprecated API features). + +Other code health +----------------- + +[typos] Typo fixes by raf. + +[pre-release checks] Added pre-release checks to detect a) new typos +in documentation and source-code comments, b) missing entries in +the postfix-files file (some documentation would not be installed), +c) missing rules in the postlink script (some text would not have +a hyperlink in documentation), and d) missing map-based $parameter +names in the proxy_read_maps default value (the proxymap daemon +would not automatically authorize some proxied maps). + +[memory stream] Improved support for memory-based streams made it +possible to inline small cidr:, pcre:, and regexp: maps in Postfix +parameter values, and to eliminate some ad-hoc code that converted +tlsproxy(8) protocol data to or from serialized form. -[Incompat 20190427] Postfix now normalizes IP addresses received -with XCLIENT, XFORWARD, or with the HaProxy protocol, for consistency -with direct connections to Postfix. This may change the appearance -of logging, and the way that check_client_access will match subnets -of an IPv6 address. diff --git a/external/ibm-public/postfix/dist/README_FILES/SASL_README b/external/ibm-public/postfix/dist/README_FILES/SASL_README index 0c42480382f..94a377eab0b 100644 --- a/external/ibm-public/postfix/dist/README_FILES/SASL_README +++ b/external/ibm-public/postfix/dist/README_FILES/SASL_README @@ -558,8 +558,8 @@ The following is a summary of applicable smtpd.conf file entries: Specify ldapdb to enable the plugin. ldapdb_uri - Specify either ldapi:// for to connect over a UNIX-domain socket, ldap: - // for an unencrypted TCP connection or ldaps:// for an encrypted TCP + Specify either ldapi:// to connect over a UNIX-domain socket, ldap:/ + / for an unencrypted TCP connection, or ldaps:// for an encrypted TCP connection. ldapdb_id @@ -1058,9 +1058,9 @@ username/password information. standard "AUTH=mmeetthhoodd....." syntax in response to the EHLO command; this requires no additional Postfix client configuration. - * The Postfix SMTP client does not support the obsolete "wrappermode" - protocol, which uses TCP port 465 on the SMTP server. See TLS_README for a - solution that uses the stunnel command. + * With the setting "smtp_tls_wrappermode = yes", the Postfix SMTP client + supports the "wrappermode" protocol, which uses TCP port 465 on the SMTP + server (Postfix 3.0 and later). * With the smtp_sasl_password_maps parameter, we configure the Postfix SMTP client to send username and password information to the mail gateway @@ -1134,14 +1134,14 @@ final resort. single MySQL database, and configure different Postfix queries to extract the appropriate information. - * Specify dbm instead of hash if your system uses dbm files instead of db + * Specify ddbbmm instead of hhaasshh if your system uses ddbbmm files instead of ddbb files. To find out what lookup tables Postfix supports, use the command - "postconf -m". + "ppoossttccoonnff --mm". - * Execute the command "postmap /etc/postfix/sasl_passwd" whenever you change + * Execute the command "ppoossttmmaapp //eettcc//ppoossttffiixx//ssaassll__ppaasssswwdd" whenever you change the sasl_passwd table. - * Execute the command "postmap /etc/postfix/sender_relay" whenever you change + * Execute the command "ppoossttmmaapp //eettcc//ppoossttffiixx//sseennddeerr__rreellaayy" whenever you change the sender_relay table. PPoossttffiixx SSMMTTPP//LLMMTTPP cclliieenntt ppoolliiccyy -- SSAASSLL mmeecchhaanniissmm pprrooppeerrttiieess @@ -1296,7 +1296,7 @@ NNoottee Postfix configuration a little more convenient because you don't have to specify the SASL plug-in type in the Postfix main.cf file (but this may cause surprises when you switch to a later Postfix version that is built - with the default SASL type of sasl). + with the default SASL type of cyrus). * If you also want support for LDAP or TLS (or for Cyrus SASL), you need to merge their CCARGS and AUXLIBS options into the above command line; see the @@ -1313,7 +1313,7 @@ BBuuiillddiinngg CCyyrruuss SSAASSLL ssuuppppoorrtt BBuuiillddiinngg tthhee CCyyrruuss SSAASSLL lliibbrraarryy Postfix works with cyrus-sasl-1.5.x or cyrus-sasl-2.1.x, which are available -from ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/. +from https://github.com/cyrusimap/cyrus-sasl/releases. IImmppoorrttaanntt @@ -1344,6 +1344,10 @@ Cyrus SASL version 2.1.x % mmaakkee mmaakkeeffiilleess CCCCAARRGGSS==""--DDUUSSEE__SSAASSLL__AAUUTTHH --DDUUSSEE__CCYYRRUUSS__SSAASSLL \\ --II//uussrr//llooccaall//iinncclluuddee//ssaassll"" AAUUXXLLIIBBSS==""--LL//uussrr//llooccaall//lliibb --llssaassll22"" + If your Cyrus SASL shared library is in a directory that the RUN-TIME + linker does not know about, add a "-Wl,-R,/path/to/directory" option after + "-lsasl2". + Cyrus SASL version 1.5.x % mmaakkee ttiiddyy # if you have left-over files from a previous build diff --git a/external/ibm-public/postfix/dist/README_FILES/SCHEDULER_README b/external/ibm-public/postfix/dist/README_FILES/SCHEDULER_README index a6f7702ffc5..448ee0a7991 100644 --- a/external/ibm-public/postfix/dist/README_FILES/SCHEDULER_README +++ b/external/ibm-public/postfix/dist/README_FILES/SCHEDULER_README @@ -496,7 +496,7 @@ This document is divided into sections as follows: TThhee ssttrruuccttuurreess uusseedd bbyy nnqqmmggrr Let's start by recapitulating the structures and terms used when referring to -queue manager and how it operates. Many of these are partially described +the queue manager and how it operates. Many of these are partially described elsewhere, but it is nice to have a coherent overview in one place: * Each message structure represents one mail message which Postfix is to @@ -512,8 +512,8 @@ elsewhere, but it is nice to have a coherent overview in one place: set of queues (describing the destinations it shall talk to) and jobs (referencing the messages it shall deliver). - * Each transport queue (not to be confused with the on-disk active queue or - incoming queue) groups everything what is going be delivered to given + * Each transport queue (not to be confused with the on-disk "active" queue or + "incoming" queue) groups everything what is going be delivered to given destination (aka nexthop) by its transport. Each queue belongs to one transport, so each destination may be referred to by several queues, one for each transport. Each queue maintains a list of all recipient entries @@ -547,17 +547,17 @@ description above anytime you'll feel you have lost a sense what is what. WWhhaatt hhaappppeennss wwhheenn nnqqmmggrr ppiicckkss uupp tthhee mmeessssaaggee -Whenever nqmgr moves a queue file into the active queue, the following happens: -It reads all necessary information from the queue file as oqmgr does, and also -reads as many recipients as possible - more on that later, for now let's just -pretend it always reads all recipients. +Whenever nqmgr moves a queue file into the "active" queue, the following +happens: It reads all necessary information from the queue file as oqmgr does, +and also reads as many recipients as possible - more on that later, for now +let's just pretend it always reads all recipients. Then it resolves the recipients as oqmgr does, which means obtaining (address, nexthop, transport) triple for each recipient. For each triple, it finds the transport; if it does not exist yet, it instantiates it (unless it's dead). -Within the transport, it finds the destination queue for given nexthop; if it -does not exist yet, it instantiates it (unless it's dead). The triple is then -bound to given destination queue. This happens in qmgr_resolve() and is +Within the transport, it finds the destination queue for the given nexthop; if +it does not exist yet, it instantiates it (unless it's dead). The triple is +then bound to given destination queue. This happens in qmgr_resolve() and is basically the same as in oqmgr. Then for each triple which was bound to some queue (and thus transport), the @@ -566,19 +566,19 @@ context; if it does not exist yet, it instantiates it. Within the job, it finds the peer which represents the bound destination queue within this jobs context; if it does not exist yet, it instantiates it. Finally, it stores the address from the resolved triple to the recipient entry which is appended to both the -queue entry list and the peer entry list. The addresses for same nexthop are -batched in the entries up to recipient_concurrency limit for that transport. -This happens in qmgr_assign() and apart from that it operates with job and peer -structures it is basically the same as in oqmgr. +queue entry list and the peer entry list. The addresses for the same nexthop +are batched in the entries up to the transport_destination_recipient_limit for +that transport. This happens in qmgr_message_assign(), and apart from that it +operates with job and peer structures, it is basically the same as in oqmgr. When the job is instantiated, it is enqueued on the transport's job list based on the time its message was picked up by nqmgr. For first batch of recipients this means it is appended to the end of the job list, but the ordering of the job list by the enqueue time is important as we will see shortly. -[Now you should have pretty good idea what is the state of the nqmgr after -couple of messages was picked up, what is the relation between all those job, -peer, queue and entry structures.] +[Now you should have a pretty good idea what the state of the nqmgr is after a +couple of messages were picked up, and what the relation is between all those +job, peer, queue and entry structures.] HHooww tthhee eennttrryy sseelleeccttiioonn wwoorrkkss @@ -606,9 +606,9 @@ job list is by default kept in the order the message was picked up by the nqmgr. So by default we get the top-level round-robin transport, and within each transport we get the FIFO message delivery. The round-robin of the peers by the destination is perhaps of little importance in most real-life cases -(unless the recipient_concurrency limit is reached, in one job there is only -one peer structure for each destination), but theoretically it makes sure that -even within single jobs, destinations are treated fairly. +(unless the transport_destination_recipient_limit is reached, in one job there +is only one peer structure for each destination), but theoretically it makes +sure that even within single jobs, destinations are treated fairly. [By now you should have a feeling you really know how the scheduler works, except for the preemption, under ideal conditions - that is, no recipient @@ -661,14 +661,14 @@ with more than one recipient? Say if we have one four-recipient mail followed by two two-recipient mails? The simple answer would be to use delivery sequence 12121313. But the problem -is that this does not scale well. Imagine you have mail with thousand -recipients followed by mail with hundred recipients. It is tempting to suggest -the delivery sequence like 121212...., but alas! Imagine there arrives another -mail with say ten recipients. But there are no free slots anymore, so it can't -slip by, not even if it had just only one recipients. It will be stuck until +is that this does not scale well. Imagine you have mail with a thousand +recipients followed by mail with a hundred recipients. It is tempting to +suggest the delivery sequence like 121212...., but alas! Imagine there arrives +another mail with say ten recipients. But there are no free slots anymore, so +it can't slip by, not even if it had only one recipient. It will be stuck until the hundred-recipient mail is delivered, which really sucks. -So, it becomes obvious that while inflating the message to get free slots is +So, it becomes obvious that while inflating the message to get free slots is a great idea, one has to be really careful of how the free slots are assigned, otherwise one might corner himself. So, how does nqmgr really use the free slots? @@ -689,30 +689,30 @@ slots, and then we could preempt it and sneak in the ten-recipient mail... Wait wait wait! Could we? Aren't we overinflating the original one thousand recipient mail? -Well, despite it looks so at the first glance, another trick will allow us to -answer "no, we are not!". If we had said that we will inflate the delivery time -twice at maximum, and then we consider every other slot as a free slot, then we -would overinflate in case of the recursive preemption. BUT! The trick is that -if we use only every n-th slot as a free slot for n>2, there is always some -worst inflation factor which we can guarantee not to be breached, even if we -apply the algorithm recursively. To be precise, if for every k>1 normally used -slots we accumulate one free delivery slot, than the inflation factor is not -worse than k/(k-1) no matter how many recursive preemptions happen. And it's -not worse than (k+1)/k if only non-recursive preemption happens. Now, having -got through the theory and the related math, let's see how nqmgr implements -this. +Well, despite the fact that it looks so at the first glance, another trick will +allow us to answer "no, we are not!". If we had said that we will inflate the +delivery time twice at maximum, and then we consider every other slot as a free +slot, then we would overinflate in case of the recursive preemption. BUT! The +trick is that if we use only every n-th slot as a free slot for n>2, there is +always some worst inflation factor which we can guarantee not to be breached, +even if we apply the algorithm recursively. To be precise, if for every k>1 +normally used slots we accumulate one free delivery slot, than the inflation +factor is not worse than k/(k-1) no matter how many recursive preemptions +happen. And it's not worse than (k+1)/k if only non-recursive preemption +happens. Now, having got through the theory and the related math, let's see how +nqmgr implements this. Each job has so called "available delivery slot" counter. Each transport has a transport_delivery_slot_cost parameter, which defaults to default_delivery_slot_cost parameter which is set to 5 by default. This is the k from the paragraph above. Each time k entries of the job are selected for delivery, this counter is incremented by one. Once there are some slots -accumulated, job which requires no more than that number of slots to be fully +accumulated, a job which requires no more than that number of slots to be fully delivered can preempt this job. [Well, the truth is, the counter is incremented every time an entry is selected -and it is divided by k when it is used. But for the understanding it's good -enough to use the above approximation of the truth.] +and it is divided by k when it is used. But to understand, it's good enough to +use the above approximation of the truth.] OK, so now we know the conditions which must be satisfied so one job can preempt another one. But what job gets preempted, how do we choose what job @@ -720,11 +720,11 @@ preempts it if there are several valid candidates, and when does all this exactly happen? The answer for the first part is simple. The job whose entry was selected the -last time is so called current job. Normally, it is the first job on the +last time is the so called current job. Normally, it is the first job on the scheduler's job list, but destination concurrency limits may change this as we will see later. It is always only the current job which may get preempted. -Now for the second part. The current job has certain amount of recipient +Now for the second part. The current job has a certain amount of recipient entries, and as such may accumulate at maximum some amount of available delivery slots. It might have already accumulated some, and perhaps even already used some when it was preempted before (remember a job can be preempted @@ -737,22 +737,22 @@ The answer is - the one with maximum enqueue_time/recipient_entry_count. That is, the older the job is, the more we should try to deliver it in order to get best message delivery rates. These rates are of course subject to how many recipients the message has, therefore the division by the recipient (entry) -count. No one shall be surprised that message with n recipients takes n times -longer to deliver than message with one recipient. +count. No one shall be surprised that a message with n recipients takes n times +longer to deliver than a message with one recipient. Now let's recap the previous two paragraphs. Isn't it too complicated? Why don't the candidates come only among the jobs which can be delivered within the number of slots the current job already accumulated? Why do we need to estimate how much it has yet to accumulate? If you found out the answer, congratulate yourself. If we did it this simple way, we would always choose the candidate -with least recipient entries. If there were enough single recipient mails +with the fewest recipient entries. If there were enough single recipient mails coming in, they would always slip by the bulk mail as soon as possible, and the -two and more recipients mail would never get a chance, no matter how long they +two or more recipients mail would never get a chance, no matter how long they have been sitting around in the job list. -This candidate selection has interesting implication - that when we choose the -best candidate for preemption (this is done in qmgr_choose_candidate()), it may -happen that we may not use it for preemption immediately. This leads to an +This candidate selection has an interesting implication - that when we choose +the best candidate for preemption (this is done in qmgr_choose_candidate()), it +may happen that we may not use it for preemption immediately. This leads to an answer to the last part of the original question - when does the preemption happen? @@ -760,23 +760,23 @@ The preemption attempt happens every time next transport's recipient entry is to be chosen for delivery. To avoid needless overhead, the preemption is not attempted if the current job could never accumulate more than transport_minimum_delivery_slots (defaults to default_minimum_delivery_slots -which defaults to 3). If there is already enough accumulated slots to preempt +which defaults to 3). If there are already enough accumulated slots to preempt the current job by the chosen best candidate, it is done immediately. This basically means that the candidate is moved in front of the current job on the scheduler's job list and decreasing the accumulated slot counter by the amount -used by the candidate. If there is not enough slots... well, I could say that +used by the candidate. If there are not enough slots... well, I could say that nothing happens and the another preemption is attempted the next time. But that's not the complete truth. The truth is that it turns out that it is not really necessary to wait until the jobs counter accumulates all the delivery slots in advance. Say we have ten-recipient mail followed by two two-recipient mails. If the preemption -happened when enough delivery slot accumulate (assuming slot cost 2), the +happened when enough delivery slots accumulate (assuming slot cost 2), the delivery sequence becomes 11112211113311. Now what would we get if we would wait only for 50% of the necessary slots to accumulate and we promise we would wait for the remaining 50% later, after we get back to the preempted job? If we -use such slot loan, the delivery sequence becomes 11221111331111. As we can -see, it makes it no considerably worse for the delivery of the ten-recipient +use such a slot loan, the delivery sequence becomes 11221111331111. As we can +see, it makes it not considerably worse for the delivery of the ten-recipient mail, but it allows the small messages to be delivered sooner. The concept of these slot loans is where the transport_delivery_slot_discount @@ -787,11 +787,11 @@ many percent (resp. how many slots) one "gets in advance", when the number of slots required to deliver the best candidate is compared with the number of slots the current slot had accumulated so far. -And it pretty much concludes this chapter. +And that pretty much concludes this chapter. [Now you should have a feeling that you pretty much understand the scheduler -and the preemption, or at least that you will have it after you read the last -chapter couple more times. You shall clearly see the job list and the +and the preemption, or at least that you will have after you read the last +chapter a couple more times. You shall clearly see the job list and the preemption happening at its head, in ideal delivery conditions. The feeling of understanding shall last until you start wondering what happens if some of the jobs are blocked, which you might eventually figure out correctly from what had @@ -805,17 +805,18 @@ The nqmgr uses the same algorithm for destination concurrency control as oqmgr. Now what happens when the destination limits are reached and no more entries for that destination may be selected by the scheduler? -From user's point of view it is all simple. If some of the peers of a job can't -be selected, those peers are simply skipped by the entry selection algorithm -(the pseudo-code described before) and only the selectable ones are used. If -none of the peers may be selected, the job is declared a "blocker job". Blocker -jobs are skipped by the entry selection algorithm and they are also excluded -from the candidates for preemption of current job. Thus the scheduler -effectively behaves as if the blocker jobs didn't exist on the job list at all. -As soon as at least one of the peers of a blocker job becomes unblocked (that -is, the delivery agent handling the delivery of the recipient entry for given -destination successfully finishes), the job's blocker status is removed and the -job again participates in all further scheduler actions normally. +From the user's point of view it is all simple. If some of the peers of a job +can't be selected, those peers are simply skipped by the entry selection +algorithm (the pseudo-code described before) and only the selectable ones are +used. If none of the peers may be selected, the job is declared a "blocker +job". Blocker jobs are skipped by the entry selection algorithm and they are +also excluded from the candidates for preemption of the current job. Thus the +scheduler effectively behaves as if the blocker jobs didn't exist on the job +list at all. As soon as at least one of the peers of a blocker job becomes +unblocked (that is, the delivery agent handling the delivery of the recipient +entry for the given destination successfully finishes), the job's blocker +status is removed and the job again participates in all further scheduler +actions normally. So the summary is that the users don't really have to be concerned about the interaction of the destination limits and scheduling algorithm. It works well @@ -844,8 +845,8 @@ are selected, and once they are all selected, job 1 continues. As we see, it's all very clean and straightforward. Now how does this change because of blockers? -The answer is: a lot. Any job may become blocker job at any time, and also -become normal job again at any time. This has several important implications: +The answer is: a lot. Any job may become a blocker job at any time, and also +become a normal job again at any time. This has several important implications: 1. The jobs may be completed in arbitrary order. For example, in the example above, if the current job 7 becomes blocked, the next job 4 may complete @@ -854,7 +855,7 @@ become normal job again at any time. This has several important implications: completed and only after that 4 becomes unblocked and is completed... You get the idea. - [Interesting side note: even when jobs are delivered out of order, from + [Interesting side note: even when jobs are delivered out of order, from a single destination's point of view the jobs are still delivered in the expected order (that is, FIFO unless there was some preemption involved). This is because whenever a destination queue becomes unblocked (the @@ -885,7 +886,7 @@ the point 3) example: jobs 7 and 8 preempt job 4, now job 8 becomes blocked too, then job 4 completes. Tricky, huh? If I illustrate the relations after the above mentioned examples (but those in -point 1)), the situation would look like this: +point 1), the situation would look like this: v- parent @@ -900,11 +901,11 @@ point 1)), the situation would look like this: Now how does nqmgr deal with all these complicated relations? Well, it maintains them all as described, but fortunately, all these relations -are necessary only for purposes of proper counting of available delivery slots. -For purposes of ordering the jobs for entry selection, the original rule still -applies: "the job preempting the current job is moved in front of the current -job on the job list". So for entry selection purposes, the job relations remain -as simple as this: +are necessary only for the purpose of proper counting of available delivery +slots. For the purpose of ordering the jobs for entry selection, the original +rule still applies: "the job preempting the current job is moved in front of +the current job on the job list". So for entry selection purposes, the job +relations remain as simple as this: 7--8--1--2--6--3--5--.. <- scheduler's job list order @@ -916,8 +917,8 @@ introduction to the problem domain. Otherwise I suggest you just forget about all this and stick with the user's point of view: the blocker jobs are simply ignored. -[By now, you should have a feeling that there is more things going under the -hood than you ever wanted to know. You decide that forgetting about this +[By now, you should have a feeling that there are more things going on under +the hood than you ever wanted to know. You decide that forgetting about this chapter is the best you can do for the sake of your mind's health and you basically stick with the idea how the scheduler works in ideal conditions, when there are no blockers, which is good enough.] @@ -925,25 +926,25 @@ there are no blockers, which is good enough.] DDeeaalliinngg wwiitthh mmeemmoorryy rreessoouurrccee lliimmiittss When discussing the nqmgr scheduler, we have so far assumed that all recipients -of all messages in the active queue are completely read into the memory. This -is simply not true. There is an upper bound on the amount of memory the nqmgr -may use, and therefore it must impose some limits on the information it may -store in the memory at any given time. +of all messages in the "active" queue are completely read into memory. This is +simply not true. There is an upper bound on the amount of memory the nqmgr may +use, and therefore it must impose some limits on the information it may store +in memory at any given time. First of all, not all messages may be read in-core at once. At any time, only qmgr_message_active_limit messages may be read in-core at maximum. When read -into memory, the messages are picked from the incoming and deferred message -queues and moved to the active queue (incoming having priority), so if there is -more than qmgr_message_active_limit messages queued in the active queue, the -rest will have to wait until (some of) the messages in the active queue are +into memory, the messages are picked from the "incoming" and "deferred" queues +and moved to the "active" queue (incoming having priority), so if there are +more than qmgr_message_active_limit messages queued in the "active" queue, the +rest will have to wait until (some of) the messages in the "active" queue are completely delivered (or deferred). Even with the limited amount of in-core messages, there is another limit which -must be imposed in order to avoid memory exhaustion. Each message may contain -huge amount of recipients (tens or hundreds of thousands are not uncommon), so -if nqmgr read all recipients of all messages in the active queue, it may easily -run out of memory. Therefore there must be some upper bound on the amount of -message recipients which are read into the memory at the same time. +must be imposed in order to avoid memory exhaustion. Each message may contain a +huge number of recipients (tens or hundreds of thousands are not uncommon), so +if nqmgr read all recipients of all messages in the "active" queue, it may +easily run out of memory. Therefore there must be some upper bound on the +amount of message recipients which are read into memory at the same time. Before discussing how exactly nqmgr implements the recipient limits, let's see how the sole existence of the limits themselves affects the nqmgr and its @@ -951,7 +952,7 @@ scheduler. The message limit is straightforward - it just limits the size of the lookahead the nqmgr's scheduler has when choosing which message can preempt the current -one. Messages not in the active queue simply are not considered at all. +one. Messages not in the "active" queue are simply not considered at all. The recipient limit complicates more things. First of all, the message reading code must support reading the recipients in batches, which among other things @@ -967,14 +968,14 @@ file, the scheduler can't operate with exact counts of recipient entries. With unread recipients, it is not clear how many recipient entries there will be, as they are subject to per-destination grouping. It is not even clear to what transports (and thus jobs) the recipients will be assigned. And with messages -coming from the deferred queue, it is not even clear how many unread recipients -are still to be delivered. This all means that the scheduler must use only -estimates of how many recipients entries there will be. Fortunately, it is -possible to estimate the minimum and maximum correctly, so the scheduler can -always err on the safe side. Obviously, the better the estimates, the better -results, so it is best when we are able to read all recipients in-core and turn -the estimates into exact counts, or at least try to read as many as possible to -make the estimates as accurate as possible. +coming from the "deferred" queue, it is not even clear how many unread +recipients are still to be delivered. This all means that the scheduler must +use only estimates of how many recipients entries there will be. Fortunately, +it is possible to estimate the minimum and maximum correctly, so the scheduler +can always err on the safe side. Obviously, the better the estimates, the +better the results, so it is best when we are able to read all recipients in- +core and turn the estimates into exact counts, or at least try to read as many +as possible to make the estimates as accurate as possible. The third complication is that it is no longer true that the scheduler is done with a job once all of its in-core recipients are delivered. It is possible @@ -987,9 +988,9 @@ And finally, the fourth complication is that the nqmgr code must somehow impose the recipient limit itself. Now how does it achieve it? Perhaps the easiest solution would be to say that each message may have at -maximum X recipients stored in-core, but such solution would be poor for +maximum X recipients stored in-core, but such a solution would be poor for several reasons. With reasonable qmgr_message_active_limit values, the X would -have to be quite low to maintain reasonable memory footprint. And with low X +have to be quite low to maintain a reasonable memory footprint. And with low X lots of things would not work well. The nqmgr would have problems to use the transport_destination_recipient_limit efficiently. The scheduler's preemption would be suboptimal as the recipient count estimates would be inaccurate. The @@ -997,28 +998,28 @@ message queue file would have to be accessed many times to read in more recipients again and again. Therefore it seems reasonable to have a solution which does not use a limit -imposed on per-message basis, but which maintains a pool of available recipient -slots, which can be shared among all messages in the most efficient manner. And -as we do not want separate transports to compete for resources whenever -possible, it seems appropriate to maintain such recipient pool for each -transport separately. This is the general idea, now how does it work in +imposed on a per-message basis, but which maintains a pool of available +recipient slots, which can be shared among all messages in the most efficient +manner. And as we do not want separate transports to compete for resources +whenever possible, it seems appropriate to maintain such a recipient pool for +each transport separately. This is the general idea, now how does it work in practice? -First we have to solve little chicken-and-egg problem. If we want to use the -per-transport recipient pools, we first need to know to what transport(s) is -the message assigned. But we will find that out only after we read in the -recipients first. So it is obvious that we first have to read in some -recipients, use them to find out to what transports is the message to be -assigned, and only after that we can use the per-transport recipient pools. +First we have to solve a little chicken-and-egg problem. If we want to use the +per-transport recipient pools, we first need to know to what transport(s) the +message is assigned. But we will find that out only after we first read in the +recipients. So it is obvious that we first have to read in some recipients, use +them to find out to what transports the message is to be assigned, and only +after that can we use the per-transport recipient pools. Now how many recipients shall we read for the first time? This is what qmgr_message_recipient_minimum and qmgr_message_recipient_limit values control. The qmgr_message_recipient_minimum value specifies how many recipients of each -message we will read for the first time, no matter what. It is necessary to -read at least one recipient before we can assign the message to a transport and -create the first job. However, reading only qmgr_message_recipient_minimum -recipients even if there are only few messages with few recipients in-core -would be wasteful. Therefore if there is less than qmgr_message_recipient_limit +message we will read the first time, no matter what. It is necessary to read at +least one recipient before we can assign the message to a transport and create +the first job. However, reading only qmgr_message_recipient_minimum recipients +even if there are only few messages with few recipients in-core would be +wasteful. Therefore if there are fewer than qmgr_message_recipient_limit recipients in-core so far, the first batch of recipients may be larger than qmgr_message_recipient_minimum - as large as is required to reach the qmgr_message_recipient_limit limit. @@ -1033,12 +1034,12 @@ recipient batch may be as large as the sum of all recipient slots of all jobs of the message permits (plus the qmgr_message_recipient_minimum amount which always applies). -For example, if a message has three jobs, first with 1 recipient still in-core -and 4 recipient slots, second with 5 recipient in-core and 5 recipient slots, -and third with 2 recipients in-core and 0 recipient slots, it has 1+5+2=7 -recipients in-core and 4+5+0=9 jobs' recipients slots in total. This means that -we could immediately read 2+qmgr_message_recipient_minimum more recipients of -that message in core. +For example, if a message has three jobs, the first with 1 recipient still in- +core and 4 recipient slots, the second with 5 recipients in-core and 5 +recipient slots, and the third with 2 recipients in-core and 0 recipient slots, +it has 1+5+2=8 recipients in-core and 4+5+0=9 jobs' recipients slots in total. +This means that we could immediately read 2+qmgr_message_recipient_minimum more +recipients of that message in core. The above example illustrates several things which might be worth mentioning explicitly: first, note that although the per-transport slots are assigned to @@ -1067,17 +1068,17 @@ job list does. More specifically, each time a job is created and appended to the job list, it gets all unused recipient slots from its transport's pool. It keeps them until all recipients of its message are read. When this happens, all unused recipient -slots are transferred to the next job (which is now in fact now first such job) +slots are transferred to the next job (which is now in fact the first such job) on the job list which still has some recipients unread, or eventually back to -the transport pool if there is no such job. Such transfer then also happens +the transport pool if there is no such job. Such a transfer then also happens whenever a recipient entry of that job is delivered. There is also a scenario when a job is not appended to the end of the job list -(for example it was created as a result of second or later recipient batch). +(for example it was created as a result of a second or later recipient batch). Then it works exactly as above, except that if it was put in front of the first unread job (that is, the job of a message which still has some unread -recipients in queue file), that job is first forced to return all of its unused -recipient slots to the transport pool. +recipients in the queue file), that job is first forced to return all of its +unused recipient slots to the transport pool. The algorithm just described leads to the following state: The first unread job on the job list always gets all the remaining recipient slots of that transport @@ -1087,22 +1088,22 @@ maximum as many slots as they still have recipients in-core (the maximum is there because of the sponsoring mentioned before) and the jobs after this job get nothing from the transport recipient pool (unless they got something before and then the first unread job was created and enqueued in front of them later - -in such case the also get at maximum as many slots as they have recipients in- -core). - -Things work fine in such state for most of the time, because the current job is -either completely read in-core or has as much recipient slots as there are, but -there is one situation which we still have to take care of specially. Imagine -if the current job is preempted by some unread job from the job list and there -are no more recipient slots available, so this new current job could read only -batches of qmgr_message_recipient_minimum recipients at a time. This would -really degrade performance. For this reason, each transport has extra pool of -transport_extra_recipient_limit recipient slots, dedicated exactly for this -situation. Each time an unread job preempts the current job, it gets half of -the remaining recipient slots from the normal pool and this extra pool. +in such a case, they also get at maximum as many slots as they have recipients +in-core). + +Things work fine in such a state for most of the time, because the current job +is either completely read in-core or has as many recipient slots as there are, +but there is one situation which we still have to take care of specially. +Imagine if the current job is preempted by some unread job from the job list +and there are no more recipient slots available, so this new current job could +read only batches of qmgr_message_recipient_minimum recipients at a time. This +would really degrade performance. For this reason, each transport has an extra +pool of transport_extra_recipient_limit recipient slots, dedicated exactly for +this situation. Each time an unread job preempts the current job, it gets half +of the remaining recipient slots from the normal pool and this extra pool. And that's it. It sure does sound pretty complicated, but fortunately most -people don't really have to care how exactly it works as long as it works. +people don't really have to care exactly how it works as long as it works. Perhaps the only important things to know for most people are the following upper bound formulas: @@ -1126,14 +1127,14 @@ The total amount of recipients in core is where the sum is over all used transports. -And this terribly complicated chapter concludes the documentation of nqmgr +And this terribly complicated chapter concludes the documentation of the nqmgr scheduler. [By now you should theoretically know the nqmgr scheduler inside out. In practice, you still hope that you will never have to really understand the last or last two chapters completely, and fortunately most people really won't. Understanding how the scheduler works in ideal conditions is more than good -enough for vast majority of users.] +enough for the vast majority of users.] CCrreeddiittss diff --git a/external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README b/external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README index 230204a7fbf..7477a3685d2 100644 --- a/external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README +++ b/external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README @@ -23,7 +23,7 @@ RReellaayy ccoonnttrrooll,, jjuunnkk mmaaiill ccoonnttr In a distant past, the Internet was a friendly environment. Mail servers happily forwarded mail on behalf of anyone towards any destination. On today's Internet, spammers abuse servers that forward mail from arbitrary systems, and -abused systems end up on anti-spammer blacklists. See, for example, the +abused systems end up on anti-spammer denylists. See, for example, the information on http://www.mail-abuse.org/ and other websites. By default, Postfix has a moderately restrictive approach to mail relaying. @@ -50,11 +50,11 @@ email. Protocol-oriented access controls become less useful over time as spammers and worm writers learn to read RFC documents. - * Blacklist oriented: some SMTP server access controls query blacklists with + * Denylist oriented: some SMTP server access controls query denylists with known to be bad sites such as open mail relays, open web proxies, and home computers that have been compromised and that are under remote control by - criminals. The effectiveness of these blacklists depends on how complete - and how up to date they are. + criminals. The effectiveness of these denylists depends on how complete and + how up to date they are. * Threshold oriented: some SMTP server access controls attempt to raise the bar by either making the client do more work (greylisting) or by asking for @@ -160,8 +160,9 @@ Each restriction list is evaluated from left to right until some restriction produces a result of PERMIT, REJECT or DEFER (try again later). The end of each list is equivalent to a PERMIT result. By placing a PERMIT restriction before a REJECT restriction you can make exceptions for specific clients or users. This -is called whitelisting; the fourth example above allows mail from local -networks but otherwise rejects mail to arbitrary destinations. +is called allowlisting; the smtpd_relay_restrictions example above allows mail +from local networks, and from SASL authenticated clients, but otherwise rejects +mail to arbitrary destinations. The table below summarizes the purpose of each SMTP access restriction list. All lists use the exact same syntax; they differ only in the time of evaluation @@ -248,7 +249,7 @@ Benefits of delayed restriction evaluation, and of restriction mixing: logging only the client hostname and IP address and not knowing whose mail was being blocked. - * Mixing is needed for complex whitelisting policies. For example, in order + * Mixing is needed for complex allowlisting policies. For example, in order to reject local sender addresses in mail from non-local clients, you need to be able to mix restrictions on client information with restrictions on sender information in the same restriction list. Without this ability, many diff --git a/external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README b/external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README index 0c96c760ae1..291fa5c8709 100644 --- a/external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README +++ b/external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README @@ -201,7 +201,7 @@ The first example specifies that the policy server listens on a TCP socket at 127.0.0.1 port 9998. The second example specifies an absolute pathname of a UNIX-domain socket. The third example specifies a pathname relative to the Postfix queue directory; use this for policy servers that are spawned by the -Postfix master daemon. +Postfix master daemon. On many systems, "local" is a synonym for "unix". To create a policy service that listens on a UNIX-domain socket called "policy", and that runs under control of the Postfix spawn(8) daemon, you would @@ -240,7 +240,7 @@ NOTES: * Line 11: this increases the time that a policy server process may run to 3600 seconds. The default time limit of 1000 seconds is too short; the - policy daemon needs to run long as the SMTP server process that talks to + policy daemon needs to run as long as the SMTP server process that talks to it. See the spawn(8) manpage for more information about the transport_time_limit parameter. @@ -432,8 +432,8 @@ Notes: * Line 6: this increases the time that a greylist server process may run to 3600 seconds. The default time limit of 1000 seconds is too short; the - greylist daemon needs to run long as the SMTP server process that talks to - it. See the spawn(8) manpage for more information about the + greylist daemon needs to run as long as the SMTP server process that talks + to it. See the spawn(8) manpage for more information about the transport_time_limit parameter. * Line 9: reject_unauth_destination is not needed here if the mail relay @@ -470,8 +470,9 @@ GGrreeyylliissttiinngg mmaaiill ffrroomm ffrreeqquueen It is relatively safe to turn on greylisting for specific domains that often appear in forged email. At some point in cyberspace/time a list of frequently -forged MAIL FROM domains could be found at http://www.monkeys.com/anti-spam/ -filtering/sender-domain-validate.in. +forged MAIL FROM domains could be found at https://web.archive.org/web/ +20080526153208/http://www.monkeys.com/anti-spam/filtering/sender-domain- +validate.in. 1 /etc/postfix/main.cf: 2 smtpd_recipient_restrictions = @@ -516,7 +517,7 @@ If you turn on greylisting for all mail you may want to make exceptions for mailing lists that use one-time sender addresses, because each message will be delayed due to greylisting, and the one-time sender addresses can pollute your greylist database relatively quickly. Instead of making exceptions, you can -automatically whitelist clients that survive greylisting repeatedly; this +automatically allowlist clients that survive greylisting repeatedly; this avoids most of the delays and most of the database pollution problem. 1 /etc/postfix/main.cf: @@ -578,11 +579,11 @@ $database_name="/var/mta/greylist.db"; $greylist_delay=60; # -# Auto-whitelist threshold. Specify 0 to disable, or the number of +# Auto-allowlist threshold. Specify 0 to disable, or the number of # successful "come backs" after which a client is no longer subject # to greylisting. # -$auto_whitelist_threshold = 10; +$auto_allowlist_threshold = 10; # # Demo SMTPD access policy routine. The result is an action just like @@ -595,10 +596,10 @@ sub smtpd_access_policy { # Open the database on the fly. open_database() unless $database_obj; - # Search the auto-whitelist. - if ($auto_whitelist_threshold > 0) { + # Search the auto-allowlist. + if ($auto_allowlist_threshold > 0) { $count = read_database($attr{"client_address"}); - if ($count > $auto_whitelist_threshold) { + if ($count > $auto_allowlist_threshold) { return "dunno"; } } @@ -627,8 +628,8 @@ sub smtpd_access_policy { # syslog $syslog_priority, "request age %d", $now - $time_stamp if $verbose; if ($now - $time_stamp > $greylist_delay) { - # Update the auto-whitelist. - if ($auto_whitelist_threshold > 0) { + # Update the auto-allowlist. + if ($auto_allowlist_threshold > 0) { update_database($attr{"client_address"}, $count + 1); } return "dunno"; diff --git a/external/ibm-public/postfix/dist/README_FILES/SMTPD_PROXY_README b/external/ibm-public/postfix/dist/README_FILES/SMTPD_PROXY_README index f2cd530d44f..a3707ea4c62 100644 --- a/external/ibm-public/postfix/dist/README_FILES/SMTPD_PROXY_README +++ b/external/ibm-public/postfix/dist/README_FILES/SMTPD_PROXY_README @@ -102,8 +102,9 @@ From then on mail is processed as usual. The content filter itself is not described here. You can use any filter that is SMTP enabled. For non-SMTP capable content filtering software, Bennett Todd's -SMTP proxy implements a nice Perl-based framework. See: http:// -bent.latency.net/smtpprox/ or https://github.com/jnorell/smtpprox. +SMTP proxy implements a nice Perl-based framework. See: https:// +web.archive.org/web/20151022025756/http://bent.latency.net/smtpprox/ or https:/ +/github.com/jnorell/smtpprox/ Postfix Postfix filter on SMTP server Postfix Postfix @@ -197,9 +198,9 @@ The after-filter SMTP server is a new master.cf entry: By default, the filter has 100 seconds to do its work. If it takes longer then Postfix gives up and reports an error to the remote SMTP client. You can -increase this time limit (see configuration parameter section below) but doing -so is pointless because you can't control when the remote SMTP client times -out. +increase this time limit (see the "Configuration parameters" section below) but +doing so is pointless because you can't control when the remote SMTP client +times out. CCoonnffiigguurraattiioonn ppaarraammeetteerrss diff --git a/external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README b/external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README index 5496a3b0d38..9e7970e72f2 100644 --- a/external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README +++ b/external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README @@ -173,7 +173,7 @@ This section applies only to systems that have SMTPUTF8 support turned on For compatibility with pre-SMTPUTF8 environments, Postfix does not automatically set the "SMTPUTF8 requested" flag on messages from non-SMTPUTF8 -clients that contain an UTF-8 header value or UTF-8 address localpart. This +clients that contain a UTF-8 header value or UTF-8 address localpart. This would make such messages undeliverable to non-SMTPUTF8 servers, and could be a barrier to SMTPUTF8 adoption. diff --git a/external/ibm-public/postfix/dist/README_FILES/SOHO_README b/external/ibm-public/postfix/dist/README_FILES/SOHO_README index 722bece706e..bbba7c210d9 100644 --- a/external/ibm-public/postfix/dist/README_FILES/SOHO_README +++ b/external/ibm-public/postfix/dist/README_FILES/SOHO_README @@ -73,8 +73,8 @@ addresses by valid Internet addresses. This mapping happens ONLY when mail leaves the machine; not when you send mail between users on the same machine. The following example presents additional configuration. You need to combine -this with basic configuration information as discussed the first half of this -document. +this with basic configuration information as discussed in the first half of +this document. 1 /etc/postfix/main.cf: 2 smtp_generic_maps = hash:/etc/postfix/generic @@ -109,8 +109,8 @@ fantasy addresses, including mail to local fantasy addresses that don't have a valid Internet address of their own. The following example presents additional configuration. You need to combine -this with basic configuration information as discussed the first half of this -document. +this with basic configuration information as discussed in the first half of +this document. 1 /etc/postfix/main.cf: 2 myhostname = hostname.localdomain @@ -200,9 +200,9 @@ username/password information. standard "AUTH=mmeetthhoodd....." syntax in response to the EHLO command; this requires no additional Postfix client configuration. - * The Postfix SMTP client does not support the obsolete "wrappermode" - protocol, which uses TCP port 465 on the SMTP server. See TLS_README for a - solution that uses the stunnel command. + * With the setting "smtp_tls_wrappermode = yes", the Postfix SMTP client + supports the "wrappermode" protocol, which uses TCP port 465 on the SMTP + server (Postfix 3.0 and later). * With the smtp_sasl_password_maps parameter, we configure the Postfix SMTP client to send username and password information to the mail gateway @@ -276,13 +276,13 @@ final resort. single MySQL database, and configure different Postfix queries to extract the appropriate information. - * Specify dbm instead of hash if your system uses dbm files instead of db + * Specify ddbbmm instead of hhaasshh if your system uses ddbbmm files instead of ddbb files. To find out what lookup tables Postfix supports, use the command - "postconf -m". + "ppoossttccoonnff --mm". - * Execute the command "postmap /etc/postfix/sasl_passwd" whenever you change + * Execute the command "ppoossttmmaapp //eettcc//ppoossttffiixx//ssaassll__ppaasssswwdd" whenever you change the sasl_passwd table. - * Execute the command "postmap /etc/postfix/sender_relay" whenever you change + * Execute the command "ppoossttmmaapp //eettcc//ppoossttffiixx//sseennddeerr__rreellaayy" whenever you change the sender_relay table. diff --git a/external/ibm-public/postfix/dist/README_FILES/SQLITE_README b/external/ibm-public/postfix/dist/README_FILES/SQLITE_README index 324b305887d..7f668dea4df 100644 --- a/external/ibm-public/postfix/dist/README_FILES/SQLITE_README +++ b/external/ibm-public/postfix/dist/README_FILES/SQLITE_README @@ -26,6 +26,9 @@ For example: 'CCARGS=-DHAS_SQLITE -I/usr/local/include' \ 'AUXLIBS_SQLITE=-L/usr/local/lib -lsqlite3 -lpthread' +If your SQLite shared library is in a directory that the RUN-TIME linker does +not know about, add a "-Wl,-R,/path/to/directory" option after "-lsqlite3". + Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_SQLITE. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically- loaded SQLite database client, but only the new AUXLIBS_SQLITE variable @@ -62,12 +65,6 @@ dbpath = /some/path/to/sqlite_database # See sqlite_table(5) for details. query = SELECT forw_addr FROM mxaliases WHERE alias='%s' AND status='paid' -AAddddiittiioonnaall nnootteess - -The SQLite configuration interface setup allows for multiple sqlite databases: -you can use one for a virtual table, one for an access table, and one for an -aliases table if you want. - CCrreeddiittss SQLite support was added with Postfix version 2.8. diff --git a/external/ibm-public/postfix/dist/README_FILES/STANDARD_CONFIGURATION_README b/external/ibm-public/postfix/dist/README_FILES/STANDARD_CONFIGURATION_README index ceb18fce8a7..ca188fe2b0e 100644 --- a/external/ibm-public/postfix/dist/README_FILES/STANDARD_CONFIGURATION_README +++ b/external/ibm-public/postfix/dist/README_FILES/STANDARD_CONFIGURATION_README @@ -113,7 +113,7 @@ As usual, the examples show only parameters that are not left at their default settings. First we present the non-mailhost configuration, because it is the simpler one. -This machine sends mail as "user@example.com" and is final destination for +This machine sends mail as "user@example.com" and is the final destination for "user@hostname.example.com". 1 /etc/postfix/main.cf: @@ -135,8 +135,8 @@ Translation: below, "Postfix behind a firewall". Next we present the mailhost configuration. This machine sends mail as -"user@example.com" and is final destination for "user@hostname.example.com" as -well as "user@example.com". +"user@example.com" and is the final destination for "user@hostname.example.com" +as well as "user@example.com". 1 DNS: 2 example.com IN MX 10 mailhost.example.com. @@ -238,7 +238,7 @@ Translation: literals matching $inet_interfaces or $proxy_interfaces are deemed local. So "localpart@[a.d.d.r]" can be matched as simply "localpart" in canonical (5) and virtual(5). This avoids the need to specify firewall IP addresses - into Postfix configuration files. + in Postfix configuration files. The last part of the solution does the email forwarding, which is the real purpose of the firewall email function. @@ -348,8 +348,8 @@ Note: this example requires Postfix version 2.0 and later. To find out what Postfix version you have, execute the command "ppoossttccoonnff mmaaiill__vveerrssiioonn". The following example presents additional configuration. You need to combine -this with basic configuration information as discussed the first half of this -document. +this with basic configuration information as discussed in the first half of +this document. 1 /etc/postfix/main.cf: 2 transport_maps = hash:/etc/postfix/transport @@ -386,7 +386,8 @@ transport table. CCoonnffiigguurriinngg PPoossttffiixx aass pprriimmaarryy oorr bbaacckkuupp MMXX hhoosstt ffoorr aa rreemmoottee ssiittee This section presents additional configuration. You need to combine this with -basic configuration information as discussed the first half of this document. +basic configuration information as discussed in the first half of this +document. When your system is SECONDARY MX host for a remote site this is all you need: @@ -472,7 +473,8 @@ This section applies to dialup connections that are down most of the time. For dialup connections that are up 24x7, see the local area network section above. This section presents additional configuration. You need to combine this with -basic configuration information as discussed the first half of this document. +basic configuration information as discussed in the first half of this +document. If you do not have your own hostname and IP address (usually with dialup, cable TV or DSL connections) then you should also study the section on "Postfix on @@ -553,8 +555,8 @@ addresses by valid Internet addresses. This mapping happens ONLY when mail leaves the machine; not when you send mail between users on the same machine. The following example presents additional configuration. You need to combine -this with basic configuration information as discussed the first half of this -document. +this with basic configuration information as discussed in the first half of +this document. 1 /etc/postfix/main.cf: 2 smtp_generic_maps = hash:/etc/postfix/generic @@ -589,8 +591,8 @@ fantasy addresses, including mail to local fantasy addresses that don't have a valid Internet address of their own. The following example presents additional configuration. You need to combine -this with basic configuration information as discussed the first half of this -document. +this with basic configuration information as discussed in the first half of +this document. 1 /etc/postfix/main.cf: 2 myhostname = hostname.localdomain diff --git a/external/ibm-public/postfix/dist/README_FILES/STRESS_README b/external/ibm-public/postfix/dist/README_FILES/STRESS_README index bae6ad172a1..8edc148e400 100644 --- a/external/ibm-public/postfix/dist/README_FILES/STRESS_README +++ b/external/ibm-public/postfix/dist/README_FILES/STRESS_README @@ -259,7 +259,7 @@ to Postfix. maps. The Postfix SMTP server will reject mail and disconnect without waiting for the remote SMTP client to send a QUIT command. - * To hang up connections from blacklisted zombies, you can set specific + * To hang up connections from denylisted zombies, you can set specific Postfix SMTP server reject codes for specific RBLs, and for individual responses from specific RBLs. We'll use zen.spamhaus.org as an example; by the time you read this document, details may have changed. Right now, their @@ -410,7 +410,7 @@ OOtthheerr mmeeaassuurreess ttoo ooffff--llooaadd zzoom The postscreen(8) daemon, introduced with Postfix 2.8, provides additional protection against mail server overload. One postscreen(8) process handles -multiple inbound SMTP connections, and decides which clients may to talk to a +multiple inbound SMTP connections, and decides which clients may talk to a Postfix SMTP server process. By keeping spambots away, postscreen(8) leaves more SMTP server processes available for legitimate clients, and delays the onset of server overload conditions. diff --git a/external/ibm-public/postfix/dist/README_FILES/TLS_LEGACY_README b/external/ibm-public/postfix/dist/README_FILES/TLS_LEGACY_README index e9f36fdccd2..f4dae6b003f 100644 --- a/external/ibm-public/postfix/dist/README_FILES/TLS_LEGACY_README +++ b/external/ibm-public/postfix/dist/README_FILES/TLS_LEGACY_README @@ -5,7 +5,7 @@ PPoossttffiixx lleeggaaccyy TTLLSS SSuuppppoorrtt NNOOTTEE This document describes an old TLS user interface that is based on a third- -party TLS patch by Lutz Jänicke. As of Postfix version 2.3, the old user +party TLS patch by Lutz Ja"nicke. As of Postfix version 2.3, the old user interface still exists to allow migration from earlier Postfix releases, but its functionality is frozen. @@ -51,7 +51,7 @@ programs. Other colored boxes represent storage elements. <---seed--- ---seed---> Network-> smtpd(8) tlsmgr(8) smtp(8) ->Network - <-session-> <-session-> + <-session-> <-session-> / | \ | @@ -126,7 +126,7 @@ SSeerrvveerr--ssiiddee cceerrttiiffiiccaattee aanndd p In order to use TLS, the Postfix SMTP server needs a certificate and a private key. Both must be in "pem" format. The private key must not be encrypted, -meaning: the key must be accessible without password. Both certificate and +meaning: the key must be accessible without a password. Both certificate and private key may be in the same file. Both RSA and DSA certificates are supported. Typically you will only have RSA @@ -147,7 +147,7 @@ with: % ccaatt sseerrvveerr__cceerrtt..ppeemm iinntteerrmmeeddiiaattee__CCAA..ppeemm >> sseerrvveerr..ppeemm -A Postfix SMTP server certificate supplied here must be usable as SSL server +A Postfix SMTP server certificate supplied here must be usable as an SSL server certificate and hence pass the "openssl verify -purpose sslserver ..." test. A client that trusts the root CA has a local copy of the root CA certificate, @@ -410,8 +410,8 @@ server access control: The permit_tls_all_clientcerts feature must be used with caution, because it can result in too many access permissions. Use this feature only if a special -CA issues the client certificates, and only if this CA is listed as trusted CA. -If other CAs are trusted, any owner of a valid client certificate would be +CA issues the client certificates, and only if this CA is listed as a trusted +CA. If other CAs are trusted, any owner of a valid client certificate would be authorized. The permit_tls_all_clientcerts feature can be practical for a specially created email relay server. @@ -447,9 +447,9 @@ Example: SSeerrvveerr--ssiiddee cciipphheerr ccoonnttrroollss To influence the Postfix SMTP server cipher selection scheme, you can give -cipherlist string. A detailed description would go to far here; please refer to -the OpenSSL documentation. If you don't know what to do with it, simply don't -touch it and leave the (openssl-)compiled in default! +cipherlist string. A detailed description would go too far here; please refer +to the OpenSSL documentation. If you don't know what to do with it, simply +don't touch it and leave the (openssl-)compiled in default! DO NOT USE " to enclose the string, specify just the string!!! @@ -520,8 +520,8 @@ time, in which case the cipher used determines which certificate is presented. It is possible for the Postfix SMTP client to use the same key/certificate pair as the Postfix SMTP server. If a certificate is to be presented, it must be in "pem" format. The private key must not be encrypted, meaning: it must be -accessible without password. Both parts (certificate and private key) may be in -the same file. +accessible without a password. Both parts (certificate and private key) may be +in the same file. In order for remote SMTP servers to verify the Postfix SMTP client certificates, the CA certificate (in case of a certificate chain, all CA @@ -534,7 +534,7 @@ with: % ccaatt cclliieenntt__cceerrtt..ppeemm iinntteerrmmeeddiiaattee__CCAA..ppeemm >> cclliieenntt..ppeemm -A Postfix SMTP client certificate supplied here must be usable as SSL client +A Postfix SMTP client certificate supplied here must be usable as an SSL client certificate and hence pass the "openssl verify -purpose sslclient ..." test. A server that trusts the root CA has a local copy of the root CA certificate, @@ -780,9 +780,9 @@ summarized as follows: "smtp_use_tls = yes". * When both hostname and next-hop destination lookups produce a result, the - more specific per-site policy (NONE, MUST, etc) overrides the less specific - one (MAY), and the more secure per-site policy (MUST, etc) overrides the - less secure one (NONE). + more specific per-site policy (NONE, MUST, etc.) overrides the less + specific one (MAY), and the more secure per-site policy (MUST, etc.) + overrides the less secure one (NONE). * After the per-site policy lookups are combined, the result generally overrides the global policy. The exception is the less specific MMAAYY per- @@ -827,7 +827,7 @@ Example: example.org NONE # TLS should not be used with the host smtp.example.com. - smtp.example.com NONE + [smtp.example.com] NONE DDiissccoovveerriinngg sseerrvveerrss tthhaatt ssuuppppoorrtt TTLLSS @@ -862,9 +862,9 @@ Example: CClliieenntt--ssiiddee cciipphheerr ccoonnttrroollss To influence the Postfix SMTP client cipher selection scheme, you can give -cipherlist string. A detailed description would go to far here; please refer to -the OpenSSL documentation. If you don't know what to do with it, simply don't -touch it and leave the (openssl-)compiled in default! +cipherlist string. A detailed description would go too far here; please refer +to the OpenSSL documentation. If you don't know what to do with it, simply +don't touch it and leave the (openssl-)compiled in default! DO NOT USE " to enclose the string, specify just the string!!! @@ -1071,10 +1071,10 @@ Please differentiate when possible between: * Problems in the TLS code: <postfix_tls@aet.tu-cottbus.de> * Problems in vanilla Postfix: <postfix-users@postfix.org> -CCoommppaattiibbiilliittyy wwiitthh PPoossttffiixx <<22..22 TTLLSS ssuuppppoorrtt +CCoommppaattiibbiilliittyy wwiitthh PPoossttffiixx << 22..22 TTLLSS ssuuppppoorrtt Postfix version 2.2 TLS support is based on the Postfix/TLS patch by Lutz -Jänicke, but differs in a few minor ways. +Ja"nicke, but differs in a few minor ways. * main.cf: Specify "btree" instead of "sdbm" for TLS session cache databases. @@ -1109,8 +1109,8 @@ support cycle. CCrreeddiittss - * TLS support for Postfix was originally developed by Lutz Jänicke at Cottbus - Technical University. + * TLS support for Postfix was originally developed by Lutz Ja"nicke at + Cottbus Technical University. * Wietse Venema adopted the code, did some restructuring, and compiled this part of the documentation from Lutz's documents. * Victor Duchovni was instrumental with the re-implementation of the diff --git a/external/ibm-public/postfix/dist/README_FILES/TUNING_README b/external/ibm-public/postfix/dist/README_FILES/TUNING_README index c1176617a89..10801646c9a 100644 --- a/external/ibm-public/postfix/dist/README_FILES/TUNING_README +++ b/external/ibm-public/postfix/dist/README_FILES/TUNING_README @@ -285,9 +285,8 @@ than the default 20) simultaneous connections, especially if the gateway forwards to multiple MX hosts. When all MX hosts are up and accepting connections in a timely fashion, throughput will be high. If any MX host is down and completely unresponsive, the average connection latency rises to at -least 1/N * $smtp_connection_timeout, if there are N MX hosts. This limits -throughput to at most the destination concurrency * N / -$smtp_connection_timeout. +least 1/N * $smtp_connect_timeout, if there are N MX hosts. This limits +throughput to at most the destination concurrency * N / $smtp_connect_timeout. For example, with a destination concurrency of 100 and 2 MX hosts, each host will handle up to 50 simultaneous connections. If one MX host is down and the @@ -298,10 +297,10 @@ low as 5s or even 1s can be used to prevent congestion when one or more, but not all MX hosts are down. If necessary, set a higher transport_destination_concurrency_limit (in main.cf -since this is a queue manager parameter) and a lower smtp_connection_timeout -(with a "-o" override in master.cf since this parameter has no per-transport -name) for the relay transport and any transports dedicated for specific high -volume destinations. +since this is a queue manager parameter) and a lower smtp_connect_timeout (with +a "-o" override in master.cf since this parameter has no per-transport name) +for the relay transport and any transports dedicated for specific high volume +destinations. TTuunniinngg tthhee nnuummbbeerr ooff rreecciippiieennttss ppeerr ddeelliivveerryy diff --git a/external/ibm-public/postfix/dist/README_FILES/VIRTUAL_README b/external/ibm-public/postfix/dist/README_FILES/VIRTUAL_README index 6f470eeb79e..e693a0ceb29 100644 --- a/external/ibm-public/postfix/dist/README_FILES/VIRTUAL_README +++ b/external/ibm-public/postfix/dist/README_FILES/VIRTUAL_README @@ -27,14 +27,14 @@ The following topics are covered: CCaannoonniiccaall vveerrssuuss hhoosstteedd vveerrssuuss ootthheerr ddoommaaiinnss -Most Postfix systems are ffiinnaall ddeessttiinnaattiioonn for only a few domain names. These -include the hostnames and [the IP addresses] of the machine that Postfix runs -on, and sometimes also include the parent domain of the hostname. The remainder -of this document will refer to these domains as the canonical domains. They are -usually implemented with the Postfix local domain address class, as defined in -the ADDRESS_CLASS_README file. - -Besides the canonical domains, Postfix can be configured to be ffiinnaall +Most Postfix systems are the ffiinnaall ddeessttiinnaattiioonn for only a few domain names. +These include the hostnames and [the IP addresses] of the machine that Postfix +runs on, and sometimes also include the parent domain of the hostname. The +remainder of this document will refer to these domains as the canonical +domains. They are usually implemented with the Postfix local domain address +class, as defined in the ADDRESS_CLASS_README file. + +Besides the canonical domains, Postfix can be configured to be the ffiinnaall ddeessttiinnaattiioonn for any number of additional domains. These domains are called hosted, because they are not directly associated with the name of the machine itself. Hosted domains are usually implemented with the virtual alias domain @@ -49,8 +49,8 @@ implemented with the relay domain address class, as defined in the ADDRESS_CLASS_README file. Finally, Postfix can be configured as a transit host for sending mail across -the internet. Obviously, Postfix is not final destination for such mail. This -function is available only for authorized clients and/or users, and is +the internet. Obviously, Postfix is not the final destination for such mail. +This function is available only for authorized clients and/or users, and is implemented by the default domain address class, as defined in the ADDRESS_CLASS_README file. diff --git a/external/ibm-public/postfix/dist/RELEASE_NOTES b/external/ibm-public/postfix/dist/RELEASE_NOTES index c121e7f014c..167b87b33bc 100644 --- a/external/ibm-public/postfix/dist/RELEASE_NOTES +++ b/external/ibm-public/postfix/dist/RELEASE_NOTES @@ -1,19 +1,19 @@ -This is the Postfix 3.5 (stable) release. +This is the Postfix 3.7 (stable) release. -The stable Postfix release is called postfix-3.5.x where 3=major -release number, 5=minor release number, x=patchlevel. The stable +The stable Postfix release is called postfix-3.7.x where 3=major +release number, 7=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called -postfix-3.6-yyyymmdd where yyyymmdd is the release date (yyyy=year, +postfix-3.8-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. -If you upgrade from Postfix 3.3 or earlier, read RELEASE_NOTES-3.4 +If you upgrade from Postfix 3.5 or earlier, read RELEASE_NOTES-3.6 before proceeding. License change @@ -25,141 +25,175 @@ more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. -libc-musl workaround for Postfix 3.2.15, 3.3.10, 3.4.12, and 3.5.2 ------------------------------------------------------------------- +Bugfix for messages not delivered after "warning: Unexpected record type 'X' +============================================================================ -Security: this release disables DANE support on Linux systems with -libc-musl, because libc-musl provides no indication whether DNS -responses are authentic. This broke DANE support without a clear -explanation. +Due to a bug introduced in Postfix 3.7.0, a message could falsely +be flagged as corrupt with "warning: Unexpected record type 'X'". -Major changes - multiple relayhost in SMTP ------------------------------------------- +Such messages were moved to the "corrupt" queue directory, where +they may still be found. See below for instructions to deal with +these falsely flagged messages. -[Feature 20200111] the Postfix SMTP and LMTP client support a list -of nexthop destinations separated by comma or whitespace. These -destinations will be tried in the specified order. +This could happen for messages with 5000 or more recipients, or +with fewer recipients on a busy mail server. The problem was first +reported by Frank Brendel, reproduced by John Alex. -The list form can be specified in relayhost, transport_maps, -default_transport, and sender_dependent_default_transport_maps. +A file in the "corrupt" queue directory may be inspected with the +command "postcat /var/spool/postfix/corrupt/<filename>. If delivery +of the file is still desired, the file can be moved back to +/var/spool/postfix/incoming after updating Postfix and executing +"postfix reload". -Examples: -/etc/postfix/main.cf: - relayhost = foo.example, bar.example - default_transport = smtp:foo.example, bar.example. - -NOTE: this is an SMTP and LMTP client feature. It does not work for -other Postfix delivery agents. +Major changes - configuration +----------------------------- -Major changes - certificate access ----------------------------------- +[Feature 20210605] Support to inline the content of small cidr:, +pcre:, and regexp: tables in Postfix parameter values. -[Feature 20190517] Search order support for check_ccert_access. -Search order support for other tables is in design (canonical_maps, -virtual_alias_maps, transport_maps, etc.). +Example: -The following check_ccert_access setting uses the built-in search -order: it first looks up the client certificate fingerprint, then -the client certificate public-key fingerprint, and it stops when a -decision is made. + smtpd_forbidden_commands = + CONNECT GET POST regexp:{{/^[^A-Z]/ Thrash}} -/etc/postfix/main.cf: - smtpd_mumble_restrictions = - ... - check_ccert_access hash:/etc/postfix/ccert-access - ... +This is the new smtpd_forbidden_commands default value. It will +immediately disconnect a remote SMTP client when a command does not +start with a letter (a-z or A-Z). -The following setting, with explicit search order, produces the -exact same result: +The basic syntax is: /etc/postfix/main.cf: - smtpd_mumble_restrictions = - ... - check_ccert_access { - hash:/etc/postfix/ccert-access { - search_order = cert_fingerprint, pubkey_fingerprint } } - ... - -Support is planned for other certificate features. - -Major changes - dovecot usability ---------------------------------- - -[Feature 20190615] The SMTP+LMTP delivery agent can now prepend -Delivered-To, X-Original-To and Return-Path headers, just like the -pipe(8) and local(8) delivery agents. - -This uses the "flags=DORX" command-line flags in master.cf. See the -smtp(8) manpage for details. - -This obsoletes the "lmtp_assume_final = yes" setting, and replaces -it with "flags=...X...", for consistency with the pipe(8) delivery -agent. + parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. -Major changes - forced expiration ---------------------------------- +/etc/postfix/master.cf: + .. -o { parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. } .. -[Feature 20200202] Support to force-expire email messages. This -introduces new postsuper(1) command-line options to request expiration, -and additional information in mailq(1) or postqueue(1) output. +where map-type is one of cidr, pcre, or regexp. -The forced-to-expire status is stored in a queue file attribute. -An expired message is returned to the sender when the queue manager -attempts to deliver that message (note that Postfix will never -deliver messages in the hold queue). +Postfix ignores whitespace after '{' and before '}', and writes each +rule as one text line to a nameless in-memory file: -The postsuper(1) -e and -f options both set the forced-to-expire -queue file attribute. The difference is that -f will also release -a message if it is in the hold queue. With -e, such a message would -not be returned to the sender until it is released with -f or -H. +in-memory file: + rule-1 + rule-2 + .. -In the mailq(1) or postqueue(1) -p output, a forced-to-expire message -is indicated with # after the queue file name. In postqueue(1) JSON -output, there is a new per-message field "forced_expire" (with value -true or false) that shows the forced-to-expire status. +Postfix parses the result as if it is a file in /etc/postfix. -Major changes - haproxy2 protocol ---------------------------------- +Note: if a rule contains $, specify $$ to keep Postfix from trying +to do $name expansion as it evaluates the parameter value. -[Feature 20200112] Support for the haproxy v2 protocol. The Postfix -implementation supports TCP over IPv4 and IPv6, as well as non-proxied -connections; the latter are typically used for heartbeat tests. +Major changes - lmdb support +---------------------------- -The haproxy v2 protocol introduces no additional Postfix configuration. -The Postfix smtpd(8) and postscreen(8) daemons accept both v1 and -v2 protocol versions. +[Feature 20210605] Overhauled the LMDB client's error handling, and +added integration tests for future-proofing. There are no visible +changes in documented behavior. Major changes - logging ----------------------- -[Incompat 20191109] Postfix daemon processes now log the from= and -to= addresses in external (quoted) form in non-debug logging (info, -warning, etc.). This means that when an address localpart contains -spaces or other special characters, the localpart will be quoted, -for example: - - from=<"name with spaces"@example.com> - -Older Postfix versions would log the internal (unquoted) form: - - from=<name with spaces@example.com> - -The external and internal forms are identical for the vast majority -of email addresses that contain no spaces or other special characters -in the localpart. - -Specify "info_log_address_format = internal" for backwards -compatibility. - -The logging in external form is consistent with the address form -that Postfix 3.2 and later prefer for table lookups. It is therefore -the more useful form for non-debug logging. - -Major changes - IP address normalization ----------------------------------------- +[Feature 20210815] To make the maillog_file feature more useful, +the postlog(1) command is now set-gid postdrop, so that unprivileged +programs can use it to write logging through the postlogd(8) daemon. +This required hardening the postlog(1) command against privilege +escalation attacks. DO NOT turn on the set-gid bit with older +postlog(1) implementations. + +Major changes - pcre2 support +----------------------------- + +[Feature 20211127] Support for the pcre2 library (the legacy pcre +library is no longer maintained). The Postfix build procedure +automatically detects if the pcre2 library is installed, and if it +is unavailable, the Postfix build procedure will detect if the +legacy pcre library is installed. See PCRE_README if you need to +build Postfix with a specific library. + +Visible differences: some error messages may have a different text, +and the 'X' pattern flag is no longer supported with pcre2. + +Major changes - security +------------------------ + +[Feature 20220102] Postfix programs now randomize the initial state +of in-memory hash tables, to defend against hash collision attacks +involving a large number of attacker-chosen lookup keys. Presently, +the only known opportunity for such attacks involves remote SMTP +client IPv6 addresses in the anvil(8) service. The attack would +require making hundreds of short-lived connections per second from +thousands of different IP addresses, because the anvil(8) service +drops inactive counters after 100s. Other in-memory hash tables +with attacker-chosen lookup keys are by design limited in size. The +fix is cheap, and therefore implemented for all Postfix in-memory +hash tables. Problem reported by Pascal Junod. + +[Feature 20211030] The postqueue command now sanitizes non-printable +characters (such as newlines) in strings before they are formatted +as json or as legacy output. These outputs are piped into other +programs that are run by administrative users. This closes a +hypothetical opportunity for privilege escalation. + +[Feature 20210815] Updated defense against remote clients or servers +that 'trickle' SMTP or LMTP traffic, based on per-request deadlines +and minimum data rates. + +Per-request deadlines: + +The new {smtpd,smtp,lmtp}_per_request_deadline parameters replace +{smtpd,smtp,lmtp}_per_record_deadline, with backwards compatible +default settings. This defense is enabled by default in the Postfix +SMTP server in case of overload. + +The new smtpd_per_record_deadline parameter limits the combined +time for the Postfix SMTP server to receive a request and to send +a response, while the new {smtp,lmtp}_per_record_deadline parameters +limit the combined time for the Postfix SMTP or LMTP client to send +a request and to receive a response. + +Minimum data rates: + +The new smtpd_min_data_rate parameter enforces a minimum plaintext +data transfer rate for DATA and BDAT requests, but only when +smtpd_per_record_deadline is enabled. After a read operation transfers +N plaintext bytes (possibly after TLS decryption), and after the +DATA or BDAT request deadline is decreased by the elapsed time of +that read operation, the DATA or BDAT request deadline is increased +by N/smtpd_min_data_rate seconds. However, the deadline is never +increased beyond the smtpd_timeout value. The default minimum data +rate is 500 (bytes/second) but is still subject to change. + +The new {smtp,lmtp}_min_data_rate parameters enforce the corresponding +minimum DATA transfer rates for the Postfix SMTP and LMTP client. + +Major changes - tls support +--------------------------- + +[Cleanup 20220121] The new tlsproxy_client_security_level parameter +replaces tlsproxy_client_level, and the new tlsproxy_client_policy_maps +parameter replaces tlsproxy_client_policy. This is for consistent +parameter naming (tlsproxy_client_xxx corresponds to smtp_tls_xxx). +This change was made with backwards-compatible default settings. + +[Feature 20210926] Postfix was updated to support OpenSSL 3.0.0 API +features, and to work around OpenSSL 3.0.0 bit-rot (avoid using +deprecated API features). + +Other code health +----------------- + +[typos] Typo fixes by raf. + +[pre-release checks] Added pre-release checks to detect a) new typos +in documentation and source-code comments, b) missing entries in +the postfix-files file (some documentation would not be installed), +c) missing rules in the postlink script (some text would not have +a hyperlink in documentation), and d) missing map-based $parameter +names in the proxy_read_maps default value (the proxymap daemon +would not automatically authorize some proxied maps). + +[memory stream] Improved support for memory-based streams made it +possible to inline small cidr:, pcre:, and regexp: maps in Postfix +parameter values, and to eliminate some ad-hoc code that converted +tlsproxy(8) protocol data to or from serialized form. -[Incompat 20190427] Postfix now normalizes IP addresses received -with XCLIENT, XFORWARD, or with the HaProxy protocol, for consistency -with direct connections to Postfix. This may change the appearance -of logging, and the way that check_client_access will match subnets -of an IPv6 address. diff --git a/external/ibm-public/postfix/dist/RELEASE_NOTES-3.5 b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.5 new file mode 100644 index 00000000000..d3c41b83bae --- /dev/null +++ b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.5 @@ -0,0 +1,157 @@ +This is the Postfix 3.5 (stable) release. + +The stable Postfix release is called postfix-3.5.x where 3=major +release number, 5=minor release number, x=patchlevel. The stable +release never changes except for patches that address bugs or +emergencies. Patches change the patchlevel and the release date. + +New features are developed in snapshot releases. These are called +postfix-3.6-yyyymmdd where yyyymmdd is the release date (yyyy=year, +mm=month, dd=day). Patches are never issued for snapshot releases; +instead, a new snapshot is released. + +The mail_release_date configuration parameter (format: yyyymmdd) +specifies the release date of a stable release or snapshot release. + +If you upgrade from Postfix 3.3 or earlier, read RELEASE_NOTES-3.4 +before proceeding. + +License change +--------------- + +This software is distributed with a dual license: in addition to the +historical IBM Public License 1.0, it is now also distributed with the +more recent Eclipse Public License 2.0. Recipients can choose to take +the software under the license of their choice. Those who are more +comfortable with the IPL can continue with that license. + +Major changes - multiple relayhost in SMTP +------------------------------------------ + +[Feature 20200111] the Postfix SMTP and LMTP client support a list +of nexthop destinations separated by comma or whitespace. These +destinations will be tried in the specified order. + +The list form can be specified in relayhost, transport_maps, +default_transport, and sender_dependent_default_transport_maps. + +Examples: +/etc/postfix/main.cf: + relayhost = foo.example, bar.example + default_transport = smtp:foo.example, bar.example. + +NOTE: this is an SMTP and LMTP client feature. It does not work for +other Postfix delivery agents. + +Major changes - certificate access +---------------------------------- + +[Feature 20190517] Search order support for check_ccert_access. +Search order support for other tables is in design (canonical_maps, +virtual_alias_maps, transport_maps, etc.). + +The following check_ccert_access setting uses the built-in search +order: it first looks up the client certificate fingerprint, then +the client certificate public-key fingerprint, and it stops when a +decision is made. + +/etc/postfix/main.cf: + smtpd_mumble_restrictions = + ... + check_ccert_access hash:/etc/postfix/ccert-access + ... + +The following setting, with explicit search order, produces the +exact same result: + +/etc/postfix/main.cf: + smtpd_mumble_restrictions = + ... + check_ccert_access { + hash:/etc/postfix/ccert-access { + search_order = cert_fingerprint, pubkey_fingerprint } } + ... + +Support is planned for other certificate features. + +Major changes - dovecot usability +--------------------------------- + +[Feature 20190615] The SMTP+LMTP delivery agent can now prepend +Delivered-To, X-Original-To and Return-Path headers, just like the +pipe(8) and local(8) delivery agents. + +This uses the "flags=DORX" command-line flags in master.cf. See the +smtp(8) manpage for details. + +This obsoletes the "lmtp_assume_final = yes" setting, and replaces +it with "flags=...X...", for consistency with the pipe(8) delivery +agent. + +Major changes - forced expiration +--------------------------------- + +[Feature 20200202] Support to force-expire email messages. This +introduces new postsuper(1) command-line options to request expiration, +and additional information in mailq(1) or postqueue(1) output. + +The forced-to-expire status is stored in a queue file attribute. +An expired message is returned to the sender when the queue manager +attempts to deliver that message (note that Postfix will never +deliver messages in the hold queue). + +The postsuper(1) -e and -f options both set the forced-to-expire +queue file attribute. The difference is that -f will also release +a message if it is in the hold queue. With -e, such a message would +not be returned to the sender until it is released with -f or -H. + +In the mailq(1) or postqueue(1) -p output, a forced-to-expire message +is indicated with # after the queue file name. In postqueue(1) JSON +output, there is a new per-message field "forced_expire" (with value +true or false) that shows the forced-to-expire status. + +Major changes - haproxy2 protocol +--------------------------------- + +[Feature 20200112] Support for the haproxy v2 protocol. The Postfix +implementation supports TCP over IPv4 and IPv6, as well as non-proxied +connections; the latter are typically used for heartbeat tests. + +The haproxy v2 protocol introduces no additional Postfix configuration. +The Postfix smtpd(8) and postscreen(8) daemons accept both v1 and +v2 protocol versions. + +Major changes - logging +----------------------- + +[Incompat 20191109] Postfix daemon processes now log the from= and +to= addresses in external (quoted) form in non-debug logging (info, +warning, etc.). This means that when an address localpart contains +spaces or other special characters, the localpart will be quoted, +for example: + + from=<"name with spaces"@example.com> + +Older Postfix versions would log the internal (unquoted) form: + + from=<name with spaces@example.com> + +The external and internal forms are identical for the vast majority +of email addresses that contain no spaces or other special characters +in the localpart. + +Specify "info_log_address_format = internal" for backwards +compatibility. + +The logging in external form is consistent with the address form +that Postfix 3.2 and later prefer for table lookups. It is therefore +the more useful form for non-debug logging. + +Major changes - IP address normalization +---------------------------------------- + +[Incompat 20190427] Postfix now normalizes IP addresses received +with XCLIENT, XFORWARD, or with the HaProxy protocol, for consistency +with direct connections to Postfix. This may change the appearance +of logging, and the way that check_client_access will match subnets +of an IPv6 address. diff --git a/external/ibm-public/postfix/dist/RELEASE_NOTES-3.6 b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.6 new file mode 100644 index 00000000000..d8ac90cc715 --- /dev/null +++ b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.6 @@ -0,0 +1,277 @@ +This is the Postfix 3.6 (stable) release. + +The stable Postfix release is called postfix-3.6.x where 3=major +release number, 6=minor release number, x=patchlevel. The stable +release never changes except for patches that address bugs or +emergencies. Patches change the patchlevel and the release date. + +New features are developed in snapshot releases. These are called +postfix-3.7-yyyymmdd where yyyymmdd is the release date (yyyy=year, +mm=month, dd=day). Patches are never issued for snapshot releases; +instead, a new snapshot is released. + +The mail_release_date configuration parameter (format: yyyymmdd) +specifies the release date of a stable release or snapshot release. + +If you upgrade from Postfix 3.4 or earlier, read RELEASE_NOTES-3.5 +before proceeding. + +License change +--------------- + +This software is distributed with a dual license: in addition to the +historical IBM Public License 1.0, it is now also distributed with the +more recent Eclipse Public License 2.0. Recipients can choose to take +the software under the license of their choice. Those who are more +comfortable with the IPL can continue with that license. + +Major changes - internal protocol identification +------------------------------------------------ + +[Incompat 20200920] Internal protocols have changed. You need to +"postfix stop" before updating, or before backing out to an earlier +release, otherwise long-running daemons (pickup, qmgr, verify, tlsproxy, +postscreen) may fail to communicate with the rest of Postfix, causing +mail delivery delays until Postfix is restarted. + +This change does not affect message files in Postfix queue directories, +only the communication between running Postfix programs. + +With this change, every Postfix internal service, including the postdrop +command, announces the name of its protocol before doing any other I/O. +Every Postfix client program, including the Postfix sendmail command, +will verify that the protocol name matches what it is supposed to be. + +The purpose of this change is to produce better error messages, for +example, when someone configures the discard daemon as a bounce +service in master.cf, or vice versa. + +This change may break third-party programs that implement a +Postfix-internal protocol such as qpsmtpd. Such programs have never +been supported. Fortunately, this will be an easy fix: look at the +first data from the cleanup daemon: if it is a protocol announcement, +you're talking to Postfix 3.6 or later. That's the only real change. + +Major changes - tls +------------------- + +[Incompat 20200705] The minimum supported OpenSSL version is 1.1.1, +which will reach the end of life by 2023-09-11. Postfix 3.6 is +expected to reach the end of support in 2025. Until then, Postfix +will be updated as needed for compatibility with OpenSSL. + +The default fingerprint digest has changed from md5 to sha256 (Postfix +3.6 with compatibility_level >= 3.6). With a lower compatibility_level +setting, Postfix defaults to using md5, and logs a warning when a Postfix +configuration specifies no explicit digest type. + +Export-grade Diffie-Hellman key exchange is no longer supported, +and the tlsproxy_tls_dh512_param_file parameter is ignored, + +[Feature 20200906] The tlstype.pl helper script by Viktor Dukhovni +reports TLS information per message delivery. This processes output +from the collate.pl script. See auxiliary/collate/README.tlstype and +auxiliary/collate/tlstype.pl. + +Major changes - compatibility level +----------------------------------- + +[Feature 20210109] Starting with Postfix version 3.6, the compatibility +level is "3.6". In future Postfix releases, the compatibility level will +be the Postfix version that introduced the last incompatible change. The +level is formatted as 'major.minor.patch', where 'patch' is usually +omitted and defaults to zero. Earlier compatibility levels are 0, 1 and 2. + +This also introduces main.cf and master.cf support for the <=level, +<level, and other operators to compare compatibility levels. With the +standard <=, <, etc. operators, compatibility level 3.10 would be less +than 3.9, which is undesirable. + +Major changes - services(5) override +------------------------------------ + +[Feature 20210418] Postfix no longer uses the services(5) database +to look up the TCP ports for SMTP and LMTP services. Instead, this +information is configured with the new known_tcp_ports configuration +parameter (default: lmtp=24, smtp=25, smtps=submissions=465, +submission=587). When a service is not specified in known_tcp_ports, +Postfix will still query the services(5) database. + +Major changes - local_login_sender_maps +--------------------------------------- + +[Feature 20201025] Fine-grained control over the envelope sender address +for submission with the Postfix sendmail (or postdrop) commands. + +The local_login_sender_maps parameter (default: static:*) specifies +a list of lookup tables that are searched by the UNIX login name, and +that return a list of allowed envelope sender patterns separated by +space or comma. The default is backwards-compatible: every user may +specify any sender envelope address. + +This feature is enforced by the postdrop command. When no UNIX login +name is available, the postdrop command will prepend "uid:" to the +numerical UID and use that instead. + +This feature ignores address extensions in the user-specified +envelope sender address. + +Besides the special pattern "*" which allows any sender address, +there are "<>" which matches an empty sender address, and the +"@domain" wildcard pattern. More information about those can be found +in the postconf(5) manpage. + +Example: + +/etc/postfix/main.cf: + # Allow root and postfix full control, anyone else can only + # send mail as themselves. Use "uid:" followed by the numerical + # UID when the UID has no entry in the UNIX password file. + local_login_sender_maps = + inline:{ { root = *}, { postfix = * } }, + pcre:/etc/postfix/login_senders + +/etc/postfix/login_senders: + # Allow both the bare username and the user@domain forms. + /(.+)/ $1 $1@example.com + +Major changes - order of relay and recipient restrictions +--------------------------------------------------------- + +[Incompat 20210131] With smtpd_relay_before_recipient_restrictions=yes, +the Postfix SMTP server will evaluate smtpd_relay_restrictions before +smtpd_recipient_restrictions. This is the default behavior with +compatibility_level >= 3.6. + +This change makes the implemented behavior consistent with existing +documentation. There is a backwards-compatibility warning that allows +users to freeze historical behavior. See COMPATIBILITY_README for +details. + +Major changes - respectful logging +---------------------------------- + +[Feature 20210220] Postfix version 3.6 deprecates terminology +that implies white is better than black. Instead, Postfix prefers +'allowlist', 'denylist', and variations on those words. This change +affects Postfix documentation, and postscreen parameters and logging. + +To keep the old postscreen logging set "respectful_logging = no" +in main.cf. + +Noel Jones assisted with the initial transition. + +Changes in documentation +------------------------ + +Postfix documentation was updated to use 'allowlist', 'denylist', etc. +These documentation changes do not affect Postfix behavior. + +Changes in parameter names +-------------------------- + +The following postscreen parameters replace names that contain 'blacklist' +or 'whitelist': + + postscreen_allowlist_interfaces + postscreen_denylist_action + postscreen_dnsbl_allowlist_threshold + +These new parameters have backwards-compatible default settings +that support the old parameter names, so that the name change should +not affect Postfix behavior. This means that existing management tools +that use the old parameter names should keep working as before. + +This compatibility safety net may break when some management tools +use the new parameter names, and some use the old names, such that +different tools will disagree on how Postfix works. + +Changes in logging +------------------ + +The following logging replaces forms that contain 'blacklist' or +'whitelist': + + postfix/postscreen[pid]: ALLOWLIST VETO [address]:port + postfix/postscreen[pid]: ALLOWLISTED [address]:port + postfix/postscreen[pid]: DENYLISTED [address]:port + +To avoid breaking logfile analysis tools, Postfix keeps logging the old +forms by default, as long as the compatibility_level parameter setting +is less than 3.6, and the respectful_logging parameter is not explicitly +configured. As a reminder, Postfix will log the following: + + postfix/postscreen[pid]: Using backwards-compatible default setting + respectful_logging=no for client [address]:port + +To keep logging the old form, make the setting "respectful_logging = +no" permanent in main.cf, for example: + + # postconf "respectful_logging = no" + # postfix reload + +To stop the reminder, configure the respectful_logging parameter to +"yes" or "no", or configure "compatibility_level = 3.6". + +Major changes - threaded bounces +-------------------------------- + +[Feature 20201205] Support for threaded bounces. This allows mail +readers to present a non-delivery, delayed delivery, or successful +delivery notification in the same email thread as the original +message. + +Unfortunately, this also makes it easy for users to mistakenly delete +the whole email thread (all related messages), instead of deleting +only the delivery status notification. + +To enable, specify "enable_threaded_bounces = yes". + +Other changes - smtpd_sasl_mechanism_list +----------------------------------------- + +[Feature 20200906] The smtpd_sasl_mechanism_list parameter (default: +!external, static:rest) prevents confusing errors when a SASL backend +announces EXTERNAL support which Postfix does not support. + +Other changes - delivery logging +-------------------------------- + +[Incompat 20200531] Postfix delivery agents now log an explicit record +when delegating delivery to a different Postfix delivery agent. + +For example, with "best_mx_transport = local", an SMTP delivery +agent will now log when a recipient will be delivered locally. This +makes the delegating delivery agent visible, where it would otherwise +have remained invisible, which would complicate troubleshooting. + + postfix/smtp[pid]: queueid: passing <recipient> to transport=local + +This will usually be followed by logging for an actual delivery: + + postfix/local[pid]: queueid: to=<recipient>, relay=local, ... + +Other examples: the local delivery agent will log a record that it +defers mailbox delivery through mailbox_transport or through +fallback_transport. + +Other changes - error logging +----------------------------- + +[Incompat 20200531] Postfix programs will now log "Application error" +instead of "Success" or "Unknown error: 0" when an operation fails with +errno == 0, i.e., the error originates from non-kernel code. + +Other changes - dns lookups +--------------------------- + +[Feature 20200509] The threadsafe resolver API (res_nxxx() calls) +is now the default, not because the API is threadsafe, but because +this is the API where new features are being added. + +To build old style, build with: + + make makefiles CCARGS="-DNO_RES_NCALLS..." + +This is the default for systems that are known not to support the +threadsafe resolver API. diff --git a/external/ibm-public/postfix/dist/TLS_ACKNOWLEDGEMENTS b/external/ibm-public/postfix/dist/TLS_ACKNOWLEDGEMENTS index 93c93d5b2a4..6cf4354486c 100644 --- a/external/ibm-public/postfix/dist/TLS_ACKNOWLEDGEMENTS +++ b/external/ibm-public/postfix/dist/TLS_ACKNOWLEDGEMENTS @@ -1,5 +1,5 @@ - Walcir Fontanini <walcir@densis.fee.unicamp.br> - * tested on Solaris 2.5 and and reported missing "snprintf()" + * tested on Solaris 2.5 and reported missing "snprintf()" -> was fixed in pfixtls-0.1.2 * contributed the script to add fingerprints contributed/fp.csh diff --git a/external/ibm-public/postfix/dist/TLS_CHANGES b/external/ibm-public/postfix/dist/TLS_CHANGES index 62a529e6a84..1abe0ff15b7 100644 --- a/external/ibm-public/postfix/dist/TLS_CHANGES +++ b/external/ibm-public/postfix/dist/TLS_CHANGES @@ -1940,7 +1940,7 @@ - Updated configuration information: * As of OpenSSL 0.9.4, certificate chain verification is not sufficient, since the certificate purpose is not checked, so I recommend to add - all intermediate CAs the the list of CAs and stay with a verification + all intermediate CAs the list of CAs and stay with a verification depth of 1. Work is in progress for 0.9.5. - Stepped up to the just released new patchlevel postfix-19990906-pl09. @@ -2070,7 +2070,7 @@ 1999/10/09 - Set an absolut maximum length of 32 for the IDs used for session caching. - This matches the default in OpenSSL, but I don´t want to see surprises + This matches the default in OpenSSL, but I don't want to see surprises when somebody sometimes will run into a longer session id. 1999/10/05 == Released 0.4.0 == @@ -2107,11 +2107,11 @@ to computer sience students. 1999/09/28 - - I cannot use the mod_ssl way for session caching and I don´t want to - spend an extra "gcache" daemon as ApacheSSL does. So I follow Wietse´s + - I cannot use the mod_ssl way for session caching and I don't want to + spend an extra "gcache" daemon as ApacheSSL does. So I follow Wietse's idea realized for his mail queues and create hash level based subdirectory structures. The good thing: I can cannibalize the mail_queue code. - The bad thing: there is a path length of 100 chars fix coded in Wietse´s + The bad thing: there is a path length of 100 chars fix coded in Wietse's routines. It does hold for 32byte session ideas. Status: can save sessions to disk and recall them (server side). @@ -2119,8 +2119,8 @@ - Created new call backs for external session caching for the server side. In a first step, they can print out the session ids for the newly created session and when recalling a session. - As the OpenSSL documentation on this is pretty sparse, Ben Laurie´s - ApacheSSL code is very helpful, Ralph Engelschall´s Mod_SSL code for + As the OpenSSL documentation on this is pretty sparse, Ben Laurie's + ApacheSSL code is very helpful, Ralph Engelschall's Mod_SSL code for session caching is far more complicated. 1999/09/23 == Released 0.3.10 == @@ -2146,7 +2146,7 @@ SSL_CTX_set_session_id_context() call was missing. To find this, I had to trace through the OpenSSL library and when I finally found it in ssl/ssl_sess.c, there was an appropriate comment about this. I however - have to find out why I didn´t receive the appropriate error message... + have to find out why I didn't receive the appropriate error message... - This bug was hidden during the first developing stages, as the shutdown sequence was not working correct, so the session was not cached. @@ -2181,7 +2181,7 @@ 1999/09/09 == Released 0.3.6 == 1999/09/09 - - Added a missing ´#ifdef HAS_SSL #endif´ in smtp_connect.c. + - Added a missing '#ifdef HAS_SSL #endif' in smtp_connect.c. Noted by Jeff Johnson <jeff@websitefactory.net>. - HINT: On 1999/09/06 a new "stable" version of postfix was released. @@ -2357,7 +2357,7 @@ 1999/04/14 - Ported from OpenSSL the BIO_callback functions to dump out the negotiation and transmission for debugging purposes. The functions are triggered - by the the new loglevels 3 and 4. + by the new loglevels 3 and 4. - Call SSL_free() to get rid of the SSL connection structure not used anymore. diff --git a/external/ibm-public/postfix/dist/US_PATENT_6321267 b/external/ibm-public/postfix/dist/US_PATENT_6321267 index 4972090c27d..6d8676301fd 100644 --- a/external/ibm-public/postfix/dist/US_PATENT_6321267 +++ b/external/ibm-public/postfix/dist/US_PATENT_6321267 @@ -1,3 +1,8 @@ +[The patent discussed in this document expired in 2019, without a +request for extension. The owner of that patent can no longer sue for +infringement. However, other patents may make similar claims. The text +below may serve as an example for dealing with them.] + 1. Disclaimer: This text is not an authoritative statement. If you are concerned about the implications of US patent 6,321,267, then you should give this text to your own lawyer and get their diff --git a/external/ibm-public/postfix/dist/WISHLIST b/external/ibm-public/postfix/dist/WISHLIST new file mode 100644 index 00000000000..d0a0db45c07 --- /dev/null +++ b/external/ibm-public/postfix/dist/WISHLIST @@ -0,0 +1,1140 @@ +Wish list: + + Things to do before the stable release: + + make pre-release-check, HTML validator check. + + Disable -DSNAPSHOT and -DNONPROD in makedefs. + + Alias htable(3) calls to equivalent binhash(3) calls, + and obsolete the htable(3) module. + + FILTER_README needs some text on multi-instance implementations, + and existing multi-instance references need to be updated. + + Fix code that still uses "long" for data_size and data_offset, + and that uses "%ld" in sscanf(). + + A smart query service for live Postfix tables that outputs JSON? + + Add a pointer to + http://mmogilvi.users.sourceforge.net/software/oauthbearer.html + in documentation or on-line howtos. + + Read http://mmogilvi.users.sourceforge.net/software/oauthbearer.html + and see how we can improve on the Postfix side. + + Add verp=+= to the qmgr "from=" logging. This is already + implemented but not yet integrated. + + Need canonical Dovecot example that has virtual_mailbox_domains, + (virtual_mailbox_maps or reject unverified_recipient), and + virtual_transport. + + Make smtpd_relay_before_recipient_restrictions settable + in smtpd_checks tests. + + Make the DNS resolver library pluggable, so that we can a) + plug in a fake resolver library for DNS-related regression + tests and make DNS tests hermetic (no external dependency; + b) add support for non-libbind resolvers. Gracefully handle + requests for unsupported functionality; return an error status, + instead of terminating. + + Add a robust dnssec_probe regression test (success and fail) + that does not break existing regression tests. + + smtp_sasl_tls_security_options = noanonymous, and make + smtp_sasl_security_options the default dependent on the + smtp_sasl_tls_security_options default (i.e. reverse the + dependency). Or make them independent. + + Try to make the master throttle more distrusting. Currently, + the master throttles a service after a child process cannot be + created (fork() fails), or if a child process fails upon its + first use. The master always unthrottles the service if a process + handles a client successfully. This is sufficient to mitigate + local errors that break all attempts to use a service. It also + slows down stupid remote attacks as long as malicious traffic + dominates benign traffic. Perhaps monitor a crashing percentage? + If 50% of all connections to a service result in abnormal + termination, that would be bad even under a non-attack scenario. + + More accurate address verification: do a quota check before + reporting that a local(8) or virtual(8) recipient is deliverable. + + Eliminate duplicate mail submission permission checks from + sendmail, so that they happen in postdrop only. Then, pass the + result through the postdrop-to-sendmail protocol. This requires + that postdrop reads all inputs before responding (the + local_login_sender_maps check depends on the envelope + sender). Then sendmail can save input to dead.letter (no setgid + privilege, but it would still have to use safe_open() to avoid + clobbering files). + + Consider removing compat_level_from_numbers() and aliases, + because they are no longer used anywhere. + + Allow '}' at the beginning of a line. This would make multi-line + configuration settings easier to enter. This may be true + for main.cf, master.cf and similar files (such as database + configuration files, but not necessarily elsewhere). So it + may have to be a readlline flag. + + Understand what happens with DNSSEC related status fields + in posttls-finger when resolv.conf points to a host that + runs no DNS server. + + Hardening the half-dane behavior: some sites may rely on + current behavior which allows original MX domain name for + certificate matches. Requires a new (compatibility) parameter + setting? + + Code deduplication: migrate multi_server applications to + event_server, because the multi_server and event_server + skeletons are much more similar than other skeletons. In + addition to the default event_server accept() handler, also + register a read event callback for handling post_accept + events. But the currrent multi_server API fits typical usage + better. + + When a secondary instance has no multi_instance_name set, + postmulti -i won't be able to find it. + + nbbio: exercise the sanity checks with fake msg(3) functions. + + optreset (bsd-ism) how badly do we need it? + + transport policy protocol (clone of check_policy). + + See also postscreen event-driven client for policy delegation + below. + + smtp_line_length_limit can insert a line break in the middle + of a multi-byte character (which is not necessarily UTF-8, + so we can't simply look at the 8th bit). Also, note that a + multi-byte character may span queue file record boundaries, + for example if line_length_limit == smtp_line_length_limit. + The only way to fix this is to make the smtp_text_out() + routine aware of every possible multi-byte encoding. + + Replace ad-hoc code for pipe(8) flags handling, with + infrastructure that was built for smtp(8). + + Move map descriptions from postconf(1) to DATABASE_README + and point there. The text in DATABASE_README is less complete + than that in postconf(1). + + make tls_pre_jail_init() safe by design for use in programs + that implement both clients and servers. + + In smtpd(8) and postscreen(8), set the ehlo_discard_mask + to ~0 so that STARTTLS, BDAT, DSN, etc. work only for clients + that send EHLO. + + Wordsmithing: "replace by X" -> "replace with X" unless X + is "responsible" for making the substitution. + + In postscreen, don't fork after 'postfix reload' when + psc_check_queue_length (and psc_post_queue_length?) is zero. + + After I/O error, store errno in VSTREAM object before errno + may be overwritten. + + Add some tips for logging from container: + https://www.projectatomic.io/blog/2016/10/playing-with-docker-logging/; + syslog_name = $myhostname/postfix; mkdir queue and data + dir; postfix check to create queue subdirectories. + + Add postwhite as a postscreen-related project. + https://github.com/stevejenkins/postwhite/blob/master/README.md + + XFORWARD attributes in policy protocol? + + Document postsrsd and postforward for srs-ifying. Would + more fine-grained smtp_generic_maps support help? + + Decide whether to deprecate database configuration pathnames + that start with ".", for example, ldap:./file/name. These forms + are documented for ldap:, memcache:, mysql:, pgsql:, and sqlite: + maps. Postfix daemon processes will look up files relative to the + queue directory, but with postmap command-line processes it would + be more natural to interpret relative pathnames relative to the + current directory of the calling process (it would be a surprise + if "postmap hash:./foo" would access "/var/spool/postfix/foo", + or if "postmap hash:foo" and or "postmap hash:./foo" would access + different files). + + Convert postalias(1) to store external-form keys, and convert + aliases(5) to perform external-first lookup with fallback to + internal form, to make it consistent with the rest of Postfix. + In several years we may remove the internal-form fallbacks + with a compatibility_level safety net. + + In the bounce daemon, set util_utf8_enable if returning an + SMTPUTF8 message. This is wrong; if SMTPUTF8 is disabled, + then Postfix must not turn it on. + + Add a header_body_checks extension callback in smtp_proto.c + that implements the PASS action. + + Propagate SMTPD_PEER_CODE_XXX from smtpd(8) to cleanup(8), + so that {client_resolve} and {_} produce consistent results. + + NO_IP_CYRUS_SASL_AUTH should be a main.cf parameter. + + Modeline support in config files to enable/disable trailing + #comment, and to give hints about how to handle an LHS or + RHS. This will not preserve trailing comments in lines that + are modified with "postconf -e" and the like. + + Maintainability: replace lengthy libmilter-API argument lists + with named parameters, as with the libtls API. + + Fix buflen integer overflow detection in dict*sql.c. + + Fix "make test" bitrot. + + Move DNS-based tests from porcupine.org to postfix.org, or use + a mock DNS library (a library that presents the same API as the + real library, but that produces canned responses). + + Document dns_ncache_ttl_fix_enable use case in POSTSCREEN_README + and RELEASE_NOTES. + + Remove this file from the stable release. + + Things to do after the stable release: + + Specify WARN_UNUSED_RESULT for all library functions that + pass, deliver, bounce or defer a delivery request. + + Invent some kind of type-checking wrappers for htable(3), + ctable(3) and other modules that take and return a void* + pointer. We already did that for variadic functions. + + TLS certificate provenance: indicate whether a subject + name/issuer are verified or not (for example, change the + attribute name to unverified_ccert_subject etc.). This is + relevant only for fingerprint-based authentication including + DANE, and affects logging, SMTPD policy, and Milters. + + Generalize the daemon '-S' stand-alone mode, so that it can + be used with custom configuration settings for request/reply + regression testing. This would use the existing "-o name=value" + support to override parameters. For example, queue_directory + would point to a directory with sockets for fake versions of + Postfix-internal services. + + Update the list of Sendmail macros that Postfix can send + to Milters (auth_ssf and TLS-related). + + Update smtpd command count when rejecting or skipping input + before command-table lookup. But then we need to count + commands that are rejected (malformed UTF-8, tokenizer + error, forbidden command), or skipped (noop). + + What is the best place to detect spaces in pathnames during + installation/upgrade/packaging? postfix-install for early + warning, and post-install as a safety net? + + When the service basename differs from the program file + basename, either prepend the service name to the syslogname (as + if syslog_name=postfix/service/program), or prepend the service + name to the process name (perhaps too confusing). The service + indication is desirable for mail delivery transports (smtp + versus relay) as it identifies what scheduler parameters are + in effect, but it is also desirable for mail receiving services + (smtp versus submission verus smtps as configured in the stock + master.cf file). This requires exceptions for some program names + (exclude smtpd to avoid logging postfix/smtp/smtpd which could + result in more confusion, and maybe other program names). + + UTF8 DNS[BW]L domain name. + + Consolidate maps flags in mail_params.h instead of having + multiple copies scattered across programs. + + Try to allow UTF-8 myhostname/mydomain, at least in bounce + template expansion. + + In the SMTP server, do not issue an enhanced status code when + rejecting a connection before the HELO handshake is completed. + + Maybe don't whitelist a client that has maxed out its + per-MTA connection count limit. + + Inline support for pcre:{/pattern/=action, ...} and ditto + support for regexp: and cidr: tables. Factor out and reuse + code that already exists in inline: and other tables. + + Log command=good/bad statistics in postscreen? + + smtpd_checks tests either must use a DNS dummy resolver + (override the res_search API) or all names must be under + test.postfix.org (but that does not work for address->name + lookups, and cannot simulate some errors). + + Reporting the original Message-ID in a bounce message + In-Reply-To: or References: header. In the cleanup daemon, + grab a copy of the Message-ID and export it along with other + header-extracted information at the top of the "extracted" + queue file segment. In the queue manager, extract this + along with other header-extracted information, and forward + the Message-ID in the bounce server notification request. + + Clobber ORCPT when sender is owner-mumble? + + Add milter_mumble_macros to the list of per-macro features. + + The pickup daemon logs warnings only when the cleanup daemon + dit not provide a "reason" attribute. Is this logic right? + + up-convert myhostname to UTF-8 in MIME boundary strings? + + Eliminate code duplication between pcf_print_master_field() + and pcf_print_master_entry(). + + Error reporting: see if pcf_check_master_entry() and children + can return error descriptions instead of terminating with + a fatal error. + + Add a switch to consider postscreen deep protocol tests as + "completed" when receiving "RSET" after "RCPT TO" and the + session has passed all tests up to that point. RSET becomes + like QUIT except perhaps that it does not hang up. + + apipe: map, splits results into address lists and performs + lookups for the invidual addresses, converting back and + forth between external and internal forms. + + Clarify that receive_override_options have no effect with + smtpd_proxy_filter. + + Document the relative order of header_checks, address + rewriting, milters. + + NOT: Table-driven case folding and case-insensitive string + comparison specifically for UTF-8. Use libicu functions + instead. + + When downgrading message/global to 7bit, is quoted-printable + the appropriate encoding? Should it be base64? + + Should we encode headers with RFC 2047, when that is the + only reason that Postfix cannot deliver to a non-UTF8SMTP + server? Probably not in the general case. What about + Postfix as a gateway server that converts UTF8SMTP + for delivery to non-UTF8SMTP environments? + + Document and test restriction_classes example for + smtpd_policy_service_default_action. + + Don't accept AUTH or other features that are not announced + in the EHLO response. + + Suggested at Mailserver conference: Postscreen RDNS-based + reputation (but this makes postscreen performance highly + unpredicable because it introduces a dependency on random + DNS servers). + + Suggested at Mailserver conference: a way to select a + specific field in a table, presumably as the result value. + This may be done with a filtermap{i,j,...}: table that propagates + only the specified field(s). + + Discourage the use of "after 220" tests in POSTSCREEN_README + and the documentation of individual parameter settings. + + To un-break "make tests" under src/smtpd, make tests + independent from the DNS and native routines for host + name/address lookup. + + Make been_here flag BH_FLAG_FOLD configurable for masochists. + + Replace some redundant TLS_README sections with pointers + to FORWARD_SECRECY_README. + + Move html/index.html source to proto/. + + How hard is it to follow canonical or virtual mapping + for the purpose of address validation? We must never + reject a valid address. + + Preserve case in smtpd_resolve_addr() and add a structure + member for the case-folded address. IIRC some Milter macro + needs to show the unfolded address. + + Per SASL account rate limits. This requires new infrastructure + that maintains stats by SASL account instead of client IP + address. + + Watchdog timer in postmap/postalias. + + Begin code revision, after DANE support stabilizes. This + should be one pass that changes only names and no code. + + recipient_delimiters = $recipient_delimiter for BC + + All source code must specify its original author and + license statement. Some code modules specify Lutz Jaenicke + as the original author and fall under his liberal license. + Code that is added to such a module has the same license + (or at least something that is not more restrictive). Code + modules without input from Lutz Jaenicke must state its + original author and license (preferably no more restrictive + than Postfix's own license). Currently, too many files list + Wietse as the original author, and Lutz Jaenicke's license, + which is wrong. + + We have smtp_host_lookup, smtp_dns_resolver_options, and + now smtp_dns_support_level. Of these, smtp_dns_resolver_options + is orthogonal but the rest has overlap. + + There needs to be support for automatic migration from the + deprecated disable_dns_lookups feature to the preferred + smtp_dns_support_level feature. This support needs to exist + for several releases before the deprecated feature can be + removed. + + End code revision, after DANE support stabilizes. + + It would be nice if "bare username" lookup is not hard-coded + for domains in the local address class. + + Don't forget Apple's code donation for fetching mail from + IMAP server. + + Should postconf -o refuse to work without the -x option? + + Make 30s caching (feature 20070414) configurable, such that + 0 means no caching. + + Make errno white/blacklist for getpwnam_r etc. and mailbox + write errors. + + smtpd_muble_restrictions rule names are case-insensitive. + restriction_classes values are case-sensitive but should + be case-insensitive for consistency with smtpd_muble_restrictions. + + Make "rename" the default when postmapping a DB file + (later: use copy+rename for postmap -i, postmap -d). + + Service-name parameters aren't documented in daemon manpages. + + When faking up the DSN ORCPT, don't send bare usernames + from local command-line submission. + + lmtp_assume_final is broken. A 2XX response does not imply + final delivery. The Sieve language implements accept-then-bounce. + + postscreen event-driven plug-in interface to send out a + query in parallel with the Pregreet and DNSBL tests, using + a simplified version of the policy delegation protocol. + + Parallelized queue preprocessing: rip out the queue manager + code to read queue files and resolve recipients, and run + it in parallel processes. The queue manager then processes + their results as they become available. This would eliminate + the qmgr<->trivial-rewrite bottleneck. This can also eliminate + much of the scheduling disadvantage of a single queue manager + compared to hundreds of mail receiving or sending processes + (especially if there is a way to scan the queue in parallel). + + Memory pools for same-type memory objects. This can be + used to either increase memory locality for frequently-allocated + objects (MRU allocation) or to make use-after-free bugs + more detectable (use LRU allocation and wipe the object + immediately after free(). Finally, same-type memory pools + prevent object type errors with use-after-free bugs. + + "no-cache" option for selected postscreen tests? + + Need a new DICT flag to indicate that a map handle supports + locking. If it doesn't (as with memcache or proxymap + handles), then postscreen etc. don't need to close a cache + file after "postfix reload". After a fork() it is OK to + keep using a memcache or proxymap handle, because the parent + exits immediately. For this to work, the memcache client + needs to propagate the flag from a persistent backup map, + but the proxymap protocol should not propagate this to the + client. + + Different TTL values for different DNSBL sources? + + Replace master(8) SIGHUP by very simple socket protocol to + allow reload of a specific service. + + postscreen: in the dummy SMTP engine, log the protocol state + at time of violation (like smtpd, set state->where initially + to CONNECT, then update it with the name of the last "known" + command, or set it to "unimplemented"). + + The discussion of postscreen cache configuration is in the + wrong place (how whitelisting works). Move it to the section + about configuring postscreen. + + Before proxymap can be exposed to the network (primarily + to share postscreen or verify caches), need to enforce + limits on attribute string name and value length in IPC + protocols. 10-20KB seems OK. We need to enforce content + sanity checks (for example, no control characters; Postfix + does not pass around multi-line data in table lookups). The + VSTREAM library already supports read/write deadlines. We + need to use attack-resistant code for numeric conversion. + + move flush_init() etc. from defer service clients to the + bounce daemon? Postfix works best when work can be spread + out over many clients, instead of over a few servers. + + multi_connect() function that takes a list of inet:host:port + and/or unix:pathname specs, with an explicit "inet" prefix + argument to handle applications that use host:port only. + This will simplify multi-host implementation for memcache + client, dovecot client, and other. + + dict_memcache: treat "bad" key as cache miss, i.e. read/write + the backup database as if the cache did not exist. This + does not help because most Postfix maps (virtual, canonical, + access, transport, ...) also don't support spaces in keys. + + postscreen: keep the cache open after "postfix reload" when + it is remote (type memcache: or proxy:). This does not work + because memcache can use a non-proxied file as backup). + + What is the feasibility of adding an mta_name (personality) + attribute that is propagated via queue files and delivery + agent requests? It would default to myhostname. + + Major performance improvement opportunity (that is until + everyone runs Postfix queues on SSDs). Investigate the + viability of a daemon that produces incoming and postdrop + queue files on request (in reality it would maintain a + limited queue of "spare" files). Central queue file allocation + reduces the I/O performance disadvantage that qmgr has when + 100 smtpd processes are receiving mail, or when lots of + mail is submitted with the sendmail command line. When an + smtpd process accepts MAIL FROM, a cleanup daemon requests + a queue file and receives a queue ID + file handle from the + queue file daemon. If the queue file daemon is down, the + cleanup daemon creates the file itself like it does now; + this can be hidden in the mail_stream library module. If + the mail transaction is aborted, then the cleanup daemon + gives the queue file back to the queue file daemon's "spare" + file pool, saving most of the overhead of creating and + deleting a queue file (the file would still need to be + renamed at the start of the next mail transaction). If the + cleanup daemon is unable to give a file back, then it can + delete the file like it does now; this can be hidden in the + mail_stream library module. The whole thing can be + transparently added to Postfix by adding calls to a + queue-file-service client to the mail_queue_enter() and + mail_queue_remove() library routines. Other advantages: + 1) negligible performance hit when queue file allocation + happens earlier, so that logging and milters have a queue + ID for the whole transaction not just the first valid + recipient; 2) by not removing every queue files we get most + of the performance gain of a queue based on append/truncate + instead of the much more expensive create/delete. + + Investigate viability of Sendmail dns maps. + + Make the rules for how to use close-on-exec more explicit. + + Provide separate timeout control for dict_proxy client, + rewrite client, resolve client, cleanup client, and so on. + Perhaps a timeout argument to the mail_connect() routines. + + Trick from amavisd: save listen socket/fifo/etc state, clear + their close-on-exec flags, exec the same program file to + re-initialize (with saved socket state on command line or + in environment), then restore the listen socket/fifo/etc + close-on-exec flags. This could be a way to mitigate the + impact of memory/file leaks, and to implement "postfix + reload" support for master(8) features that currently don't + support this. + + Sub-second time resolution. The first benefit is to make + per-destination rate delays more usable. Other applications + will come up once the support exists. The straightforward + approach is to represent all time intervals in milliseconds, + and to update all code that makes system calls with a time + argument (as well as the compiled-in upper and lower time + parameter bounds, which are currently in seconds). + Unfortunately, that limits he maximum time interval to less + than 25 days on 32-bit systems, and is likely to break + compatibility (for starters, it cannot even deal with the + compiled-in 100d upper bound on the queue file lifetime). + A second option is to have a "compatibility" time base + switch between milliseconds and seconds; this means extra + changes to all code that makes system calls with a time + argument, and the way that the compiled-in upper and lower + bounds are specified. Some of this can be encapsulated in + macros like time_to_sec(t), time_to_msec(t) and sec_to_time(t). + Finally, it is relatively easy to replace the events(3) + interface to use "double" for the time delay arguments, but + it is a major pain to convert all main.cf time parameters + into doubles (converting only some leads to a documentation + nightmare). + + Address verify cache: allow a negative cache "refresh" + result to purge a "positive" cache entry in some safe manner. + Currently, the negative cache "refresh" result is discarded, + address verify cache lookup returns OK, and each lookup + forces a "refresh" probe until the entry expires. + + Some Sendmail configurations trigger sub-optimal behavior + when the postscreen_whitelist_interfaces parameter lists + primary MX addresses only. When postscreen's "deep protocol + tests" are successful on the primary MX address (i.e. they + result in 4XX responses to RCPT TO), some Sendmail + configurations keep the primary MX connection open until + AFTER they finish talking to the backup MX address. The + problem is that the backup connection runs into a WHITELIST + VETO condition because the whitelisting database has not + yet been updated with the PASS NEW result for the primary + MX connection. Unfortunately postscreen can't update the + whitelisting database before the primary MX connection is + closed, because a client may still make a mistake. + + In the SMTP server, check if the connection is closed before + replying to ".", and discard the message if the reply can't + be sent. This reduces the time window for RFC 1047 message + duplication, and may even prevent the delivery of some spam. + http://www.exim.org/lurker/message/20070416.103159.9d5ff0ce.en.html + This requires splitting the SMTP server's commit operation + into two operations: first, a tentative commit operation + that performs most of the I/O and processing in milters and + in the cleanup server; second, a final commit operation + that is executed only if the remote SMTP client hasn't hung + up in the mean time. Unfortunately, SMTP-based before-queue + content filters don't support a tentative commit operation. + + Find out how to reproduce Berkeley DB bogus ENOENT errors. + postscreen does not log this with Berkeley DB 1 (FreeBSD + 4..8), 4.7.25 (Ubuntu 9.04) and 4.8.24 (Ubuntu 10.04). + + postconf command-line option to show the compile-time + settings (CCARGS, AUXLIBS) in case binary packages + don't install the makedefs.out file. + + events.c: cache the side effects of file descriptor event + enable/disable operations in user space, and do bulk kernel + updates at event_loop() time. This can eliminate costly + system calls with successive event disable/enable operations + on the same file descriptor. This can also eliminate the + need for tricky code that tries to avoid the expense of + successive disable/enable operations. Such code is likely + to introduce bugs. + + When does it pay off to send domains in the active queue + to a DNS prefetch daemon? Could this generalize to a dynamic + transport map that piggy-backs domains with the same MX + host into the same mail delivery transaction? + + tlsproxy(8) should receive TLS preferences from postscreen(8) + and smtpd(8), instead of reading them from main.cf. This + means that many tlsproxy_ parameters become postscreen_ + parameters, and that tls_server_init() parameters move to + to tls_server_start(). That is a significant API change. + It also means tlsproxy can't open all files before chroot(). + + anvil rate limit for sasl_username. + + Encapsulate nbbio buffer access and update by tlsproxy. + + Full-duplex support for tlsproxy(8). This requires updating + events(3) and nbbio(3). + + Register automagic destructor for object attached to VSTREAM. + + Use different ipc time limits for email message transactions + (smtpd, pickup)->cleanup and for quick query/reply transactions + such as address rewriting/resolution. Beware of large time + limits for local or virtual alias expansion. + + permit_tempfail_action (default: defer_if_reject) to be + used as the default value for dnswl_tempfail_action and + rhswl_tempfail_action. Steal liberally from the code that + implements unverified_recipient_tempfail_action etc. + + Support filtering of messages that are generated by Postfix: + This would apply to postmaster notices and bounce messages + (DKIM), and address verification (BATV). + + Consistency: in postconf.proto make <dt>..</dt> tags bold. + + Would it help if there were different cleanup_service + parameter names for different message paths? smtpd(8) uses + the same cleanup_service value for receiving remote mail + and for submitting postmaster problem reports. Do we need + separate mumble_cleanup_service_name parameters for "inject", + "notify" and "forward" (with backwards compatible defaults)? + + IF/ENDIF support for CIDR tables. + + Need a regular expression table to translate address + verification responses into hard/soft/accept reply codes. + + Is there a way to make sendmail -V work after local alias + expansion? Majordomo-like mailing lists would benefit from + this; the example in VERP_README does not work in the general + case. + + When an alias is a member of an :include: list with owner- + alias, local(8) needs an option to deliver alias or alias->user + indirectly. What happens when an :include: list with owner- + alias includes another list? + + Don't allow empty result values in pcre and regexp maps. + Postfix doesn't allow them anywhere else (check this). + + Make PCRE_MAX_CAPTURE configurable. + + Add some checks for tokens starting with #. A challenge + is to report sensible context from the guts of some low-level + parser, without introducing a great deal of clumsiness. + + Add sendmail macros for {verify} and maybe other TLS info. + + Find out if we are doing the correct thing by looking at + state->milter_reject_text when expanding {rcpt_addr} or + {rcpt_host}. + + Find out why post_mail() etc. block when the qmgr fifo is + full (answer: trigger_timeout). How can this cause delays + in the queue manager? When a recipient bounces during + (transport, nexthop, address) resolution, it is redirected + to the error or retry mailer; and bounce-after-delivery is + asynchrounous so it can't block the queue manager, either. + + How to ensure that proxy_read_maps is processed after all + its dependencies are initialized, or just bite the bullet + and rewrite the parameter initialization code. + + The cleanup virtual alias expansion limit does not really + deliver on its promises. 1) It promises to truncate the + result without aborting delivery, which would be undesirable + anyway, but that is not what it does, so that is good. 2) + It keeps all the recipients from multi-recipient database + lookup, then terminates further recursion when the result + exceeds the expansion limit. This behavior achieves the + original goal that all things shall have a finite size (even + though but we don'really care how large they are) but may + result in surprises when recipients are listed in virtual + alias domains or need expansion for other reasons. In a + phone call with Victor, a reasonable way out is to set the + limit to some large number (100000) and abort delivery when + the result exceeds the limit. + + Should the postscreen save permanent white/black list lookup + results to the temporary cache, and query the temporary + cache first? Skipping white/black list lookups will speed + up the handling of "good" clients without a permanent + whitelist entry. Of course, this means that updates to the + white/black lists do not immediately take effect. Workarounds: + 1) use a shorter temporary cache TTL for clients on the + permanent black/white lists; 2) ignore cached white/black + list lookup results after "postfix reload"; 2) adjust the + logging, for example "WHITELISTED address (cached)" and + "BLACKLISTED address (cached)" to eliminate surprises. + Comparing the cache entry time with the white/blacklist + file modification time is not foolproof: for example, pcre + or CIDR tables are read only once. + + It would be nice if the generic dict_cache(3) cache manager + could postpone process suicide until cache cleanup is + completed (but that is not possible when postscreen forks + into the background to finish already-accepted connections, + and it is not desirable when a host is being shut down). + + When postscreen drops a connection, a 521 "greeting" should + be of the form "521 servername..." and not have an enhanced + status code. The "521 5.7.1" form can be used after EHLO. + Of course no spammer is going to complain about Postfix + SMTP compliance. + + Find a place to document all the mail routing mechanisms + in one place so people can figure out how Postfix works. + + The access map BCC action is marked "not stable", perhaps + because people would also expect BCC actions in header/body_checks. + How much would it take to make the queue file editing code + generally usable? + + Move smtpd_command_filter into smtpd_chat_query() and update + the session transcript (see smtp_chat_reply() for an example). + + SMTP connection caching without storing connections, to + improve TLS mail delivery performance. + + Should not milter8_mail_event() unset the "hold" default + reply? Better, the default reply should not be used for + this purpose. + + Don't send MASTER_STAT_TAKEN/MASTER_STAT_AVAIL when a server + runs with process limit of 1. But this means the master + never learns that the process is successful and will always + pause $service_throttle_time before restarting a failed service. + + Don't bother maintaining a per-service lockfile when a + server runs with process limit of 1. The purpose of the + lockfile is to avoid thundering herd problems when the kernel + wakes up multiple processes for each new client connection. + + Implement PREPEND action for milter_header_checks. Save the + to-be-prepended text to buffer, then emit it along with the + new header. + + Fix the header_body_checks API, so that the name of the map + class (e.g. milter_header_checks) is available for logging. + + Fix the mime_state and header_body_checks APIs, so that + they use VSTRINGs. This simplifies REPLACE actions. + + Update FILTER_README for multi-instance support, and rename + the old document to FILTER_LEGACY_README. + + Need to sign delivery status notifications, to avoid surprises + when eventually people start enforcing DKIM etc. signatures. + + Either document or remove the internal_mail_filter_classes + feature (it's disabled by default). + + Make the "unknown recipient" test configurable as + first|last|never, with "yes"=="last" for backwards + compatibility. The "first" setting is good for performance + (stress=yes) when all users are defined in local files; but + it may perform worse when users are in networked tables. + + Cleanup: make DNSBL query format configurable beyond the + client's reversed IP address. + + With 'final delivery' in the LMTP client, need an option + to also add delivered-to and other pipe(8) features. This + requires making mail_copy() functionality available in + non-mailbox context. + + Cleanup: modernize the "add missing From: header" code, to + ``phrase <addr>'' form. Most likely, quote the entire phrase + if it contains any text that is special, then rfc822_externalize + the whole thing. + + SMTP server: make the server_addr and server_port available + to policy server, Dovecot, and perhaps Milters. + + Med: local and remote source port and IP address for smtpd + policy hook. + + Maybe change maps_rbl_reject_code default to 521, and + update wording in STRESS_README. + + Encapsulate time_t comparisons so that they can be made + system dependent (use difftime() where available). + + Encapsulate time_t conversions (e.g. REC_TYPE_TIME) so that + they can be made system dependent. + + Plan for time_t larger than long, or wait for LP64 to + dominate the world? + + Make "AUTH=<>" appendage to MAIL FROM configurable, enabled + by default. + + To support ternary operator without a huge parsing effort, + consider ${value?{xxx}:{yyy}} where ${name} is existing + syntax, and where ?{text} and :{text} are new syntax that + is unlikely to break existing configurations. Or perhaps + it's just too ugly. + + Write delivery rate delay example (which _README?) and auth + failure cache example (SASL_README). Then include them in + SOHO_README. + + Look for alternatives for the use of non_smtpd_milters. + This involves some way to force local submissions to go + through a local SMTP client and server, without triggering + "mail loops back to myself" false alarms. The advantage is + that it makes smtpd_mumble_restrictions available for local + and remote mail; the disadvantage is that it makes local + submissions more dependent on networking. One possibility + is to use "pickup -o content_filter=smtp:127.0.0.1:10025", + or a dedicated SMTP client/server on UNIX-domain sockets; + we could also decide to always suppress "mail loop" detection + for loopback connections. Another option is to have the + pickup or cleanup server drive an SMTP client directly; + this would require extension of the mail_stream() interface, + plus a way to handle bounced/deferred recipients intelligently, + but it would be at odds with Postfix design where delivery + agents access queue files directly; exposing delivery agents + to raw queue files violates another Postfix design principle. + + Consolidate duplicated code in *_server_accept_{pass,inet}(). + + Consolidate duplicated code in {inet,unix,upass}_trigger.c. + + In the SMTP client, handle 421 replies in smtp_loop() by + having the input function raise a flag after detecting 421 + (kill connection caching and be sure to do the right thing + with RSET probes), leave the smtp_loop() per-command reply + handlers unchanged, and have the smtp_loop() reader loop + bail out with smtp_site_fail("server disconnected after + %s", where), but only in the case that it isn't already in + the final state. But first we need to clean up the handling + of do/don't cache, expired, bad and dead sessions. + + Combine smtpd_peer.c and qmqpd_peer.c into a single function + that produces a client context object, and provide attribute + print/scan routines that pass these client context objects + around. With this, we no longer have to update multiple + pieces of code when a client attribute is added. Ditto for + SASL and TLS context. + + Don't log "warning: XXXXX: undeliverable postmaster + notification discarded" for spam from outside. + + Really need a cleanup driver that allows testing against + Milter applications instead of synthetic events. This would + have to provide stubs for clients that talk to Postfix + daemon processes. See if this approach can also be used for + other daemons. + + smtpd(8) exempts $address_verify_sender from access controls, + but it doesn't know whether cleanup(8) or delivery agents + modify the sender. Would it be possible to "calibrate" this + exemption, perhaps by having delivery agents pass the probe + sender to the verify server, keeping in mind that the probe + sender may differ per delivery agent due to output rewriting. + + Update attr_print/scan() so they can send/receive file + descriptors. This simplifies kludgy code in many daemons. + + Would there be a problem adding $smtpd_mumble_restrictions + and $smtpd_sender_login_maps to the default proxy_read_maps + settings? + + Remove defer(8) and trace(8) references and man pages. These + are services not program names. On the other hand we have + man pages for lmtp(8) and smtp(8), but not for relay(8). + Likewise, retry(8) does not have a man page. + + Bind all deliveries to the same local delivery process, + making Postfix perform as poorly as monolithic mailers, but + giving a possibility to eliminate duplicate deliveries. + + Maybe declare loop when resolve_local(mxhost) is true? + + Update message content length when adding/removing headers. + + Need scache size limit. + + REDIRECT should override original recipient info, and + probably override DSN as well. + + Update FILTER_README with mailing list suggestions to tag + with a badness indicator and then filter down-stream. + + Make null local-part handling configurable: either expand + into mailer-daemon (current behavior) or disallow (strict + behavior, currently implemented only in the SMTP server). + + Add M flag (enable multi-recipient delivery) to pipe daemon. + + The usage of TLScontext->cache_type is unclear. It specifies + a TLS session cache type (smtpd, smtp, or lmtp), but it is + sometimes used as an indicator that TLS session caching is + unavailable. In reality, that decision is made by not + registering call-back functions for cache maintenance. + + Postfix TLS library code should copy any strings that it + receives from the application, instead of passing them + around as pointers. TLScontext->cache_type is a case in + point. + + Are transport:nexthop null fields the same as in the case + of default_transport etc. parameters? + + Don't lose bits when converting st_dev into maildir file + name. It's 64 bits on Linux. Found with the BEAM source + code analyzer. Is this really a problem, or are they just + using 64 bits for upwards compatibility with LP64 systems? + + Do or don't introduce unknown_reverse_client_reject_code. + + Check that "UINT32 == unsigned int" choice is ok (i.e. LP64 + UNIX). + + Tempfail when a Milter application tries to negotiate content + access, while it is configured in an SMTP server that runs + before the smtpd_proxy filter. + + Log DSN original recipient when rejecting mail. + + Keep whitespace between label and ":"? + + Make the map case folding/locking options configurable, if + not at run-time then at least at compile time so we get + consistent behavior across applications. + + Investigate what it would take to eliminate oqmgr, and to + make the old behavior configurable in a unified queue + manager. This would shave another 2.7 KLOC from the source + footprint. + + Document the case folding strategy for match_list like + features. + + Eliminate the (incoming,deferred)->active rename operation. + This requires an in-memory hash of queue file names to avoid + duplicate open() operations. + + Softbounce fallback-to-ISP for SOHO users. This heuristic + assumes that when direct-to-MX delivery fails with 5XX, + delivery via the ISP may still succeed. This could be + implemented by enabling soft bounces for destinations other + than the smtp_fallback_relay. So the only benefit of this + over the existing soft_bounce feature is that it has no + effect on smtp_fallback_relay deliveries. + + Centralize main.cf parameter input so that defaults work + consistently. What about parameter names that are prefixed + with mail delivery transport names? + + Fix default time unit handling so that we can have a default + bounce lifetime of $maximal_queue_lifetime, without causing + panics when a non-default maximal_queue_lifetime setting + includes no time unit. + + After the 20051222 ISASCII paranoia, lowercase() lowercases + ASCII text only. + + Privacy: remove local command/pathname details from remote + delivery status reports, and log them via local msg_warn(). + + Is it safe to cache a connection after it has been used for + more than some number of address verification probes? + + Try to recognize that Resent- headers appear in blocks, + newest block first. But don't break on incorrect header + block organization. + + Hard limits on cache sizes (anvil, specifically). + + Laptop friendliness: make the qmgr remember when the next + deferred queue scan needs to be done, and have the pickup + server stat() the maildrop directory before searching it. + + Low: replace_sender/replace_recipient actions in access + maps, so they can be used in policy servers? + + Low: configurable order of local(8) delivery methods. + + Med: smtp_connect_timeout_budget (default: 3x smtp_connect_timeout) + to limit the total time spent trying to connect. + + Med: transform IPv4-in-IPv6 address literals to IPv4 form + when comparing against local IP addresses? + + Med: transform IPv4-in-IPv6 address literals to IPv4 form + when eliminating MX mailer loops? + + Med: Postfix requires [] around IPv6 address information + in match lists such as mynetworks, debug_peer_list etc., + but the [] must not be specified in access(5) maps. Other + places don't care. For now, this gotcha is documented in + IPV6_README and in postconf(5) with each feature that may + use IPv6 address information. The general recommendation + is not to use [] unless absolutely necessary. + + Med: the partial address matching of IPv6 addresses in + access(5) maps is a bit lame: it repeatedly truncates the + last ":octetpair" from the printable address representation + until a match is found or until truncation is no longer + possible. Since one or more ":" are usually omitted from + the printable IPv6 address representation, this does not + really try all the possibilities that one might expect to + be tried. For now, this gotcha is documented in access(5). + + Low: reject HELO with any domain name or IP address that + this MTA is the final destination for. + + Low: should the Delivered-To: test in local(8) be configurable? + + Low: make mail_addr_find() lookup configurable. + + Low: update events.c so that 1-second timer requests do not + suffer from rounding errors. This is needed for 1-second + SMTP session caching time limits. A 1-second interval would + become arbitrarily short when an event is scheduled just + before the current second rolls over. + + Low: configurable internal/system locking method. + + Low: add INSTALL section for pre-existing Postfix systems. + + Low: add INSTALL section for pre-existing RPM Postfixes. + + Low: disallow smtpd_recipient_limit < 100 (the RFC minimum). + + Low: noise filter: allow smtp(8) to retry immediately if + all MXes return a quick ECONNRESET or 4xx reply during the + initial handshake. Retry once? How many times? + + Low: make post-install a "postfix-only script" so it can + take data from the environment instead of main.cf. + + Low: randomize deferred mail backoff. + + Med: separate ulimit for delivery to command? + + Med: postsuper -r should do something with recipients in + bounce logfiles, to make sure the sender will be notified. + To be perfectly safe, no process other than the queue manager + should move a queue file away from the active queue. + + This could involve tagging a queue file, and use up another + permission bit (postsuper tags a "hot" file, qmgr requeues it). + + Low: postsuper re-run after renaming files, but only a + limited number of times. + + Low: smtp-source may block when sending large test messages. + + Med: find a way to log the sender address when MAIL FROM + is rejected due to lack of disk space. + + Low: revise other local delivery agent duplicate filters. + + Low: all table lookups should consistently use internalized + (unquoted) or externalized (quoted) forms as lookup keys. + smtpd, qmgr, local, etc. use unquoted address forms as keys. + cleanup uses quoted forms. + + Low: have a configurable list of errno values for mailbox + or maildir delivery that result in deferral rather than + bouncing mail. What about "killed by signal" exits? + + Low: after reorganizing configuration parameters, add flags + to all parameters whose value can be read from file. + + Medium: need in-process caching for map lookups. LDAP servers + seem to need this in particular. Need a way to expire cached + results that are too old. + + Low: generic showq protocol, to allow for more intelligent + processing than just mailq. Maybe marry this with postsuper. + + Low: default domain for appending to unqualified recipients, + so that unqualified names can be delivered locally. + + Low: The $process_id_directory setting is not used anywhere + in Postfix. Problem reported by Michael Smith, texas.net. + This should be documented, or better, the code should warn + about attempts to set read-only parameters. + + Low: while converting 8bit text to quoted-printable, perhaps + use =46rom to avoid having to produce >From when delivering + to mailbox. + + virtual_mailbox_path expression like forward_path, so that + people can specify prefix and suffix. diff --git a/external/ibm-public/postfix/dist/conf/access b/external/ibm-public/postfix/dist/conf/access index 257339bfb07..97892eb7393 100644 --- a/external/ibm-public/postfix/dist/conf/access +++ b/external/ibm-public/postfix/dist/conf/access @@ -31,7 +31,7 @@ # # Alternatively, the table can be provided as a regu- # lar-expression map where patterns are given as regular -# expressions, or lookups can be directed to TCP-based +# expressions, or lookups can be directed to a TCP-based # server. In those cases, the lookups are done in a slightly # different way as described below under "REGULAR EXPRESSION # TABLES" or "TCP-BASED TABLES". @@ -232,7 +232,7 @@ # # DEFER_IF_PERMIT optional text... # Defer the request if some later restriction would -# result in a an explicit or implicit PERMIT action. +# result in an explicit or implicit PERMIT action. # Reply with "$access_map_defer_code 4.7.1 optional # text..." when the optional text is specified, oth- # erwise reply with a generic error response message. diff --git a/external/ibm-public/postfix/dist/conf/canonical b/external/ibm-public/postfix/dist/conf/canonical index 9881f4ef8bf..4957fcc4fc1 100644 --- a/external/ibm-public/postfix/dist/conf/canonical +++ b/external/ibm-public/postfix/dist/conf/canonical @@ -29,7 +29,7 @@ # # Alternatively, the table can be provided as a regu- # lar-expression map where patterns are given as regular -# expressions, or lookups can be directed to TCP-based +# expressions, or lookups can be directed to a TCP-based # server. In those cases, the lookups are done in a slightly # different way as described below under "REGULAR EXPRESSION # TABLES" or "TCP-BASED TABLES". @@ -252,8 +252,8 @@ # # masquerade_exceptions (empty) # Optional list of user names that are not subjected -# to address masquerading, even when their address -# matches $masquerade_domains. +# to address masquerading, even when their addresses +# match $masquerade_domains. # # mydestination ($myhostname, localhost.$mydomain, local- # host) diff --git a/external/ibm-public/postfix/dist/conf/generic b/external/ibm-public/postfix/dist/conf/generic index 9d293683a64..f371eb9a5c9 100644 --- a/external/ibm-public/postfix/dist/conf/generic +++ b/external/ibm-public/postfix/dist/conf/generic @@ -42,8 +42,8 @@ # # Alternatively, the table can be provided as a regu- # lar-expression map where patterns are given as regular -# expressions, or lookups can be directed to TCP-based -# server. In those case, the lookups are done in a slightly +# expressions, or lookups can be directed to a TCP-based +# server. In those cases, the lookups are done in a slightly # different way as described below under "REGULAR EXPRESSION # TABLES" or "TCP-BASED TABLES". # @@ -140,8 +140,8 @@ # This section describes how the table lookups change when # lookups are directed to a TCP-based server. For a descrip- # tion of the TCP client/server lookup protocol, see tcp_ta- -# ble(5). This feature is not available up to and including -# Postfix version 2.4. +# ble(5). This feature is available in Postfix 2.5 and +# later. # # Each lookup operation uses the entire address once. Thus, # user@domain mail addresses are not broken up into their @@ -180,40 +180,42 @@ # The text below provides only a parameter summary. See # postconf(5) for more details including examples. # -# smtp_generic_maps -# Address mapping lookup table for envelope and -# header sender and recipient addresses while deliv- -# ering mail via SMTP. +# smtp_generic_maps (empty) +# Optional lookup tables that perform address rewrit- +# ing in the Postfix SMTP client, typically to trans- +# form a locally valid address into a globally valid +# address when sending mail across the Internet. # -# propagate_unmatched_extensions -# A list of address rewriting or forwarding mecha- -# nisms that propagate an address extension from the -# original address to the result. Specify zero or -# more of canonical, virtual, alias, forward, -# include, or generic. +# propagate_unmatched_extensions (canonical, virtual) +# What address lookup tables copy an address exten- +# sion from the lookup key to the lookup result. # # Other parameters of interest: # -# inet_interfaces -# The network interface addresses that this system -# receives mail on. You need to stop and start Post- -# fix when this parameter changes. -# -# proxy_interfaces -# Other interfaces that this machine receives mail on -# by way of a proxy agent or network address transla- -# tor. -# -# mydestination -# List of domains that this mail system considers -# local. -# -# myorigin -# The domain that is appended to locally-posted mail. -# -# owner_request_special -# Give special treatment to owner-xxx and xxx-request -# addresses. +# inet_interfaces (all) +# The network interface addresses that this mail sys- +# tem receives mail on. +# +# proxy_interfaces (empty) +# The network interface addresses that this mail sys- +# tem receives mail on by way of a proxy or network +# address translation unit. +# +# mydestination ($myhostname, localhost.$mydomain, local- +# host) +# The list of domains that are delivered via the +# $local_transport mail delivery transport. +# +# myorigin ($myhostname) +# The domain name that locally-posted mail appears to +# come from, and that locally posted mail is deliv- +# ered to. +# +# owner_request_special (yes) +# Enable special treatment for owner-listname entries +# in the aliases(5) file, and don't split owner-list- +# name and listname-request address localparts when +# the recipient_delimiter is set to "-". # # SEE ALSO # postmap(1), Postfix lookup table manager diff --git a/external/ibm-public/postfix/dist/conf/relocated b/external/ibm-public/postfix/dist/conf/relocated index e50edfd1842..90f63ecf209 100644 --- a/external/ibm-public/postfix/dist/conf/relocated +++ b/external/ibm-public/postfix/dist/conf/relocated @@ -24,7 +24,7 @@ # # Alternatively, the table can be provided as a regu- # lar-expression map where patterns are given as regular -# expressions, or lookups can be directed to TCP-based +# expressions, or lookups can be directed to a TCP-based # server. In those case, the lookups are done in a slightly # different way as described below under "REGULAR EXPRESSION # TABLES" or "TCP-BASED TABLES". @@ -86,66 +86,68 @@ # description of regular expression lookup table syntax, see # regexp_table(5) or pcre_table(5). For a description of the # TCP client/server table lookup protocol, see tcp_table(5). -# This feature is not available up to and including Postfix -# version 2.4. +# This feature is available in Postfix 2.5 and later. # -# Each pattern is a regular expression that is applied to +# Each pattern is a regular expression that is applied to # the entire address being looked up. Thus, user@domain mail -# addresses are not broken up into their user and @domain +# addresses are not broken up into their user and @domain # constituent parts, nor is user+foo broken up into user and # foo. # -# Patterns are applied in the order as specified in the ta- -# ble, until a pattern is found that matches the search +# Patterns are applied in the order as specified in the ta- +# ble, until a pattern is found that matches the search # string. # -# Results are the same as with indexed file lookups, with -# the additional feature that parenthesized substrings from +# Results are the same as with indexed file lookups, with +# the additional feature that parenthesized substrings from # the pattern can be interpolated as $1, $2 and so on. # # TCP-BASED TABLES -# This section describes how the table lookups change when +# This section describes how the table lookups change when # lookups are directed to a TCP-based server. For a descrip- # tion of the TCP client/server lookup protocol, see tcp_ta- -# ble(5). This feature is not available up to and including -# Postfix version 2.4. +# ble(5). This feature is available in Postfix 2.5 and +# later. # # Each lookup operation uses the entire address once. Thus, -# user@domain mail addresses are not broken up into their +# user@domain mail addresses are not broken up into their # user and @domain constituent parts, nor is user+foo broken # up into user and foo. # # Results are the same as with indexed file lookups. # # BUGS -# The table format does not understand quoting conventions. +# The table format does not understand quoting conventions. # # CONFIGURATION PARAMETERS -# The following main.cf parameters are especially relevant. -# The text below provides only a parameter summary. See +# The following main.cf parameters are especially relevant. +# The text below provides only a parameter summary. See # postconf(5) for more details including examples. # -# relocated_maps -# List of lookup tables for relocated users or sites. +# relocated_maps (empty) +# Optional lookup tables with new contact information +# for users or domains that no longer exist. # # Other parameters of interest: # -# inet_interfaces -# The network interface addresses that this system -# receives mail on. You need to stop and start Post- -# fix when this parameter changes. +# inet_interfaces (all) +# The network interface addresses that this mail sys- +# tem receives mail on. # -# mydestination -# List of domains that this mail system considers -# local. +# mydestination ($myhostname, localhost.$mydomain, local- +# host) +# The list of domains that are delivered via the +# $local_transport mail delivery transport. # -# myorigin -# The domain that is appended to locally-posted mail. +# myorigin ($myhostname) +# The domain name that locally-posted mail appears to +# come from, and that locally posted mail is deliv- +# ered to. # -# proxy_interfaces -# Other interfaces that this machine receives mail on -# by way of a proxy agent or network address transla- -# tor. +# proxy_interfaces (empty) +# The network interface addresses that this mail sys- +# tem receives mail on by way of a proxy or network +# address translation unit. # # SEE ALSO # trivial-rewrite(8), address resolver @@ -153,13 +155,13 @@ # postconf(5), configuration parameters # # README FILES -# Use "postconf readme_directory" or "postconf html_direc- +# Use "postconf readme_directory" or "postconf html_direc- # tory" to locate this information. # DATABASE_README, Postfix lookup table overview # ADDRESS_REWRITING_README, address rewriting guide # # LICENSE -# The Secure Mailer license must be distributed with this +# The Secure Mailer license must be distributed with this # software. # # AUTHOR(S) diff --git a/external/ibm-public/postfix/dist/conf/transport b/external/ibm-public/postfix/dist/conf/transport index d1b32686b39..bad7739512c 100644 --- a/external/ibm-public/postfix/dist/conf/transport +++ b/external/ibm-public/postfix/dist/conf/transport @@ -61,7 +61,7 @@ # # Alternatively, the table can be provided as a regu- # lar-expression map where patterns are given as regular -# expressions, or lookups can be directed to TCP-based +# expressions, or lookups can be directed to a TCP-based # server. In those case, the lookups are done in a slightly # different way as described below under "REGULAR EXPRESSION # TABLES" or "TCP-BASED TABLES". @@ -91,7 +91,7 @@ # # The pattern specifies an email address, a domain name, or # a domain name hierarchy, as described in section "TABLE -# LOOKUP". +# SEARCH ORDER". # # The result is of the form transport:nexthop and specifies # how or where to deliver mail. This is described in section diff --git a/external/ibm-public/postfix/dist/conf/virtual b/external/ibm-public/postfix/dist/conf/virtual index da9cd655cf5..96390fee80e 100644 --- a/external/ibm-public/postfix/dist/conf/virtual +++ b/external/ibm-public/postfix/dist/conf/virtual @@ -51,7 +51,7 @@ # # Alternatively, the table can be provided as a regu- # lar-expression map where patterns are given as regular -# expressions, or lookups can be directed to TCP-based +# expressions, or lookups can be directed to a TCP-based # server. In those case, the lookups are done in a slightly # different way as described below under "REGULAR EXPRESSION # TABLES" or "TCP-BASED TABLES". @@ -99,8 +99,8 @@ # tination, or when it is listed in $inet_interfaces # or $proxy_interfaces. # -# This functionality overlaps with functionality of -# the local aliases(5) database. The difference is +# This functionality overlaps with the functionality +# of the local aliases(5) database. The difference is # that virtual(5) mapping can be applied to non-local # addresses. # @@ -155,7 +155,7 @@ # # The propagate_unmatched_extensions parameter controls # whether an unmatched address extension (+foo) is propa- -# gated to the result of table lookup. +# gated to the result of a table lookup. # # VIRTUAL ALIAS DOMAINS # Besides virtual aliases, the virtual alias table can also @@ -232,8 +232,8 @@ # This section describes how the table lookups change when # lookups are directed to a TCP-based server. For a descrip- # tion of the TCP client/server lookup protocol, see tcp_ta- -# ble(5). This feature is not available up to and including -# Postfix version 2.4. +# ble(5). This feature is available in Postfix 2.5 and +# later. # # Each lookup operation uses the entire address once. Thus, # user@domain mail addresses are not broken up into their @@ -254,11 +254,11 @@ # virtual_alias_maps ($virtual_maps) # Optional lookup tables that alias specific mail # addresses or domains to other local or remote -# address. +# addresses. # # virtual_alias_domains ($virtual_alias_maps) -# Postfix is final destination for the specified list -# of virtual alias domains, that is, domains for +# Postfix is the final destination for the specified +# list of virtual alias domains, that is, domains for # which all addresses are aliased to addresses in # other local or remote domains. # diff --git a/external/ibm-public/postfix/dist/html/ADDRESS_CLASS_README.html b/external/ibm-public/postfix/dist/html/ADDRESS_CLASS_README.html index 92ee9f0f8a7..0932e9f700b 100644 --- a/external/ibm-public/postfix/dist/html/ADDRESS_CLASS_README.html +++ b/external/ibm-public/postfix/dist/html/ADDRESS_CLASS_README.html @@ -7,7 +7,7 @@ <title>Postfix Address Classes </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html b/external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html index 3c76edbe226..a2d83188ce5 100644 --- a/external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html +++ b/external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html @@ -7,7 +7,7 @@ <title>Postfix Address Rewriting </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -493,8 +493,8 @@ document. </p> </dd> Rewrite "user@host" to "user@host.$<a href="postconf.5.html#mydomain">mydomain</a>" </dt> <dd> <p> This feature is controlled by the boolean <a href="postconf.5.html#append_dot_mydomain">append_dot_mydomain</a> -parameter (default: yes). The purpose is to get consistent treatment -of different forms of the same hostname. </p> +parameter (default: Postfix ≥ 3.0: no, Postfix < 3.0: yes). The purpose +is to get consistent treatment of different forms of the same hostname. </p> <p> NOTE: Postfix versions 2.2 and later rewrite message headers from remote SMTP clients only if the client matches the diff --git a/external/ibm-public/postfix/dist/html/BACKSCATTER_README.html b/external/ibm-public/postfix/dist/html/BACKSCATTER_README.html index d6bd10ea7af..f4e26edde7c 100644 --- a/external/ibm-public/postfix/dist/html/BACKSCATTER_README.html +++ b/external/ibm-public/postfix/dist/html/BACKSCATTER_README.html @@ -7,7 +7,7 @@ <title>Postfix Backscatter Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -302,7 +302,7 @@ many users configure their email addresses as <i>username@example.com</i>, messages with DSN turned on will trigger the REJECT action in the previous section. </p> -<p> If you have such clients then you can to exclude their Message-ID +<p> If you have such clients then you can exclude their Message-ID strings with the two "<tt>Message-ID:.* <!&!</tt>" patterns that are shown in the previous section. Otherwise you will not be able to use the two backscatter rules to stop forged Message ID @@ -382,7 +382,8 @@ above techniques to recognize forgeries. </p> because there is a lot of variation in report formats. The following is only a small example of message header patterns. For a large collection of header and body patterns that recognize virus -notification email, see <a href="http://www.dkuug.dk/keld/virus/">http://www.dkuug.dk/keld/virus/</a> +notification email, see +<a href="https://web.archive.org/web/20100317123907/http://std.dkuug.dk/keld/virus/">https://web.archive.org/web/20100317123907/http://std.dkuug.dk/keld/virus/</a> or <a href="http://www.t29.dk/antiantivirus.txt">http://www.t29.dk/antiantivirus.txt</a>. </p> <blockquote> diff --git a/external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html b/external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html index 8d760c0975b..ccede706f06 100644 --- a/external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html +++ b/external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html @@ -7,7 +7,7 @@ <title> Postfix Basic Configuration </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -264,7 +264,7 @@ clients that send mail from outside an authorized network block. This is explained in the <a href="SASL_README.html">SASL_README</a> and <a href="TLS_README.html">TLS_README</a> documents. </p> <p> IMPORTANT: If your machine is connected to a wide area network -then the "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host" setting may be too friendly. </p> +then the "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" setting may be too friendly. </p> <p> Examples (specify only one of the following): </p> @@ -286,13 +286,15 @@ parameter value. <ul> -<li> <p> Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host" when Postfix should -forward mail from only the local machine. </p> +<li> <p> Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host" (the default when +<a href="postconf.5.html#compatibility_level">compatibility_level</a> ≥ 2) when Postfix should forward mail from +only the local machine. </p> -<li> <p> Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" (the default) when -Postfix should forward mail from SMTP clients in the same IP -subnetworks as the local machine. On Linux, this works correctly -only with interfaces specified with the "ifconfig" command. </p> +<li> <p> Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" (the default when +<a href="postconf.5.html#compatibility_level">compatibility_level</a> < 2) when Postfix should forward mail from +SMTP clients in the same IP subnetworks as the local machine. +On Linux, this works correctly only with interfaces specified +with the "ifconfig" or "ip" command. </p> <li> <p> Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" when Postfix should forward mail from SMTP clients in the same IP class A/B/C networks diff --git a/external/ibm-public/postfix/dist/html/BDAT_README.html b/external/ibm-public/postfix/dist/html/BDAT_README.html index b8feeeb144e..3cc1daf83b0 100644 --- a/external/ibm-public/postfix/dist/html/BDAT_README.html +++ b/external/ibm-public/postfix/dist/html/BDAT_README.html @@ -7,7 +7,7 @@ <title>Postfix BDAT (CHUNKING) support</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -20,7 +20,7 @@ BDAT (CHUNKING) support</h1> <h2>Overview </h2> -<p> Postfix SMTP server supports <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> CHUNKING (the BDAT command) +<p> Postfix SMTP server supports <a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a> CHUNKING (the BDAT command) without BINARYMIME, in both <a href="smtpd.8.html">smtpd(8)</a> and <a href="postscreen.8.html">postscreen(8)</a>. It is enabled by default. </p> @@ -51,7 +51,7 @@ globally: </p> # The logging alternative: <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> = chunking # The non-logging alternative: - <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> = chunking, silent_discard + <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> = chunking, silent-discard </pre> </blockquote> @@ -155,7 +155,7 @@ signatures, so conversion would have to happen before signing. </p> <h2> <a name="downsides">Downsides of CHUNKING (BDAT) support</a> </h2> -<p> The <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> authors did not specify any limitations on how +<p> The <a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a> authors did not specify any limitations on how clients may pipeline commands (i.e. send commands without waiting for a server response). If a server announces PIPELINING support, like Postfix does, then a remote SMTP client can pipeline all @@ -167,10 +167,10 @@ behavior. If you require "<a href="postconf.5.html#reject_unauth_pipelining">rej then turn off Postfix's CHUNKING announcement as described above. </p> -<p> In <a href="http://tools.ietf.org/html/rfc4468">RFC 4468</a>, the authors write that a client may pipeline +<p> In <a href="https://tools.ietf.org/html/rfc4468">RFC 4468</a>, the authors write that a client may pipeline commands, and that after sending BURL LAST or BDAT LAST, a client must wait for the server's response. But as this text does not -appear in <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> which defines BDAT, is it a useless restriction +appear in <a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a> which defines BDAT, it is a useless restriction that Postfix will not enforce. </p> </body> diff --git a/external/ibm-public/postfix/dist/html/BUILTIN_FILTER_README.html b/external/ibm-public/postfix/dist/html/BUILTIN_FILTER_README.html index 8550a985e04..3cd3dec89ce 100644 --- a/external/ibm-public/postfix/dist/html/BUILTIN_FILTER_README.html +++ b/external/ibm-public/postfix/dist/html/BUILTIN_FILTER_README.html @@ -7,7 +7,7 @@ <title>Postfix Built-in Content Inspection</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -222,9 +222,9 @@ header/body checks for mail to some domains only</a>". </p> <li> <p> Header/body checks do not decode message headers or message body content. For example, if text in the message body is BASE64 -encoded (<a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a>) then your regular expressions will have to match +encoded (<a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a>) then your regular expressions will have to match the BASE64 encoded form. Likewise, message headers with encoded -non-ASCII characters (<a href="http://tools.ietf.org/html/rfc2047">RFC 2047</a>) need to be matched in their encoded +non-ASCII characters (<a href="https://tools.ietf.org/html/rfc2047">RFC 2047</a>) need to be matched in their encoded form. </p> <li> <p> Header/body checks cannot filter on a combination of @@ -458,8 +458,8 @@ of duplication. </p> Postfix versions do not support the <a href="postconf.5.html#receive_override_options">receive_override_options</a> feature. </p> -<p> If you are MX service provider and want to apply disable -head/body checks for some domains, you can configure ONE Postfix +<p> If you are an MX service provider and want to enable header/body +checks only for some domains, you can configure ONE Postfix instance with multiple SMTP server IP addresses in <a href="master.5.html">master.cf</a>. Each address provides a different service. </p> diff --git a/external/ibm-public/postfix/dist/html/CDB_README.html b/external/ibm-public/postfix/dist/html/CDB_README.html index 6997a14076a..8676292e11f 100644 --- a/external/ibm-public/postfix/dist/html/CDB_README.html +++ b/external/ibm-public/postfix/dist/html/CDB_README.html @@ -7,7 +7,7 @@ <title>Postfix CDB Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html b/external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html index d527e1981a3..39ee716728f 100644 --- a/external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html +++ b/external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html @@ -7,7 +7,7 @@ <title>Postfix Backwards-Compatibility Safety Net</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -50,7 +50,7 @@ permanent in main.cf or master.cf, before <a href="#turnoff">turning off the backwards-compatibility safety net</a> as described at the end of this document. </p> -<p> The following messages may be logged: </p> +<p> Logged with <a href="postconf.5.html#compatibility_level">compatibility_level</a> < 1: </p> <ul> @@ -60,8 +60,14 @@ default setting append_dot_mydomain=yes </a> </p> <li> <p> <a href="#chroot"> Using backwards-compatible default setting chroot=y</a> </p> +</ul> + +<p> Logged with <a href="postconf.5.html#compatibility_level">compatibility_level</a> < 2: </p> + +<ul> + <li><p> <a href="#relay_restrictions"> Using backwards-compatible -default setting smtpd_relay_restrictions = (empty)</a> </p> +default setting "smtpd_relay_restrictions = (empty)"</a> </p> <li> <p> <a href="#mynetworks_style"> Using backwards-compatible default setting mynetworks_style=subnet </a> </p> @@ -74,6 +80,27 @@ default setting smtputf8_enable=no</a> </p> </ul> +<p> Logged with <a href="postconf.5.html#compatibility_level">compatibility_level</a> < 3.6: </p> + +<ul> + +<li> <p> <a href="#smtpd_digest"> Using backwards-compatible +default setting smtpd_tls_fingerprint_digest=md5</a> </p> + +<li> <p> <a href="#smtp_digest"> Using backwards-compatible +default setting smtp_tls_fingerprint_digest=md5</a> </p> + +<li> <p> <a href="#smtp_digest"> Using backwards-compatible +default setting lmtp_tls_fingerprint_digest=md5</a> </p> + +<li> <p> <a href="#relay_before_rcpt"> Using backwards-compatible +default setting smtpd_relay_before_recipient_restrictions=no</a> </p> + +<li> <p> <a href="#respectful_logging"> Using backwards-compatible +default setting respectful_logging=no</a> </p> + +</ul> + <p> If such a message is logged in the context of a legitimate request, the system administrator should make the backwards-compatible setting permanent in <a href="postconf.5.html">main.cf</a> or <a href="master.5.html">master.cf</a>, as detailed in the @@ -218,7 +245,7 @@ setting mynetworks_style=subnet</a> </h2> <p> The <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> default value has changed from "subnet" to "host". This parameter is used to implement the "<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>" -feature. The change could in unexpected 'access denied' errors after +feature. The change could cause unexpected 'access denied' errors after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises. </p> @@ -327,7 +354,7 @@ explicit list of domain names. </p> <h2> <a name="smtputf8_enable"> Using backwards-compatible default setting smtputf8_enable=no</a> </h2> -<p> The <a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> default value has changed from "no" to "yes. +<p> The <a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> default value has changed from "no" to "yes". With the new "yes" setting, the Postfix SMTP server rejects non-ASCII addresses from clients that don't request SMTPUTF8 support, after Postfix is updated from an older version. The backwards-compatibility @@ -366,6 +393,167 @@ in <a href="postconf.5.html">main.cf</a>: </pre> </blockquote> +<h2> <a name="smtpd_digest"> Using backwards-compatible +default setting smtpd_tls_fingerprint_digest=md5</a> </h2> + +<p> The <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> default value has changed from +"md5" to "sha256". With the new "sha256" setting, the Postfix SMTP +server avoids using the deprecated "md5" algorithm and computes a more +secure digest of the client certificate. </p> + +<p> If you're using the default "md5" setting, or even an explicit +"sha1" (also deprecated) setting, you should consider switching to +"sha256". This will require updating any associated lookup table keys +with the "sha256" digests of the expected client certificate or public +key. </p> + +<p> As long as the <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter is left at its +implicit default value, and the <a href="postconf.5.html#compatibility_level">compatibility_level</a> setting is less than +3.6, Postfix logs a warning each time a client certificate or public key +fingerprint is (potentially) used for access control: </p> + +<blockquote> +<pre> +postfix/smtpd[27560]: using backwards-compatible default setting + <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>=md5 to compute certificate fingerprints +</pre> +</blockquote> + +<p> Since any client certificate fingerprints are passed in policy service +lookups, and Postfix doesn't know whether the fingerprint will be used, the +warning may also be logged when policy lookups are performed for connections +that used a client certificate, even if the policy service does not in fact +examine the client certificate. To reduce the noise somewhat, such warnings +are issued at most once per <a href="smtpd.8.html">smtpd(8)</a> process instance. </p> + +<p> If you prefer to stick with "md5", you can suppress the warnings by +making that setting explicit. After addressing any other compatibility +warnings, you can <a href="#turnoff">update</a> your compatibility level. +</p> + +<blockquote> +<pre> +# <b>postconf <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>=md5</b> +# <b>postfix reload</b> +</pre> +</blockquote> + +<h2> <a name="smtp_digest"> Using backwards-compatible +default setting smtp_tls_fingerprint_digest=md5</a> </h2> + +<p> The <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> and <a href="postconf.5.html#lmtp_tls_fingerprint_digest">lmtp_tls_fingerprint_digest</a> +default values have changed from "md5" to "sha256". With the new +"sha256" setting, the Postfix SMTP and LMTP client avoids using the +deprecated "md5" algorithm and computes a more secure digest of the +server certificate. </p> + +<p> If you're using the default "md5" setting, or even an explicit +"sha1" (also deprecated) setting, you should consider switching to +"sha256". This will require updating any "fingerprint" security level +policies in the TLS policy table to specify matching "sha256" digests of +the expected server certificates or public keys. </p> + +<p> As long as the <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> (or LMTP equivalent) +parameter is left at its implicit default value, and the +<a href="postconf.5.html#compatibility_level">compatibility_level</a> setting is less than 3.6, Postfix logs a warning each +time the "fingerprint" security level is used to specify matching "md5" +digests of trusted server certificates or public keys: </p> + +<blockquote> +<pre> +postfix/smtp[27560]: using backwards-compatible default setting + <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>=md5 to compute certificate fingerprints +</pre> +</blockquote> + +<p> If you prefer to stick with "md5", you can suppress the warnings by +making that setting explicit. After addressing any other compatibility +warnings, you can <a href="#turnoff">update</a> your compatibility level. +</p> + +<blockquote> +<pre> +# <b>postconf '<a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5' \ + '<a href="postconf.5.html#lmtp_tls_fingerprint_digest">lmtp_tls_fingerprint_digest</a> = md5' </b> +# <b>postfix reload</b> +</pre> +</blockquote> + +<h2> <a name="relay_before_rcpt"> Using backwards-compatible +default setting smtpd_relay_before_recipient_restrictions=no</a> </h2> + +<p> The <a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a> feature was +introduced in Postfix version 3.6, to evaluate <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> +before <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. Historically, <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> +was evaluated after <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>, contradicting +documented behavior. </p> + +<blockquote> <p> Background: <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> is +primarily designed to enforce a mail relaying policy, while +<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> is primarily designed to enforce spam +blocking policy. Both are evaluated while replying to the RCPT TO +command, and both support the same features. </p> </blockquote> + +<p> To maintain compatibility with earlier versions, Postfix will +keep evaluating <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> before +<a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>, as long as the <a href="postconf.5.html#compatibility_level">compatibility_level</a> is +less than 3.6, and the <a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a> +parameter is left at its implicit default setting. As a reminder, +Postfix may log the following message: </p> + +<blockquote> +<pre> +postfix/smtpd[54696]: using backwards-compatible default setting + <a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a>=no to reject recipient + "user@example.com" from client "host.example.net[10.0.0.2]" +</pre> +</blockquote> + +<p> If Postfix should keep evaluating <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> +before <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>, then the system +administrator should make the backwards-compatible setting +"<a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a>=no" permanent in <a href="postconf.5.html">main.cf</a>: </p> + +<blockquote> +<pre> +# <b> postconf <a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a>=no </b> +# <b> postfix reload </b> +</pre> +</blockquote> + +<h2> <a name="respectful_logging"> Using backwards-compatible +default setting respectful_logging=no</a> </h2> + +<p> Postfix version 3.6 deprecates configuration parameter names and +logging that suggest white is better than black. Instead it prefers +'allowlist, 'denylist', and variations of those words. While the renamed +configuration parameters have backwards-compatible default values, +the changes in logging could affect logfile analysis tools. </p> + +<p> To avoid breaking existing logfile analysis tools, Postfix will keep +logging the deprecated form, as long as the <a href="postconf.5.html#respectful_logging">respectful_logging</a> parameter +is left at its implicit default value, and the <a href="postconf.5.html#compatibility_level">compatibility_level</a> +setting is less than 3.6. As a reminder, Postfix may log the following +when a remote SMTP client is allowlisted or denylisted: </p> + +<blockquote> +<pre> +postfix/postscreen[22642]: Using backwards-compatible default setting + <a href="postconf.5.html#respectful_logging">respectful_logging</a>=no for client [<i>address</i>]:<i>port</i> +</pre> +</blockquote> + +<p> If Postfix should keep logging the deprecated form, then the +system administrator should make the backwards-compatible setting +"<a href="postconf.5.html#respectful_logging">respectful_logging</a> = no" permanent in <a href="postconf.5.html">main.cf</a>. + +<blockquote> +<pre> +# <b>postconf "<a href="postconf.5.html#respectful_logging">respectful_logging</a> = no"</b> +# <b>postfix reload</b> +</pre> +</blockquote> + <h2> <a name="turnoff">Turning off the backwards-compatibility safety net</a> </h2> <p> Backwards compatibility is turned off by updating the @@ -390,6 +578,17 @@ warning: To disable backwards compatibility use "postconf <a href="postconf.5.ht <p> Sites that don't care about backwards compatibility may set "<a href="postconf.5.html#compatibility_level">compatibility_level</a> = 9999" at their own risk. </p> +<p> Starting with Postfix version 3.6, the compatibility level in +the above warning message is the Postfix version that introduced +the last incompatible change. The level is formatted as +<i>major.minor.patch</i>, where <i>patch</i> is usually omitted and +defaults to zero. Earlier compatibility levels are 0, 1 and 2. </p> + +<p> NOTE: Postfix 3.6 also introduces support for the "<level", +"<=level", and other operators to compare compatibility levels. +With the standard operators "<", "<=", etc., compatibility +level "3.10" would be smaller than "3.9" which is undesirable. </p> + </body> </html> diff --git a/external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html b/external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html index c2bf8b6faad..e18a05302f2 100644 --- a/external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html +++ b/external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html @@ -7,7 +7,7 @@ <title>Postfix Connection Cache </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -22,10 +22,6 @@ <p> This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later. </p> -<p> See <a href="TLS_README.html#client_tls_reuse">Client-side TLS -connection reuse</a> for how this connection cache is used to -implement multiple deliveries per TLS-encrypted connection. </p> - <p> Topics covered in this document: </p> <ul> @@ -49,8 +45,8 @@ you</a></h2> <p> With SMTP connection caching, Postfix can deliver multiple messages over the same SMTP connection. By default, Postfix 2.2 -reuses an SMTP connection automatically when a destination has -high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. </p> +reuses a plaintext SMTP connection automatically when a destination has +high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. </p> <p> SMTP Connection caching is a performance feature. Whether or not it actually improves performance depends on the conditions: </p> @@ -62,10 +58,15 @@ when delivering mail to a destination with multiple mail servers, because it can help Postfix to skip over a non-responding server. </p> +<li> <p> SMTP Connection caching can also help with receivers that +impose rate limits on new connections. </p> + <li> <p> Otherwise, the benefits of SMTP connection caching are minor: it eliminates the latency of the TCP handshake (SYN, SYN+ACK, ACK), plus the latency of the SMTP initial handshake (220 greeting, -EHLO command, EHLO response). +EHLO command, EHLO response). With TLS-encrypted connections, this +can save an additional two roundtrips that would otherwise be needed +to send STARTTLS and to resume a TLS session. </p> <li> <p> SMTP Connection caching gives no gains with respect to SMTP session tear-down. The Postfix <a href="smtp.8.html">smtp(8)</a> client normally does @@ -90,7 +91,7 @@ architecture <a href="OVERVIEW.html">OVERVIEW</a> document. </p> <p> The Postfix connection cache is shared among Postfix mail delivering processes. This maximizes the opportunity to reuse an -open connection. Other MTAs such as Sendmail or exim have a +open connection. Some MTAs such as Sendmail have a non-shared connection cache. Here, a connection can be reused only by the mail delivering process that creates the connection. To get the same performance improvement as with a shared connection cache, @@ -100,47 +101,84 @@ non-shared connections need to be kept open for a longer time. </p> maintains the shared connection cache. With Postfix version 2.2, only the <a href="smtp.8.html">smtp(8)</a> client has support to access this cache. </p> +<p> When SMTP connection caching is enabled (see next section), the +<a href="smtp.8.html">smtp(8)</a> client does not disconnect after a mail transaction, but +gives the connection to the <a href="scache.8.html">scache(8)</a> server which keeps the +connection open for a limited amount of time. </p> + +<p> After handing over the open connection to the <a href="scache.8.html">scache(8)</a> server, +the <a href="smtp.8.html">smtp(8)</a> client continues with some other mail delivery request. +Meanwhile, any <a href="smtp.8.html">smtp(8)</a> client process can ask the <a href="scache.8.html">scache(8)</a> server +for that cached connection and reuse it for mail delivery. </p> + <blockquote> <table> <tr> <td> </td> <td> <tt> /-- </tt> </td> <td align="center" colspan="3" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td colspan="2"> <tt> ---> </tt> Internet </td> </tr> +--> </tt> </td> <td> Internet </td> </tr> <tr> <td align="center" bgcolor="#f0f0ff"> <a href="qmgr.8.html">qmgr(8)</a> </td> <td> </td> -<td align="center" rowspan="3"> </td> <td align="center" -rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> <td> </td> +<td align="center" rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> </tr> + +<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" +colspan="4" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td align="left"> + </td> </tr> -<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" -colspan="2" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td align="left"> <tt> ---> </tt> Internet </td> </tr> - -<tr> <td colspan="3"> </td> <td align="center"><tt>^<br>|</tt></td> -<td> </td> </tr> +<tr> <td colspan="2"> </td> <td> </td> <td +align="center"><tt>^<br>|</tt></td> </tr> -<tr> <td colspan="3"> </td> <td align="center" colspan="3" +<tr> <td colspan="2"> </td> <td align="center" colspan="3" bgcolor="#f0f0ff"> <a href="scache.8.html">scache(8)</a> </td> </tr> </table> </blockquote> -<p> When SMTP connection caching is enabled (see next section), the -<a href="smtp.8.html">smtp(8)</a> client does not disconnect after a mail transaction, but -gives the connection to the <a href="scache.8.html">scache(8)</a> server which keeps the -connection open for a limited amount of time. </p> +<p> With TLS connection reuse (Postfix 3.4 and later), the Postfix +<a href="smtp.8.html">smtp(8)</a> client connects to a remote SMTP server and sends plaintext +EHLO and STARTTLS commands, then inserts a <a href="tlsproxy.8.html">tlsproxy(8)</a> process into +the connection as shown below. </p> -<p> After handing over the open connection to the <a href="scache.8.html">scache(8)</a> server, -the <a href="smtp.8.html">smtp(8)</a> client continues with some other mail delivery request. -Meanwhile, any <a href="smtp.8.html">smtp(8)</a> client process can ask the <a href="scache.8.html">scache(8)</a> server -for that cached connection and reuse it for mail delivery. </p> +<p> After delivering mail, the <a href="smtp.8.html">smtp(8)</a> client hands over the open +<a href="smtp.8.html">smtp(8)</a>-to-<a href="tlsproxy.8.html">tlsproxy(8)</a> connection to the <a href="scache.8.html">scache(8)</a> server, and +continues with some other mail delivery request. Meanwhile, any +<a href="smtp.8.html">smtp(8)</a> client process can ask the <a href="scache.8.html">scache(8)</a> server for that cached +connection and reuse it for mail delivery. </p> + +<blockquote> + +<table> + +<tr> <td> </td> <td> <tt> /-- </tt> </td> <td align="center" +colspan="3" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td colspan="2"> <tt> +--> </tt> </td> <td align="center"bgcolor="#f0f0ff"> <a href="tlsproxy.8.html">tlsproxy(8)</a> +</td> <td> <tt> --> </tt> </td> <td> Internet </td> </tr> + +<tr> <td align="center" bgcolor="#f0f0ff"> <a href="qmgr.8.html">qmgr(8)</a> </td> <td> </td> +<td align="center" rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> +</tr> + +<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" +colspan="4" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td align="left"> + </td> </tr> + +<tr> <td colspan="2"> </td> <td> </td> <td +align="center"><tt>^<br>|</tt></td> </tr> + +<tr> <td colspan="2"> </td> <td align="center" colspan="3" +bgcolor="#f0f0ff"> <a href="scache.8.html">scache(8)</a> </td> </tr> + +</table> + +</blockquote> <p> The connection cache can be searched by destination domain name (the right-hand side of the recipient address) and by the IP address of the host at the other end of the connection. This allows Postfix -to reuse a connection even when the remote host is mail server for +to reuse a connection even when the remote host is a mail server for domains with different names. </p> <h2><a name="configuration">Connection cache configuration </a></h2> @@ -209,6 +247,10 @@ lookups is ignored. </p> </blockquote> +<p> See <a href="TLS_README.html#client_tls_reuse">Client-side TLS +connection reuse</a> to enable multiple deliveries over a TLS-encrypted +connection (Postfix version 3.4 and later). </p> + </ul> <h2><a name="safety">Connection cache safety mechanisms </a></h2> diff --git a/external/ibm-public/postfix/dist/html/CONTENT_INSPECTION_README.html b/external/ibm-public/postfix/dist/html/CONTENT_INSPECTION_README.html index d44c54bcc42..f529c83a81f 100644 --- a/external/ibm-public/postfix/dist/html/CONTENT_INSPECTION_README.html +++ b/external/ibm-public/postfix/dist/html/CONTENT_INSPECTION_README.html @@ -7,7 +7,7 @@ <title>Postfix Content Inspection </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/DATABASE_README.html b/external/ibm-public/postfix/dist/html/DATABASE_README.html index fedb86230da..1305fdbe3ee 100644 --- a/external/ibm-public/postfix/dist/html/DATABASE_README.html +++ b/external/ibm-public/postfix/dist/html/DATABASE_README.html @@ -7,7 +7,7 @@ <title>Postfix Lookup Table Overview</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -98,7 +98,7 @@ lookup key exists. Any non-empty lookup result value may be used here: the lookup result is not used. Examples are the <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> that determine what local recipients Postfix accepts in mail from the network, the <a href="postconf.5.html#mydestination">mydestination</a> parameter -that specifies what domains Postfix delivers locally, or the +that specifies what domains Postfix delivers locally for, or the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter that specifies the IP addresses of trusted clients or client networks. Technically, these are lists, not tables. Despite the difference, Postfix lists are described here @@ -326,7 +326,7 @@ also the <a href="DATABASE_README.html#types">static</a>: map type. </dd> <dt> <b>internal</b> </dt> -<dd> A non-shared, in-memory hash table. Its content are lost when +<dd> A non-shared, in-memory hash table. Its contents are lost when a process terminates. </dd> <dt> <b>lmdb</b> </dt> diff --git a/external/ibm-public/postfix/dist/html/DB_README.html b/external/ibm-public/postfix/dist/html/DB_README.html index 2064d662c29..6cfd24f948d 100644 --- a/external/ibm-public/postfix/dist/html/DB_README.html +++ b/external/ibm-public/postfix/dist/html/DB_README.html @@ -7,7 +7,7 @@ <title>Postfix Berkeley DB Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -100,6 +100,10 @@ source code, use something like: </p> </pre> </blockquote> +<p> If your Berkeley DB shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-ldb". </p> + <p> Solaris needs this: </p> <blockquote> diff --git a/external/ibm-public/postfix/dist/html/DEBUG_README.html b/external/ibm-public/postfix/dist/html/DEBUG_README.html index f0dea38d0a0..a2cec547b19 100644 --- a/external/ibm-public/postfix/dist/html/DEBUG_README.html +++ b/external/ibm-public/postfix/dist/html/DEBUG_README.html @@ -7,7 +7,7 @@ <title> Postfix Debugging Howto </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -577,11 +577,11 @@ or 1000+ lines of <b>postconf</b> command output. </p> </ul> <li> <p> Better, provide output from the <b>postfinger</b> tool. -This can be found at <a href="http://ftp.wl0.org/SOURCES/postfinger">http://ftp.wl0.org/SOURCES/postfinger</a>. </p> +This can be found at <a href="https://github.com/ford--prefect/postfinger">https://github.com/ford--prefect/postfinger</a>. </p> <li> <p> If the problem is SASL related, consider including the output from the <b>saslfinger</b> tool. This can be found at -<a href="http://postfix.state-of-mind.de/patrick.koetter/saslfinger/">http://postfix.state-of-mind.de/patrick.koetter/saslfinger/</a>. </p> +<a href="https://packages.debian.org/search?keywords=sasl2-bin">https://packages.debian.org/search?keywords=sasl2-bin</a>. </p> <li> <p> If the problem is about too much mail in the queue, consider including output from the <b>qshape</b> tool, as described in the diff --git a/external/ibm-public/postfix/dist/html/DSN_README.html b/external/ibm-public/postfix/dist/html/DSN_README.html index 32ef928afff..ea50c09dabd 100644 --- a/external/ibm-public/postfix/dist/html/DSN_README.html +++ b/external/ibm-public/postfix/dist/html/DSN_README.html @@ -7,7 +7,7 @@ <title>Postfix DSN Support </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -21,7 +21,7 @@ DSN Support </h1> <h2>Introduction</h2> <p> Postfix version 2.3 introduces support for Delivery Status -Notifications as described in <a href="http://tools.ietf.org/html/rfc3464">RFC 3464</a>. This gives senders control +Notifications as described in <a href="https://tools.ietf.org/html/rfc3464">RFC 3464</a>. This gives senders control over successful and failed delivery notifications. </p> <p> Specifically, DSN support gives an email sender the ability to diff --git a/external/ibm-public/postfix/dist/html/ETRN_README.html b/external/ibm-public/postfix/dist/html/ETRN_README.html index d88c1652ff3..f1d728f3dbd 100644 --- a/external/ibm-public/postfix/dist/html/ETRN_README.html +++ b/external/ibm-public/postfix/dist/html/ETRN_README.html @@ -7,7 +7,7 @@ <title>Postfix ETRN Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/FILTER_README.html b/external/ibm-public/postfix/dist/html/FILTER_README.html index 5910669ae24..6eec9ab1d51 100644 --- a/external/ibm-public/postfix/dist/html/FILTER_README.html +++ b/external/ibm-public/postfix/dist/html/FILTER_README.html @@ -7,7 +7,7 @@ <title>Postfix After-Queue Content Filter </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -473,7 +473,7 @@ mail back into Postfix with SMTP on localhost port 10026. </p> <p> For non-SMTP capable content filtering software, Bennett Todd's SMTP proxy implements a nice PERL/SMTP content filtering framework. -See: <a href="http://bent.latency.net/smtpprox/">http://bent.latency.net/smtpprox/</a>. </p> +See: <a href="https://web.archive.org/web/20151022025756/http://bent.latency.net/smtpprox/">https://web.archive.org/web/20151022025756/http://bent.latency.net/smtpprox/</a>. </p> <p> In the figure below, names followed by a number represent Postfix commands or daemon programs. See the <a href="OVERVIEW.html">OVERVIEW</a> diff --git a/external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html b/external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html index 3bdb047f3fd..4fa0a029bd2 100644 --- a/external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html +++ b/external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html @@ -7,7 +7,7 @@ <title>TLS Forward Secrecy in Postfix</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -176,7 +176,7 @@ and is not recommended for now. </p> <h3> EDH Server support </h3> -<p> Postfix ≥ 2.2 support 1024-bit-prime EDH out of the box, +<p> Postfix ≥ 2.2 supports 1024-bit-prime EDH out of the box, with no additional configuration, but you may want to override the default prime to be 2048 bits long, and you may want to regenerate your primes periodically. See the <a href="#quick-start">quick-start</a> @@ -218,7 +218,7 @@ for the recommended configuration to work around this issue. </p> <h3> EECDH Server support </h3> -<p> Postfix ≥ 2.6 support NIST P-256 EECDH when built with OpenSSL +<p> Postfix ≥ 2.6 supports NIST P-256 EECDH when built with OpenSSL ≥ 1.0.0. When the remote SMTP client also supports EECDH and implements the P-256 curve, forward secrecy just works. </p> @@ -227,7 +227,7 @@ setting the <a href="postconf.5.html">main.cf</a> parameter <a href="postconf.5. </p> </blockquote> <p> The elliptic curve standards are evolving, with new curves -introduced in <a href="http://tools.ietf.org/html/rfc8031">RFC 8031</a> to augment or replace the NIST curves tarnished +introduced in <a href="https://tools.ietf.org/html/rfc8031">RFC 8031</a> to augment or replace the NIST curves tarnished by the Snowden revelations. Fortunately, TLS clients advertise their list of supported curves to the server so that servers can choose newer stronger curves when mutually supported. OpenSSL 1.0.2 @@ -334,7 +334,17 @@ for improved security against pre-computation attacks and for compatibility with Debian-patched Exim SMTP clients that require a ≥ 2048-bit length for the non-export prime. </p> -<p> Execute as root (prime group generation can take a +<p> With Postfix ≥ 3.7 built against OpenSSL version is 3.0.0 or later, when +the value of <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> is either empty or "<b>auto</b>", the +EDH parameter selection is delegated to the OpenSSL library, which selects +appropriate parameters based on the TLS handshake. This choice is likely to be +the most interoperable with SMTP clients using various TLS libraries, and +custom local parameters are no longer recommended when using Postfix ≥ 3.7 +built against OpenSSL 3.0.0. Just leave <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> at its +default value (both in <a href="postconf.5.html">main.cf</a>(5) and any <a href="master.5.html">master.cf</a>(5) overrides, and let +OpenSSL do the work. </p> + +<p> Otherwise, execute as root (prime group generation can take a few seconds to a few minutes): </p> <blockquote> @@ -350,7 +360,7 @@ few seconds to a few minutes): </p> <p> The Postfix SMTP server EDH parameter files are not secret, after all these parameters are sent to all remote SMTP clients in -the clear. Mode 0644 is fine. </p> +the clear. Mode 0644 is appropriate. </p> <p> You can improve security against pre-computation attacks further by regenerating the Postfix SMTP server EDH parameters periodically @@ -520,7 +530,7 @@ This pattern is likely to persist until some new key-exchange mechanism is invented that also supports forward secrecy. </p> <p> The actual key length and raw algorithm key length -are generally the same with non-export ciphers, but may they +are generally the same with non-export ciphers, but they may differ for the legacy export ciphers where the actual key is artificially shortened. </p> diff --git a/external/ibm-public/postfix/dist/html/IPV6_README.html b/external/ibm-public/postfix/dist/html/IPV6_README.html index 01810c08e14..acf24b9014c 100644 --- a/external/ibm-public/postfix/dist/html/IPV6_README.html +++ b/external/ibm-public/postfix/dist/html/IPV6_README.html @@ -7,7 +7,7 @@ <title>Postfix IPv6 Support</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -111,49 +111,22 @@ will use when it makes network connections. </p> <pre> /etc/postfix/<a href="postconf.5.html">main.cf</a>: # You must stop/start Postfix after changing this parameter. - <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4 (DEFAULT: enable IPv4 only) <a href="postconf.5.html#inet_protocols">inet_protocols</a> = all (enable IPv4, and IPv6 if supported) + <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4 (enable IPv4 only) <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4, ipv6 (enable both IPv4 and IPv6) <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv6 (enable IPv6 only) </pre> </blockquote> -<p> By default, Postfix uses IPv4 only, because most systems aren't -attached to an IPv6 network. </p> - -<ul> - -<li> <p> On systems with combined IPv4/IPv6 stacks, attempts to -deliver mail via IPv6 would always fail with "network unreachable", -and those attempts would only slow down Postfix. </p> - -<li> <p> Linux kernels don't even load IPv6 protocol support by -default. Any attempt to use it would fail immediately. </p> - -</ul> +<p> The default is compile-time dependent: "all" when Postfix is built +on a software distribution with IPv6 support, "ipv4" otherwise. </p> <p> Note 1: you must stop and start Postfix after changing the <a href="postconf.5.html#inet_protocols">inet_protocols</a> configuration parameter. </p> -<p> Note 2: if you see error messages like the following, then -you're running Linux and need to turn on IPv6 in the kernel: see -<a href="http://www.ipv6.org/">http://www.ipv6.org/</a> for hints and tips. Unlike other systems, -Linux does not have a combined stack for IPv4 and IPv6, and IPv6 -protocol support is not loaded by default. </p> - -<blockquote> -<pre> -postconf: warning: <a href="postconf.5.html#inet_protocols">inet_protocols</a>: IPv6 support is disabled: Address family not supported by protocol -postconf: warning: <a href="postconf.5.html#inet_protocols">inet_protocols</a>: configuring for IPv4 support only -</pre> -</blockquote> - -<p> Note 3: on older Linux and Solaris systems, the setting +<p> Note 2: on older Linux and Solaris systems, the setting "<a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv6" will not prevent Postfix from -accepting IPv4 connections. Postfix will present the client IP -addresses in IPv6 format, though. In all other cases, Postfix always -presents IPv4 client IP addresses in the traditional dotted quad -IPv4 format. </p> +accepting IPv4 connections. </p> <li> <p> The other new parameter is <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>. This sets the local interface address for outgoing IPv6 SMTP @@ -180,7 +153,7 @@ setting looks like: </p> </blockquote> <p> If you did specify the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter value in -<a href="postconf.5.html">main.cf</a>, you need update the <a href="postconf.5.html#mynetworks">mynetworks</a> value to include +<a href="postconf.5.html">main.cf</a>, you need to update the <a href="postconf.5.html#mynetworks">mynetworks</a> value to include the IPv6 networks the system is in. Be sure to specify IPv6 address information inside "<tt>[]</tt>", like this: </p> @@ -209,8 +182,8 @@ over IPv6 before trying IPv4. With more recent Postfix versions, the order of IPv6 versus IPv4 outgoing connection attempts is configurable with the <a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> parameter. </p> -<li> <p> Postfix versions before 2.6 do not support DNSBL (real-time -blackhole list) lookups for IPv6 client IP addresses. </p> +<li> <p> Postfix versions before 2.6 do not support DNSBL (DNS +blocklist) lookups for IPv6 client IP addresses. </p> <li> <p> IPv6 does not have class A, B, C, etc. networks. With IPv6 networks, the setting "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" has the @@ -249,13 +222,13 @@ receiving mail. </p> to listen on loopback network interfaces only. </p> <li> <p> The <a href="postconf.5.html#lmtp_bind_address">lmtp_bind_address</a> and <a href="postconf.5.html#lmtp_bind_address6">lmtp_bind_address6</a> -features were omitted. The Postfix LMTP client will be absorbed -into the SMTP client, so there is no reason to keep adding features +features were omitted. Postfix version 2.3 merged the LMTP client +into the SMTP client, so there was no reason to keep adding features to the LMTP client. </p> <li> <p> The SMTP server now requires that IPv6 addresses in SMTP commands are specified as [ipv6:<i>ipv6address</i>], as -described in <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. </p> +described in <a href="https://tools.ietf.org/html/rfc2821">RFC 2821</a>. </p> <li> <p> The IPv6 network address matching code was rewritten from the ground up, and is expected to be closer to the specification. diff --git a/external/ibm-public/postfix/dist/html/LDAP_README.html b/external/ibm-public/postfix/dist/html/LDAP_README.html index 5178b29b821..d019dba47e5 100644 --- a/external/ibm-public/postfix/dist/html/LDAP_README.html +++ b/external/ibm-public/postfix/dist/html/LDAP_README.html @@ -7,7 +7,7 @@ <title>Postfix LDAP Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -96,6 +96,10 @@ your Postfix source tree should work: </p> </pre> </blockquote> +<p> If your LDAP shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lldap". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of <a href="LDAP_README.html">AUXLIBS_LDAP</a>. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded LDAP database client, but only the new @@ -195,7 +199,7 @@ server listening at port 389 on ldap.example.com. It will bind anonymously, search for any directory entries whose mailacceptinggeneralid attribute is "ldapuser", read the "maildrop" attributes of those found, and build a list of their maildrops, which will be treated -as <a href="http://tools.ietf.org/html/rfc822">RFC822</a> addresses to which the message will be delivered. </p> +as <a href="https://tools.ietf.org/html/rfc822">RFC822</a> addresses to which the message will be delivered. </p> <h2><a name="example_virtual">Example: virtual domains/addresses</a></h2> @@ -529,7 +533,7 @@ query_filter = (&(mailacceptinggeneralid=%s)(!(|(maildrop="*|*")(maildrop="* </pre> </blockquote> -<li> <p> And for that matter, even for aliases, you may not want users able to +<li> <p> And for that matter, even for aliases, you may not want users to be able to specify their maildrops as programs, includes, etc. This might be particularly pertinent on a "sealed" server where they don't have local UNIX accounts, but exist only in LDAP and Cyrus. You might allow @@ -588,10 +592,10 @@ contents, please include the applicable bits of some directory entries. </p> <li>Prabhat K Singh: Wrote the initial Postfix LDAP lookups and connection caching. -<li>Keith Stevenson: <a href="http://tools.ietf.org/html/rfc2254">RFC 2254</a> escaping in queries. +<li>Keith Stevenson: <a href="https://tools.ietf.org/html/rfc2254">RFC 2254</a> escaping in queries. <li>Samuel Tardieu: Noticed that searches could include wildcards, prompting - the work on <a href="http://tools.ietf.org/html/rfc2254">RFC 2254</a> escaping in queries. Spotted a bug + the work on <a href="https://tools.ietf.org/html/rfc2254">RFC 2254</a> escaping in queries. Spotted a bug in binding. <li>Sami Haahtinen: Referral chasing and v3 support. diff --git a/external/ibm-public/postfix/dist/html/LINUX_README.html b/external/ibm-public/postfix/dist/html/LINUX_README.html index f06c1b4b3f6..0d5b0eef50a 100644 --- a/external/ibm-public/postfix/dist/html/LINUX_README.html +++ b/external/ibm-public/postfix/dist/html/LINUX_README.html @@ -7,7 +7,7 @@ <title>Postfix and Linux</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -20,10 +20,10 @@ <h2> Host lookup issues </h2> <p> By default Linux /etc/hosts lookups do not support multiple IP -address per hostname. This causes warnings from the Postfix SMTP +addresses per hostname. This causes warnings from the Postfix SMTP server that "hostname XXX does not resolve to address YYY", and is especially a problem with hosts that have both IPv4 and IPv6 -addresses. To fix, turn on support for multiple IP addresses: </p> +addresses. To fix this, turn on support for multiple IP addresses: </p> <blockquote> <pre> @@ -73,7 +73,7 @@ library routines. See the <a href="DB_README.html">DB_README</a> file for furth <p> On RedHat Linux 7.1 and later <b>procmail</b> no longer has permission -to write the mail spool directory. Workaround: </p> +to write to the mail spool directory. Workaround: </p> <blockquote> <pre> @@ -81,6 +81,13 @@ to write the mail spool directory. Workaround: </p> </pre> </blockquote> +<h2>Logging in a container</h2> + +<p> When running Postfix inside a container, you can use stdout +logging as described in <a href="MAILLOG_README.html">MAILLOG_README</a>. Alternatives: run syslogd +inside the container, or mount the host's syslog socket inside the +container. </p> + <h2>Syslogd performance</h2> <p> LINUX <b>syslogd</b> uses synchronous writes by default. Because @@ -99,6 +106,14 @@ logfile name: </p> <p> Send a "<b>kill -HUP</b>" to the <b>syslogd</b> to make the change effective. </p> +<h2>Other logging performance issues</h2> + +<p> LINUX <b>systemd</b> intercepts all logging and enforces its +own rate limits before handing off requests to a backend such as +<b>rsyslogd</b> or <b>syslog-ng</b>. On a busy mail server this can +result in information loss. As a workaround, you can use Postfix's +built-in logging as described in <a href="MAILLOG_README.html">MAILLOG_README</a>. </p> + </body> </html> diff --git a/external/ibm-public/postfix/dist/html/LMDB_README.html b/external/ibm-public/postfix/dist/html/LMDB_README.html index 6a598ed0e25..caf554304b7 100644 --- a/external/ibm-public/postfix/dist/html/LMDB_README.html +++ b/external/ibm-public/postfix/dist/html/LMDB_README.html @@ -7,7 +7,7 @@ <title>Postfix OpenLDAP LMDB Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -55,6 +55,10 @@ build Postfix with LMDB support, use something like: </p> </pre> </blockquote> +<p> If your LMDB shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-llmdb". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of <a href="LMDB_README.html">AUXLIBS_LMDB</a>. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded LMDB database client, but only the new diff --git a/external/ibm-public/postfix/dist/html/LOCAL_RECIPIENT_README.html b/external/ibm-public/postfix/dist/html/LOCAL_RECIPIENT_README.html index 3f2e0420038..2b571f0ba7d 100644 --- a/external/ibm-public/postfix/dist/html/LOCAL_RECIPIENT_README.html +++ b/external/ibm-public/postfix/dist/html/LOCAL_RECIPIENT_README.html @@ -7,7 +7,7 @@ <title>Rejecting Unknown Local Recipients with Postfix</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/MAILDROP_README.html b/external/ibm-public/postfix/dist/html/MAILDROP_README.html index e2e09f62fb5..aa2d7946a73 100644 --- a/external/ibm-public/postfix/dist/html/MAILDROP_README.html +++ b/external/ibm-public/postfix/dist/html/MAILDROP_README.html @@ -7,7 +7,7 @@ <title>Postfix + Maildrop Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -85,7 +85,7 @@ becoming clogged with undeliverable messages. Specify an empty value ("<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> =") to disable this feature. </p> <li> <p> Lines 6 and 13-15 redirect mail for postmaster to the -local postmaster. <a href="http://tools.ietf.org/html/rfc821">RFC 821</a> requires that every domain has a postmaster +local postmaster. <a href="https://tools.ietf.org/html/rfc821">RFC 821</a> requires that every domain has a postmaster address. </p> </ul> diff --git a/external/ibm-public/postfix/dist/html/MAILLOG_README.html b/external/ibm-public/postfix/dist/html/MAILLOG_README.html index aa371ba26cd..32e33677e45 100644 --- a/external/ibm-public/postfix/dist/html/MAILLOG_README.html +++ b/external/ibm-public/postfix/dist/html/MAILLOG_README.html @@ -7,7 +7,7 @@ <title>Postfix logging to file or stdout</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -129,7 +129,7 @@ program is configured with the <a href="postconf.5.html#maillog_file_compressor" <ul> -<li> <p> This command will not rotate a logfile with pathname under +<li> <p> This command will not rotate a logfile with a pathname under the /dev directory, such as /dev/stdout. </p> <li> <p> This command does not (yet) remove old logfiles. </p> @@ -146,7 +146,7 @@ the /dev directory, such as /dev/stdout. </p> in the background, as well as non-daemon programs for local mail submission or Postfix management. -<li> <p> Logging to Postfix logfile or stdout requires the Postfix +<li> <p> Logging to the Postfix logfile or stdout requires the Postfix <a href="postlogd.8.html">postlogd(8)</a> service. This ensures that simultaneous logging from different programs will not get mixed up. </p> diff --git a/external/ibm-public/postfix/dist/html/MEMCACHE_README.html b/external/ibm-public/postfix/dist/html/MEMCACHE_README.html index 59b62152e0e..a57a9eb0893 100644 --- a/external/ibm-public/postfix/dist/html/MEMCACHE_README.html +++ b/external/ibm-public/postfix/dist/html/MEMCACHE_README.html @@ -7,7 +7,7 @@ <title>Postfix memcache client Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/MILTER_README.html b/external/ibm-public/postfix/dist/html/MILTER_README.html index 537ebbe8c44..1c0ecae3e6e 100644 --- a/external/ibm-public/postfix/dist/html/MILTER_README.html +++ b/external/ibm-public/postfix/dist/html/MILTER_README.html @@ -7,7 +7,7 @@ <title>Postfix before-queue Milter support </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -309,7 +309,8 @@ from other Milter applications. </p> <dt> <b>unix:</b><i>pathname</i> </dt> <dd><p>Connect to the local UNIX-domain server that is bound to the specified pathname. If the <a href="smtpd.8.html">smtpd(8)</a> or <a href="cleanup.8.html">cleanup(8)</a> process runs chrooted, an absolute pathname -is interpreted relative to the Postfix queue directory.</p> </dd> +is interpreted relative to the Postfix queue directory. On many +systems, <b>local</b> is a synonym for <b>unix</b></p> </dd> <dt> <b> inet:</b><i>host</i><b>:</b><i>port</i> </dt> <dd> <p> Connect to the specified TCP port on the specified local or remote @@ -758,7 +759,7 @@ transaction (for example; queue ID, sender, or recipient). </p> you may specify macro default values with the <a href="postconf.5.html#milter_macro_defaults">milter_macro_defaults</a> parameter. Specify zero or more <i>name=value</i> pairs separated by comma or whitespace; you may even specify macro names that Postfix does -know about! </p> +not know about! </p> <h2><a name="workarounds">Workarounds</a></h2> diff --git a/external/ibm-public/postfix/dist/html/MULTI_INSTANCE_README.html b/external/ibm-public/postfix/dist/html/MULTI_INSTANCE_README.html index 39fc87da10c..da8d801be1c 100644 --- a/external/ibm-public/postfix/dist/html/MULTI_INSTANCE_README.html +++ b/external/ibm-public/postfix/dist/html/MULTI_INSTANCE_README.html @@ -7,7 +7,7 @@ <title>Managing multiple Postfix instances on a single host</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -259,7 +259,7 @@ EOF </pre> </blockquote> -<p> The test message should be delivered the members of the "mtaadmin" +<p> The test message should be delivered to the members of the "mtaadmin" address group (or whatever address group you choose) with the following headers: </p> @@ -378,7 +378,7 @@ post-filter re-injection SMTP service. Typical additions include: </p> <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> = <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, reject - # Tolerate occasional high latency in the content filter. + # Tolerate occasional high latency in the content filter. # <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> = 1200s @@ -637,7 +637,7 @@ of any users, including the $<a href="postconf.5.html#mail_owner">mail_owner</a> <li><p> The <a href="postconf.5.html">main.cf</a>, <a href="master.5.html">master.cf</a> (and other optional) configuration files in $<a href="postconf.5.html#config_directory">config_directory</a>. </p> -<li> <p> The <a href="QSHAPE_README.html#maildrop_queue">maildrop</a>, incoming, active, deferred and <a href="QSHAPE_README.html#hold_queue">hold queues</a> +<li> <p> The <a href="QSHAPE_README.html#maildrop_queue">maildrop</a>, <a href="QSHAPE_README.html#incoming_queue">incoming</a>, active, deferred and <a href="QSHAPE_README.html#hold_queue">hold queues</a> in $<a href="postconf.5.html#queue_directory">queue_directory</a> (which contains additional directories needed by Postfix, and which optionally doubles as a chroot jail for Postfix daemon processes). </p> diff --git a/external/ibm-public/postfix/dist/html/MYSQL_README.html b/external/ibm-public/postfix/dist/html/MYSQL_README.html index 06a84aa3bfd..147802f0dd0 100644 --- a/external/ibm-public/postfix/dist/html/MYSQL_README.html +++ b/external/ibm-public/postfix/dist/html/MYSQL_README.html @@ -7,7 +7,7 @@ <title>Postfix MySQL Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -46,8 +46,7 @@ There is no need to recompile Postfix. </p> which can be obtained from: </p> <blockquote> - <p> <a href="http://www.mysql.com/downloads/">http://www.mysql.com/downloads/</a> <br> - <a href="http://sourceforge.net/projects/mysql/">http://sourceforge.net/projects/mysql/</a> </p> + <p> <a href="http://www.mysql.com/downloads/">http://www.mysql.com/downloads/</a> </p> </blockquote> <p> In order to build Postfix with mysql map support, you will need to add @@ -62,6 +61,10 @@ make -f Makefile.init makefiles \ </pre> </blockquote> +<p> If your MySQL shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lmysqlclient". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of <a href="MYSQL_README.html">AUXLIBS_MYSQL</a>. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded MySQL database client, but only the new @@ -174,7 +177,7 @@ Marcus, IC Group, Inc.</li> <li> Liviu Daia with further refinements from Jose Luis Tallon and Victor Duchovni developed the common query, result_format, domain and -expansion_limit interface for LDAP, MySQL and PosgreSQL.</li> +expansion_limit interface for LDAP, MySQL and PostgreSQL.</li> </ul> diff --git a/external/ibm-public/postfix/dist/html/NFS_README.html b/external/ibm-public/postfix/dist/html/NFS_README.html index fdbd0fdc55a..5de5e73f8e3 100644 --- a/external/ibm-public/postfix/dist/html/NFS_README.html +++ b/external/ibm-public/postfix/dist/html/NFS_README.html @@ -7,7 +7,7 @@ <title>Postfix and NFS</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/OVERVIEW.html b/external/ibm-public/postfix/dist/html/OVERVIEW.html index 1393e26d03a..42ae04e917b 100644 --- a/external/ibm-public/postfix/dist/html/OVERVIEW.html +++ b/external/ibm-public/postfix/dist/html/OVERVIEW.html @@ -7,7 +7,7 @@ <title>Postfix Architecture Overview </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -561,21 +561,59 @@ about this feature is in the <a href="CONNECTION_CACHE_README.html">CONNECTION_C <tr> <td> </td> <td> <tt> /-- </tt> </td> <td align="center" colspan="3" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td colspan="2"> <tt> ---> </tt> Internet </td> </tr> - +--> </tt> </td> <td> Internet </td> </tr> + <tr> <td align="center" bgcolor="#f0f0ff"> <a href="qmgr.8.html">qmgr(8)</a> </td> <td> </td> -<td align="center" rowspan="3"> </td> <td align="center" -rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> <td> </td> +<td align="center" rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> </tr> -<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" -colspan="2" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td align="left"> <tt> ---> </tt> Internet </td> </tr> - -<tr> <td colspan="3"> </td> <td align="center"><tt>^<br>|</tt></td> -<td> </td> </tr> +<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" +colspan="4" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td align="left"> + </td> </tr> + +<tr> <td colspan="2"> </td> <td> </td> <td +align="center"><tt>^<br>|</tt></td> </tr> + +<tr> <td colspan="2"> </td> <td align="center" colspan="3" +bgcolor="#f0f0ff"> <a href="scache.8.html">scache(8)</a> </td> </tr> + +</table> + +<p> A Postfix <a href="smtp.8.html">smtp(8)</a> client can reuse a TLS-encrypted connection +(with "<a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> = yes"). This can greatly reduce +the overhead of connection setup and improves message delivery +rates. After a Postfix <a href="smtp.8.html">smtp(8)</a> client connects to a remote SMTP +server and sends plaintext EHLO and STARTTLS commands, the <a href="smtp.8.html">smtp(8)</a> +client inserts a <a href="tlsproxy.8.html">tlsproxy(8)</a> process into the connection as shown +below. </p> + +<p> After the mail transaction completes, the Postfix <a href="smtp.8.html">smtp(8)</a> client +gives the <a href="smtp.8.html">smtp(8)</a>-to-<a href="tlsproxy.8.html">tlsproxy(8)</a> connection to the <a href="scache.8.html">scache(8)</a> +server, which keeps the connection open for a limited amount of +time. The <a href="smtp.8.html">smtp(8)</a> client continues with some other mail delivery +request. Meanwhile, any Postfix <a href="smtp.8.html">smtp(8)</a> client can ask the <a href="scache.8.html">scache(8)</a> +server for that cached connection and reuse it for mail delivery. +</p> + +<table> + +<tr> <td> </td> <td> <tt> /-- </tt> </td> <td align="center" +colspan="3" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td colspan="2"> <tt> +--> </tt> </td> <td align="center"bgcolor="#f0f0ff"> <a href="tlsproxy.8.html">tlsproxy(8)</a> +</td> <td> <tt> --> </tt> </td> <td> Internet </td> </tr> + +<tr> <td align="center" bgcolor="#f0f0ff"> <a href="qmgr.8.html">qmgr(8)</a> </td> <td> </td> +<td align="center" rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> +</tr> -<tr> <td colspan="3"> </td> <td align="center" colspan="3" +<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" +colspan="4" bgcolor="#f0f0ff"> <a href="smtp.8.html">smtp(8)</a> </td> <td align="left"> + </td> </tr> + +<tr> <td colspan="2"> </td> <td> </td> <td +align="center"><tt>^<br>|</tt></td> </tr> + +<tr> <td colspan="2"> </td> <td align="center" colspan="3" bgcolor="#f0f0ff"> <a href="scache.8.html">scache(8)</a> </td> </tr> </table> @@ -737,50 +775,94 @@ those numbers were 92% and 95%, respectively. While <a href="postscreen.8.html" keeps the zombies away, more <a href="smtpd.8.html">smtpd(8)</a> processes remain available for legitimate clients. </p> -<p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for clients that -pass its tests; by allowing whitelisted clients to skip tests, +<p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for clients that +pass its tests; by allowing allowlisted clients to skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. </p> <p> The <a href="postscreen.8.html">postscreen(8)</a> server is available with Postfix 2.8 and later. To keep the implementation simple, <a href="postscreen.8.html">postscreen(8)</a> delegates -DNS white/blacklist lookups to <a href="dnsblog.8.html">dnsblog(8)</a> server processes, and +DNS allow/denylist lookups to <a href="dnsblog.8.html">dnsblog(8)</a> server processes, and delegates TLS encryption/decryption to <a href="tlsproxy.8.html">tlsproxy(8)</a> server processes. -This delegation is invisible to the remote SMTP client, and is not -shown in the diagram below. </p> +This delegation is invisible to the remote SMTP client. </p> <table> -<tr> <td> zombie </td> </tr> +<tr> <td colspan="2"> </td> <td align="center"> zombie </td> </tr> -<tr> <td> </td> <td align="left"> <tt> \ </tt> </td> </tr> +<tr> <td colspan="3"> </td> <td align="left"> <tt> \ </tt> </td> </tr> -<tr> <td> zombie </td> <td align="left"> <tt> - </tt> </td> <td> +<tr> <td> zombie </td> <td> <tt> - </tt> </td> <td bgcolor="#f0f0ff" align="center"> <a href="tlsproxy.8.html">tlsproxy(8)</a> </td> <td align="left"> <tt> - </tt> </td> <td> </td> <td> </td> <td> </td> <td align="right"> <tt> - </tt> </td> <td bgcolor="#f0f0ff" align="center"> <a href="smtpd.8.html">smtpd(8)</a> </td> </tr> -<tr> <td> </td> <td align="right"> <tt> \ </tt> </td> <td> </td> +<tr> <td colspan="3"> </td> <td align="right"> <tt> \ </tt> </td> <td> </td> <td align="left"> <tt> / </tt> </td> </tr> -<tr> <td bgcolor="#f0f0ff" align="center"> other </td> <td> <tt> +<tr> <td colspan="2"> </td> <td bgcolor="#f0f0ff" align="center"> other </td> <td> <tt> --- </tt> </td> <td bgcolor="#f0f0ff" align="center" valign="middle"> <a href="postscreen.8.html">postscreen(8)</a> </td> </tr> -<tr> <td> </td> <td align="right"> <tt> / </tt> </td> <td> </td> +<tr> <td colspan="3"> </td> <td align="right"> <tt> / </tt> </td> <td> </td> <td align="right"> <tt> \ </tt> </td> </tr> -<tr> <td bgcolor="#f0f0ff" align="center"> other </td> <td align="left"> +<tr> <td colspan="2"> </td> <td bgcolor="#f0f0ff" align="center"> other </td> <td align="left"> <tt> - </tt> </td> <td> </td> <td> </td> <td> </td> <td align="right"> <tt> - </tt> </td> <td bgcolor="#f0f0ff" align="center"> <a href="smtpd.8.html">smtpd(8)</a> </td> </tr> -<tr> <td> </td> <td align="left"> <tt> / </tt> </td> </tr> +<tr> <td colspan="3"> </td> <td align="left"> <tt> / </tt> </td> </tr> -<tr> <td> zombie </td> </tr> +<tr> <td colspan="2"> </td> <td align="center"> zombie </td> </tr> +</table> + +<li> <p>The <a href="postlogd.8.html">postlogd(8)</a> server provides an alternative to syslog +logging, which remains the default. This feature is available with +Postfix version 3.4 or later, and supports the following modes: +</p> + + +<ul> + +<li> <p>Logging to file, which addresses a usability problem with +MacOS, and eliminates information loss caused by systemd rate limits. +</p> + +<table> + +<tr> <td bgcolor="#f0f0ff" rowspan="3" valign="middle" align="center"> +commands<br>or daemons</td> <td colspan="4"> </td> </tr> + +<tr> <td colspan="2"> <td> <tt> -> </tt> </td> <td bgcolor="#f0f0ff"> +<a href="postlogd.8.html">postlogd(8)</a> </td> <td> <tt> -> </tt> </td> <td> /path/to/file +</td> </tr> + +<tr> <td colspan=6> </td> </tr> </table> +<li> <p>Logging to stdout, which eliminates a syslog dependency +when Postfix runs inside a container. </p> + +<table> + +<tr> <td bgcolor="#f0f0ff" rowspan="3" valign="middle" align="center"> +commands<br>or daemons</td> <td colspan="4"> </td> <td +rowspan="3" align="center"> stdout inherited<br>from "postfix +start-fg" </td> </tr> + +<tr> <td colspan="2"> <tt> -> </tt> </td> <td bgcolor="#f0f0ff"> +<a href="postlogd.8.html">postlogd(8)</a> </td> <td> <tt> -> </tt> </td> </tr> + +<tr> <td colspan=5> </td> </tr> + +</table> + +</ul> + +<p> See <a href="MAILLOG_README.html">MAILLOG_README</a> for details and limitations. </p> + </ul> <h2> <a name="commands"> Postfix support commands </a> </h2> diff --git a/external/ibm-public/postfix/dist/html/PACKAGE_README.html b/external/ibm-public/postfix/dist/html/PACKAGE_README.html index c1f6ea84030..6a290ea5271 100644 --- a/external/ibm-public/postfix/dist/html/PACKAGE_README.html +++ b/external/ibm-public/postfix/dist/html/PACKAGE_README.html @@ -7,7 +7,7 @@ <title>Guidelines for Package Builders</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/PCRE_README.html b/external/ibm-public/postfix/dist/html/PCRE_README.html index 817bbb892c2..0a89dfbda4e 100644 --- a/external/ibm-public/postfix/dist/html/PCRE_README.html +++ b/external/ibm-public/postfix/dist/html/PCRE_README.html @@ -7,7 +7,7 @@ <title>Postfix PCRE Support</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -30,39 +30,56 @@ expression implementation that you find on many systems. </p> is given in the <a href="pcre_table.5.html">pcre_table(5)</a> manual page. Information about PCRE itself can be found at <a href="http://www.pcre.org/">http://www.pcre.org/</a>. </p> -<h2>Building Postfix with PCRE support</h2> +<h2>Using Postfix packages with PCRE support</h2> -<p> These instructions assume that you build Postfix from source -code as described in the <a href="INSTALL.html">INSTALL</a> document. Some modification may -be required if you build Postfix from a vendor-specific source -package. </p> - -<p> Note: to use pcre with Debian GNU/Linux's Postfix, all you +<p> To use pcre with Debian GNU/Linux's Postfix, or with Fedora or +RHEL Postfix, all you need is to install the postfix-pcre package and you're done. There is no need to recompile Postfix. </p> -<p> In some future, Postfix will have a plug-in interface for adding -map types. Until then, you need to compile PCRE support into Postfix. -</p> +<h2>Building Postfix from source with PCRE support</h2> -<p> First of all, you need the PCRE library (Perl Compatible Regular -Expressions), which can be obtained from: </p> +<p> These instructions assume that you build Postfix from source +code as described in the <a href="INSTALL.html">INSTALL</a> document. </p> -<blockquote> -<a href="ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/">ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/</a>. +<p> To build Postfix from source with pcre support, you need a pcre +library. Install a vendor package, or download the source code from +locations in <a href="https://www.pcre.org/">https://www.pcre.org/</a> and build that yourself. + +<p> Postfix can build with the pcre2 library or the legacy pcre +library. It's probably easiest to let the Postfix build procedure +pick one. The following commands will first discover if the pcre2 +library is installed, and if that is not available, will discover +if the legacy pcre library is installed. </p> + +<blockquote> +<pre> +$ make -f Makefile.init makefiles +$ make +</pre> </blockquote> -<p> NOTE: pcre versions prior to 2.06 cannot be used. </p> +<p> To build Postfix explicitly with a pcre2 library (Postfix 3.7 +and later): </p> + +<blockquote> +<pre> +$ make -f Makefile.init makefiles \ + "CCARGS=-DHAS_PCRE=2 `pcre2-config --cflags`" \ + "<a href="PCRE_README.html">AUXLIBS_PCRE</a>=`pcre2-config --libs8`" +$ make +</pre> +</blockquote> -<p> In order to build Postfix with PCRE support you need to add --DHAS_PCRE and a -I option for the PCRE include file to CCARGS, and -add the path to the PCRE library to <a href="PCRE_README.html">AUXLIBS_PCRE</a>, for example: </p> +<p> To build Postfix explicitly with a legacy pcre library (all +Postfix versions): </p> <blockquote> <pre> -make -f Makefile.init makefiles \ - "CCARGS=-DHAS_PCRE `pcre-config --cflags`" \ +$ make -f Makefile.init makefiles \ + "CCARGS=-DHAS_PCRE=1 `pcre-config --cflags`" \ "<a href="PCRE_README.html">AUXLIBS_PCRE</a>=`pcre-config --libs`" +$ make </pre> </blockquote> diff --git a/external/ibm-public/postfix/dist/html/PGSQL_README.html b/external/ibm-public/postfix/dist/html/PGSQL_README.html index b0a66b792c1..98741395a92 100644 --- a/external/ibm-public/postfix/dist/html/PGSQL_README.html +++ b/external/ibm-public/postfix/dist/html/PGSQL_README.html @@ -7,7 +7,7 @@ <title>Postfix PostgreSQL Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -57,6 +57,10 @@ the location of the libpq library file. </p> </pre> </blockquote> +<p> If your PostgreSQL shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lpq". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of <a href="PGSQL_README.html">AUXLIBS_PGSQL</a>. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded PostgreSQL database client, but only diff --git a/external/ibm-public/postfix/dist/html/POSTSCREEN_3_5_README.html b/external/ibm-public/postfix/dist/html/POSTSCREEN_3_5_README.html new file mode 100644 index 00000000000..d26c6d6d8ad --- /dev/null +++ b/external/ibm-public/postfix/dist/html/POSTSCREEN_3_5_README.html @@ -0,0 +1,1198 @@ +<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" + "http://www.w3.org/TR/html4/loose.dtd"> + +<head> + +<title>Postfix Postscreen Howto (Postfix 2.8 - 3.5)</title> + +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> + +</head> + +<body> + +<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto (Postfix 2.8 - 3.5)</h1> + +<hr> + +<h2> <a name="intro">Introduction</a> </h2> + +<p> This document describes features that are available in Postfix +2.8 - 3.5. </p> + +<p> The Postfix <a href="postscreen.8.html">postscreen(8)</a> daemon provides additional protection +against mail server overload. One <a href="postscreen.8.html">postscreen(8)</a> process handles +multiple inbound SMTP connections, and decides which clients may +talk to a Postfix SMTP server process. By keeping spambots away, +<a href="postscreen.8.html">postscreen(8)</a> leaves more SMTP server processes available for +legitimate clients, and delays the onset of <a +href="STRESS_README.html">server overload</a> conditions. </p> + +<p> <a href="postscreen.8.html">postscreen(8)</a> should not be used on SMTP ports that receive +mail from end-user clients (MUAs). In a typical deployment, +<a href="postscreen.8.html">postscreen(8)</a> handles the MX service on TCP port 25, while MUA +clients submit mail via the submission service on TCP port 587 which +requires client authentication. Alternatively, a site could set up +a dedicated, non-postscreen, "port 25" server that provides submission +service and client authentication, but no MX service. </p> + +<p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for clients that +pass its tests; by allowing allowlisted clients to skip tests, +<a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. +</p> + +<p> <a href="postscreen.8.html">postscreen(8)</a> is part of a multi-layer defense. <p> + +<ul> + +<li> <p> As the first layer, <a href="postscreen.8.html">postscreen(8)</a> blocks connections from +zombies and other spambots that are responsible for about 90% of +all spam. It is implemented as a single process to make this defense +as inexpensive as possible. </p> + +<li> <p> The second layer implements more complex SMTP-level access +checks with <a href="SMTPD_ACCESS_README.html">Postfix SMTP servers</a>, +<a href="SMTPD_POLICY_README.html">policy daemons</a>, and +<a href="MILTER_README.html">Milter applications</a>. </p> + +<li> <p> The third layer performs light-weight content inspection +with the Postfix built-in <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. This can +block unacceptable attachments such as executable programs, and +worms or viruses with easy-to-recognize signatures. </p> + +<li> <p> The fourth layer provides heavy-weight content inspection +with external content filters. Typical examples are <a +href="http://www.ijs.si/software/amavisd/">Amavisd-new</a>, <a +href="http://spamassassin.apache.org/">SpamAssassin</a>, and <a +href="MILTER_README.html">Milter applications</a>. </p> + +</ul> + +<p> Each layer reduces the spam volume. The general strategy is to +use the less expensive defenses first, and to use the more expensive +defenses only for the spam that remains. </p> + +<p> Topics in this document: </p> + +<ul> + +<li> <a href="#intro">Introduction</a> + +<li> <a href="#basic">The basic idea behind postscreen(8)</a> + +<li> <a href="#general"> General operation </a> + +<li> <a href="#quick">Quick tests before everything else</a> + +<li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> + +<li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> + +<li> <a href="#other_error">Other errors</a> + +<li> <a href="#victory">When all tests succeed</a> + +<li> <a href="#config"> Configuring the postscreen(8) service</a> + +<li> <a href="#historical"> Historical notes and credits </a> + +</ul> + +<h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> + +<p> Most email is spam, and most spam is sent out by zombies (malware +on compromised end-user computers). Wietse expects that the zombie +problem will get worse before things improve, if ever. Without a +tool like <a href="postscreen.8.html">postscreen(8)</a> that keeps the zombies away, Postfix would be +spending most of its resources not receiving email. </p> + +<p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-a-zombie +decision based on a single measurement. This is necessary because +many zombies try to fly under the radar and avoid spamming the same +site repeatedly. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client is +not-a-zombie, it allowlists the client temporarily to avoid further +delays for legitimate mail. </p> + +<p> Zombies have challenges too: they have only a limited amount +of time to deliver spam before their IP address becomes denylisted. +To speed up spam deliveries, zombies make compromises in their SMTP +protocol implementation. For example, they speak before their turn, +or they ignore responses from SMTP servers and continue sending +mail even when the server tells them to go away. </p> + +<p> <a href="postscreen.8.html">postscreen(8)</a> uses a variety of measurements to recognize +zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client +IP address is denylisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol +compromises that are made to speed up delivery. These are good +indicators for making is-a-zombie decisions based on single +measurements. </p> + +<p> <a href="postscreen.8.html">postscreen(8)</a> does not inspect message content. Message content +can vary from one delivery to the next, especially with clients +that (also) send legitimate email. Content is not a good indicator +for making is-a-zombie decisions based on single measurements, +and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is focused on. </p> + +<h2> <a name="general"> General operation </a> </h2> + +<p> For each connection from an SMTP client, <a href="postscreen.8.html">postscreen(8)</a> performs +a number of tests +in the order as described below. Some tests introduce a delay of +a few seconds. <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for +clients that pass its tests; by allowing allowlisted clients to +skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email +traffic. </p> + +<p> By default, <a href="postscreen.8.html">postscreen(8)</a> hands off all connections to a Postfix +SMTP server process after logging its findings. This mode is useful +for non-destructive testing. </p> + +<p> In a typical production setting, <a href="postscreen.8.html">postscreen(8)</a> is configured +to reject mail from clients that fail one or more tests, after +logging the helo, sender and recipient information. </p> + +<p> Note: <a href="postscreen.8.html">postscreen(8)</a> is not an SMTP proxy; this is intentional. +The purpose is to keep zombies away from Postfix, with minimal +overhead for legitimate clients. </p> + +<h2> <a name="quick">Quick tests before everything else</a> </h2> + +<p> Before engaging in SMTP-level tests. <a href="postscreen.8.html">postscreen(8)</a> queries a +number of local deny and allowlists. These tests speed up the +handling of known clients. </p> + +<ul> + +<li> <a href="#perm_white_black"> Permanent allow/denylist test </a> + +<li> <a href="#temp_white"> Temporary allowlist test </a> + +<li> <a href="#white_veto"> MX Policy test </a> + +</ul> + +<h3> <a name="perm_white_black"> Permanent allow/denylist test </a> </h3> + +<p> The <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>) +specifies a permanent access list for SMTP client IP addresses. Typically +one would specify something that allowlists local networks, followed +by a CIDR table for selective allow- and denylisting. </p> + +<p> Example: </p> + +<pre> +/etc/postfix/<a href="postconf.5.html">main.cf</a>: + <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, + <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr + +/etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: + # Rules are evaluated in the order as specified. + # Denylist 192.168.* except 192.168.0.1. + 192.168.0.1 permit + 192.168.0.0/16 reject +</pre> + +<p> See the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> manpage documentation for more +details. </p> + +<p> When the SMTP client address matches a "permit" action, +<a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: +</p> + +<pre> + <b>WHITELISTED</b> <i>[address]:port</i> +</pre> + +<p> The allowlist action is not configurable: immediately hand off the +connection to a Postfix SMTP server process. </p> + +<p> When the SMTP client address matches a "reject" action, +<a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: +</p> + +<pre> + <b>BLACKLISTED</b> <i>[address]:port</i> +</pre> + +<p> The <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> parameter specifies the action +that is taken next. See "<a href="#fail_before_220">When tests +fail before the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="temp_white"> Temporary allowlist test </a> </h3> + +<p> The <a href="postscreen.8.html">postscreen(8)</a> daemon maintains a <i>temporary</i> +allowlist for SMTP client IP addresses that have passed all +the tests described below. The <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> parameter +specifies the location of the temporary allowlist. The +temporary allowlist is not used for SMTP client addresses +that appear on the <i>permanent</i> access list. </p> + +<p> By default the temporary allowlist is not shared with other +<a href="postscreen.8.html">postscreen(8)</a> daemons. See +<a href="#temp_white_sharing"> Sharing +the temporary allowlist </a> below for alternatives. </p> + +<p> When the SMTP client address appears on the temporary +allowlist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port +number as: </p> + +<pre> + <b>PASS OLD</b> <i>[address]:port</i> +</pre> + +<p> The action is not configurable: immediately hand off the +connection to a Postfix SMTP server process. The client is +excluded from further tests until its temporary allowlist +entry expires, as controlled with the postscreen_*_ttl +parameters. Expired entries are silently renewed if possible. </p> + +<h3> <a name="white_veto"> MX Policy test </a> </h3> + +<p> When the remote SMTP client is not on the static access list +or temporary allowlist, <a href="postscreen.8.html">postscreen(8)</a> can implement a number of +allowlist tests, before it grants the client a temporary allowlist +status that allows it to talk to a Postfix SMTP server process. </p> + +<p> When <a href="postscreen.8.html">postscreen(8)</a> is configured to monitor all primary and +backup MX addresses, it can refuse to allowlist clients that connect +to a backup MX address only (an old spammer trick to take advantage +of backup MX hosts with weaker anti-spam policies than primary MX +hosts). </p> + +<blockquote> <p> NOTE: The following solution is for small sites. +Larger sites would have to share the <a href="postscreen.8.html">postscreen(8)</a> cache between +primary and backup MTAs, which would introduce a common point of +failure. </p> </blockquote> + +<ul> + +<li> <p> First, configure the host to listen on both primary and +backup MX addresses. Use the appropriate <tt>ifconfig</tt> or <tt>ip</tt> +command for the local operating system, or update the appropriate +configuration files and "refresh" the network protocol stack. </p> + +<p> <p> Second, configure Postfix to listen on the new IP address +(this step is needed when you have specified <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> in +<a href="postconf.5.html">main.cf</a>). </p> + +<li> <p> Then, configure <a href="postscreen.8.html">postscreen(8)</a> to deny the temporary allowlist +status on the backup MX address(es). An example for Wietse's +server is: </p> + +<pre> +/etc/postfix/<a href="postconf.5.html">main.cf</a>: + <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> = !168.100.189.8 <a href="DATABASE_README.html#types">static</a>:all +</pre> + +<p> Translation: allow clients to obtain the temporary allowlist +status on all server IP addresses except 168.100.189.8, which is a +backup MX address. </p> + +</ul> + +<p> When a non-allowlisted client connects the backup MX address, +<a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: +</p> + +<pre> + <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> + <b>WHITELIST VETO</b> <i>[address]:port</i> +</pre> + +<p> Translation: the client at <i>[address]:port</i> connected to +the backup MX address 168.100.189.8 while it was not allowlisted. +The client will not be granted the temporary allowlist status, even +if passes all the allowlist tests described below. </p> + +<h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> + +<p> The <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> parameter specifies a short time +interval before the "220 <i>text</i>..." server greeting, where +<a href="postscreen.8.html">postscreen(8)</a> can run a number of tests in parallel. </p> + +<p> When a good client passes these tests, and no "<a +href="#after_220">deep protocol tests</a>" +are configured, <a href="postscreen.8.html">postscreen(8)</a> +adds the client to the temporary allowlist and hands off the "live" +connection to a Postfix SMTP server process. The client can then +continue as if <a href="postscreen.8.html">postscreen(8)</a> never even existed (except of course +for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). </p> + +<ul> + +<li> <a href="#pregreet"> Pregreet test </a> + +<li> <a href="#dnsbl"> DNS Allow/denylist test </a> + +<li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> + +</ul> + +<h3> <a name="pregreet"> Pregreet test </a> </h3> + +<p> The SMTP protocol is a classic example of a protocol where the +server speaks before the client. <a href="postscreen.8.html">postscreen(8)</a> detects zombies +that are in a hurry and that speak before their turn. This test is +enabled by default. </p> + +<p> The <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> parameter specifies the <i>text</i> +portion of a "220-<i>text</i>..." teaser banner (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>). +Note that this becomes the first part of a multi-line server greeting. +The <a href="postscreen.8.html">postscreen(8)</a> daemon sends this before the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> +timer is started. The purpose of the teaser banner is to confuse +zombies so that they speak before their turn. It has no effect on +SMTP clients that correctly implement the protocol. </p> + +<p> To avoid problems with poorly-implemented SMTP engines in network +appliances or network testing tools, either exclude them from all +tests with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> feature or else specify +an empty teaser banner: </p> + +<pre> +/etc/postfix/<a href="postconf.5.html">main.cf</a>: + # Exclude broken clients by allowlisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> + # should always be allowlisted. + <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, + <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr + +/etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: + 192.168.254.0/24 permit +</pre> + +<pre> +/etc/postfix/<a href="postconf.5.html">main.cf</a>: + # Disable the teaser banner (try allowlisting first if you can). + <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> = +</pre> + +<p> When an SMTP client sends a command before the +<a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, <a href="postscreen.8.html">postscreen(8)</a> logs this as: +</p> + +<pre> + <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> +</pre> + +<p> Translation: the client at <i>[address]:port</i> sent <i>count</i> +bytes before its turn to speak. This happened <i>time</i> seconds +after the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> timer was started. The <i>text</i> +is what the client sent (truncated to 100 bytes, and with non-printable +characters replaced with C-style escapes such as \r for carriage-return +and \n for newline). </p> + +<p> The <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> parameter specifies the action that +is taken next. See "<a href="#fail_before_220">When tests fail +before the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="dnsbl"> DNS Allow/denylist test </a> </h3> + +<p> The <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter (default: empty) specifies +a list of DNS blocklist servers with optional filters and weight +factors (positive weights for denylisting, negative for allowlisting). +These servers will be queried in parallel with the reverse client +IP address. This test is disabled by default. </p> + +<blockquote> +<p> +CAUTION: when postscreen rejects mail, its SMTP reply contains the +DNSBL domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to +hide "password" information in DNSBL domain names. +</p> +</blockquote> + +<p> When the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> time has elapsed, and the combined +DNSBL score is equal to or greater than the <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> +parameter value, <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> + +<pre> + <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> has a combined +DNSBL score of <i>count</i>. </p> + +<p> The <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> parameter specifies the action that +is taken when the combined DNSBL score is equal to or greater than +the threshold. See "<a href="#fail_before_220">When tests fail +before the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> + +<p> When the client address matches the permanent denylist, or +when the client fails the pregreet or DNSBL tests, the action is +specified with <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, +or <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a>, respectively. </p> + +<dl> + +<dt> <b>ignore</b> (default) </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Repeat this test the next time the client connects. This option +is useful for testing and collecting statistics without blocking +mail. </dd> + +<dt> <b>enforce</b> </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver mail +with a 550 SMTP reply, and log the helo/sender/recipient information. +Repeat this test the next time the client connects. </dd> + +<dt> <b>drop</b> </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. </dd> + +</dl> + +<h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> + +<p> In this phase of the protocol, <a href="postscreen.8.html">postscreen(8)</a> implements a +number of "deep protocol" tests. These tests use an SMTP protocol +engine that is built into the <a href="postscreen.8.html">postscreen(8)</a> server. </p> + +<p> Important note: these protocol tests are disabled by default. +They are more intrusive than the pregreet and DNSBL tests, and they +have limitations as discussed next. </p> + +<ul> + +<li> <p> The main limitation of "after 220 greeting" tests is that +a new client must disconnect after passing these tests (reason: +postscreen is not a proxy). Then the client must reconnect from +the same IP address before it can deliver mail. The following +measures may help to avoid email delays: </p> + +<ul> + +<li> <p> Allow "good" clients to skip tests with the +<a href="postconf.5.html#postscreen_dnsbl_whitelist_threshold">postscreen_dnsbl_whitelist_threshold</a> feature (Postfix 2.11 and +later). This is especially effective for sites such as Google that +never retry immediately from the same IP address. </p> + +<li> <p> Small sites: Configure <a href="postscreen.8.html">postscreen(8)</a> to listen on multiple +IP addresses, published in DNS as different IP addresses for the +same MX hostname or for different MX hostnames. This avoids mail +delivery delays with clients that reconnect immediately from the +same IP address. </p> + +<li> <p> Large sites: Share the <a href="postscreen.8.html">postscreen(8)</a> cache between different +Postfix MTAs with a large-enough <a href="memcache_table.5.html">memcache_table(5)</a>. Again, this +avoids mail delivery delays with clients that reconnect immediately +from the same IP address. </p> + +</ul> + +<li> <p> <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP engine does not implement the +AUTH, XCLIENT, and XFORWARD features. If you need to make these +services available on port 25, then do not enable the tests after +the 220 server greeting. </p> + +<li> <p> End-user clients should connect directly to the submission +service, so that they never have to deal with <a href="postscreen.8.html">postscreen(8)</a>'s tests. +</p> + +</ul> + +<p> The following "after 220 greeting" tests are available: </p> + +<ul> + +<li> <a href="#pipelining">Command pipelining test</a> + +<li> <a href="#non_smtp">Non-SMTP command test</a> + +<li> <a href="#barelf">Bare newline test</a> + +<li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> + +</ul> + +<h3> <a name="pipelining">Command pipelining test</a> </h3> + +<p> By default, SMTP is a half-duplex protocol: the sender and +receiver send one command and one response at a time. Unlike the +Postfix SMTP server, <a href="postscreen.8.html">postscreen(8)</a> does not announce support +for ESMTP command pipelining. Therefore, clients are not allowed +to send multiple commands. <a href="postscreen.8.html">postscreen(8)</a>'s +<a href="#after_220">deep +protocol test</a> for this is disabled by default. </p> + +<p> With "<a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> detects +zombies that send multiple commands, instead of sending one command +and waiting for the server to reply. </p> + +<p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has +to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> +logging more informative. </p> + +<p> When a client sends multiple commands, <a href="postscreen.8.html">postscreen(8)</a> logs this +as: </p> + +<pre> + <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i>: <i>text</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> sent +multiple SMTP commands, instead of sending one command and then +waiting for the server to reply. This happened after the client +sent <i>command</i>. The <i>text</i> shows part of the input that +was sent too early; it is not logged with Postfix 2.8. </p> + +<p> The <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> parameter specifies the action +that is taken next. See "<a href="#fail_after_220">When tests fail +after the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="non_smtp">Non-SMTP command test</a> </h3> + +<p> Some spambots send their mail through open proxies. A symptom +of this is the usage of commands such as CONNECT and other non-SMTP +commands. Just like the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> +feature, <a href="postscreen.8.html">postscreen(8)</a> has an equivalent <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> +feature to block these clients. <a href="postscreen.8.html">postscreen(8)</a>'s +<a href="#after_220">deep +protocol test</a> for this is disabled by default. </p> + +<p> With "<a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> +detects zombies that send commands specified with the +<a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> parameter. This also detects commands +with the syntax of a message header label. The latter is a symptom +that the client is sending message content after ignoring all the +responses from <a href="postscreen.8.html">postscreen(8)</a> that reject mail. </p> + +<p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has +to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> +logging more informative. </p> + +<p> When a client sends non-SMTP commands, <a href="postscreen.8.html">postscreen(8)</a> logs this +as: </p> + +<pre> + <b>NON-SMTP COMMAND from</b> <i>[address]:port</i> <b>after</b> <i>command: text</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> sent a +command that matches the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> +parameter, or that has the syntax of a message header label (text +followed by optional space and ":"). +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<p> The <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> parameter specifies +the action that is taken next. See "<a href="#fail_after_220">When +tests fail after the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="barelf">Bare newline test</a> </h3> + +<p> SMTP is a line-oriented protocol: lines have a limited length, +and are terminated with <CR><LF>. Lines ending in a +"bare" <LF>, that is newline not preceded by carriage return, +are not allowed in SMTP. <a href="postscreen.8.html">postscreen(8)</a>'s +<a href="#after_220">deep +protocol test</a> for this is disabled by default. </p> + +<p> With "<a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> +detects clients that send lines ending in bare newline characters. +</p> + +<p> This test is opportunistically enabled when <a href="postscreen.8.html">postscreen(8)</a> has +to use the built-in SMTP engine anyway. This is to make <a href="postscreen.8.html">postscreen(8)</a> +logging more informative. </p> + +<p> When a client sends bare newline characters, <a href="postscreen.8.html">postscreen(8)</a> logs +this as: +</p> + +<pre> + <b>BARE NEWLINE from</b> <i>[address]:port</i> <b>after</b> <i>command</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> sent a bare +newline character, that is newline not preceded by carriage +return. +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<p> The <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> parameter specifies the +action that is taken next. See "<a href="#fail_after_220">When +tests fail after the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> + +<p> When the client fails the pipelining, non-SMTP command or bare +newline tests, the action is specified with <a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a>, +<a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> or <a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a>, +respectively. </p> + +<dl> + +<dt> <b>ignore</b> (default for bare newline) </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Do NOT repeat this test before the result from some other test +expires. + +This option is useful for testing and collecting statistics without +blocking mail permanently. </dd> + +<dt> <b>enforce</b> (default for pipelining) </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver +mail with a 550 SMTP reply, and log the helo/sender/recipient +information. Repeat this test the next time the client connects. +</dd> + +<dt> <b>drop</b> (default for non-SMTP commands) </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. This action is +compatible with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> +feature. </dd> + +</dl> + +<h2> <a name="other_error">Other errors</a> </h2> + +<p> When an SMTP client hangs up unexpectedly, <a href="postscreen.8.html">postscreen(8)</a> logs +this as: </p> + +<pre> + <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> disconnected +unexpectedly, <i>time</i> seconds after the start of the +test named <i>test name</i>. </p> + +<p> There is no punishment for hanging up. A client that hangs up +without sending the QUIT command can still pass all <a href="postscreen.8.html">postscreen(8)</a> +tests. </p> + +<!-- + +<p> While an unexpired penalty is in effect, an SMTP client is not +allowed to pass any tests, and <a href="postscreen.8.html">postscreen(8)</a> logs each connection +with the remaining amount of penalty time as: </p> + +<pre> + <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> +</pre> + +<p> During this time, all attempts by the client to deliver mail +will be deferred with a 450 SMTP status. </p> + +--> + +<p> The following errors are reported by the built-in SMTP engine. +This engine never accepts mail, therefore it has per-session limits +on the number of commands and on the session length. </p> + +<pre> + <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> <b>after</b> <i>command</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> reached the +per-command time limit as specified with the <a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> +parameter. The session is terminated immediately. +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<pre> + <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> reached the +per-session command count limit as specified with the +<a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> parameter. The session is terminated +immediately. +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<pre> + <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> reached the +per-command length limit, as specified with the <a href="postconf.5.html#line_length_limit">line_length_limit</a> +parameter. The session is terminated immediately. +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<p> When an SMTP client makes too many connections at the same time, +<a href="postscreen.8.html">postscreen(8)</a> rejects the connection with a 421 status code and logs: </p> + +<pre> + <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> +</pre> + +<p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> parameter controls this limit. </p> + +<p> When an SMTP client connects after <a href="postscreen.8.html">postscreen(8)</a> has reached a +connection count limit, <a href="postscreen.8.html">postscreen(8)</a> rejects the connection with +a 421 status code and logs: </p> + +<pre> + <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all screening ports busy</b> + <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> +</pre> + +<p> The <a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> and <a href="postconf.5.html#postscreen_post_queue_limit">postscreen_post_queue_limit</a> +parameters control these limits. </p> + +<h2> <a name="victory">When all tests succeed</a> </h2> + +<p> When a new SMTP client passes all tests (i.e. it is not allowlisted +via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> + +<pre> + <b>PASS NEW</b> <i>[address]:port</i> +</pre> + +<p> Where <i>[address]:port</i> are the client IP address and port. +Then, <a href="postscreen.8.html">postscreen(8)</a> +creates a temporary allowlist entry that excludes the client IP +address from further tests until the temporary allowlist entry +expires, as controlled with the postscreen_*_ttl parameters. </p> + +<p> When no "<a href="#after_220">deep protocol tests</a>" are +configured, <a href="postscreen.8.html">postscreen(8)</a> hands off the "live" connection to a Postfix +SMTP server process. The client can then continue as if <a href="postscreen.8.html">postscreen(8)</a> +never even existed (except for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). +</p> + +<p> When any "<a href="#after_220">deep protocol tests</a>" are +configured, <a href="postscreen.8.html">postscreen(8)</a> cannot hand off the "live" connection to +a Postfix SMTP server process in the middle of the session. Instead, +<a href="postscreen.8.html">postscreen(8)</a> defers mail delivery attempts with a 4XX status, logs +the helo/sender/recipient information, and waits for the client to +disconnect. The next time the client connects it will be allowed +to talk to a Postfix SMTP server process to deliver its mail. +<a href="postscreen.8.html">postscreen(8)</a> mitigates the impact of this limitation by giving +<a href="#after_220">deep protocol tests</a> a long expiration +time. </p> + +<h2> <a name="config"> Configuring the postscreen(8) service</a> +</h2> + +<p> <a href="postscreen.8.html">postscreen(8)</a> has been tested on FreeBSD [4-8], Linux 2.[4-6] +and Solaris 9 systems. </p> + +<ul> + +<li> <a href="#enable"> Turning on postscreen(8) without blocking +mail</a> + +<li> <a href="#starttls"> postscreen(8) TLS configuration </a> + +<li> <a href="#blocking"> Blocking mail with postscreen(8) </a> + +<li> <a href="#turnoff"> Turning off postscreen(8) </a> + +<li> <a href="#temp_white_sharing"> Sharing the temporary allowlist +</a> + +</ul> + +<h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> + +<p> To enable the <a href="postscreen.8.html">postscreen(8)</a> service and log client information +without blocking mail: </p> + +<ol> + +<li> <p> Make sure that local clients and systems with non-standard +SMTP implementations are excluded from any <a href="postscreen.8.html">postscreen(8)</a> tests. The +default is to exclude all clients in <a href="postconf.5.html#mynetworks">mynetworks</a>. To exclude additional +clients, for example, third-party performance monitoring tools (these +tend to have broken SMTP implementations): </p> + +<pre> +/etc/postfix/<a href="postconf.5.html">main.cf</a>: + # Exclude broken clients by allowlisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> + # should always be allowlisted. + <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, + <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr + +/etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: + 192.168.254.0/24 permit +</pre> + +<li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service +in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries +that follow. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + #smtp inet n - n - - smtpd + # -o parameter=value ... +</pre> + +<li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service +in <a href="master.5.html">master.cf</a>, and duplicate any "<tt>-o parameter=value</tt>" entries +from the smtpd service that was commented out in the previous step. +</p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + smtpd pass - - n - - smtpd + -o parameter=value ... +</pre> + +<li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" +service in <a href="master.5.html">master.cf</a>. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + smtp inet n - n - 1 postscreen +</pre> + +<li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" +service in <a href="master.5.html">master.cf</a>. This service implements STARTTLS support for +<a href="postscreen.8.html">postscreen(8)</a>. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + tlsproxy unix - - n - 0 tlsproxy +</pre> + +<li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" +service in <a href="master.5.html">master.cf</a>. This service does DNSBL lookups for <a href="postscreen.8.html">postscreen(8)</a> +and logs results. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + dnsblog unix - - n - 0 dnsblog +</pre> + +<li> <p> To enable DNSBL lookups, list some DNS blocklist sites in +<a href="postconf.5.html">main.cf</a>, separated by whitespace. Different sites can have different +weights. For example: + +<pre> +/etc/postfix/<a href="postconf.5.html">main.cf</a>: + <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2 + <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = zen.spamhaus.org*2 + bl.spamcop.net*1 b.barracudacentral.org*1 +</pre> + +<p> Note: if your DNSBL queries have a "secret" in the domain name, +you must censor this information from the <a href="postscreen.8.html">postscreen(8)</a> SMTP replies. +For example: </p> + +<pre> +/etc/postfix/<a href="postconf.5.html">main.cf</a>: + <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply +</pre> + +<pre> +/etc/postfix/dnsbl_reply: + # Secret DNSBL name Name in <a href="postscreen.8.html">postscreen(8)</a> replies + secret.zen.dq.spamhaus.net zen.spamhaus.org +</pre> + +<p> The <a href="DATABASE_README.html#types">texthash</a>: format is similar to <a href="DATABASE_README.html#types">hash</a>: except that there is +no need to run <a href="postmap.1.html">postmap(1)</a> before the file can be used, and that it +does not detect changes after the file is read. It is new with +Postfix version 2.8. </p> + +<li> <p> Read the new configuration with "<tt>postfix reload</tt>". +</p> + +</ol> + +<p> Notes: </p> + +<ul> + +<li> <p> Some <a href="postscreen.8.html">postscreen(8)</a> configuration parameters implement +stress-dependent behavior. This is supported only when the default +value is stress-dependent (that is, "postconf -d <i>parametername</i>" +output shows +"<i>parametername</i> = ${stress?<i>something</i>}${stress:<i>something</i>}" or +"<i>parametername</i> = ${stress?{<i>something</i>}:{<i>something</i>}}"). +Other parameters always evaluate as if the stress value is the empty +string. </p> + +<li> <p> See "<a href="#before_220">Tests before the 220 SMTP server +greeting</a>" for details about the logging from these +<a href="postscreen.8.html">postscreen(8)</a> tests. </p> + +<li> <p> If you run Postfix 2.6 or earlier you must stop and start +the master daemon ("<tt>postfix stop; postfix start</tt>"). This +is needed because the Postfix "pass" master service type did not +work reliably on all systems. </p> + +</ul> + +<h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> + +<p> <a href="postscreen.8.html">postscreen(8)</a> TLS support is available for remote SMTP clients +that aren't allowlisted, including clients that need to renew their +temporary allowlist status. When a remote SMTP client requests TLS +service, <a href="postscreen.8.html">postscreen(8)</a> invisibly hands off the connection to a +<a href="tlsproxy.8.html">tlsproxy(8)</a> process. Then, <a href="tlsproxy.8.html">tlsproxy(8)</a> encrypts and decrypts the +traffic between <a href="postscreen.8.html">postscreen(8)</a> and the remote SMTP client. One +<a href="tlsproxy.8.html">tlsproxy(8)</a> process can handle multiple SMTP sessions. The number +of <a href="tlsproxy.8.html">tlsproxy(8)</a> processes slowly increases with server load, but it +should always be much smaller than the number of <a href="postscreen.8.html">postscreen(8)</a> TLS +sessions. </p> + +<p> TLS support for <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> uses the same +parameters as with <a href="smtpd.8.html">smtpd(8)</a>. We recommend that you keep the relevant +configuration parameters in <a href="postconf.5.html">main.cf</a>. If you must specify "-o +smtpd_mumble=value" parameter overrides in <a href="master.5.html">master.cf</a> for a +postscreen-protected <a href="smtpd.8.html">smtpd(8)</a> service, then you should specify those +same parameter overrides for the <a href="postscreen.8.html">postscreen(8)</a> and <a href="tlsproxy.8.html">tlsproxy(8)</a> +services. </p> + +<h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> + +<p> For compatibility with <a href="smtpd.8.html">smtpd(8)</a>, <a href="postscreen.8.html">postscreen(8)</a> implements the +<a href="postconf.5.html#soft_bounce">soft_bounce</a> safety feature. This causes Postfix to reject mail with +a "try again" reply code. </p> + +<ul> + +<li> <p> To turn this on for all of Postfix, specify "<tt><a href="postconf.5.html#soft_bounce">soft_bounce</a> += yes</tt>" in <a href="postconf.5.html">main.cf</a>. </p> + +<li> <p> To turn this on for <a href="postscreen.8.html">postscreen(8)</a> only, append "<tt>-o +<a href="postconf.5.html#soft_bounce">soft_bounce</a>=yes</tt>" (note: NO SPACES around '=') to the postscreen +entry in <a href="master.5.html">master.cf</a>. <p> + +</ul> + +<p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> + +<p> After testing, do not forget to remove the <a href="postconf.5.html#soft_bounce">soft_bounce</a> feature, +otherwise senders won't receive their non-delivery notification +until many days later. </p> + +<p> To use the <a href="postscreen.8.html">postscreen(8)</a> service to block mail, edit <a href="postconf.5.html">main.cf</a> and +specify one or more of: </p> + +<ul> + +<li> <p> "<tt><a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> = enforce</tt>", to reject +clients that are on DNS blocklists, and to log the helo/sender/recipient +information. With good DNSBLs this reduces the amount of load on +Postfix SMTP servers dramatically. </p> + +<li> <p> "<tt><a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> = enforce</tt>", to reject +clients that talk before their turn, and to log the helo/sender/recipient +information. This stops over half of all known-to-be illegitimate +connections to Wietse's mail server. It is backup protection for +zombies that haven't yet been denylisted. </p> + +<li> <p> You can also enable "<a href="#after_220">deep protocol +tests</a>", but these are more intrusive than the pregreet or DNSBL +tests. </p> + +<p> When a good client passes the "<a href="#after_220">deep +protocol tests</a>", +<a href="postscreen.8.html">postscreen(8)</a> adds the client to the temporary +allowlist but it cannot hand off the "live" connection to a Postfix +SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> +defers mail delivery attempts with a 4XX status, logs the +helo/sender/recipient information, and waits for the client to +disconnect. </p> + +<p> When the good client comes back in a later session, it is allowed +to talk directly to a Postfix SMTP server. See "<a href="#after_220">Tests +after the 220 SMTP server greeting</a>" above for limitations with +AUTH and other features that clients may need. </p> + +<p> An unexpected benefit from "<a href="#after_220">deep protocol +tests</a>" is that some "good" clients don't return after the 4XX +reply; these clients were not so good after all. </p> + +<p> Unfortunately, some senders will retry requests from different +IP addresses, and may never get allowlisted. For this reason, +Wietse stopped using "<a href="#after_220">deep protocol tests</a>" +on his own internet-facing mail server. </p> + +<li> <p> There is also support for permanent denylisting and +allowlisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> +parameter for details. </p> + +</ul> + +<h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> + +<p> To turn off <a href="postscreen.8.html">postscreen(8)</a> and handle mail directly with Postfix +SMTP server processes: </p> + +<ol> + +<li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service +in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries +that follow. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + #smtp inet n - n - 1 postscreen + # -o parameter=value ... +</pre> + +<li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service +in <a href="master.5.html">master.cf</a>. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + #dnsblog unix - - n - 0 dnsblog +</pre> + +<li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service +in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries +that follow. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + #smtpd pass - - n - - smtpd + # -o parameter=value ... +</pre> + +<li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" +service in <a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" +entries that follow. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + #tlsproxy unix - - n - 0 tlsproxy + # -o parameter=value ... +</pre> + +<li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in +<a href="master.5.html">master.cf</a>, including any "<tt>-o parameter=value</tt>" entries that +may follow. </p> + +<pre> +/etc/postfix/<a href="master.5.html">master.cf</a>: + smtp inet n - n - - smtpd + -o parameter=value ... +</pre> + +<li> <p> Read the new configuration with "<tt>postfix reload</tt>". +</p> + +</ol> + +<h3> <a name="temp_white_sharing"> Sharing the temporary allowlist </a> </h3> + +<p> By default, the temporary allowlist is not shared between +multiple <a href="postscreen.8.html">postscreen(8)</a> daemons. To enable sharing, choose one +of the following options: </p> + +<ul> + +<li> <p> A non-persistent <a href="memcache_table.5.html">memcache</a>: temporary allowlist can be shared + between <a href="postscreen.8.html">postscreen(8)</a> daemons on the same host or different + hosts. Disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> + = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons because <a href="memcache_table.5.html">memcache</a>: has no + first-next API (but see example 4 below for <a href="memcache_table.5.html">memcache</a>: with + persistent backup). This requires Postfix 2.9 or later. </p> + + <pre> + # Example 1: non-persistent <a href="memcache_table.5.html">memcache</a>: allowlist. + /etc/postfix/<a href="postconf.5.html">main.cf</a>: + <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache + <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 + + /etc/postfix/postscreen_cache: + memcache = inet:127.0.0.1:11211 + key_format = postscreen:%s + </pre> + +<li> <p> + A persistent <a href="lmdb_table.5.html">lmdb</a>: temporary allowlist can be shared between + <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same <a href="master.8.html">master(8)</a> daemon, + or under different <a href="master.8.html">master(8)</a> daemons on the same host. Disable + cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0) in all + <a href="postscreen.8.html">postscreen(8)</a> daemons except one that is responsible for cache + cleanup. This requires Postfix 2.11 or later. </p> + + <pre> + # Example 2: persistent <a href="lmdb_table.5.html">lmdb</a>: allowlist. + /etc/postfix/<a href="postconf.5.html">main.cf</a>: + <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="lmdb_table.5.html">lmdb</a>:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache + # See note 1 below. + # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 + </pre> + +<li> <p> Other kinds of persistent temporary allowlist can be shared + only between <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same + <a href="master.8.html">master(8)</a> daemon. In this case, temporary allowlist access must + be shared through the <a href="proxymap.8.html">proxymap(8)</a> daemon. This requires Postfix + 2.9 or later. </p> + + <pre> + # Example 3: proxied <a href="DATABASE_README.html#types">btree</a>: allowlist. + /etc/postfix/<a href="postconf.5.html">main.cf</a>: + <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = + <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache + # See note 1 below. + # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 + + # Example 4: proxied <a href="DATABASE_README.html#types">btree</a>: allowlist with <a href="memcache_table.5.html">memcache</a>: accelerator. + /etc/postfix/<a href="postconf.5.html">main.cf</a>: + <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache + <a href="postconf.5.html#proxy_write_maps">proxy_write_maps</a> = + <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache + ... other proxied tables ... + # See note 1 below. + # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 + + /etc/postfix/postscreen_cache: + # Note: the $<a href="postconf.5.html#data_directory">data_directory</a> macro is not defined in this context. + memcache = inet:127.0.0.1:11211 + backup = <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache + key_format = postscreen:%s + </pre> + + <p> Note 1: disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> + = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons except one that is responsible + for cache cleanup. </p> + + <p> Note 2: <a href="postscreen.8.html">postscreen(8)</a> cache sharing via <a href="proxymap.8.html">proxymap(8)</a> requires Postfix + 2.9 or later; earlier <a href="proxymap.8.html">proxymap(8)</a> implementations don't support + cache cleanup. </p> + +</ul> + +<h2> <a name="historical"> Historical notes and credits </a> </h2> + +<p> Many ideas in <a href="postscreen.8.html">postscreen(8)</a> were explored in earlier work by +Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic +Control. </p> + +<p> Wietse threw together a crude prototype with pregreet and dnsbl +support in June 2009, because he needed something new for a Mailserver +conference presentation in July. Ralf Hildebrandt ran this code on +several servers to collect real-world statistics. This version used +the <a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> + +<p> Wietse needed new material for a LISA conference presentation +in November 2010, so he added support for DNSBL weights and filters +in August, followed by a major code rewrite, deep protocol tests, +helo/sender/recipient logging, and stress-adaptive behavior in +September. Ralf Hildebrandt ran this code on several servers to +collect real-world statistics. This version still used the embarrassing +<a href="dnsblog.8.html">dnsblog(8)</a> ad-hoc DNS client program. </p> + +<p> Wietse added STARTTLS support in December 2010. This makes +<a href="postscreen.8.html">postscreen(8)</a> usable for sites that require TLS support. The +implementation introduces the <a href="tlsproxy.8.html">tlsproxy(8)</a> event-driven TLS proxy +that decrypts/encrypts the sessions for multiple SMTP clients. </p> + +<p> The <a href="tlsproxy.8.html">tlsproxy(8)</a> implementation led to the discovery of a "new" +class of vulnerability (<a +href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0411" +>CVE-2011-0411</a>) that affected multiple implementations of SMTP, +POP, IMAP, NNTP, and FTP over TLS. </p> + +<p> <a href="postscreen.8.html">postscreen(8)</a> was officially released as part of the Postfix +2.8 stable release in January 2011.</p> + +</body> + +</html> diff --git a/external/ibm-public/postfix/dist/html/POSTSCREEN_README.html b/external/ibm-public/postfix/dist/html/POSTSCREEN_README.html index 4405f1e3e51..e6f1321e87f 100644 --- a/external/ibm-public/postfix/dist/html/POSTSCREEN_README.html +++ b/external/ibm-public/postfix/dist/html/POSTSCREEN_README.html @@ -5,7 +5,7 @@ <title>Postfix Postscreen Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -18,7 +18,8 @@ <h2> <a name="intro">Introduction</a> </h2> <p> This document describes features that are available in Postfix -2.8 and later. </p> +3.6 and later. See <a href="POSTSCREEN_3_5_README.html"> +POSTSCREEN_3_5_README.html</a> for Postfix versions 2.8 - 3.5. </p> <p> The Postfix <a href="postscreen.8.html">postscreen(8)</a> daemon provides additional protection against mail server overload. One <a href="postscreen.8.html">postscreen(8)</a> process handles @@ -36,8 +37,8 @@ requires client authentication. Alternatively, a site could set up a dedicated, non-postscreen, "port 25" server that provides submission service and client authentication, but no MX service. </p> -<p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for clients that -pass its tests; by allowing whitelisted clients to skip tests, +<p> <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for clients that +pass its tests; by allowing allowlisted clients to skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. </p> @@ -110,11 +111,11 @@ spending most of its resources not receiving email. </p> decision based on a single measurement. This is necessary because many zombies try to fly under the radar and avoid spamming the same site repeatedly. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client is -not-a-zombie, it whitelists the client temporarily to avoid further +not-a-zombie, it allowlists the client temporarily to avoid further delays for legitimate mail. </p> <p> Zombies have challenges too: they have only a limited amount -of time to deliver spam before their IP address becomes blacklisted. +of time to deliver spam before their IP address becomes denylisted. To speed up spam deliveries, zombies make compromises in their SMTP protocol implementation. For example, they speak before their turn, or they ignore responses from SMTP servers and continue sending @@ -122,7 +123,7 @@ mail even when the server tells them to go away. </p> <p> <a href="postscreen.8.html">postscreen(8)</a> uses a variety of measurements to recognize zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client -IP address is blacklisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol +IP address is denylisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol compromises that are made to speed up delivery. These are good indicators for making is-a-zombie decisions based on single measurements. </p> @@ -138,8 +139,8 @@ and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is fo <p> For each connection from an SMTP client, <a href="postscreen.8.html">postscreen(8)</a> performs a number of tests in the order as described below. Some tests introduce a delay of -a few seconds. <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary whitelist for -clients that pass its tests; by allowing whitelisted clients to +a few seconds. <a href="postscreen.8.html">postscreen(8)</a> maintains a temporary allowlist for +clients that pass its tests; by allowing allowlisted clients to skip tests, <a href="postscreen.8.html">postscreen(8)</a> minimizes its impact on legitimate email traffic. </p> @@ -158,25 +159,25 @@ overhead for legitimate clients. </p> <h2> <a name="quick">Quick tests before everything else</a> </h2> <p> Before engaging in SMTP-level tests. <a href="postscreen.8.html">postscreen(8)</a> queries a -number of local black and whitelists. These tests speed up the +number of local deny and allowlists. These tests speed up the handling of known clients. </p> <ul> -<li> <a href="#perm_white_black"> Permanent white/blacklist test </a> +<li> <a href="#perm_allow_deny"> Permanent allow/denylist test </a> -<li> <a href="#temp_white"> Temporary whitelist test </a> +<li> <a href="#temp_allow"> Temporary allowlist test </a> -<li> <a href="#white_veto"> MX Policy test </a> +<li> <a href="#allow_veto"> MX Policy test </a> </ul> -<h3> <a name="perm_white_black"> Permanent white/blacklist test </a> </h3> +<h3> <a name="perm_allow_deny"> Permanent allow/denylist test </a> </h3> <p> The <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>) specifies a permanent access list for SMTP client IP addresses. Typically -one would specify something that whitelists local networks, followed -by a CIDR table for selective white- and blacklisting. </p> +one would specify something that allowlists local networks, followed +by a CIDR table for selective allow- and denylisting. </p> <p> Example: </p> @@ -187,7 +188,7 @@ by a CIDR table for selective white- and blacklisting. </p> /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>: # Rules are evaluated in the order as specified. - # Blacklist 192.168.* except 192.168.0.1. + # Denylist 192.168.* except 192.168.0.1. 192.168.0.1 permit 192.168.0.0/16 reject </pre> @@ -199,40 +200,51 @@ details. </p> <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: </p> +<blockquote> <pre> - <b>WHITELISTED</b> <i>[address]:port</i> +<b>ALLOWLISTED</b> <i>[address]:port</i> </pre> +</blockquote> + +<blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to +select a deprecated form of this logging. </p> </blockquote> -<p> The whitelist action is not configurable: immediately hand off the +<p> The allowlist action is not configurable: immediately hand off the connection to a Postfix SMTP server process. </p> <p> When the SMTP client address matches a "reject" action, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: </p> +<blockquote> <pre> - <b>BLACKLISTED</b> <i>[address]:port</i> +<b>DENYLISTED</b> <i>[address]:port</i> </pre> +</blockquote> -<p> The <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> parameter specifies the action +<blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to +select a deprecated form of this logging. </p> </blockquote> + +<p> The <a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a> parameter specifies the action that is taken next. See "<a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a>" below. </p> -<h3> <a name="temp_white"> Temporary whitelist test </a> </h3> +<h3> <a name="temp_allow"> Temporary allowlist test </a> </h3> <p> The <a href="postscreen.8.html">postscreen(8)</a> daemon maintains a <i>temporary</i> -whitelist for SMTP client IP addresses that have passed all +allowlist for SMTP client IP addresses that have passed all the tests described below. The <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> parameter -specifies the location of the temporary whitelist. The -temporary whitelist is not used for SMTP client addresses +specifies the location of the temporary allowlist. The +temporary allowlist is not used for SMTP client addresses that appear on the <i>permanent</i> access list. </p> -<p> By default the temporary whitelist is not shared with other -postscreen(8) daemons. See <a href="#temp_white_sharing"> Sharing -the temporary whitelist </a> below for alternatives. </p> +<p> By default the temporary allowlist is not shared with other +<a href="postscreen.8.html">postscreen(8)</a> daemons. See +<a href="#temp_allow_sharing"> Sharing +the temporary allowlist </a> below for alternatives. </p> <p> When the SMTP client address appears on the temporary -whitelist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port +allowlist, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: </p> <pre> @@ -241,19 +253,19 @@ number as: </p> <p> The action is not configurable: immediately hand off the connection to a Postfix SMTP server process. The client is -excluded from further tests until its temporary whitelist +excluded from further tests until its temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. Expired entries are silently renewed if possible. </p> -<h3> <a name="white_veto"> MX Policy test </a> </h3> +<h3> <a name="allow_veto"> MX Policy test </a> </h3> <p> When the remote SMTP client is not on the static access list -or temporary whitelist, <a href="postscreen.8.html">postscreen(8)</a> can implement a number of -whitelist tests, before it grants the client a temporary whitelist +or temporary allowlist, <a href="postscreen.8.html">postscreen(8)</a> can implement a number of +allowlist tests, before it grants the client a temporary allowlist status that allows it to talk to a Postfix SMTP server process. </p> <p> When <a href="postscreen.8.html">postscreen(8)</a> is configured to monitor all primary and -backup MX addresses, it can refuse to whitelist clients that connect +backup MX addresses, it can refuse to allowlist clients that connect to a backup MX address only (an old spammer trick to take advantage of backup MX hosts with weaker anti-spam policies than primary MX hosts). </p> @@ -266,42 +278,45 @@ failure. </p> </blockquote> <ul> <li> <p> First, configure the host to listen on both primary and -backup MX addresses. Use the appropriate <tt>ifconfig</tt> command -for the local operating system, or update the appropriate configuration -files and "refresh" the network protocol stack. </p> +backup MX addresses. Use the appropriate <tt>ifconfig</tt> or <tt>ip</tt> +command for the local operating system, or update the appropriate +configuration files and "refresh" the network protocol stack. </p> <p> <p> Second, configure Postfix to listen on the new IP address (this step is needed when you have specified <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> in <a href="postconf.5.html">main.cf</a>). </p> -<li> <p> Then, configure <a href="postscreen.8.html">postscreen(8)</a> to deny the temporary whitelist +<li> <p> Then, configure <a href="postscreen.8.html">postscreen(8)</a> to deny the temporary allowlist status on the backup MX address(es). An example for Wietse's server is: </p> <pre> /etc/postfix/<a href="postconf.5.html">main.cf</a>: - <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> = !168.100.189.8 <a href="DATABASE_README.html#types">static</a>:all + <a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> = !168.100.189.8 <a href="DATABASE_README.html#types">static</a>:all </pre> -<p> Translation: allow clients to obtain the temporary whitelist +<p> Translation: allow clients to obtain the temporary allowlist status on all server IP addresses except 168.100.189.8, which is a backup MX address. </p> </ul> -<p> When a non-whitelisted client connects the backup MX address, +<p> When a non-allowlisted client connects the backup MX address, <a href="postscreen.8.html">postscreen(8)</a> logs this with the client address and port number as: </p> -<pre> - <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> - <b>WHITELIST VETO</b> <i>[address]:port</i> -</pre> +<blockquote> <pre> +<b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> +<b>ALLOWLIST VETO</b> <i>[address]:port</i> +</pre> </blockquote> + +<blockquote> <p> Use the <a href="postconf.5.html#respectful_logging">respectful_logging</a> configuration parameter to +select a deprecated form of this logging. </p> </blockquote> <p> Translation: the client at <i>[address]:port</i> connected to -the backup MX address 168.100.189.8 while it was not whitelisted. -The client will not be granted the temporary whitelist status, even -if passes all the whitelist tests described below. </p> +the backup MX address 168.100.189.8 while it was not allowlisted. +The client will not be granted the temporary allowlist status, even +if passes all the allowlist tests described below. </p> <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> @@ -310,8 +325,9 @@ interval before the "220 <i>text</i>..." server greeting, where <a href="postscreen.8.html">postscreen(8)</a> can run a number of tests in parallel. </p> <p> When a good client passes these tests, and no "<a -href="#after_220">deep protocol tests</a>" are configured, postscreen(8) -adds the client to the temporary whitelist and hands off the "live" +href="#after_220">deep protocol tests</a>" +are configured, <a href="postscreen.8.html">postscreen(8)</a> +adds the client to the temporary allowlist and hands off the "live" connection to a Postfix SMTP server process. The client can then continue as if <a href="postscreen.8.html">postscreen(8)</a> never even existed (except of course for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> delay). </p> @@ -320,7 +336,7 @@ for the short <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_w <li> <a href="#pregreet"> Pregreet test </a> -<li> <a href="#dnsbl"> DNS White/blacklist test </a> +<li> <a href="#dnsbl"> DNS Allow/denylist test </a> <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> @@ -348,8 +364,8 @@ an empty teaser banner: </p> <pre> /etc/postfix/<a href="postconf.5.html">main.cf</a>: - # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> - # should always be whitelisted. + # Exclude broken clients by allowlisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> + # should always be allowlisted. <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr @@ -359,7 +375,7 @@ an empty teaser banner: </p> <pre> /etc/postfix/<a href="postconf.5.html">main.cf</a>: - # Disable the teaser banner (try whitelisting first if you can). + # Disable the teaser banner (try allowlisting first if you can). <a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> = </pre> @@ -382,11 +398,11 @@ and \n for newline). </p> is taken next. See "<a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a>" below. </p> -<h3> <a name="dnsbl"> DNS White/blacklist test </a> </h3> +<h3> <a name="dnsbl"> DNS Allow/denylist test </a> </h3> <p> The <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter (default: empty) specifies a list of DNS blocklist servers with optional filters and weight -factors (positive weights for blacklisting, negative for whitelisting). +factors (positive weights for denylisting, negative for allowlisting). These servers will be queried in parallel with the reverse client IP address. This test is disabled by default. </p> @@ -416,9 +432,9 @@ before the 220 SMTP server greeting</a>" below. </p> <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> -<p> When the client address matches the permanent blacklist, or +<p> When the client address matches the permanent denylist, or when the client fails the pregreet or DNSBL tests, the action is -specified with <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, +specified with <a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a>, <a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a>, or <a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a>, respectively. </p> <dl> @@ -464,9 +480,9 @@ measures may help to avoid email delays: </p> <ul> <li> <p> Allow "good" clients to skip tests with the -<a href="postconf.5.html#postscreen_dnsbl_whitelist_threshold">postscreen_dnsbl_whitelist_threshold</a> feature (Postfix 2.11 and -later). This is especially effective for sites such as Google that -never retry immediately from the same IP address. </p> +<a href="postconf.5.html#postscreen_dnsbl_allowlist_threshold">postscreen_dnsbl_allowlist_threshold</a> feature. This is especially effective +for large providers that usually don't retry from the same IP +address. </p> <li> <p> Small sites: Configure <a href="postscreen.8.html">postscreen(8)</a> to listen on multiple IP addresses, published in DNS as different IP addresses for the @@ -512,7 +528,8 @@ service, so that they never have to deal with <a href="postscreen.8.html">postsc receiver send one command and one response at a time. Unlike the Postfix SMTP server, <a href="postscreen.8.html">postscreen(8)</a> does not announce support for ESMTP command pipelining. Therefore, clients are not allowed -to send multiple commands. postscreen(8)'s <a href="#after_220">deep +to send multiple commands. <a href="postscreen.8.html">postscreen(8)</a>'s +<a href="#after_220">deep protocol test</a> for this is disabled by default. </p> <p> With "<a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> detects @@ -546,7 +563,8 @@ after the 220 SMTP server greeting</a>" below. </p> of this is the usage of commands such as CONNECT and other non-SMTP commands. Just like the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> feature, <a href="postscreen.8.html">postscreen(8)</a> has an equivalent <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> -feature to block these clients. postscreen(8)'s <a href="#after_220">deep +feature to block these clients. <a href="postscreen.8.html">postscreen(8)</a>'s +<a href="#after_220">deep protocol test</a> for this is disabled by default. </p> <p> With "<a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> @@ -583,7 +601,8 @@ tests fail after the 220 SMTP server greeting</a>" below. </p> <p> SMTP is a line-oriented protocol: lines have a limited length, and are terminated with <CR><LF>. Lines ending in a "bare" <LF>, that is newline not preceded by carriage return, -are not allowed in SMTP. postscreen(8)'s <a href="#after_220">deep +are not allowed in SMTP. <a href="postscreen.8.html">postscreen(8)</a>'s +<a href="#after_220">deep protocol test</a> for this is disabled by default. </p> <p> With "<a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> = yes", <a href="postscreen.8.html">postscreen(8)</a> @@ -736,7 +755,7 @@ parameters control these limits. </p> <h2> <a name="victory">When all tests succeed</a> </h2> -<p> When a new SMTP client passes all tests (i.e. it is not whitelisted +<p> When a new SMTP client passes all tests (i.e. it is not allowlisted via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: </p> <pre> @@ -745,8 +764,8 @@ via some mechanism), <a href="postscreen.8.html">postscreen(8)</a> logs this as: <p> Where <i>[address]:port</i> are the client IP address and port. Then, <a href="postscreen.8.html">postscreen(8)</a> -creates a temporary whitelist entry that excludes the client IP -address from further tests until the temporary whitelist entry +creates a temporary allowlist entry that excludes the client IP +address from further tests until the temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. </p> <p> When no "<a href="#after_220">deep protocol tests</a>" are @@ -783,7 +802,7 @@ mail</a> <li> <a href="#turnoff"> Turning off postscreen(8) </a> -<li> <a href="#temp_white_sharing"> Sharing the temporary whitelist +<li> <a href="#temp_allow_sharing"> Sharing the temporary allowlist </a> </ul> @@ -803,8 +822,8 @@ tend to have broken SMTP implementations): </p> <pre> /etc/postfix/<a href="postconf.5.html">main.cf</a>: - # Exclude broken clients by whitelisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> - # should always be whitelisted. + # Exclude broken clients by allowlisting. Clients in <a href="postconf.5.html#mynetworks">mynetworks</a> + # should always be allowlisted. <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr @@ -902,14 +921,15 @@ Postfix version 2.8. </p> <li> <p> Some <a href="postscreen.8.html">postscreen(8)</a> configuration parameters implement stress-dependent behavior. This is supported only when the default value is stress-dependent (that is, "postconf -d <i>parametername</i>" -output shows "<i>parametername</i> = -${stress?<i>something</i>}${stress:<i>something</i>}"). +output shows +"<i>parametername</i> = ${stress?<i>something</i>}${stress:<i>something</i>}" or +"<i>parametername</i> = ${stress?{<i>something</i>}:{<i>something</i>}}"). Other parameters always evaluate as if the stress value is the empty string. </p> <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server -greeting</a>" for details about the logging from these postscreen(8) -tests. </p> +greeting</a>" for details about the logging from these +<a href="postscreen.8.html">postscreen(8)</a> tests. </p> <li> <p> If you run Postfix 2.6 or earlier you must stop and start the master daemon ("<tt>postfix stop; postfix start</tt>"). This @@ -921,8 +941,8 @@ work reliably on all systems. </p> <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> <p> <a href="postscreen.8.html">postscreen(8)</a> TLS support is available for remote SMTP clients -that aren't whitelisted, including clients that need to renew their -temporary whitelist status. When a remote SMTP client requests TLS +that aren't allowlisted, including clients that need to renew their +temporary allowlist status. When a remote SMTP client requests TLS service, <a href="postscreen.8.html">postscreen(8)</a> invisibly hands off the connection to a <a href="tlsproxy.8.html">tlsproxy(8)</a> process. Then, <a href="tlsproxy.8.html">tlsproxy(8)</a> encrypts and decrypts the traffic between <a href="postscreen.8.html">postscreen(8)</a> and the remote SMTP client. One @@ -976,15 +996,16 @@ Postfix SMTP servers dramatically. </p> clients that talk before their turn, and to log the helo/sender/recipient information. This stops over half of all known-to-be illegitimate connections to Wietse's mail server. It is backup protection for -zombies that haven't yet been blacklisted. </p> +zombies that haven't yet been denylisted. </p> <li> <p> You can also enable "<a href="#after_220">deep protocol tests</a>", but these are more intrusive than the pregreet or DNSBL tests. </p> <p> When a good client passes the "<a href="#after_220">deep -protocol tests</a>", postscreen(8) adds the client to the temporary -whitelist but it cannot hand off the "live" connection to a Postfix +protocol tests</a>", +<a href="postscreen.8.html">postscreen(8)</a> adds the client to the temporary +allowlist but it cannot hand off the "live" connection to a Postfix SMTP server process in the middle of the session. Instead, <a href="postscreen.8.html">postscreen(8)</a> defers mail delivery attempts with a 4XX status, logs the helo/sender/recipient information, and waits for the client to @@ -1000,12 +1021,12 @@ tests</a>" is that some "good" clients don't return after the 4XX reply; these clients were not so good after all. </p> <p> Unfortunately, some senders will retry requests from different -IP addresses, and may never get whitelisted. For this reason, +IP addresses, and may never get allowlisted. For this reason, Wietse stopped using "<a href="#after_220">deep protocol tests</a>" on his own internet-facing mail server. </p> -<li> <p> There is also support for permanent blacklisting and -whitelisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> +<li> <p> There is also support for permanent denylisting and +allowlisting; see the description of the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter for details. </p> </ul> @@ -1070,15 +1091,15 @@ may follow. </p> </ol> -<h3> <a name="temp_white_sharing"> Sharing the temporary whitelist </a> </h3> +<h3> <a name="temp_allow_sharing"> Sharing the temporary allowlist </a> </h3> -<p> By default, the temporary whitelist is not shared between +<p> By default, the temporary allowlist is not shared between multiple <a href="postscreen.8.html">postscreen(8)</a> daemons. To enable sharing, choose one of the following options: </p> <ul> -<li> <p> A non-persistent <a href="memcache_table.5.html">memcache</a>: temporary whitelist can be shared +<li> <p> A non-persistent <a href="memcache_table.5.html">memcache</a>: temporary allowlist can be shared between <a href="postscreen.8.html">postscreen(8)</a> daemons on the same host or different hosts. Disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons because <a href="memcache_table.5.html">memcache</a>: has no @@ -1086,7 +1107,7 @@ of the following options: </p> persistent backup). This requires Postfix 2.9 or later. </p> <pre> - # Example 1: non-persistent <a href="memcache_table.5.html">memcache</a>: whitelist. + # Example 1: non-persistent <a href="memcache_table.5.html">memcache</a>: allowlist. /etc/postfix/<a href="postconf.5.html">main.cf</a>: <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 @@ -1097,7 +1118,7 @@ of the following options: </p> </pre> <li> <p> - A persistent <a href="lmdb_table.5.html">lmdb</a>: temporary whitelist can be shared between + A persistent <a href="lmdb_table.5.html">lmdb</a>: temporary allowlist can be shared between <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same <a href="master.8.html">master(8)</a> daemon, or under different <a href="master.8.html">master(8)</a> daemons on the same host. Disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0) in all @@ -1105,28 +1126,28 @@ of the following options: </p> cleanup. This requires Postfix 2.11 or later. </p> <pre> - # Example 2: persistent <a href="lmdb_table.5.html">lmdb</a>: whitelist. + # Example 2: persistent <a href="lmdb_table.5.html">lmdb</a>: allowlist. /etc/postfix/<a href="postconf.5.html">main.cf</a>: <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="lmdb_table.5.html">lmdb</a>:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache # See note 1 below. # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 </pre> -<li> <p> Other kinds of persistent temporary whitelist can be shared +<li> <p> Other kinds of persistent temporary allowlist can be shared only between <a href="postscreen.8.html">postscreen(8)</a> daemons that run under the same - <a href="master.8.html">master(8)</a> daemon. In this case, temporary whitelist access must + <a href="master.8.html">master(8)</a> daemon. In this case, temporary allowlist access must be shared through the <a href="proxymap.8.html">proxymap(8)</a> daemon. This requires Postfix 2.9 or later. </p> <pre> - # Example 3: proxied <a href="DATABASE_README.html#types">btree</a>: whitelist. + # Example 3: proxied <a href="DATABASE_README.html#types">btree</a>: allowlist. /etc/postfix/<a href="postconf.5.html">main.cf</a>: <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/postscreen_cache # See note 1 below. # <a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> = 0 - # Example 4: proxied <a href="DATABASE_README.html#types">btree</a>: whitelist with <a href="memcache_table.5.html">memcache</a>: accelerator. + # Example 4: proxied <a href="DATABASE_README.html#types">btree</a>: allowlist with <a href="memcache_table.5.html">memcache</a>: accelerator. /etc/postfix/<a href="postconf.5.html">main.cf</a>: <a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="memcache_table.5.html">memcache</a>:/etc/postfix/postscreen_cache <a href="postconf.5.html#proxy_write_maps">proxy_write_maps</a> = @@ -1186,7 +1207,8 @@ POP, IMAP, NNTP, and FTP over TLS. </p> <p> <a href="postscreen.8.html">postscreen(8)</a> was officially released as part of the Postfix 2.8 stable release in January 2011.</p> -</body> +<p> Noel Jones helped with the Postfix 3.6 transition towards respectful +documentation. </p> +</body> </html> - diff --git a/external/ibm-public/postfix/dist/html/QSHAPE_README.html b/external/ibm-public/postfix/dist/html/QSHAPE_README.html index 69b9a1822be..6b763969f17 100644 --- a/external/ibm-public/postfix/dist/html/QSHAPE_README.html +++ b/external/ibm-public/postfix/dist/html/QSHAPE_README.html @@ -7,7 +7,7 @@ <title>Postfix Bottleneck Analysis</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -120,11 +120,11 @@ minutes old and 12 older than 1280 minutes (1440 minutes in a day). <p> When the output is a terminal intermediate results showing the top 20 domains (-n option) are displayed after every 1000 messages (-N option) and the final output also shows only the top 20 domains. This makes -qshape useful even when the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> is very large and it may -otherwise take prohibitively long to read the entire <a href="QSHAPE_README.html#deferred_queue">deferred queue</a>. </p> +qshape useful even when the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> is very large and it may +otherwise take prohibitively long to read the entire "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. </p> <p> By default, qshape shows statistics for the union of both the -<a href="QSHAPE_README.html#incoming_queue">incoming</a> and <a href="QSHAPE_README.html#active_queue">active queues</a> which are the most relevant queues to +"<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "<a href="QSHAPE_README.html#active_queue">active" queues</a> which are the most relevant queues to look at when analyzing performance. </p> <p> One can request an alternate list of queues: </p> @@ -136,8 +136,8 @@ $ qshape incoming active deferred </pre> </blockquote> -<p> this will show the age distribution of the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> or -the union of the incoming active and <a href="QSHAPE_README.html#deferred_queue">deferred queues</a>. </p> +<p> this will show the age distribution of the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> or +the union of the "<a href="QSHAPE_README.html#incoming_queue">incoming"</a>, "<a href="QSHAPE_README.html#active_queue">active"</a> and "<a href="QSHAPE_README.html#deferred_queue">deferred" queues</a>. </p> <p> Command line options control the number of display "buckets", the age limit for the smallest bucket, display of parent domain @@ -154,7 +154,7 @@ dominate the queue sender or recipient counts, approximately when a burst of mail started, and when it stopped. </p> <p> The problem destinations or sender domains appear near the top -left corner of the output table. Remember that the <a href="QSHAPE_README.html#active_queue">active queue</a> +left corner of the output table. Remember that the "<a href="QSHAPE_README.html#active_queue">active" queue</a> can accommodate up to 20000 ($<a href="postconf.5.html#qmgr_message_active_limit">qmgr_message_active_limit</a>) messages. To check whether this limit has been reached, use: </p> @@ -164,11 +164,11 @@ $ qshape -s active <i>(show sender statistics)</i> </pre> </blockquote> -<p> If the total sender count is below 20000 the <a href="QSHAPE_README.html#active_queue">active queue</a> is +<p> If the total sender count is below 20000 the "<a href="QSHAPE_README.html#active_queue">active" queue</a> is not yet saturated, any high volume sender domains show near the top of the output. -<p> With <a href="qmgr.8.html">oqmgr(8)</a> the <a href="QSHAPE_README.html#active_queue">active queue</a> is also limited to at most 20000 +<p> With <a href="qmgr.8.html">oqmgr(8)</a> the "<a href="QSHAPE_README.html#active_queue">active" queue</a> is also limited to at most 20000 recipient addresses ($<a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a>). To check for exhaustion of this limit use: </p> @@ -223,15 +223,15 @@ output. </p> <h2><a name="healthy">Example 1: Healthy queue</a></h2> -<p> When looking at just the <a href="QSHAPE_README.html#incoming_queue">incoming</a> and <a href="QSHAPE_README.html#active_queue">active queues</a>, under -normal conditions (no congestion) the <a href="QSHAPE_README.html#incoming_queue">incoming</a> and <a href="QSHAPE_README.html#active_queue">active queues</a> +<p> When looking at just the "<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "<a href="QSHAPE_README.html#active_queue">active" queues</a>, under +normal conditions (no congestion) the "<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "<a href="QSHAPE_README.html#active_queue">active" queues</a> are nearly empty. Mail leaves the system almost as quickly as it -comes in or is deferred without congestion in the <a href="QSHAPE_README.html#active_queue">active queue</a>. +comes in or is deferred without congestion in the "<a href="QSHAPE_README.html#active_queue">active" queue</a>. </p> <blockquote> <pre> -$ qshape <i>(show <a href="QSHAPE_README.html#incoming_queue">incoming</a> and <a href="QSHAPE_README.html#active_queue">active queue</a> status)</i> +$ qshape <i>(show "<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "<a href="QSHAPE_README.html#active_queue">active" queue</a> status)</i> T 5 10 20 40 80 160 320 640 1280 1280+ TOTAL 5 0 0 0 1 0 0 0 1 1 2 @@ -239,9 +239,9 @@ $ qshape <i>(show <a href="QSHAPE_README.html#incoming_queue">incoming</a </pre> </blockquote> -<p> If one looks at the two queues separately, the <a href="QSHAPE_README.html#incoming_queue">incoming queue</a> +<p> If one looks at the two queues separately, the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> is empty or perhaps briefly has one or two messages, while the -<a href="QSHAPE_README.html#active_queue">active queue</a> holds more messages and for a somewhat longer time: +"<a href="QSHAPE_README.html#active_queue">active" queue</a> holds more messages and for a somewhat longer time: </p> <blockquote> @@ -266,7 +266,7 @@ dictionary attack bounces</a></h2> available for some of the <a href="VIRTUAL_README.html#canonical">hosted domains</a>. Dictionary attacks on the unvalidated domains result in bounce backscatter. The bounces dominate the queue, but with proper tuning they do not saturate the -<a href="QSHAPE_README.html#incoming_queue">incoming</a> or <a href="QSHAPE_README.html#active_queue">active queues</a>. The high volume of deferred mail is not +"<a href="QSHAPE_README.html#incoming_queue">incoming"</a> or "<a href="QSHAPE_README.html#active_queue">active" queues</a>. The high volume of deferred mail is not a direct cause for alarm. </p> <blockquote> @@ -290,7 +290,7 @@ $ qshape deferred | head is the tail end of the time distribution, showing that short term arrival rates are moderate. Larger numbers and lower message ages are more indicative of current trouble. Old mail still going nowhere -is largely harmless so long as the active and <a href="QSHAPE_README.html#incoming_queue">incoming queues</a> are +is largely harmless so long as the "<a href="QSHAPE_README.html#active_queue">active"</a> and "<a href="QSHAPE_README.html#incoming_queue">incoming" queues</a> are short. We can also see that the groups.msn.com undeliverables are low rate steady stream rather than a concentrated dictionary attack that is now over. </p> @@ -318,8 +318,9 @@ most of the messages are bounces. </p> queue</a></h2> <p> This example is taken from a Feb 2004 discussion on the Postfix -Users list. Congestion was reported with the active and incoming -queues large and not shrinking despite very large delivery agent +Users list. Congestion was reported with the +"<a href="QSHAPE_README.html#active_queue">active"</a> and "<a href="QSHAPE_README.html#incoming_queue">incoming" queues</a> +large and not shrinking despite very large delivery agent process limits. The thread is archived at: <a href="http://groups.google.com/groups?threadm=c0b7js$2r65$1@FreeBSD.csie.NCTU.edu.tw">http://groups.google.com/groups?threadm=c0b7js$2r65$1@FreeBSD.csie.NCTU.edu.tw</a> and @@ -331,7 +332,7 @@ that all the messages were for just a few destinations: </p> <blockquote> <pre> -$ qshape <i>(show <a href="QSHAPE_README.html#incoming_queue">incoming</a> and <a href="QSHAPE_README.html#active_queue">active queue</a> status)</i> +$ qshape <i>(show "<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "<a href="QSHAPE_README.html#active_queue">active" queue</a> status)</i> T A 5 10 20 40 80 160 320 320+ TOTAL 11775 9996 0 0 1 1 42 94 221 1420 @@ -341,10 +342,10 @@ $ qshape <i>(show <a href="QSHAPE_README.html#incoming_queue">incoming</a </pre> </blockquote> -<p> The "A" column showed the count of messages in the <a href="QSHAPE_README.html#active_queue">active queue</a>, -and the numbered columns showed totals for the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a>. At -10000 messages (Postfix 1.x <a href="QSHAPE_README.html#active_queue">active queue</a> size limit) the active -queue is full. The incoming was growing rapidly. </p> +<p> The "A" column showed the count of messages in the "<a href="QSHAPE_README.html#active_queue">active" queue</a>, +and the numbered columns showed totals for the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. At +10000 messages (Postfix 1.x "<a href="QSHAPE_README.html#active_queue">active" queue</a> size limit) the "<a href="QSHAPE_README.html#active_queue">active" queue</a> +is full. The "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> was growing rapidly. </p> <p> With the trouble destinations clearly identified, the administrator quickly found and fixed the problem. It is substantially harder to @@ -356,8 +357,8 @@ one message at a time. </p> <h2><a name="backlog">Example 4: High volume destination backlog</a></h2> <p> When a site you send a lot of email to is down or slow, mail -messages will rapidly build up in the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a>, or worse, in -the <a href="QSHAPE_README.html#active_queue">active queue</a>. The qshape output will show large numbers for +messages will rapidly build up in the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>, or worse, in +the "<a href="QSHAPE_README.html#active_queue">active" queue</a>. The qshape output will show large numbers for the destination domain in all age buckets that overlap the starting time of the problem: </p> @@ -373,13 +374,13 @@ $ qshape deferred | head </blockquote> <p> Here the "highvolume.com" destination is continuing to accumulate -deferred mail. The <a href="QSHAPE_README.html#incoming_queue">incoming</a> and <a href="QSHAPE_README.html#active_queue">active queues</a> are fine, but the -<a href="QSHAPE_README.html#deferred_queue">deferred queue</a> started growing some time between 1 and 2 hours ago +deferred mail. The "<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "<a href="QSHAPE_README.html#active_queue">active" queues</a> are fine, but the +"<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> started growing some time between 1 and 2 hours ago and continues to grow. </p> <p> If the high volume destination is not down, but is instead -slow, one might see similar congestion in the <a href="QSHAPE_README.html#active_queue">active queue</a>. Active -queue congestion is a greater cause for alarm; one might need to +slow, one might see similar congestion in the "<a href="QSHAPE_README.html#active_queue">active" queue</a>. +"<a href="QSHAPE_README.html#active_queue">Active" queue</a> congestion is a greater cause for alarm; one might need to take measures to ensure that the mail is deferred instead or even add an <a href="access.5.html">access(5)</a> rule asking the sender to try again later. </p> @@ -616,7 +617,7 @@ submission rate or perhaps excessive CPU consumption in the <a href="cleanup.8.h service due to excessive <a href="postconf.5.html#body_checks">body_checks</a>, or (Postfix ≥ 2.3) high latency milters. </p> -<p> Note, that once the <a href="QSHAPE_README.html#active_queue">active queue</a> is full, the cleanup service +<p> Note, that once the "<a href="QSHAPE_README.html#active_queue">active" queue</a> is full, the cleanup service will attempt to slow down message injection by pausing $<a href="postconf.5.html#in_flow_delay">in_flow_delay</a> for each message. In this case "<a href="QSHAPE_README.html#maildrop_queue">maildrop" queue</a> congestion may be a consequence of congestion downstream, rather than a problem in @@ -643,7 +644,7 @@ size of the "<a href="QSHAPE_README.html#maildrop_queue">maildrop" queue</a>. </ <p> The administrator can define "smtpd" <a href="access.5.html">access(5)</a> policies, or <a href="cleanup.8.html">cleanup(8)</a> header/body checks that cause messages to be automatically diverted from normal processing and placed indefinitely in the -"<a href="QSHAPE_README.html#hold_queue">hold" queue</a>. Messages placed in the "hold" queue stay there until +"<a href="QSHAPE_README.html#hold_queue">hold" queue</a>. Messages placed in the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a> stay there until the administrator intervenes. No periodic delivery attempts are made for messages in the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a>. The <a href="postsuper.1.html">postsuper(1)</a> command can be used to manually release messages into the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. @@ -651,8 +652,8 @@ can be used to manually release messages into the "<a href="QSHAPE_README.html#d <p> Messages can potentially stay in the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a> longer than $<a href="postconf.5.html#maximal_queue_lifetime">maximal_queue_lifetime</a>. If such "old" messages need to be released from -the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a>, they should typically be moved into the "maildrop" -queue using "postsuper -r", so that the message gets a new timestamp and +the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a>, they should typically be moved into the "<a href="QSHAPE_README.html#maildrop_queue">maildrop" queue</a> +using "postsuper -r", so that the message gets a new timestamp and is given more than one opportunity to be delivered. Messages that are "young" can be moved directly into the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> using "postsuper -H". </p> @@ -672,21 +673,21 @@ notifies the queue manager of new mail arrival. The queue manager ignores incomplete queue files whose mode is 0600, as these are still being written by cleanup. </p> -<p> The queue manager scans the <a href="QSHAPE_README.html#incoming_queue">incoming queue</a> bringing any new -mail into the "<a href="QSHAPE_README.html#active_queue">active" queue</a> if the active queue resource limits -have not been exceeded. By default, the <a href="QSHAPE_README.html#active_queue">active queue</a> accommodates -at most 20000 messages. Once the <a href="QSHAPE_README.html#active_queue">active queue</a> message limit is -reached, the queue manager stops scanning the incoming (and deferred, -see below) queue. </p> +<p> The queue manager scans the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> bringing any new +mail into the "<a href="QSHAPE_README.html#active_queue">active" queue</a> if the "<a href="QSHAPE_README.html#active_queue">active" queue</a> resource limits +have not been exceeded. By default, the "<a href="QSHAPE_README.html#active_queue">active" queue</a> accommodates +at most 20000 messages. Once the "<a href="QSHAPE_README.html#active_queue">active" queue</a> message limit is +reached, the queue manager stops scanning the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> +(and the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>, see below). </p> -<p> Under normal conditions the <a href="QSHAPE_README.html#incoming_queue">incoming queue</a> is nearly empty (has +<p> Under normal conditions the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> is nearly empty (has only mode 0600 files), with the queue manager able to import new -messages into the <a href="QSHAPE_README.html#active_queue">active queue</a> as soon as they become available. +messages into the "<a href="QSHAPE_README.html#active_queue">active" queue</a> as soon as they become available. </p> -<p> The <a href="QSHAPE_README.html#incoming_queue">incoming queue</a> grows when the message input rate spikes +<p> The "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> grows when the message input rate spikes above the rate at which the queue manager can import messages into -the <a href="QSHAPE_README.html#active_queue">active queue</a>. The main factors slowing down the queue manager +the "<a href="QSHAPE_README.html#active_queue">active" queue</a>. The main factors slowing down the queue manager are disk I/O and lookup queries to the trivial-rewrite service. If the queue manager is routinely not keeping up, consider not using "slow" lookup services (MySQL, LDAP, ...) for transport lookups or speeding @@ -712,8 +713,8 @@ to 1 message per second, but is not strong enough to deflect an excessive input rate from many sources at the same time. </p> <p> If a server is being hammered from multiple directions, consider -raising the <a href="postconf.5.html#in_flow_delay">in_flow_delay</a> to 10 seconds, but only if the incoming -queue is growing even while the <a href="QSHAPE_README.html#active_queue">active queue</a> is not full and the +raising the <a href="postconf.5.html#in_flow_delay">in_flow_delay</a> to 10 seconds, but only if the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> +is growing even while the "<a href="QSHAPE_README.html#active_queue">active" queue</a> is not full and the trivial-rewrite service is using a fast transport lookup mechanism. </p> @@ -723,8 +724,8 @@ trivial-rewrite service is using a fast transport lookup mechanism. ensure fast and fair delivery of mail to all destinations within designated resource limits. </p> -<p> The <a href="QSHAPE_README.html#active_queue">active queue</a> is somewhat analogous to an operating system's -process run queue. Messages in the <a href="QSHAPE_README.html#active_queue">active queue</a> are ready to be +<p> The "<a href="QSHAPE_README.html#active_queue">active" queue</a> is somewhat analogous to an operating system's +process run queue. Messages in the "<a href="QSHAPE_README.html#active_queue">active" queue</a> are ready to be sent (runnable), but are not necessarily in the process of being sent (running). </p> @@ -732,15 +733,14 @@ sent (running). </p> as a directory on disk, the real "<a href="QSHAPE_README.html#active_queue">active" queue</a> is a set of data structures in the memory of the queue manager process. </p> -<p> Messages in the "<a href="QSHAPE_README.html#maildrop_queue">maildrop"</a>, "<a href="QSHAPE_README.html#hold_queue">hold"</a>, "<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "deferred" -queues (see below) do not occupy memory; they are safely stored on +<p> Messages in the "<a href="QSHAPE_README.html#maildrop_queue">maildrop"</a>, "<a href="QSHAPE_README.html#hold_queue">hold"</a>, "<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "<a href="QSHAPE_README.html#deferred_queue">deferred" queues</a> +(see below) do not occupy memory; they are safely stored on disk waiting for their turn to be processed. The envelope information for messages in the "<a href="QSHAPE_README.html#active_queue">active" queue</a> is managed in memory, allowing the queue manager to do global scheduling, allocating available -delivery agent processes to an appropriate message in the active -queue. </p> +delivery agent processes to an appropriate message in the "<a href="QSHAPE_README.html#active_queue">active" queue</a>. </p> -<p> Within the <a href="QSHAPE_README.html#active_queue">active queue</a>, (multi-recipient) messages are broken +<p> Within the "<a href="QSHAPE_README.html#active_queue">active" queue</a>, (multi-recipient) messages are broken up into groups of recipients that share the same transport/nexthop combination; the group size is capped by the transport's recipient concurrency limit. </p> @@ -756,15 +756,15 @@ concurrency limits. Per-recipient limits are appropriate when performing final delivery to mailboxes rather than when relaying to a remote server. </p> -<p> Congestion occurs in the <a href="QSHAPE_README.html#active_queue">active queue</a> when one or more destinations +<p> Congestion occurs in the "<a href="QSHAPE_README.html#active_queue">active" queue</a> when one or more destinations drain slower than the corresponding message input rate. </p> -<p> Input into the <a href="QSHAPE_README.html#active_queue">active queue</a> comes both from new mail in the "incoming" -queue, and retries of mail in the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. Should the "deferred" -queue get really large, retries of old mail can dominate the arrival +<p> Input into the "<a href="QSHAPE_README.html#active_queue">active" queue</a> comes both from new mail in the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a>, +and retries of mail in the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. Should the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> +get really large, retries of old mail can dominate the arrival rate of new mail. Systems with more CPU, faster disks and more network -bandwidth can deal with larger <a href="QSHAPE_README.html#deferred_queue">deferred queues</a>, but as a rule of thumb -the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scales to somewhere between 100,000 and 1,000,000 +bandwidth can deal with larger "<a href="QSHAPE_README.html#deferred_queue">deferred" queues</a>, but as a rule of thumb +the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> scales to somewhere between 100,000 and 1,000,000 messages with good performance unlikely above that "limit". Systems with queues this large should typically stop accepting new mail, or put the backlog "on hold" until the underlying issue is fixed (provided that @@ -773,12 +773,12 @@ there is enough capacity to handle just the new mail). </p> <p> When a destination is down for some time, the queue manager will mark it dead, and immediately defer all mail for the destination without trying to assign it to a delivery agent. In this case the messages -will quickly leave the <a href="QSHAPE_README.html#active_queue">active queue</a> and end up in the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> +will quickly leave the "<a href="QSHAPE_README.html#active_queue">active" queue</a> and end up in the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> (with Postfix < 2.4, this is done directly by the queue manager, with Postfix ≥ 2.4 this is done via the "retry" delivery agent). </p> <p> When the destination is instead simply slow, or there is a problem -causing an excessive arrival rate the <a href="QSHAPE_README.html#active_queue">active queue</a> will grow and will +causing an excessive arrival rate the "<a href="QSHAPE_README.html#active_queue">active" queue</a> will grow and will become dominated by mail to the congested destination. </p> <p> The only way to reduce congestion is to either reduce the input @@ -818,7 +818,7 @@ throughput falls to just over 1 message per second. </p> <p> The best way to avoid bottlenecks when one or more MX hosts is non-responsive is to use connection caching. Connection caching was introduced with Postfix 2.2 and is by default enabled on demand for -destinations with a backlog of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. When connection +destinations with a backlog of mail in the "<a href="QSHAPE_README.html#active_queue">active" queue</a>. When connection caching is in effect for a particular destination, established connections are re-used to send additional messages, this reduces the number of connections made per message delivery and maintains good throughput even @@ -849,20 +849,20 @@ transport allocates a separate delivery agent pool to these destinations and allows separate tuning of timeouts and concurrency limits. </p> <p> Another common cause of congestion is unwarranted flushing of the -entire <a href="QSHAPE_README.html#deferred_queue">deferred queue</a>. The deferred queue holds messages that are likely +entire "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. The "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> holds messages that are likely to fail to be delivered and are also likely to be slow to fail delivery -(time out). As a result the most common reaction to a large <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> +(time out). As a result the most common reaction to a large "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> (flush it!) is more than likely counter-productive, and typically makes -the congestion worse. Do not flush the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> unless you expect +the congestion worse. Do not flush the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> unless you expect that most of its content has recently become deliverable (e.g. <a href="postconf.5.html#relayhost">relayhost</a> back up after an outage)! </p> <p> Note that whenever the queue manager is restarted, there may -already be messages in the <a href="QSHAPE_README.html#active_queue">active queue</a> directory, but the "real" -<a href="QSHAPE_README.html#active_queue">active queue</a> in memory is empty. In order to recover the in-memory -state, the queue manager moves all the <a href="QSHAPE_README.html#active_queue">active queue</a> messages -back into the <a href="QSHAPE_README.html#incoming_queue">incoming queue</a>, and then uses its normal incoming -queue scan to refill the <a href="QSHAPE_README.html#active_queue">active queue</a>. The process of moving all +already be messages in the "<a href="QSHAPE_README.html#active_queue">active" queue</a> directory, but the "real" +"<a href="QSHAPE_README.html#active_queue">active" queue</a> in memory is empty. In order to recover the in-memory +state, the queue manager moves all the "<a href="QSHAPE_README.html#active_queue">active" queue</a> messages +back into the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a>, and then uses its normal "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> +scan to refill the "<a href="QSHAPE_README.html#active_queue">active" queue</a>. The process of moving all the messages back and forth, redoing transport table (<a href="trivial-rewrite.8.html">trivial-rewrite(8)</a> resolve service) lookups, and re-importing the messages back into memory is expensive. At all costs, avoid frequent restarts of the @@ -872,20 +872,20 @@ queue manager (e.g. via frequent execution of "postfix reload"). </p> <p> When all the deliverable recipients for a message are delivered, and for some recipients delivery failed for a transient reason (it -might succeed later), the message is placed in the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a>. +might succeed later), the message is placed in the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. </p> -<p> The queue manager scans the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> periodically. The scan -interval is controlled by the <a href="postconf.5.html#queue_run_delay">queue_run_delay</a> parameter. While a deferred -queue scan is in progress, if an <a href="QSHAPE_README.html#incoming_queue">incoming queue</a> scan is also in progress -(ideally these are brief since the <a href="QSHAPE_README.html#incoming_queue">incoming queue</a> should be short), the -queue manager alternates between looking for messages in the "incoming" -queue and in the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. This "round-robin" strategy prevents -starvation of either the <a href="QSHAPE_README.html#incoming_queue">incoming</a> or the <a href="QSHAPE_README.html#deferred_queue">deferred queues</a>. </p> - -<p> Each <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scan only brings a fraction of the deferred -queue back into the <a href="QSHAPE_README.html#active_queue">active queue</a> for a retry. This is because each -message in the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> is assigned a "cool-off" time when +<p> The queue manager scans the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> periodically. The scan +interval is controlled by the <a href="postconf.5.html#queue_run_delay">queue_run_delay</a> parameter. While a "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> +scan is in progress, if an "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> scan is also in progress +(ideally these are brief since the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> should be short), the +queue manager alternates between looking for messages in the "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a> +and in the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>. This "round-robin" strategy prevents +starvation of either the "<a href="QSHAPE_README.html#incoming_queue">incoming"</a> or the "<a href="QSHAPE_README.html#deferred_queue">deferred" queues</a>. </p> + +<p> Each "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> scan only brings a fraction of the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> +back into the "<a href="QSHAPE_README.html#active_queue">active" queue</a> for a retry. This is because each +message in the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> is assigned a "cool-off" time when it is deferred. This is done by time-warping the modification time of the queue file into the future. The queue file is not eligible for a retry if its modification time is not yet reached. @@ -897,36 +897,36 @@ the message's age in the queue, and adjusting up or down to lie within the limits. This means that young messages are initially retried more often than old messages. </p> -<p> If a high volume site routinely has large <a href="QSHAPE_README.html#deferred_queue">deferred queues</a>, it +<p> If a high volume site routinely has large "<a href="QSHAPE_README.html#deferred_queue">deferred" queues</a>, it may be useful to adjust the <a href="postconf.5.html#queue_run_delay">queue_run_delay</a>, <a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a> and <a href="postconf.5.html#maximal_backoff_time">maximal_backoff_time</a> to provide short enough delays on first failure (Postfix ≥ 2.4 has a sensibly low minimal backoff time by default), with perhaps longer delays after multiple failures, to reduce the retransmission rate of old messages and thereby reduce the quantity -of previously deferred mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. If you want a really +of previously deferred mail in the "<a href="QSHAPE_README.html#active_queue">active" queue</a>. If you want a really low <a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a>, you may also want to lower <a href="postconf.5.html#queue_run_delay">queue_run_delay</a>, but understand that more frequent scans will increase the demand for disk I/O. </p> -<p> One common cause of large <a href="QSHAPE_README.html#deferred_queue">deferred queues</a> is failure to validate +<p> One common cause of large "<a href="QSHAPE_README.html#deferred_queue">deferred" queues</a> is failure to validate recipients at the SMTP input stage. Since spammers routinely launch dictionary attacks from unrepliable sender addresses, the bounces -for invalid recipient addresses clog the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> (and at high -volumes proportionally clog the <a href="QSHAPE_README.html#active_queue">active queue</a>). Recipient validation +for invalid recipient addresses clog the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> (and at high +volumes proportionally clog the "<a href="QSHAPE_README.html#active_queue">active" queue</a>). Recipient validation is strongly recommended through use of the <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> and <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> parameters. Even when bounces drain quickly they inundate innocent victims of forgery with unwanted email. To avoid this, do not accept mail for invalid recipients. </p> <p> When a host with lots of deferred mail is down for some time, -it is possible for the entire <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> to reach its retry -time simultaneously. This can lead to a very full <a href="QSHAPE_README.html#active_queue">active queue</a> once +it is possible for the entire "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> to reach its retry +time simultaneously. This can lead to a very full "<a href="QSHAPE_README.html#active_queue">active" queue</a> once the host comes back up. The phenomenon can repeat approximately every <a href="postconf.5.html#maximal_backoff_time">maximal_backoff_time</a> seconds if the messages are again deferred after a brief burst of congestion. Perhaps, a future Postfix release will add a random offset to the retry time (or use a combination -of strategies) to reduce the odds of repeated complete deferred -queue flushes. </p> +of strategies) to reduce the odds of repeated complete "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a> +flushes. </p> <h2><a name="credits">Credits</a></h2> diff --git a/external/ibm-public/postfix/dist/html/RESTRICTION_CLASS_README.html b/external/ibm-public/postfix/dist/html/RESTRICTION_CLASS_README.html index 37b19421bb2..e6b42aecfb3 100644 --- a/external/ibm-public/postfix/dist/html/RESTRICTION_CLASS_README.html +++ b/external/ibm-public/postfix/dist/html/RESTRICTION_CLASS_README.html @@ -7,7 +7,7 @@ <title>Postfix Per-Client/User/etc. Access Control</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/SASL_README.html b/external/ibm-public/postfix/dist/html/SASL_README.html index 4b12902235f..eeaad444612 100644 --- a/external/ibm-public/postfix/dist/html/SASL_README.html +++ b/external/ibm-public/postfix/dist/html/SASL_README.html @@ -5,7 +5,7 @@ <title>Postfix SASL Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -25,7 +25,7 @@ mail to remote destinations when the client's IP address is in the <p> SMTP clients outside the SMTP server's network need a different way to get "same network" privileges. To address this need, Postfix -supports SASL authentication (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>, formerly <a href="http://tools.ietf.org/html/rfc2554">RFC 2554</a>). With +supports SASL authentication (<a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>, formerly <a href="https://tools.ietf.org/html/rfc2554">RFC 2554</a>). With this a remote SMTP client can authenticate to the Postfix SMTP server, and the Postfix SMTP client can authenticate to a remote SMTP server. Once a client is authenticated, a server can give it @@ -960,9 +960,9 @@ file entries: </p> <dt>ldapdb_uri</dt> -<dd> <p> Specify either <code>ldapi://</code> for to connect over +<dd> <p> Specify either <code><a href="ldap_table.5.html">ldapi</a>://</code> to connect over a UNIX-domain socket, <code><a href="ldap_table.5.html">ldap</a>://</code> for an unencrypted TCP -connection or <code>ldaps://</code> for an encrypted TCP connection. +connection, or <code><a href="ldap_table.5.html">ldaps</a>://</code> for an encrypted TCP connection. </p> </dd> <dt>ldapdb_id</dt> @@ -1697,10 +1697,9 @@ that use the non-standard "<code>AUTH=<em>method.</em>...</code>" syntax in response to the EHLO command; this requires no additional Postfix client configuration. </p> </li> -<li> <p> The Postfix SMTP client does not support the obsolete -"wrappermode" protocol, which uses TCP port <code>465</code> on the -SMTP server. See <a href="TLS_README.html">TLS_README</a> for a solution that uses the -<code>stunnel</code> command. </p> </li> +<li> <p> With the setting "<a href="postconf.5.html#smtp_tls_wrappermode">smtp_tls_wrappermode</a> = yes", the Postfix +SMTP client supports the "wrappermode" protocol, which uses TCP +port 465 on the SMTP server (Postfix 3.0 and later). </p> </li> <li> <p> With the <code><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a></code> parameter, we configure the Postfix SMTP client to send username and password @@ -1810,14 +1809,14 @@ resort. </p> tables into one single MySQL database, and configure different Postfix queries to extract the appropriate information. </p> -<li> <p> Specify dbm instead of hash if your system uses dbm files -instead of db files. To find out what lookup tables Postfix supports, -use the command "postconf -m". </p> +<li> <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses +<b>dbm</b> files instead of <b>db</b> files. To find out what lookup +tables Postfix supports, use the command "<b>postconf -m</b>". </p> -<li> <p> Execute the command "postmap /etc/postfix/sasl_passwd" +<li> <p> Execute the command "<b>postmap /etc/postfix/sasl_passwd</b>" whenever you change the sasl_passwd table. </p> -<li> <p> Execute the command "postmap /etc/postfix/sender_relay" +<li> <p> Execute the command "<b>postmap /etc/postfix/sender_relay</b>" whenever you change the sender_relay table. </p> </ul> @@ -2048,7 +2047,7 @@ necessary; it just makes Postfix configuration a little more convenient because you don't have to specify the SASL plug-in type in the Postfix <a href="postconf.5.html">main.cf</a> file (but this may cause surprises when you switch to a later Postfix version that is built with the default -SASL type of <code>sasl</code>). </p> +SASL type of <code>cyrus</code>). </p> </li> @@ -2078,7 +2077,7 @@ options into the above command line; see the <a href="LDAP_README.html">LDAP_REA <h4><a name="build_sasl">Building the Cyrus SASL library</a></h4> <p> Postfix works with cyrus-sasl-1.5.x or cyrus-sasl-2.1.x, which are -available from <a href="ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/">ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/</a>. </p> +available from <a href="https://github.com/cyrusimap/cyrus-sasl/releases">https://github.com/cyrusimap/cyrus-sasl/releases</a>. </p> <blockquote> @@ -2128,6 +2127,10 @@ definitions: </p> -I/usr/local/include/sasl" AUXLIBS="-L/usr/local/lib -lsasl2"</strong> </pre> +<p> If your Cyrus SASL shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lsasl2". </p> + </dd> <dt>Cyrus SASL version 1.5.x</dt> @@ -2185,7 +2188,7 @@ it unless you are forced to. The makers of Cyrus SASL write: </p> <blockquote> <i> This library is being deprecated and applications should transition to using the SASLv2 library</i> (source: <a -href="http://cyrusimap.web.cmu.edu/downloads.html">Project Cyrus: +href="http://www.cyrusimap.org/download.html">Project Cyrus: Downloads</a>). </blockquote> <p> If you still need to set it up, here's a quick rundown: </p> diff --git a/external/ibm-public/postfix/dist/html/SCHEDULER_README.html b/external/ibm-public/postfix/dist/html/SCHEDULER_README.html index 06922f39876..f303f33fa26 100644 --- a/external/ibm-public/postfix/dist/html/SCHEDULER_README.html +++ b/external/ibm-public/postfix/dist/html/SCHEDULER_README.html @@ -7,7 +7,7 @@ <title>Postfix Queue Scheduler</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -720,7 +720,7 @@ nqmgr </a> </h3> <p> Let's start by recapitulating the structures and terms used when -referring to queue manager and how it operates. Many of these are +referring to the queue manager and how it operates. Many of these are partially described elsewhere, but it is nice to have a coherent overview in one place: @@ -745,7 +745,7 @@ it shall talk to) and jobs (referencing the messages it shall deliver). </p> <li> <p> Each transport queue (not to be confused with the on-disk -<a href="QSHAPE_README.html#active_queue">active queue</a> or <a href="QSHAPE_README.html#incoming_queue">incoming queue</a>) groups everything what is going be +"<a href="QSHAPE_README.html#active_queue">active" queue</a> or "<a href="QSHAPE_README.html#incoming_queue">incoming" queue</a>) groups everything what is going be delivered to given destination (aka nexthop) by its transport. Each queue belongs to one transport, so each destination may be referred to by several queues, one for each transport. Each queue maintains @@ -795,7 +795,7 @@ up the message </a> </h3> <p> -Whenever <tt>nqmgr</tt> moves a queue file into the <a href="QSHAPE_README.html#active_queue">active queue</a>, +Whenever <tt>nqmgr</tt> moves a queue file into the "<a href="QSHAPE_README.html#active_queue">active" queue</a>, the following happens: It reads all necessary information from the queue file as <tt>oqmgr</tt> does, and also reads as many recipients as possible - more on that later, for now let's just pretend it @@ -809,7 +809,7 @@ Then it resolves the recipients as <tt>oqmgr</tt> does, which means obtaining (address, nexthop, transport) triple for each recipient. For each triple, it finds the transport; if it does not exist yet, it instantiates it (unless it's dead). Within the -transport, it finds the destination queue for given nexthop; if it +transport, it finds the destination queue for the given nexthop; if it does not exist yet, it instantiates it (unless it's dead). The triple is then bound to given destination queue. This happens in qmgr_resolve() and is basically the same as in <tt>oqmgr</tt>. @@ -826,9 +826,10 @@ the bound destination queue within this jobs context; if it does not exist yet, it instantiates it. Finally, it stores the address from the resolved triple to the recipient entry which is appended to both the queue entry list and the peer entry list. The addresses -for same nexthop are batched in the entries up to recipient_concurrency -limit for that transport. This happens in qmgr_assign() and apart -from that it operates with job and peer structures it is basically the +for the same nexthop are batched in the entries up to the +<a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> for that transport. +This happens in qmgr_message_assign(), and apart +from that it operates with job and peer structures, it is basically the same as in <tt>oqmgr</tt>. </p> @@ -845,9 +846,9 @@ time is important as we will see shortly. <p> -[Now you should have pretty good idea what is the state of the -<tt>nqmgr</tt> after couple of messages was picked up, what is the -relation between all those job, peer, queue and entry structures.] +[Now you should have a pretty good idea what the state of the +<tt>nqmgr</tt> is after a couple of messages were picked up, and what the +relation is between all those job, peer, queue and entry structures.] </p> @@ -894,7 +895,8 @@ was picked up by the <tt>nqmgr</tt>. So by default we get the top-level round-robin transport, and within each transport we get the FIFO message delivery. The round-robin of the peers by the destination is perhaps of little importance in most real-life cases -(unless the recipient_concurrency limit is reached, in one job there +(unless the <a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> is reached, +in one job there is only one peer structure for each destination), but theoretically it makes sure that even within single jobs, destinations are treated fairly. @@ -986,11 +988,11 @@ mail followed by two two-recipient mails? The simple answer would be to use delivery sequence <tt>12121313</tt>. But the problem is that this does not scale well. Imagine you have -mail with thousand recipients followed by mail with hundred recipients. +mail with a thousand recipients followed by mail with a hundred recipients. It is tempting to suggest the delivery sequence like <tt>121212....</tt>, but alas! Imagine there arrives another mail with say ten recipients. But there are no free slots anymore, so it can't slip by, not even -if it had just only one recipients. It will be stuck until the +if it had only one recipient. It will be stuck until the hundred-recipient mail is delivered, which really sucks. </p> @@ -998,7 +1000,7 @@ hundred-recipient mail is delivered, which really sucks. <p> So, it becomes obvious that while inflating the message to get -free slots is great idea, one has to be really careful of how the +free slots is a great idea, one has to be really careful of how the free slots are assigned, otherwise one might corner himself. So, how does <tt>nqmgr</tt> really use the free slots? @@ -1032,7 +1034,7 @@ thousand recipient mail? <p> -Well, despite it looks so at the first glance, another trick will +Well, despite the fact that it looks so at the first glance, another trick will allow us to answer "no, we are not!". If we had said that we will inflate the delivery time twice at maximum, and then we consider every other slot as a free slot, then we would overinflate in case @@ -1056,7 +1058,7 @@ transport has a <a href="postconf.5.html#transport_delivery_slot_cost"><i>transp defaults to <a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a> parameter which is set to 5 by default. This is the k from the paragraph above. Each time k entries of the job are selected for delivery, this counter is -incremented by one. Once there are some slots accumulated, job which +incremented by one. Once there are some slots accumulated, a job which requires no more than that number of slots to be fully delivered can preempt this job. @@ -1066,7 +1068,7 @@ can preempt this job. [Well, the truth is, the counter is incremented every time an entry is selected and it is divided by k when it is used. -But for the understanding it's good enough to use +But to understand, it's good enough to use the above approximation of the truth.] </p> @@ -1083,7 +1085,7 @@ and when does all this exactly happen? <p> The answer for the first part is simple. The job whose entry was -selected the last time is so called current job. Normally, it is +selected the last time is the so called current job. Normally, it is the first job on the scheduler's job list, but destination concurrency limits may change this as we will see later. It is always only the current job which may get preempted. @@ -1092,7 +1094,7 @@ current job which may get preempted. <p> -Now for the second part. The current job has certain amount of +Now for the second part. The current job has a certain amount of recipient entries, and as such may accumulate at maximum some amount of available delivery slots. It might have already accumulated some, and perhaps even already used some when it was preempted before @@ -1111,8 +1113,8 @@ That is, the older the job is, the more we should try to deliver it in order to get best message delivery rates. These rates are of course subject to how many recipients the message has, therefore the division by the recipient (entry) count. No one shall be surprised -that message with n recipients takes n times longer to deliver than -message with one recipient. +that a message with n recipients takes n times longer to deliver than +a message with one recipient. </p> @@ -1124,9 +1126,9 @@ delivered within the number of slots the current job already accumulated? Why do we need to estimate how much it has yet to accumulate? If you found out the answer, congratulate yourself. If we did it this simple way, we would always choose the candidate -with least recipient entries. If there were enough single recipient +with the fewest recipient entries. If there were enough single recipient mails coming in, they would always slip by the bulk mail as soon -as possible, and the two and more recipients mail would never get +as possible, and the two or more recipients mail would never get a chance, no matter how long they have been sitting around in the job list. @@ -1134,7 +1136,7 @@ job list. <p> -This candidate selection has interesting implication - that when +This candidate selection has an interesting implication - that when we choose the best candidate for preemption (this is done in qmgr_choose_candidate()), it may happen that we may not use it for preemption immediately. This leads to an answer to the last part @@ -1148,12 +1150,12 @@ The preemption attempt happens every time next transport's recipient entry is to be chosen for delivery. To avoid needless overhead, the preemption is not attempted if the current job could never accumulate more than <a href="postconf.5.html#transport_minimum_delivery_slots"><i>transport</i>_minimum_delivery_slots</a> (defaults to -<a href="postconf.5.html#default_minimum_delivery_slots">default_minimum_delivery_slots</a> which defaults to 3). If there is +<a href="postconf.5.html#default_minimum_delivery_slots">default_minimum_delivery_slots</a> which defaults to 3). If there are already enough accumulated slots to preempt the current job by the chosen best candidate, it is done immediately. This basically means that the candidate is moved in front of the current job on the scheduler's job list and decreasing the accumulated slot counter -by the amount used by the candidate. If there is not enough slots... +by the amount used by the candidate. If there are not enough slots... well, I could say that nothing happens and the another preemption is attempted the next time. But that's not the complete truth. @@ -1164,13 +1166,13 @@ is attempted the next time. But that's not the complete truth. The truth is that it turns out that it is not really necessary to wait until the jobs counter accumulates all the delivery slots in advance. Say we have ten-recipient mail followed by two two-recipient -mails. If the preemption happened when enough delivery slot accumulate +mails. If the preemption happened when enough delivery slots accumulate (assuming slot cost 2), the delivery sequence becomes <tt>11112211113311</tt>. Now what would we get if we would wait only for 50% of the necessary slots to accumulate and we promise we would wait for the remaining 50% later, after we get back -to the preempted job? If we use such slot loan, the delivery sequence -becomes <tt>11221111331111</tt>. As we can see, it makes it no +to the preempted job? If we use such a slot loan, the delivery sequence +becomes <tt>11221111331111</tt>. As we can see, it makes it not considerably worse for the delivery of the ten-recipient mail, but it allows the small messages to be delivered sooner. @@ -1192,15 +1194,15 @@ accumulated so far. <p> -And it pretty much concludes this chapter. +And that pretty much concludes this chapter. </p> <p> [Now you should have a feeling that you pretty much understand the -scheduler and the preemption, or at least that you will have it -after you read the last chapter couple more times. You shall clearly +scheduler and the preemption, or at least that you will have +after you read the last chapter a couple more times. You shall clearly see the job list and the preemption happening at its head, in ideal delivery conditions. The feeling of understanding shall last until you start wondering what happens if some of the jobs are blocked, @@ -1226,17 +1228,17 @@ selected by the scheduler? <p> -From user's point of view it is all simple. If some of the peers +From the user's point of view it is all simple. If some of the peers of a job can't be selected, those peers are simply skipped by the entry selection algorithm (the pseudo-code described before) and only the selectable ones are used. If none of the peers may be selected, the job is declared a "blocker job". Blocker jobs are skipped by the entry selection algorithm and they are also excluded -from the candidates for preemption of current job. Thus the scheduler +from the candidates for preemption of the current job. Thus the scheduler effectively behaves as if the blocker jobs didn't exist on the job list at all. As soon as at least one of the peers of a blocker job becomes unblocked (that is, the delivery agent handling the delivery -of the recipient entry for given destination successfully finishes), +of the recipient entry for the given destination successfully finishes), the job's blocker status is removed and the job again participates in all further scheduler actions normally. @@ -1298,8 +1300,8 @@ this change because of blockers? <p> -The answer is: a lot. Any job may become blocker job at any time, -and also become normal job again at any time. This has several +The answer is: a lot. Any job may become a blocker job at any time, +and also become a normal job again at any time. This has several important implications: </p> @@ -1320,7 +1322,7 @@ unblocked and is completed... You get the idea. <p> [Interesting side note: even when jobs are delivered out of order, -from single destination's point of view the jobs are still delivered +from a single destination's point of view the jobs are still delivered in the expected order (that is, FIFO unless there was some preemption involved). This is because whenever a destination queue becomes unblocked (the destination limit allows selection of more recipient @@ -1371,7 +1373,7 @@ huh? <p> If I illustrate the relations after the above mentioned examples -(but those in point 1)), the situation would look like this: +(but those in point 1), the situation would look like this: </p> @@ -1398,8 +1400,8 @@ Now how does <tt>nqmgr</tt> deal with all these complicated relations? <p> Well, it maintains them all as described, but fortunately, all these -relations are necessary only for purposes of proper counting of -available delivery slots. For purposes of ordering the jobs for +relations are necessary only for the purpose of proper counting of +available delivery slots. For the purpose of ordering the jobs for entry selection, the original rule still applies: "the job preempting the current job is moved in front of the current job on the job list". So for entry selection purposes, the job relations remain @@ -1428,8 +1430,8 @@ are simply ignored. <p> -[By now, you should have a feeling that there is more things going -under the hood than you ever wanted to know. You decide that +[By now, you should have a feeling that there are more things going +on under the hood than you ever wanted to know. You decide that forgetting about this chapter is the best you can do for the sake of your mind's health and you basically stick with the idea how the scheduler works in ideal conditions, when there are no blockers, @@ -1443,11 +1445,11 @@ limits </a> </h3> <p> When discussing the <tt>nqmgr</tt> scheduler, we have so far assumed -that all recipients of all messages in the <a href="QSHAPE_README.html#active_queue">active queue</a> are completely -read into the memory. This is simply not true. There is an upper +that all recipients of all messages in the "<a href="QSHAPE_README.html#active_queue">active" queue</a> are completely +read into memory. This is simply not true. There is an upper bound on the amount of memory the <tt>nqmgr</tt> may use, and therefore it must impose some limits on the information it may store -in the memory at any given time. +in memory at any given time. </p> @@ -1456,11 +1458,11 @@ in the memory at any given time. First of all, not all messages may be read in-core at once. At any time, only <a href="postconf.5.html#qmgr_message_active_limit">qmgr_message_active_limit</a> messages may be read in-core at maximum. When read into memory, the messages are picked from the -<a href="QSHAPE_README.html#incoming_queue">incoming</a> and deferred message queues and moved to the <a href="QSHAPE_README.html#active_queue">active queue</a> -(incoming having priority), so if there is more than -<a href="postconf.5.html#qmgr_message_active_limit">qmgr_message_active_limit</a> messages queued in the <a href="QSHAPE_README.html#active_queue">active queue</a>, the -rest will have to wait until (some of) the messages in the active -queue are completely delivered (or deferred). +"<a href="QSHAPE_README.html#incoming_queue">incoming"</a> and "<a href="QSHAPE_README.html#deferred_queue">deferred" queues</a> and moved to the "<a href="QSHAPE_README.html#active_queue">active" queue</a> +(incoming having priority), so if there are more than +<a href="postconf.5.html#qmgr_message_active_limit">qmgr_message_active_limit</a> messages queued in the "<a href="QSHAPE_README.html#active_queue">active" queue</a>, the +rest will have to wait until (some of) the messages in the "<a href="QSHAPE_README.html#active_queue">active" queue</a> +are completely delivered (or deferred). </p> @@ -1468,11 +1470,11 @@ queue are completely delivered (or deferred). Even with the limited amount of in-core messages, there is another limit which must be imposed in order to avoid memory exhaustion. -Each message may contain huge amount of recipients (tens or hundreds +Each message may contain a huge number of recipients (tens or hundreds of thousands are not uncommon), so if <tt>nqmgr</tt> read all -recipients of all messages in the <a href="QSHAPE_README.html#active_queue">active queue</a>, it may easily run +recipients of all messages in the "<a href="QSHAPE_README.html#active_queue">active" queue</a>, it may easily run out of memory. Therefore there must be some upper bound on the -amount of message recipients which are read into the memory at the +amount of message recipients which are read into memory at the same time. </p> @@ -1490,8 +1492,8 @@ affects the <tt>nqmgr</tt> and its scheduler. The message limit is straightforward - it just limits the size of the lookahead the <tt>nqmgr</tt>'s scheduler has when choosing which -message can preempt the current one. Messages not in the active -queue simply are not considered at all. +message can preempt the current one. Messages not in the "<a href="QSHAPE_README.html#active_queue">active" queue</a> +are simply not considered at all. </p> @@ -1517,12 +1519,12 @@ of recipient entries. With unread recipients, it is not clear how many recipient entries there will be, as they are subject to per-destination grouping. It is not even clear to what transports (and thus jobs) the recipients will be assigned. And with messages -coming from the <a href="QSHAPE_README.html#deferred_queue">deferred queue</a>, it is not even clear how many unread +coming from the "<a href="QSHAPE_README.html#deferred_queue">deferred" queue</a>, it is not even clear how many unread recipients are still to be delivered. This all means that the scheduler must use only estimates of how many recipients entries there will be. Fortunately, it is possible to estimate the minimum and maximum correctly, so the scheduler can always err on the safe -side. Obviously, the better the estimates, the better results, so +side. Obviously, the better the estimates, the better the results, so it is best when we are able to read all recipients in-core and turn the estimates into exact counts, or at least try to read as many as possible to make the estimates as accurate as possible. @@ -1552,9 +1554,9 @@ it achieve it? <p> Perhaps the easiest solution would be to say that each message may -have at maximum X recipients stored in-core, but such solution would +have at maximum X recipients stored in-core, but such a solution would be poor for several reasons. With reasonable <a href="postconf.5.html#qmgr_message_active_limit">qmgr_message_active_limit</a> -values, the X would have to be quite low to maintain reasonable +values, the X would have to be quite low to maintain a reasonable memory footprint. And with low X lots of things would not work well. The <tt>nqmgr</tt> would have problems to use the <a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> efficiently. The @@ -1568,11 +1570,11 @@ again. <p> Therefore it seems reasonable to have a solution which does not use -a limit imposed on per-message basis, but which maintains a pool +a limit imposed on a per-message basis, but which maintains a pool of available recipient slots, which can be shared among all messages in the most efficient manner. And as we do not want separate transports to compete for resources whenever possible, it seems -appropriate to maintain such recipient pool for each transport +appropriate to maintain such a recipient pool for each transport separately. This is the general idea, now how does it work in practice? @@ -1580,13 +1582,13 @@ practice? <p> -First we have to solve little chicken-and-egg problem. If we want +First we have to solve a little chicken-and-egg problem. If we want to use the per-transport recipient pools, we first need to know to -what transport(s) is the message assigned. But we will find that -out only after we read in the recipients first. So it is obvious +what transport(s) the message is assigned. But we will find that +out only after we first read in the recipients. So it is obvious that we first have to read in some recipients, use them to find out -to what transports is the message to be assigned, and only after -that we can use the per-transport recipient pools. +to what transports the message is to be assigned, and only after +that can we use the per-transport recipient pools. </p> @@ -1595,12 +1597,12 @@ that we can use the per-transport recipient pools. Now how many recipients shall we read for the first time? This is what <a href="postconf.5.html#qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a> and <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> values control. The <a href="postconf.5.html#qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a> value specifies -how many recipients of each message we will read for the first time, +how many recipients of each message we will read the first time, no matter what. It is necessary to read at least one recipient before we can assign the message to a transport and create the first job. However, reading only <a href="postconf.5.html#qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a> recipients even if there are only few messages with few recipients in-core would -be wasteful. Therefore if there is less than <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> +be wasteful. Therefore if there are fewer than <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> recipients in-core so far, the first batch of recipients may be larger than <a href="postconf.5.html#qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a> - as large as is required to reach the <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> limit. @@ -1624,10 +1626,10 @@ recipient slots of all jobs of the message permits (plus the <p> -For example, if a message has three jobs, first with 1 recipient -still in-core and 4 recipient slots, second with 5 recipient in-core -and 5 recipient slots, and third with 2 recipients in-core and 0 -recipient slots, it has 1+5+2=7 recipients in-core and 4+5+0=9 jobs' +For example, if a message has three jobs, the first with 1 recipient +still in-core and 4 recipient slots, the second with 5 recipients in-core +and 5 recipient slots, and the third with 2 recipients in-core and 0 +recipient slots, it has 1+5+2=8 recipients in-core and 4+5+0=9 jobs' recipients slots in total. This means that we could immediately read 2+<a href="postconf.5.html#qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a> more recipients of that message in core. @@ -1675,9 +1677,9 @@ More specifically, each time a job is created and appended to the job list, it gets all unused recipient slots from its transport's pool. It keeps them until all recipients of its message are read. When this happens, all unused recipient slots are transferred to -the next job (which is now in fact now first such job) on the job +the next job (which is now in fact the first such job) on the job list which still has some recipients unread, or eventually back to -the transport pool if there is no such job. Such transfer then also +the transport pool if there is no such job. Such a transfer then also happens whenever a recipient entry of that job is delivered. </p> @@ -1685,10 +1687,10 @@ happens whenever a recipient entry of that job is delivered. <p> There is also a scenario when a job is not appended to the end of -the job list (for example it was created as a result of second or +the job list (for example it was created as a result of a second or later recipient batch). Then it works exactly as above, except that if it was put in front of the first unread job (that is, the job -of a message which still has some unread recipients in queue file), +of a message which still has some unread recipients in the queue file), that job is first forced to return all of its unused recipient slots to the transport pool. @@ -1705,21 +1707,21 @@ as they still have recipients in-core (the maximum is there because of the sponsoring mentioned before) and the jobs after this job get nothing from the transport recipient pool (unless they got something before and then the first unread job was created and enqueued in -front of them later - in such case the also get at maximum as many +front of them later - in such a case, they also get at maximum as many slots as they have recipients in-core). </p> <p> -Things work fine in such state for most of the time, because the -current job is either completely read in-core or has as much recipient +Things work fine in such a state for most of the time, because the +current job is either completely read in-core or has as many recipient slots as there are, but there is one situation which we still have to take care of specially. Imagine if the current job is preempted by some unread job from the job list and there are no more recipient slots available, so this new current job could read only batches of <a href="postconf.5.html#qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a> recipients at a time. This would -really degrade performance. For this reason, each transport has +really degrade performance. For this reason, each transport has an extra pool of <a href="postconf.5.html#transport_extra_recipient_limit"><i>transport</i>_extra_recipient_limit</a> recipient slots, dedicated exactly for this situation. Each time an unread job preempts the current job, it gets half of the remaining recipient @@ -1730,7 +1732,7 @@ slots from the normal pool and this extra pool. <p> And that's it. It sure does sound pretty complicated, but fortunately -most people don't really have to care how exactly it works as long +most people don't really have to care exactly how it works as long as it works. Perhaps the only important things to know for most people are the following upper bound formulas: @@ -1783,7 +1785,7 @@ where the sum is over all used transports. <p> And this terribly complicated chapter concludes the documentation -of <tt>nqmgr</tt> scheduler. +of the <tt>nqmgr</tt> scheduler. </p> @@ -1793,7 +1795,7 @@ of <tt>nqmgr</tt> scheduler. inside out. In practice, you still hope that you will never have to really understand the last or last two chapters completely, and fortunately most people really won't. Understanding how the scheduler -works in ideal conditions is more than good enough for vast majority +works in ideal conditions is more than good enough for the vast majority of users.] </p> diff --git a/external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html b/external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html index d77d3bce13d..478d153ecc8 100644 --- a/external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html +++ b/external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html @@ -7,7 +7,7 @@ <title>Postfix SMTP relay and access control </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -55,7 +55,7 @@ policies </a> </h2> Mail servers happily forwarded mail on behalf of anyone towards any destination. On today's Internet, spammers abuse servers that forward mail from arbitrary systems, and abused systems end up on -anti-spammer blacklists. See, for example, the information on +anti-spammer denylists. See, for example, the information on <a href="http://www.mail-abuse.org/">http://www.mail-abuse.org/</a> and other websites. </p> <p> By default, Postfix has a moderately restrictive approach to @@ -87,11 +87,11 @@ SMTP client implementations. Protocol-oriented access controls become less useful over time as spammers and worm writers learn to read RFC documents. </p> -<li> <p> Blacklist oriented: some SMTP server access controls -query blacklists with known to be bad sites such as open mail +<li> <p> Denylist oriented: some SMTP server access controls +query denylists with known to be bad sites such as open mail relays, open web proxies, and home computers that have been compromised and that are under remote control by criminals. The -effectiveness of these blacklists depends on how complete and how +effectiveness of these denylists depends on how complete and how up to date they are. </p> <li> <p> Threshold oriented: some SMTP server access controls attempt @@ -145,7 +145,7 @@ no"). </p> <ul> -<li> <p> Disallowing <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> address syntax (example: "MAIL FROM: the +<li> <p> Disallowing <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> address syntax (example: "MAIL FROM: the dude <dude@example.com>"). </p> <li> <p> Disallowing addresses that are not enclosed with <> @@ -218,8 +218,9 @@ some restriction produces a result of PERMIT, REJECT or DEFER (try again later). The end of each list is equivalent to a PERMIT result. By placing a PERMIT restriction before a REJECT restriction you can make exceptions for specific clients or users. This is called -whitelisting; the fourth example above allows mail from local -networks but otherwise rejects mail to arbitrary destinations. </p> +allowlisting; the <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> example above allows mail from local +networks, and from SASL authenticated clients, but otherwise rejects mail +to arbitrary destinations. </p> <p> The table below summarizes the purpose of each SMTP access restriction list. All lists use the exact same syntax; they differ @@ -320,7 +321,7 @@ until the RCPT TO command, it can log the sender and the recipient address. This is more useful than logging only the client hostname and IP address and not knowing whose mail was being blocked. </p> -<li> <p> Mixing is needed for complex whitelisting policies. For +<li> <p> Mixing is needed for complex allowlisting policies. For example, in order to reject local sender addresses in mail from non-local clients, you need to be able to mix restrictions on client information with restrictions on sender information in the same diff --git a/external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html b/external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html index da57bc56649..3f74fc59f33 100644 --- a/external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html +++ b/external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html @@ -7,7 +7,7 @@ <title>Postfix SMTP Access Policy Delegation </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -24,14 +24,14 @@ block or accept mail at specific SMTP protocol stages. In addition, the Postfix SMTP server can delegate decisions to an external policy server (Postfix 2.1 and later). </p> -<p> With this policy delegation mechanism, a simple <a href="#greylist"> -greylist </a> policy can be implemented with only a dozen lines of +<p> With this policy delegation mechanism, a simple +<a href="#greylist">greylist</a> policy can be implemented with only a dozen lines of Perl, as is shown at the end of this document. A complete example can be found in the Postfix source code, in the directory examples/smtpd-policy. </p> <p> Another example of policy delegation is the SPF policy server -at https://web.archive.org/web/20190221142057/<a href="http://www.openspf.org/Software">http://www.openspf.org/Software</a>. </p> +at <a href="https://web.archive.org/web/20190221142057/http://www.openspf.org/Software">https://web.archive.org/web/20190221142057/http://www.openspf.org/Software</a>. </p> <p> Policy delegation is now the preferred method for adding policies to Postfix. It's much easier to develop a new feature in few lines @@ -269,7 +269,7 @@ a TCP socket at 127.0.0.1 port 9998. The second example specifies an absolute pathname of a UNIX-domain socket. The third example specifies a pathname relative to the Postfix queue directory; use this for policy servers that are spawned by the Postfix master -daemon. </p> +daemon. On many systems, "local" is a synonym for "unix".</p> <p> To create a policy service that listens on a UNIX-domain socket called "policy", and that runs under control of the Postfix <a href="spawn.8.html">spawn(8)</a> @@ -316,7 +316,7 @@ open relay. </p> <li> <p> Line 11: this increases the time that a policy server process may run to 3600 seconds. The default time limit of 1000 -seconds is too short; the policy daemon needs to run long as the +seconds is too short; the policy daemon needs to run as long as the SMTP server process that talks to it. See the <a href="spawn.8.html">spawn(8)</a> manpage for more information about the <a href="postconf.5.html#transport_time_limit"><i>transport</i>_time_limit</a> parameter. </p> @@ -565,7 +565,7 @@ each request and reply. </p> <li> <p> Line 6: this increases the time that a greylist server process may run to 3600 seconds. The default time limit of 1000 -seconds is too short; the greylist daemon needs to run long as the +seconds is too short; the greylist daemon needs to run as long as the SMTP server process that talks to it. See the <a href="spawn.8.html">spawn(8)</a> manpage for more information about the <a href="postconf.5.html#transport_time_limit"><i>transport</i>_time_limit</a> parameter. </p> @@ -615,7 +615,7 @@ client/server configuration</a>" section above. </p> domains that often appear in forged email. At some point in cyberspace/time a list of frequently forged MAIL FROM domains could be found at -<a href="http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in">http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in</a>. +<a href="https://web.archive.org/web/20080526153208/http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in">https://web.archive.org/web/20080526153208/http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in</a>. <blockquote> <pre> @@ -672,7 +672,7 @@ exceptions for mailing lists that use one-time sender addresses, because each message will be delayed due to greylisting, and the one-time sender addresses can pollute your greylist database relatively quickly. Instead of making exceptions, you can automatically -whitelist clients that survive greylisting repeatedly; this avoids +allowlist clients that survive greylisting repeatedly; this avoids most of the delays and most of the database pollution problem. </p> <blockquote> @@ -746,11 +746,11 @@ $database_name="/var/mta/greylist.db"; $greylist_delay=60; # -# Auto-whitelist threshold. Specify 0 to disable, or the number of +# Auto-allowlist threshold. Specify 0 to disable, or the number of # successful "come backs" after which a client is no longer subject # to greylisting. # -$auto_whitelist_threshold = 10; +$auto_allowlist_threshold = 10; # # Demo SMTPD access policy routine. The result is an action just like @@ -763,10 +763,10 @@ sub smtpd_access_policy { # Open the database on the fly. open_database() unless $database_obj; - # Search the auto-whitelist. - if ($auto_whitelist_threshold > 0) { + # Search the auto-allowlist. + if ($auto_allowlist_threshold > 0) { $count = read_database($attr{"client_address"}); - if ($count > $auto_whitelist_threshold) { + if ($count > $auto_allowlist_threshold) { return "dunno"; } } @@ -795,8 +795,8 @@ sub smtpd_access_policy { # syslog $syslog_priority, "request age %d", $now - $time_stamp if $verbose; if ($now - $time_stamp > $greylist_delay) { - # Update the auto-whitelist. - if ($auto_whitelist_threshold > 0) { + # Update the auto-allowlist. + if ($auto_allowlist_threshold > 0) { update_database($attr{"client_address"}, $count + 1); } return "dunno"; diff --git a/external/ibm-public/postfix/dist/html/SMTPD_PROXY_README.html b/external/ibm-public/postfix/dist/html/SMTPD_PROXY_README.html index 17dc7c2b605..9e90ed1033a 100644 --- a/external/ibm-public/postfix/dist/html/SMTPD_PROXY_README.html +++ b/external/ibm-public/postfix/dist/html/SMTPD_PROXY_README.html @@ -7,7 +7,7 @@ <title>Postfix Before-Queue Content Filter </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -199,8 +199,9 @@ usual. </p> <p> The content filter itself is not described here. You can use any filter that is SMTP enabled. For non-SMTP capable content filtering software, Bennett Todd's SMTP proxy implements a nice -Perl-based framework. See: <a href="http://bent.latency.net/smtpprox/">http://bent.latency.net/smtpprox/</a> or -https://github.com/jnorell/smtpprox.</p> +Perl-based framework. See: +<a href="https://web.archive.org/web/20151022025756/http://bent.latency.net/smtpprox/">https://web.archive.org/web/20151022025756/http://bent.latency.net/smtpprox/</a> +or <a href="https://github.com/jnorell/smtpprox/">https://github.com/jnorell/smtpprox/</a> </p> <blockquote> @@ -351,8 +352,8 @@ the top of the <a href="master.5.html">master.cf</a> file: </p> <p> By default, the filter has 100 seconds to do its work. If it takes longer then Postfix gives up and reports an error to the -remote SMTP client. You can increase this time limit (see configuration -parameter section below) but doing so is pointless because you +remote SMTP client. You can increase this time limit (see the <a href="#parameters">"Configuration +parameters"</a> section below) but doing so is pointless because you can't control when the remote SMTP client times out. </p> <h2><a name="parameters">Configuration parameters</a></h2> diff --git a/external/ibm-public/postfix/dist/html/SMTPUTF8_README.html b/external/ibm-public/postfix/dist/html/SMTPUTF8_README.html index 1a3c8d5f162..4f37c9c75e2 100644 --- a/external/ibm-public/postfix/dist/html/SMTPUTF8_README.html +++ b/external/ibm-public/postfix/dist/html/SMTPUTF8_README.html @@ -22,8 +22,8 @@ Postfix SMTPUTF8 support <h2> Overview </h2> <p> This document describes Postfix support for Email Address -Internationalization (EAI) as defined in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a> (SMTPUTF8 extension), -<a href="http://tools.ietf.org/html/rfc6532">RFC 6532</a> (Internationalized email headers) and <a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized +Internationalization (EAI) as defined in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (SMTPUTF8 extension), +<a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a> (Internationalized email headers) and <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized delivery status notifications). Introduced with Postfix version 3.0, this fully supports UTF-8 email addresses and UTF-8 message header values. </p> @@ -244,7 +244,7 @@ turned on (<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes). <p> For compatibility with pre-SMTPUTF8 environments, Postfix does not automatically set the "SMTPUTF8 requested" flag on messages -from non-SMTPUTF8 clients that contain an UTF-8 header value or +from non-SMTPUTF8 clients that contain a UTF-8 header value or UTF-8 address localpart. This would make such messages undeliverable to non-SMTPUTF8 servers, and could be a barrier to SMTPUTF8 adoption. </p> @@ -288,7 +288,7 @@ at one point in time. </p> <h3> No automatic conversions between ASCII and UTF-8 domain names. </h3> -<p> Some background: According to <a href="http://tools.ietf.org/html/rfc6530">RFC 6530</a> and related documents, +<p> Some background: According to <a href="https://tools.ietf.org/html/rfc6530">RFC 6530</a> and related documents, an internationalized domain name can appear in two forms: the UTF-8 form, and the ASCII (xn--mumble) form. An internationalized address localpart must be encoded in UTF-8; the RFCs do not define an ASCII @@ -336,7 +336,7 @@ environments</a> </h2> non-UTF-8 members. Postfix will try to deliver the non-UTF8 subscribers over "traditional" non-SMTPUTF8 sessions, as long as the message has an ASCII envelope sender address and all-ASCII header values. -The mailing list manager may have to apply <a href="http://tools.ietf.org/html/rfc2047">RFC 2047</a> encoding to +The mailing list manager may have to apply <a href="https://tools.ietf.org/html/rfc2047">RFC 2047</a> encoding to satisfy that last condition. </p> <h3> Pre-existing non-ASCII email flows </h3> @@ -352,7 +352,7 @@ if pre-SMTPUTF8 standards do not support such practice. </p> requires that non-ASCII address information is encoded in UTF-8 and will reject other encodings such as ISO-8859. It is not practical for Postfix to support multiple encodings at the same time. There -is no problem with <a href="http://tools.ietf.org/html/rfc2047">RFC 2047</a> encodings such as "=?ISO-8859-1?Q?text?=", +is no problem with <a href="https://tools.ietf.org/html/rfc2047">RFC 2047</a> encodings such as "=?ISO-8859-1?Q?text?=", because those use only characters from the ASCII characterset. </p> <h3> Rejecting non-ASCII addresses in non-SMTPUTF8 transactions </h3> diff --git a/external/ibm-public/postfix/dist/html/SOHO_README.html b/external/ibm-public/postfix/dist/html/SOHO_README.html index ce2ff14a4c3..2d86167dcb0 100644 --- a/external/ibm-public/postfix/dist/html/SOHO_README.html +++ b/external/ibm-public/postfix/dist/html/SOHO_README.html @@ -7,7 +7,7 @@ <title>Postfix Small/Home Office Hints and Tips</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -117,7 +117,7 @@ send mail between users on the same machine. </p> <p> The following example presents additional configuration. You need to combine this with basic configuration information as -discussed the first half of this document. </p> +discussed in the first half of this document. </p> <blockquote> <pre> @@ -165,7 +165,7 @@ address of their own.</p> <p> The following example presents additional configuration. You need to combine this with basic configuration information as -discussed the first half of this document. </p> +discussed in the first half of this document. </p> <blockquote> <pre> @@ -191,7 +191,7 @@ discussed the first half of this document. </p> <li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not use a domain name that is already in use by real organizations -on the Internet. See <a href="http://tools.ietf.org/html/rfc2606">RFC 2606</a> for examples of domain +on the Internet. See <a href="https://tools.ietf.org/html/rfc2606">RFC 2606</a> for examples of domain names that are guaranteed not to be owned by anyone. </p> <li> <p> Lines 5, 9, 10: This provides the mapping from @@ -288,10 +288,9 @@ that use the non-standard "<code>AUTH=<em>method.</em>...</code>" syntax in response to the EHLO command; this requires no additional Postfix client configuration. </p> </li> -<li> <p> The Postfix SMTP client does not support the obsolete -"wrappermode" protocol, which uses TCP port <code>465</code> on the -SMTP server. See <a href="TLS_README.html">TLS_README</a> for a solution that uses the -<code>stunnel</code> command. </p> </li> +<li> <p> With the setting "<a href="postconf.5.html#smtp_tls_wrappermode">smtp_tls_wrappermode</a> = yes", the Postfix +SMTP client supports the "wrappermode" protocol, which uses TCP +port 465 on the SMTP server (Postfix 3.0 and later). </p> </li> <li> <p> With the <code><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a></code> parameter, we configure the Postfix SMTP client to send username and password @@ -401,14 +400,14 @@ resort. </p> tables into one single MySQL database, and configure different Postfix queries to extract the appropriate information. </p> -<li> <p> Specify dbm instead of hash if your system uses dbm files -instead of db files. To find out what lookup tables Postfix supports, -use the command "postconf -m". </p> +<li> <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses +<b>dbm</b> files instead of <b>db</b> files. To find out what lookup +tables Postfix supports, use the command "<b>postconf -m</b>". </p> -<li> <p> Execute the command "postmap /etc/postfix/sasl_passwd" +<li> <p> Execute the command "<b>postmap /etc/postfix/sasl_passwd</b>" whenever you change the sasl_passwd table. </p> -<li> <p> Execute the command "postmap /etc/postfix/sender_relay" +<li> <p> Execute the command "<b>postmap /etc/postfix/sender_relay</b>" whenever you change the sender_relay table. </p> </ul> diff --git a/external/ibm-public/postfix/dist/html/SQLITE_README.html b/external/ibm-public/postfix/dist/html/SQLITE_README.html index 664c4666f96..bc91e5fdcb3 100644 --- a/external/ibm-public/postfix/dist/html/SQLITE_README.html +++ b/external/ibm-public/postfix/dist/html/SQLITE_README.html @@ -7,7 +7,7 @@ <title>Postfix SQLite Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -48,6 +48,10 @@ make -f Makefile.init makefiles \ </pre> </blockquote> +<p> If your SQLite shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lsqlite3". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of <a href="SQLITE_README.html">AUXLIBS_SQLITE</a>. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded SQLite database client, but only the new @@ -94,12 +98,6 @@ dbpath = /some/path/to/sqlite_database query = SELECT forw_addr FROM mxaliases WHERE alias='%s' AND status='paid' </pre> -<h2>Additional notes</h2> - -<p> The SQLite configuration interface setup allows for multiple -sqlite databases: you can use one for a virtual table, one for an -access table, and one for an aliases table if you want. </p> - <h2>Credits</h2> <p> SQLite support was added with Postfix version 2.8. </p> diff --git a/external/ibm-public/postfix/dist/html/STANDARD_CONFIGURATION_README.html b/external/ibm-public/postfix/dist/html/STANDARD_CONFIGURATION_README.html index c767ee07898..ee076f61fca 100644 --- a/external/ibm-public/postfix/dist/html/STANDARD_CONFIGURATION_README.html +++ b/external/ibm-public/postfix/dist/html/STANDARD_CONFIGURATION_README.html @@ -7,7 +7,7 @@ <title>Postfix Standard Configuration Examples</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -168,7 +168,7 @@ at their default settings. </p> <p> First we present the non-mailhost configuration, because it is the simpler one. This machine sends mail as "user@example.com" and -is final destination for "user@hostname.example.com". </p> +is the final destination for "user@hostname.example.com". </p> <blockquote> <pre> @@ -198,7 +198,7 @@ a firewall</a>". </p> </ul> <p> Next we present the mailhost configuration. This machine sends -mail as "user@example.com" and is final destination for +mail as "user@example.com" and is the final destination for "user@hostname.example.com" as well as "user@example.com". </p> <blockquote> @@ -341,7 +341,7 @@ All the mail to these two accounts is forwarded to an inside address. only address literals matching $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> are deemed local. So "localpart@[a.d.d.r]" can be matched as simply "localpart" in <a href="canonical.5.html">canonical(5)</a> and <a href="virtual.5.html">virtual(5)</a>. This avoids the need to -specify firewall IP addresses into Postfix configuration files. </p> +specify firewall IP addresses in Postfix configuration files. </p> </ul> @@ -478,7 +478,7 @@ out what Postfix version you have, execute the command "<b>postconf <p> The following example presents additional configuration. You need to combine this with basic configuration information as -discussed the first half of this document. </p> +discussed in the first half of this document. </p> <blockquote> <pre> @@ -526,7 +526,7 @@ you edit the transport table. </p> <h2><a name="backup">Configuring Postfix as primary or backup MX host for a remote site</a></h2> <p> This section presents additional configuration. You need to -combine this with basic configuration information as discussed the +combine this with basic configuration information as discussed in the first half of this document. </p> <p> When your system is SECONDARY MX host for a remote site this @@ -642,7 +642,7 @@ of the time. For dialup connections that are up 24x7, see the <a href="#local_network">local area network</a> section above. </p> <p> This section presents additional configuration. You need to -combine this with basic configuration information as discussed the +combine this with basic configuration information as discussed in the first half of this document. </p> <p> If you do not have your own hostname and IP address (usually @@ -749,7 +749,7 @@ send mail between users on the same machine. </p> <p> The following example presents additional configuration. You need to combine this with basic configuration information as -discussed the first half of this document. </p> +discussed in the first half of this document. </p> <blockquote> <pre> @@ -797,7 +797,7 @@ address of their own.</p> <p> The following example presents additional configuration. You need to combine this with basic configuration information as -discussed the first half of this document. </p> +discussed in the first half of this document. </p> <blockquote> <pre> @@ -823,7 +823,7 @@ discussed the first half of this document. </p> <li> <p> Lines 2-3: Substitute your fantasy hostname here. Do not use a domain name that is already in use by real organizations -on the Internet. See <a href="http://tools.ietf.org/html/rfc2606">RFC 2606</a> for examples of domain +on the Internet. See <a href="https://tools.ietf.org/html/rfc2606">RFC 2606</a> for examples of domain names that are guaranteed not to be owned by anyone. </p> <li> <p> Lines 5, 9, 10: This provides the mapping from diff --git a/external/ibm-public/postfix/dist/html/STRESS_README.html b/external/ibm-public/postfix/dist/html/STRESS_README.html index 2e384ba3399..bc2afb8366c 100644 --- a/external/ibm-public/postfix/dist/html/STRESS_README.html +++ b/external/ibm-public/postfix/dist/html/STRESS_README.html @@ -7,7 +7,7 @@ <title>Postfix Stress-Dependent Configuration</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -354,7 +354,7 @@ such as SMTP access maps. The Postfix SMTP server will reject mail and disconnect without waiting for the remote SMTP client to send a QUIT command. </p> -<li> <p> To hang up connections from blacklisted zombies, you can +<li> <p> To hang up connections from denylisted zombies, you can set specific Postfix SMTP server reject codes for specific RBLs, and for individual responses from specific RBLs. We'll use zen.spamhaus.org as an example; by the time you read this document, @@ -543,7 +543,7 @@ services that accept remote connections. </p> <p> The <a href="postscreen.8.html">postscreen(8)</a> daemon, introduced with Postfix 2.8, provides additional protection against mail server overload. One <a href="postscreen.8.html">postscreen(8)</a> process handles multiple inbound SMTP connections, and decides which -clients may to talk to a Postfix SMTP server process. By keeping +clients may talk to a Postfix SMTP server process. By keeping spambots away, <a href="postscreen.8.html">postscreen(8)</a> leaves more SMTP server processes available for legitimate clients, and delays the onset of server overload conditions. </p> diff --git a/external/ibm-public/postfix/dist/html/TLS_LEGACY_README.html b/external/ibm-public/postfix/dist/html/TLS_LEGACY_README.html index 15b3f143795..1d8a8ae8d41 100644 --- a/external/ibm-public/postfix/dist/html/TLS_LEGACY_README.html +++ b/external/ibm-public/postfix/dist/html/TLS_LEGACY_README.html @@ -7,7 +7,7 @@ <title>Postfix legacy TLS Support </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -33,9 +33,9 @@ encrypted session protects the information that is transmitted with SMTP mail or with SASL authentication. <p> Postfix version 2.2 introduces support for TLS as described in -<a href="http://tools.ietf.org/html/rfc3207">RFC 3207</a>. TLS Support for older Postfix versions was available as +<a href="https://tools.ietf.org/html/rfc3207">RFC 3207</a>. TLS Support for older Postfix versions was available as an add-on patch. The section "<a href="#compat">Compatibility with -Postfix < 2.2 TLS support</a>" below discusses the differences +Postfix < 2.2 TLS support</a>" below discusses the differences between these implementations. </p> <p> Topics covered in this document: </p> @@ -54,7 +54,7 @@ between these implementations. </p> <li><a href="#problems"> Reporting problems </a> -<li><a href="#compat">Compatibility with Postfix < 2.2 TLS support</a> +<li><a href="#compat">Compatibility with Postfix < 2.2 TLS support</a> <li><a href="#credits"> Credits </a> @@ -225,7 +225,7 @@ key configuration </a> </h3> <p> In order to use TLS, the Postfix SMTP server needs a certificate and a private key. Both must be in "pem" format. The private key must not be encrypted, meaning: the key must be accessible without -password. Both certificate and private key may be in the same +a password. Both certificate and private key may be in the same file. </p> <p> Both RSA and DSA certificates are supported. Typically you will @@ -253,7 +253,7 @@ CA". Create the server.pem file with: </p> </blockquote> <p> A Postfix SMTP server certificate supplied here must be usable -as SSL server certificate and hence pass the "openssl verify -purpose +as an SSL server certificate and hence pass the "openssl verify -purpose sslserver ..." test. </p> <p> A client that trusts the root CA has a local copy of the root @@ -425,7 +425,7 @@ private key. This is intended behavior. </p> <p> You can ENFORCE the use of TLS, so that the Postfix SMTP server announces STARTTLS and accepts no mail without TLS encryption, by -setting "<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> = yes". According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST +setting "<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> = yes". According to <a href="https://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST NOT be applied in case of a publicly-referenced Postfix SMTP server. This option is off by default and should only seldom be used. </p> @@ -575,7 +575,7 @@ $<a href="postconf.5.html#data_directory">data_directory</a>, and a warning is l <p> Cached Postfix SMTP server session information expires after a certain amount of time. Postfix/TLS does not use the OpenSSL -default of 300s, but a longer time of 3600sec (=1 hour). <a href="http://tools.ietf.org/html/rfc2246">RFC 2246</a> +default of 300s, but a longer time of 3600sec (=1 hour). <a href="https://tools.ietf.org/html/rfc2246">RFC 2246</a> recommends a maximum of 24 hours. </p> <p> Example: </p> @@ -616,7 +616,7 @@ as a key for the specified <a href="access.5.html">access(5)</a> table. </p> </d <p> The <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a> feature must be used with caution, because it can result in too many access permissions. Use this feature only if a special CA issues the client certificates, and -only if this CA is listed as trusted CA. If other CAs are trusted, +only if this CA is listed as a trusted CA. If other CAs are trusted, any owner of a valid client certificate would be authorized. The <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a> feature can be practical for a specially created email relay server. </p> @@ -663,7 +663,7 @@ the user or host.</p> <p> To influence the Postfix SMTP server cipher selection scheme, you can give cipherlist string. A detailed description would go -to far here; please refer to the OpenSSL documentation. If you +too far here; please refer to the OpenSSL documentation. If you don't know what to do with it, simply don't touch it and leave the (openssl-)compiled in default! </p> @@ -778,7 +778,7 @@ certificate is presented. </p> key/certificate pair as the Postfix SMTP server. If a certificate is to be presented, it must be in "pem" format. The private key must not be encrypted, meaning: it must be accessible without -password. Both parts (certificate and private key) may be in the +a password. Both parts (certificate and private key) may be in the same file. </p> <p> In order for remote SMTP servers to verify the Postfix SMTP @@ -798,7 +798,7 @@ Create the client.pem file with: </p> </blockquote> <p> A Postfix SMTP client certificate supplied here must be usable -as SSL client certificate and hence pass the "openssl verify -purpose +as an SSL client certificate and hence pass the "openssl verify -purpose sslclient ..." test. </p> <p> A server that trusts the root CA has a local copy of the root @@ -949,7 +949,7 @@ $<a href="postconf.5.html#data_directory">data_directory</a>, and a warning is l <p> Cached Postfix SMTP client session information expires after a certain amount of time. Postfix/TLS does not use the OpenSSL -default of 300s, but a longer time of 3600s (=1 hour). <a href="http://tools.ietf.org/html/rfc2246">RFC 2246</a> +default of 300s, but a longer time of 3600s (=1 hour). <a href="https://tools.ietf.org/html/rfc2246">RFC 2246</a> recommends a maximum of 24 hours. </p> <p> Example: </p> @@ -1004,7 +1004,7 @@ CommonName is checked. Verification may be turned off with the <p> Enforcing the use of TLS is useful if you know that you will only -connect to servers that support <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> _and_ that present server +connect to servers that support <a href="https://tools.ietf.org/html/rfc2487">RFC 2487</a> _and_ that present server certificates that meet the above requirements. An example would be a client only sends email to one specific mailhub that offers the necessary STARTTLS support. </p> @@ -1021,7 +1021,7 @@ the necessary STARTTLS support. </p> <h3> <a name="client_tls_nopeer"> Disabling server certificate verification </a> </h3> -<p> As of <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> the requirements for hostname checking for MTA +<p> As of <a href="https://tools.ietf.org/html/rfc2487">RFC 2487</a> the requirements for hostname checking for MTA clients are not set. When TLS is required (<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> = yes), the option <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> can be set to "no" to disable strict remote SMTP server hostname checking. In this case, the mail @@ -1156,9 +1156,9 @@ policy is based on <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a h "<a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> = yes" imply "<a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a> = yes". </p> <li> <p> When both hostname and next-hop destination lookups produce -a result, the more specific per-site policy (NONE, MUST, etc) +a result, the more specific per-site policy (NONE, MUST, etc.) overrides the less specific one (MAY), and the more secure per-site -policy (MUST, etc) overrides the less secure one (NONE). </p> +policy (MUST, etc.) overrides the less secure one (NONE). </p> <li> <p> After the per-site policy lookups are combined, the result generally overrides the global policy. The exception is the less @@ -1215,7 +1215,7 @@ verification. This feature requires Postfix 2.2.9 or later. </p> example.org NONE # TLS should not be used with the host <i>smtp.example.com</i>. - smtp.example.com NONE + [smtp.example.com] NONE </pre> </blockquote> @@ -1266,7 +1266,7 @@ special CA which then issues the actual certificate...) </p> <p> To influence the Postfix SMTP client cipher selection scheme, you can give cipherlist string. A detailed description would go -to far here; please refer to the OpenSSL documentation. If you +too far here; please refer to the OpenSSL documentation. If you don't know what to do with it, simply don't touch it and leave the (openssl-)compiled in default! </p> @@ -1539,7 +1539,7 @@ Patches, when possible, are greatly appreciated too. </p> </ul> -<h2><a name="compat">Compatibility with Postfix <2.2 TLS support</a></h2> +<h2><a name="compat">Compatibility with Postfix < 2.2 TLS support</a></h2> <p> Postfix version 2.2 TLS support is based on the Postfix/TLS patch by Lutz Jänicke, but differs in a few minor ways. </p> diff --git a/external/ibm-public/postfix/dist/html/TUNING_README.html b/external/ibm-public/postfix/dist/html/TUNING_README.html index 9a378d03c97..164ef3ce73d 100644 --- a/external/ibm-public/postfix/dist/html/TUNING_README.html +++ b/external/ibm-public/postfix/dist/html/TUNING_README.html @@ -7,7 +7,7 @@ <title>Postfix Performance Tuning</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -409,9 +409,9 @@ especially if the gateway forwards to multiple MX hosts. When all MX hosts are up and accepting connections in a timely fashion, throughput will be high. If any MX host is down and completely unresponsive, the average connection latency rises to at least 1/N -* $smtp_connection_timeout, if there are N MX hosts. This limits +* $<a href="postconf.5.html#smtp_connect_timeout">smtp_connect_timeout</a>, if there are N MX hosts. This limits throughput to at most the destination concurrency * N / -$smtp_connection_timeout. </p> +$<a href="postconf.5.html#smtp_connect_timeout">smtp_connect_timeout</a>. </p> <p> For example, with a destination concurrency of 100 and 2 MX hosts, each host will handle up to 50 simultaneous connections. If @@ -422,9 +422,9 @@ multiple MX hosts need a lower connection timeout, values as low as 5s or even 1s can be used to prevent congestion when one or more, but not all MX hosts are down. </p> -<p> If necessary, set a higher transport_destination_concurrency_limit +<p> If necessary, set a higher <a href="postconf.5.html#transport_destination_concurrency_limit"><i>transport</i>_destination_concurrency_limit</a> (in <a href="postconf.5.html">main.cf</a> since this is a queue manager parameter) and a lower -smtp_connection_timeout (with a "-o" override in <a href="master.5.html">master.cf</a> since +<a href="postconf.5.html#smtp_connect_timeout">smtp_connect_timeout</a> (with a "-o" override in <a href="master.5.html">master.cf</a> since this parameter has no per-transport name) for the relay transport and any transports dedicated for specific high volume destinations. </p> diff --git a/external/ibm-public/postfix/dist/html/UUCP_README.html b/external/ibm-public/postfix/dist/html/UUCP_README.html index 32f3c790d2f..81c72161110 100644 --- a/external/ibm-public/postfix/dist/html/UUCP_README.html +++ b/external/ibm-public/postfix/dist/html/UUCP_README.html @@ -7,7 +7,7 @@ <title>Postfix and UUCP </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/VERP_README.html b/external/ibm-public/postfix/dist/html/VERP_README.html index 61f34e7723a..7915ff64692 100644 --- a/external/ibm-public/postfix/dist/html/VERP_README.html +++ b/external/ibm-public/postfix/dist/html/VERP_README.html @@ -7,7 +7,7 @@ <title>Postfix VERP Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/VIRTUAL_README.html b/external/ibm-public/postfix/dist/html/VIRTUAL_README.html index d23c57b402a..ffc02e00742 100644 --- a/external/ibm-public/postfix/dist/html/VIRTUAL_README.html +++ b/external/ibm-public/postfix/dist/html/VIRTUAL_README.html @@ -7,7 +7,7 @@ <title>Postfix Virtual Domain Hosting Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -62,7 +62,7 @@ domains, non-UNIX accounts</a> <h2><a name="canonical">Canonical versus hosted versus other domains</a></h2> -<p>Most Postfix systems are <b>final destination</b> for only a +<p>Most Postfix systems are the <b>final destination</b> for only a few domain names. These include the hostnames and [the IP addresses] of the machine that Postfix runs on, and sometimes also include the parent domain of the hostname. The remainder of this document @@ -71,7 +71,7 @@ usually implemented with the Postfix <a href="ADDRESS_CLASS_README.html#local_do as defined in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file.</p> <p> Besides the <a href="VIRTUAL_README.html#canonical">canonical domains</a>, Postfix can be configured to be -<b>final destination</b> for any number of additional domains. +the <b>final destination</b> for any number of additional domains. These domains are called hosted, because they are not directly associated with the name of the machine itself. Hosted domains are usually implemented with the <a href="ADDRESS_CLASS_README.html#virtual_alias_class">virtual alias domain</a> address class @@ -87,7 +87,7 @@ MX host becomes available. This function is implemented with the file. </p> <p> Finally, Postfix can be configured as a transit host for sending -mail across the internet. Obviously, Postfix is not final destination +mail across the internet. Obviously, Postfix is not the final destination for such mail. This function is available only for authorized clients and/or users, and is implemented by the <a href="ADDRESS_CLASS_README.html#default_domain_class">default domain</a> address class, as defined in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file. </p> diff --git a/external/ibm-public/postfix/dist/html/XCLIENT_README.html b/external/ibm-public/postfix/dist/html/XCLIENT_README.html index a58a32140d7..15125760364 100644 --- a/external/ibm-public/postfix/dist/html/XCLIENT_README.html +++ b/external/ibm-public/postfix/dist/html/XCLIENT_README.html @@ -7,7 +7,7 @@ <title>Postfix XCLIENT Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -89,7 +89,7 @@ names are shown in upper case, they are in fact case insensitive. <ul> - <li> <p> Attribute values are xtext encoded as per <a href="http://tools.ietf.org/html/rfc1891">RFC 1891</a>. + <li> <p> Attribute values are xtext encoded as per <a href="https://tools.ietf.org/html/rfc1891">RFC 1891</a>. </p> <li> <p> The NAME attribute specifies a remote SMTP client @@ -260,7 +260,7 @@ before each MAIL FROM command. </p> <h2> References </h2> <p> Moore, K, "SMTP Service Extension for Delivery Status Notifications", -<a href="http://tools.ietf.org/html/rfc1891">RFC 1891</a>, January 1996. </p> +<a href="https://tools.ietf.org/html/rfc1891">RFC 1891</a>, January 1996. </p> </body> diff --git a/external/ibm-public/postfix/dist/html/XFORWARD_README.html b/external/ibm-public/postfix/dist/html/XFORWARD_README.html index cdd79dcc935..9a43e27d32e 100644 --- a/external/ibm-public/postfix/dist/html/XFORWARD_README.html +++ b/external/ibm-public/postfix/dist/html/XFORWARD_README.html @@ -7,7 +7,7 @@ <title>Postfix XFORWARD Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -81,7 +81,7 @@ names are shown in upper case, they are in fact case insensitive. <ul> - <li> <p> Attribute values are xtext encoded as per <a href="http://tools.ietf.org/html/rfc1891">RFC 1891</a>. + <li> <p> Attribute values are xtext encoded as per <a href="https://tools.ietf.org/html/rfc1891">RFC 1891</a>. </p> <li> <p> The NAME attribute specifies the up-stream hostname, @@ -234,7 +234,7 @@ so there is no risk of information leakage. </p> <h2> References </h2> <p> Moore, K, "SMTP Service Extension for Delivery Status Notifications", -<a href="http://tools.ietf.org/html/rfc1891">RFC 1891</a>, January 1996. </p> +<a href="https://tools.ietf.org/html/rfc1891">RFC 1891</a>, January 1996. </p> </body> diff --git a/external/ibm-public/postfix/dist/html/access.5.html b/external/ibm-public/postfix/dist/html/access.5.html index 9adcb0271a7..cfbec47dd52 100644 --- a/external/ibm-public/postfix/dist/html/access.5.html +++ b/external/ibm-public/postfix/dist/html/access.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - access(5) </title> </head> <body> <pre> ACCESS(5) ACCESS(5) @@ -34,8 +34,8 @@ ACCESS(5) ACCESS(5) Alternatively, the table can be provided as a regular-expression map where patterns are given as regular expressions, or lookups can be - directed to TCP-based server. In those cases, the lookups are done in a - slightly different way as described below under "REGULAR EXPRESSION + directed to a TCP-based server. In those cases, the lookups are done in + a slightly different way as described below under "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". <b>CASE FOLDING</b> @@ -160,7 +160,7 @@ ACCESS(5) ACCESS(5) <b>REJECT ACTIONS</b> Postfix version 2.3 and later support enhanced status codes as defined - in <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a>. When no code is specified at the beginning of the <i>text</i> + in <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a>. When no code is specified at the beginning of the <i>text</i> below, Postfix inserts a default enhanced status code of "5.7.1" in the case of reject actions, and "4.7.1" in the case of defer actions. See "ENHANCED STATUS CODES" below. @@ -213,7 +213,7 @@ ACCESS(5) ACCESS(5) This feature is available in Postfix 2.1 and later. <b>DEFER_IF_PERMIT</b> <i>optional text...</i> - Defer the request if some later restriction would result in a an + Defer the request if some later restriction would result in an explicit or implicit PERMIT action. Reply with "<b>$<a href="postconf.5.html#access_map_defer_code">access_map_defer_code</a> 4.7.1</b> <i>optional text...</i>" when the optional text is specified, otherwise reply with a generic error @@ -340,7 +340,7 @@ ACCESS(5) ACCESS(5) <b>ENHANCED STATUS CODES</b> Postfix version 2.3 and later support enhanced status codes as defined - in <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a>. When an enhanced status code is specified in an access + in <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a>. When an enhanced status code is specified in an access table, it is subject to modification. The following transformations are needed when the same access table is used for client, helo, sender, or recipient access restrictions; they happen regardless of whether Post- diff --git a/external/ibm-public/postfix/dist/html/aliases.5.html b/external/ibm-public/postfix/dist/html/aliases.5.html index 5a8ad9a6da3..e7d5b663b43 100644 --- a/external/ibm-public/postfix/dist/html/aliases.5.html +++ b/external/ibm-public/postfix/dist/html/aliases.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - aliases(5) </title> </head> <body> <pre> ALIASES(5) ALIASES(5) @@ -63,8 +63,8 @@ ALIASES(5) ALIASES(5) The <i>value</i> contains one or more of the following: <i>address</i> - Mail is forwarded to <i>address</i>, which is compatible with the <a href="http://tools.ietf.org/html/rfc822">RFC</a> - <a href="http://tools.ietf.org/html/rfc822">822</a> standard. + Mail is forwarded to <i>address</i>, which is compatible with the <a href="https://tools.ietf.org/html/rfc822">RFC</a> + <a href="https://tools.ietf.org/html/rfc822">822</a> standard. <i>/file/name</i> Mail is appended to <i>/file/name</i>. See <a href="local.8.html"><b>local</b>(8)</a> for details of @@ -164,20 +164,19 @@ ALIASES(5) ALIASES(5) set to "-". <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b> - The set of characters that can separate a user name from its - extension (example: user+foo), or a .forward file name from its - extension (example: .forward+foo). + The set of characters that can separate an email address local- + part, user name, or a .forward file name from its extension. Available in Postfix version 2.3 and later: <b><a href="postconf.5.html#frozen_delivered_to">frozen_delivered_to</a> (yes)</b> - Update the <a href="local.8.html"><b>local</b>(8)</a> delivery agent's idea of the Delivered-To: - address (see <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a>) only once, at the start - of a delivery attempt; do not update the Delivered-To: address + Update the <a href="local.8.html"><b>local</b>(8)</a> delivery agent's idea of the Delivered-To: + address (see <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a>) only once, at the start + of a delivery attempt; do not update the Delivered-To: address while expanding aliases or .forward files. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) <b>SEE ALSO</b> <a href="local.8.html">local(8)</a>, local delivery agent diff --git a/external/ibm-public/postfix/dist/html/anvil.8.html b/external/ibm-public/postfix/dist/html/anvil.8.html index c4cdc4caa0d..2acb09a1c67 100644 --- a/external/ibm-public/postfix/dist/html/anvil.8.html +++ b/external/ibm-public/postfix/dist/html/anvil.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - anvil(8) </title> </head> <body> <pre> ANVIL(8) ANVIL(8) diff --git a/external/ibm-public/postfix/dist/html/bounce.5.html b/external/ibm-public/postfix/dist/html/bounce.5.html index 84377664701..78b19040661 100644 --- a/external/ibm-public/postfix/dist/html/bounce.5.html +++ b/external/ibm-public/postfix/dist/html/bounce.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - bounce(5) </title> </head> <body> <pre> BOUNCE(5) BOUNCE(5) diff --git a/external/ibm-public/postfix/dist/html/bounce.8.html b/external/ibm-public/postfix/dist/html/bounce.8.html index 67801211a20..a2768453dfe 100644 --- a/external/ibm-public/postfix/dist/html/bounce.8.html +++ b/external/ibm-public/postfix/dist/html/bounce.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - bounce(8) </title> </head> <body> <pre> BOUNCE(8) BOUNCE(8) @@ -39,16 +39,16 @@ BOUNCE(8) BOUNCE(8) and that depend on retry logic in their own client. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) - <a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a> (Format of Internet Message Bodies) - <a href="http://tools.ietf.org/html/rfc2822">RFC 2822</a> (Internet Message Format) - <a href="http://tools.ietf.org/html/rfc3462">RFC 3462</a> (Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc3834">RFC 3834</a> (Auto-Submitted: message header) - <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format) - <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) - <a href="http://tools.ietf.org/html/rfc6532">RFC 6532</a> (Internationalized Message Format) - <a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a> (Format of Internet Message Bodies) + <a href="https://tools.ietf.org/html/rfc2822">RFC 2822</a> (Internet Message Format) + <a href="https://tools.ietf.org/html/rfc3462">RFC 3462</a> (Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc3834">RFC 3834</a> (Auto-Submitted: message header) + <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format) + <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) + <a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a> (Internationalized Message Format) + <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -153,6 +153,18 @@ BOUNCE(8) BOUNCE(8) <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. + Available in Postfix 3.6 and later: + + <b><a href="postconf.5.html#enable_threaded_bounces">enable_threaded_bounces</a> (no)</b> + Enable non-delivery, success, and delay notifications that link + to the original message by including a References: and + In-Reply-To: header with the original Message-ID value. + + Available in Postfix 3.7 and later: + + <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> + The format of the Postfix-generated <b>From:</b> header. + <b>FILES</b> /var/spool/postfix/bounce/* non-delivery records /var/spool/postfix/defer/* non-delivery records diff --git a/external/ibm-public/postfix/dist/html/canonical.5.html b/external/ibm-public/postfix/dist/html/canonical.5.html index c54dc0962c3..5899a0024ce 100644 --- a/external/ibm-public/postfix/dist/html/canonical.5.html +++ b/external/ibm-public/postfix/dist/html/canonical.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - canonical(5) </title> </head> <body> <pre> CANONICAL(5) CANONICAL(5) @@ -33,8 +33,8 @@ CANONICAL(5) CANONICAL(5) Alternatively, the table can be provided as a regular-expression map where patterns are given as regular expressions, or lookups can be - directed to TCP-based server. In those cases, the lookups are done in a - slightly different way as described below under "REGULAR EXPRESSION + directed to a TCP-based server. In those cases, the lookups are done in + a slightly different way as described below under "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". By default the <a href="canonical.5.html"><b>canonical</b>(5)</a> mapping affects both message header @@ -234,7 +234,7 @@ CANONICAL(5) CANONICAL(5) <b><a href="postconf.5.html#masquerade_exceptions">masquerade_exceptions</a> (empty)</b> Optional list of user names that are not subjected to address - masquerading, even when their address matches $<a href="postconf.5.html#masquerade_domains">masquer</a>- + masquerading, even when their addresses match $<a href="postconf.5.html#masquerade_domains">masquer</a>- <a href="postconf.5.html#masquerade_domains">ade_domains</a>. <b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b> diff --git a/external/ibm-public/postfix/dist/html/cidr_table.5.html b/external/ibm-public/postfix/dist/html/cidr_table.5.html index 879a792ea81..7cad83ca0e6 100644 --- a/external/ibm-public/postfix/dist/html/cidr_table.5.html +++ b/external/ibm-public/postfix/dist/html/cidr_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - cidr_table(5) </title> </head> <body> <pre> CIDR_TABLE(5) CIDR_TABLE(5) @@ -98,13 +98,36 @@ CIDR_TABLE(5) CIDR_TABLE(5) Note: address information may be enclosed inside "[]" but this form is not required. +<b>INLINE SPECIFICATION</b> + The contents of a table may be specified in the table name. The basic + syntax is: + + <a href="postconf.5.html">main.cf</a>: + <i>parameter</i> <b>= .. <a href="cidr_table.5.html">cidr</a>:{ {</b> <i>rule-1</i> <b>}, {</b> <i>rule-2</i> <b>} .. } ..</b> + + <a href="master.5.html">master.cf</a>: + <b>.. -o {</b> <i>parameter</i> <b>= .. <a href="cidr_table.5.html">cidr</a>:{ {</b> <i>rule-1</i> <b>}, {</b> <i>rule-2</i> <b>} .. } .. } ..</b> + + Postfix ignores whitespace after '{' and before '}', and writes each + <i>rule</i> as one text line to an in-memory file: + + in-memory file: + rule-1 + rule-2 + .. + + Postfix parses the result as if it is a file in /etc/postfix. + + Note: if a rule contains <b>$</b>, specify <b>$$</b> to keep Postfix from trying to + do <i>$name</i> expansion as it evaluates a parameter value. + <b>EXAMPLE SMTPD ACCESS MAP</b> /etc/postfix/<a href="postconf.5.html">main.cf</a>: <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = ... <a href="cidr_table.5.html">cidr</a>:/etc/postfix/client.cidr ... /etc/postfix/client.<a href="cidr_table.5.html">cidr</a>: - # Rule order matters. Put more specific whitelist entries - # before more general blacklist entries. + # Rule order matters. Put more specific allowlist entries + # before more general denylist entries. 192.168.1.1 OK 192.168.0.0/16 REJECT 2001:db8::1 OK diff --git a/external/ibm-public/postfix/dist/html/cleanup.8.html b/external/ibm-public/postfix/dist/html/cleanup.8.html index a525ddc1939..994c8a81782 100644 --- a/external/ibm-public/postfix/dist/html/cleanup.8.html +++ b/external/ibm-public/postfix/dist/html/cleanup.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - cleanup(8) </title> </head> <body> <pre> CLEANUP(8) CLEANUP(8) @@ -16,55 +16,65 @@ CLEANUP(8) CLEANUP(8) The <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon processes inbound mail, inserts it into the <b>incoming</b> mail queue, and informs the queue manager of its arrival. - The <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon always performs the following transformations: + The <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon performs the following transformations: <b>o</b> Insert missing message headers: (<b>Resent-</b>) <b>From:</b>, <b>To:</b>, <b>Mes-</b> <b>sage-Id:</b>, and <b>Date:</b>. + This is enabled with the <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a></b> and + <b><a href="postconf.5.html#always_add_missing_headers">always_add_missing_headers</a></b> parameter settings. - <b>o</b> Transform envelope and header addresses to the standard + <b>o</b> Transform envelope and header addresses to the standard <i>user@fully-qualified-domain</i> form that is expected by other Post- - fix programs. This task is delegated to the <a href="trivial-rewrite.8.html"><b>trivial-rewrite</b>(8)</a> - daemon. + fix programs. This task depends on the <a href="trivial-rewrite.8.html"><b>trivial-rewrite</b>(8)</a> dae- + mon. + The header transformation is enabled with the <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_re</a>-</b> + <b><a href="postconf.5.html#local_header_rewrite_clients">write_clients</a></b> parameter setting. <b>o</b> Eliminate duplicate envelope recipient addresses. + This is enabled with the <b><a href="postconf.5.html#duplicate_filter_limit">duplicate_filter_limit</a></b> parameter set- + ting. - <b>o</b> Remove message headers: <b>Bcc</b>, <b>Content-Length</b>, <b>Resent-Bcc</b>, + <b>o</b> Remove message headers: <b>Bcc</b>, <b>Content-Length</b>, <b>Resent-Bcc</b>, <b>Return-Path</b>. - - The following address transformations are optional: + This is enabled with the <a href="postconf.5.html#message_drop_headers">message_drop_headers</a> parameter setting. <b>o</b> Optionally, rewrite all envelope and header addresses according to the mappings specified in the <a href="canonical.5.html"><b>canonical</b>(5)</a> lookup tables. + The header transformation is enabled with the <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_re</a>-</b> + <b><a href="postconf.5.html#local_header_rewrite_clients">write_clients</a></b> parameter setting. - <b>o</b> Optionally, masquerade envelope sender addresses and message - header addresses (i.e. strip host or domain information below - all domains listed in the <b><a href="postconf.5.html#masquerade_domains">masquerade_domains</a></b> parameter, except - for user names listed in <b><a href="postconf.5.html#masquerade_exceptions">masquerade_exceptions</a></b>). By default, + <b>o</b> Optionally, masquerade envelope sender addresses and message + header addresses (i.e. strip host or domain information below + all domains listed in the <b><a href="postconf.5.html#masquerade_domains">masquerade_domains</a></b> parameter, except + for user names listed in <b><a href="postconf.5.html#masquerade_exceptions">masquerade_exceptions</a></b>). By default, address masquerading does not affect envelope recipients. + The header transformation is enabled with the <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_re</a>-</b> + <b><a href="postconf.5.html#local_header_rewrite_clients">write_clients</a></b> parameter setting. <b>o</b> Optionally, expand envelope recipients according to information - found in the <a href="virtual.5.html"><b>virtual</b>(5)</a> lookup tables. + found in the <b><a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a></b> lookup tables. The <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon performs sanity checks on the content of each message. When it finds a problem, by default it returns a diagnostic - status to the client, and leaves it up to the client to deal with the - problem. Alternatively, the client can request the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon to - bounce the message back to the sender in case of trouble. + status to the cleanup service client, and leaves it up to the client to + deal with the problem. Alternatively, the client can request the + <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon to bounce the message back to the sender in case of + trouble. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) - <a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a> (MIME: Format of Internet Message Bodies) - <a href="http://tools.ietf.org/html/rfc2046">RFC 2046</a> (MIME: Media Types) - <a href="http://tools.ietf.org/html/rfc2822">RFC 2822</a> (Internet Message Format) - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) - <a href="http://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery status notifications) - <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a> (MIME: Format of Internet Message Bodies) + <a href="https://tools.ietf.org/html/rfc2046">RFC 2046</a> (MIME: Media Types) + <a href="https://tools.ietf.org/html/rfc2822">RFC 2822</a> (Internet Message Format) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) + <a href="https://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery status notifications) + <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. <b>BUGS</b> - Table-driven rewriting rules make it hard to express <b>if then else</b> and + Table-driven rewriting rules make it hard to express <b>if then else</b> and other logical relationships. <b>CONFIGURATION PARAMETERS</b> @@ -72,7 +82,7 @@ CLEANUP(8) CLEANUP(8) run for only a limited amount of time. Use the command "<b>postfix reload</b>" to speed up a change. - The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for + The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including examples. <b>COMPATIBILITY CONTROLS</b> @@ -83,16 +93,16 @@ CLEANUP(8) CLEANUP(8) Available in Postfix version 2.1 only: <b><a href="postconf.5.html#enable_errors_to">enable_errors_to</a> (no)</b> - Report mail delivery errors to the address specified with the - non-standard Errors-To: message header, instead of the envelope - sender address (this feature is removed with Postfix version - 2.2, is turned off by default with Postfix version 2.1, and is + Report mail delivery errors to the address specified with the + non-standard Errors-To: message header, instead of the envelope + sender address (this feature is removed with Postfix version + 2.2, is turned off by default with Postfix version 2.1, and is always turned on with older Postfix versions). Available in Postfix version 2.6 and later: <b><a href="postconf.5.html#always_add_missing_headers">always_add_missing_headers</a> (no)</b> - Always add (Resent-) From:, To:, Date: or Message-ID: headers + Always add (Resent-) From:, To:, Date: or Message-ID: headers when not present. Available in Postfix version 2.9 and later: @@ -103,43 +113,46 @@ CLEANUP(8) CLEANUP(8) Available in Postfix version 3.0 and later: <b><a href="postconf.5.html#message_drop_headers">message_drop_headers</a> (bcc, content-length, resent-bcc, return-path)</b> - Names of message headers that the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon will remove + Names of message headers that the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon will remove after applying <a href="header_checks.5.html"><b>header_checks</b>(5)</a> and before invoking Milter applications. + <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> + The format of the Postfix-generated <b>From:</b> header. + <b>BUILT-IN CONTENT FILTERING CONTROLS</b> Postfix built-in content filtering is meant to stop a flood of worms or viruses. It is not a general content filter. <b><a href="postconf.5.html#body_checks">body_checks</a> (empty)</b> - Optional lookup tables for content inspection as specified in + Optional lookup tables for content inspection as specified in the <a href="header_checks.5.html"><b>body_checks</b>(5)</a> manual page. <b><a href="postconf.5.html#header_checks">header_checks</a> (empty)</b> - Optional lookup tables for content inspection of primary - non-MIME message headers, as specified in the <a href="header_checks.5.html"><b>header_checks</b>(5)</a> + Optional lookup tables for content inspection of primary + non-MIME message headers, as specified in the <a href="header_checks.5.html"><b>header_checks</b>(5)</a> manual page. Available in Postfix version 2.0 and later: <b><a href="postconf.5.html#body_checks_size_limit">body_checks_size_limit</a> (51200)</b> - How much text in a message body segment (or attachment, if you + How much text in a message body segment (or attachment, if you prefer to use that term) is subjected to <a href="postconf.5.html#body_checks">body_checks</a> inspection. <b><a href="postconf.5.html#mime_header_checks">mime_header_checks</a> ($<a href="postconf.5.html#header_checks">header_checks</a>)</b> - Optional lookup tables for content inspection of MIME related - message headers, as described in the <a href="header_checks.5.html"><b>header_checks</b>(5)</a> manual + Optional lookup tables for content inspection of MIME related + message headers, as described in the <a href="header_checks.5.html"><b>header_checks</b>(5)</a> manual page. <b><a href="postconf.5.html#nested_header_checks">nested_header_checks</a> ($<a href="postconf.5.html#header_checks">header_checks</a>)</b> - Optional lookup tables for content inspection of non-MIME mes- - sage headers in attached messages, as described in the + Optional lookup tables for content inspection of non-MIME mes- + sage headers in attached messages, as described in the <a href="header_checks.5.html"><b>header_checks</b>(5)</a> manual page. Available in Postfix version 2.3 and later: <b><a href="postconf.5.html#message_reject_characters">message_reject_characters</a> (empty)</b> - The set of characters that Postfix will reject in message con- + The set of characters that Postfix will reject in message con- tent. <b><a href="postconf.5.html#message_strip_characters">message_strip_characters</a> (empty)</b> @@ -148,22 +161,23 @@ CLEANUP(8) CLEANUP(8) <b>BEFORE QUEUE MILTER CONTROLS</b> As of version 2.3, Postfix supports the Sendmail version 8 Milter (mail - filter) protocol. When mail is not received via the <a href="smtpd.8.html">smtpd(8)</a> server, + filter) protocol. When mail is not received via the <a href="smtpd.8.html">smtpd(8)</a> server, the <a href="cleanup.8.html">cleanup(8)</a> server will simulate SMTP events to the extent that this is possible. For details see the <a href="MILTER_README.html">MILTER_README</a> document. <b><a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a> (empty)</b> - A list of Milter (mail filter) applications for new mail that + A list of Milter (mail filter) applications for new mail that does not arrive via the Postfix <a href="smtpd.8.html"><b>smtpd</b>(8)</a> server. <b><a href="postconf.5.html#milter_protocol">milter_protocol</a> (6)</b> - The mail filter protocol version and optional protocol exten- - sions for communication with a Milter application; prior to + The mail filter protocol version and optional protocol exten- + sions for communication with a Milter application; prior to Postfix 2.6 the default protocol is 2. <b><a href="postconf.5.html#milter_default_action">milter_default_action</a> (tempfail)</b> - The default action when a Milter (mail filter) application is - unavailable or mis-configured. + The default action when a Milter (mail filter) response is + unavailable (for example, bad Postfix configuration or Milter + failure). <b><a href="postconf.5.html#milter_macro_daemon_name">milter_macro_daemon_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> The {daemon_name} macro value for Milter (mail filter) applica- @@ -408,7 +422,7 @@ CLEANUP(8) CLEANUP(8) <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> Enable preliminary SMTPUTF8 support for the protocols described - in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. + in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. <b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b> Detect that a message requires SMTPUTF8 support for the speci- @@ -491,7 +505,7 @@ CLEANUP(8) CLEANUP(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> The email address form that will be used in non-debug logging (info, warning, etc.). diff --git a/external/ibm-public/postfix/dist/html/defer.8.html b/external/ibm-public/postfix/dist/html/defer.8.html index 67801211a20..a2768453dfe 100644 --- a/external/ibm-public/postfix/dist/html/defer.8.html +++ b/external/ibm-public/postfix/dist/html/defer.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - bounce(8) </title> </head> <body> <pre> BOUNCE(8) BOUNCE(8) @@ -39,16 +39,16 @@ BOUNCE(8) BOUNCE(8) and that depend on retry logic in their own client. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) - <a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a> (Format of Internet Message Bodies) - <a href="http://tools.ietf.org/html/rfc2822">RFC 2822</a> (Internet Message Format) - <a href="http://tools.ietf.org/html/rfc3462">RFC 3462</a> (Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc3834">RFC 3834</a> (Auto-Submitted: message header) - <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format) - <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) - <a href="http://tools.ietf.org/html/rfc6532">RFC 6532</a> (Internationalized Message Format) - <a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a> (Format of Internet Message Bodies) + <a href="https://tools.ietf.org/html/rfc2822">RFC 2822</a> (Internet Message Format) + <a href="https://tools.ietf.org/html/rfc3462">RFC 3462</a> (Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc3834">RFC 3834</a> (Auto-Submitted: message header) + <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format) + <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) + <a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a> (Internationalized Message Format) + <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -153,6 +153,18 @@ BOUNCE(8) BOUNCE(8) <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. + Available in Postfix 3.6 and later: + + <b><a href="postconf.5.html#enable_threaded_bounces">enable_threaded_bounces</a> (no)</b> + Enable non-delivery, success, and delay notifications that link + to the original message by including a References: and + In-Reply-To: header with the original Message-ID value. + + Available in Postfix 3.7 and later: + + <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> + The format of the Postfix-generated <b>From:</b> header. + <b>FILES</b> /var/spool/postfix/bounce/* non-delivery records /var/spool/postfix/defer/* non-delivery records diff --git a/external/ibm-public/postfix/dist/html/discard.8.html b/external/ibm-public/postfix/dist/html/discard.8.html index 8523adc4a93..c324ee94e4e 100644 --- a/external/ibm-public/postfix/dist/html/discard.8.html +++ b/external/ibm-public/postfix/dist/html/discard.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - discard(8) </title> </head> <body> <pre> DISCARD(8) DISCARD(8) @@ -17,7 +17,7 @@ DISCARD(8) DISCARD(8) the queue manager. Each request specifies a queue file, a sender address, a next-hop destination that is treated as the reason for dis- carding the mail, and recipient information. The reason may be pre- - fixed with an <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a>-compatible detail code. This program expects to + fixed with an <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a>-compatible detail code. This program expects to be run from the <a href="master.8.html"><b>master</b>(8)</a> process manager. The <a href="discard.8.html"><b>discard</b>(8)</a> delivery agent pretends to deliver all recipients in the @@ -33,7 +33,7 @@ DISCARD(8) DISCARD(8) the network, and can be run chrooted at fixed low privilege. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. diff --git a/external/ibm-public/postfix/dist/html/dnsblog.8.html b/external/ibm-public/postfix/dist/html/dnsblog.8.html index a2710dc1ef6..e21033323cf 100644 --- a/external/ibm-public/postfix/dist/html/dnsblog.8.html +++ b/external/ibm-public/postfix/dist/html/dnsblog.8.html @@ -1,32 +1,32 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - dnsblog(8) </title> </head> <body> <pre> DNSBLOG(8) DNSBLOG(8) <b>NAME</b> - dnsblog - Postfix DNS white/blacklist logger + dnsblog - Postfix DNS allow/denylist logger <b>SYNOPSIS</b> <b>dnsblog</b> [generic Postfix daemon options] <b>DESCRIPTION</b> - The <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> server implements an ad-hoc DNS white/blacklist lookup + The <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> server implements an ad-hoc DNS allow/denylist lookup service. This may eventually be replaced by an UDP client that is built directly into the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server. <b>PROTOCOL</b> - With each connection, the <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> server receives a DNS white/black- - list domain name, an IP address, and an ID. If the IP address is - listed under the DNS white/blacklist, the <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> server logs the - match and replies with the query arguments plus an address list with - the resulting IP addresses, separated by whitespace, and the reply TTL. - Otherwise it replies with the query arguments plus an empty address - list and the reply TTL; the reply TTL is -1 if there is no reply, or a - negative reply that contains no SOA record. Finally, the <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> - server closes the connection. + With each connection, the <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> server receives a DNS + allow/denylist domain name, an IP address, and an ID. If the IP + address is listed under the DNS allow/denylist, the <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> server + logs the match and replies with the query arguments plus an address + list with the resulting IP addresses, separated by whitespace, and the + reply TTL. Otherwise it replies with the query arguments plus an empty + address list and the reply TTL; the reply TTL is -1 if there is no + reply, or a negative reply that contains no SOA record. Finally, the + <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> server closes the connection. <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -48,7 +48,7 @@ DNSBLOG(8) DNSBLOG(8) request before it is terminated by a built-in watchdog timer. <b><a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> (empty)</b> - Optional list of DNS white/blacklist domains, filters and weight + Optional list of DNS allow/denylist domains, filters and weight factors. <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b> diff --git a/external/ibm-public/postfix/dist/html/error.8.html b/external/ibm-public/postfix/dist/html/error.8.html index a2096fe2ff8..a85680f409d 100644 --- a/external/ibm-public/postfix/dist/html/error.8.html +++ b/external/ibm-public/postfix/dist/html/error.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - error(8) </title> </head> <body> <pre> ERROR(8) ERROR(8) @@ -17,7 +17,7 @@ ERROR(8) ERROR(8) the queue manager. Each request specifies a queue file, a sender address, the reason for non-delivery (specified as the next-hop desti- nation), and recipient information. The reason may be prefixed with an - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a>-compatible detail code; if none is specified a default 4.0.0 + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a>-compatible detail code; if none is specified a default 4.0.0 or 5.0.0 code is used instead. This program expects to be run from the <a href="master.8.html"><b>master</b>(8)</a> process manager. @@ -34,7 +34,7 @@ ERROR(8) ERROR(8) network, and can be run chrooted at fixed low privilege. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. diff --git a/external/ibm-public/postfix/dist/html/flush.8.html b/external/ibm-public/postfix/dist/html/flush.8.html index a14f8186760..e7ac243ca18 100644 --- a/external/ibm-public/postfix/dist/html/flush.8.html +++ b/external/ibm-public/postfix/dist/html/flush.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - flush(8) </title> </head> <body> <pre> FLUSH(8) FLUSH(8) diff --git a/external/ibm-public/postfix/dist/html/generic.5.html b/external/ibm-public/postfix/dist/html/generic.5.html index 17d31d57257..304fd431eb2 100644 --- a/external/ibm-public/postfix/dist/html/generic.5.html +++ b/external/ibm-public/postfix/dist/html/generic.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - generic(5) </title> </head> <body> <pre> GENERIC(5) GENERIC(5) @@ -43,8 +43,8 @@ GENERIC(5) GENERIC(5) Alternatively, the table can be provided as a regular-expression map where patterns are given as regular expressions, or lookups can be - directed to TCP-based server. In those case, the lookups are done in a - slightly different way as described below under "REGULAR EXPRESSION + directed to a TCP-based server. In those cases, the lookups are done in + a slightly different way as described below under "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". <b>CASE FOLDING</b> @@ -130,8 +130,8 @@ GENERIC(5) GENERIC(5) <b>TCP-BASED TABLES</b> This section describes how the table lookups change when lookups are directed to a TCP-based server. For a description of the TCP - client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is not - available up to and including Postfix version 2.4. + client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is + available in Postfix 2.5 and later. Each lookup operation uses the entire address once. Thus, <i>user@domain</i> mail addresses are not broken up into their <i>user</i> and <i>@domain</i> con- @@ -168,35 +168,39 @@ GENERIC(5) GENERIC(5) below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including examples. - <b><a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a></b> - Address mapping lookup table for envelope and header sender and - recipient addresses while delivering mail via SMTP. + <b><a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a> (empty)</b> + Optional lookup tables that perform address rewriting in the + Postfix SMTP client, typically to transform a locally valid + address into a globally valid address when sending mail across + the Internet. - <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b> - A list of address rewriting or forwarding mechanisms that propa- - gate an address extension from the original address to the - result. Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>, <b>for-</b> - <b>ward</b>, <b>include</b>, or <b>generic</b>. + <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> (canonical, virtual)</b> + What address lookup tables copy an address extension from the + lookup key to the lookup result. Other parameters of interest: - <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b> - The network interface addresses that this system receives mail - on. You need to stop and start Postfix when this parameter - changes. + <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b> + The network interface addresses that this mail system receives + mail on. - <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b> - Other interfaces that this machine receives mail on by way of a - proxy agent or network address translator. + <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b> + The network interface addresses that this mail system receives + mail on by way of a proxy or network address translation unit. - <b><a href="postconf.5.html#mydestination">mydestination</a></b> - List of domains that this mail system considers local. + <b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b> + The list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a> + mail delivery transport. - <b><a href="postconf.5.html#myorigin">myorigin</a></b> - The domain that is appended to locally-posted mail. + <b><a href="postconf.5.html#myorigin">myorigin</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> + The domain name that locally-posted mail appears to come from, + and that locally posted mail is delivered to. - <b><a href="postconf.5.html#owner_request_special">owner_request_special</a></b> - Give special treatment to <b>owner-</b><i>xxx</i> and <i>xxx</i><b>-request</b> addresses. + <b><a href="postconf.5.html#owner_request_special">owner_request_special</a> (yes)</b> + Enable special treatment for owner-<i>listname</i> entries in the + <a href="aliases.5.html"><b>aliases</b>(5)</a> file, and don't split owner-<i>listname</i> and <i>list-</i> + <i>name</i>-request address localparts when the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> is + set to "-". <b>SEE ALSO</b> <a href="postmap.1.html">postmap(1)</a>, Postfix lookup table manager diff --git a/external/ibm-public/postfix/dist/html/header_checks.5.html b/external/ibm-public/postfix/dist/html/header_checks.5.html index caf15b5315a..03b0f3ef70b 100644 --- a/external/ibm-public/postfix/dist/html/header_checks.5.html +++ b/external/ibm-public/postfix/dist/html/header_checks.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - header_checks(5) </title> </head> <body> <pre> HEADER_CHECKS(5) HEADER_CHECKS(5) @@ -173,7 +173,7 @@ HEADER_CHECKS(5) HEADER_CHECKS(5) Note 1: the BCC address is added as if it was specified with NOTIFY=NONE. The sender will not be notified when the BCC address is undeliverable, as long as all down-stream software - implements <a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a>. + implements <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a>. Note 2: this ignores duplicate addresses (with the same delivery status notification options). @@ -376,10 +376,10 @@ HEADER_CHECKS(5) HEADER_CHECKS(5) line at a time. A decision made for one line is not carried over to the next line. - <b>o</b> If text in the message body is encoded (<a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a>) then the rules + <b>o</b> If text in the message body is encoded (<a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a>) then the rules need to be specified for the encoded form. - <b>o</b> Likewise, when message headers are encoded (<a href="http://tools.ietf.org/html/rfc2047">RFC 2047</a>) then the + <b>o</b> Likewise, when message headers are encoded (<a href="https://tools.ietf.org/html/rfc2047">RFC 2047</a>) then the rules need to be specified for the encoded form. Message headers added by the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon itself are excluded from @@ -462,8 +462,8 @@ HEADER_CHECKS(5) HEADER_CHECKS(5) <a href="postmap.1.html">postmap(1)</a>, Postfix lookup table management <a href="postsuper.1.html">postsuper(1)</a>, Postfix janitor <a href="postcat.1.html">postcat(1)</a>, show Postfix queue file contents - <a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a>, base64 and quoted-printable encoding rules - <a href="http://tools.ietf.org/html/rfc2047">RFC 2047</a>, message header encoding for non-ASCII text + <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a>, base64 and quoted-printable encoding rules + <a href="https://tools.ietf.org/html/rfc2047">RFC 2047</a>, message header encoding for non-ASCII text <b>README FILES</b> <a href="DATABASE_README.html">DATABASE_README</a>, Postfix lookup table overview diff --git a/external/ibm-public/postfix/dist/html/index.html b/external/ibm-public/postfix/dist/html/index.html index c88728195b3..2fd0c1dc22a 100644 --- a/external/ibm-public/postfix/dist/html/index.html +++ b/external/ibm-public/postfix/dist/html/index.html @@ -7,7 +7,7 @@ <title>Postfix Documentation</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/html/ldap_table.5.html b/external/ibm-public/postfix/dist/html/ldap_table.5.html index 8d4ee06cc86..d35f5e1be05 100644 --- a/external/ibm-public/postfix/dist/html/ldap_table.5.html +++ b/external/ibm-public/postfix/dist/html/ldap_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - ldap_table(5) </title> </head> <body> <pre> LDAP_TABLE(5) LDAP_TABLE(5) @@ -88,8 +88,8 @@ LDAP_TABLE(5) LDAP_TABLE(5) (the last one provided that OpenLDAP was compiled with support for SSL): - server_host = ldapi://%2Fsome%2Fpath - ldaps://ldap.example.com:636 + server_host = <a href="ldap_table.5.html">ldapi</a>://%2Fsome%2Fpath + <a href="ldap_table.5.html">ldaps</a>://ldap.example.com:636 <b>server_port (default: 389)</b> The port the LDAP server listens on, e.g. @@ -102,7 +102,7 @@ LDAP_TABLE(5) LDAP_TABLE(5) timeout = 5 <b>search_base (No default; you must configure this)</b> - The <a href="http://tools.ietf.org/html/rfc2253">RFC2253</a> base DN at which to conduct the search, e.g. + The <a href="https://tools.ietf.org/html/rfc2253">RFC2253</a> base DN at which to conduct the search, e.g. search_base = dc=your, dc=com @@ -111,38 +111,39 @@ LDAP_TABLE(5) LDAP_TABLE(5) <b>%%</b> This is replaced by a literal '%' character. - <b>%s</b> This is replaced by the input key. <a href="http://tools.ietf.org/html/rfc2253">RFC 2253</a> quoting is + <b>%s</b> This is replaced by the input key. <a href="https://tools.ietf.org/html/rfc2253">RFC 2253</a> quoting is used to make sure that the input key does not add unex- pected metacharacters. <b>%u</b> When the input key is an address of the form user@domain, - <b>%u</b> is replaced by the (<a href="http://tools.ietf.org/html/rfc2253">RFC 2253</a>) quoted local part of the + <b>%u</b> is replaced by the (<a href="https://tools.ietf.org/html/rfc2253">RFC 2253</a>) quoted local part of the address. Otherwise, <b>%u</b> is replaced by the entire search string. If the localpart is empty, the search is sup- pressed and returns no results. <b>%d</b> When the input key is an address of the form user@domain, - <b>%d</b> is replaced by the (<a href="http://tools.ietf.org/html/rfc2253">RFC 2253</a>) quoted domain part of + <b>%d</b> is replaced by the (<a href="https://tools.ietf.org/html/rfc2253">RFC 2253</a>) quoted domain part of the address. Otherwise, the search is suppressed and returns no results. <b>%[SUD]</b> For the <b>search_base</b> parameter, the upper-case equivalents of the above expansions behave identically to their lower-case counter-parts. With the <b>result_format</b> parame- - ter (previously called <b>result_filter</b> see the COMPATIBIL- - ITY section and below), they expand to the corresponding - components of input key rather than the result value. + ter (previously called <b>result_filter</b> see the OTHER OBSO- + LETE FEATURES section and below), they expand to the cor- + responding components of input key rather than the result + value. - <b>%[1-9]</b> The patterns %1, %2, ... %9 are replaced by the corre- - sponding most significant component of the input key's - domain. If the input key is <i>user@mail.example.com</i>, then + <b>%[1-9]</b> The patterns %1, %2, ... %9 are replaced by the corre- + sponding most significant component of the input key's + domain. If the input key is <i>user@mail.example.com</i>, then %1 is <b>com</b>, %2 is <b>example</b> and %3 is <b>mail</b>. If the input key - is unqualified or does not have enough domain components + is unqualified or does not have enough domain components to satisfy all the specified patterns, the search is sup- pressed and returns no results. <b>query_filter (default: mailacceptinggeneralid=%s)</b> - The <a href="http://tools.ietf.org/html/rfc2254">RFC2254</a> filter used to search the directory, where <b>%s</b> is a + The <a href="https://tools.ietf.org/html/rfc2254">RFC2254</a> filter used to search the directory, where <b>%s</b> is a substitute for the address Postfix is trying to resolve, e.g. query_filter = (&(mail=%s)(paid_up=true)) @@ -152,27 +153,28 @@ LDAP_TABLE(5) LDAP_TABLE(5) <b>%%</b> This is replaced by a literal '%' character. (Postfix 2.2 and later). - <b>%s</b> This is replaced by the input key. <a href="http://tools.ietf.org/html/rfc2254">RFC 2254</a> quoting is - used to make sure that the input key does not add unex- + <b>%s</b> This is replaced by the input key. <a href="https://tools.ietf.org/html/rfc2254">RFC 2254</a> quoting is + used to make sure that the input key does not add unex- pected metacharacters. <b>%u</b> When the input key is an address of the form user@domain, - <b>%u</b> is replaced by the (<a href="http://tools.ietf.org/html/rfc2254">RFC 2254</a>) quoted local part of the - address. Otherwise, <b>%u</b> is replaced by the entire search - string. If the localpart is empty, the search is sup- + <b>%u</b> is replaced by the (<a href="https://tools.ietf.org/html/rfc2254">RFC 2254</a>) quoted local part of the + address. Otherwise, <b>%u</b> is replaced by the entire search + string. If the localpart is empty, the search is sup- pressed and returns no results. <b>%d</b> When the input key is an address of the form user@domain, - <b>%d</b> is replaced by the (<a href="http://tools.ietf.org/html/rfc2254">RFC 2254</a>) quoted domain part of - the address. Otherwise, the search is suppressed and + <b>%d</b> is replaced by the (<a href="https://tools.ietf.org/html/rfc2254">RFC 2254</a>) quoted domain part of + the address. Otherwise, the search is suppressed and returns no results. <b>%[SUD]</b> The upper-case equivalents of the above expansions behave - in the <b>query_filter</b> parameter identically to their - lower-case counter-parts. With the <b>result_format</b> parame- - ter (previously called <b>result_filter</b> see the COMPATIBIL- - ITY section and below), they expand to the corresponding - components of input key rather than the result value. + in the <b>query_filter</b> parameter identically to their + lower-case counter-parts. With the <b>result_format</b> parame- + ter (previously called <b>result_filter</b> see the OTHER OBSO- + LETE FEATURES section and below), they expand to the cor- + responding components of input key rather than the result + value. The above %S, %U and %D expansions are available with Postfix 2.2 and later. @@ -249,9 +251,9 @@ LDAP_TABLE(5) LDAP_TABLE(5) NOTE: DO NOT put quotes around the result format! <b>domain (default: no domain list)</b> - This is a list of domain names, paths to files, or dictionaries. - When specified, only fully qualified search keys with a - *non-empty* localpart and a matching domain are eligible for + This is a list of domain names, paths to files, or "<a href="DATABASE_README.html">type:table</a>" + databases. When specified, only fully qualified search keys with + a *non-empty* localpart and a matching domain are eligible for lookup: 'user' lookups, bare domain lookups and "@domain" lookups are not performed. This can significantly reduce the query load on the LDAP server. @@ -281,7 +283,7 @@ LDAP_TABLE(5) LDAP_TABLE(5) <b>special_result_attribute (default: empty)</b> The attribute(s) of directory entries that can contain DNs or - <a href="http://tools.ietf.org/html/rfc2255">RFC 2255</a> LDAP URLs. If found, a recursive search is performed to + <a href="https://tools.ietf.org/html/rfc2255">RFC 2255</a> LDAP URLs. If found, a recursive search is performed to retrieve the entry referenced by the DN, or the entries matched by the URL query. @@ -295,13 +297,13 @@ LDAP_TABLE(5) LDAP_TABLE(5) special, leaf or terminal) in the Postfix table definition. If the URL lists any of the table's special result attributes, these are retrieved and used recursively. A URL that does not - specify any attribute selection, is equivalent (<a href="http://tools.ietf.org/html/rfc2255">RFC 2255</a>) to a + specify any attribute selection, is equivalent (<a href="https://tools.ietf.org/html/rfc2255">RFC 2255</a>) to a URL that selects all attributes, in which case the selected attributes will be the full set of result attributes in the Postfix table. If an LDAP URL attribute-descriptor or the corresponding Postfix - LDAP table result attribute (but not both) uses <a href="http://tools.ietf.org/html/rfc2255">RFC 2255</a> + LDAP table result attribute (but not both) uses <a href="https://tools.ietf.org/html/rfc2255">RFC 2255</a> sub-type options ("attr;option"), the attribute requested from the LDAP server will include the sub-type option. In all other cases, the URL attribute and the table attribute must match @@ -522,7 +524,7 @@ LDAP_TABLE(5) LDAP_TABLE(5) LDAP SSL service can be requested by using a LDAP SSL URL in the server_host parameter: - server_host = ldaps://ldap.example.com:636 + server_host = <a href="ldap_table.5.html">ldaps</a>://ldap.example.com:636 STARTTLS can be turned on with the start_tls parameter: @@ -629,7 +631,7 @@ LDAP_TABLE(5) LDAP_TABLE(5) ing at port 389 on ldap.example.com. It will bind anonymously, search for any directory entries whose mailacceptinggeneralid attribute is "ldapuser", read the "maildrop" attributes of those found, and build a - list of their maildrops, which will be treated as <a href="http://tools.ietf.org/html/rfc822">RFC822</a> addresses to + list of their maildrops, which will be treated as <a href="https://tools.ietf.org/html/rfc822">RFC822</a> addresses to which the message will be delivered. <b>OBSOLETE MAIN.CF PARAMETERS</b> diff --git a/external/ibm-public/postfix/dist/html/lmdb_table.5.html b/external/ibm-public/postfix/dist/html/lmdb_table.5.html index 990eb7a6ae3..6fbc8b140f8 100644 --- a/external/ibm-public/postfix/dist/html/lmdb_table.5.html +++ b/external/ibm-public/postfix/dist/html/lmdb_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - lmdb_table(5) </title> </head> <body> <pre> LMDB_TABLE(5) LMDB_TABLE(5) @@ -40,13 +40,12 @@ LMDB_TABLE(5) LMDB_TABLE(5) part, address extension or domain portion. This behavior is also found with, for example, <a href="DATABASE_README.html#types">btree</a>:, <a href="DATABASE_README.html#types">hash</a>:, or <a href="ldap_table.5.html">ldap</a>: tables. - Unlike other flat-file Postfix databases, changes to an LMDB database - do not trigger automatic daemon program restart, and do not require - "<b>postfix reload</b>". + Changes to an LMDB database do not trigger an automatic daemon restart, + and do not require a daemon restart with "<b>postfix reload</b>". <b>RELIABILITY</b> LMDB's copy-on-write architecture provides safe updates, at the cost of - using more space than some other flat-file databases. Read operations + using more space than some other flat-file databases. Read operations are memory-mapped for speed. Write operations are not memory-mapped to avoid silent corruption due to stray pointer bugs. @@ -55,29 +54,29 @@ LMDB_TABLE(5) LMDB_TABLE(5) as a shared cache for <a href="verify.8.html">verify(8)</a> or <a href="postscreen.8.html">postscreen(8)</a> services. <b>SYNCHRONIZATION</b> - The Postfix LMDB adapter does not use LMDB's built-in locking scheme, - because that would require world-writable lockfiles and would violate - the Postfix security model. Instead, Postfix uses fcntl(2) locks with + The Postfix LMDB adapter does not use LMDB's built-in locking scheme, + because that would require world-writable lockfiles and would violate + the Postfix security model. Instead, Postfix uses fcntl(2) locks with whole-file granularity. Programs that use LMDB's built-in locking pro- tocol will corrupt a Postfix LMDB database or will read garbage. Every Postfix LMDB database read or write transaction must be protected - from start to end with a shared or exclusive fcntl(2) lock. A writer - may atomically downgrade an exclusive lock to a shared lock, but it + from start to end with a shared or exclusive fcntl(2) lock. A writer + may atomically downgrade an exclusive lock to a shared lock, but it must hold an exclusive lock while opening another write transaction. - Note that fcntl(2) locks do not protect transactions within the same - process against each other. If a program cannot avoid making simulta- - neous database requests, then it must protect its transactions with + Note that fcntl(2) locks do not protect transactions within the same + process against each other. If a program cannot avoid making simulta- + neous database requests, then it must protect its transactions with in-process locks, in addition to the per-process fcntl(2) locks. <b>CONFIGURATION PARAMETERS</b> - Short-lived programs automatically pick up changes to <a href="postconf.5.html">main.cf</a>. With - long-running daemon programs, Use the command "<b>postfix reload</b>" after a + Short-lived programs automatically pick up changes to <a href="postconf.5.html">main.cf</a>. With + long-running daemon programs, Use the command "<b>postfix reload</b>" after a configuration change. - <b><a href="postconf.5.html#lmdb_map_size">lmdb_map_size</a> (default: 16777216)</b> - The initial LMDB database size limit in bytes. + <b><a href="postconf.5.html#lmdb_map_size">lmdb_map_size</a> (16777216)</b> + The initial OpenLDAP LMDB database size limit in bytes. <b>SEE ALSO</b> <a href="postconf.1.html">postconf(1)</a>, Postfix supported lookup tables diff --git a/external/ibm-public/postfix/dist/html/lmtp.8.html b/external/ibm-public/postfix/dist/html/lmtp.8.html index a01589cc196..98d8879ceea 100644 --- a/external/ibm-public/postfix/dist/html/lmtp.8.html +++ b/external/ibm-public/postfix/dist/html/lmtp.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - smtp(8) </title> </head> <body> <pre> SMTP(8) SMTP(8) @@ -141,26 +141,26 @@ SMTP(8) SMTP(8) low privilege. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) - <a href="http://tools.ietf.org/html/rfc1651">RFC 1651</a> (SMTP service extensions) - <a href="http://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) - <a href="http://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message Size Declaration) - <a href="http://tools.ietf.org/html/rfc2033">RFC 2033</a> (LMTP protocol) - <a href="http://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Error Codes) - <a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a> (MIME: Format of Internet Message Bodies) - <a href="http://tools.ietf.org/html/rfc2046">RFC 2046</a> (MIME: Media Types) - <a href="http://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command) - <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining) - <a href="http://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) - <a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension) - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) - <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH command) - <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) - <a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc7672">RFC 7672</a> (SMTP security via opportunistic DANE TLS) + <a href="https://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc1651">RFC 1651</a> (SMTP service extensions) + <a href="https://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) + <a href="https://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message Size Declaration) + <a href="https://tools.ietf.org/html/rfc2033">RFC 2033</a> (LMTP protocol) + <a href="https://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Error Codes) + <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a> (MIME: Format of Internet Message Bodies) + <a href="https://tools.ietf.org/html/rfc2046">RFC 2046</a> (MIME: Media Types) + <a href="https://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command) + <a href="https://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining) + <a href="https://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) + <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) + <a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH command) + <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) + <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a> (SMTP security via opportunistic DANE TLS) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -231,7 +231,7 @@ SMTP(8) SMTP(8) <b><a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a> (yes)</b> Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO - commands as required by <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a>. + commands as required by <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>. <b><a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> (empty)</b> A mechanism to transform replies from remote SMTP servers one @@ -324,7 +324,7 @@ SMTP(8) SMTP(8) <b><a href="postconf.5.html#smtp_dns_resolver_options">smtp_dns_resolver_options</a> (empty)</b> DNS Resolver options for the Postfix SMTP client. - Available in Postfix version 2.9 and later: + Available in Postfix version 2.9 - 3.6: <b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b> Change the behavior of the smtp_*_timeout time limits, from a @@ -333,6 +333,8 @@ SMTP(8) SMTP(8) response line, SMTP message content line, or TLS protocol mes- sage). + Available in Postfix version 2.9 and later: + <b><a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a> (no)</b> Whether or not to append the "AUTH=<>" option to the MAIL FROM command in SASL-authenticated SMTP sessions. @@ -361,10 +363,38 @@ SMTP(8) SMTP(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> The email address form that will be used in non-debug logging (info, warning, etc.). + Available in Postfix 3.6 and later: + + <b><a href="postconf.5.html#dnssec_probe">dnssec_probe</a> (ns:.)</b> + The DNS query type (default: "ns") and DNS query name (default: + ".") that Postfix may use to determine whether DNSSEC validation + is available. + + <b><a href="postconf.5.html#known_tcp_ports">known_tcp_ports</a> (lmtp=24, smtp=25, smtps=submissions=465, submis-</b> + <b>sion=587)</b> + Optional setting that avoids lookups in the <b>services</b>(5) data- + base. + + Available in Postfix version 3.7 and later: + + <b><a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a> (no)</b> + Change the behavior of the smtp_*_timeout time limits, from a + time limit per plaintext or TLS read or write call, to a com- + bined time limit for sending a complete SMTP request and for + receiving a complete SMTP response. + + <b><a href="postconf.5.html#smtp_min_data_rate">smtp_min_data_rate</a> (500)</b> + The minimum plaintext data transfer rate in bytes/second for + DATA requests, when deadlines are enabled with + <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>. + + <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> + The format of the Postfix-generated <b>From:</b> header. + <b>MIME PROCESSING CONTROLS</b> Available in Postfix version 2.0 and later: @@ -508,9 +538,9 @@ SMTP(8) SMTP(8) policy by next-hop destination; when a non-empty value is speci- fied, this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter. - <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (!SSLv2, !SSLv3)</b> - List of SSL/TLS protocols that the Postfix SMTP client will use - with mandatory TLS encryption. + <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (see 'postconf -d' output)</b> + TLS protocols that the Postfix SMTP client will use with manda- + tory TLS encryption. <b><a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a> (9)</b> The verification depth for remote SMTP server certificates. @@ -567,15 +597,15 @@ SMTP(8) SMTP(8) for the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_secu</a>-</b> <b><a href="postconf.5.html#smtp_tls_security_level">rity_level</a></b> = fingerprint). - <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> (md5)</b> + <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> (see 'postconf -d' output)</b> The message digest algorithm used to construct remote SMTP server certificate fingerprints. Available in Postfix version 2.6 and later: - <b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (!SSLv2, !SSLv3)</b> - List of TLS protocols that the Postfix SMTP client will exclude - or include with opportunistic TLS encryption. + <b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (see postconf -d output)</b> + TLS protocols that the Postfix SMTP client will use with oppor- + tunistic TLS encryption. <b><a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> (medium)</b> The minimum TLS cipher grade that the Postfix SMTP client will @@ -605,10 +635,10 @@ SMTP(8) SMTP(8) Available in Postfix version 2.11-3.1: <b><a href="postconf.5.html#tls_dane_digest_agility">tls_dane_digest_agility</a> (on)</b> - Configure <a href="http://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility. + Configure <a href="https://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility. <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b> - Enable support for <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain + Enable support for <a href="https://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain digests of trust-anchors with certificate usage "2". Available in Postfix version 2.11 and later: @@ -632,7 +662,7 @@ SMTP(8) SMTP(8) Available in Postfix version 3.1 and later: - <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (dane)</b> + <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (see 'postconf -d' output)</b> The TLS policy for MX hosts with "secure" TLSA records when the nexthop destination security level is <b>dane</b>, but the MX record was found via an "insecure" MX lookup. @@ -771,7 +801,7 @@ SMTP(8) SMTP(8) Time limit for connection cache connect, send or receive opera- tions. - Available in Postfix version 2.9 and later: + Available in Postfix version 2.9 - 3.6: <b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b> Change the behavior of the smtp_*_timeout time limits, from a @@ -792,56 +822,71 @@ SMTP(8) SMTP(8) <b><a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> (no)</b> Try to make multiple deliveries per TLS-encrypted connection. + Available in Postfix version 3.7 and later: + + <b><a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a> (no)</b> + Change the behavior of the smtp_*_timeout time limits, from a + time limit per plaintext or TLS read or write call, to a com- + bined time limit for sending a complete SMTP request and for + receiving a complete SMTP response. + + <b><a href="postconf.5.html#smtp_min_data_rate">smtp_min_data_rate</a> (500)</b> + The minimum plaintext data transfer rate in bytes/second for + DATA requests, when deadlines are enabled with + <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>. + Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon: - <b>transport_destination_concurrency_limit ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b> + <b><a href="postconf.5.html#transport_destination_concurrency_limit">transport_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b> <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b> - A transport-specific override for the default_destination_con- - currency_limit parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> + A transport-specific override for the <a href="postconf.5.html#default_destination_concurrency_limit">default_destination_con</a>- + <a href="postconf.5.html#default_destination_concurrency_limit">currency_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery transport. - <b>transport_destination_recipient_limit ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b> + <b><a href="postconf.5.html#transport_destination_recipient_limit">transport_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b> <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b> A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>- - <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> + <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery transport. <b>SMTPUTF8 CONTROLS</b> Preliminary SMTPUTF8 support is introduced with Postfix 3.0. <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> - Enable preliminary SMTPUTF8 support for the protocols described - in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. + Enable preliminary SMTPUTF8 support for the protocols described + in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. <b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b> - Detect that a message requires SMTPUTF8 support for the speci- + Detect that a message requires SMTPUTF8 support for the speci- fied mail origin classes. Available in Postfix version 3.2 and later: <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b> - Enable 'transitional' compatibility between IDNA2003 and - IDNA2008, when converting UTF-8 domain names to/from the ASCII + Enable 'transitional' compatibility between IDNA2003 and + IDNA2008, when converting UTF-8 domain names to/from the ASCII form that is used for DNS lookups. <b>TROUBLE SHOOTING CONTROLS</b> <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> - The increment in verbose logging level when a remote client or - server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. + The increment in verbose logging level when a nexthop destina- + tion, remote client or server name or network address matches a + pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> - Optional list of remote client or server hostname or network - address patterns that cause the verbose logging level to - increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. + Optional list of nexthop destination, remote client or server + name or network address patterns that, if matched, cause the + verbose logging level to increase by the amount specified in + $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. <b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b> - The recipient of postmaster notifications about mail delivery + The recipient of postmaster notifications about mail delivery problems that are caused by policy, resource, software or proto- col errors. <b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b> - What categories of Postfix-generated mail are subject to - before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, + What categories of Postfix-generated mail are subject to + before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. <b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b> @@ -849,46 +894,46 @@ SMTP(8) SMTP(8) <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#best_mx_transport">best_mx_transport</a> (empty)</b> - Where the Postfix SMTP client should deliver mail when it + Where the Postfix SMTP client should deliver mail when it detects a "mail loops back to myself" error condition. <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b> - How much time a Postfix daemon process may take to handle a + How much time a Postfix daemon process may take to handle a request before it is terminated by a built-in watchdog timer. <b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b> - The maximal number of digits after the decimal point when log- + The maximal number of digits after the decimal point when log- ging sub-second delay values. <b><a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a> (no)</b> Disable DNS lookups in the Postfix SMTP and LMTP clients. <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b> - The network interface addresses that this mail system receives + The network interface addresses that this mail system receives mail on. - <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (all)</b> - The Internet protocols Postfix will attempt to use when making + <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (see 'postconf -d output')</b> + The Internet protocols Postfix will attempt to use when making or accepting connections. <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b> - The time limit for sending or receiving information over an + The time limit for sending or receiving information over an internal communication channel. <b><a href="postconf.5.html#lmtp_assume_final">lmtp_assume_final</a> (no)</b> - When a remote LMTP server announces no DSN support, assume that - the server performs final delivery, and send "delivered" deliv- + When a remote LMTP server announces no DSN support, assume that + the server performs final delivery, and send "delivered" deliv- ery status notifications instead of "relayed". <b><a href="postconf.5.html#lmtp_tcp_port">lmtp_tcp_port</a> (24)</b> The default TCP port that the Postfix LMTP client connects to. <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> - The maximum amount of time that an idle Postfix daemon process + The maximum amount of time that an idle Postfix daemon process waits for an incoming connection before terminating voluntarily. <b><a href="postconf.5.html#max_use">max_use</a> (100)</b> @@ -902,20 +947,20 @@ SMTP(8) SMTP(8) The process name of a Postfix command or daemon process. <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b> - The network interface addresses that this mail system receives + The network interface addresses that this mail system receives mail on by way of a proxy or network address translation unit. <b><a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> (any)</b> The address type ("ipv6", "ipv4" or "any") that the Postfix SMTP - client will try first, when a destination has IPv6 and IPv4 + client will try first, when a destination has IPv6 and IPv4 addresses with equal MX preference. <b><a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> (empty)</b> - An optional numerical network address that the Postfix SMTP + An optional numerical network address that the Postfix SMTP client should bind to when making an IPv4 connection. <b><a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> (empty)</b> - An optional numerical network address that the Postfix SMTP + An optional numerical network address that the Postfix SMTP client should bind to when making an IPv6 connection. <b><a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> @@ -935,7 +980,7 @@ SMTP(8) SMTP(8) The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Available with Postfix 2.2 and earlier: @@ -953,7 +998,7 @@ SMTP(8) SMTP(8) Available with Postfix 3.0 and later: <b><a href="postconf.5.html#smtp_address_verify_target">smtp_address_verify_target</a> (rcpt)</b> - In the context of email address verification, the SMTP protocol + In the context of email address verification, the SMTP protocol stage that determines whether an email address is deliverable. Available with Postfix 3.1 and later: @@ -972,6 +1017,12 @@ SMTP(8) SMTP(8) <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. + Available in Postfix 3.7 and later: + + <b><a href="postconf.5.html#smtp_bind_address_enforce">smtp_bind_address_enforce</a> (no)</b> + Defer delivery when the Postfix SMTP client cannot apply the + <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> or <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> setting. + <b>SEE ALSO</b> <a href="generic.5.html">generic(5)</a>, output address rewriting <a href="header_checks.5.html">header_checks(5)</a>, message header content inspection diff --git a/external/ibm-public/postfix/dist/html/local.8.html b/external/ibm-public/postfix/dist/html/local.8.html index d433ac8fc44..8c237db35fa 100644 --- a/external/ibm-public/postfix/dist/html/local.8.html +++ b/external/ibm-public/postfix/dist/html/local.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - local(8) </title> </head> <body> <pre> LOCAL(8) LOCAL(8) @@ -51,11 +51,15 @@ LOCAL(8) LOCAL(8) shell), <b>$recipient</b> (complete recipient address), <b>$extension</b> (recipient address extension), <b>$domain</b> (recipient domain), <b>$local</b> (entire recipi- ent address localpart) and <b>$<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a>.</b> The forms - <i>${name?value}</i> and <i>${name:value}</i> expand conditionally to <i>value</i> when - <i>$name</i> is (is not) defined. Characters that may have special meaning to - the shell or file system are replaced by underscores. The list of - acceptable characters is specified with the <b><a href="postconf.5.html#forward_expansion_filter">forward_expansion_filter</a></b> - configuration parameter. + <i>${name?value}</i> and <i>${name?{value}}</i> (Postfix 3.0 and later) expand condi- + tionally to <i>value</i> when <i>$name</i> is defined, and the forms <i>${name:value}</i> + <i>${name:{value}}</i> (Postfix 3.0 and later) expand conditionally to <i>value</i> + when <i>$name</i> is not defined. The form <i>${name?{value1}:{value2}}</i> (Postfix + 3.0 and later) expands conditionally to <i>value1</i> when <i>$name</i> is defined, + or <i>value2</i> otherwise. Characters that may have special meaning to the + shell or file system are replaced with underscores. The list of accept- + able characters is specified with the <b><a href="postconf.5.html#forward_expansion_filter">forward_expansion_filter</a></b> configu- + ration parameter. An alias or ~/.<b>forward</b> file may list any combination of external com- mands, destination file names, <b>:include:</b> directives, or mail addresses. @@ -141,11 +145,15 @@ LOCAL(8) LOCAL(8) <b>$shell</b> (recipient shell), <b>$recipient</b> (complete recipient address), <b>$extension</b> (recipient address extension), <b>$domain</b> (recipient domain), <b>$local</b> (entire recipient address localpart) and <b>$<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a>.</b> - The forms <i>${name?value}</i> and <i>${name:value}</i> expand conditionally to <i>value</i> - when <i>$name</i> is (is not) defined. Characters that may have special mean- - ing to the shell or file system are replaced by underscores. The list - of acceptable characters is specified with the <b><a href="postconf.5.html#execution_directory_expansion_filter">execution_direc</a>-</b> - <b><a href="postconf.5.html#execution_directory_expansion_filter">tory_expansion_filter</a></b> configuration parameter. + The forms <i>${name?value}</i> and <i>${name?{value}}</i> (Postfix 3.0 and later) + expand conditionally to <i>value</i> when <i>$name</i> is defined, and the forms + <i>${name:value}</i> and <i>${name:{value}}</i> (Postfix 3.0 and later) expand condi- + tionally to <i>value</i> when <i>$name</i> is not defined. The form + <i>${name?{value1}:{value2}}</i> (Postfix 3.0 and later) expands conditionally + to <i>value1</i> when <i>$name</i> is defined, or <i>value2</i> otherwise. Characters that + may have special meaning to the shell or file system are replaced with + underscores. The list of acceptable characters is specified with the + <b><a href="postconf.5.html#execution_directory_expansion_filter">execution_directory_expansion_filter</a></b> configuration parameter. The command is executed directly where possible. Assistance by the shell (<b>/bin/sh</b> on UNIX systems) is used only when the command contains @@ -159,14 +167,14 @@ LOCAL(8) LOCAL(8) follow the conventions defined in <<b>sysexits.h</b>>. Exit status 0 means normal successful completion. - Postfix version 2.3 and later support <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a>-style enhanced status + Postfix version 2.3 and later support <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a>-style enhanced status codes. If a command terminates with a non-zero exit status, and the command output begins with an enhanced status code, this status code takes precedence over the non-zero exit status. A limited amount of message context is exported via environment vari- ables. Characters that may have special meaning to the shell are - replaced by underscores. The list of acceptable characters is speci- + replaced with underscores. The list of acceptable characters is speci- fied with the <b><a href="postconf.5.html#command_expansion_filter">command_expansion_filter</a></b> configuration parameter. <b>SHELL</b> The recipient user's login shell. @@ -279,8 +287,8 @@ LOCAL(8) LOCAL(8) the <b><a href="postconf.5.html#default_privs">default_privs</a></b> configuration parameter. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -421,7 +429,7 @@ LOCAL(8) LOCAL(8) <b><a href="postconf.5.html#command_execution_directory">command_execution_directory</a> (empty)</b> The <a href="local.8.html"><b>local</b>(8)</a> delivery agent working directory for delivery to - external command. + external commands. <b>MAILBOX LOCKING CONTROLS</b> <b><a href="postconf.5.html#deliver_lock_attempts">deliver_lock_attempts</a> (20)</b> @@ -480,7 +488,7 @@ LOCAL(8) LOCAL(8) <b><a href="postconf.5.html#default_privs">default_privs</a> (nobody)</b> The default rights used by the <a href="local.8.html"><b>local</b>(8)</a> delivery agent for - delivery to external file or command. + delivery to an external file or command. <b><a href="postconf.5.html#forward_expansion_filter">forward_expansion_filter</a> (see 'postconf -d' output)</b> Restrict the characters that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent allows @@ -521,7 +529,7 @@ LOCAL(8) LOCAL(8) <b><a href="postconf.5.html#local_command_shell">local_command_shell</a> (empty)</b> Optional shell program for <a href="local.8.html"><b>local</b>(8)</a> delivery to non-Postfix com- - mand. + mands. <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> The maximum amount of time that an idle Postfix daemon process @@ -550,9 +558,8 @@ LOCAL(8) LOCAL(8) The location of the Postfix top-level queue directory. <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b> - The set of characters that can separate a user name from its - extension (example: user+foo), or a .forward file name from its - extension (example: .forward+foo). + The set of characters that can separate an email address local- + part, user name, or a .forward file name from its extension. <b><a href="postconf.5.html#require_home_directory">require_home_directory</a> (no)</b> Require that a <a href="local.8.html"><b>local</b>(8)</a> recipient's home directory exists before @@ -562,14 +569,14 @@ LOCAL(8) LOCAL(8) The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Available in Postfix version 3.3 and later: <b><a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a> (yes)</b> - Enable support for the original recipient address after an - address is rewritten to a different address (for example with + Enable support for the original recipient address after an + address is rewritten to a different address (for example with aliasing or with canonical mapping). <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> @@ -577,8 +584,8 @@ LOCAL(8) LOCAL(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> - The email address form that will be used in non-debug logging + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> + The email address form that will be used in non-debug logging (info, warning, etc.). <b>FILES</b> @@ -602,10 +609,10 @@ LOCAL(8) LOCAL(8) The Secure Mailer license must be distributed with this software. <b>HISTORY</b> - The <b>Delivered-To:</b> message header appears in the <b>qmail</b> system by Daniel + The <b>Delivered-To:</b> message header appears in the <b>qmail</b> system by Daniel Bernstein. - The <i>maildir</i> structure appears in the <b>qmail</b> system by Daniel Bernstein. + The <i>maildir</i> structure appears in the <b>qmail</b> system by Daniel Bernstein. <b>AUTHOR(S)</b> Wietse Venema diff --git a/external/ibm-public/postfix/dist/html/mailq.1.html b/external/ibm-public/postfix/dist/html/mailq.1.html index 02f20fe8913..eb99f16cb0a 100644 --- a/external/ibm-public/postfix/dist/html/mailq.1.html +++ b/external/ibm-public/postfix/dist/html/mailq.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - sendmail(1) </title> </head> <body> <pre> SENDMAIL(1) SENDMAIL(1) @@ -45,24 +45,27 @@ SENDMAIL(1) SENDMAIL(1) ery attempt will be made until the mail is taken off hold. - This mode of operation is implemented by executing the + <b>#</b> The message is forced to expire. See the <a href="postsuper.1.html"><b>postsuper</b>(1)</a> + options <b>-e</b> or <b>-f</b>. + + This mode of operation is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. <b>newaliases</b> - Initialize the alias database. If no input file is specified - (with the <b>-oA</b> option, see below), the program processes the - file(s) specified with the <b><a href="postconf.5.html#alias_database">alias_database</a></b> configuration parame- - ter. If no alias database type is specified, the program uses - the type specified with the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration + Initialize the alias database. If no input file is specified + (with the <b>-oA</b> option, see below), the program processes the + file(s) specified with the <b><a href="postconf.5.html#alias_database">alias_database</a></b> configuration parame- + ter. If no alias database type is specified, the program uses + the type specified with the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration parameter. This mode of operation is implemented by running the <a href="postalias.1.html"><b>postalias</b>(1)</a> command. Note: it may take a minute or so before an alias database update - becomes visible. Use the "<b>postfix reload</b>" command to eliminate + becomes visible. Use the "<b>postfix reload</b>" command to eliminate this delay. - These and other features can be selected by specifying the appropriate - combination of command-line options. Some features are controlled by + These and other features can be selected by specifying the appropriate + combination of command-line options. Some features are controlled by parameters in the <a href="postconf.5.html"><b>main.cf</b></a> configuration file. The following options are recognized: @@ -70,13 +73,13 @@ SENDMAIL(1) SENDMAIL(1) <b>-Am</b> (ignored) <b>-Ac</b> (ignored) - Postfix sendmail uses the same configuration file regardless of + Postfix sendmail uses the same configuration file regardless of whether or not a message is an initial submission. <b>-B</b> <i>body</i><b>_</b><i>type</i> The message body MIME type: <b>7BIT</b> or <b>8BITMIME</b>. - <b>-bd</b> Go into daemon mode. This mode of operation is implemented by + <b>-bd</b> Go into daemon mode. This mode of operation is implemented by executing the "<b>postfix start</b>" command. <b>-bh</b> (ignored) @@ -86,8 +89,8 @@ SENDMAIL(1) SENDMAIL(1) <b>-bi</b> Initialize alias database. See the <b>newaliases</b> command above. - <b>-bl</b> Go into daemon mode. To accept only local connections as with - Sendmail's <b>-bl</b> option, specify "<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback</b>" in + <b>-bl</b> Go into daemon mode. To accept only local connections as with + Sendmail's <b>-bl</b> option, specify "<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback</b>" in the Postfix <a href="postconf.5.html"><b>main.cf</b></a> configuration file. <b>-bm</b> Read mail from standard input and arrange for delivery. This is @@ -95,17 +98,17 @@ SENDMAIL(1) SENDMAIL(1) <b>-bp</b> List the mail queue. See the <b>mailq</b> command above. - <b>-bs</b> Stand-alone SMTP server mode. Read SMTP commands from standard - input, and write responses to standard output. In stand-alone - SMTP server mode, mail relaying and other access controls are - disabled by default. To enable them, run the process as the + <b>-bs</b> Stand-alone SMTP server mode. Read SMTP commands from standard + input, and write responses to standard output. In stand-alone + SMTP server mode, mail relaying and other access controls are + disabled by default. To enable them, run the process as the <b><a href="postconf.5.html#mail_owner">mail_owner</a></b> user. - This mode of operation is implemented by running the <a href="smtpd.8.html"><b>smtpd</b>(8)</a> + This mode of operation is implemented by running the <a href="smtpd.8.html"><b>smtpd</b>(8)</a> daemon. - <b>-bv</b> Do not collect or deliver a message. Instead, send an email - report after verifying each recipient address. This is useful + <b>-bv</b> Do not collect or deliver a message. Instead, send an email + report after verifying each recipient address. This is useful for testing address rewriting and routing configurations. This feature is available in Postfix version 2.1 and later. @@ -113,58 +116,58 @@ SENDMAIL(1) SENDMAIL(1) <b>-C</b> <i>config</i><b>_</b><i>file</i> <b>-C</b> <i>config</i><b>_</b><i>dir</i> - The path name of the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, or of its parent - directory. This information is ignored with Postfix versions + The path name of the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, or of its parent + directory. This information is ignored with Postfix versions before 2.3. With Postfix version 3.2 and later, a non-default directory must - be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter- + be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter- nate_config_directories or <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> parame- ters. - With all Postfix versions, you can specify a directory pathname - with the MAIL_CONFIG environment variable to override the loca- + With all Postfix versions, you can specify a directory pathname + with the MAIL_CONFIG environment variable to override the loca- tion of configuration files. <b>-F</b> <i>full</i><b>_</b><i>name</i> - Set the sender full name. This overrides the NAME environment + Set the sender full name. This overrides the NAME environment variable, and is used only with messages that have no <b>From:</b> mes- sage header. <b>-f</b> <i>sender</i> - Set the envelope sender address. This is the address where + Set the envelope sender address. This is the address where delivery problems are sent to. With Postfix versions before 2.1, - the <b>Errors-To:</b> message header overrides the error return + the <b>Errors-To:</b> message header overrides the error return address. - <b>-G</b> Gateway (relay) submission, as opposed to initial user submis- - sion. Either do not rewrite addresses at all, or update incom- - plete addresses with the domain information specified with + <b>-G</b> Gateway (relay) submission, as opposed to initial user submis- + sion. Either do not rewrite addresses at all, or update incom- + plete addresses with the domain information specified with <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a></b>. This option is ignored before Postfix version 2.3. <b>-h</b> <i>hop</i><b>_</b><i>count</i> (ignored) - Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter + Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter instead. <b>-I</b> Initialize alias database. See the <b>newaliases</b> command above. - <b>-i</b> When reading a message from standard input, don't treat a line + <b>-i</b> When reading a message from standard input, don't treat a line with only a <b>.</b> character as the end of input. <b>-L</b> <i>label</i> (ignored) - The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter + The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter instead. <b>-m</b> (ignored) Backwards compatibility. <b>-N</b> <i>dsn</i> (default: 'delay, failure') - Delivery status notification control. Specify either a + Delivery status notification control. Specify either a comma-separated list with one or more of <b>failure</b> (send notifica- - tion when delivery fails), <b>delay</b> (send notification when deliv- - ery is delayed), or <b>success</b> (send notification when the message + tion when delivery fails), <b>delay</b> (send notification when deliv- + ery is delayed), or <b>success</b> (send notification when the message is delivered); or specify <b>never</b> (don't send any notifications at all). @@ -174,50 +177,50 @@ SENDMAIL(1) SENDMAIL(1) Backwards compatibility. <b>-oA</b><i>alias</i><b>_</b><i>database</i> - Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>. + Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>. See <a href="postalias.1.html"><b>postalias</b>(1)</a> for details. <b>-O</b> <i>option=value</i> (ignored) - Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration + Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration parameter in <a href="postconf.5.html"><b>main.cf</b></a> instead. <b>-o7</b> (ignored) <b>-o8</b> (ignored) - To send 8-bit or binary content, use an appropriate MIME encap- + To send 8-bit or binary content, use an appropriate MIME encap- sulation and specify the appropriate <b>-B</b> command-line option. - <b>-oi</b> When reading a message from standard input, don't treat a line + <b>-oi</b> When reading a message from standard input, don't treat a line with only a <b>.</b> character as the end of input. <b>-om</b> (ignored) The sender is never eliminated from alias etc. expansions. <b>-o</b> <i>x value</i> (ignored) - Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame- + Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame- ter in <a href="postconf.5.html"><b>main.cf</b></a> instead. <b>-r</b> <i>sender</i> - Set the envelope sender address. This is the address where + Set the envelope sender address. This is the address where delivery problems are sent to. With Postfix versions before 2.1, - the <b>Errors-To:</b> message header overrides the error return + the <b>Errors-To:</b> message header overrides the error return address. <b>-R</b> <i>return</i> - Delivery status notification control. Specify "hdrs" to return - only the header when a message bounces, "full" to return a full + Delivery status notification control. Specify "hdrs" to return + only the header when a message bounces, "full" to return a full copy (the default behavior). The <b>-R</b> option specifies an upper bound; Postfix will return only - the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> + the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> setting. This option is ignored before Postfix version 2.10. - <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe- + <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe- cuting the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. - Warning: flushing undeliverable mail frequently will result in + Warning: flushing undeliverable mail frequently will result in poor delivery performance of all other mail. <b>-q</b><i>interval</i> (ignored) @@ -226,21 +229,21 @@ SENDMAIL(1) SENDMAIL(1) <b>-qI</b><i>queueid</i> Schedule immediate delivery of mail with the specified queue ID. - This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com- + This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com- mand, and is available with Postfix version 2.4 and later. <b>-qR</b><i>site</i> - Schedule immediate delivery of all mail that is queued for the - named <i>site</i>. This option accepts only <i>site</i> names that are eligi- - ble for the "fast flush" service, and is implemented by execut- + Schedule immediate delivery of all mail that is queued for the + named <i>site</i>. This option accepts only <i>site</i> names that are eligi- + ble for the "fast flush" service, and is implemented by execut- ing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information about the "fast flush" service. <b>-qS</b><i>site</i> - This command is not implemented. Use the slower "<b>sendmail -q</b>" + This command is not implemented. Use the slower "<b>sendmail -q</b>" command instead. - <b>-t</b> Extract recipients from message headers. These are added to any + <b>-t</b> Extract recipients from message headers. These are added to any recipients specified on the command line. With Postfix versions prior to 2.1, this option requires that no @@ -256,23 +259,23 @@ SENDMAIL(1) SENDMAIL(1) This feature is available in Postfix 2.3 and later. <b>-XV</b> (Postfix 2.2 and earlier: <b>-V</b>) - Variable Envelope Return Path. Given an envelope sender address - of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i> + Variable Envelope Return Path. Given an envelope sender address + of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i> receives mail with a personalized envelope sender address. - By default, the personalized envelope sender address is - <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac- - ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu- + By default, the personalized envelope sender address is + <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac- + ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu- ration parameter. <b>-XV</b><i>xy</i> (Postfix 2.2 and earlier: <b>-V</b><i>xy</i>) - As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters, + As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters, instead of the characters specified with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delim</a>-</b> <b><a href="postconf.5.html#default_verp_delimiters">iters</a></b> configuration parameter. <b>-v</b> Send an email report of the first delivery attempt (Postfix ver- - sions 2.1 and later). Mail delivery always happens in the back- - ground. When multiple <b>-v</b> options are given, enable verbose log- + sions 2.1 and later). Mail delivery always happens in the back- + ground. When multiple <b>-v</b> options are given, enable verbose log- ging for debugging purposes. <b>-X</b> <i>log</i><b>_</b><i>file</i> (ignored) @@ -280,12 +283,42 @@ SENDMAIL(1) SENDMAIL(1) configuration parameters instead. <b>SECURITY</b> - By design, this program is not set-user (or group) id. However, it must - handle data from untrusted, possibly remote, users. Thus, the usual - precautions need to be taken against malicious inputs. + By design, this program is not set-user (or group) id. It is prepared + to handle message content from untrusted, possibly remote, users. + + However, like most Postfix programs, this program does not enforce a + security policy on its command-line arguments. Instead, it relies on + the UNIX system to enforce access policies based on the effective user + and group IDs of the process. Concretely, this means that running Post- + fix commands as root (from sudo or equivalent) on behalf of a non-root + user is likely to create privilege escalation opportunities. + + If an application runs any Postfix programs on behalf of users that do + not have normal shell access to Postfix commands, then that application + MUST restrict user-specified command-line arguments to avoid privilege + escalation. + + <b>o</b> Filter all command-line arguments, for example arguments that + contain a pathname or that specify a database access method. + These pathname checks must reject user-controlled symlinks or + hardlinks to sensitive files, and must not be vulnerable to TOC- + TOU race attacks. + + <b>o</b> Disable command options processing for all command arguments + that contain user-specified data. For example, the Postfix <a href="sendmail.1.html"><b>send-</b></a> + <a href="sendmail.1.html"><b>mail</b>(1)</a> command line MUST be structured as follows: + + <b>/path/to/sendmail</b> <i>system-arguments</i> <b>--</b> <i>user-arguments</i> + + Here, the "<b>--</b>" disables command option processing for all + <i>user-arguments</i> that follow. + + Without the "<b>--</b>", a malicious user could enable Postfix <a href="sendmail.1.html"><b>send-</b></a> + <a href="sendmail.1.html"><b>mail</b>(1)</a> command options, by specifying an email address that + starts with "<b>-</b>". <b>DIAGNOSTICS</b> - Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard + Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard error stream. <b>ENVIRONMENT</b> @@ -299,12 +332,12 @@ SENDMAIL(1) SENDMAIL(1) Enable debugging with an external command, as specified with the <b><a href="postconf.5.html#debugger_command">debugger_command</a></b> configuration parameter. - <b>NAME</b> The sender full name. This is used only with messages that have + <b>NAME</b> The sender full name. This is used only with messages that have no <b>From:</b> message header. See also the <b>-F</b> option above. <b>CONFIGURATION PARAMETERS</b> - The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- - gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a> + The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- + gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a> <a href="postconf.5.html"><b>conf</b>(5)</a> for more details including examples. <b>COMPATIBILITY CONTROLS</b> @@ -315,7 +348,7 @@ SENDMAIL(1) SENDMAIL(1) line endings from <CR><LF> into UNIX format (<LF>). <b>TROUBLE SHOOTING CONTROLS</b> - The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix + The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix system. <b><a href="postconf.5.html#debugger_command">debugger_command</a> (empty)</b> @@ -323,13 +356,15 @@ SENDMAIL(1) SENDMAIL(1) invoked with the -D option. <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> - The increment in verbose logging level when a remote client or - server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. + The increment in verbose logging level when a nexthop destina- + tion, remote client or server name or network address matches a + pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> - Optional list of remote client or server hostname or network - address patterns that cause the verbose logging level to - increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. + Optional list of nexthop destination, remote client or server + name or network address patterns that, if matched, cause the + verbose logging level to increase by the amount specified in + $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. <b>ACCESS CONTROLS</b> Available in Postfix version 2.2 and later: @@ -341,13 +376,13 @@ SENDMAIL(1) SENDMAIL(1) List of users who are authorized to view the queue. <b><a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> (<a href="DATABASE_README.html#types">static</a>:anyone)</b> - List of users who are authorized to submit mail with the <a href="sendmail.1.html"><b>send-</b></a> + List of users who are authorized to submit mail with the <a href="sendmail.1.html"><b>send-</b></a> <a href="sendmail.1.html"><b>mail</b>(1)</a> command (and with the privileged <a href="postdrop.1.html"><b>postdrop</b>(1)</a> helper com- mand). <b>RESOURCE AND RATE CONTROLS</b> <b><a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> (50000)</b> - The maximal amount of original message text that is sent in a + The maximal amount of original message text that is sent in a non-delivery notification. <b><a href="postconf.5.html#fork_attempts">fork_attempts</a> (5)</b> @@ -361,11 +396,11 @@ SENDMAIL(1) SENDMAIL(1) in the primary message headers. <b><a href="postconf.5.html#queue_run_delay">queue_run_delay</a> (300s)</b> - The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager; + The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager; prior to Postfix 2.4 the default value was 1000s. <b>FAST FLUSH CONTROLS</b> - The <a href="ETRN_README.html">ETRN_README</a> file describes configuration and operation details for + The <a href="ETRN_README.html">ETRN_README</a> file describes configuration and operation details for the Postfix "fast flush" service. <b><a href="postconf.5.html#fast_flush_domains">fast_flush_domains</a> ($<a href="postconf.5.html#relay_domains">relay_domains</a>)</b> @@ -373,26 +408,26 @@ SENDMAIL(1) SENDMAIL(1) tion logfiles with mail that is queued to those destinations. <b>VERP CONTROLS</b> - The <a href="VERP_README.html">VERP_README</a> file describes configuration and operation details of + The <a href="VERP_README.html">VERP_README</a> file describes configuration and operation details of Postfix support for variable envelope return path addresses. <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a> (+=)</b> The two default VERP delimiter characters. <b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b> - The characters Postfix accepts as VERP delimiter characters on + The characters Postfix accepts as VERP delimiter characters on the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command line and in SMTP commands. <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#alias_database">alias_database</a> (see 'postconf -d' output)</b> - The alias databases for <a href="local.8.html"><b>local</b>(8)</a> delivery that are updated with + The alias databases for <a href="local.8.html"><b>local</b>(8)</a> delivery that are updated with "<b>newaliases</b>" or with "<b>sendmail -bi</b>". <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b> The location of all postfix administrative commands. <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_directory">daemon_directory</a> (see 'postconf -d' output)</b> @@ -403,46 +438,46 @@ SENDMAIL(1) SENDMAIL(1) and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands. <b><a href="postconf.5.html#delay_warning_time">delay_warning_time</a> (0h)</b> - The time after which the sender receives a copy of the message + The time after which the sender receives a copy of the message headers of mail that is still queued. <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix - process will import from a non-Postfix parent process, or + The list of environment variables that a privileged Postfix + process will import from a non-Postfix parent process, or name=value environment overrides. <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b> - The UNIX system account that owns the Postfix queue and most + The UNIX system account that owns the Postfix queue and most Postfix daemon processes. <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b> The location of the Postfix top-level queue directory. <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> (empty)</b> - Don't rewrite message headers from remote clients at all when - this parameter is empty; otherwise, rewrite message headers and + Don't rewrite message headers from remote clients at all when + this parameter is empty; otherwise, rewrite message headers and append the specified domain name to incomplete addresses. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Postfix 3.2 and later: <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b> A list of non-default Postfix configuration directories that may - be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in - the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the + be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in + the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the MAIL_CONFIG environment parameter. <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b> - An optional list of non-default Postfix configuration directo- - ries; these directories belong to additional Postfix instances - that share the Postfix executable files and documentation with - the default Postfix instance, and that are started, stopped, + An optional list of non-default Postfix configuration directo- + ries; these directories belong to additional Postfix instances + that share the Postfix executable files and documentation with + the default Postfix instance, and that are started, stopped, etc., together with the default Postfix instance. <b>FILES</b> @@ -463,7 +498,7 @@ SENDMAIL(1) SENDMAIL(1) syslogd(8), system logging <b>README_FILES</b> - Use "<b>postconf <a href="postconf.5.html#readme_directory">readme_directory</a></b>" or "<b>postconf <a href="postconf.5.html#html_directory">html_directory</a></b>" to locate + Use "<b>postconf <a href="postconf.5.html#readme_directory">readme_directory</a></b>" or "<b>postconf <a href="postconf.5.html#html_directory">html_directory</a></b>" to locate this information. <a href="DEBUG_README.html">DEBUG_README</a>, Postfix debugging howto <a href="ETRN_README.html">ETRN_README</a>, Postfix ETRN howto diff --git a/external/ibm-public/postfix/dist/html/makedefs.1.html b/external/ibm-public/postfix/dist/html/makedefs.1.html index cf1f02c1743..46c9a9a1d87 100644 --- a/external/ibm-public/postfix/dist/html/makedefs.1.html +++ b/external/ibm-public/postfix/dist/html/makedefs.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - makedefs(1) </title> </head> <body> <pre> MAKEDEFS(1) MAKEDEFS(1) @@ -34,7 +34,7 @@ MAKEDEFS(1) MAKEDEFS(1) Specifies one or more non-default object libraries. Postfix 3.0 and later specify some of their database library dependencies with <a href="CDB_README.html">AUXLIBS_CDB</a>, <a href="LDAP_README.html">AUXLIBS_LDAP</a>, <a href="LMDB_README.html">AUXLIBS_LMDB</a>, <a href="MYSQL_README.html">AUXLIBS_MYSQL</a>, - <a href="PCRE_README.html">AUXLIBS_PCRE</a>, <a href="PGSQL_README.html">AUXLIBS_PGSQL</a>, <a href="SDBM_README.html">AUXLIBS_SDBM</a>, and <a href="SQLITE_README.html">AUXLIBS_SQLITE</a>, + <a href="PCRE_README.html">AUXLIBS_PCRE</a>, <a href="PGSQL_README.html">AUXLIBS_PGSQL</a>, AUXLIBS_SDBM, and <a href="SQLITE_README.html">AUXLIBS_SQLITE</a>, respectively. <b>CC=</b><i>compiler</i><b>_</b><i>command</i> @@ -104,47 +104,52 @@ MAKEDEFS(1) MAKEDEFS(1) <b>-DNO_PCRE</b> Do not build with PCRE support. By default, PCRE support - is compiled in when the <b>pcre-config</b> utility is installed. + is compiled in when the <b>pcre2-config</b> or <b>pcre-config</b> util- + ity are installed. <b>-DNO_POSIX_GETPW_R</b> Disable support for POSIX getpwnam_r/getpwuid_r. + <b>-DNO_RES_NCALLS</b> + Do not build with the threadsafe resolver(5) API + (res_ninit() etc.). + <b>-DNO_SIGSETJMP</b> - Use setjmp()/longjmp() instead of sigsetjmp()/sig- - longjmp(). By default, Postfix uses sigsetjmp()/sig- + Use setjmp()/longjmp() instead of sigsetjmp()/sig- + longjmp(). By default, Postfix uses sigsetjmp()/sig- longjmp() when they appear to work. <b>-DNO_SNPRINTF</b> - Use sprintf() instead of snprintf(). By default, Postfix + Use sprintf() instead of snprintf(). By default, Postfix uses snprintf() except on ancient systems. <b>DEBUG=</b><i>debug</i><b>_</b><i>level</i> - Specifies a non-default debugging level. The default is <b>-g</b>. + Specifies a non-default debugging level. The default is <b>-g</b>. Specify <b>DEBUG=</b> to turn off debugging. <b>OPT=</b><i>optimization</i><b>_</b><i>level</i> - Specifies a non-default optimization level. The default is <b>-O</b>. + Specifies a non-default optimization level. The default is <b>-O</b>. Specify <b>OPT=</b> to turn off optimization. <b>POSTFIX_INSTALL_OPTS=</b><i>-option...</i> - Specifies options for the postfix-install command, separated by - whitespace. Currently, the only supported option is + Specifies options for the postfix-install command, separated by + whitespace. Currently, the only supported option is <b>-keep-build-mtime</b>. <b>SHLIB_CFLAGS=</b><i>flags</i> - Override the compiler flags (typically, "-fPIC") for Postfix + Override the compiler flags (typically, "-fPIC") for Postfix dynamically-linked libraries and database plugins. This feature was introduced with Postfix 3.0. <b>SHLIB_RPATH=</b><i>rpath</i> - Override the runpath (typically, "'-Wl,-rpath,${SHLIB_DIR}'") + Override the runpath (typically, "'-Wl,-rpath,${SHLIB_DIR}'") for Postfix dynamically-linked libraries. This feature was introduced with Postfix 3.0. <b>SHLIB_SUFFIX=</b><i>suffix</i> - Override the filename suffix (typically, ".so") for Postfix + Override the filename suffix (typically, ".so") for Postfix dynamically-linked libraries and database plugins. This feature was introduced with Postfix 3.0. @@ -152,7 +157,7 @@ MAKEDEFS(1) MAKEDEFS(1) <b>shared=yes</b> <b>shared=no</b> - Enable (disable) Postfix builds with dynamically-linked + Enable (disable) Postfix builds with dynamically-linked libraries typically named $<a href="postconf.5.html#shlib_directory">shlib_directory</a>/libpostfix-*.so.*. This feature was introduced with Postfix 3.0. @@ -160,39 +165,39 @@ MAKEDEFS(1) MAKEDEFS(1) <b>dynamicmaps=yes</b> <b>dynamicmaps=no</b> - Enable (disable) Postfix builds with the configuration file + Enable (disable) Postfix builds with the configuration file $<a href="postconf.5.html#meta_directory">meta_directory</a>/dynamicmaps.cf and dynamically-loadable database - plugins typically named postfix-*.so.*. The setting "dynam- - icmaps=yes" implicitly enables Postfix dynamically-linked + plugins typically named postfix-*.so.*. The setting "dynam- + icmaps=yes" implicitly enables Postfix dynamically-linked libraries. This feature was introduced with Postfix 3.0. <b>pie=yes</b> - <b>pie=no</b> Enable (disable) Postfix builds with position-independent exe- + <b>pie=no</b> Enable (disable) Postfix builds with position-independent exe- cutables, on platforms where this is supported. This feature was introduced with Postfix 3.0. <i>installation</i><b>_</b><i>parameter</i><b>=</b><i>value</i>... - Override the compiled-in default value of the specified instal- - lation parameter(s). The following parameters are supported in + Override the compiled-in default value of the specified instal- + lation parameter(s). The following parameters are supported in this context: - <a href="postconf.5.html#command_directory">command_directory</a> <a href="postconf.5.html#config_directory">config_directory</a> <a href="postconf.5.html#daemon_directory">daemon_directory</a> <a href="postconf.5.html#data_directory">data_direc</a>- - <a href="postconf.5.html#data_directory">tory</a> <a href="postconf.5.html#default_database_type">default_database_type</a> <a href="postconf.5.html#html_directory">html_directory</a> <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a> - <a href="postconf.5.html#mailq_path">mailq_path</a> <a href="postconf.5.html#manpage_directory">manpage_directory</a> <a href="postconf.5.html#meta_directory">meta_directory</a> <a href="postconf.5.html#newaliases_path">newaliases_path</a> - <a href="postconf.5.html#queue_directory">queue_directory</a> <a href="postconf.5.html#readme_directory">readme_directory</a> <a href="postconf.5.html#sendmail_path">sendmail_path</a> <a href="postconf.5.html#shlib_directory">shlib_directory</a> + <a href="postconf.5.html#command_directory">command_directory</a> <a href="postconf.5.html#config_directory">config_directory</a> <a href="postconf.5.html#daemon_directory">daemon_directory</a> <a href="postconf.5.html#data_directory">data_direc</a>- + <a href="postconf.5.html#data_directory">tory</a> <a href="postconf.5.html#default_database_type">default_database_type</a> <a href="postconf.5.html#html_directory">html_directory</a> <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a> + <a href="postconf.5.html#mailq_path">mailq_path</a> <a href="postconf.5.html#manpage_directory">manpage_directory</a> <a href="postconf.5.html#meta_directory">meta_directory</a> <a href="postconf.5.html#newaliases_path">newaliases_path</a> + <a href="postconf.5.html#queue_directory">queue_directory</a> <a href="postconf.5.html#readme_directory">readme_directory</a> <a href="postconf.5.html#sendmail_path">sendmail_path</a> <a href="postconf.5.html#shlib_directory">shlib_directory</a> <a href="postconf.5.html#openssl_path">openssl_path</a> - See the <a href="postconf.5.html">postconf(5)</a> manpage for a description of these parame- + See the <a href="postconf.5.html">postconf(5)</a> manpage for a description of these parame- ters. This feature was introduced with Postfix 3.0. <b>WARN=</b><i>warning</i><b>_</b><i>flags</i> - Specifies non-default gcc compiler warning options for use when + Specifies non-default gcc compiler warning options for use when "make" is invoked in a source subdirectory only. <b>LICENSE</b> diff --git a/external/ibm-public/postfix/dist/html/master.5.html b/external/ibm-public/postfix/dist/html/master.5.html index 4e488fc021f..1b924267a26 100644 --- a/external/ibm-public/postfix/dist/html/master.5.html +++ b/external/ibm-public/postfix/dist/html/master.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - master(5) </title> </head> <body> <pre> MASTER(5) MASTER(5) @@ -15,41 +15,41 @@ MASTER(5) MASTER(5) services that run in the background. Postfix services are implemented by daemon processes. These run in the - background under control of the <a href="master.8.html"><b>master</b>(8)</a> process. The <a href="master.5.html">master.cf</a> con- - figuration file defines how a client program connects to a service, and - what daemon program runs when a service is requested. Most daemon pro- - cesses are short-lived and terminate voluntarily after serving <b><a href="postconf.5.html#max_use">max_use</a></b> - clients, or after inactivity for <b><a href="postconf.5.html#max_idle">max_idle</a></b> or more units of time. - - All daemons specified here must speak a Postfix-internal protocol. In - order to execute non-Postfix software use the <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a> or - <a href="spawn.8.html"><b>spawn</b>(8)</a> services, or run the server under control by <b>inetd</b>(8) or - equivalent. - - After changing <a href="master.5.html">master.cf</a> you must execute "<b>postfix reload</b>" to reload + background, started on-demand by the <a href="master.8.html"><b>master</b>(8)</a> process. The <a href="master.5.html">master.cf</a> + configuration file defines how a client program connects to a service, + and what daemon program runs when a service is requested. Most daemon + processes are short-lived and terminate voluntarily after serving + <b><a href="postconf.5.html#max_use">max_use</a></b> clients, or after inactivity for <b><a href="postconf.5.html#max_idle">max_idle</a></b> or more units of + time. + + All daemons specified here must speak a Postfix-internal protocol. In + order to execute non-Postfix software use the <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a> or + <a href="spawn.8.html"><b>spawn</b>(8)</a> services, or execute the software with <b>inetd</b>(8) or equivalent. + + After changing <a href="master.5.html">master.cf</a> you must execute "<b>postfix reload</b>" to reload the configuration. <b>SYNTAX</b> The general format of the <a href="master.5.html">master.cf</a> file is as follows: - <b>o</b> Empty lines and whitespace-only lines are ignored, as are lines + <b>o</b> Empty lines and whitespace-only lines are ignored, as are lines whose first non-whitespace character is a `#'. - <b>o</b> A logical line starts with non-whitespace text. A line that + <b>o</b> A logical line starts with non-whitespace text. A line that starts with whitespace continues a logical line. - <b>o</b> Each logical line defines a single Postfix service. Each ser- - vice is identified by its name and type as described below. + <b>o</b> Each logical line defines a single Postfix service. Each ser- + vice is identified by its name and type as described below. When multiple lines specify the same service name and type, only - the last one is remembered. Otherwise, the order of <a href="master.5.html">master.cf</a> + the last one is remembered. Otherwise, the order of <a href="master.5.html">master.cf</a> service definitions does not matter. - Each logical line consists of eight fields separated by whitespace. - These are described below in the order as they appear in the <a href="master.5.html">master.cf</a> + Each logical line consists of eight fields separated by whitespace. + These are described below in the order as they appear in the <a href="master.5.html">master.cf</a> file. - Where applicable a field of "-" requests that the built-in default - value be used. For boolean fields specify "y" or "n" to override the + Where applicable a field of "-" requests that the built-in default + value be used. For boolean fields specify "y" or "n" to override the default value. <b>Service name</b> @@ -59,151 +59,153 @@ MASTER(5) MASTER(5) <b>Service type</b> Specify one of the following service types: - <b>inet</b> The service listens on a TCP/IP socket and is accessible + <b>inet</b> The service listens on a TCP/IP socket and is accessible via the network. - The service name is specified as <i>host:port</i>, denoting the - host and port on which new connections should be - accepted. The host part (and colon) may be omitted. - Either host or port may be given in symbolic form (see - <b>hosts</b>(5) or <b>services</b>(5)) or in numeric form (IP address + The service name is specified as <i>host:port</i>, denoting the + host and port on which new connections should be + accepted. The host part (and colon) may be omitted. + Either host or port may be given in symbolic form (see + <b>hosts</b>(5) or <b>services</b>(5)) or in numeric form (IP address or port number). Host information may be enclosed inside "[]"; this form is necessary only with IPv6 addresses. - Examples: a service named <b>127.0.0.1:smtp</b> or <b>::1:smtp</b> + Examples: a service named <b>127.0.0.1:smtp</b> or <b>::1:smtp</b> receives mail via the loopback interface only; and a ser- - vice named <b>10025</b> accepts connections on TCP port 10025 - via all interfaces configured with the <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b> + vice named <b>10025</b> accepts connections on TCP port 10025 + via all interfaces configured with the <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b> parameter. - Note: with Postfix version 2.2 and later specify - "<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback-only</b>" in <a href="postconf.5.html">main.cf</a>, instead of - hard-coding loopback IP address information in <a href="master.5.html">master.cf</a> + Note: with Postfix version 2.2 and later specify + "<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback-only</b>" in <a href="postconf.5.html">main.cf</a>, instead of + hard-coding loopback IP address information in <a href="master.5.html">master.cf</a> or in <a href="postconf.5.html">main.cf</a>. <b>unix</b> The service listens on a UNIX-domain stream socket and is accessible for local clients only. - The service name is a pathname relative to the Postfix - queue directory (pathname controlled with the + The service name is a pathname relative to the Postfix + queue directory (pathname controlled with the <b><a href="postconf.5.html#queue_directory">queue_directory</a></b> configuration parameter in <a href="postconf.5.html">main.cf</a>). - On Solaris 8 and earlier systems the <b>unix</b> type is imple- + On Solaris 8 and earlier systems the <b>unix</b> type is imple- mented with streams sockets. <b>unix-dgram</b> - The service listens on a UNIX-domain datagram socket and + The service listens on a UNIX-domain datagram socket and is accessible for local clients only. - The service name is a pathname relative to the Postfix - queue directory (pathname controlled with the + The service name is a pathname relative to the Postfix + queue directory (pathname controlled with the <b><a href="postconf.5.html#queue_directory">queue_directory</a></b> configuration parameter in <a href="postconf.5.html">main.cf</a>). <b>fifo</b> (obsolete) - The service listens on a FIFO (named pipe) and is acces- + The service listens on a FIFO (named pipe) and is acces- sible for local clients only. - The service name is a pathname relative to the Postfix - queue directory (pathname controlled with the + The service name is a pathname relative to the Postfix + queue directory (pathname controlled with the <b><a href="postconf.5.html#queue_directory">queue_directory</a></b> configuration parameter in <a href="postconf.5.html">main.cf</a>). - <b>pass</b> The service listens on a UNIX-domain stream socket, and + <b>pass</b> The service listens on a UNIX-domain stream socket, and is accessible to local clients only. It receives one open - connection (file descriptor passing) per connection + connection (file descriptor passing) per connection request. - The service name is a pathname relative to the Postfix - queue directory (pathname controlled with the + The service name is a pathname relative to the Postfix + queue directory (pathname controlled with the <b><a href="postconf.5.html#queue_directory">queue_directory</a></b> configuration parameter in <a href="postconf.5.html">main.cf</a>). - On Solaris 8 and earlier systems the <b>pass</b> type is imple- + On Solaris 8 and earlier systems the <b>pass</b> type is imple- mented with streams sockets. This feature is available as of Postfix version 2.5. <b>Private (default: y)</b> - Whether or not access is restricted to the mail system. Inter- - net (type <b>inet</b>) services can't be private. + Whether a service is internal to Postfix (pathname starts with + <b>private/</b>), or exposed through Postfix command-line tools (path- + name starts with <b>public/</b>). Internet (type <b>inet</b>) services can't + be private. <b>Unprivileged (default: y)</b> Whether the service runs with root privileges or as the owner of the Postfix system (the owner name is controlled by the <b><a href="postconf.5.html#mail_owner">mail_owner</a></b> configuration variable in the <a href="postconf.5.html">main.cf</a> file). - The <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a>, <a href="spawn.8.html"><b>spawn</b>(8)</a>, and <a href="virtual.8.html"><b>virtual</b>(8)</a> daemons require + The <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a>, <a href="spawn.8.html"><b>spawn</b>(8)</a>, and <a href="virtual.8.html"><b>virtual</b>(8)</a> daemons require privileges. - <b>Chroot (default: Postfix</b> ><b>= 3.0: n, Postfix</b> <<b>3.0: y)</b> - Whether or not the service runs chrooted to the mail queue + <b>Chroot (default: Postfix</b> ><b>= 3.0: n, Postfix</b> < <b>3.0: y)</b> + Whether or not the service runs chrooted to the mail queue directory (pathname is controlled by the <b><a href="postconf.5.html#queue_directory">queue_directory</a></b> config- uration variable in the <a href="postconf.5.html">main.cf</a> file). - Chroot should not be used with the <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a>, <a href="spawn.8.html"><b>spawn</b>(8)</a>, + Chroot should not be used with the <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a>, <a href="spawn.8.html"><b>spawn</b>(8)</a>, and <a href="virtual.8.html"><b>virtual</b>(8)</a> daemons. Although the <a href="proxymap.8.html"><b>proxymap</b>(8)</a> server can run - chrooted, doing so defeats most of the purpose of having that + chrooted, doing so defeats most of the purpose of having that service in the first place. The files in the examples/chroot-setup subdirectory of the Post- - fix source show how to set up a Postfix chroot environment on a - variety of systems. See also <a href="BASIC_CONFIGURATION_README.html">BASIC_CONFIGURATION_README</a> for + fix source show how to set up a Postfix chroot environment on a + variety of systems. See also <a href="BASIC_CONFIGURATION_README.html">BASIC_CONFIGURATION_README</a> for issues related to running daemons chrooted. <b>Wake up time (default: 0)</b> Automatically wake up the named service after the specified num- - ber of seconds. The wake up is implemented by connecting to the - service and sending a wake up request. A ? at the end of the - wake-up time field requests that no wake up events be sent + ber of seconds. The wake up is implemented by connecting to the + service and sending a wake up request. A ? at the end of the + wake-up time field requests that no wake up events be sent before the first time a service is used. Specify 0 for no auto- matic wake up. - The <a href="pickup.8.html"><b>pickup</b>(8)</a>, <a href="qmgr.8.html"><b>qmgr</b>(8)</a> and <a href="flush.8.html"><b>flush</b>(8)</a> daemons require a wake up + The <a href="pickup.8.html"><b>pickup</b>(8)</a>, <a href="qmgr.8.html"><b>qmgr</b>(8)</a> and <a href="flush.8.html"><b>flush</b>(8)</a> daemons require a wake up timer. <b>Process limit (default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b> - The maximum number of processes that may execute this service + The maximum number of processes that may execute this service simultaneously. Specify 0 for no process count limit. - NOTE: Some Postfix services must be configured as a sin- - gle-process service (for example, <a href="qmgr.8.html"><b>qmgr</b>(8)</a>) and some services - must be configured with no process limit (for example, + NOTE: Some Postfix services must be configured as a sin- + gle-process service (for example, <a href="qmgr.8.html"><b>qmgr</b>(8)</a>) and some services + must be configured with no process limit (for example, <a href="cleanup.8.html"><b>cleanup</b>(8)</a>). These limits must not be changed. <b>Command name + arguments</b> - The command to be executed. Characters that are special to the - shell such as ">" or "|" have no special meaning here, and - quotes cannot be used to protect arguments containing white- - space. To protect whitespace, use "{" and "}" as described + The command to be executed. Characters that are special to the + shell such as ">" or "|" have no special meaning here, and + quotes cannot be used to protect arguments containing white- + space. To protect whitespace, use "{" and "}" as described below. - The command name is relative to the Postfix daemon directory - (pathname is controlled by the <b><a href="postconf.5.html#daemon_directory">daemon_directory</a></b> configuration + The command name is relative to the Postfix daemon directory + (pathname is controlled by the <b><a href="postconf.5.html#daemon_directory">daemon_directory</a></b> configuration variable). - The command argument syntax for specific commands is specified + The command argument syntax for specific commands is specified in the respective daemon manual page. - The following command-line options have the same effect for all + The following command-line options have the same effect for all daemon programs: - <b>-D</b> Run the daemon under control by the command specified + <b>-D</b> Run the daemon under control by the command specified with the <b><a href="postconf.5.html#debugger_command">debugger_command</a></b> variable in the <a href="postconf.5.html">main.cf</a> config- uration file. See <a href="DEBUG_README.html">DEBUG_README</a> for hints and tips. <b>-o {</b> <i>name</i> = <i>value</i> <b>}</b> (long form, Postfix >= 3.0) <b>-o</b> <i>name</i>=<i>value</i> (short form) - Override the named <a href="postconf.5.html">main.cf</a> configuration parameter. The - parameter value can refer to other parameters as <i>$name</i> - etc., just like in <a href="postconf.5.html">main.cf</a>. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for syntax. + Override the named <a href="postconf.5.html">main.cf</a> configuration parameter. The + parameter value can refer to other parameters as <i>$name</i> + etc., just like in <a href="postconf.5.html">main.cf</a>. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for syntax. - NOTE 1: With the "long form" shown above, whitespace - after "{", around "=", and before "}" is ignored, and + NOTE 1: With the "long form" shown above, whitespace + after "{", around "=", and before "}" is ignored, and whitespace within the parameter value is preserved. NOTE 2: with the "short form" shown above, do not specify - whitespace around the "=" or in parameter values. To - specify a parameter value that contains whitespace, use - the long form described above, or use commas instead of + whitespace around the "=" or in parameter values. To + specify a parameter value that contains whitespace, use + the long form described above, or use commas instead of spaces, or specify the value in <a href="postconf.5.html">main.cf</a>. Example: /etc/postfix/<a href="master.5.html">master.cf</a>: @@ -214,18 +216,18 @@ MASTER(5) MASTER(5) submission_xxx_yyy = text with whitespace... NOTE 3: Over-zealous use of parameter overrides makes the - Postfix configuration hard to understand and maintain. - At a certain point, it might be easier to configure mul- + Postfix configuration hard to understand and maintain. + At a certain point, it might be easier to configure mul- tiple instances of Postfix, instead of configuring multi- ple personalities via <a href="master.5.html">master.cf</a>. - <b>-v</b> Increase the verbose logging level. Specify multiple <b>-v</b> - options to make a Postfix daemon process increasingly + <b>-v</b> Increase the verbose logging level. Specify multiple <b>-v</b> + options to make a Postfix daemon process increasingly verbose. Other command-line arguments Specify "{" and "}" around command arguments that contain - whitespace (Postfix 3.0 and later). Whitespace after "{" + whitespace (Postfix 3.0 and later). Whitespace after "{" and before "}" is ignored. <b>SEE ALSO</b> diff --git a/external/ibm-public/postfix/dist/html/master.8.html b/external/ibm-public/postfix/dist/html/master.8.html index e06802898b5..f1fc336a61a 100644 --- a/external/ibm-public/postfix/dist/html/master.8.html +++ b/external/ibm-public/postfix/dist/html/master.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - master(8) </title> </head> <body> <pre> MASTER(8) MASTER(8) @@ -150,7 +150,7 @@ MASTER(8) MASTER(8) The network interface addresses that this mail system receives mail on. - <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (all)</b> + <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (see 'postconf -d output')</b> The Internet protocols Postfix will attempt to use when making or accepting connections. @@ -184,8 +184,15 @@ MASTER(8) MASTER(8) <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. + Available in Postfix 3.6 and later: + + <b><a href="postconf.5.html#known_tcp_ports">known_tcp_ports</a> (lmtp=24, smtp=25, smtps=submissions=465, submis-</b> + <b>sion=587)</b> + Optional setting that avoids lookups in the <b>services</b>(5) data- + base. + <b>FILES</b> - To expand the directory names below into their actual values, use the + To expand the directory names below into their actual values, use the command "<b>postconf <a href="postconf.5.html#config_directory">config_directory</a></b>" etc. $<a href="postconf.5.html#config_directory">config_directory</a>/<a href="postconf.5.html">main.cf</a>, global configuration file. diff --git a/external/ibm-public/postfix/dist/html/memcache_table.5.html b/external/ibm-public/postfix/dist/html/memcache_table.5.html index 70c9f74e5e9..c79e4d9e8c4 100644 --- a/external/ibm-public/postfix/dist/html/memcache_table.5.html +++ b/external/ibm-public/postfix/dist/html/memcache_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - memcache_table(5) </title> </head> <body> <pre> MEMCACHE_TABLE(5) MEMCACHE_TABLE(5) diff --git a/external/ibm-public/postfix/dist/html/mysql_table.5.html b/external/ibm-public/postfix/dist/html/mysql_table.5.html index 6dcb4ed29ac..a196c1ddc0e 100644 --- a/external/ibm-public/postfix/dist/html/mysql_table.5.html +++ b/external/ibm-public/postfix/dist/html/mysql_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - mysql_table(5) </title> </head> <body> <pre> MYSQL_TABLE(5) MYSQL_TABLE(5) @@ -21,7 +21,7 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) Alternatively, lookup tables can be specified as MySQL databases. In order to use MySQL lookups, define a MySQL source as a lookup table in <a href="postconf.5.html">main.cf</a>, for example: - <a href="postconf.5.html#alias_maps">alias_maps</a> = <a href="mysql_table.5.html">mysql</a>:/etc/mysql-aliases.cf + <a href="postconf.5.html#alias_maps">alias_maps</a> = <a href="mysql_table.5.html">mysql</a>:/etc/postfix/mysql-aliases.cf The file /etc/postfix/mysql-aliases.cf has the same format as the Post- fix <a href="postconf.5.html">main.cf</a> file, and can specify the parameters described below. @@ -43,7 +43,8 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) <b>MYSQL PARAMETERS</b> <b>hosts</b> The hosts that Postfix will try to connect to and query from. Specify <i>unix:</i> for UNIX domain sockets, <i>inet:</i> for TCP connections - (default). Example: + (default). Examples: + hosts = inet:host1.some.domain inet:host2.some.domain:port hosts = host1.some.domain host2.some.domain:port hosts = unix:/file/name @@ -176,9 +177,9 @@ MYSQL_TABLE(5) MYSQL_TABLE(5) NOTE: DO NOT put quotes around the result format! <b>domain (default: no domain list)</b> - This is a list of domain names, paths to files, or dictionaries. - When specified, only fully qualified search keys with a - *non-empty* localpart and a matching domain are eligible for + This is a list of domain names, paths to files, or "<a href="DATABASE_README.html">type:table</a>" + databases. When specified, only fully qualified search keys with + a *non-empty* localpart and a matching domain are eligible for lookup: 'user' lookups, bare domain lookups and "@domain" lookups are not performed. This can significantly reduce the query load on the MySQL server. diff --git a/external/ibm-public/postfix/dist/html/newaliases.1.html b/external/ibm-public/postfix/dist/html/newaliases.1.html index 02f20fe8913..eb99f16cb0a 100644 --- a/external/ibm-public/postfix/dist/html/newaliases.1.html +++ b/external/ibm-public/postfix/dist/html/newaliases.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - sendmail(1) </title> </head> <body> <pre> SENDMAIL(1) SENDMAIL(1) @@ -45,24 +45,27 @@ SENDMAIL(1) SENDMAIL(1) ery attempt will be made until the mail is taken off hold. - This mode of operation is implemented by executing the + <b>#</b> The message is forced to expire. See the <a href="postsuper.1.html"><b>postsuper</b>(1)</a> + options <b>-e</b> or <b>-f</b>. + + This mode of operation is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. <b>newaliases</b> - Initialize the alias database. If no input file is specified - (with the <b>-oA</b> option, see below), the program processes the - file(s) specified with the <b><a href="postconf.5.html#alias_database">alias_database</a></b> configuration parame- - ter. If no alias database type is specified, the program uses - the type specified with the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration + Initialize the alias database. If no input file is specified + (with the <b>-oA</b> option, see below), the program processes the + file(s) specified with the <b><a href="postconf.5.html#alias_database">alias_database</a></b> configuration parame- + ter. If no alias database type is specified, the program uses + the type specified with the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration parameter. This mode of operation is implemented by running the <a href="postalias.1.html"><b>postalias</b>(1)</a> command. Note: it may take a minute or so before an alias database update - becomes visible. Use the "<b>postfix reload</b>" command to eliminate + becomes visible. Use the "<b>postfix reload</b>" command to eliminate this delay. - These and other features can be selected by specifying the appropriate - combination of command-line options. Some features are controlled by + These and other features can be selected by specifying the appropriate + combination of command-line options. Some features are controlled by parameters in the <a href="postconf.5.html"><b>main.cf</b></a> configuration file. The following options are recognized: @@ -70,13 +73,13 @@ SENDMAIL(1) SENDMAIL(1) <b>-Am</b> (ignored) <b>-Ac</b> (ignored) - Postfix sendmail uses the same configuration file regardless of + Postfix sendmail uses the same configuration file regardless of whether or not a message is an initial submission. <b>-B</b> <i>body</i><b>_</b><i>type</i> The message body MIME type: <b>7BIT</b> or <b>8BITMIME</b>. - <b>-bd</b> Go into daemon mode. This mode of operation is implemented by + <b>-bd</b> Go into daemon mode. This mode of operation is implemented by executing the "<b>postfix start</b>" command. <b>-bh</b> (ignored) @@ -86,8 +89,8 @@ SENDMAIL(1) SENDMAIL(1) <b>-bi</b> Initialize alias database. See the <b>newaliases</b> command above. - <b>-bl</b> Go into daemon mode. To accept only local connections as with - Sendmail's <b>-bl</b> option, specify "<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback</b>" in + <b>-bl</b> Go into daemon mode. To accept only local connections as with + Sendmail's <b>-bl</b> option, specify "<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback</b>" in the Postfix <a href="postconf.5.html"><b>main.cf</b></a> configuration file. <b>-bm</b> Read mail from standard input and arrange for delivery. This is @@ -95,17 +98,17 @@ SENDMAIL(1) SENDMAIL(1) <b>-bp</b> List the mail queue. See the <b>mailq</b> command above. - <b>-bs</b> Stand-alone SMTP server mode. Read SMTP commands from standard - input, and write responses to standard output. In stand-alone - SMTP server mode, mail relaying and other access controls are - disabled by default. To enable them, run the process as the + <b>-bs</b> Stand-alone SMTP server mode. Read SMTP commands from standard + input, and write responses to standard output. In stand-alone + SMTP server mode, mail relaying and other access controls are + disabled by default. To enable them, run the process as the <b><a href="postconf.5.html#mail_owner">mail_owner</a></b> user. - This mode of operation is implemented by running the <a href="smtpd.8.html"><b>smtpd</b>(8)</a> + This mode of operation is implemented by running the <a href="smtpd.8.html"><b>smtpd</b>(8)</a> daemon. - <b>-bv</b> Do not collect or deliver a message. Instead, send an email - report after verifying each recipient address. This is useful + <b>-bv</b> Do not collect or deliver a message. Instead, send an email + report after verifying each recipient address. This is useful for testing address rewriting and routing configurations. This feature is available in Postfix version 2.1 and later. @@ -113,58 +116,58 @@ SENDMAIL(1) SENDMAIL(1) <b>-C</b> <i>config</i><b>_</b><i>file</i> <b>-C</b> <i>config</i><b>_</b><i>dir</i> - The path name of the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, or of its parent - directory. This information is ignored with Postfix versions + The path name of the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, or of its parent + directory. This information is ignored with Postfix versions before 2.3. With Postfix version 3.2 and later, a non-default directory must - be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter- + be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter- nate_config_directories or <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> parame- ters. - With all Postfix versions, you can specify a directory pathname - with the MAIL_CONFIG environment variable to override the loca- + With all Postfix versions, you can specify a directory pathname + with the MAIL_CONFIG environment variable to override the loca- tion of configuration files. <b>-F</b> <i>full</i><b>_</b><i>name</i> - Set the sender full name. This overrides the NAME environment + Set the sender full name. This overrides the NAME environment variable, and is used only with messages that have no <b>From:</b> mes- sage header. <b>-f</b> <i>sender</i> - Set the envelope sender address. This is the address where + Set the envelope sender address. This is the address where delivery problems are sent to. With Postfix versions before 2.1, - the <b>Errors-To:</b> message header overrides the error return + the <b>Errors-To:</b> message header overrides the error return address. - <b>-G</b> Gateway (relay) submission, as opposed to initial user submis- - sion. Either do not rewrite addresses at all, or update incom- - plete addresses with the domain information specified with + <b>-G</b> Gateway (relay) submission, as opposed to initial user submis- + sion. Either do not rewrite addresses at all, or update incom- + plete addresses with the domain information specified with <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a></b>. This option is ignored before Postfix version 2.3. <b>-h</b> <i>hop</i><b>_</b><i>count</i> (ignored) - Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter + Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter instead. <b>-I</b> Initialize alias database. See the <b>newaliases</b> command above. - <b>-i</b> When reading a message from standard input, don't treat a line + <b>-i</b> When reading a message from standard input, don't treat a line with only a <b>.</b> character as the end of input. <b>-L</b> <i>label</i> (ignored) - The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter + The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter instead. <b>-m</b> (ignored) Backwards compatibility. <b>-N</b> <i>dsn</i> (default: 'delay, failure') - Delivery status notification control. Specify either a + Delivery status notification control. Specify either a comma-separated list with one or more of <b>failure</b> (send notifica- - tion when delivery fails), <b>delay</b> (send notification when deliv- - ery is delayed), or <b>success</b> (send notification when the message + tion when delivery fails), <b>delay</b> (send notification when deliv- + ery is delayed), or <b>success</b> (send notification when the message is delivered); or specify <b>never</b> (don't send any notifications at all). @@ -174,50 +177,50 @@ SENDMAIL(1) SENDMAIL(1) Backwards compatibility. <b>-oA</b><i>alias</i><b>_</b><i>database</i> - Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>. + Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>. See <a href="postalias.1.html"><b>postalias</b>(1)</a> for details. <b>-O</b> <i>option=value</i> (ignored) - Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration + Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration parameter in <a href="postconf.5.html"><b>main.cf</b></a> instead. <b>-o7</b> (ignored) <b>-o8</b> (ignored) - To send 8-bit or binary content, use an appropriate MIME encap- + To send 8-bit or binary content, use an appropriate MIME encap- sulation and specify the appropriate <b>-B</b> command-line option. - <b>-oi</b> When reading a message from standard input, don't treat a line + <b>-oi</b> When reading a message from standard input, don't treat a line with only a <b>.</b> character as the end of input. <b>-om</b> (ignored) The sender is never eliminated from alias etc. expansions. <b>-o</b> <i>x value</i> (ignored) - Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame- + Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame- ter in <a href="postconf.5.html"><b>main.cf</b></a> instead. <b>-r</b> <i>sender</i> - Set the envelope sender address. This is the address where + Set the envelope sender address. This is the address where delivery problems are sent to. With Postfix versions before 2.1, - the <b>Errors-To:</b> message header overrides the error return + the <b>Errors-To:</b> message header overrides the error return address. <b>-R</b> <i>return</i> - Delivery status notification control. Specify "hdrs" to return - only the header when a message bounces, "full" to return a full + Delivery status notification control. Specify "hdrs" to return + only the header when a message bounces, "full" to return a full copy (the default behavior). The <b>-R</b> option specifies an upper bound; Postfix will return only - the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> + the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> setting. This option is ignored before Postfix version 2.10. - <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe- + <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe- cuting the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. - Warning: flushing undeliverable mail frequently will result in + Warning: flushing undeliverable mail frequently will result in poor delivery performance of all other mail. <b>-q</b><i>interval</i> (ignored) @@ -226,21 +229,21 @@ SENDMAIL(1) SENDMAIL(1) <b>-qI</b><i>queueid</i> Schedule immediate delivery of mail with the specified queue ID. - This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com- + This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com- mand, and is available with Postfix version 2.4 and later. <b>-qR</b><i>site</i> - Schedule immediate delivery of all mail that is queued for the - named <i>site</i>. This option accepts only <i>site</i> names that are eligi- - ble for the "fast flush" service, and is implemented by execut- + Schedule immediate delivery of all mail that is queued for the + named <i>site</i>. This option accepts only <i>site</i> names that are eligi- + ble for the "fast flush" service, and is implemented by execut- ing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information about the "fast flush" service. <b>-qS</b><i>site</i> - This command is not implemented. Use the slower "<b>sendmail -q</b>" + This command is not implemented. Use the slower "<b>sendmail -q</b>" command instead. - <b>-t</b> Extract recipients from message headers. These are added to any + <b>-t</b> Extract recipients from message headers. These are added to any recipients specified on the command line. With Postfix versions prior to 2.1, this option requires that no @@ -256,23 +259,23 @@ SENDMAIL(1) SENDMAIL(1) This feature is available in Postfix 2.3 and later. <b>-XV</b> (Postfix 2.2 and earlier: <b>-V</b>) - Variable Envelope Return Path. Given an envelope sender address - of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i> + Variable Envelope Return Path. Given an envelope sender address + of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i> receives mail with a personalized envelope sender address. - By default, the personalized envelope sender address is - <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac- - ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu- + By default, the personalized envelope sender address is + <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac- + ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu- ration parameter. <b>-XV</b><i>xy</i> (Postfix 2.2 and earlier: <b>-V</b><i>xy</i>) - As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters, + As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters, instead of the characters specified with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delim</a>-</b> <b><a href="postconf.5.html#default_verp_delimiters">iters</a></b> configuration parameter. <b>-v</b> Send an email report of the first delivery attempt (Postfix ver- - sions 2.1 and later). Mail delivery always happens in the back- - ground. When multiple <b>-v</b> options are given, enable verbose log- + sions 2.1 and later). Mail delivery always happens in the back- + ground. When multiple <b>-v</b> options are given, enable verbose log- ging for debugging purposes. <b>-X</b> <i>log</i><b>_</b><i>file</i> (ignored) @@ -280,12 +283,42 @@ SENDMAIL(1) SENDMAIL(1) configuration parameters instead. <b>SECURITY</b> - By design, this program is not set-user (or group) id. However, it must - handle data from untrusted, possibly remote, users. Thus, the usual - precautions need to be taken against malicious inputs. + By design, this program is not set-user (or group) id. It is prepared + to handle message content from untrusted, possibly remote, users. + + However, like most Postfix programs, this program does not enforce a + security policy on its command-line arguments. Instead, it relies on + the UNIX system to enforce access policies based on the effective user + and group IDs of the process. Concretely, this means that running Post- + fix commands as root (from sudo or equivalent) on behalf of a non-root + user is likely to create privilege escalation opportunities. + + If an application runs any Postfix programs on behalf of users that do + not have normal shell access to Postfix commands, then that application + MUST restrict user-specified command-line arguments to avoid privilege + escalation. + + <b>o</b> Filter all command-line arguments, for example arguments that + contain a pathname or that specify a database access method. + These pathname checks must reject user-controlled symlinks or + hardlinks to sensitive files, and must not be vulnerable to TOC- + TOU race attacks. + + <b>o</b> Disable command options processing for all command arguments + that contain user-specified data. For example, the Postfix <a href="sendmail.1.html"><b>send-</b></a> + <a href="sendmail.1.html"><b>mail</b>(1)</a> command line MUST be structured as follows: + + <b>/path/to/sendmail</b> <i>system-arguments</i> <b>--</b> <i>user-arguments</i> + + Here, the "<b>--</b>" disables command option processing for all + <i>user-arguments</i> that follow. + + Without the "<b>--</b>", a malicious user could enable Postfix <a href="sendmail.1.html"><b>send-</b></a> + <a href="sendmail.1.html"><b>mail</b>(1)</a> command options, by specifying an email address that + starts with "<b>-</b>". <b>DIAGNOSTICS</b> - Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard + Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard error stream. <b>ENVIRONMENT</b> @@ -299,12 +332,12 @@ SENDMAIL(1) SENDMAIL(1) Enable debugging with an external command, as specified with the <b><a href="postconf.5.html#debugger_command">debugger_command</a></b> configuration parameter. - <b>NAME</b> The sender full name. This is used only with messages that have + <b>NAME</b> The sender full name. This is used only with messages that have no <b>From:</b> message header. See also the <b>-F</b> option above. <b>CONFIGURATION PARAMETERS</b> - The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- - gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a> + The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- + gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a> <a href="postconf.5.html"><b>conf</b>(5)</a> for more details including examples. <b>COMPATIBILITY CONTROLS</b> @@ -315,7 +348,7 @@ SENDMAIL(1) SENDMAIL(1) line endings from <CR><LF> into UNIX format (<LF>). <b>TROUBLE SHOOTING CONTROLS</b> - The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix + The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix system. <b><a href="postconf.5.html#debugger_command">debugger_command</a> (empty)</b> @@ -323,13 +356,15 @@ SENDMAIL(1) SENDMAIL(1) invoked with the -D option. <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> - The increment in verbose logging level when a remote client or - server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. + The increment in verbose logging level when a nexthop destina- + tion, remote client or server name or network address matches a + pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> - Optional list of remote client or server hostname or network - address patterns that cause the verbose logging level to - increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. + Optional list of nexthop destination, remote client or server + name or network address patterns that, if matched, cause the + verbose logging level to increase by the amount specified in + $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. <b>ACCESS CONTROLS</b> Available in Postfix version 2.2 and later: @@ -341,13 +376,13 @@ SENDMAIL(1) SENDMAIL(1) List of users who are authorized to view the queue. <b><a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> (<a href="DATABASE_README.html#types">static</a>:anyone)</b> - List of users who are authorized to submit mail with the <a href="sendmail.1.html"><b>send-</b></a> + List of users who are authorized to submit mail with the <a href="sendmail.1.html"><b>send-</b></a> <a href="sendmail.1.html"><b>mail</b>(1)</a> command (and with the privileged <a href="postdrop.1.html"><b>postdrop</b>(1)</a> helper com- mand). <b>RESOURCE AND RATE CONTROLS</b> <b><a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> (50000)</b> - The maximal amount of original message text that is sent in a + The maximal amount of original message text that is sent in a non-delivery notification. <b><a href="postconf.5.html#fork_attempts">fork_attempts</a> (5)</b> @@ -361,11 +396,11 @@ SENDMAIL(1) SENDMAIL(1) in the primary message headers. <b><a href="postconf.5.html#queue_run_delay">queue_run_delay</a> (300s)</b> - The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager; + The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager; prior to Postfix 2.4 the default value was 1000s. <b>FAST FLUSH CONTROLS</b> - The <a href="ETRN_README.html">ETRN_README</a> file describes configuration and operation details for + The <a href="ETRN_README.html">ETRN_README</a> file describes configuration and operation details for the Postfix "fast flush" service. <b><a href="postconf.5.html#fast_flush_domains">fast_flush_domains</a> ($<a href="postconf.5.html#relay_domains">relay_domains</a>)</b> @@ -373,26 +408,26 @@ SENDMAIL(1) SENDMAIL(1) tion logfiles with mail that is queued to those destinations. <b>VERP CONTROLS</b> - The <a href="VERP_README.html">VERP_README</a> file describes configuration and operation details of + The <a href="VERP_README.html">VERP_README</a> file describes configuration and operation details of Postfix support for variable envelope return path addresses. <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a> (+=)</b> The two default VERP delimiter characters. <b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b> - The characters Postfix accepts as VERP delimiter characters on + The characters Postfix accepts as VERP delimiter characters on the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command line and in SMTP commands. <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#alias_database">alias_database</a> (see 'postconf -d' output)</b> - The alias databases for <a href="local.8.html"><b>local</b>(8)</a> delivery that are updated with + The alias databases for <a href="local.8.html"><b>local</b>(8)</a> delivery that are updated with "<b>newaliases</b>" or with "<b>sendmail -bi</b>". <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b> The location of all postfix administrative commands. <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_directory">daemon_directory</a> (see 'postconf -d' output)</b> @@ -403,46 +438,46 @@ SENDMAIL(1) SENDMAIL(1) and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands. <b><a href="postconf.5.html#delay_warning_time">delay_warning_time</a> (0h)</b> - The time after which the sender receives a copy of the message + The time after which the sender receives a copy of the message headers of mail that is still queued. <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix - process will import from a non-Postfix parent process, or + The list of environment variables that a privileged Postfix + process will import from a non-Postfix parent process, or name=value environment overrides. <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b> - The UNIX system account that owns the Postfix queue and most + The UNIX system account that owns the Postfix queue and most Postfix daemon processes. <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b> The location of the Postfix top-level queue directory. <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> (empty)</b> - Don't rewrite message headers from remote clients at all when - this parameter is empty; otherwise, rewrite message headers and + Don't rewrite message headers from remote clients at all when + this parameter is empty; otherwise, rewrite message headers and append the specified domain name to incomplete addresses. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Postfix 3.2 and later: <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b> A list of non-default Postfix configuration directories that may - be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in - the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the + be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in + the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the MAIL_CONFIG environment parameter. <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b> - An optional list of non-default Postfix configuration directo- - ries; these directories belong to additional Postfix instances - that share the Postfix executable files and documentation with - the default Postfix instance, and that are started, stopped, + An optional list of non-default Postfix configuration directo- + ries; these directories belong to additional Postfix instances + that share the Postfix executable files and documentation with + the default Postfix instance, and that are started, stopped, etc., together with the default Postfix instance. <b>FILES</b> @@ -463,7 +498,7 @@ SENDMAIL(1) SENDMAIL(1) syslogd(8), system logging <b>README_FILES</b> - Use "<b>postconf <a href="postconf.5.html#readme_directory">readme_directory</a></b>" or "<b>postconf <a href="postconf.5.html#html_directory">html_directory</a></b>" to locate + Use "<b>postconf <a href="postconf.5.html#readme_directory">readme_directory</a></b>" or "<b>postconf <a href="postconf.5.html#html_directory">html_directory</a></b>" to locate this information. <a href="DEBUG_README.html">DEBUG_README</a>, Postfix debugging howto <a href="ETRN_README.html">ETRN_README</a>, Postfix ETRN howto diff --git a/external/ibm-public/postfix/dist/html/nisplus_table.5.html b/external/ibm-public/postfix/dist/html/nisplus_table.5.html index fc442eea35e..6058d982391 100644 --- a/external/ibm-public/postfix/dist/html/nisplus_table.5.html +++ b/external/ibm-public/postfix/dist/html/nisplus_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - nisplus_table(5) </title> </head> <body> <pre> NISPLUS_TABLE(5) NISPLUS_TABLE(5) diff --git a/external/ibm-public/postfix/dist/html/oqmgr.8.html b/external/ibm-public/postfix/dist/html/oqmgr.8.html index 6f6913589c2..39c0622959c 100644 --- a/external/ibm-public/postfix/dist/html/oqmgr.8.html +++ b/external/ibm-public/postfix/dist/html/oqmgr.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - oqmgr(8) </title> </head> <body> <pre> OQMGR(8) OQMGR(8) @@ -133,8 +133,8 @@ OQMGR(8) OQMGR(8) queue manager of the arrival of new mail one would request <b>I</b>. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) - <a href="http://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery status notifications) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) + <a href="https://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery status notifications) <b>SECURITY</b> The <a href="qmgr.8.html"><b>oqmgr</b>(8)</a> daemon is not security sensitive. It reads single-charac- @@ -382,7 +382,7 @@ OQMGR(8) OQMGR(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> The email address form that will be used in non-debug logging (info, warning, etc.). diff --git a/external/ibm-public/postfix/dist/html/pcre_table.5.html b/external/ibm-public/postfix/dist/html/pcre_table.5.html index f2ee70ac024..7a3f3b7379d 100644 --- a/external/ibm-public/postfix/dist/html/pcre_table.5.html +++ b/external/ibm-public/postfix/dist/html/pcre_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - pcre_table(5) </title> </head> <body> <pre> PCRE_TABLE(5) PCRE_TABLE(5) @@ -36,8 +36,11 @@ PCRE_TABLE(5) PCRE_TABLE(5) terns, and "<b>postmap -bmq -</b> <<i>file</i>" for <a href="header_checks.5.html">body_checks(5)</a> (Postfix 2.6 and later). + This driver can be built with the pcre2 library (Postfix 3.7 and + later), or with the legacy pcre library (all Postfix versions). + <b>COMPATIBILITY</b> - With Postfix version 2.2 and earlier specify "<b>postmap -fq</b>" to query a + With Postfix version 2.2 and earlier specify "<b>postmap -fq</b>" to query a table that contains case sensitive patterns. Patterns are case insensi- tive by default. @@ -45,16 +48,16 @@ PCRE_TABLE(5) PCRE_TABLE(5) The general form of a PCRE table is: <b>/</b><i>pattern</i><b>/</b><i>flags result</i> - When <i>pattern</i> matches the input string, use the corresponding + When <i>pattern</i> matches the input string, use the corresponding <i>result</i> value. <b>!/</b><i>pattern</i><b>/</b><i>flags result</i> - When <i>pattern</i> does <b>not</b> match the input string, use the corre- + When <i>pattern</i> does <b>not</b> match the input string, use the corre- sponding <i>result</i> value. <b>if /</b><i>pattern</i><b>/</b><i>flags</i> - <b>endif</b> If the input string matches /<i>pattern</i>/, then match that input + <b>endif</b> If the input string matches /<i>pattern</i>/, then match that input string against the patterns between <b>if</b> and <b>endif</b>. The <b>if</b>..<b>endif</b> can nest. @@ -64,8 +67,8 @@ PCRE_TABLE(5) PCRE_TABLE(5) <b>if !/</b><i>pattern</i><b>/</b><i>flags</i> - <b>endif</b> If the input string does not match /<i>pattern</i>/, then match that - input string against the patterns between <b>if</b> and <b>endif</b>. The + <b>endif</b> If the input string does not match /<i>pattern</i>/, then match that + input string against the patterns between <b>if</b> and <b>endif</b>. The <b>if</b>..<b>endif</b> can nest. Note: do not prepend whitespace to patterns inside <b>if</b>..<b>endif</b>. @@ -73,97 +76,123 @@ PCRE_TABLE(5) PCRE_TABLE(5) This feature is available in Postfix 2.1 and later. blank lines and comments - Empty lines and whitespace-only lines are ignored, as are lines + Empty lines and whitespace-only lines are ignored, as are lines whose first non-whitespace character is a `#'. multi-line text - A logical line starts with non-whitespace text. A line that + A logical line starts with non-whitespace text. A line that starts with whitespace continues a logical line. - Each pattern is a perl-like regular expression. The expression delim- - iter can be any non-alphanumerical character, except whitespace or - characters that have special meaning (traditionally the forward slash - is used). The regular expression can contain whitespace. + Each pattern is a perl-like regular expression. The expression delim- + iter can be any non-alphanumeric character, except whitespace or char- + acters that have special meaning (traditionally the forward slash is + used). The regular expression can contain whitespace. - By default, matching is case-insensitive, and newlines are not treated - as special characters. The behavior is controlled by flags, which are - toggled by appending one or more of the following characters after the + By default, matching is case-insensitive, and newlines are not treated + as special characters. The behavior is controlled by flags, which are + toggled by appending one or more of the following characters after the pattern: <b>i</b> (default: on) - Toggles the case sensitivity flag. By default, matching is case + Toggles the case sensitivity flag. By default, matching is case insensitive. <b>m</b> (default: off) - Toggles the PCRE_MULTILINE flag. When this flag is on, the <b>^</b> and - <b>$</b> metacharacters match immediately after and immediately before - a newline character, respectively, in addition to matching at + Toggles the pcre MULTILINE flag. When this flag is on, the <b>^</b> and + <b>$</b> metacharacters match immediately after and immediately before + a newline character, respectively, in addition to matching at the start and end of the subject string. <b>s</b> (default: on) - Toggles the PCRE_DOTALL flag. When this flag is on, the <b>.</b> - metacharacter matches the newline character. With Postfix ver- - sions prior to 2.0, the flag is off by default, which is incon- + Toggles the pcre DOTALL flag. When this flag is on, the <b>.</b> + metacharacter matches the newline character. With Postfix ver- + sions prior to 2.0, the flag is off by default, which is incon- venient for multi-line message header matching. <b>x</b> (default: off) Toggles the pcre extended flag. When this flag is on, whitespace - characters in the pattern (other than in a character class) are - ignored. To include a whitespace character as part of the pat- + characters in the pattern (other than in a character class) are + ignored. To include a whitespace character as part of the pat- tern, escape it with backslash. Note: do not use <b>#</b><i>comment</i> after patterns. <b>A</b> (default: off) - Toggles the PCRE_ANCHORED flag. When this flag is on, the pat- - tern is forced to be "anchored", that is, it is constrained to - match only at the start of the string which is being searched - (the "subject string"). This effect can also be achieved by + Toggles the pcre ANCHORED flag. When this flag is on, the pat- + tern is forced to be "anchored", that is, it is constrained to + match only at the start of the string which is being searched + (the "subject string"). This effect can also be achieved by appropriate constructs in the pattern itself. <b>E</b> (default: off) - Toggles the PCRE_DOLLAR_ENDONLY flag. When this flag is on, a <b>$</b> + Toggles the pcre DOLLAR_ENDONLY flag. When this flag is on, a <b>$</b> metacharacter in the pattern matches only at the end of the sub- - ject string. Without this flag, a dollar also matches immedi- - ately before the final character if it is a newline character - (but not before any other newline characters). This flag is - ignored if PCRE_MULTILINE flag is set. + ject string. Without this flag, a dollar also matches immedi- + ately before the final character if it is a newline character + (but not before any other newline characters). This flag is + ignored if the pcre MULTILINE flag is set. <b>U</b> (default: off) - Toggles the ungreedy matching flag. When this flag is on, the - pattern matching engine inverts the "greediness" of the quanti- - fiers so that they are not greedy by default, but become greedy - if followed by "?". This flag can also set by a (?U) modifier + Toggles the pcre UNGREEDY flag. When this flag is on, the pat- + tern matching engine inverts the "greediness" of the quantifiers + so that they are not greedy by default, but become greedy if + followed by "?". This flag can also set by a (?U) modifier within the pattern. <b>X</b> (default: off) - Toggles the PCRE_EXTRA flag. When this flag is on, any back- + Toggles the pcre EXTRA flag. When this flag is on, any back- slash in a pattern that is followed by a letter that has no spe- - cial meaning causes an error, thus reserving these combinations + cial meaning causes an error, thus reserving these combinations for future expansion. + This feature is not supported with PCRE2. + <b>SEARCH ORDER</b> - Patterns are applied in the order as specified in the table, until a + Patterns are applied in the order as specified in the table, until a pattern is found that matches the input string. - Each pattern is applied to the entire input string. Depending on the + Each pattern is applied to the entire input string. Depending on the application, that string is an entire client hostname, an entire client - IP address, or an entire mail address. Thus, no parent domain or par- + IP address, or an entire mail address. Thus, no parent domain or par- ent network search is done, and <i>user@domain</i> mail addresses are not bro- - ken up into their <i>user</i> and <i>domain</i> constituent parts, nor is <i>user+foo</i> + ken up into their <i>user</i> and <i>domain</i> constituent parts, nor is <i>user+foo</i> broken up into <i>user</i> and <i>foo</i>. <b>TEXT SUBSTITUTION</b> - Substitution of substrings (text that matches patterns inside "()") - from the matched expression into the result string is requested with - $1, $2, etc.; specify $$ to produce a $ character as output. The - macros in the result string may need to be written as ${n} or $(n) if - they aren't followed by whitespace. + Substitution of substrings (text that matches patterns inside "()") + from the matched expression into the result string is requested with + $1, $2, etc.; specify $$ to produce a $ character as output. The + macros in the result string may need to be written as ${n} or $(n) if + they aren't followed by whitespace. This feature does not support + pcre2 substring names. Note: since negated patterns (those preceded by <b>!</b>) return a result when the expression does not match, substitutions are not available for negated patterns. +<b>INLINE SPECIFICATION</b> + The contents of a table may be specified in the table name. The basic + syntax is: + + <a href="postconf.5.html">main.cf</a>: + <i>parameter</i> <b>= .. <a href="pcre_table.5.html">pcre</a>:{ {</b> <i>rule-1</i> <b>}, {</b> <i>rule-2</i> <b>} .. } ..</b> + + <a href="master.5.html">master.cf</a>: + <b>.. -o {</b> <i>parameter</i> <b>= .. <a href="pcre_table.5.html">pcre</a>:{ {</b> <i>rule-1</i> <b>}, {</b> <i>rule-2</i> <b>} .. } .. } ..</b> + + Postfix ignores whitespace after '{' and before '}', and writes each + <i>rule</i> as one text line to an in-memory file: + + in-memory file: + rule-1 + rule-2 + .. + + Postfix parses the result as if it is a file in /etc/postfix. + + Note: if a rule contains <b>$</b>, specify <b>$$</b> to keep Postfix from trying to + do <i>$name</i> expansion as it evaluates a parameter value. + <b>EXAMPLE SMTPD ACCESS MAP</b> # Protect your outgoing majordomo exploders /^(?!owner-)(.*)-outgoing@(.*)/ 550 Use ${1}@${2} instead diff --git a/external/ibm-public/postfix/dist/html/pgsql_table.5.html b/external/ibm-public/postfix/dist/html/pgsql_table.5.html index 49c4476e977..89a200bf11f 100644 --- a/external/ibm-public/postfix/dist/html/pgsql_table.5.html +++ b/external/ibm-public/postfix/dist/html/pgsql_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - pgsql_table(5) </title> </head> <body> <pre> PGSQL_TABLE(5) PGSQL_TABLE(5) @@ -21,7 +21,7 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) Alternatively, lookup tables can be specified as PostgreSQL databases. In order to use PostgreSQL lookups, define a PostgreSQL source as a lookup table in <a href="postconf.5.html">main.cf</a>, for example: - <a href="postconf.5.html#alias_maps">alias_maps</a> = <a href="pgsql_table.5.html">pgsql</a>:/etc/pgsql-aliases.cf + <a href="postconf.5.html#alias_maps">alias_maps</a> = <a href="pgsql_table.5.html">pgsql</a>:/etc/postfix/pgsql-aliases.cf The file /etc/postfix/pgsql-aliases.cf has the same format as the Post- fix <a href="postconf.5.html">main.cf</a> file, and can specify the parameters described below. @@ -48,6 +48,7 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) prefixes are accepted and ignored for backwards compatibility. Examples: hosts = postgresql://username@example.com/tablename?sslmode=require + hosts = inet:host1.some.domain inet:host2.some.domain:port hosts = host1.some.domain host2.some.domain:port hosts = unix:/file/name @@ -118,7 +119,7 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) <b>select_function</b>, <b>query</b>, <b>select_field</b>, ... With Postfix 2.2 the <b>query</b> parameter has highest precedence, see - COMPATIBILITY above. + OBSOLETE QUERY INTERFACES below. NOTE: DO NOT put quotes around the <b>query</b> parameter. @@ -167,9 +168,9 @@ PGSQL_TABLE(5) PGSQL_TABLE(5) NOTE: DO NOT put quotes around the result format! <b>domain (default: no domain list)</b> - This is a list of domain names, paths to files, or dictionaries. - When specified, only fully qualified search keys with a - *non-empty* localpart and a matching domain are eligible for + This is a list of domain names, paths to files, or "<a href="DATABASE_README.html">type:table</a>" + databases. When specified, only fully qualified search keys with + a *non-empty* localpart and a matching domain are eligible for lookup: 'user' lookups, bare domain lookups and "@domain" lookups are not performed. This can significantly reduce the query load on the PostgreSQL server. diff --git a/external/ibm-public/postfix/dist/html/pickup.8.html b/external/ibm-public/postfix/dist/html/pickup.8.html index b1a58b29916..238b9ad79b4 100644 --- a/external/ibm-public/postfix/dist/html/pickup.8.html +++ b/external/ibm-public/postfix/dist/html/pickup.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - pickup(8) </title> </head> <body> <pre> PICKUP(8) PICKUP(8) @@ -99,7 +99,7 @@ PICKUP(8) PICKUP(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> The email address form that will be used in non-debug logging (info, warning, etc.). diff --git a/external/ibm-public/postfix/dist/html/pipe.8.html b/external/ibm-public/postfix/dist/html/pipe.8.html index 6248898198e..b2be997375f 100644 --- a/external/ibm-public/postfix/dist/html/pipe.8.html +++ b/external/ibm-public/postfix/dist/html/pipe.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - pipe(8) </title> </head> <body> <pre> PIPE(8) PIPE(8) @@ -121,7 +121,7 @@ PIPE(8) PIPE(8) command-line <b>$sender</b>, <b>$original_recipient</b> and <b>$recipient</b> address localparts (text to the left of the right-most <b>@</b> character), according to an 8-bit transparent version of - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a>. This is recommended for delivery via <b>UUCP</b> or + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a>. This is recommended for delivery via <b>UUCP</b> or <b>BSMTP</b>. The result is compatible with the address parsing of com- @@ -169,47 +169,49 @@ PIPE(8) PIPE(8) as an argument by itself: <i>Right</i>: command -f $sender -- $recipient + NOTE: DO NOT put quotes around the command, $sender, or $recipi- + ent. This feature is available as of Postfix 2.3. <b>size</b>=<i>size</i><b>_</b><i>limit</i> (optional) - Don't deliver messages that exceed this size limit (in bytes); + Don't deliver messages that exceed this size limit (in bytes); return them to the sender instead. <b>user</b>=<i>username</i> (required) <b>user</b>=<i>username</i>:<i>groupname</i> - Execute the external command with the user ID and group ID of - the specified <i>username</i>. The software refuses to execute com- - mands with root privileges, or with the privileges of the mail + Execute the external command with the user ID and group ID of + the specified <i>username</i>. The software refuses to execute com- + mands with root privileges, or with the privileges of the mail system owner. If <i>groupname</i> is specified, the corresponding group ID is used instead of the group ID of <i>username</i>. <b>argv</b>=<i>command</i>... (required) - The command to be executed. This must be specified as the last + The command to be executed. This must be specified as the last command attribute. The command is executed directly, i.e. with- - out interpretation of shell meta characters by a shell command + out interpretation of shell meta characters by a shell command interpreter. Specify "{" and "}" around command arguments that contain white- - space (Postfix 3.0 and later). Whitespace after the opening "{" + space (Postfix 3.0 and later). Whitespace after the opening "{" and before the closing "}" is ignored. - In the command argument vector, the following macros are recog- + In the command argument vector, the following macros are recog- nized and replaced with corresponding information from the Post- fix queue manager delivery request. - In addition to the form ${<i>name</i>}, the forms $<i>name</i> and the depre- + In addition to the form ${<i>name</i>}, the forms $<i>name</i> and the depre- cated form $(<i>name</i>) are also recognized. Specify <b>$$</b> where a sin- gle <b>$</b> is wanted. <b>${client_address}</b> - This macro expands to the remote client network address. + This macro expands to the remote client network address. This feature is available as of Postfix 2.2. <b>${client_helo}</b> - This macro expands to the remote client HELO command + This macro expands to the remote client HELO command parameter. This feature is available as of Postfix 2.2. @@ -220,7 +222,7 @@ PIPE(8) PIPE(8) This feature is available as of Postfix 2.2. <b>${client_port}</b> - This macro expands to the remote client TCP port number. + This macro expands to the remote client TCP port number. This feature is available as of Postfix 2.5. @@ -231,7 +233,7 @@ PIPE(8) PIPE(8) <b>${domain}</b> This macro expands to the domain portion of the recipient - address. For example, with an address <i>user+foo@domain</i> + address. For example, with an address <i>user+foo@domain</i> the domain is <i>domain</i>. This information is modified by the <b>h</b> flag for case fold- @@ -240,12 +242,12 @@ PIPE(8) PIPE(8) This feature is available as of Postfix 2.5. <b>${extension}</b> - This macro expands to the extension part of a recipient - address. For example, with an address <i>user+foo@domain</i> + This macro expands to the extension part of a recipient + address. For example, with an address <i>user+foo@domain</i> the extension is <i>foo</i>. - A command-line argument that contains <b>${extension}</b> - expands into as many command-line arguments as there are + A command-line argument that contains <b>${extension}</b> + expands into as many command-line arguments as there are recipients. This information is modified by the <b>u</b> flag for case fold- @@ -253,11 +255,11 @@ PIPE(8) PIPE(8) <b>${mailbox}</b> This macro expands to the complete local part of a recip- - ient address. For example, with an address + ient address. For example, with an address <i>user+foo@domain</i> the mailbox is <i>user+foo</i>. - A command-line argument that contains <b>${mailbox}</b> expands - to as many command-line arguments as there are recipi- + A command-line argument that contains <b>${mailbox}</b> expands + to as many command-line arguments as there are recipi- ents. This information is modified by the <b>u</b> flag for case fold- @@ -270,11 +272,11 @@ PIPE(8) PIPE(8) ing. <b>${original_recipient}</b> - This macro expands to the complete recipient address + This macro expands to the complete recipient address before any address rewriting or aliasing. - A command-line argument that contains <b>${original_recipi-</b> - <b>ent}</b> expands to as many command-line arguments as there + A command-line argument that contains <b>${original_recipi-</b> + <b>ent}</b> expands to as many command-line arguments as there are recipients. This information is modified by the <b>hqu</b> flags for quoting @@ -290,8 +292,8 @@ PIPE(8) PIPE(8) <b>${recipient}</b> This macro expands to the complete recipient address. - A command-line argument that contains <b>${recipient}</b> - expands to as many command-line arguments as there are + A command-line argument that contains <b>${recipient}</b> + expands to as many command-line arguments as there are recipients. This information is modified by the <b>hqu</b> flags for quoting @@ -299,14 +301,14 @@ PIPE(8) PIPE(8) <b>${sasl_method}</b> This macro expands to the name of the SASL authentication - mechanism in the AUTH command when the Postfix SMTP + mechanism in the AUTH command when the Postfix SMTP server received the message. This feature is available as of Postfix 2.2. <b>${sasl_sender}</b> - This macro expands to the SASL sender name (i.e. the - original submitter as per <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>) in the MAIL FROM com- + This macro expands to the SASL sender name (i.e. the + original submitter as per <a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>) in the MAIL FROM com- mand when the Postfix SMTP server received the message. This feature is available as of Postfix 2.2. @@ -318,115 +320,115 @@ PIPE(8) PIPE(8) This feature is available as of Postfix 2.2. <b>${sender}</b> - This macro expands to the envelope sender address. By - default, the null sender address expands to MAILER-DAE- - MON; this can be changed with the <b>null_sender</b> attribute, + This macro expands to the envelope sender address. By + default, the null sender address expands to MAILER-DAE- + MON; this can be changed with the <b>null_sender</b> attribute, as described above. This information is modified by the <b>q</b> flag for quoting. <b>${size}</b> This macro expands to Postfix's idea of the message size, - which is an approximation of the size of the message as + which is an approximation of the size of the message as delivered. <b>${user}</b> - This macro expands to the username part of a recipient - address. For example, with an address <i>user+foo@domain</i> + This macro expands to the username part of a recipient + address. For example, with an address <i>user+foo@domain</i> the username part is <i>user</i>. - A command-line argument that contains <b>${user}</b> expands - into as many command-line arguments as there are recipi- + A command-line argument that contains <b>${user}</b> expands + into as many command-line arguments as there are recipi- ents. This information is modified by the <b>u</b> flag for case fold- ing. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) <b>DIAGNOSTICS</b> - Command exit status codes are expected to follow the conventions + Command exit status codes are expected to follow the conventions defined in <<b>sysexits.h</b>>. Exit status 0 means normal successful comple- tion. In the case of a non-zero exit status, a limited amount of command out- - put is logged, and reported in a delivery status notification. When - the output begins with a 4.X.X or 5.X.X enhanced status code, the sta- - tus code takes precedence over the non-zero exit status (Postfix ver- + put is logged, and reported in a delivery status notification. When + the output begins with a 4.X.X or 5.X.X enhanced status code, the sta- + tus code takes precedence over the non-zero exit status (Postfix ver- sion 2.3 and later). - After successful delivery (zero exit status) a limited amount of com- - mand output is logged, and reported in "success" delivery status noti- + After successful delivery (zero exit status) a limited amount of com- + mand output is logged, and reported in "success" delivery status noti- fications (Postfix 3.0 and later). This command output is not examined for the presence of an enhanced status code. - Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. - Corrupted message files are marked so that the queue manager can move + Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. + Corrupted message files are marked so that the queue manager can move them to the <b>corrupt</b> queue for further inspection. <b>SECURITY</b> - This program needs a dual personality 1) to access the private Postfix - queue and IPC mechanisms, and 2) to execute external commands as the + This program needs a dual personality 1) to access the private Postfix + queue and IPC mechanisms, and 2) to execute external commands as the specified user. It is therefore security sensitive. <b>CONFIGURATION PARAMETERS</b> Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically as <a href="pipe.8.html"><b>pipe</b>(8)</a> processes run - for only a limited amount of time. Use the command "<b>postfix reload</b>" to + for only a limited amount of time. Use the command "<b>postfix reload</b>" to speed up a change. - The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for + The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including examples. <b>RESOURCE AND RATE CONTROLS</b> In the text below, <i>transport</i> is the first field in a <a href="master.5.html"><b>master.cf</b></a> entry. - <b>transport_time_limit ($<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b> + <b><a href="postconf.5.html#transport_time_limit">transport_time_limit</a> ($<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b> A transport-specific override for the <a href="postconf.5.html#command_time_limit">command_time_limit</a> parame- - ter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message + ter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery transport. Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon: - <b>transport_destination_concurrency_limit ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b> + <b><a href="postconf.5.html#transport_destination_concurrency_limit">transport_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b> <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b> - A transport-specific override for the default_destination_con- - currency_limit parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> + A transport-specific override for the <a href="postconf.5.html#default_destination_concurrency_limit">default_destination_con</a>- + <a href="postconf.5.html#default_destination_concurrency_limit">currency_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery transport. - <b>transport_destination_recipient_limit ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b> + <b><a href="postconf.5.html#transport_destination_recipient_limit">transport_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b> <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b> A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>- - <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> + <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery transport. <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b> - How much time a Postfix daemon process may take to handle a + How much time a Postfix daemon process may take to handle a request before it is terminated by a built-in watchdog timer. <b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b> - The maximal number of digits after the decimal point when log- + The maximal number of digits after the decimal point when log- ging sub-second delay values. <b><a href="postconf.5.html#export_environment">export_environment</a> (see 'postconf -d' output)</b> - The list of environment variables that a Postfix process will + The list of environment variables that a Postfix process will export to non-Postfix processes. <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b> - The time limit for sending or receiving information over an + The time limit for sending or receiving information over an internal communication channel. <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b> - The UNIX system account that owns the Postfix queue and most + The UNIX system account that owns the Postfix queue and most Postfix daemon processes. <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> - The maximum amount of time that an idle Postfix daemon process + The maximum amount of time that an idle Postfix daemon process waits for an incoming connection before terminating voluntarily. <b><a href="postconf.5.html#max_use">max_use</a> (100)</b> @@ -443,9 +445,8 @@ PIPE(8) PIPE(8) The location of the Postfix top-level queue directory. <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b> - The set of characters that can separate a user name from its - extension (example: user+foo), or a .forward file name from its - extension (example: .forward+foo). + The set of characters that can separate an email address local- + part, user name, or a .forward file name from its extension. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. @@ -473,7 +474,7 @@ PIPE(8) PIPE(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> The email address form that will be used in non-debug logging (info, warning, etc.). diff --git a/external/ibm-public/postfix/dist/html/postalias.1.html b/external/ibm-public/postfix/dist/html/postalias.1.html index b029057d120..f1c612c055b 100644 --- a/external/ibm-public/postfix/dist/html/postalias.1.html +++ b/external/ibm-public/postfix/dist/html/postalias.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postalias(1) </title> </head> <body> <pre> POSTALIAS(1) POSTALIAS(1) @@ -17,7 +17,7 @@ POSTALIAS(1) POSTALIAS(1) The <a href="postalias.1.html"><b>postalias</b>(1)</a> command creates or queries one or more Postfix alias databases, or updates an existing one. The input and output file for- mats are expected to be compatible with Sendmail version 8, and are - expected to be suitable for the use as NIS alias maps. + expected to be suitable for use as NIS alias maps. If the result files do not exist they will be created with the same group and other read permissions as their source file. @@ -128,12 +128,18 @@ POSTALIAS(1) POSTALIAS(1) <i>file</i><b>_</b><i>name</i><b>.dir</b>. This is available on systems with support for <b>dbm</b> databases. + <b>fail</b> A table that reliably fails all requests. The lookup ta- + ble name is used for logging only. This table exists to + simplify Postfix error tests. + <b>hash</b> The output is a hashed file, named <i>file</i><b>_</b><i>name</i><b>.db</b>. This is available on systems with support for <b>db</b> databases. - <b>fail</b> A table that reliably fails all requests. The lookup ta- - ble name is used for logging only. This table exists to - simplify Postfix error tests. + <b>lmdb</b> The output is a btree-based file, named <i>file</i><b>_</b><i>name</i><b>.lmdb</b>. + <b>lmdb</b> supports concurrent writes and reads from different + processes, unlike other supported file-based tables. + This is available on systems with support for <b>lmdb</b> data- + bases. <b>sdbm</b> The output consists of two files, named <i>file</i><b>_</b><i>name</i><b>.pag</b> and <i>file</i><b>_</b><i>name</i><b>.dir</b>. This is available on systems with support @@ -192,13 +198,13 @@ POSTALIAS(1) POSTALIAS(1) and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands. <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix + The list of environment variables that a privileged Postfix process will import from a non-Postfix parent process, or name=value environment overrides. <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> Enable preliminary SMTPUTF8 support for the protocols described - in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. + in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>, <a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a>, and <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a>. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. @@ -207,8 +213,13 @@ POSTALIAS(1) POSTALIAS(1) A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". + Available in Postfix 2.11 and later: + + <b><a href="postconf.5.html#lmdb_map_size">lmdb_map_size</a> (16777216)</b> + The initial OpenLDAP LMDB database size limit in bytes. + <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) <b>SEE ALSO</b> <a href="aliases.5.html">aliases(5)</a>, format of alias database input file. diff --git a/external/ibm-public/postfix/dist/html/postcat.1.html b/external/ibm-public/postfix/dist/html/postcat.1.html index 9424d55f17e..1a5c7af1d6f 100644 --- a/external/ibm-public/postfix/dist/html/postcat.1.html +++ b/external/ibm-public/postfix/dist/html/postcat.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postcat(1) </title> </head> <body> <pre> POSTCAT(1) POSTCAT(1) @@ -53,6 +53,15 @@ POSTCAT(1) POSTCAT(1) This feature is available in Postfix 2.0 and later. + <b>-r</b> Print records in file order, don't follow pointer records. + + This feature is available in Postfix 3.7 and later. + + <b>-s</b> <i>offset</i> + Skip to the specified queue file offset. + + This feature is available in Postfix 3.7 and later. + <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b> options make the software increasingly verbose. diff --git a/external/ibm-public/postfix/dist/html/postconf.1.html b/external/ibm-public/postfix/dist/html/postconf.1.html index e6525618b8d..813755e17f6 100644 --- a/external/ibm-public/postfix/dist/html/postconf.1.html +++ b/external/ibm-public/postfix/dist/html/postconf.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postconf(1) </title> </head> <body> <pre> POSTCONF(1) POSTCONF(1) @@ -143,7 +143,7 @@ POSTCONF(1) POSTCONF(1) or more service fields with new values as specified with "<i>ser-</i> <i>vice/type/field=value</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. Cur- rently, the "command" field contains the command name and com- - mand arguments. this may change in the near future, so that the + mand arguments. This may change in the near future, so that the "command" field contains only the command name, and a new "argu- ments" pseudofield contains the command arguments. @@ -157,7 +157,8 @@ POSTCONF(1) POSTCONF(1) whitespace on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. The <b>-e</b> option is no longer needed with Postfix version 2.8 and - later. + later, as it is assumed whenever a value is specified (empty or + non-empty). <b>-f</b> Fold long lines when printing <a href="postconf.5.html"><b>main.cf</b></a> or <a href="master.5.html"><b>master.cf</b></a> configuration file entries, for human readability. @@ -165,58 +166,58 @@ POSTCONF(1) POSTCONF(1) This feature is available with Postfix 2.9 and later. <b>-F</b> Show <a href="master.5.html"><b>master.cf</b></a> per-entry field settings (by default all services - and all fields), formatted as "<i>service/type/field=value</i>", one + and all fields), formatted as "<i>service/type/field=value</i>", one per line. Specify <b>-Ff</b> to fold long lines. - Specify one or more "<i>service/type/field</i>" instances on the <a href="postconf.1.html"><b>post-</b></a> - <a href="postconf.1.html"><b>conf</b>(1)</a> command line to limit the output to fields of interest. - Trailing parameter name or service type fields that are omitted + Specify one or more "<i>service/type/field</i>" instances on the <a href="postconf.1.html"><b>post-</b></a> + <a href="postconf.1.html"><b>conf</b>(1)</a> command line to limit the output to fields of interest. + Trailing parameter name or service type fields that are omitted will be handled as "*" wildcard fields. This feature is available with Postfix 2.11 and later. - <b>-h</b> Show parameter or attribute values without the "<i>name</i> = " label + <b>-h</b> Show parameter or attribute values without the "<i>name</i> = " label that normally precedes the value. - <b>-H</b> Show parameter or attribute names without the " = <i>value</i>" that + <b>-H</b> Show parameter or attribute names without the " = <i>value</i>" that normally follows the name. This feature is available with Postfix 3.1 and later. - <b>-l</b> List the names of all supported mailbox locking methods. Post- + <b>-l</b> List the names of all supported mailbox locking methods. Post- fix supports the following methods: - <b>flock</b> A kernel-based advisory locking method for local files + <b>flock</b> A kernel-based advisory locking method for local files only. This locking method is available on systems with a BSD compatible library. - <b>fcntl</b> A kernel-based advisory locking method for local and + <b>fcntl</b> A kernel-based advisory locking method for local and remote files. <b>dotlock</b> An application-level locking method. An application locks - a file named <i>filename</i> by creating a file named <i>file-</i> + a file named <i>filename</i> by creating a file named <i>file-</i> <i>name</i><b>.lock</b>. The application is expected to remove its own - lock file, as well as stale lock files that were left + lock file, as well as stale lock files that were left behind after abnormal program termination. - <b>-m</b> List the names of all supported lookup table types. In Postfix - configuration files, lookup tables are specified as <i>type</i><b>:</b><i>name</i>, + <b>-m</b> List the names of all supported lookup table types. In Postfix + configuration files, lookup tables are specified as <i>type</i><b>:</b><i>name</i>, where <i>type</i> is one of the types listed below. The table <i>name</i> syn- - tax depends on the lookup table type as described in the <a href="DATABASE_README.html">DATA</a>- + tax depends on the lookup table type as described in the <a href="DATABASE_README.html">DATA</a>- <a href="DATABASE_README.html">BASE_README</a> document. - <b>btree</b> A sorted, balanced tree structure. Available on systems + <b>btree</b> A sorted, balanced tree structure. Available on systems with support for Berkeley DB databases. - <b>cdb</b> A read-optimized structure with no support for incremen- - tal updates. Available on systems with support for CDB + <b>cdb</b> A read-optimized structure with no support for incremen- + tal updates. Available on systems with support for CDB databases. This feature is available with Postfix 2.2 and later. <b>cidr</b> A table that associates values with Classless - Inter-Domain Routing (CIDR) patterns. This is described + Inter-Domain Routing (CIDR) patterns. This is described in <a href="cidr_table.5.html"><b>cidr_table</b>(5)</a>. This feature is available with Postfix 2.2 and later. @@ -226,12 +227,12 @@ POSTCONF(1) POSTCONF(1) <b>environ</b> The UNIX process environment array. The lookup key is the - environment variable name; the table name is ignored. + environment variable name; the table name is ignored. Originally implemented for testing, someone may find this useful someday. - <b>fail</b> A table that reliably fails all requests. The lookup ta- - ble name is used for logging. This table exists to sim- + <b>fail</b> A table that reliably fails all requests. The lookup ta- + ble name is used for logging. This table exists to sim- plify Postfix error tests. This feature is available with Postfix 2.9 and later. @@ -240,23 +241,23 @@ POSTCONF(1) POSTCONF(1) tems with support for Berkeley DB databases. <b>inline</b> (read-only) - A non-shared, in-memory lookup table. Example: "<b><a href="DATABASE_README.html#types">inline</a>:{</b> - <i>key</i><b>=</b><i>value</i><b>, {</b> <i>key</i> <b>=</b> <i>text with whitespace or comma</i> <b>}}</b>". - Key-value pairs are separated by whitespace or comma; - with a key-value pair inside "<b>{}</b>", whitespace is ignored - after the opening "<b>{</b>", around the "<b>=</b>" between key and - value, and before the closing "<b>}</b>". Inline tables elimi- - nate the need to create a database file for just a few + A non-shared, in-memory lookup table. Example: "<b><a href="DATABASE_README.html#types">inline</a>:{</b> + <i>key</i><b>=</b><i>value</i><b>, {</b> <i>key</i> <b>=</b> <i>text with whitespace or comma</i> <b>}}</b>". + Key-value pairs are separated by whitespace or comma; + with a key-value pair inside "<b>{}</b>", whitespace is ignored + after the opening "<b>{</b>", around the "<b>=</b>" between key and + value, and before the closing "<b>}</b>". Inline tables elimi- + nate the need to create a database file for just a few fixed elements. See also the <i><a href="DATABASE_README.html#types">static</a>:</i> map type. This feature is available with Postfix 3.0 and later. <b>internal</b> - A non-shared, in-memory hash table. Its content are lost + A non-shared, in-memory hash table. Its content are lost when a process terminates. - <b>lmdb</b> OpenLDAP LMDB database (a memory-mapped, persistent - file). Available on systems with support for LMDB data- + <b>lmdb</b> OpenLDAP LMDB database (a memory-mapped, persistent + file). Available on systems with support for LMDB data- bases. This is described in <a href="lmdb_table.5.html"><b>lmdb_table</b>(5)</a>. This feature is available with Postfix 2.11 and later. @@ -265,57 +266,57 @@ POSTCONF(1) POSTCONF(1) LDAP database client. This is described in <a href="ldap_table.5.html"><b>ldap_table</b>(5)</a>. <b>memcache</b> - Memcache database client. This is described in <a href="memcache_table.5.html"><b>mem-</b></a> + Memcache database client. This is described in <a href="memcache_table.5.html"><b>mem-</b></a> <a href="memcache_table.5.html"><b>cache_table</b>(5)</a>. This feature is available with Postfix 2.9 and later. <b>mysql</b> (read-only) MySQL database client. Available on systems with support - for MySQL databases. This is described in <a href="mysql_table.5.html"><b>mysql_ta-</b></a> + for MySQL databases. This is described in <a href="mysql_table.5.html"><b>mysql_ta-</b></a> <a href="mysql_table.5.html"><b>ble</b>(5)</a>. <b>pcre</b> (read-only) - A lookup table based on Perl Compatible Regular Expres- + A lookup table based on Perl Compatible Regular Expres- sions. The file format is described in <a href="pcre_table.5.html"><b>pcre_table</b>(5)</a>. <b>pgsql</b> (read-only) - PostgreSQL database client. This is described in + PostgreSQL database client. This is described in <a href="pgsql_table.5.html"><b>pgsql_table</b>(5)</a>. This feature is available with Postfix 2.1 and later. <b>pipemap</b> (read-only) - A lookup table that constructs a pipeline of tables. - Example: "<b><a href="DATABASE_README.html#types">pipemap</a>:{</b><i>type</i><b>_</b><i>1:name</i><b>_</b><i>1, ..., type</i><b>_</b><i>n:name</i><b>_</b><i>n</i><b>}</b>". - Each "<a href="DATABASE_README.html#types">pipemap</a>:" query is given to the first table. Each + A lookup table that constructs a pipeline of tables. + Example: "<b><a href="DATABASE_README.html#types">pipemap</a>:{</b><i>type</i><b>_</b><i>1:name</i><b>_</b><i>1, ..., type</i><b>_</b><i>n:name</i><b>_</b><i>n</i><b>}</b>". + Each "<a href="DATABASE_README.html#types">pipemap</a>:" query is given to the first table. Each lookup result becomes the query for the next table in the - pipeline, and the last table produces the final result. - When any table lookup produces no result, the pipeline - produces no result. The first and last characters of the + pipeline, and the last table produces the final result. + When any table lookup produces no result, the pipeline + produces no result. The first and last characters of the "<a href="DATABASE_README.html#types">pipemap</a>:" table name must be "<b>{</b>" and "<b>}</b>". Within these, individual maps are separated with comma or whitespace. This feature is available with Postfix 3.0 and later. - <b>proxy</b> Postfix <a href="proxymap.8.html"><b>proxymap</b>(8)</a> client for shared access to Postfix + <b>proxy</b> Postfix <a href="proxymap.8.html"><b>proxymap</b>(8)</a> client for shared access to Postfix databases. The table name syntax is <i>type</i><b>:</b><i>name</i>. This feature is available with Postfix 2.0 and later. <b>randmap</b> (read-only) - An in-memory table that performs random selection. Exam- + An in-memory table that performs random selection. Exam- ple: "<b><a href="DATABASE_README.html#types">randmap</a>:{</b><i>result</i><b>_</b><i>1, ..., result</i><b>_</b><i>n</i><b>}</b>". Each table query returns a random choice from the specified results. - The first and last characters of the "<a href="DATABASE_README.html#types">randmap</a>:" table - name must be "<b>{</b>" and "<b>}</b>". Within these, individual + The first and last characters of the "<a href="DATABASE_README.html#types">randmap</a>:" table + name must be "<b>{</b>" and "<b>}</b>". Within these, individual results are separated with comma or whitespace. To give a specific result more weight, specify it multiple times. This feature is available with Postfix 3.0 and later. <b>regexp</b> (read-only) - A lookup table based on regular expressions. The file + A lookup table based on regular expressions. The file format is described in <a href="regexp_table.5.html"><b>regexp_table</b>(5)</a>. <b>sdbm</b> An indexed file type based on hashing. Available on sys- @@ -324,9 +325,9 @@ POSTCONF(1) POSTCONF(1) This feature is available with Postfix 2.2 and later. <b>socketmap</b> (read-only) - Sendmail-style socketmap client. The table name is - <b>inet</b>:<i>host</i>:<i>port</i>:<i>name</i> for a TCP/IP server, or <b>unix</b>:<i>path-</i> - <i>name</i>:<i>name</i> for a UNIX-domain server. This is described in + Sendmail-style socketmap client. The table name is + <b>inet</b>:<i>host</i>:<i>port</i>:<i>name</i> for a TCP/IP server, or <b>unix</b>:<i>path-</i> + <i>name</i>:<i>name</i> for a UNIX-domain server. This is described in <a href="socketmap_table.5.html"><b>socketmap_table</b>(5)</a>. This feature is available with Postfix 2.10 and later. @@ -337,11 +338,11 @@ POSTCONF(1) POSTCONF(1) This feature is available with Postfix 2.8 and later. <b>static</b> (read-only) - A table that always returns its name as lookup result. + A table that always returns its name as lookup result. For example, <b><a href="DATABASE_README.html#types">static</a>:foobar</b> always returns the string <b>foo-</b> - <b>bar</b> as lookup result. Specify "<b><a href="DATABASE_README.html#types">static</a>:{</b> <i>text with white-</i> - <i>space</i> <b>}</b>" when the result contains whitespace; this form - ignores whitespace after the opening "<b>{</b>" and before the + <b>bar</b> as lookup result. Specify "<b><a href="DATABASE_README.html#types">static</a>:{</b> <i>text with white-</i> + <i>space</i> <b>}</b>" when the result contains whitespace; this form + ignores whitespace after the opening "<b>{</b>" and before the closing "<b>}</b>". See also the <i><a href="DATABASE_README.html#types">inline</a>:</i> map. The form "<b><a href="DATABASE_README.html#types">static</a>:{</b><i>text</i><b>}</b> is available with Postfix 3.0 and @@ -351,65 +352,68 @@ POSTCONF(1) POSTCONF(1) TCP/IP client. The protocol is described in <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. <b>texthash</b> (read-only) - Produces similar results as <a href="DATABASE_README.html#types">hash</a>: files, except that you - don't need to run the <a href="postmap.1.html"><b>postmap</b>(1)</a> command before you can - use the file, and that it does not detect changes after + Produces similar results as <a href="DATABASE_README.html#types">hash</a>: files, except that you + don't need to run the <a href="postmap.1.html"><b>postmap</b>(1)</a> command before you can + use the file, and that it does not detect changes after the file is read. This feature is available with Postfix 2.8 and later. <b>unionmap</b> (read-only) - A table that sends each query to multiple lookup tables - and that concatenates all found results, separated by + A table that sends each query to multiple lookup tables + and that concatenates all found results, separated by comma. The table name syntax is the same as for <b>pipemap</b>. This feature is available with Postfix 3.0 and later. <b>unix</b> (read-only) - A limited view of the UNIX authentication database. The + A limited view of the UNIX authentication database. The following tables are implemented: <b>unix:passwd.byname</b> - The table is the UNIX password database. The key - is a login name. The result is a password file + The table is the UNIX password database. The key + is a login name. The result is a password file entry in <b>passwd</b>(5) format. <b>unix:group.byname</b> The table is the UNIX group database. The key is a - group name. The result is a group file entry in + group name. The result is a group file entry in <b>group</b>(5) format. - Other table types may exist depending on how Postfix was built. + Other table types may exist depending on how Postfix was built. - <b>-M</b> Show <a href="master.5.html"><b>master.cf</b></a> file contents instead of <a href="postconf.5.html"><b>main.cf</b></a> file contents. + <b>-M</b> Show <a href="master.5.html"><b>master.cf</b></a> file contents instead of <a href="postconf.5.html"><b>main.cf</b></a> file contents. Specify <b>-Mf</b> to fold long lines for human readability. Specify zero or more arguments, each with a <i>service-name</i> or <i>ser-</i> - <i>vice-name/service-type</i> pair, where <i>service-name</i> is the first - field of a <a href="master.5.html">master.cf</a> entry and <i>service-type</i> is one of (<b>inet</b>, + <i>vice-name/service-type</i> pair, where <i>service-name</i> is the first + field of a <a href="master.5.html">master.cf</a> entry and <i>service-type</i> is one of (<b>inet</b>, <b>unix</b>, <b>fifo</b>, or <b>pass</b>). - If <i>service-name</i> or <i>service-name/service-type</i> is specified, only - the matching <a href="master.5.html">master.cf</a> entries will be output. For example, - "<b>postconf -Mf smtp</b>" will output all services named "smtp", and - "<b>postconf -Mf smtp/inet</b>" will output only the smtp service that - listens on the network. Trailing service type fields that are + If <i>service-name</i> or <i>service-name/service-type</i> is specified, only + the matching <a href="master.5.html">master.cf</a> entries will be output. For example, + "<b>postconf -Mf smtp</b>" will output all services named "smtp", and + "<b>postconf -Mf smtp/inet</b>" will output only the smtp service that + listens on the network. Trailing service type fields that are omitted will be handled as "*" wildcard fields. This feature is available with Postfix 2.9 and later. The syntax - was changed from "<i>name.type</i>" to "<i>name/type</i>", and "*" wildcard + was changed from "<i>name.type</i>" to "<i>name/type</i>", and "*" wildcard support was added with Postfix 2.11. <b>-n</b> Show only configuration parameters that have explicit <i>name=value</i> - settings in <a href="postconf.5.html"><b>main.cf</b></a>. Specify <b>-nf</b> to fold long lines for human - readability (Postfix 2.9 and later). To show settings that dif- + settings in <a href="postconf.5.html"><b>main.cf</b></a>. Specify <b>-nf</b> to fold long lines for human + readability (Postfix 2.9 and later). To show settings that dif- fer from built-in defaults only, use the following bash syntax: - comm -23 <(postconf -n) <(postconf -d) + LANG=C comm -23 <(postconf -n) <(postconf -d) Replace "-23" with "-12" to show settings that duplicate built-in defaults. <b>-o</b> <i>name=value</i> - Override <a href="postconf.5.html"><b>main.cf</b></a> parameter settings. + Override <a href="postconf.5.html"><b>main.cf</b></a> parameter settings. This lets you see the + effect changing a parameter would have when it is used in other + configuration parameters, e.g.: + postconf -x -o stress=yes This feature is available with Postfix 2.10 and later. @@ -417,38 +421,38 @@ POSTCONF(1) POSTCONF(1) This feature is available with Postfix 2.11 and later. - <b>-P</b> Show <a href="master.5.html"><b>master.cf</b></a> service parameter settings (by default all ser- - vices and all parameters), formatted as "<i>service/type/parame-</i> + <b>-P</b> Show <a href="master.5.html"><b>master.cf</b></a> service parameter settings (by default all ser- + vices and all parameters), formatted as "<i>service/type/parame-</i> <i>ter=value</i>", one per line. Specify <b>-Pf</b> to fold long lines. - Specify one or more "<i>service/type/parameter</i>" instances on the - <a href="postconf.1.html"><b>postconf</b>(1)</a> command line to limit the output to parameters of - interest. Trailing parameter name or service type fields that + Specify one or more "<i>service/type/parameter</i>" instances on the + <a href="postconf.1.html"><b>postconf</b>(1)</a> command line to limit the output to parameters of + interest. Trailing parameter name or service type fields that are omitted will be handled as "*" wildcard fields. This feature is available with Postfix 2.11 and later. <b>-t</b> [<i>template</i><b>_</b><i>file</i>] - Display the templates for text that appears at the beginning of - delivery status notification (DSN) messages, without expanding + Display the templates for text that appears at the beginning of + delivery status notification (DSN) messages, without expanding $<b>name</b> expressions. - To override the <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a></b> parameter setting, specify - a template file name at the end of the "<b>postconf -t</b>" command - line. Specify an empty file name to display built-in templates + To override the <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a></b> parameter setting, specify + a template file name at the end of the "<b>postconf -t</b>" command + line. Specify an empty file name to display built-in templates (in shell language: ""). This feature is available with Postfix 2.3 and later. <b>-T</b> <i>mode</i> - If Postfix is compiled without TLS support, the <b>-T</b> option pro- - duces no output. Otherwise, if an invalid <i>mode</i> is specified, - the <b>-T</b> option reports an error and exits with a non-zero status + If Postfix is compiled without TLS support, the <b>-T</b> option pro- + duces no output. Otherwise, if an invalid <i>mode</i> is specified, + the <b>-T</b> option reports an error and exits with a non-zero status code. The valid modes are: <b>compile-version</b> Output the OpenSSL version that Postfix was compiled with - (i.e. the OpenSSL version in a header file). The output + (i.e. the OpenSSL version in a header file). The output format is the same as with the command "<b>openssl version</b>". <b>run-version</b> @@ -456,40 +460,40 @@ POSTCONF(1) POSTCONF(1) runtime (i.e. the OpenSSL version in a shared library). <b>public-key-algorithms</b> - Output the lower-case names of the supported public-key + Output the lower-case names of the supported public-key algorithms, one per-line. This feature is available with Postfix 3.1 and later. - <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b> + <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b> options make the software increasingly verbose. - <b>-x</b> Expand <i>$name</i> in <a href="postconf.5.html"><b>main.cf</b></a> or <a href="master.5.html"><b>master.cf</b></a> parameter values. The + <b>-x</b> Expand <i>$name</i> in <a href="postconf.5.html"><b>main.cf</b></a> or <a href="master.5.html"><b>master.cf</b></a> parameter values. The expansion is recursive. This feature is available with Postfix 2.10 and later. - <b>-X</b> Edit the <a href="postconf.5.html"><b>main.cf</b></a> configuration file, and remove the parameters + <b>-X</b> Edit the <a href="postconf.5.html"><b>main.cf</b></a> configuration file, and remove the parameters named on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. Specify a list of param- eter names, not "<i>name=value</i>" pairs. - With <b>-M</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and remove one - or more service entries as specified with "<i>service/type</i>" on the + With <b>-M</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and remove one + or more service entries as specified with "<i>service/type</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. - With <b>-P</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and remove one + With <b>-P</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and remove one or more service parameter settings (-o parameter=value settings) - as specified with "<i>service/type/parameter</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> + as specified with "<i>service/type/parameter</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. In all cases the file is copied to a temporary file then renamed into place. Specify quotes to protect special characters on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. - There is no <a href="postconf.1.html"><b>postconf</b>(1)</a> command to perform the reverse opera- + There is no <a href="postconf.1.html"><b>postconf</b>(1)</a> command to perform the reverse opera- tion. - This feature is available with Postfix 2.10 and later. Support + This feature is available with Postfix 2.10 and later. Support for -M and -P was added with Postfix 2.11. <b>-#</b> Edit the <a href="postconf.5.html"><b>main.cf</b></a> configuration file, and comment out the parame- @@ -497,18 +501,18 @@ POSTCONF(1) POSTCONF(1) eters revert to their default values. Specify a list of parame- ter names, not "<i>name=value</i>" pairs. - With <b>-M</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and comment out - one or more service entries as specified with "<i>service/type</i>" on + With <b>-M</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and comment out + one or more service entries as specified with "<i>service/type</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. In all cases the file is copied to a temporary file then renamed into place. Specify quotes to protect special characters on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. - There is no <a href="postconf.1.html"><b>postconf</b>(1)</a> command to perform the reverse opera- + There is no <a href="postconf.1.html"><b>postconf</b>(1)</a> command to perform the reverse opera- tion. - This feature is available with Postfix 2.6 and later. Support + This feature is available with Postfix 2.6 and later. Support for -M was added with Postfix 2.11. <b>DIAGNOSTICS</b> @@ -519,18 +523,18 @@ POSTCONF(1) POSTCONF(1) Directory with Postfix configuration files. <b>CONFIGURATION PARAMETERS</b> - The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- + The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- gram. - The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for + The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including examples. <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a> (empty)</b> - Pathname of a configuration file with bounce message templates. + Pathname of a configuration file with bounce message templates. <b>FILES</b> /etc/postfix/<a href="postconf.5.html">main.cf</a>, Postfix configuration parameters diff --git a/external/ibm-public/postfix/dist/html/postdrop.1.html b/external/ibm-public/postfix/dist/html/postdrop.1.html index 7155559b89b..ce25bfbdb0a 100644 --- a/external/ibm-public/postfix/dist/html/postdrop.1.html +++ b/external/ibm-public/postfix/dist/html/postdrop.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postdrop(1) </title> </head> <body> <pre> POSTDROP(1) POSTDROP(1) @@ -94,6 +94,21 @@ POSTDROP(1) POSTDROP(1) <a href="sendmail.1.html"><b>mail</b>(1)</a> command (and with the privileged <a href="postdrop.1.html"><b>postdrop</b>(1)</a> helper com- mand). + Available in Postfix version 3.6 and later: + + <b><a href="postconf.5.html#local_login_sender_maps">local_login_sender_maps</a> (<a href="DATABASE_README.html#types">static</a>:*)</b> + A list of lookup tables that are searched by the UNIX login + name, and that return a list of allowed envelope sender patterns + separated by space or comma. + + <b><a href="postconf.5.html#empty_address_local_login_sender_maps_lookup_key">empty_address_local_login_sender_maps_lookup_key</a> (</b><><b>)</b> + The lookup key to be used in <a href="postconf.5.html#local_login_sender_maps">local_login_sender_maps</a> tables, + instead of the null sender address. + + <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b> + The set of characters that can separate an email address local- + part, user name, or a .forward file name from its extension. + <b>FILES</b> /var/spool/postfix/<a href="QSHAPE_README.html#maildrop_queue">maildrop</a>, <a href="QSHAPE_README.html#maildrop_queue">maildrop queue</a> diff --git a/external/ibm-public/postfix/dist/html/postfix-manuals.html b/external/ibm-public/postfix/dist/html/postfix-manuals.html index 9b90c23df64..6f674e6d659 100644 --- a/external/ibm-public/postfix/dist/html/postfix-manuals.html +++ b/external/ibm-public/postfix/dist/html/postfix-manuals.html @@ -7,7 +7,7 @@ <title>Postfix Manual Pages </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -84,6 +84,8 @@ the following convention: </p> <li> <a href="postconf.1.html">postconf(1)</a>, Postfix configuration utility +<li> <a href="postdrop.1.html">postdrop(1)</a>, Postfix mail posting utility + <li> <a href="postfix.1.html">postfix(1)</a>, Postfix control program <li> <a href="postfix-tls.1.html">postfix-tls(1)</a>, Postfix TLS management @@ -192,7 +194,7 @@ the following convention: </p> <li> <a href="discard.8.html">discard(8)</a>, Postfix discard delivery agent -<li> <a href="dnsblog.8.html">dnsblog(8)</a>, DNS black/whitelist logger +<li> <a href="dnsblog.8.html">dnsblog(8)</a>, DNS allow/denylist logger <li> <a href="error.8.html">error(8)</a>, Postfix error delivery agent diff --git a/external/ibm-public/postfix/dist/html/postfix-tls.1.html b/external/ibm-public/postfix/dist/html/postfix-tls.1.html index 099284e58ed..348ba85752b 100644 --- a/external/ibm-public/postfix/dist/html/postfix-tls.1.html +++ b/external/ibm-public/postfix/dist/html/postfix-tls.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postfix-tls(1) </title> </head> <body> <pre> POSTFIX-TLS(1) POSTFIX-TLS(1) diff --git a/external/ibm-public/postfix/dist/html/postfix-wrapper.5.html b/external/ibm-public/postfix/dist/html/postfix-wrapper.5.html index d9a8ba4da9c..bf84eb87f5a 100644 --- a/external/ibm-public/postfix/dist/html/postfix-wrapper.5.html +++ b/external/ibm-public/postfix/dist/html/postfix-wrapper.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postfix-wrapper(5) </title> </head> <body> <pre> POSTFIX-WRAPPER(5) POSTFIX-WRAPPER(5) diff --git a/external/ibm-public/postfix/dist/html/postfix.1.html b/external/ibm-public/postfix/dist/html/postfix.1.html index eb59ad30d5c..d69e1ece693 100644 --- a/external/ibm-public/postfix/dist/html/postfix.1.html +++ b/external/ibm-public/postfix/dist/html/postfix.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postfix(1) </title> </head> <body> <pre> POSTFIX(1) POSTFIX(1) @@ -41,11 +41,15 @@ POSTFIX(1) POSTFIX(1) ground, and enable <a href="master.8.html"><b>master</b>(8)</a> "init" mode when running as PID 1. This command requires that multi-instance support is disabled (i.e. the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> parameter value must be - empty). When running Postfix inside a container, mount the con- - tainer host's /dev/log socket inside the container (example: - "docker run -v /dev/log:/dev/log ...") and specify a distinct - Postfix "<a href="postconf.5.html#syslog_name">syslog_name</a>" prefix that identifies logging from the - Postfix instance. + empty). + + When running Postfix inside a container, see <a href="MAILLOG_README.html">MAILLOG_README</a> for + logging to stdout. Postfix logs to syslog by default, which + requires a) running a syslogd process inside the container, or + b) mounting the container host's /dev/log socket inside the con- + tainer (example: "docker run -v /dev/log:/dev/log ..."), and c) + a distinct Postfix "<a href="postconf.5.html#syslog_name">syslog_name</a>" prefix that identifies logging + from the Postfix instance. <b>stop</b> Stop the Postfix mail system in an orderly fashion. If possible, running processes are allowed to terminate at their earliest @@ -217,6 +221,11 @@ POSTFIX(1) POSTFIX(1) Available in Postfix version 3.0 and later: + <b><a href="postconf.5.html#compatibility_level">compatibility_level</a> (0)</b> + A safety net that causes Postfix to run with backwards-compati- + ble default settings after an upgrade to a newer Postfix ver- + sion. + <b><a href="postconf.5.html#meta_directory">meta_directory</a> (see 'postconf -d' output)</b> The location of non-executable files that are shared among mul- tiple Postfix instances, such as postfix-files, dynamicmaps.cf, @@ -237,7 +246,7 @@ POSTFIX(1) POSTFIX(1) Other configuration parameters: <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix + The list of environment variables that a privileged Postfix process will import from a non-Postfix parent process, or name=value environment overrides. @@ -294,24 +303,26 @@ POSTFIX(1) POSTFIX(1) <b>FILES</b> Prior to Postfix version 2.6, all of the following files were in <b>$<a href="postconf.5.html#config_directory">con</a>-</b> - <b><a href="postconf.5.html#config_directory">fig_directory</a></b>. Some files are now in <b>$<a href="postconf.5.html#daemon_directory">daemon_directory</a></b> so that they can - be shared among multiple instances that run the same Postfix version. + <b><a href="postconf.5.html#config_directory">fig_directory</a></b>. Some files are now in <b>$<a href="postconf.5.html#daemon_directory">daemon_directory</a></b> or <b>$meta_direc-</b> + <b>tory</b> so that they can be shared among multiple instances that run the + same Postfix version. - Use the command "<b>postconf <a href="postconf.5.html#config_directory">config_directory</a></b>" or "<b>postconf <a href="postconf.5.html#daemon_directory">daemon_direc</a>-</b> + Use the command "<b>postconf <a href="postconf.5.html#config_directory">config_directory</a></b>" or "<b>postconf <a href="postconf.5.html#daemon_directory">daemon_direc</a>-</b> <b><a href="postconf.5.html#daemon_directory">tory</a></b>" to expand the names into their actual values. $<a href="postconf.5.html#config_directory">config_directory</a>/<a href="postconf.5.html">main.cf</a>, Postfix configuration parameters $<a href="postconf.5.html#config_directory">config_directory</a>/<a href="master.5.html">master.cf</a>, Postfix daemon processes - $<a href="postconf.5.html#daemon_directory">daemon_directory</a>/postfix-files, file/directory permissions $<a href="postconf.5.html#daemon_directory">daemon_directory</a>/postfix-script, administrative commands $<a href="postconf.5.html#daemon_directory">daemon_directory</a>/post-install, post-installation configuration - $<a href="postconf.5.html#daemon_directory">daemon_directory</a>/dynamicmaps.cf, plug-in database clients + $<a href="postconf.5.html#meta_directory">meta_directory</a>/dynamicmaps.cf, plug-in database clients + $<a href="postconf.5.html#meta_directory">meta_directory</a>/postfix-files, file/directory permissions <b>SEE ALSO</b> Commands: <a href="postalias.1.html">postalias(1)</a>, create/update/query alias database <a href="postcat.1.html">postcat(1)</a>, examine Postfix queue file <a href="postconf.1.html">postconf(1)</a>, Postfix configuration utility + <a href="postdrop.1.html">postdrop(1)</a>, Postfix mail posting utility <a href="postfix.1.html">postfix(1)</a>, Postfix control program <a href="postfix-tls.1.html">postfix-tls(1)</a>, Postfix TLS management <a href="postkick.1.html">postkick(1)</a>, trigger Postfix daemon @@ -360,7 +371,7 @@ POSTFIX(1) POSTFIX(1) <a href="bounce.8.html">bounce(8)</a>, <a href="defer.8.html">defer(8)</a>, <a href="trace.8.html">trace(8)</a>, Delivery status reports <a href="cleanup.8.html">cleanup(8)</a>, canonicalize and enqueue message <a href="discard.8.html">discard(8)</a>, Postfix discard delivery agent - <a href="dnsblog.8.html">dnsblog(8)</a>, DNS black/whitelist logger + <a href="dnsblog.8.html">dnsblog(8)</a>, DNS allow/denylist logger <a href="error.8.html">error(8)</a>, Postfix error delivery agent <a href="flush.8.html">flush(8)</a>, Postfix fast ETRN service <a href="local.8.html">local(8)</a>, Postfix local delivery agent diff --git a/external/ibm-public/postfix/dist/html/postkick.1.html b/external/ibm-public/postfix/dist/html/postkick.1.html index 15af2e11599..12ebc5aa21a 100644 --- a/external/ibm-public/postfix/dist/html/postkick.1.html +++ b/external/ibm-public/postfix/dist/html/postkick.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postkick(1) </title> </head> <body> <pre> POSTKICK(1) POSTKICK(1) diff --git a/external/ibm-public/postfix/dist/html/postlock.1.html b/external/ibm-public/postfix/dist/html/postlock.1.html index 0ebce6ca776..3cac8c0ec48 100644 --- a/external/ibm-public/postfix/dist/html/postlock.1.html +++ b/external/ibm-public/postfix/dist/html/postlock.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postlock(1) </title> </head> <body> <pre> POSTLOCK(1) POSTLOCK(1) diff --git a/external/ibm-public/postfix/dist/html/postlog.1.html b/external/ibm-public/postfix/dist/html/postlog.1.html index cacbd6a71ce..d3c038f4984 100644 --- a/external/ibm-public/postfix/dist/html/postlog.1.html +++ b/external/ibm-public/postfix/dist/html/postlog.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postlog(1) </title> </head> <body> <pre> POSTLOG(1) POSTLOG(1) @@ -47,37 +47,43 @@ POSTLOG(1) POSTLOG(1) <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b> options make the software increasingly verbose. +<b>SECURITY</b> + The <a href="postlog.1.html"><b>postlog</b>(1)</a> command is designed to run with set-groupid privileges, + so that it can connect to the <a href="postlogd.8.html"><b>postlogd</b>(8)</a> daemon process (Postfix 3.7 + and later; earlier implementations of this command must not have + set-groupid or set-userid permissions). + <b>ENVIRONMENT</b> MAIL_CONFIG Directory with the <a href="postconf.5.html"><b>main.cf</b></a> file. <b>CONFIGURATION PARAMETERS</b> - The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- + The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- gram. - The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for + The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including examples. <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix - process will import from a non-Postfix parent process, or + The list of environment parameters that a privileged Postfix + process will import from a non-Postfix parent process, or name=value environment overrides. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Available in Postfix 3.4 and later: <b><a href="postconf.5.html#maillog_file">maillog_file</a> (empty)</b> - The name of an optional logfile that is written by the Postfix + The name of an optional logfile that is written by the Postfix <a href="postlogd.8.html"><b>postlogd</b>(8)</a> service. <b><a href="postconf.5.html#postlog_service_name">postlog_service_name</a> (postlog)</b> @@ -91,6 +97,9 @@ POSTLOG(1) POSTLOG(1) <b>LICENSE</b> The Secure Mailer license must be distributed with this software. +<b>HISTORY</b> + The <a href="postlog.1.html"><b>postlog</b>(1)</a> command was introduced with Postfix version 3.4. + <b>AUTHOR(S)</b> Wietse Venema IBM T.J. Watson Research diff --git a/external/ibm-public/postfix/dist/html/postlogd.8.html b/external/ibm-public/postfix/dist/html/postlogd.8.html index 8cdc50d4d32..bd26cb85c40 100644 --- a/external/ibm-public/postfix/dist/html/postlogd.8.html +++ b/external/ibm-public/postfix/dist/html/postlogd.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postlogd(8) </title> </head> <body> <pre> POSTLOGD(8) POSTLOGD(8) @@ -31,8 +31,8 @@ POSTLOGD(8) POSTLOGD(8) <b><a href="postconf.5.html#maillog_file">log_file</a></b> (also, logging to stdout would interfere with the operation of some of these programs). These programs can log to <a href="postlogd.8.html"><b>postlogd</b>(8)</a> if they are run by the super-user, or if their executable file has set-gid per- - mission. Do not set this permission on programs other than <a href="postdrop.1.html"><b>postdrop</b>(1)</a> - and <a href="postqueue.1.html"><b>postqueue</b>(1)</a>. + mission. Do not set this permission on programs other than <a href="postdrop.1.html"><b>postdrop</b>(1)</a>, + <a href="postqueue.1.html"><b>postqueue</b>(1)</a> and (Postfix >= 3.7) <a href="postlog.1.html"><b>postlog</b>(1)</a>. <b>CONFIGURATION PARAMETERS</b> Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="postlogd.8.html"><b>postlogd</b>(8)</a> pro- diff --git a/external/ibm-public/postfix/dist/html/postmap.1.html b/external/ibm-public/postfix/dist/html/postmap.1.html index 8c23225311d..aa5377b2176 100644 --- a/external/ibm-public/postfix/dist/html/postmap.1.html +++ b/external/ibm-public/postfix/dist/html/postmap.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postmap(1) </title> </head> <body> <pre> POSTMAP(1) POSTMAP(1) @@ -38,8 +38,10 @@ POSTMAP(1) POSTMAP(1) starts with whitespace continues a logical line. The <i>key</i> and <i>value</i> are processed as is, except that surrounding white - space is stripped off. Whitespace in lookup keys is supported as of - Postfix 3.2. + space is stripped off. Whitespace in lookup keys is supported in Post- + fix 3.2 and later, by surrounding the key with double quote characters + `"'. Within the double quotes, double quote `"' and backslash `\' char- + acters can be included by quoting them with a preceding backslash. When the <b>-F</b> option is given, the <i>value</i> must specify one or more file- names separated by comma and/or whitespace; <a href="postmap.1.html"><b>postmap</b>(1)</a> will concatenate @@ -47,7 +49,7 @@ POSTMAP(1) POSTMAP(1) will store the base64-encoded result instead of the <i>value</i>. When the <i>key</i> specifies email address information, the localpart should - be enclosed with double quotes if required by <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a>. For example, an + be enclosed with double quotes if required by <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a>. For example, an address localpart that contains ";", or a localpart that starts or ends with ".". @@ -62,7 +64,7 @@ POSTMAP(1) POSTMAP(1) <b>COMMAND-LINE ARGUMENTS</b> <b>-b</b> Enable message body query mode. When reading lookup keys from standard input with "<b>-q -</b>", process the input as if it is an - email message in <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each line of body content + email message in <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each line of body content becomes one lookup key. By default, the <b>-b</b> option starts generating lookup keys at the @@ -72,9 +74,9 @@ POSTMAP(1) POSTMAP(1) body-style lookup keys for attachment MIME headers and for attached message/* headers. - NOTE: with "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", the <b>-b</b> option option dis- - ables UTF-8 syntax checks on query keys and lookup results. - Specify the <b>-U</b> option to force UTF-8 syntax checks anyway. + NOTE: with "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", the <b>-b</b> option disables UTF-8 + syntax checks on query keys and lookup results. Specify the <b>-U</b> + option to force UTF-8 syntax checks anyway. This feature is available in Postfix version 2.6 and later. @@ -101,11 +103,13 @@ POSTMAP(1) POSTMAP(1) When creating a map from source file, process each value as a list of filenames, concatenate the content of those files, and store the base64-encoded result instead of the value (see INPUT - FORMAT for details). + FILE FORMAT for details). + + This feature is available in Postfix version 3.4 and later. <b>-h</b> Enable message header query mode. When reading lookup keys from standard input with "<b>-q -</b>", process the input as if it is an - email message in <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each logical header line + email message in <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each logical header line becomes one lookup key. A multi-line header becomes one lookup key with one or more embedded newline characters. @@ -204,13 +208,19 @@ POSTMAP(1) POSTMAP(1) <i>file</i><b>_</b><i>name</i><b>.dir</b>. This is available on systems with support for <b>dbm</b> databases. + <b>fail</b> A table that reliably fails all requests. The lookup ta- + ble name is used for logging only. This table exists to + simplify Postfix error tests. + <b>hash</b> The output file is a hashed file, named <i>file</i><b>_</b><i>name</i><b>.db</b>. This is available on systems with support for <b>db</b> data- bases. - <b>fail</b> A table that reliably fails all requests. The lookup ta- - ble name is used for logging only. This table exists to - simplify Postfix error tests. + <b>lmdb</b> The output is a btree-based file, named <i>file</i><b>_</b><i>name</i><b>.lmdb</b>. + <b>lmdb</b> supports concurrent writes and reads from different + processes, unlike other supported file-based tables. + This is available on systems with support for <b>lmdb</b> data- + bases. <b>sdbm</b> The output consists of two files, named <i>file</i><b>_</b><i>name</i><b>.pag</b> and <i>file</i><b>_</b><i>name</i><b>.dir</b>. This is available on systems with support @@ -262,13 +272,13 @@ POSTMAP(1) POSTMAP(1) and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands. <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix + The list of environment variables that a privileged Postfix process will import from a non-Postfix parent process, or name=value environment overrides. <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> Enable preliminary SMTPUTF8 support for the protocols described - in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. + in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>, <a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a>, and <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a>. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. @@ -277,6 +287,11 @@ POSTMAP(1) POSTMAP(1) A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". + Available in Postfix 2.11 and later: + + <b><a href="postconf.5.html#lmdb_map_size">lmdb_map_size</a> (16777216)</b> + The initial OpenLDAP LMDB database size limit in bytes. + <b>SEE ALSO</b> <a href="postalias.1.html">postalias(1)</a>, create/update/query alias database <a href="postconf.1.html">postconf(1)</a>, supported database types diff --git a/external/ibm-public/postfix/dist/html/postmulti.1.html b/external/ibm-public/postfix/dist/html/postmulti.1.html index 0115b9fd83f..6456b92197b 100644 --- a/external/ibm-public/postfix/dist/html/postmulti.1.html +++ b/external/ibm-public/postfix/dist/html/postmulti.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postmulti(1) </title> </head> <body> <pre> POSTMULTI(1) POSTMULTI(1) @@ -200,7 +200,7 @@ POSTMULTI(1) POSTMULTI(1) default values for the private directories of the new instance. The "<b>-G</b> <i>group</i>" option may be specified to assign the instance to a group, otherwise, the new - instance is not a member of any groups. + instance is not a member of any group. The new instance <a href="postconf.5.html">main.cf</a> is the stock <a href="postconf.5.html">main.cf</a> with the parameters that specify the locations of shared files @@ -222,66 +222,67 @@ POSTMULTI(1) POSTMULTI(1) <a href="postconf.5.html#data_directory">data_directory</a>=/my/data/dir If any of these pathnames is not supplied, the program - attempts to generate the pathname by taking the corre- - sponding primary instance pathname, and by replacing the - last pathname component by the value of the <b>-I</b> option. + attempts to generate the missing pathname(s) by taking + the corresponding primary instance pathname, and replac- + ing the last pathname component by the value of the <b>-I</b> + option. - If the instance configuration directory already exists, - and contains both a <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> file, <b>create</b> + If the instance configuration directory already exists, + and contains both a <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> file, <b>create</b> will "import" the instance as-is. For existing instances, <b>create</b> and <b>import</b> are identical. - <b>import</b> Import an existing instance into the list of instances + <b>import</b> Import an existing instance into the list of instances managed by the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> multi-instance manager. This - adds the instance to the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> list + adds the instance to the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> list of the primary instance. If the "<b>-I</b> <i>name</i>" option is pro- - vided it specifies the new name for the instance and is - used to define a default location for the instance con- - figuration directory (as with <b>create</b> above). The "<b>-G</b> - <i>group</i>" option may be used to assign the instance to a - group. Add a "<b><a href="postconf.5.html#config_directory">config_directory</a>=</b><i>/path</i>" argument to over- + vided it specifies the new name for the instance and is + used to define a default location for the instance con- + figuration directory (as with <b>create</b> above). The "<b>-G</b> + <i>group</i>" option may be used to assign the instance to a + group. Add a "<b><a href="postconf.5.html#config_directory">config_directory</a>=</b><i>/path</i>" argument to over- ride a default pathname based on "<b>-I</b> <i>name</i>". <b>destroy</b> - Destroy a secondary Postfix instance. To be a candidate + Destroy a secondary Postfix instance. To be a candidate for destruction an instance must be disabled, stopped and - its queue must not contain any messages. Attempts to - destroy the primary Postfix instance trigger a fatal + its queue must not contain any messages. Attempts to + destroy the primary Postfix instance trigger a fatal error, without destroying the instance. The instance is removed from the primary instance <a href="postconf.5.html">main.cf</a> file's <a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> parameter and its - data, queue and configuration directories are cleaned of - files and directories created by the Postfix system. The + data, queue and configuration directories are cleaned of + files and directories created by the Postfix system. The <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> files are removed from the configu- - ration directory even if they have been modified since - initial creation. Finally, the instance is "deported" + ration directory even if they have been modified since + initial creation. Finally, the instance is "deported" from the list of managed instances. - If other files are present in instance private directo- + If other files are present in instance private directo- ries, the directories may not be fully removed, a warning is logged to alert the administrator. It is expected that - an instance built using "fresh" directories via the <b>cre-</b> - <b>ate</b> action will be fully removed by the <b>destroy</b> action - (if first disabled). If the instance configuration and - queue directories are populated with additional files - (access and rewriting tables, chroot jail content, etc.) + an instance built using "fresh" directories via the <b>cre-</b> + <b>ate</b> action will be fully removed by the <b>destroy</b> action + (if first disabled). If the instance configuration and + queue directories are populated with additional files + (access and rewriting tables, chroot jail content, etc.) the instance directories will not be fully removed. - The <b>destroy</b> action triggers potentially dangerous file - removal operations. Make sure the instance's data, queue - and configuration directories are set correctly and do + The <b>destroy</b> action triggers potentially dangerous file + removal operations. Make sure the instance's data, queue + and configuration directories are set correctly and do not contain any valuable files. - <b>deport</b> Deport a secondary instance from the list of managed + <b>deport</b> Deport a secondary instance from the list of managed instances. This deletes the instance configuration direc- - tory from the primary instance's <a href="postconf.5.html#multi_instance_directories">multi_instance_directo</a>- - <a href="postconf.5.html#multi_instance_directories">ries</a> list, but does not remove any files or directories. + tory from the primary instance's <a href="postconf.5.html#multi_instance_directories">multi_instance_directo</a>- + <a href="postconf.5.html#multi_instance_directories">ries</a> list, but does not remove any files or directories. - <b>assign</b> Assign a new instance name or a new group name to the - selected instance. Use "<b>-G -</b>" to specify "no group" and - "<b>-I -</b>" to specify "no name". If you choose to make an - instance "nameless", set a suitable <a href="postconf.5.html#syslog_name">syslog_name</a> in the + <b>assign</b> Assign a new instance name or a new group name to the + selected instance. Use "<b>-G -</b>" to specify "no group" and + "<b>-I -</b>" to specify "no name". If you choose to make an + instance "nameless", set a suitable <a href="postconf.5.html#syslog_name">syslog_name</a> in the corresponding <a href="postconf.5.html">main.cf</a> file. <b>enable</b> Mark the selected instance as enabled. This just sets the @@ -289,18 +290,18 @@ POSTMULTI(1) POSTMULTI(1) instance's <a href="postconf.5.html">main.cf</a> file. <b>disable</b> - Mark the selected instance as disabled. This means that - the instance will not be started etc. with "postfix - start", "postmulti -p start" and so on. The instance can - still be started etc. with "postfix -c config-directory + Mark the selected instance as disabled. This means that + the instance will not be started etc. with "postfix + start", "postmulti -p start" and so on. The instance can + still be started etc. with "postfix -c config-directory start". <b>Other options</b> - <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b> + <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b> options make the software increasingly verbose. <b>ENVIRONMENT</b> - The <a href="postmulti.1.html"><b>postmulti</b>(1)</a> command exports the following environment variables + The <a href="postmulti.1.html"><b>postmulti</b>(1)</a> command exports the following environment variables before executing the requested <i>command</i> for a given instance: <b>MAIL_VERBOSE</b> @@ -311,22 +312,22 @@ POSTMULTI(1) POSTMULTI(1) <b>CONFIGURATION PARAMETERS</b> <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_directory">daemon_directory</a> (see 'postconf -d' output)</b> The directory with Postfix support programs and daemon programs. <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix - process will import from a non-Postfix parent process, or + The list of environment variables that a privileged Postfix + process will import from a non-Postfix parent process, or name=value environment overrides. <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b> - An optional list of non-default Postfix configuration directo- - ries; these directories belong to additional Postfix instances - that share the Postfix executable files and documentation with - the default Postfix instance, and that are started, stopped, + An optional list of non-default Postfix configuration directo- + ries; these directories belong to additional Postfix instances + that share the Postfix executable files and documentation with + the default Postfix instance, and that are started, stopped, etc., together with the default Postfix instance. <b><a href="postconf.5.html#multi_instance_group">multi_instance_group</a> (empty)</b> @@ -336,40 +337,40 @@ POSTMULTI(1) POSTMULTI(1) The optional instance name of this Postfix instance. <b><a href="postconf.5.html#multi_instance_enable">multi_instance_enable</a> (no)</b> - Allow this Postfix instance to be started, stopped, etc., by a + Allow this Postfix instance to be started, stopped, etc., by a multi-instance manager. <b><a href="postconf.5.html#postmulti_start_commands">postmulti_start_commands</a> (start)</b> - The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager + The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager treats as "start" commands. <b><a href="postconf.5.html#postmulti_stop_commands">postmulti_stop_commands</a> (see 'postconf -d' output)</b> - The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager + The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager treats as "stop" commands. <b><a href="postconf.5.html#postmulti_control_commands">postmulti_control_commands</a> (reload flush)</b> - The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager + The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager treats as "control" commands, that operate on running instances. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Available in Postfix 3.0 and later: <b><a href="postconf.5.html#meta_directory">meta_directory</a> (see 'postconf -d' output)</b> - The location of non-executable files that are shared among mul- - tiple Postfix instances, such as postfix-files, dynamicmaps.cf, - and the multi-instance template files <a href="postconf.5.html">main.cf</a>.proto and <a href="master.5.html">mas- + The location of non-executable files that are shared among mul- + tiple Postfix instances, such as postfix-files, dynamicmaps.cf, + and the multi-instance template files <a href="postconf.5.html">main.cf</a>.proto and <a href="master.5.html">mas- ter.cf</a>.proto. <b><a href="postconf.5.html#shlib_directory">shlib_directory</a> (see 'postconf -d' output)</b> - The location of Postfix dynamically-linked libraries (libpost- - fix-*.so), and the default location of Postfix database plugins - (postfix-*.so) that have a relative pathname in the dynam- + The location of Postfix dynamically-linked libraries (libpost- + fix-*.so), and the default location of Postfix database plugins + (postfix-*.so) that have a relative pathname in the dynam- icmaps.cf file. <b>FILES</b> diff --git a/external/ibm-public/postfix/dist/html/postqueue.1.html b/external/ibm-public/postfix/dist/html/postqueue.1.html index c4b3e1e1d11..123e276121b 100644 --- a/external/ibm-public/postfix/dist/html/postqueue.1.html +++ b/external/ibm-public/postfix/dist/html/postqueue.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postqueue(1) </title> </head> <body> <pre> POSTQUEUE(1) POSTQUEUE(1) @@ -87,8 +87,8 @@ POSTQUEUE(1) POSTQUEUE(1) <b>-s</b> <i>site</i> Schedule immediate delivery of all mail that is queued for the - named <i>site</i>. A numerical site must be specified as a valid <a href="http://tools.ietf.org/html/rfc5321">RFC</a> - <a href="http://tools.ietf.org/html/rfc5321">5321</a> address literal enclosed in [], just like in email + named <i>site</i>. A numerical site must be specified as a valid <a href="https://tools.ietf.org/html/rfc5321">RFC</a> + <a href="https://tools.ietf.org/html/rfc5321">5321</a> address literal enclosed in [], just like in email addresses. The site must be eligible for the "fast flush" ser- vice. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information about the "fast flush" service. @@ -156,7 +156,7 @@ POSTQUEUE(1) POSTQUEUE(1) it can connect to Postfix daemon processes. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc7159">RFC 7159</a> (JSON notation) + <a href="https://tools.ietf.org/html/rfc7159">RFC 7159</a> (JSON notation) <b>DIAGNOSTICS</b> Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard @@ -196,7 +196,7 @@ POSTQUEUE(1) POSTQUEUE(1) tion logfiles with mail that is queued to those destinations. <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix + The list of environment variables that a privileged Postfix process will import from a non-Postfix parent process, or name=value environment overrides. diff --git a/external/ibm-public/postfix/dist/html/postscreen.8.html b/external/ibm-public/postfix/dist/html/postscreen.8.html index 0ebc296e600..c60e1134d08 100644 --- a/external/ibm-public/postfix/dist/html/postscreen.8.html +++ b/external/ibm-public/postfix/dist/html/postscreen.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postscreen(8) </title> </head> <body> <pre> POSTSCREEN(8) POSTSCREEN(8) @@ -28,9 +28,9 @@ POSTSCREEN(8) POSTSCREEN(8) "port 25" server that provides <b>submission</b> service and client authenti- cation, but no MX service. - <a href="postscreen.8.html"><b>postscreen</b>(8)</a> maintains a temporary whitelist for clients that have + <a href="postscreen.8.html"><b>postscreen</b>(8)</a> maintains a temporary allowlist for clients that have passed a number of tests. When an SMTP client IP address is - whitelisted, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> hands off the connection immediately to a + allowlisted, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> hands off the connection immediately to a Postfix SMTP server process. This minimizes the overhead for legitimate mail. @@ -55,20 +55,20 @@ POSTSCREEN(8) POSTSCREEN(8) fixed low privilege. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc1123">RFC 1123</a> (Host requirements) - <a href="http://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) - <a href="http://tools.ietf.org/html/rfc1869">RFC 1869</a> (SMTP service extensions) - <a href="http://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message Size Declaration) - <a href="http://tools.ietf.org/html/rfc1985">RFC 1985</a> (ETRN command) - <a href="http://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Status Codes) - <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) - Not: <a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining) - <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> (CHUNKING without BINARYMIME) - <a href="http://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) - <a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension) - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) - <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol, including multi-line 220 banners) + <a href="https://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc1123">RFC 1123</a> (Host requirements) + <a href="https://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) + <a href="https://tools.ietf.org/html/rfc1869">RFC 1869</a> (SMTP service extensions) + <a href="https://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message Size Declaration) + <a href="https://tools.ietf.org/html/rfc1985">RFC 1985</a> (ETRN command) + <a href="https://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Status Codes) + <a href="https://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) + Not: <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining) + <a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a> (CHUNKING without BINARYMIME) + <a href="https://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) + <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) + <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol, including multi-line 220 banners) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -128,6 +128,11 @@ POSTSCREEN(8) POSTSCREEN(8) Optional lookup table for information that is appended after a 4XX or 5XX <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server response. + Available in Postfix 3.6 and later: + + <b><a href="postconf.5.html#respectful_logging">respectful_logging</a> (see 'postconf -d' output)</b> + Avoid logging that implies white is better than black. + <b>TROUBLE SHOOTING CONTROLS</b> <b><a href="postconf.5.html#postscreen_expansion_filter">postscreen_expansion_filter</a> (see 'postconf -d' output)</b> List of characters that are permitted in @@ -152,31 +157,27 @@ POSTSCREEN(8) POSTSCREEN(8) The time limit for the proxy protocol specified with the <a href="postconf.5.html#postscreen_upstream_proxy_protocol">postscreen_upstream_proxy_protocol</a> parameter. -<b>PERMANENT WHITE/BLACKLIST TEST</b> +<b>PERMANENT ALLOW/DENYLIST TEST</b> This test is executed immediately after a remote SMTP client connects. - If a client is permanently whitelisted, the client will be handed off + If a client is permanently allowlisted, the client will be handed off immediately to a Postfix SMTP server process. <b><a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> (<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>)</b> - Permanent white/blacklist for remote SMTP client IP addresses. + Permanent allow/denylist for remote SMTP client IP addresses. <b><a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> (ignore)</b> - The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when a remote SMTP client is - permanently blacklisted with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parame- - ter. + Renamed to <a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a> in Postfix 3.6. <b>MAIL EXCHANGER POLICY TESTS</b> When <a href="postscreen.8.html"><b>postscreen</b>(8)</a> is configured to monitor all primary and backup MX - addresses, it can refuse to whitelist clients that connect to a backup + addresses, it can refuse to allowlist clients that connect to a backup MX address only. For small sites, this requires configuring primary and backup MX addresses on the same MTA. Larger sites would have to share the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> cache between primary and backup MTAs, which would introduce a common point of failure. <b><a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> (<a href="DATABASE_README.html#types">static</a>:all)</b> - A list of local <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server IP addresses where a - non-whitelisted remote SMTP client can obtain <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s - temporary whitelist status. + Renamed to <a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> in Postfix 3.6. <b>BEFORE 220 GREETING TESTS</b> These tests are executed before the remote SMTP client receives the @@ -199,7 +200,7 @@ POSTSCREEN(8) POSTSCREEN(8) with when it rejects mail. <b><a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> (empty)</b> - Optional list of DNS white/blacklist domains, filters and weight + Optional list of DNS allow/denylist domains, filters and weight factors. <b><a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> (1)</b> @@ -231,29 +232,44 @@ POSTSCREEN(8) POSTSCREEN(8) Available in Postfix version 2.11 and later: <b><a href="postconf.5.html#postscreen_dnsbl_whitelist_threshold">postscreen_dnsbl_whitelist_threshold</a> (0)</b> - Allow a remote SMTP client to skip "before" and "after 220 - greeting" protocol tests, based on its combined DNSBL score as - defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter. + Renamed to <a href="postconf.5.html#postscreen_dnsbl_allowlist_threshold">postscreen_dnsbl_allowlist_threshold</a> in Postfix 3.6. Available in Postfix version 3.0 and later: <b><a href="postconf.5.html#postscreen_dnsbl_timeout">postscreen_dnsbl_timeout</a> (10s)</b> The time limit for DNSBL or DNSWL lookups. + Available in Postfix version 3.6 and later: + + <b><a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a> (ignore)</b> + The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when a remote SMTP client is + permanently denylisted with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parame- + ter. + + <b><a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> (<a href="DATABASE_README.html#types">static</a>:all)</b> + A list of local <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server IP addresses where a + non-allowlisted remote SMTP client can obtain <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s + temporary allowlist status. + + <b><a href="postconf.5.html#postscreen_dnsbl_allowlist_threshold">postscreen_dnsbl_allowlist_threshold</a> (0)</b> + Allow a remote SMTP client to skip "before" and "after 220 + greeting" protocol tests, based on its combined DNSBL score as + defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter. + <b>AFTER 220 GREETING TESTS</b> These tests are executed after the remote SMTP client receives the "220 - servername" greeting. If a client passes all tests during this phase, - it will receive a 4XX response to all RCPT TO commands. After the - client reconnects, it will be allowed to talk directly to a Postfix + servername" greeting. If a client passes all tests during this phase, + it will receive a 4XX response to all RCPT TO commands. After the + client reconnects, it will be allowed to talk directly to a Postfix SMTP server process. <b><a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> (ignore)</b> - The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when a remote SMTP client - sends a bare newline character, that is, a newline not preceded + The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when a remote SMTP client + sends a bare newline character, that is, a newline not preceded by carriage return. <b><a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> (no)</b> - Enable "bare newline" SMTP protocol tests in the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> + Enable "bare newline" SMTP protocol tests in the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server. <b><a href="postconf.5.html#postscreen_disable_vrfy_command">postscreen_disable_vrfy_command</a> ($<a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a>)</b> @@ -268,7 +284,7 @@ POSTSCREEN(8) POSTSCREEN(8) mencing a MAIL transaction. <b><a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> (drop)</b> - The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when a remote SMTP client + The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when a remote SMTP client sends non-SMTP commands as specified with the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbid</a>- <a href="postconf.5.html#postscreen_forbidden_commands">den_commands</a> parameter. @@ -276,12 +292,12 @@ POSTSCREEN(8) POSTSCREEN(8) Enable "non-SMTP command" tests in the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server. <b><a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> (enforce)</b> - The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when a remote SMTP client + The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when a remote SMTP client sends multiple commands instead of sending one command and wait- ing for the server to respond. <b><a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> (no)</b> - Enable "pipelining" SMTP protocol tests in the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> + Enable "pipelining" SMTP protocol tests in the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server. <b>CACHE CONTROLS</b> @@ -293,7 +309,7 @@ POSTSCREEN(8) POSTSCREEN(8) <b><a href="postconf.5.html#postscreen_cache_retention_time">postscreen_cache_retention_time</a> (7d)</b> The amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will cache an expired tem- - porary whitelist entry before it is removed. + porary allowlist entry before it is removed. <b><a href="postconf.5.html#postscreen_bare_newline_ttl">postscreen_bare_newline_ttl</a> (30d)</b> The amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the result from a @@ -301,13 +317,13 @@ POSTSCREEN(8) POSTSCREEN(8) <b><a href="postconf.5.html#postscreen_dnsbl_max_ttl">postscreen_dnsbl_max_ttl</a></b> <b>(${<a href="postconf.5.html#postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a>?{$<a href="postconf.5.html#postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a>}:{1}}h)</b> - The maximum amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the - result from a successful DNS-based reputation test before a + The maximum amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the + result from a successful DNS-based reputation test before a client IP address is required to pass that test again. <b><a href="postconf.5.html#postscreen_dnsbl_min_ttl">postscreen_dnsbl_min_ttl</a> (60s)</b> - The minimum amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the - result from a successful DNS-based reputation test before a + The minimum amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the + result from a successful DNS-based reputation test before a client IP address is required to pass that test again. <b><a href="postconf.5.html#postscreen_greet_ttl">postscreen_greet_ttl</a> (1d)</b> @@ -324,34 +340,34 @@ POSTSCREEN(8) POSTSCREEN(8) <b>RESOURCE CONTROLS</b> <b><a href="postconf.5.html#line_length_limit">line_length_limit</a> (2048)</b> - Upon input, long lines are chopped up into pieces of at most + Upon input, long lines are chopped up into pieces of at most this length; upon delivery, long lines are reconstructed. <b><a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> ($<a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connec</a>-</b> <b><a href="postconf.5.html#smtpd_client_connection_count_limit">tion_count_limit</a>)</b> - How many simultaneous connections any remote SMTP client is + How many simultaneous connections any remote SMTP client is allowed to have with the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> daemon. <b><a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> (20)</b> - The limit on the total number of commands per SMTP session for + The limit on the total number of commands per SMTP session for <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s built-in SMTP protocol engine. <b><a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> (normal: 300s, overload: 10s)</b> - The time limit to read an entire command line with + The time limit to read an entire command line with <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s built-in SMTP protocol engine. <b><a href="postconf.5.html#postscreen_post_queue_limit">postscreen_post_queue_limit</a> ($<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b> - The number of clients that can be waiting for service from a + The number of clients that can be waiting for service from a real Postfix SMTP server process. <b><a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> ($<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b> - The number of non-whitelisted clients that can be waiting for a - decision whether they will receive service from a real Postfix + The number of non-allowlisted clients that can be waiting for a + decision whether they will receive service from a real Postfix SMTP server process. <b><a href="postconf.5.html#postscreen_watchdog_timeout">postscreen_watchdog_timeout</a> (10s)</b> - How much time a <a href="postscreen.8.html"><b>postscreen</b>(8)</a> process may take to respond to a - remote SMTP client command or to perform a cache operation + How much time a <a href="postscreen.8.html"><b>postscreen</b>(8)</a> process may take to respond to a + remote SMTP client command or to perform a cache operation before it is terminated by a built-in watchdog timer. <b>STARTTLS CONTROLS</b> @@ -364,11 +380,11 @@ POSTSCREEN(8) POSTSCREEN(8) The name of the <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>. <b>OBSOLETE STARTTLS SUPPORT CONTROLS</b> - These parameters are supported for compatibility with <a href="smtpd.8.html"><b>smtpd</b>(8)</a> legacy + These parameters are supported for compatibility with <a href="smtpd.8.html"><b>smtpd</b>(8)</a> legacy parameters. <b><a href="postconf.5.html#postscreen_use_tls">postscreen_use_tls</a> ($<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b> - Opportunistic TLS: announce STARTTLS support to remote SMTP + Opportunistic TLS: announce STARTTLS support to remote SMTP clients, but do not require that clients use TLS encryption. <b><a href="postconf.5.html#postscreen_enforce_tls">postscreen_enforce_tls</a> ($<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b> @@ -377,18 +393,18 @@ POSTSCREEN(8) POSTSCREEN(8) <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b> - The maximal number of digits after the decimal point when log- + The maximal number of digits after the decimal point when log- ging sub-second delay values. <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b> The location of all postfix administrative commands. <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> - The maximum amount of time that an idle Postfix daemon process + The maximum amount of time that an idle Postfix daemon process waits for an incoming connection before terminating voluntarily. <b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b> @@ -401,7 +417,7 @@ POSTSCREEN(8) POSTSCREEN(8) The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Available in Postfix 3.3 and later: @@ -411,14 +427,14 @@ POSTSCREEN(8) POSTSCREEN(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> - The email address form that will be used in non-debug logging + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> + The email address form that will be used in non-debug logging (info, warning, etc.). <b>SEE ALSO</b> <a href="smtpd.8.html">smtpd(8)</a>, Postfix SMTP server <a href="tlsproxy.8.html">tlsproxy(8)</a>, Postfix TLS proxy server - <a href="dnsblog.8.html">dnsblog(8)</a>, DNS black/whitelist logger + <a href="dnsblog.8.html">dnsblog(8)</a>, DNS allow/denylist logger <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging syslogd(8), system logging @@ -431,7 +447,7 @@ POSTSCREEN(8) POSTSCREEN(8) <b>HISTORY</b> This service was introduced with Postfix version 2.8. - Many ideas in <a href="postscreen.8.html"><b>postscreen</b>(8)</a> were explored in earlier work by Michael + Many ideas in <a href="postscreen.8.html"><b>postscreen</b>(8)</a> were explored in earlier work by Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic Control. <b>AUTHOR(S)</b> diff --git a/external/ibm-public/postfix/dist/html/postsuper.1.html b/external/ibm-public/postfix/dist/html/postsuper.1.html index 66078977264..47b98f31645 100644 --- a/external/ibm-public/postfix/dist/html/postsuper.1.html +++ b/external/ibm-public/postfix/dist/html/postsuper.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - postsuper(1) </title> </head> <body> <pre> POSTSUPER(1) POSTSUPER(1) @@ -44,6 +44,15 @@ POSTSUPER(1) POSTSUPER(1) input. For example, to delete all mail with exactly one recipi- ent <b>user@example.com</b>: + postqueue -j | jq -r ' + # See JSON OBJECT FORMAT section in the <a href="postqueue.1.html">postqueue(1)</a> manpage + select(.recipients[0].address == "user@example.com") + | select(.recipients[1].address == null) + | .queue_id + ' | postsuper -d - + + (note the "jq -r" option), or the historical form: + mailq | tail -n +2 | grep -v '^ *(' | awk 'BEGIN { RS = "" } # $7=sender, $8=recipient1, $9=recipient2 { if ($8 == "user@example.com" && $9 == "") diff --git a/external/ibm-public/postfix/dist/html/posttls-finger.1.html b/external/ibm-public/postfix/dist/html/posttls-finger.1.html index 4a47a4818b8..401ad0726e0 100644 --- a/external/ibm-public/postfix/dist/html/posttls-finger.1.html +++ b/external/ibm-public/postfix/dist/html/posttls-finger.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - posttls-finger(1) </title> </head> <body> <pre> POSTTLS-FINGER(1) POSTTLS-FINGER(1) @@ -18,7 +18,7 @@ POSTTLS-FINGER(1) POSTTLS-FINGER(1) TLS-related information about the server. With SMTP, the destination is a domainname; with LMTP it is either a domainname prefixed with <b>inet:</b> or a pathname prefixed with <b>unix:</b>. If Postfix is built without TLS - support, the resulting posttls-finger program has very limited func- + support, the resulting <a href="posttls-finger.1.html"><b>posttls-finger</b>(1)</a> program has very limited func- tionality, and only the <b>-a</b>, <b>-c</b>, <b>-h</b>, <b>-o</b>, <b>-S</b>, <b>-t</b>, <b>-T</b> and <b>-v</b> options are available. @@ -83,9 +83,9 @@ POSTTLS-FINGER(1) POSTTLS-FINGER(1) <b>-a</b> <i>family</i> (default: <b>any</b>) Address family preference: <b>ipv4</b>, <b>ipv6</b> or <b>any</b>. When using <b>any</b>, - posttls-finger will randomly select one of the two as the more - preferred, and exhaust all MX preferences for the first address - family before trying any addresses for the other. + <a href="posttls-finger.1.html"><b>posttls-finger</b>(1)</a> will randomly select one of the two as the + more preferred, and exhaust all MX preferences for the first + address family before trying any addresses for the other. <b>-A</b> <i>trust-anchor.pem</i> (default: none) A list of PEM trust-anchor files that overrides CAfile and CAp- @@ -104,77 +104,78 @@ POSTTLS-FINGER(1) POSTTLS-FINGER(1) tificates. To see the actual chain sent by the remote SMTP server leave <i>CAfile</i> and <i>CApath</i> unset. - <b>-d</b> <i>mdalg</i> (default: <b>sha1</b>) + <b>-d</b> <i>mdalg</i> (default: <b>$<a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b>) The message digest algorithm to use for reporting remote SMTP server fingerprints and matching against user provided certifi- cate fingerprints (with DANE TLSA records the algorithm is spec- - ified in the DNS). + ified in the DNS). In Postfix versions prior to 3.6, the + default value was "md5". - <b>-f</b> Lookup the associated DANE TLSA RRset even when a hostname is - not an alias and its address records lie in an unsigned zone. + <b>-f</b> Lookup the associated DANE TLSA RRset even when a hostname is + not an alias and its address records lie in an unsigned zone. See <a href="postconf.5.html#smtp_tls_force_insecure_host_tlsa_lookup">smtp_tls_force_insecure_host_tlsa_lookup</a> for details. <b>-F</b> <i>CAfile.pem</i> (default: none) The PEM formatted CAfile for remote SMTP server certificate ver- - ification. By default no CAfile is used and no public CAs are + ification. By default no CAfile is used and no public CAs are trusted. <b>-g</b> <i>grade</i> (default: medium) - The minimum TLS cipher grade used by posttls-finger. See + The minimum TLS cipher grade used by <a href="posttls-finger.1.html"><b>posttls-finger</b>(1)</a>. See <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> for details. <b>-h</b> <i>host</i><b>_</b><i>lookup</i> (default: <b>dns</b>) - The hostname lookup methods used for the connection. See the + The hostname lookup methods used for the connection. See the documentation of <a href="postconf.5.html#smtp_host_lookup">smtp_host_lookup</a> for syntax and semantics. <b>-H</b> <i>chainfiles</i> (default: <i>none</i>) List of files with a sequence PEM-encoded TLS client certificate - chains. The list can be built-up incrementally, by specifying - the option multiple times, or all at once via a comma or white- - space separated list of filenames. Each chain starts with a - private key, which is followed immediately by the corresponding - certificate, and optionally by additional issuer certificates. + chains. The list can be built-up incrementally, by specifying + the option multiple times, or all at once via a comma or white- + space separated list of filenames. Each chain starts with a + private key, which is followed immediately by the corresponding + certificate, and optionally by additional issuer certificates. Each new key begins a new chain for the corresponding algorithm. - This option is mutually exclusive with the below <b>-k</b> and <b>-K</b> + This option is mutually exclusive with the below <b>-k</b> and <b>-K</b> options. <b>-k</b> <i>certfile</i> (default: <i>keyfile</i>) - File with PEM-encoded TLS client certificate chain. This + File with PEM-encoded TLS client certificate chain. This defaults to <i>keyfile</i> if one is specified. <b>-K</b> <i>keyfile</i> (default: <i>certfile</i>) - File with PEM-encoded TLS client private key. This defaults to + File with PEM-encoded TLS client private key. This defaults to <i>certfile</i> if one is specified. <b>-l</b> <i>level</i> (default: <b>dane</b> or <b>secure</b>) - The security level for the connection, default <b>dane</b> or <b>secure</b> + The security level for the connection, default <b>dane</b> or <b>secure</b> depending on whether DNSSEC is available. For syntax and seman- - tics, see the documentation of <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a>. When - <b>dane</b> or <b>dane-only</b> is supported and selected, if no TLSA records - are found, or all the records found are unusable, the <i>secure</i> - level will be used instead. The <b>fingerprint</b> security level + tics, see the documentation of <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a>. When + <b>dane</b> or <b>dane-only</b> is supported and selected, if no TLSA records + are found, or all the records found are unusable, the <i>secure</i> + level will be used instead. The <b>fingerprint</b> security level allows you to test certificate or public-key fingerprint matches before you deploy them in the policy table. - Note, since <b>posttls-finger</b> does not actually deliver any email, - the <b>none</b>, <b>may</b> and <b>encrypt</b> security levels are not very useful. - Since <b>may</b> and <b>encrypt</b> don't require peer certificates, they will - often negotiate anonymous TLS ciphersuites, so you won't learn - much about the remote SMTP server's certificates at these levels - if it also supports anonymous TLS (though you may learn that the - server supports anonymous TLS). + Note, since <a href="posttls-finger.1.html"><b>posttls-finger</b>(1)</a> does not actually deliver any + email, the <b>none</b>, <b>may</b> and <b>encrypt</b> security levels are not very + useful. Since <b>may</b> and <b>encrypt</b> don't require peer certificates, + they will often negotiate anonymous TLS ciphersuites, so you + won't learn much about the remote SMTP server's certificates at + these levels if it also supports anonymous TLS (though you may + learn that the server supports anonymous TLS). <b>-L</b> <i>logopts</i> (default: <b>routine,certmatch</b>) - Fine-grained TLS logging options. To tune the TLS features + Fine-grained TLS logging options. To tune the TLS features logged during the TLS handshake, specify one or more of: <b>0, none</b> - These yield no TLS logging; you'll generally want more, + These yield no TLS logging; you'll generally want more, but this is handy if you just want the trust chain: $ posttls-finger -cC -L none destination <b>1, routine, summary</b> - These synonymous values yield a normal one-line summary + These synonymous values yield a normal one-line summary of the TLS connection. <b>2, debug</b> @@ -182,104 +183,104 @@ POSTTLS-FINGER(1) POSTTLS-FINGER(1) and verbose. <b>3, ssl-expert</b> - These synonymous values combine debug with ssl-hand- + These synonymous values combine debug with ssl-hand- shake-packet-dump. For experts only. <b>4, ssl-developer</b> - These synonymous values combine ssl-expert with ssl-ses- - sion-packet-dump. For experts only, and in most cases, + These synonymous values combine ssl-expert with ssl-ses- + sion-packet-dump. For experts only, and in most cases, use wireshark instead. <b>ssl-debug</b> - Turn on OpenSSL logging of the progress of the SSL hand- + Turn on OpenSSL logging of the progress of the SSL hand- shake. <b>ssl-handshake-packet-dump</b> - Log hexadecimal packet dumps of the SSL handshake; for + Log hexadecimal packet dumps of the SSL handshake; for experts only. <b>ssl-session-packet-dump</b> - Log hexadecimal packet dumps of the entire SSL session; - only useful to those who can debug SSL protocol problems + Log hexadecimal packet dumps of the entire SSL session; + only useful to those who can debug SSL protocol problems from hex dumps. <b>untrusted</b> - Logs trust chain verification problems. This is turned - on automatically at security levels that use peer names - signed by Certification Authorities to validate certifi- - cates. So while this setting is recognized, you should + Logs trust chain verification problems. This is turned + on automatically at security levels that use peer names + signed by Certification Authorities to validate certifi- + cates. So while this setting is recognized, you should never need to set it explicitly. <b>peercert</b> - This logs a one line summary of the remote SMTP server + This logs a one line summary of the remote SMTP server certificate subject, issuer, and fingerprints. <b>certmatch</b> - This logs remote SMTP server certificate matching, show- + This logs remote SMTP server certificate matching, show- ing the CN and each subjectAltName and which name - matched. With DANE, logs matching of TLSA record + matched. With DANE, logs matching of TLSA record trust-anchor and end-entity certificates. - <b>cache</b> This logs session cache operations, showing whether ses- - sion caching is effective with the remote SMTP server. - Automatically used when reconnecting with the <b>-r</b> option; + <b>cache</b> This logs session cache operations, showing whether ses- + sion caching is effective with the remote SMTP server. + Automatically used when reconnecting with the <b>-r</b> option; rarely needs to be set explicitly. <b>verbose</b> Enables verbose logging in the Postfix TLS driver; includes all of peercert..cache and more. - The default is <b>routine,certmatch</b>. After a reconnect, <b>peercert</b>, + The default is <b>routine,certmatch</b>. After a reconnect, <b>peercert</b>, <b>certmatch</b> and <b>verbose</b> are automatically disabled while <b>cache</b> and <b>summary</b> are enabled. <b>-m</b> <i>count</i> (default: <b>5</b>) - When the <b>-r</b> <i>delay</i> option is specified, the <b>-m</b> option determines - the maximum number of reconnect attempts to use with a server - behind a load balancer, to see whether connection caching is - likely to be effective for this destination. Some MTAs don't - expose the underlying server identity in their EHLO response; - with these servers there will never be more than 1 reconnection + When the <b>-r</b> <i>delay</i> option is specified, the <b>-m</b> option determines + the maximum number of reconnect attempts to use with a server + behind a load balancer, to see whether connection caching is + likely to be effective for this destination. Some MTAs don't + expose the underlying server identity in their EHLO response; + with these servers there will never be more than 1 reconnection attempt. <b>-M</b> <i>insecure</i><b>_</b><i>mx</i><b>_</b><i>policy</i> (default: <b>dane</b>) - The TLS policy for MX hosts with "secure" TLSA records when the - nexthop destination security level is <b>dane</b>, but the MX record + The TLS policy for MX hosts with "secure" TLSA records when the + nexthop destination security level is <b>dane</b>, but the MX record was found via an "insecure" MX lookup. See the <a href="postconf.5.html">main.cf</a> documen- - tation for smtp_tls_insecure_mx_policy for details. + tation for <a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> for details. <b>-o</b> <i>name=value</i> - Specify zero or more times to override the value of the <a href="postconf.5.html">main.cf</a> - parameter <i>name</i> with <i>value</i>. Possible use-cases include overrid- - ing the values of TLS library parameters, or "<a href="postconf.5.html#myhostname">myhostname</a>" to + Specify zero or more times to override the value of the <a href="postconf.5.html">main.cf</a> + parameter <i>name</i> with <i>value</i>. Possible use-cases include overrid- + ing the values of TLS library parameters, or "<a href="postconf.5.html#myhostname">myhostname</a>" to configure the SMTP EHLO name sent to the remote server. - <b>-p</b> <i>protocols</i> (default: !SSLv2) - List of TLS protocols that posttls-finger will exclude or - include. See <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> for details. + <b>-p</b> <i>protocols</i> (default: >=TLSv1) + TLS protocols that <a href="posttls-finger.1.html"><b>posttls-finger</b>(1)</a> will exclude or include. + See <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> for details. <b>-P</b> <i>CApath/</i> (default: none) - The OpenSSL CApath/ directory (indexed via c_rehash(1)) for + The OpenSSL CApath/ directory (indexed via c_rehash(1)) for remote SMTP server certificate verification. By default no CAp- ath is used and no public CAs are trusted. <b>-r</b> <i>delay</i> - With a cacheable TLS session, disconnect and reconnect after + With a cacheable TLS session, disconnect and reconnect after <i>delay</i> seconds. Report whether the session is re-used. Retry if a - new server is encountered, up to 5 times or as specified with - the <b>-m</b> option. By default reconnection is disabled, specify a + new server is encountered, up to 5 times or as specified with + the <b>-m</b> option. By default reconnection is disabled, specify a positive delay to enable this behavior. <b>-s</b> <i>servername</i> - The server name to send with the TLS Server Name Indication - (SNI) extension. When the server has DANE TLSA records, this - parameter is ignored and the TLSA base domain is used instead. - Otherwise, SNI is not used by default, but can be enabled by + The server name to send with the TLS Server Name Indication + (SNI) extension. When the server has DANE TLSA records, this + parameter is ignored and the TLSA base domain is used instead. + Otherwise, SNI is not used by default, but can be enabled by specifying the desired value with this option. - <b>-S</b> Disable SMTP; that is, connect to an LMTP server. The default - port for LMTP over TCP is 24. Alternative ports can specified - by appending "<i>:servicename</i>" or ":<i>portnumber</i>" to the destination + <b>-S</b> Disable SMTP; that is, connect to an LMTP server. The default + port for LMTP over TCP is 24. Alternative ports can specified + by appending "<i>:servicename</i>" or ":<i>portnumber</i>" to the destination argument. <b>-t</b> <i>timeout</i> (default: <b>30</b>) @@ -287,31 +288,31 @@ POSTTLS-FINGER(1) POSTTLS-FINGER(1) reading the remote server's 220 banner. <b>-T</b> <i>timeout</i> (default: <b>30</b>) - The SMTP/LMTP command timeout for EHLO/LHLO, STARTTLS and QUIT. + The SMTP/LMTP command timeout for EHLO/LHLO, STARTTLS and QUIT. - <b>-v</b> Enable verbose Postfix logging. Specify more than once to + <b>-v</b> Enable verbose Postfix logging. Specify more than once to increase the level of verbose logging. - <b>-w</b> Enable outgoing TLS wrapper mode, or SMTPS support. This is - typically provided on port 465 by servers that are compatible - with the ad-hoc SMTP in SSL protocol, rather than the standard - STARTTLS protocol. The destination <i>domain</i>:<i>port</i> should of course - provide such a service. + <b>-w</b> Enable outgoing TLS wrapper mode, or SUBMISSIONS/SMTPS support. + This is typically provided on port 465 by servers that are com- + patible with the SMTP-in-SSL protocol, rather than the STARTTLS + protocol. The destination <i>domain</i>:<i>port</i> must of course provide + such a service. - <b>-X</b> Enable <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> mode. This is an unsupported mode, for pro- + <b>-X</b> Enable <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> mode. This is an unsupported mode, for pro- gram development only. [<b>inet:</b>]<i>domain</i>[:<i>port</i>] Connect via TCP to domain <i>domain</i>, port <i>port</i>. The default port is - <b>smtp</b> (or 24 with LMTP). With SMTP an MX lookup is performed to - resolve the domain to a host, unless the domain is enclosed in - <b>[]</b>. If you want to connect to a specific MX host, for instance - <i>mx1.example.com</i>, specify [<i>mx1.example.com</i>] as the destination + <b>smtp</b> (or 24 with LMTP). With SMTP an MX lookup is performed to + resolve the domain to a host, unless the domain is enclosed in + <b>[]</b>. If you want to connect to a specific MX host, for instance + <i>mx1.example.com</i>, specify [<i>mx1.example.com</i>] as the destination and <i>example.com</i> as a <b>match</b> argument. When using DNS, the desti- - nation domain is assumed fully qualified and no default domain - or search suffixes are applied; you must use fully-qualified - names or also enable <b>native</b> host lookups (these don't support - <b>dane</b> or <b>dane-only</b> as no DNSSEC validation information is avail- + nation domain is assumed fully qualified and no <a href="ADDRESS_CLASS_README.html#default_domain_class">default domain</a> + or search suffixes are applied; you must use fully-qualified + names or also enable <b>native</b> host lookups (these don't support + <b>dane</b> or <b>dane-only</b> as no DNSSEC validation information is avail- able via <b>native</b> lookups). <b>unix:</b><i>pathname</i> @@ -320,8 +321,8 @@ POSTTLS-FINGER(1) POSTTLS-FINGER(1) <b>match ...</b> With no match arguments specified, certificate peername matching uses the compiled-in default strategies for each security level. - If you specify one or more arguments, these will be used as the - list of certificate or public-key digests to match for the <b>fin-</b> + If you specify one or more arguments, these will be used as the + list of certificate or public-key digests to match for the <b>fin-</b> <b>gerprint</b> level, or as the list of DNS names to match in the cer- tificate at the <b>verify</b> and <b>secure</b> levels. If the security level is <b>dane</b>, or <b>dane-only</b> the match names are ignored, and <b>hostname,</b> diff --git a/external/ibm-public/postfix/dist/html/proxymap.8.html b/external/ibm-public/postfix/dist/html/proxymap.8.html index 649d399f5f2..8a65c606405 100644 --- a/external/ibm-public/postfix/dist/html/proxymap.8.html +++ b/external/ibm-public/postfix/dist/html/proxymap.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - proxymap(8) </title> </head> <body> <pre> PROXYMAP(8) PROXYMAP(8) diff --git a/external/ibm-public/postfix/dist/html/qmgr.8.html b/external/ibm-public/postfix/dist/html/qmgr.8.html index f30a5b8de58..a1995851019 100644 --- a/external/ibm-public/postfix/dist/html/qmgr.8.html +++ b/external/ibm-public/postfix/dist/html/qmgr.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - qmgr(8) </title> </head> <body> <pre> QMGR(8) QMGR(8) @@ -138,8 +138,8 @@ QMGR(8) QMGR(8) queue manager of the arrival of new mail one would request <b>I</b>. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) - <a href="http://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery status notifications) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) + <a href="https://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery status notifications) <b>SECURITY</b> The <a href="qmgr.8.html"><b>qmgr</b>(8)</a> daemon is not security sensitive. It reads single-character @@ -460,7 +460,7 @@ QMGR(8) QMGR(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> The email address form that will be used in non-debug logging (info, warning, etc.). diff --git a/external/ibm-public/postfix/dist/html/qmqp-sink.1.html b/external/ibm-public/postfix/dist/html/qmqp-sink.1.html index ecbfe98f4a8..2ff8a028b78 100644 --- a/external/ibm-public/postfix/dist/html/qmqp-sink.1.html +++ b/external/ibm-public/postfix/dist/html/qmqp-sink.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - qmqp-sink(1) </title> </head> <body> <pre> QMQP-SINK(1) QMQP-SINK(1) diff --git a/external/ibm-public/postfix/dist/html/qmqp-source.1.html b/external/ibm-public/postfix/dist/html/qmqp-source.1.html index 60b15e76692..7bb739a2058 100644 --- a/external/ibm-public/postfix/dist/html/qmqp-source.1.html +++ b/external/ibm-public/postfix/dist/html/qmqp-source.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - qmqp-source(1) </title> </head> <body> <pre> QMQP-SOURCE(1) QMQP-SOURCE(1) diff --git a/external/ibm-public/postfix/dist/html/qmqpd.8.html b/external/ibm-public/postfix/dist/html/qmqpd.8.html index 4086cec53c1..bbabaf714ed 100644 --- a/external/ibm-public/postfix/dist/html/qmqpd.8.html +++ b/external/ibm-public/postfix/dist/html/qmqpd.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - qmqpd(8) </title> </head> <body> <pre> QMQPD(8) QMQPD(8) @@ -60,7 +60,7 @@ QMQPD(8) QMQPD(8) <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> Enable preliminary SMTPUTF8 support for the protocols described - in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. + in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. <b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b> Detect that a message requires SMTPUTF8 support for the speci- @@ -92,13 +92,15 @@ QMQPD(8) QMQPD(8) <b>TROUBLE SHOOTING CONTROLS</b> <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> - The increment in verbose logging level when a remote client or - server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. + The increment in verbose logging level when a nexthop destina- + tion, remote client or server name or network address matches a + pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> - Optional list of remote client or server hostname or network - address patterns that cause the verbose logging level to - increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. + Optional list of nexthop destination, remote client or server + name or network address patterns that, if matched, cause the + verbose logging level to increase by the amount specified in + $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. <b><a href="postconf.5.html#soft_bounce">soft_bounce</a> (no)</b> Safety net to keep mail queued that would otherwise be returned diff --git a/external/ibm-public/postfix/dist/html/qshape.1.html b/external/ibm-public/postfix/dist/html/qshape.1.html index 1cecd33a522..07d206c0bb4 100644 --- a/external/ibm-public/postfix/dist/html/qshape.1.html +++ b/external/ibm-public/postfix/dist/html/qshape.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - qshape(1) </title> </head> <body> <pre> QSHAPE(1) QSHAPE(1) diff --git a/external/ibm-public/postfix/dist/html/regexp_table.5.html b/external/ibm-public/postfix/dist/html/regexp_table.5.html index 468f7af8191..b0e8648191d 100644 --- a/external/ibm-public/postfix/dist/html/regexp_table.5.html +++ b/external/ibm-public/postfix/dist/html/regexp_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - regexp_table(5) </title> </head> <body> <pre> REGEXP_TABLE(5) REGEXP_TABLE(5) @@ -127,6 +127,29 @@ REGEXP_TABLE(5) REGEXP_TABLE(5) the expression does not match, substitutions are not available for negated patterns. +<b>INLINE SPECIFICATION</b> + The contents of a table may be specified in the table name. The basic + syntax is: + + <a href="postconf.5.html">main.cf</a>: + <i>parameter</i> <b>= .. <a href="regexp_table.5.html">regexp</a>:{ {</b> <i>rule-1</i> <b>}, {</b> <i>rule-2</i> <b>} .. } ..</b> + + <a href="master.5.html">master.cf</a>: + <b>.. -o {</b> <i>parameter</i> <b>= .. <a href="regexp_table.5.html">regexp</a>:{ {</b> <i>rule-1</i> <b>}, {</b> <i>rule-2</i> <b>} .. } .. } ..</b> + + Postfix ignores whitespace after '{' and before '}', and writes each + <i>rule</i> as one text line to an in-memory file: + + in-memory file: + rule-1 + rule-2 + .. + + Postfix parses the result as if it is a file in /etc/postfix. + + Note: if a rule contains <b>$</b>, specify <b>$$</b> to keep Postfix from trying to + do <i>$name</i> expansion as it evaluates a parameter value. + <b>EXAMPLE SMTPD ACCESS MAP</b> # Disallow sender-specified routing. This is a must if you relay mail # for other domains. diff --git a/external/ibm-public/postfix/dist/html/relocated.5.html b/external/ibm-public/postfix/dist/html/relocated.5.html index ac2a4eda008..87db84b6520 100644 --- a/external/ibm-public/postfix/dist/html/relocated.5.html +++ b/external/ibm-public/postfix/dist/html/relocated.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - relocated(5) </title> </head> <body> <pre> RELOCATED(5) RELOCATED(5) @@ -27,8 +27,8 @@ RELOCATED(5) RELOCATED(5) Alternatively, the table can be provided as a regular-expression map where patterns are given as regular expressions, or lookups can be - directed to TCP-based server. In those case, the lookups are done in a - slightly different way as described below under "REGULAR EXPRESSION + directed to a TCP-based server. In those case, the lookups are done in + a slightly different way as described below under "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". Table lookups are case insensitive. @@ -83,7 +83,7 @@ RELOCATED(5) RELOCATED(5) to a TCP-based server. For a description of regular expression lookup table syntax, see <a href="regexp_table.5.html"><b>regexp_table</b>(5)</a> or <a href="pcre_table.5.html"><b>pcre_table</b>(5)</a>. For a description of the TCP client/server table lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This - feature is not available up to and including Postfix version 2.4. + feature is available in Postfix 2.5 and later. Each pattern is a regular expression that is applied to the entire address being looked up. Thus, <i>user@domain</i> mail addresses are not bro- @@ -100,8 +100,8 @@ RELOCATED(5) RELOCATED(5) <b>TCP-BASED TABLES</b> This section describes how the table lookups change when lookups are directed to a TCP-based server. For a description of the TCP - client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is not - available up to and including Postfix version 2.4. + client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is + available in Postfix 2.5 and later. Each lookup operation uses the entire address once. Thus, <i>user@domain</i> mail addresses are not broken up into their <i>user</i> and <i>@domain</i> con- @@ -117,25 +117,27 @@ RELOCATED(5) RELOCATED(5) below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including examples. - <b><a href="postconf.5.html#relocated_maps">relocated_maps</a></b> - List of lookup tables for relocated users or sites. + <b><a href="postconf.5.html#relocated_maps">relocated_maps</a> (empty)</b> + Optional lookup tables with new contact information for users or + domains that no longer exist. Other parameters of interest: - <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b> - The network interface addresses that this system receives mail - on. You need to stop and start Postfix when this parameter - changes. + <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b> + The network interface addresses that this mail system receives + mail on. - <b><a href="postconf.5.html#mydestination">mydestination</a></b> - List of domains that this mail system considers local. + <b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b> + The list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a> + mail delivery transport. - <b><a href="postconf.5.html#myorigin">myorigin</a></b> - The domain that is appended to locally-posted mail. + <b><a href="postconf.5.html#myorigin">myorigin</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> + The domain name that locally-posted mail appears to come from, + and that locally posted mail is delivered to. - <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b> - Other interfaces that this machine receives mail on by way of a - proxy agent or network address translator. + <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b> + The network interface addresses that this mail system receives + mail on by way of a proxy or network address translation unit. <b>SEE ALSO</b> <a href="trivial-rewrite.8.html">trivial-rewrite(8)</a>, address resolver diff --git a/external/ibm-public/postfix/dist/html/scache.8.html b/external/ibm-public/postfix/dist/html/scache.8.html index 6b2512678d2..c3b8b19bccc 100644 --- a/external/ibm-public/postfix/dist/html/scache.8.html +++ b/external/ibm-public/postfix/dist/html/scache.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - scache(8) </title> </head> <body> <pre> SCACHE(8) SCACHE(8) diff --git a/external/ibm-public/postfix/dist/html/sendmail.1.html b/external/ibm-public/postfix/dist/html/sendmail.1.html index 02f20fe8913..eb99f16cb0a 100644 --- a/external/ibm-public/postfix/dist/html/sendmail.1.html +++ b/external/ibm-public/postfix/dist/html/sendmail.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - sendmail(1) </title> </head> <body> <pre> SENDMAIL(1) SENDMAIL(1) @@ -45,24 +45,27 @@ SENDMAIL(1) SENDMAIL(1) ery attempt will be made until the mail is taken off hold. - This mode of operation is implemented by executing the + <b>#</b> The message is forced to expire. See the <a href="postsuper.1.html"><b>postsuper</b>(1)</a> + options <b>-e</b> or <b>-f</b>. + + This mode of operation is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. <b>newaliases</b> - Initialize the alias database. If no input file is specified - (with the <b>-oA</b> option, see below), the program processes the - file(s) specified with the <b><a href="postconf.5.html#alias_database">alias_database</a></b> configuration parame- - ter. If no alias database type is specified, the program uses - the type specified with the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration + Initialize the alias database. If no input file is specified + (with the <b>-oA</b> option, see below), the program processes the + file(s) specified with the <b><a href="postconf.5.html#alias_database">alias_database</a></b> configuration parame- + ter. If no alias database type is specified, the program uses + the type specified with the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration parameter. This mode of operation is implemented by running the <a href="postalias.1.html"><b>postalias</b>(1)</a> command. Note: it may take a minute or so before an alias database update - becomes visible. Use the "<b>postfix reload</b>" command to eliminate + becomes visible. Use the "<b>postfix reload</b>" command to eliminate this delay. - These and other features can be selected by specifying the appropriate - combination of command-line options. Some features are controlled by + These and other features can be selected by specifying the appropriate + combination of command-line options. Some features are controlled by parameters in the <a href="postconf.5.html"><b>main.cf</b></a> configuration file. The following options are recognized: @@ -70,13 +73,13 @@ SENDMAIL(1) SENDMAIL(1) <b>-Am</b> (ignored) <b>-Ac</b> (ignored) - Postfix sendmail uses the same configuration file regardless of + Postfix sendmail uses the same configuration file regardless of whether or not a message is an initial submission. <b>-B</b> <i>body</i><b>_</b><i>type</i> The message body MIME type: <b>7BIT</b> or <b>8BITMIME</b>. - <b>-bd</b> Go into daemon mode. This mode of operation is implemented by + <b>-bd</b> Go into daemon mode. This mode of operation is implemented by executing the "<b>postfix start</b>" command. <b>-bh</b> (ignored) @@ -86,8 +89,8 @@ SENDMAIL(1) SENDMAIL(1) <b>-bi</b> Initialize alias database. See the <b>newaliases</b> command above. - <b>-bl</b> Go into daemon mode. To accept only local connections as with - Sendmail's <b>-bl</b> option, specify "<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback</b>" in + <b>-bl</b> Go into daemon mode. To accept only local connections as with + Sendmail's <b>-bl</b> option, specify "<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback</b>" in the Postfix <a href="postconf.5.html"><b>main.cf</b></a> configuration file. <b>-bm</b> Read mail from standard input and arrange for delivery. This is @@ -95,17 +98,17 @@ SENDMAIL(1) SENDMAIL(1) <b>-bp</b> List the mail queue. See the <b>mailq</b> command above. - <b>-bs</b> Stand-alone SMTP server mode. Read SMTP commands from standard - input, and write responses to standard output. In stand-alone - SMTP server mode, mail relaying and other access controls are - disabled by default. To enable them, run the process as the + <b>-bs</b> Stand-alone SMTP server mode. Read SMTP commands from standard + input, and write responses to standard output. In stand-alone + SMTP server mode, mail relaying and other access controls are + disabled by default. To enable them, run the process as the <b><a href="postconf.5.html#mail_owner">mail_owner</a></b> user. - This mode of operation is implemented by running the <a href="smtpd.8.html"><b>smtpd</b>(8)</a> + This mode of operation is implemented by running the <a href="smtpd.8.html"><b>smtpd</b>(8)</a> daemon. - <b>-bv</b> Do not collect or deliver a message. Instead, send an email - report after verifying each recipient address. This is useful + <b>-bv</b> Do not collect or deliver a message. Instead, send an email + report after verifying each recipient address. This is useful for testing address rewriting and routing configurations. This feature is available in Postfix version 2.1 and later. @@ -113,58 +116,58 @@ SENDMAIL(1) SENDMAIL(1) <b>-C</b> <i>config</i><b>_</b><i>file</i> <b>-C</b> <i>config</i><b>_</b><i>dir</i> - The path name of the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, or of its parent - directory. This information is ignored with Postfix versions + The path name of the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, or of its parent + directory. This information is ignored with Postfix versions before 2.3. With Postfix version 3.2 and later, a non-default directory must - be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter- + be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter- nate_config_directories or <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> parame- ters. - With all Postfix versions, you can specify a directory pathname - with the MAIL_CONFIG environment variable to override the loca- + With all Postfix versions, you can specify a directory pathname + with the MAIL_CONFIG environment variable to override the loca- tion of configuration files. <b>-F</b> <i>full</i><b>_</b><i>name</i> - Set the sender full name. This overrides the NAME environment + Set the sender full name. This overrides the NAME environment variable, and is used only with messages that have no <b>From:</b> mes- sage header. <b>-f</b> <i>sender</i> - Set the envelope sender address. This is the address where + Set the envelope sender address. This is the address where delivery problems are sent to. With Postfix versions before 2.1, - the <b>Errors-To:</b> message header overrides the error return + the <b>Errors-To:</b> message header overrides the error return address. - <b>-G</b> Gateway (relay) submission, as opposed to initial user submis- - sion. Either do not rewrite addresses at all, or update incom- - plete addresses with the domain information specified with + <b>-G</b> Gateway (relay) submission, as opposed to initial user submis- + sion. Either do not rewrite addresses at all, or update incom- + plete addresses with the domain information specified with <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a></b>. This option is ignored before Postfix version 2.3. <b>-h</b> <i>hop</i><b>_</b><i>count</i> (ignored) - Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter + Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter instead. <b>-I</b> Initialize alias database. See the <b>newaliases</b> command above. - <b>-i</b> When reading a message from standard input, don't treat a line + <b>-i</b> When reading a message from standard input, don't treat a line with only a <b>.</b> character as the end of input. <b>-L</b> <i>label</i> (ignored) - The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter + The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter instead. <b>-m</b> (ignored) Backwards compatibility. <b>-N</b> <i>dsn</i> (default: 'delay, failure') - Delivery status notification control. Specify either a + Delivery status notification control. Specify either a comma-separated list with one or more of <b>failure</b> (send notifica- - tion when delivery fails), <b>delay</b> (send notification when deliv- - ery is delayed), or <b>success</b> (send notification when the message + tion when delivery fails), <b>delay</b> (send notification when deliv- + ery is delayed), or <b>success</b> (send notification when the message is delivered); or specify <b>never</b> (don't send any notifications at all). @@ -174,50 +177,50 @@ SENDMAIL(1) SENDMAIL(1) Backwards compatibility. <b>-oA</b><i>alias</i><b>_</b><i>database</i> - Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>. + Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>. See <a href="postalias.1.html"><b>postalias</b>(1)</a> for details. <b>-O</b> <i>option=value</i> (ignored) - Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration + Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration parameter in <a href="postconf.5.html"><b>main.cf</b></a> instead. <b>-o7</b> (ignored) <b>-o8</b> (ignored) - To send 8-bit or binary content, use an appropriate MIME encap- + To send 8-bit or binary content, use an appropriate MIME encap- sulation and specify the appropriate <b>-B</b> command-line option. - <b>-oi</b> When reading a message from standard input, don't treat a line + <b>-oi</b> When reading a message from standard input, don't treat a line with only a <b>.</b> character as the end of input. <b>-om</b> (ignored) The sender is never eliminated from alias etc. expansions. <b>-o</b> <i>x value</i> (ignored) - Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame- + Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame- ter in <a href="postconf.5.html"><b>main.cf</b></a> instead. <b>-r</b> <i>sender</i> - Set the envelope sender address. This is the address where + Set the envelope sender address. This is the address where delivery problems are sent to. With Postfix versions before 2.1, - the <b>Errors-To:</b> message header overrides the error return + the <b>Errors-To:</b> message header overrides the error return address. <b>-R</b> <i>return</i> - Delivery status notification control. Specify "hdrs" to return - only the header when a message bounces, "full" to return a full + Delivery status notification control. Specify "hdrs" to return + only the header when a message bounces, "full" to return a full copy (the default behavior). The <b>-R</b> option specifies an upper bound; Postfix will return only - the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> + the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> setting. This option is ignored before Postfix version 2.10. - <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe- + <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe- cuting the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. - Warning: flushing undeliverable mail frequently will result in + Warning: flushing undeliverable mail frequently will result in poor delivery performance of all other mail. <b>-q</b><i>interval</i> (ignored) @@ -226,21 +229,21 @@ SENDMAIL(1) SENDMAIL(1) <b>-qI</b><i>queueid</i> Schedule immediate delivery of mail with the specified queue ID. - This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com- + This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com- mand, and is available with Postfix version 2.4 and later. <b>-qR</b><i>site</i> - Schedule immediate delivery of all mail that is queued for the - named <i>site</i>. This option accepts only <i>site</i> names that are eligi- - ble for the "fast flush" service, and is implemented by execut- + Schedule immediate delivery of all mail that is queued for the + named <i>site</i>. This option accepts only <i>site</i> names that are eligi- + ble for the "fast flush" service, and is implemented by execut- ing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information about the "fast flush" service. <b>-qS</b><i>site</i> - This command is not implemented. Use the slower "<b>sendmail -q</b>" + This command is not implemented. Use the slower "<b>sendmail -q</b>" command instead. - <b>-t</b> Extract recipients from message headers. These are added to any + <b>-t</b> Extract recipients from message headers. These are added to any recipients specified on the command line. With Postfix versions prior to 2.1, this option requires that no @@ -256,23 +259,23 @@ SENDMAIL(1) SENDMAIL(1) This feature is available in Postfix 2.3 and later. <b>-XV</b> (Postfix 2.2 and earlier: <b>-V</b>) - Variable Envelope Return Path. Given an envelope sender address - of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i> + Variable Envelope Return Path. Given an envelope sender address + of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i> receives mail with a personalized envelope sender address. - By default, the personalized envelope sender address is - <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac- - ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu- + By default, the personalized envelope sender address is + <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac- + ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu- ration parameter. <b>-XV</b><i>xy</i> (Postfix 2.2 and earlier: <b>-V</b><i>xy</i>) - As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters, + As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters, instead of the characters specified with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delim</a>-</b> <b><a href="postconf.5.html#default_verp_delimiters">iters</a></b> configuration parameter. <b>-v</b> Send an email report of the first delivery attempt (Postfix ver- - sions 2.1 and later). Mail delivery always happens in the back- - ground. When multiple <b>-v</b> options are given, enable verbose log- + sions 2.1 and later). Mail delivery always happens in the back- + ground. When multiple <b>-v</b> options are given, enable verbose log- ging for debugging purposes. <b>-X</b> <i>log</i><b>_</b><i>file</i> (ignored) @@ -280,12 +283,42 @@ SENDMAIL(1) SENDMAIL(1) configuration parameters instead. <b>SECURITY</b> - By design, this program is not set-user (or group) id. However, it must - handle data from untrusted, possibly remote, users. Thus, the usual - precautions need to be taken against malicious inputs. + By design, this program is not set-user (or group) id. It is prepared + to handle message content from untrusted, possibly remote, users. + + However, like most Postfix programs, this program does not enforce a + security policy on its command-line arguments. Instead, it relies on + the UNIX system to enforce access policies based on the effective user + and group IDs of the process. Concretely, this means that running Post- + fix commands as root (from sudo or equivalent) on behalf of a non-root + user is likely to create privilege escalation opportunities. + + If an application runs any Postfix programs on behalf of users that do + not have normal shell access to Postfix commands, then that application + MUST restrict user-specified command-line arguments to avoid privilege + escalation. + + <b>o</b> Filter all command-line arguments, for example arguments that + contain a pathname or that specify a database access method. + These pathname checks must reject user-controlled symlinks or + hardlinks to sensitive files, and must not be vulnerable to TOC- + TOU race attacks. + + <b>o</b> Disable command options processing for all command arguments + that contain user-specified data. For example, the Postfix <a href="sendmail.1.html"><b>send-</b></a> + <a href="sendmail.1.html"><b>mail</b>(1)</a> command line MUST be structured as follows: + + <b>/path/to/sendmail</b> <i>system-arguments</i> <b>--</b> <i>user-arguments</i> + + Here, the "<b>--</b>" disables command option processing for all + <i>user-arguments</i> that follow. + + Without the "<b>--</b>", a malicious user could enable Postfix <a href="sendmail.1.html"><b>send-</b></a> + <a href="sendmail.1.html"><b>mail</b>(1)</a> command options, by specifying an email address that + starts with "<b>-</b>". <b>DIAGNOSTICS</b> - Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard + Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard error stream. <b>ENVIRONMENT</b> @@ -299,12 +332,12 @@ SENDMAIL(1) SENDMAIL(1) Enable debugging with an external command, as specified with the <b><a href="postconf.5.html#debugger_command">debugger_command</a></b> configuration parameter. - <b>NAME</b> The sender full name. This is used only with messages that have + <b>NAME</b> The sender full name. This is used only with messages that have no <b>From:</b> message header. See also the <b>-F</b> option above. <b>CONFIGURATION PARAMETERS</b> - The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- - gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a> + The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro- + gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a> <a href="postconf.5.html"><b>conf</b>(5)</a> for more details including examples. <b>COMPATIBILITY CONTROLS</b> @@ -315,7 +348,7 @@ SENDMAIL(1) SENDMAIL(1) line endings from <CR><LF> into UNIX format (<LF>). <b>TROUBLE SHOOTING CONTROLS</b> - The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix + The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix system. <b><a href="postconf.5.html#debugger_command">debugger_command</a> (empty)</b> @@ -323,13 +356,15 @@ SENDMAIL(1) SENDMAIL(1) invoked with the -D option. <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> - The increment in verbose logging level when a remote client or - server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. + The increment in verbose logging level when a nexthop destina- + tion, remote client or server name or network address matches a + pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> - Optional list of remote client or server hostname or network - address patterns that cause the verbose logging level to - increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. + Optional list of nexthop destination, remote client or server + name or network address patterns that, if matched, cause the + verbose logging level to increase by the amount specified in + $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. <b>ACCESS CONTROLS</b> Available in Postfix version 2.2 and later: @@ -341,13 +376,13 @@ SENDMAIL(1) SENDMAIL(1) List of users who are authorized to view the queue. <b><a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> (<a href="DATABASE_README.html#types">static</a>:anyone)</b> - List of users who are authorized to submit mail with the <a href="sendmail.1.html"><b>send-</b></a> + List of users who are authorized to submit mail with the <a href="sendmail.1.html"><b>send-</b></a> <a href="sendmail.1.html"><b>mail</b>(1)</a> command (and with the privileged <a href="postdrop.1.html"><b>postdrop</b>(1)</a> helper com- mand). <b>RESOURCE AND RATE CONTROLS</b> <b><a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a> (50000)</b> - The maximal amount of original message text that is sent in a + The maximal amount of original message text that is sent in a non-delivery notification. <b><a href="postconf.5.html#fork_attempts">fork_attempts</a> (5)</b> @@ -361,11 +396,11 @@ SENDMAIL(1) SENDMAIL(1) in the primary message headers. <b><a href="postconf.5.html#queue_run_delay">queue_run_delay</a> (300s)</b> - The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager; + The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager; prior to Postfix 2.4 the default value was 1000s. <b>FAST FLUSH CONTROLS</b> - The <a href="ETRN_README.html">ETRN_README</a> file describes configuration and operation details for + The <a href="ETRN_README.html">ETRN_README</a> file describes configuration and operation details for the Postfix "fast flush" service. <b><a href="postconf.5.html#fast_flush_domains">fast_flush_domains</a> ($<a href="postconf.5.html#relay_domains">relay_domains</a>)</b> @@ -373,26 +408,26 @@ SENDMAIL(1) SENDMAIL(1) tion logfiles with mail that is queued to those destinations. <b>VERP CONTROLS</b> - The <a href="VERP_README.html">VERP_README</a> file describes configuration and operation details of + The <a href="VERP_README.html">VERP_README</a> file describes configuration and operation details of Postfix support for variable envelope return path addresses. <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a> (+=)</b> The two default VERP delimiter characters. <b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b> - The characters Postfix accepts as VERP delimiter characters on + The characters Postfix accepts as VERP delimiter characters on the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command line and in SMTP commands. <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#alias_database">alias_database</a> (see 'postconf -d' output)</b> - The alias databases for <a href="local.8.html"><b>local</b>(8)</a> delivery that are updated with + The alias databases for <a href="local.8.html"><b>local</b>(8)</a> delivery that are updated with "<b>newaliases</b>" or with "<b>sendmail -bi</b>". <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b> The location of all postfix administrative commands. <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_directory">daemon_directory</a> (see 'postconf -d' output)</b> @@ -403,46 +438,46 @@ SENDMAIL(1) SENDMAIL(1) and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands. <b><a href="postconf.5.html#delay_warning_time">delay_warning_time</a> (0h)</b> - The time after which the sender receives a copy of the message + The time after which the sender receives a copy of the message headers of mail that is still queued. <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b> - The list of environment parameters that a privileged Postfix - process will import from a non-Postfix parent process, or + The list of environment variables that a privileged Postfix + process will import from a non-Postfix parent process, or name=value environment overrides. <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b> - The UNIX system account that owns the Postfix queue and most + The UNIX system account that owns the Postfix queue and most Postfix daemon processes. <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b> The location of the Postfix top-level queue directory. <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> (empty)</b> - Don't rewrite message headers from remote clients at all when - this parameter is empty; otherwise, rewrite message headers and + Don't rewrite message headers from remote clients at all when + this parameter is empty; otherwise, rewrite message headers and append the specified domain name to incomplete addresses. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Postfix 3.2 and later: <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b> A list of non-default Postfix configuration directories that may - be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in - the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the + be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in + the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the MAIL_CONFIG environment parameter. <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b> - An optional list of non-default Postfix configuration directo- - ries; these directories belong to additional Postfix instances - that share the Postfix executable files and documentation with - the default Postfix instance, and that are started, stopped, + An optional list of non-default Postfix configuration directo- + ries; these directories belong to additional Postfix instances + that share the Postfix executable files and documentation with + the default Postfix instance, and that are started, stopped, etc., together with the default Postfix instance. <b>FILES</b> @@ -463,7 +498,7 @@ SENDMAIL(1) SENDMAIL(1) syslogd(8), system logging <b>README_FILES</b> - Use "<b>postconf <a href="postconf.5.html#readme_directory">readme_directory</a></b>" or "<b>postconf <a href="postconf.5.html#html_directory">html_directory</a></b>" to locate + Use "<b>postconf <a href="postconf.5.html#readme_directory">readme_directory</a></b>" or "<b>postconf <a href="postconf.5.html#html_directory">html_directory</a></b>" to locate this information. <a href="DEBUG_README.html">DEBUG_README</a>, Postfix debugging howto <a href="ETRN_README.html">ETRN_README</a>, Postfix ETRN howto diff --git a/external/ibm-public/postfix/dist/html/showq.8.html b/external/ibm-public/postfix/dist/html/showq.8.html index e95ce0f32da..46d4ca4ae07 100644 --- a/external/ibm-public/postfix/dist/html/showq.8.html +++ b/external/ibm-public/postfix/dist/html/showq.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - showq(8) </title> </head> <body> <pre> SHOWQ(8) SHOWQ(8) diff --git a/external/ibm-public/postfix/dist/html/smtp-sink.1.html b/external/ibm-public/postfix/dist/html/smtp-sink.1.html index 57161f8a73c..ed44dd4ba5c 100644 --- a/external/ibm-public/postfix/dist/html/smtp-sink.1.html +++ b/external/ibm-public/postfix/dist/html/smtp-sink.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - smtp-sink(1) </title> </head> <body> <pre> SMTP-SINK(1) SMTP-SINK(1) @@ -213,8 +213,8 @@ SMTP-SINK(1) SMTP-SINK(1) Listen on the UNIX-domain socket at <i>pathname</i>. <i>backlog</i> - The maximum length the queue of pending connections, as defined - by the <b>listen</b>(2) system call. + The maximum length of the queue of pending connections, as + defined by the <b>listen</b>(2) system call. <b>DUMP FILE FORMAT</b> Each dumped message contains a sequence of text lines, terminated with @@ -269,7 +269,7 @@ SMTP-SINK(1) SMTP-SINK(1) dom portion of the per-message capture file name. <i>time-stamp</i> - A time stamp as defined in <a href="http://tools.ietf.org/html/rfc2822">RFC 2822</a>. + A time stamp as defined in <a href="https://tools.ietf.org/html/rfc2822">RFC 2822</a>. <b>SEE ALSO</b> <a href="smtp-source.1.html">smtp-source(1)</a>, SMTP/LMTP message generator diff --git a/external/ibm-public/postfix/dist/html/smtp-source.1.html b/external/ibm-public/postfix/dist/html/smtp-source.1.html index b4ac6cd51d5..6ff6db35073 100644 --- a/external/ibm-public/postfix/dist/html/smtp-source.1.html +++ b/external/ibm-public/postfix/dist/html/smtp-source.1.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - smtp-source(1) </title> </head> <body> <pre> SMTP-SOURCE(1) SMTP-SOURCE(1) diff --git a/external/ibm-public/postfix/dist/html/smtp.8.html b/external/ibm-public/postfix/dist/html/smtp.8.html index a01589cc196..98d8879ceea 100644 --- a/external/ibm-public/postfix/dist/html/smtp.8.html +++ b/external/ibm-public/postfix/dist/html/smtp.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - smtp(8) </title> </head> <body> <pre> SMTP(8) SMTP(8) @@ -141,26 +141,26 @@ SMTP(8) SMTP(8) low privilege. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) - <a href="http://tools.ietf.org/html/rfc1651">RFC 1651</a> (SMTP service extensions) - <a href="http://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) - <a href="http://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message Size Declaration) - <a href="http://tools.ietf.org/html/rfc2033">RFC 2033</a> (LMTP protocol) - <a href="http://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Error Codes) - <a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a> (MIME: Format of Internet Message Bodies) - <a href="http://tools.ietf.org/html/rfc2046">RFC 2046</a> (MIME: Media Types) - <a href="http://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command) - <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining) - <a href="http://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) - <a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension) - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) - <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH command) - <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) - <a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc7672">RFC 7672</a> (SMTP security via opportunistic DANE TLS) + <a href="https://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc1651">RFC 1651</a> (SMTP service extensions) + <a href="https://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) + <a href="https://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message Size Declaration) + <a href="https://tools.ietf.org/html/rfc2033">RFC 2033</a> (LMTP protocol) + <a href="https://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Error Codes) + <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a> (MIME: Format of Internet Message Bodies) + <a href="https://tools.ietf.org/html/rfc2046">RFC 2046</a> (MIME: Media Types) + <a href="https://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command) + <a href="https://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining) + <a href="https://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) + <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) + <a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH command) + <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) + <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a> (SMTP security via opportunistic DANE TLS) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -231,7 +231,7 @@ SMTP(8) SMTP(8) <b><a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a> (yes)</b> Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO - commands as required by <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a>. + commands as required by <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>. <b><a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> (empty)</b> A mechanism to transform replies from remote SMTP servers one @@ -324,7 +324,7 @@ SMTP(8) SMTP(8) <b><a href="postconf.5.html#smtp_dns_resolver_options">smtp_dns_resolver_options</a> (empty)</b> DNS Resolver options for the Postfix SMTP client. - Available in Postfix version 2.9 and later: + Available in Postfix version 2.9 - 3.6: <b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b> Change the behavior of the smtp_*_timeout time limits, from a @@ -333,6 +333,8 @@ SMTP(8) SMTP(8) response line, SMTP message content line, or TLS protocol mes- sage). + Available in Postfix version 2.9 and later: + <b><a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a> (no)</b> Whether or not to append the "AUTH=<>" option to the MAIL FROM command in SASL-authenticated SMTP sessions. @@ -361,10 +363,38 @@ SMTP(8) SMTP(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> The email address form that will be used in non-debug logging (info, warning, etc.). + Available in Postfix 3.6 and later: + + <b><a href="postconf.5.html#dnssec_probe">dnssec_probe</a> (ns:.)</b> + The DNS query type (default: "ns") and DNS query name (default: + ".") that Postfix may use to determine whether DNSSEC validation + is available. + + <b><a href="postconf.5.html#known_tcp_ports">known_tcp_ports</a> (lmtp=24, smtp=25, smtps=submissions=465, submis-</b> + <b>sion=587)</b> + Optional setting that avoids lookups in the <b>services</b>(5) data- + base. + + Available in Postfix version 3.7 and later: + + <b><a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a> (no)</b> + Change the behavior of the smtp_*_timeout time limits, from a + time limit per plaintext or TLS read or write call, to a com- + bined time limit for sending a complete SMTP request and for + receiving a complete SMTP response. + + <b><a href="postconf.5.html#smtp_min_data_rate">smtp_min_data_rate</a> (500)</b> + The minimum plaintext data transfer rate in bytes/second for + DATA requests, when deadlines are enabled with + <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>. + + <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> + The format of the Postfix-generated <b>From:</b> header. + <b>MIME PROCESSING CONTROLS</b> Available in Postfix version 2.0 and later: @@ -508,9 +538,9 @@ SMTP(8) SMTP(8) policy by next-hop destination; when a non-empty value is speci- fied, this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter. - <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (!SSLv2, !SSLv3)</b> - List of SSL/TLS protocols that the Postfix SMTP client will use - with mandatory TLS encryption. + <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (see 'postconf -d' output)</b> + TLS protocols that the Postfix SMTP client will use with manda- + tory TLS encryption. <b><a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a> (9)</b> The verification depth for remote SMTP server certificates. @@ -567,15 +597,15 @@ SMTP(8) SMTP(8) for the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_secu</a>-</b> <b><a href="postconf.5.html#smtp_tls_security_level">rity_level</a></b> = fingerprint). - <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> (md5)</b> + <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> (see 'postconf -d' output)</b> The message digest algorithm used to construct remote SMTP server certificate fingerprints. Available in Postfix version 2.6 and later: - <b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (!SSLv2, !SSLv3)</b> - List of TLS protocols that the Postfix SMTP client will exclude - or include with opportunistic TLS encryption. + <b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (see postconf -d output)</b> + TLS protocols that the Postfix SMTP client will use with oppor- + tunistic TLS encryption. <b><a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> (medium)</b> The minimum TLS cipher grade that the Postfix SMTP client will @@ -605,10 +635,10 @@ SMTP(8) SMTP(8) Available in Postfix version 2.11-3.1: <b><a href="postconf.5.html#tls_dane_digest_agility">tls_dane_digest_agility</a> (on)</b> - Configure <a href="http://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility. + Configure <a href="https://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility. <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b> - Enable support for <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain + Enable support for <a href="https://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain digests of trust-anchors with certificate usage "2". Available in Postfix version 2.11 and later: @@ -632,7 +662,7 @@ SMTP(8) SMTP(8) Available in Postfix version 3.1 and later: - <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (dane)</b> + <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (see 'postconf -d' output)</b> The TLS policy for MX hosts with "secure" TLSA records when the nexthop destination security level is <b>dane</b>, but the MX record was found via an "insecure" MX lookup. @@ -771,7 +801,7 @@ SMTP(8) SMTP(8) Time limit for connection cache connect, send or receive opera- tions. - Available in Postfix version 2.9 and later: + Available in Postfix version 2.9 - 3.6: <b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b> Change the behavior of the smtp_*_timeout time limits, from a @@ -792,56 +822,71 @@ SMTP(8) SMTP(8) <b><a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> (no)</b> Try to make multiple deliveries per TLS-encrypted connection. + Available in Postfix version 3.7 and later: + + <b><a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a> (no)</b> + Change the behavior of the smtp_*_timeout time limits, from a + time limit per plaintext or TLS read or write call, to a com- + bined time limit for sending a complete SMTP request and for + receiving a complete SMTP response. + + <b><a href="postconf.5.html#smtp_min_data_rate">smtp_min_data_rate</a> (500)</b> + The minimum plaintext data transfer rate in bytes/second for + DATA requests, when deadlines are enabled with + <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>. + Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon: - <b>transport_destination_concurrency_limit ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b> + <b><a href="postconf.5.html#transport_destination_concurrency_limit">transport_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b> <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b> - A transport-specific override for the default_destination_con- - currency_limit parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> + A transport-specific override for the <a href="postconf.5.html#default_destination_concurrency_limit">default_destination_con</a>- + <a href="postconf.5.html#default_destination_concurrency_limit">currency_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery transport. - <b>transport_destination_recipient_limit ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b> + <b><a href="postconf.5.html#transport_destination_recipient_limit">transport_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b> <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b> A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>- - <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> + <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery transport. <b>SMTPUTF8 CONTROLS</b> Preliminary SMTPUTF8 support is introduced with Postfix 3.0. <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> - Enable preliminary SMTPUTF8 support for the protocols described - in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. + Enable preliminary SMTPUTF8 support for the protocols described + in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. <b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b> - Detect that a message requires SMTPUTF8 support for the speci- + Detect that a message requires SMTPUTF8 support for the speci- fied mail origin classes. Available in Postfix version 3.2 and later: <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b> - Enable 'transitional' compatibility between IDNA2003 and - IDNA2008, when converting UTF-8 domain names to/from the ASCII + Enable 'transitional' compatibility between IDNA2003 and + IDNA2008, when converting UTF-8 domain names to/from the ASCII form that is used for DNS lookups. <b>TROUBLE SHOOTING CONTROLS</b> <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> - The increment in verbose logging level when a remote client or - server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. + The increment in verbose logging level when a nexthop destina- + tion, remote client or server name or network address matches a + pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> - Optional list of remote client or server hostname or network - address patterns that cause the verbose logging level to - increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. + Optional list of nexthop destination, remote client or server + name or network address patterns that, if matched, cause the + verbose logging level to increase by the amount specified in + $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. <b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b> - The recipient of postmaster notifications about mail delivery + The recipient of postmaster notifications about mail delivery problems that are caused by policy, resource, software or proto- col errors. <b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b> - What categories of Postfix-generated mail are subject to - before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, + What categories of Postfix-generated mail are subject to + before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. <b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b> @@ -849,46 +894,46 @@ SMTP(8) SMTP(8) <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#best_mx_transport">best_mx_transport</a> (empty)</b> - Where the Postfix SMTP client should deliver mail when it + Where the Postfix SMTP client should deliver mail when it detects a "mail loops back to myself" error condition. <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b> - How much time a Postfix daemon process may take to handle a + How much time a Postfix daemon process may take to handle a request before it is terminated by a built-in watchdog timer. <b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b> - The maximal number of digits after the decimal point when log- + The maximal number of digits after the decimal point when log- ging sub-second delay values. <b><a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a> (no)</b> Disable DNS lookups in the Postfix SMTP and LMTP clients. <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b> - The network interface addresses that this mail system receives + The network interface addresses that this mail system receives mail on. - <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (all)</b> - The Internet protocols Postfix will attempt to use when making + <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (see 'postconf -d output')</b> + The Internet protocols Postfix will attempt to use when making or accepting connections. <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b> - The time limit for sending or receiving information over an + The time limit for sending or receiving information over an internal communication channel. <b><a href="postconf.5.html#lmtp_assume_final">lmtp_assume_final</a> (no)</b> - When a remote LMTP server announces no DSN support, assume that - the server performs final delivery, and send "delivered" deliv- + When a remote LMTP server announces no DSN support, assume that + the server performs final delivery, and send "delivered" deliv- ery status notifications instead of "relayed". <b><a href="postconf.5.html#lmtp_tcp_port">lmtp_tcp_port</a> (24)</b> The default TCP port that the Postfix LMTP client connects to. <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> - The maximum amount of time that an idle Postfix daemon process + The maximum amount of time that an idle Postfix daemon process waits for an incoming connection before terminating voluntarily. <b><a href="postconf.5.html#max_use">max_use</a> (100)</b> @@ -902,20 +947,20 @@ SMTP(8) SMTP(8) The process name of a Postfix command or daemon process. <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b> - The network interface addresses that this mail system receives + The network interface addresses that this mail system receives mail on by way of a proxy or network address translation unit. <b><a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> (any)</b> The address type ("ipv6", "ipv4" or "any") that the Postfix SMTP - client will try first, when a destination has IPv6 and IPv4 + client will try first, when a destination has IPv6 and IPv4 addresses with equal MX preference. <b><a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> (empty)</b> - An optional numerical network address that the Postfix SMTP + An optional numerical network address that the Postfix SMTP client should bind to when making an IPv4 connection. <b><a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> (empty)</b> - An optional numerical network address that the Postfix SMTP + An optional numerical network address that the Postfix SMTP client should bind to when making an IPv6 connection. <b><a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> @@ -935,7 +980,7 @@ SMTP(8) SMTP(8) The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Available with Postfix 2.2 and earlier: @@ -953,7 +998,7 @@ SMTP(8) SMTP(8) Available with Postfix 3.0 and later: <b><a href="postconf.5.html#smtp_address_verify_target">smtp_address_verify_target</a> (rcpt)</b> - In the context of email address verification, the SMTP protocol + In the context of email address verification, the SMTP protocol stage that determines whether an email address is deliverable. Available with Postfix 3.1 and later: @@ -972,6 +1017,12 @@ SMTP(8) SMTP(8) <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. + Available in Postfix 3.7 and later: + + <b><a href="postconf.5.html#smtp_bind_address_enforce">smtp_bind_address_enforce</a> (no)</b> + Defer delivery when the Postfix SMTP client cannot apply the + <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> or <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> setting. + <b>SEE ALSO</b> <a href="generic.5.html">generic(5)</a>, output address rewriting <a href="header_checks.5.html">header_checks(5)</a>, message header content inspection diff --git a/external/ibm-public/postfix/dist/html/smtpd.8.html b/external/ibm-public/postfix/dist/html/smtpd.8.html index b81b864cdf6..3e47a0eafd3 100644 --- a/external/ibm-public/postfix/dist/html/smtpd.8.html +++ b/external/ibm-public/postfix/dist/html/smtpd.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - smtpd(8) </title> </head> <body> <pre> SMTPD(8) SMTPD(8) @@ -40,27 +40,27 @@ SMTPD(8) SMTPD(8) chrooted at fixed low privilege. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc1123">RFC 1123</a> (Host requirements) - <a href="http://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) - <a href="http://tools.ietf.org/html/rfc1869">RFC 1869</a> (SMTP service extensions) - <a href="http://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message size declaration) - <a href="http://tools.ietf.org/html/rfc1985">RFC 1985</a> (ETRN command) - <a href="http://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP enhanced status codes) - <a href="http://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command) - <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP pipelining) - <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> (CHUNKING without BINARYMIME) - <a href="http://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) - <a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN extension) - <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) - <a href="http://tools.ietf.org/html/rfc3848">RFC 3848</a> (ESMTP transmission types) - <a href="http://tools.ietf.org/html/rfc4409">RFC 4409</a> (Message submission) - <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH command) - <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol) - <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) - <a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc7505">RFC 7505</a> ("Null MX" No Service Resource Record) + <a href="https://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc1123">RFC 1123</a> (Host requirements) + <a href="https://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) + <a href="https://tools.ietf.org/html/rfc1869">RFC 1869</a> (SMTP service extensions) + <a href="https://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message size declaration) + <a href="https://tools.ietf.org/html/rfc1985">RFC 1985</a> (ETRN command) + <a href="https://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP enhanced status codes) + <a href="https://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command) + <a href="https://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP pipelining) + <a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a> (CHUNKING without BINARYMIME) + <a href="https://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) + <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN extension) + <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) + <a href="https://tools.ietf.org/html/rfc3848">RFC 3848</a> (ESMTP transmission types) + <a href="https://tools.ietf.org/html/rfc4409">RFC 4409</a> (Message submission) + <a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH command) + <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol) + <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) + <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc7505">RFC 7505</a> ("Null MX" No Service Resource Record) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -84,7 +84,7 @@ SMTPD(8) SMTPD(8) <b><a href="postconf.5.html#broken_sasl_auth_clients">broken_sasl_auth_clients</a> (no)</b> Enable interoperability with remote SMTP clients that implement - an obsolete version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>). + an obsolete version of the AUTH command (<a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>). <b><a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a> (no)</b> Disable the SMTP VRFY command. @@ -97,7 +97,7 @@ SMTPD(8) SMTPD(8) <b><a href="postconf.5.html#strict_rfc821_envelopes">strict_rfc821_envelopes</a> (no)</b> Require that addresses received in SMTP MAIL FROM and RCPT TO commands are enclosed with <>, and that those addresses do not - contain <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> style comments or phrases. + contain <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> style comments or phrases. Available in Postfix version 2.1 and later: @@ -145,7 +145,7 @@ SMTPD(8) SMTPD(8) <b><a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> (empty)</b> A mechanism to transform commands from remote SMTP clients. - Available in Postfix version 2.9 and later: + Available in Postfix version 2.9 - 3.6: <b><a href="postconf.5.html#smtpd_per_record_deadline">smtpd_per_record_deadline</a> (normal: no, overload: yes)</b> Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>- @@ -159,6 +159,30 @@ SMTPD(8) SMTPD(8) <b><a href="postconf.5.html#smtpd_dns_reply_filter">smtpd_dns_reply_filter</a> (empty)</b> Optional filter for Postfix SMTP server DNS lookup results. + Available in Postfix version 3.6 and later: + + <b><a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a> (see 'postconf -d' output)</b> + Evaluate <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> before <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipi</a>- + <a href="postconf.5.html#smtpd_recipient_restrictions">ent_restrictions</a>. + + <b><a href="postconf.5.html#known_tcp_ports">known_tcp_ports</a> (lmtp=24, smtp=25, smtps=submissions=465, submis-</b> + <b>sion=587)</b> + Optional setting that avoids lookups in the <b>services</b>(5) data- + base. + + Available in Postfix version 3.7 and later: + + <b><a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a> (normal: no, overload: yes)</b> + Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>- + <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit per plaintext or TLS + read or write call, to a combined time limit for receiving a + complete SMTP request and for sending a complete SMTP response. + + <b><a href="postconf.5.html#smtpd_min_data_rate">smtpd_min_data_rate</a> (500)</b> + The minimum plaintext data transfer rate in bytes/second for + DATA and BDAT requests, when deadlines are enabled with + <a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a>. + <b>ADDRESS REWRITING CONTROLS</b> See the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document for a detailed discussion of Postfix address rewriting. @@ -326,14 +350,14 @@ SMTPD(8) SMTPD(8) ture. <b>SASL AUTHENTICATION CONTROLS</b> - Postfix SASL support (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>) can be used to authenticate remote SMTP + Postfix SASL support (<a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>) can be used to authenticate remote SMTP clients to the Postfix SMTP server, and to authenticate the Postfix SMTP client to a remote SMTP server. See the <a href="SASL_README.html">SASL_README</a> document for details. <b><a href="postconf.5.html#broken_sasl_auth_clients">broken_sasl_auth_clients</a> (no)</b> Enable interoperability with remote SMTP clients that implement - an obsolete version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>). + an obsolete version of the AUTH command (<a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>). <b><a href="postconf.5.html#smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a> (no)</b> Enable SASL authentication in the Postfix SMTP server. @@ -386,7 +410,7 @@ SMTPD(8) SMTPD(8) Available in Postfix version 2.11 and later: - <b>smtpd_sasl_service (smtp)</b> + <b><a href="postconf.5.html#smtpd_sasl_service">smtpd_sasl_service</a> (smtp)</b> The service name that is passed to the SASL plug-in that is selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b> and <b><a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a></b>. @@ -396,17 +420,23 @@ SMTPD(8) SMTPD(8) The maximum length of a SASL client's response to a server chal- lenge. + Available in Postfix 3.6 and later: + + <b><a href="postconf.5.html#smtpd_sasl_mechanism_filter">smtpd_sasl_mechanism_filter</a> (!external, <a href="DATABASE_README.html#types">static</a>:rest)</b> + If non-empty, a filter for the SASL mechanism names that the + Postfix SMTP server will announce in the EHLO response. + <b>STARTTLS SUPPORT CONTROLS</b> - Detailed information about STARTTLS configuration may be found in the + Detailed information about STARTTLS configuration may be found in the <a href="TLS_README.html">TLS_README</a> document. <b><a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> (empty)</b> - The SMTP TLS security level for the Postfix SMTP server; when a + The SMTP TLS security level for the Postfix SMTP server; when a non-empty value is specified, this overrides the obsolete param- eters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. <b><a href="postconf.5.html#smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a> ($<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b> - The SASL authentication security options that the Postfix SMTP + The SASL authentication security options that the Postfix SMTP server uses for TLS encrypted SMTP sessions. <b><a href="postconf.5.html#smtpd_starttls_timeout">smtpd_starttls_timeout</a> (see 'postconf -d' output)</b> @@ -414,25 +444,25 @@ SMTPD(8) SMTPD(8) during TLS startup and shutdown handshake procedures. <b><a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> (empty)</b> - A file containing (PEM format) CA certificates of root CAs + A file containing (PEM format) CA certificates of root CAs trusted to sign either remote SMTP client certificates or inter- mediate CA certificates. <b><a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> (empty)</b> - A directory containing (PEM format) CA certificates of root CAs + A directory containing (PEM format) CA certificates of root CAs trusted to sign either remote SMTP client certificates or inter- mediate CA certificates. <b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b> - Force the Postfix SMTP server to issue a TLS session id, even - when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_ses</a>- + Force the Postfix SMTP server to issue a TLS session id, even + when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_ses</a>- <a href="postconf.5.html#smtpd_tls_session_cache_database">sion_cache_database</a> is empty). <b><a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> (no)</b> Ask a remote SMTP client for a client certificate. <b><a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> (no)</b> - When TLS encryption is optional in the Postfix SMTP server, do + When TLS encryption is optional in the Postfix SMTP server, do not announce or accept SASL authentication over unencrypted con- nections. @@ -443,18 +473,18 @@ SMTPD(8) SMTPD(8) File with the Postfix SMTP server RSA certificate in PEM format. <b><a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> (empty)</b> - List of ciphers or cipher types to exclude from the SMTP server + List of ciphers or cipher types to exclude from the SMTP server cipher list at all TLS security levels. <b><a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> (empty)</b> File with the Postfix SMTP server DSA certificate in PEM format. <b><a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> (empty)</b> - File with DH parameters that the Postfix SMTP server should use + File with DH parameters that the Postfix SMTP server should use with non-export EDH ciphers. <b><a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> (empty)</b> - File with DH parameters that the Postfix SMTP server should use + File with DH parameters that the Postfix SMTP server should use with export-grade EDH ciphers. <b><a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a> ($<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b> @@ -467,35 +497,35 @@ SMTPD(8) SMTPD(8) Enable additional Postfix SMTP server logging of TLS activity. <b><a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> (medium)</b> - The minimum TLS cipher grade that the Postfix SMTP server will + The minimum TLS cipher grade that the Postfix SMTP server will use with mandatory TLS encryption. <b><a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> (empty)</b> - Additional list of ciphers or cipher types to exclude from the - Postfix SMTP server cipher list at mandatory TLS security lev- + Additional list of ciphers or cipher types to exclude from the + Postfix SMTP server cipher list at mandatory TLS security lev- els. - <b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (!SSLv2, !SSLv3)</b> - The SSL/TLS protocols accepted by the Postfix SMTP server with - mandatory TLS encryption. + <b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (see 'postconf -d' output)</b> + TLS protocols accepted by the Postfix SMTP server with mandatory + TLS encryption. <b><a href="postconf.5.html#smtpd_tls_received_header">smtpd_tls_received_header</a> (no)</b> Request that the Postfix SMTP server produces Received: message - headers that include information about the protocol and cipher - used, as well as the remote SMTP client CommonName and client + headers that include information about the protocol and cipher + used, as well as the remote SMTP client CommonName and client certificate issuer CommonName. <b><a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a> (no)</b> - With mandatory TLS encryption, require a trusted remote SMTP + With mandatory TLS encryption, require a trusted remote SMTP client certificate in order to allow TLS connections to proceed. <b><a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> (no)</b> - Run the Postfix SMTP server in the non-standard "wrapper" mode, + Run the Postfix SMTP server in the non-standard "wrapper" mode, instead of using the STARTTLS command. <b><a href="postconf.5.html#tls_daemon_random_bytes">tls_daemon_random_bytes</a> (32)</b> - The number of pseudo-random bytes that an <a href="smtp.8.html"><b>smtp</b>(8)</a> or <a href="smtpd.8.html"><b>smtpd</b>(8)</a> - process requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed its + The number of pseudo-random bytes that an <a href="smtp.8.html"><b>smtp</b>(8)</a> or <a href="smtpd.8.html"><b>smtpd</b>(8)</a> + process requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed its internal pseudo random number generator (PRNG). <b><a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> (see 'postconf -d' output)</b> @@ -511,41 +541,41 @@ SMTPD(8) SMTPD(8) The OpenSSL cipherlist for "export" or higher grade ciphers. <b><a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> (eNULL:!aNULL)</b> - The OpenSSL cipherlist for "NULL" grade ciphers that provide + The OpenSSL cipherlist for "NULL" grade ciphers that provide authentication without encryption. Available in Postfix version 2.5 and later: - <b><a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> (md5)</b> - The message digest algorithm to construct remote SMTP - client-certificate fingerprints or public key fingerprints - (Postfix 2.9 and later) for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b>per-</b> + <b><a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> (see 'postconf -d' output)</b> + The message digest algorithm to construct remote SMTP + client-certificate fingerprints or public key fingerprints + (Postfix 2.9 and later) for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b>per-</b> <b>mit_tls_clientcerts</b>. Available in Postfix version 2.6 and later: - <b><a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> (!SSLv2, !SSLv3)</b> - List of TLS protocols that the Postfix SMTP server will exclude - or include with opportunistic TLS encryption. + <b><a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> (see postconf -d output)</b> + TLS protocols accepted by the Postfix SMTP server with oppor- + tunistic TLS encryption. <b><a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> (medium)</b> - The minimum TLS cipher grade that the Postfix SMTP server will + The minimum TLS cipher grade that the Postfix SMTP server will use with opportunistic TLS encryption. <b><a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> (empty)</b> - File with the Postfix SMTP server ECDSA certificate in PEM for- + File with the Postfix SMTP server ECDSA certificate in PEM for- mat. <b><a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a> ($<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b> - File with the Postfix SMTP server ECDSA private key in PEM for- + File with the Postfix SMTP server ECDSA private key in PEM for- mat. <b><a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> (see 'postconf -d' output)</b> - The Postfix SMTP server security grade for ephemeral ellip- + The Postfix SMTP server security grade for ephemeral ellip- tic-curve Diffie-Hellman (EECDH) key exchange. <b><a href="postconf.5.html#tls_eecdh_strong_curve">tls_eecdh_strong_curve</a> (prime256v1)</b> - The elliptic curve used by the Postfix SMTP server for sensibly + The elliptic curve used by the Postfix SMTP server for sensibly strong ephemeral ECDH key exchange. <b><a href="postconf.5.html#tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a> (secp384r1)</b> @@ -556,7 +586,7 @@ SMTPD(8) SMTPD(8) <b><a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> (no)</b> With SSLv3 and later, use the Postfix SMTP server's cipher pref- - erence order instead of the remote client's cipher preference + erence order instead of the remote client's cipher preference order. <b><a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> (see 'postconf -d' output)</b> @@ -569,9 +599,9 @@ SMTPD(8) SMTPD(8) Available in Postfix version 3.0 and later: - <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a> (Postfix</b> ><b>= 3.0: aes-256-cbc, Postfix</b> < <b>3.0:</b> + <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a> (Postfix</b> ><b>= 3.0: aes-256-cbc, Postfix</b> < <b>3.0:</b> <b>aes-128-cbc)</b> - Algorithm used to encrypt <a href="http://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets. + Algorithm used to encrypt <a href="https://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets. Available in Postfix version 3.2 and later: @@ -582,33 +612,33 @@ SMTPD(8) SMTPD(8) Available in Postfix version 3.4 and later: <b><a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a> (empty)</b> - List of one or more PEM files, each holding one or more private + List of one or more PEM files, each holding one or more private keys directly followed by a corresponding certificate chain. <b><a href="postconf.5.html#tls_server_sni_maps">tls_server_sni_maps</a> (empty)</b> - Optional lookup tables that map names received from remote SMTP - clients via the TLS Server Name Indication (SNI) extension to + Optional lookup tables that map names received from remote SMTP + clients via the TLS Server Name Indication (SNI) extension to the appropriate keys and certificate chains. Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later: <b><a href="postconf.5.html#tls_fast_shutdown_enable">tls_fast_shutdown_enable</a> (yes)</b> - A workaround for implementations that hang Postfix while shut- + A workaround for implementations that hang Postfix while shut- ting down a TLS session, until Postfix times out. Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> - The email address form that will be used in non-debug logging + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> + The email address form that will be used in non-debug logging (info, warning, etc.). <b>OBSOLETE STARTTLS CONTROLS</b> - The following configuration parameters exist for compatibility with - Postfix versions before 2.3. Support for these will be removed in a + The following configuration parameters exist for compatibility with + Postfix versions before 2.3. Support for these will be removed in a future release. <b><a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> (no)</b> - Opportunistic TLS: announce STARTTLS support to remote SMTP + Opportunistic TLS: announce STARTTLS support to remote SMTP clients, but do not require that clients use TLS encryption. <b><a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> (no)</b> @@ -616,92 +646,94 @@ SMTPD(8) SMTPD(8) and require that clients use TLS encryption. <b><a href="postconf.5.html#smtpd_tls_cipherlist">smtpd_tls_cipherlist</a> (empty)</b> - Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS + Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS cipher list. <b>SMTPUTF8 CONTROLS</b> Preliminary SMTPUTF8 support is introduced with Postfix 3.0. <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> - Enable preliminary SMTPUTF8 support for the protocols described - in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. + Enable preliminary SMTPUTF8 support for the protocols described + in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533. <b><a href="postconf.5.html#strict_smtputf8">strict_smtputf8</a> (no)</b> Enable stricter enforcement of the SMTPUTF8 protocol. <b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b> - Detect that a message requires SMTPUTF8 support for the speci- + Detect that a message requires SMTPUTF8 support for the speci- fied mail origin classes. Available in Postfix version 3.2 and later: <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b> - Enable 'transitional' compatibility between IDNA2003 and - IDNA2008, when converting UTF-8 domain names to/from the ASCII + Enable 'transitional' compatibility between IDNA2003 and + IDNA2008, when converting UTF-8 domain names to/from the ASCII form that is used for DNS lookups. <b>VERP SUPPORT CONTROLS</b> - With VERP style delivery, each recipient of a message receives a cus- - tomized copy of the message with his/her own recipient address encoded + With VERP style delivery, each recipient of a message receives a cus- + tomized copy of the message with his/her own recipient address encoded in the envelope sender address. The <a href="VERP_README.html">VERP_README</a> file describes config- - uration and operation details of Postfix support for variable envelope - return path addresses. VERP style delivery is requested with the SMTP - XVERP command or with the "sendmail -V" command-line option and is + uration and operation details of Postfix support for variable envelope + return path addresses. VERP style delivery is requested with the SMTP + XVERP command or with the "sendmail -V" command-line option and is available in Postfix version 1.1 and later. <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a> (+=)</b> The two default VERP delimiter characters. <b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b> - The characters Postfix accepts as VERP delimiter characters on + The characters Postfix accepts as VERP delimiter characters on the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command line and in SMTP commands. Available in Postfix version 1.1 and 2.0: <b><a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b> - What remote SMTP clients are allowed to specify the XVERP com- + What remote SMTP clients are allowed to specify the XVERP com- mand. Available in Postfix version 2.1 and later: <b><a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> ($<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b> - What remote SMTP clients are allowed to specify the XVERP com- + What remote SMTP clients are allowed to specify the XVERP com- mand. <b>TROUBLE SHOOTING CONTROLS</b> - The <a href="DEBUG_README.html">DEBUG_README</a> document describes how to debug parts of the Postfix - mail system. The methods vary from making the software log a lot of + The <a href="DEBUG_README.html">DEBUG_README</a> document describes how to debug parts of the Postfix + mail system. The methods vary from making the software log a lot of detail, to running some daemon processes under control of a call tracer or debugger. <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> - The increment in verbose logging level when a remote client or - server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. + The increment in verbose logging level when a nexthop destina- + tion, remote client or server name or network address matches a + pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> - Optional list of remote client or server hostname or network - address patterns that cause the verbose logging level to - increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. + Optional list of nexthop destination, remote client or server + name or network address patterns that, if matched, cause the + verbose logging level to increase by the amount specified in + $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. <b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b> - The recipient of postmaster notifications about mail delivery + The recipient of postmaster notifications about mail delivery problems that are caused by policy, resource, software or proto- col errors. <b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b> - What categories of Postfix-generated mail are subject to - before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, + What categories of Postfix-generated mail are subject to + before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. <b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b> The list of error classes that are reported to the postmaster. <b><a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> (empty)</b> - Optional information that is appended after each Postfix SMTP + Optional information that is appended after each Postfix SMTP server 4XX or 5XX response. <b><a href="postconf.5.html#soft_bounce">soft_bounce</a> (no)</b> - Safety net to keep mail queued that would otherwise be returned + Safety net to keep mail queued that would otherwise be returned to the sender. Available in Postfix version 2.1 and later: @@ -712,109 +744,109 @@ SMTPD(8) SMTPD(8) Available in Postfix version 2.10 and later: <b><a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> (empty)</b> - Enable logging of the named "permit" actions in SMTP server - access lists (by default, the SMTP server logs "reject" actions + Enable logging of the named "permit" actions in SMTP server + access lists (by default, the SMTP server logs "reject" actions but not "permit" actions). <b>KNOWN VERSUS UNKNOWN RECIPIENT CONTROLS</b> - As of Postfix version 2.0, the SMTP server rejects mail for unknown + As of Postfix version 2.0, the SMTP server rejects mail for unknown recipients. This prevents the mail queue from clogging up with undeliv- - erable MAILER-DAEMON messages. Additional information on this topic is + erable MAILER-DAEMON messages. Additional information on this topic is in the <a href="LOCAL_RECIPIENT_README.html">LOCAL_RECIPIENT_README</a> and <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> documents. <b><a href="postconf.5.html#show_user_unknown_table_name">show_user_unknown_table_name</a> (yes)</b> - Display the name of the recipient table in the "User unknown" + Display the name of the recipient table in the "User unknown" responses. <b><a href="postconf.5.html#canonical_maps">canonical_maps</a> (empty)</b> - Optional address mapping lookup tables for message headers and + Optional address mapping lookup tables for message headers and envelopes. <b><a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> (empty)</b> - Optional address mapping lookup tables for envelope and header + Optional address mapping lookup tables for envelope and header recipient addresses. <b><a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> (empty)</b> - Optional address mapping lookup tables for envelope and header + Optional address mapping lookup tables for envelope and header sender addresses. Parameters concerning known/unknown local recipients: <b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b> - The list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a> + The list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a> mail delivery transport. <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b> - The network interface addresses that this mail system receives + The network interface addresses that this mail system receives mail on. <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b> - The network interface addresses that this mail system receives + The network interface addresses that this mail system receives mail on by way of a proxy or network address translation unit. - <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (all)</b> - The Internet protocols Postfix will attempt to use when making + <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (see 'postconf -d output')</b> + The Internet protocols Postfix will attempt to use when making or accepting connections. <b><a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> (<a href="proxymap.8.html">proxy</a>:unix:passwd.byname $<a href="postconf.5.html#alias_maps">alias_maps</a>)</b> Lookup tables with all names or addresses of local recipients: a - recipient address is local when its domain matches $<a href="postconf.5.html#mydestination">mydestina</a>- + recipient address is local when its domain matches $<a href="postconf.5.html#mydestination">mydestina</a>- <a href="postconf.5.html#mydestination">tion</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. <b><a href="postconf.5.html#unknown_local_recipient_reject_code">unknown_local_recipient_reject_code</a> (550)</b> The numerical Postfix SMTP server response code when a recipient - address is local, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> specifies a list of + address is local, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> specifies a list of lookup tables that does not match the recipient. Parameters concerning known/unknown recipients of relay destinations: <b><a href="postconf.5.html#relay_domains">relay_domains</a> (Postfix</b> ><b>= 3.0: empty, Postfix</b> < <b>3.0: $<a href="postconf.5.html#mydestination">mydestination</a>)</b> - What destination domains (and subdomains thereof) this system + What destination domains (and subdomains thereof) this system will relay mail to. <b><a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> (empty)</b> - Optional lookup tables with all valid addresses in the domains + Optional lookup tables with all valid addresses in the domains that match $<a href="postconf.5.html#relay_domains">relay_domains</a>. <b><a href="postconf.5.html#unknown_relay_recipient_reject_code">unknown_relay_recipient_reject_code</a> (550)</b> - The numerical Postfix SMTP server reply code when a recipient - address matches $<a href="postconf.5.html#relay_domains">relay_domains</a>, and <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> speci- - fies a list of lookup tables that does not match the recipient + The numerical Postfix SMTP server reply code when a recipient + address matches $<a href="postconf.5.html#relay_domains">relay_domains</a>, and <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> speci- + fies a list of lookup tables that does not match the recipient address. - Parameters concerning known/unknown recipients in virtual alias + Parameters concerning known/unknown recipients in virtual alias domains: <b><a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> ($<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>)</b> - Postfix is final destination for the specified list of virtual - alias domains, that is, domains for which all addresses are + Postfix is final destination for the specified list of virtual + alias domains, that is, domains for which all addresses are aliased to addresses in other local or remote domains. <b><a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> ($<a href="postconf.5.html#virtual_maps">virtual_maps</a>)</b> - Optional lookup tables that alias specific mail addresses or + Optional lookup tables that alias specific mail addresses or domains to other local or remote address. <b><a href="postconf.5.html#unknown_virtual_alias_reject_code">unknown_virtual_alias_reject_code</a> (550)</b> - The Postfix SMTP server reply code when a recipient address - matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> speci- - fies a list of lookup tables that does not match the recipient + The Postfix SMTP server reply code when a recipient address + matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> speci- + fies a list of lookup tables that does not match the recipient address. Parameters concerning known/unknown recipients in virtual mailbox domains: <b><a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> ($<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>)</b> - Postfix is final destination for the specified list of domains; - mail is delivered via the $<a href="postconf.5.html#virtual_transport">virtual_transport</a> mail delivery + Postfix is final destination for the specified list of domains; + mail is delivered via the $<a href="postconf.5.html#virtual_transport">virtual_transport</a> mail delivery transport. <b><a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> (empty)</b> - Optional lookup tables with all valid addresses in the domains + Optional lookup tables with all valid addresses in the domains that match $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>. <b><a href="postconf.5.html#unknown_virtual_mailbox_reject_code">unknown_virtual_mailbox_reject_code</a> (550)</b> - The Postfix SMTP server reply code when a recipient address - matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> + The Postfix SMTP server reply code when a recipient address + matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> specifies a list of lookup tables that does not match the recip- ient address. @@ -823,7 +855,7 @@ SMTPD(8) SMTPD(8) control client request rates. <b><a href="postconf.5.html#line_length_limit">line_length_limit</a> (2048)</b> - Upon input, long lines are chopped up into pieces of at most + Upon input, long lines are chopped up into pieces of at most this length; upon delivery, long lines are reconstructed. <b><a href="postconf.5.html#queue_minfree">queue_minfree</a> (0)</b> @@ -831,127 +863,147 @@ SMTPD(8) SMTPD(8) tem that is needed to receive mail. <b><a href="postconf.5.html#message_size_limit">message_size_limit</a> (10240000)</b> - The maximal size in bytes of a message, including envelope + The maximal size in bytes of a message, including envelope information. <b><a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a> (1000)</b> - The maximal number of recipients that the Postfix SMTP server + The maximal number of recipients that the Postfix SMTP server accepts per message delivery request. <b><a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> (normal: 300s, overload: 10s)</b> - The time limit for sending a Postfix SMTP server response and - for receiving a remote SMTP client request. + When the Postfix SMTP server wants to send an SMTP server + response, how long the Postfix SMTP server will wait for an + underlying network write operation to complete; and when the + Postfix SMTP server Postfix wants to receive an SMTP client + request, how long the Postfix SMTP server will wait for an + underlying network read operation to complete. <b><a href="postconf.5.html#smtpd_history_flush_threshold">smtpd_history_flush_threshold</a> (100)</b> - The maximal number of lines in the Postfix SMTP server command - history before it is flushed upon receipt of EHLO, RSET, or end + The maximal number of lines in the Postfix SMTP server command + history before it is flushed upon receipt of EHLO, RSET, or end of DATA. Available in Postfix version 2.3 and later: <b><a href="postconf.5.html#smtpd_peername_lookup">smtpd_peername_lookup</a> (yes)</b> - Attempt to look up the remote SMTP client hostname, and verify + Attempt to look up the remote SMTP client hostname, and verify that the name matches the client IP address. The per SMTP client connection count and request rate limits are imple- - mented in co-operation with the <a href="anvil.8.html"><b>anvil</b>(8)</a> service, and are available in + mented in co-operation with the <a href="anvil.8.html"><b>anvil</b>(8)</a> service, and are available in Postfix version 2.2 and later. <b><a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a> (50)</b> - How many simultaneous connections any client is allowed to make + How many simultaneous connections any client is allowed to make to this service. <b><a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> (0)</b> - The maximal number of connection attempts any client is allowed + The maximal number of connection attempts any client is allowed to make to this service per time unit. <b><a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> (0)</b> - The maximal number of message delivery requests that any client - is allowed to make to this service per time unit, regardless of + The maximal number of message delivery requests that any client + is allowed to make to this service per time unit, regardless of whether or not Postfix actually accepts those messages. <b><a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> (0)</b> - The maximal number of recipient addresses that any client is - allowed to send to this service per time unit, regardless of + The maximal number of recipient addresses that any client is + allowed to send to this service per time unit, regardless of whether or not Postfix actually accepts those recipients. <b><a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b> - Clients that are excluded from smtpd_client_*_count/rate_limit + Clients that are excluded from smtpd_client_*_count/rate_limit restrictions. Available in Postfix version 2.3 and later: <b><a href="postconf.5.html#smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a> (0)</b> - The maximal number of new (i.e., uncached) TLS sessions that a + The maximal number of new (i.e., uncached) TLS sessions that a remote SMTP client is allowed to negotiate with this service per time unit. - Available in Postfix version 2.9 and later: + Available in Postfix version 2.9 - 3.6: <b><a href="postconf.5.html#smtpd_per_record_deadline">smtpd_per_record_deadline</a> (normal: no, overload: yes)</b> Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>- - <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit per read or write - system call, to a time limit to send or receive a complete - record (an SMTP command line, SMTP response line, SMTP message + <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit per read or write + system call, to a time limit to send or receive a complete + record (an SMTP command line, SMTP response line, SMTP message content line, or TLS protocol message). Available in Postfix version 3.1 and later: <b><a href="postconf.5.html#smtpd_client_auth_rate_limit">smtpd_client_auth_rate_limit</a> (0)</b> - The maximal number of AUTH commands that any client is allowed - to send to this service per time unit, regardless of whether or + The maximal number of AUTH commands that any client is allowed + to send to this service per time unit, regardless of whether or not Postfix actually accepts those commands. + Available in Postfix version 3.7 and later: + + <b><a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a> (normal: no, overload: yes)</b> + Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>- + <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit per plaintext or TLS + read or write call, to a combined time limit for receiving a + complete SMTP request and for sending a complete SMTP response. + + <b><a href="postconf.5.html#smtpd_min_data_rate">smtpd_min_data_rate</a> (500)</b> + The minimum plaintext data transfer rate in bytes/second for + DATA and BDAT requests, when deadlines are enabled with + <a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a>. + + <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> + The format of the Postfix-generated <b>From:</b> header. + <b>TARPIT CONTROLS</b> - When a remote SMTP client makes errors, the Postfix SMTP server can - insert delays before responding. This can help to slow down run-away - software. The behavior is controlled by an error counter that counts + When a remote SMTP client makes errors, the Postfix SMTP server can + insert delays before responding. This can help to slow down run-away + software. The behavior is controlled by an error counter that counts the number of errors within an SMTP session that a client makes without delivering mail. <b><a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> (1s)</b> - With Postfix version 2.1 and later: the SMTP server response - delay after a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> - errors, and fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without + With Postfix version 2.1 and later: the SMTP server response + delay after a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> + errors, and fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without delivering mail. <b><a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> (10)</b> - The number of errors a remote SMTP client is allowed to make - without delivering mail before the Postfix SMTP server slows + The number of errors a remote SMTP client is allowed to make + without delivering mail before the Postfix SMTP server slows down all its responses. <b><a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> (normal: 20, overload: 1)</b> - The maximal number of errors a remote SMTP client is allowed to + The maximal number of errors a remote SMTP client is allowed to make without delivering mail. <b><a href="postconf.5.html#smtpd_junk_command_limit">smtpd_junk_command_limit</a> (normal: 100, overload: 1)</b> - The number of junk commands (NOOP, VRFY, ETRN or RSET) that a - remote SMTP client can send before the Postfix SMTP server + The number of junk commands (NOOP, VRFY, ETRN or RSET) that a + remote SMTP client can send before the Postfix SMTP server starts to increment the error counter with each junk command. Available in Postfix version 2.1 and later: <b><a href="postconf.5.html#smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a> (1000)</b> - The number of recipients that a remote SMTP client can send in + The number of recipients that a remote SMTP client can send in excess of the limit specified with $<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>, - before the Postfix SMTP server increments the per-session error + before the Postfix SMTP server increments the per-session error count for each excess recipient. <b>ACCESS POLICY DELEGATION CONTROLS</b> - As of version 2.1, Postfix can be configured to delegate access policy - decisions to an external server that runs outside Postfix. See the + As of version 2.1, Postfix can be configured to delegate access policy + decisions to an external server that runs outside Postfix. See the file <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a> for more information. <b><a href="postconf.5.html#smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a> (300s)</b> - The time after which an idle SMTPD policy service connection is + The time after which an idle SMTPD policy service connection is closed. <b><a href="postconf.5.html#smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a> (1000s)</b> - The time after which an active SMTPD policy service connection + The time after which an active SMTPD policy service connection is closed. <b><a href="postconf.5.html#smtpd_policy_service_timeout">smtpd_policy_service_timeout</a> (100s)</b> - The time limit for connecting to, writing to, or receiving from + The time limit for connecting to, writing to, or receiving from a delegated SMTPD policy server. Available in Postfix version 3.0 and later: @@ -961,81 +1013,81 @@ SMTPD(8) SMTPD(8) The default action when an SMTPD policy service request fails. <b><a href="postconf.5.html#smtpd_policy_service_request_limit">smtpd_policy_service_request_limit</a> (0)</b> - The maximal number of requests per SMTPD policy service connec- + The maximal number of requests per SMTPD policy service connec- tion, or zero (no limit). <b><a href="postconf.5.html#smtpd_policy_service_try_limit">smtpd_policy_service_try_limit</a> (2)</b> - The maximal number of attempts to send an SMTPD policy service + The maximal number of attempts to send an SMTPD policy service request before giving up. <b><a href="postconf.5.html#smtpd_policy_service_retry_delay">smtpd_policy_service_retry_delay</a> (1s)</b> - The delay between attempts to resend a failed SMTPD policy ser- + The delay between attempts to resend a failed SMTPD policy ser- vice request. Available in Postfix version 3.1 and later: <b><a href="postconf.5.html#smtpd_policy_service_policy_context">smtpd_policy_service_policy_context</a> (empty)</b> - Optional information that the Postfix SMTP server specifies in - the "policy_context" attribute of a policy service request - (originally, to share the same service endpoint among multiple + Optional information that the Postfix SMTP server specifies in + the "policy_context" attribute of a policy service request + (originally, to share the same service endpoint among multiple <a href="postconf.5.html#check_policy_service">check_policy_service</a> clients). <b>ACCESS CONTROLS</b> - The <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a> document gives an introduction to all the SMTP + The <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a> document gives an introduction to all the SMTP server access control features. <b><a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> (yes)</b> - Wait until the RCPT TO command before evaluating + Wait until the RCPT TO command before evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, or wait until the ETRN command - before evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and + before evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>. <b><a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> (see 'postconf -d' output)</b> - A list of Postfix features where the pattern "example.com" also - matches subdomains of example.com, instead of requiring an + A list of Postfix features where the pattern "example.com" also + matches subdomains of example.com, instead of requiring an explicit ".example.com" pattern. <b><a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> (empty)</b> - Optional restrictions that the Postfix SMTP server applies in + Optional restrictions that the Postfix SMTP server applies in the context of a client connection request. <b><a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> (no)</b> - Require that a remote SMTP client introduces itself with the - HELO or EHLO command before sending the MAIL command or other + Require that a remote SMTP client introduces itself with the + HELO or EHLO command before sending the MAIL command or other commands that require EHLO negotiation. <b><a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> (empty)</b> - Optional restrictions that the Postfix SMTP server applies in + Optional restrictions that the Postfix SMTP server applies in the context of a client HELO command. <b><a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> (empty)</b> - Optional restrictions that the Postfix SMTP server applies in + Optional restrictions that the Postfix SMTP server applies in the context of a client MAIL FROM command. <b><a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> (see 'postconf -d' output)</b> - Optional restrictions that the Postfix SMTP server applies in - the context of a client RCPT TO command, after + Optional restrictions that the Postfix SMTP server applies in + the context of a client RCPT TO command, after <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>. <b><a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> (empty)</b> - Optional restrictions that the Postfix SMTP server applies in + Optional restrictions that the Postfix SMTP server applies in the context of a client ETRN command. <b><a href="postconf.5.html#allow_untrusted_routing">allow_untrusted_routing</a> (no)</b> - Forward mail with sender-specified routing - (user[@%!]remote[@%!]site) from untrusted clients to destina- + Forward mail with sender-specified routing + (user[@%!]remote[@%!]site) from untrusted clients to destina- tions matching $<a href="postconf.5.html#relay_domains">relay_domains</a>. <b><a href="postconf.5.html#smtpd_restriction_classes">smtpd_restriction_classes</a> (empty)</b> User-defined aliases for groups of access restrictions. <b><a href="postconf.5.html#smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a> (</b><><b>)</b> - The lookup key to be used in SMTP <a href="access.5.html"><b>access</b>(5)</a> tables instead of + The lookup key to be used in SMTP <a href="access.5.html"><b>access</b>(5)</a> tables instead of the null sender address. <b><a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a> (empty)</b> - Restrict the use of the <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> SMTP access feature to + Restrict the use of the <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> SMTP access feature to only domains whose primary MX hosts match the listed networks. Available in Postfix version 2.0 and later: @@ -1045,19 +1097,19 @@ SMTPD(8) SMTPD(8) applies in the context of the SMTP DATA command. <b><a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> (see 'postconf -d' output)</b> - What characters are allowed in $name expansions of RBL reply + What characters are allowed in $name expansions of RBL reply templates. Available in Postfix version 2.1 and later: <b><a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> (no)</b> - Request that the Postfix SMTP server rejects mail from unknown - sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a> + Request that the Postfix SMTP server rejects mail from unknown + sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a> access restriction is specified. <b><a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> (yes)</b> - Request that the Postfix SMTP server rejects mail for unknown - recipient addresses, even when no explicit + Request that the Postfix SMTP server rejects mail for unknown + recipient addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a> access restriction is specified. Available in Postfix version 2.2 and later: @@ -1071,17 +1123,17 @@ SMTPD(8) SMTPD(8) <b><a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> (<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>,</b> <b><a href="postconf.5.html#defer_unauth_destination">defer_unauth_destination</a>)</b> Access restrictions for mail relay control that the Postfix SMTP - server applies in the context of the RCPT TO command, before + server applies in the context of the RCPT TO command, before <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. <b>SENDER AND RECIPIENT ADDRESS VERIFICATION CONTROLS</b> - Postfix version 2.1 introduces sender and recipient address verifica- + Postfix version 2.1 introduces sender and recipient address verifica- tion. This feature is implemented by sending probe email messages that are not actually delivered. This feature is requested via the - <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> and <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> access - restrictions. The status of verification probes is maintained by the - <a href="verify.8.html"><b>verify</b>(8)</a> server. See the file <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> for infor- - mation about how to configure and operate the Postfix sender/recipient + <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> and <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> access + restrictions. The status of verification probes is maintained by the + <a href="verify.8.html"><b>verify</b>(8)</a> server. See the file <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> for infor- + mation about how to configure and operate the Postfix sender/recipient address verification service. <b><a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> (normal: 3, overload: 1)</b> @@ -1093,7 +1145,7 @@ SMTPD(8) SMTPD(8) fication request in progress. <b><a href="postconf.5.html#address_verify_sender">address_verify_sender</a> ($<a href="postconf.5.html#double_bounce_sender">double_bounce_sender</a>)</b> - The sender address to use in address verification probes; prior + The sender address to use in address verification probes; prior to Postfix 2.5 the default was "postmaster". <b><a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> (450)</b> @@ -1101,18 +1153,18 @@ SMTPD(8) SMTPD(8) address is rejected by the <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> restriction. <b><a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> (450)</b> - The numerical Postfix SMTP server response when a recipient - address is rejected by the <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> restric- + The numerical Postfix SMTP server response when a recipient + address is rejected by the <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> restric- tion. Available in Postfix version 2.6 and later: <b><a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> (450)</b> - The numerical Postfix SMTP server response code when a sender + The numerical Postfix SMTP server response code when a sender address probe fails due to a temporary error condition. <b><a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> (450)</b> - The numerical Postfix SMTP server response when a recipient + The numerical Postfix SMTP server response when a recipient address probe fails due to a temporary error condition. <b><a href="postconf.5.html#unverified_sender_reject_reason">unverified_sender_reject_reason</a> (empty)</b> @@ -1124,17 +1176,17 @@ SMTPD(8) SMTPD(8) <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>. <b><a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b> - The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> + The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> fails due to a temporary error condition. <b><a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b> - The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipi</a>- + The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipi</a>- <a href="postconf.5.html#reject_unverified_recipient">ent</a> fails due to a temporary error condition. Available with Postfix 2.9 and later: <b><a href="postconf.5.html#address_verify_sender_ttl">address_verify_sender_ttl</a> (0s)</b> - The time between changes in the time-dependent portion of + The time between changes in the time-dependent portion of address verification probe sender addresses. <b>ACCESS CONTROL RESPONSES</b> @@ -1146,36 +1198,36 @@ SMTPD(8) SMTPD(8) map "reject" action. <b><a href="postconf.5.html#defer_code">defer_code</a> (450)</b> - The numerical Postfix SMTP server response code when a remote + The numerical Postfix SMTP server response code when a remote SMTP client request is rejected by the "defer" restriction. <b><a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> (501)</b> - The numerical Postfix SMTP server response code when the client - HELO or EHLO command parameter is rejected by the + The numerical Postfix SMTP server response code when the client + HELO or EHLO command parameter is rejected by the <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a> restriction. <b><a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> (554)</b> - The numerical Postfix SMTP server response code when a remote - SMTP client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, + The numerical Postfix SMTP server response code when a remote + SMTP client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>, <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a>, <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction. <b><a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> (504)</b> - The numerical Postfix SMTP server reply code when a client - request is rejected by the <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a>, + The numerical Postfix SMTP server reply code when a client + request is rejected by the <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a>, <a href="postconf.5.html#reject_non_fqdn_sender">reject_non_fqdn_sender</a> or <a href="postconf.5.html#reject_non_fqdn_recipient">reject_non_fqdn_recipient</a> restriction. <b><a href="postconf.5.html#plaintext_reject_code">plaintext_reject_code</a> (450)</b> - The numerical Postfix SMTP server response code when a request + The numerical Postfix SMTP server response code when a request is rejected by the <b><a href="postconf.5.html#reject_plaintext_session">reject_plaintext_session</a></b> restriction. <b><a href="postconf.5.html#reject_code">reject_code</a> (554)</b> - The numerical Postfix SMTP server response code when a remote + The numerical Postfix SMTP server response code when a remote SMTP client request is rejected by the "reject" restriction. <b><a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> (554)</b> - The numerical Postfix SMTP server response code when a client - request is rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient + The numerical Postfix SMTP server response code when a client + request is rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient restriction. <b><a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> (450)</b> @@ -1183,24 +1235,24 @@ SMTPD(8) SMTPD(8) a sender or recipient address because its domain is unknown. <b><a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> (450)</b> - The numerical Postfix SMTP server response code when a client - without valid address <=> name mapping is rejected by the + The numerical Postfix SMTP server response code when a client + without valid address <=> name mapping is rejected by the <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> restriction. <b><a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> (450)</b> - The numerical Postfix SMTP server response code when the host- - name specified with the HELO or EHLO command is rejected by the + The numerical Postfix SMTP server response code when the host- + name specified with the HELO or EHLO command is rejected by the <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a> restriction. Available in Postfix version 2.0 and later: <b><a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> (see 'postconf -d' output)</b> - The default Postfix SMTP server response template for a request + The default Postfix SMTP server response template for a request that is rejected by an RBL-based restriction. <b><a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> (550)</b> - The numerical Postfix SMTP server response code when a remote - SMTP client request is blocked by the <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipi</a>- + The numerical Postfix SMTP server response code when a remote + SMTP client request is blocked by the <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipi</a>- <a href="postconf.5.html#reject_multi_recipient_bounce">ent_bounce</a> restriction. <b><a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> (empty)</b> @@ -1210,52 +1262,52 @@ SMTPD(8) SMTPD(8) <b><a href="postconf.5.html#access_map_defer_code">access_map_defer_code</a> (450)</b> The numerical Postfix SMTP server response code for an <a href="access.5.html"><b>access</b>(5)</a> - map "defer" action, including "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" or + map "defer" action, including "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" or "<a href="postconf.5.html#defer_if_reject">defer_if_reject</a>". <b><a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a> (<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>)</b> - The Postfix SMTP server's action when a reject-type restriction + The Postfix SMTP server's action when a reject-type restriction fails due to a temporary error condition. <b><a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b> - The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_host</a>- + The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_host</a>- <a href="postconf.5.html#reject_unknown_helo_hostname">name</a> fails due to a temporary error condition. <b><a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b> - The Postfix SMTP server's action when - <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a> or <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a> + The Postfix SMTP server's action when + <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a> or <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a> fail due to a temporary error condition. <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b> - How much time a Postfix daemon process may take to handle a + How much time a Postfix daemon process may take to handle a request before it is terminated by a built-in watchdog timer. <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b> The location of all postfix administrative commands. <b><a href="postconf.5.html#double_bounce_sender">double_bounce_sender</a> (double-bounce)</b> - The sender address of postmaster notifications that are gener- + The sender address of postmaster notifications that are gener- ated by the mail system. <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b> - The time limit for sending or receiving information over an + The time limit for sending or receiving information over an internal communication channel. <b><a href="postconf.5.html#mail_name">mail_name</a> (Postfix)</b> - The mail system name that is displayed in Received: headers, in + The mail system name that is displayed in Received: headers, in the SMTP greeting banner, and in bounced mail. <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b> - The UNIX system account that owns the Postfix queue and most + The UNIX system account that owns the Postfix queue and most Postfix daemon processes. <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> - The maximum amount of time that an idle Postfix daemon process + The maximum amount of time that an idle Postfix daemon process waits for an incoming connection before terminating voluntarily. <b><a href="postconf.5.html#max_use">max_use</a> (100)</b> @@ -1266,11 +1318,11 @@ SMTPD(8) SMTPD(8) The internet hostname of this mail system. <b><a href="postconf.5.html#mynetworks">mynetworks</a> (see 'postconf -d' output)</b> - The list of "trusted" remote SMTP clients that have more privi- + The list of "trusted" remote SMTP clients that have more privi- leges than "strangers". <b><a href="postconf.5.html#myorigin">myorigin</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> - The domain name that locally-posted mail appears to come from, + The domain name that locally-posted mail appears to come from, and that locally posted mail is delivered to. <b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b> @@ -1283,9 +1335,8 @@ SMTPD(8) SMTPD(8) The location of the Postfix top-level queue directory. <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b> - The set of characters that can separate a user name from its - extension (example: user+foo), or a .forward file name from its - extension (example: .forward+foo). + The set of characters that can separate an email address local- + part, user name, or a .forward file name from its extension. <b><a href="postconf.5.html#smtpd_banner">smtpd_banner</a> ($<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b> The text that follows the 220 status code in the SMTP greeting @@ -1300,7 +1351,7 @@ SMTPD(8) SMTPD(8) Available in Postfix version 2.2 and later: - <b><a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> (CONNECT, GET, POST)</b> + <b><a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> (CONNECT GET POST <a href="regexp_table.5.html">regexp</a>:{{/^[^A-Z]/ Bogus}})</b> List of commands that cause the Postfix SMTP server to immedi- ately terminate the session with a 221 code. diff --git a/external/ibm-public/postfix/dist/html/socketmap_table.5.html b/external/ibm-public/postfix/dist/html/socketmap_table.5.html index b46fddf782f..1387fb394f6 100644 --- a/external/ibm-public/postfix/dist/html/socketmap_table.5.html +++ b/external/ibm-public/postfix/dist/html/socketmap_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - socketmap_table(5) </title> </head> <body> <pre> SOCKETMAP_TABLE(5) SOCKETMAP_TABLE(5) diff --git a/external/ibm-public/postfix/dist/html/spawn.8.html b/external/ibm-public/postfix/dist/html/spawn.8.html index 51bb9045db5..a0fc2206208 100644 --- a/external/ibm-public/postfix/dist/html/spawn.8.html +++ b/external/ibm-public/postfix/dist/html/spawn.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - spawn(8) </title> </head> <body> <pre> SPAWN(8) SPAWN(8) @@ -71,7 +71,7 @@ SPAWN(8) SPAWN(8) <a href="master.5.html"><b>master.cf</b></a> file. <b>RESOURCE AND RATE CONTROL</b> - <b>transport_time_limit ($<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b> + <b><a href="postconf.5.html#transport_time_limit">transport_time_limit</a> ($<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b> A transport-specific override for the <a href="postconf.5.html#command_time_limit">command_time_limit</a> parame- ter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery transport. diff --git a/external/ibm-public/postfix/dist/html/sqlite_table.5.html b/external/ibm-public/postfix/dist/html/sqlite_table.5.html index 7ca5fd3bb61..308d1ccb756 100644 --- a/external/ibm-public/postfix/dist/html/sqlite_table.5.html +++ b/external/ibm-public/postfix/dist/html/sqlite_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - sqlite_table(5) </title> </head> <body> <pre> SQLITE_TABLE(5) SQLITE_TABLE(5) @@ -21,7 +21,7 @@ SQLITE_TABLE(5) SQLITE_TABLE(5) Alternatively, lookup tables can be specified as SQLite databases. In order to use SQLite lookups, define an SQLite source as a lookup table in <a href="postconf.5.html">main.cf</a>, for example: - <a href="postconf.5.html#alias_maps">alias_maps</a> = <a href="sqlite_table.5.html">sqlite</a>:/etc/sqlite-aliases.cf + <a href="postconf.5.html#alias_maps">alias_maps</a> = <a href="sqlite_table.5.html">sqlite</a>:/etc/postfix/sqlite-aliases.cf The file /etc/postfix/sqlite-aliases.cf has the same format as the Postfix <a href="postconf.5.html">main.cf</a> file, and can specify the parameters described below. @@ -147,9 +147,9 @@ SQLITE_TABLE(5) SQLITE_TABLE(5) NOTE: DO NOT put quotes around the result format! <b>domain (default: no domain list)</b> - This is a list of domain names, paths to files, or dictionaries. - When specified, only fully qualified search keys with a - *non-empty* localpart and a matching domain are eligible for + This is a list of domain names, paths to files, or "<a href="DATABASE_README.html">type:table</a>" + databases. When specified, only fully qualified search keys with + a *non-empty* localpart and a matching domain are eligible for lookup: 'user' lookups, bare domain lookups and "@domain" lookups are not performed. This can significantly reduce the query load on the SQLite server. diff --git a/external/ibm-public/postfix/dist/html/tcp_table.5.html b/external/ibm-public/postfix/dist/html/tcp_table.5.html index ea8291e5f38..83f0d884b80 100644 --- a/external/ibm-public/postfix/dist/html/tcp_table.5.html +++ b/external/ibm-public/postfix/dist/html/tcp_table.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - tcp_table(5) </title> </head> <body> <pre> TCP_TABLE(5) TCP_TABLE(5) diff --git a/external/ibm-public/postfix/dist/html/tlsmgr.8.html b/external/ibm-public/postfix/dist/html/tlsmgr.8.html index 7f3ac18737a..24cbccbcdf3 100644 --- a/external/ibm-public/postfix/dist/html/tlsmgr.8.html +++ b/external/ibm-public/postfix/dist/html/tlsmgr.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - tlsmgr(8) </title> </head> <body> <pre> TLSMGR(8) TLSMGR(8) diff --git a/external/ibm-public/postfix/dist/html/tlsproxy.8.html b/external/ibm-public/postfix/dist/html/tlsproxy.8.html index 4e43ee2b45d..c15322bf3e8 100644 --- a/external/ibm-public/postfix/dist/html/tlsproxy.8.html +++ b/external/ibm-public/postfix/dist/html/tlsproxy.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - tlsproxy(8) </title> </head> <body> <pre> TLSPROXY(8) TLSPROXY(8) @@ -15,7 +15,7 @@ TLSPROXY(8) TLSPROXY(8) <b>DESCRIPTION</b> The <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server implements a two-way TLS proxy. It is used by the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server to talk SMTP-over-TLS with remote SMTP clients - that are not whitelisted (including clients whose whitelist status has + that are not allowlisted (including clients whose allowlist status has expired), and by the <a href="smtp.8.html"><b>smtp</b>(8)</a> client to support TLS connection reuse, but it should also work for non-SMTP protocols. @@ -103,7 +103,7 @@ TLSPROXY(8) TLSPROXY(8) Available in Postfix version 2.9 and later: - <b><a href="postconf.5.html#tls_legacy_public_key_fingerprint">tls_legacy_public_key_fingerprints</a> (no)</b> + <b><a href="postconf.5.html#tls_legacy_public_key_fingerprints">tls_legacy_public_key_fingerprints</a> (no)</b> A temporary migration aid for sites that use certificate <i>pub-</i> <i>lic-key</i> fingerprints with Postfix 2.9.0..2.9.5, which use an incorrect algorithm. @@ -111,10 +111,10 @@ TLSPROXY(8) TLSPROXY(8) Available in Postfix version 2.11-3.1: <b><a href="postconf.5.html#tls_dane_digest_agility">tls_dane_digest_agility</a> (on)</b> - Configure <a href="http://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility. + Configure <a href="https://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility. <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b> - Enable support for <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain + Enable support for <a href="https://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain digests of trust-anchors with certificate usage "2". Available in Postfix version 2.11 and later: @@ -126,7 +126,7 @@ TLSPROXY(8) TLSPROXY(8) <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a> (Postfix</b> ><b>= 3.0: aes-256-cbc, Postfix</b> < <b>3.0:</b> <b>aes-128-cbc)</b> - Algorithm used to encrypt <a href="http://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets. + Algorithm used to encrypt <a href="https://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets. <b><a href="postconf.5.html#openssl_path">openssl_path</a> (openssl)</b> The location of the OpenSSL command line program <b>openssl</b>(1). @@ -323,14 +323,6 @@ TLSPROXY(8) TLSPROXY(8) <b><a href="postconf.5.html#tlsproxy_client_scert_verifydepth">tlsproxy_client_scert_verifydepth</a> ($<a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>)</b> The verification depth for remote TLS server certificates. - <b><a href="postconf.5.html#tlsproxy_client_security_level">tlsproxy_client_security_level</a> ($<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a>)</b> - The default TLS security level for the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> - client. - - <b><a href="postconf.5.html#tlsproxy_client_policy_maps">tlsproxy_client_policy_maps</a> ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>)</b> - Optional lookup tables with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client TLS - security policy by next-hop destination. - <b><a href="postconf.5.html#tlsproxy_client_use_tls">tlsproxy_client_use_tls</a> ($<a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>)</b> Opportunistic mode: use TLS when a remote server announces TLS support. @@ -343,6 +335,26 @@ TLSPROXY(8) TLSPROXY(8) usage policy by next-hop destination and by remote TLS server hostname. + Available in Postfix version 3.4-3.6: + + <b><a href="postconf.5.html#tlsproxy_client_level">tlsproxy_client_level</a> ($<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a>)</b> + The default TLS security level for the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> + client. + + <b><a href="postconf.5.html#tlsproxy_client_policy">tlsproxy_client_policy</a> ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>)</b> + Optional lookup tables with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client TLS + security policy by next-hop destination. + + Available in Postfix version 3.7 and later: + + <b><a href="postconf.5.html#tlsproxy_client_security_level">tlsproxy_client_security_level</a> ($<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a>)</b> + The default TLS security level for the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> + client. + + <b><a href="postconf.5.html#tlsproxy_client_policy_maps">tlsproxy_client_policy_maps</a> ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>)</b> + Optional lookup tables with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client TLS + security policy by next-hop destination. + <b>OBSOLETE STARTTLS SUPPORT CONTROLS</b> These parameters are supported for compatibility with <a href="smtpd.8.html"><b>smtpd</b>(8)</a> legacy parameters. @@ -355,6 +367,13 @@ TLSPROXY(8) TLSPROXY(8) Mandatory TLS: announce STARTTLS support to remote SMTP clients, and require that clients use TLS encryption. + <b><a href="postconf.5.html#tlsproxy_client_use_tls">tlsproxy_client_use_tls</a> ($<a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>)</b> + Opportunistic mode: use TLS when a remote server announces TLS + support. + + <b><a href="postconf.5.html#tlsproxy_client_enforce_tls">tlsproxy_client_enforce_tls</a> ($<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>)</b> + Enforcement mode: require that SMTP servers use TLS encryption. + <b>RESOURCE CONTROLS</b> <b><a href="postconf.5.html#tlsproxy_watchdog_timeout">tlsproxy_watchdog_timeout</a> (10s)</b> How much time a <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> process may take to process local or diff --git a/external/ibm-public/postfix/dist/html/trace.8.html b/external/ibm-public/postfix/dist/html/trace.8.html index 67801211a20..a2768453dfe 100644 --- a/external/ibm-public/postfix/dist/html/trace.8.html +++ b/external/ibm-public/postfix/dist/html/trace.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - bounce(8) </title> </head> <body> <pre> BOUNCE(8) BOUNCE(8) @@ -39,16 +39,16 @@ BOUNCE(8) BOUNCE(8) and that depend on retry logic in their own client. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) - <a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a> (Format of Internet Message Bodies) - <a href="http://tools.ietf.org/html/rfc2822">RFC 2822</a> (Internet Message Format) - <a href="http://tools.ietf.org/html/rfc3462">RFC 3462</a> (Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery Status Notifications) - <a href="http://tools.ietf.org/html/rfc3834">RFC 3834</a> (Auto-Submitted: message header) - <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format) - <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) - <a href="http://tools.ietf.org/html/rfc6532">RFC 6532</a> (Internationalized Message Format) - <a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a> (Format of Internet Message Bodies) + <a href="https://tools.ietf.org/html/rfc2822">RFC 2822</a> (Internet Message Format) + <a href="https://tools.ietf.org/html/rfc3462">RFC 3462</a> (Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc3464">RFC 3464</a> (Delivery Status Notifications) + <a href="https://tools.ietf.org/html/rfc3834">RFC 3834</a> (Auto-Submitted: message header) + <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format) + <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) + <a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a> (Internationalized Message Format) + <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) <b>DIAGNOSTICS</b> Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. @@ -153,6 +153,18 @@ BOUNCE(8) BOUNCE(8) <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. + Available in Postfix 3.6 and later: + + <b><a href="postconf.5.html#enable_threaded_bounces">enable_threaded_bounces</a> (no)</b> + Enable non-delivery, success, and delay notifications that link + to the original message by including a References: and + In-Reply-To: header with the original Message-ID value. + + Available in Postfix 3.7 and later: + + <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> + The format of the Postfix-generated <b>From:</b> header. + <b>FILES</b> /var/spool/postfix/bounce/* non-delivery records /var/spool/postfix/defer/* non-delivery records diff --git a/external/ibm-public/postfix/dist/html/transport.5.html b/external/ibm-public/postfix/dist/html/transport.5.html index 05da59f70c1..b38dba51da2 100644 --- a/external/ibm-public/postfix/dist/html/transport.5.html +++ b/external/ibm-public/postfix/dist/html/transport.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - transport(5) </title> </head> <body> <pre> TRANSPORT(5) TRANSPORT(5) @@ -61,8 +61,8 @@ TRANSPORT(5) TRANSPORT(5) Alternatively, the table can be provided as a regular-expression map where patterns are given as regular expressions, or lookups can be - directed to TCP-based server. In those case, the lookups are done in a - slightly different way as described below under "REGULAR EXPRESSION + directed to a TCP-based server. In those case, the lookups are done in + a slightly different way as described below under "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". <b>CASE FOLDING</b> @@ -87,7 +87,7 @@ TRANSPORT(5) TRANSPORT(5) starts with whitespace continues a logical line. The <i>pattern</i> specifies an email address, a domain name, or a domain name - hierarchy, as described in section "TABLE LOOKUP". + hierarchy, as described in section "TABLE SEARCH ORDER". The <i>result</i> is of the form <i>transport:nexthop</i> and specifies how or where to deliver mail. This is described in section "RESULT FORMAT". diff --git a/external/ibm-public/postfix/dist/html/trivial-rewrite.8.html b/external/ibm-public/postfix/dist/html/trivial-rewrite.8.html index d5e2fdc1f18..60638567c6b 100644 --- a/external/ibm-public/postfix/dist/html/trivial-rewrite.8.html +++ b/external/ibm-public/postfix/dist/html/trivial-rewrite.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - trivial-rewrite(8) </title> </head> <body> <pre> TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) @@ -56,13 +56,13 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) Resolve the address for address verification purposes. <b>SERVER PROCESS MANAGEMENT</b> - The <a href="trivial-rewrite.8.html"><b>trivial-rewrite</b>(8)</a> servers run under control by the Postfix master - server. Each server can handle multiple simultaneous connections. - When all servers are busy while a client connects, the master creates a - new server process, provided that the trivial-rewrite server process - limit is not exceeded. Each trivial-rewrite server terminates after - serving at least <b>$<a href="postconf.5.html#max_use">max_use</a></b> clients of after <b>$<a href="postconf.5.html#max_idle">max_idle</a></b> seconds of idle - time. + The <a href="trivial-rewrite.8.html"><b>trivial-rewrite</b>(8)</a> servers run under control by the Postfix <a href="master.8.html">mas-</a> + <a href="master.8.html">ter(8)</a> server. Each server can handle multiple simultaneous connec- + tions. When all servers are busy while a client connects, the master + creates a new server process, provided that the trivial-rewrite server + process limit is not exceeded. Each trivial-rewrite server terminates + after serving at least <b>$<a href="postconf.5.html#max_use">max_use</a></b> clients of after <b>$<a href="postconf.5.html#max_idle">max_idle</a></b> seconds of + idle time. <b>STANDARDS</b> None. The command does not interact with the outside world. @@ -124,9 +124,8 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) addresses that have no ".domain" information. <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b> - The set of characters that can separate a user name from its - extension (example: user+foo), or a .forward file name from its - extension (example: .forward+foo). + The set of characters that can separate an email address local- + part, user name, or a .forward file name from its extension. <b><a href="postconf.5.html#swap_bangpath">swap_bangpath</a> (yes)</b> Enable the rewriting of "site!user" into "user@site". @@ -134,24 +133,24 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) Available in Postfix 2.2 and later: <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> (empty)</b> - Don't rewrite message headers from remote clients at all when - this parameter is empty; otherwise, rewrite message headers and + Don't rewrite message headers from remote clients at all when + this parameter is empty; otherwise, rewrite message headers and append the specified domain name to incomplete addresses. <b>ROUTING CONTROLS</b> - The following is applicable to Postfix version 2.0 and later. Earlier - versions do not have support for: <a href="postconf.5.html#virtual_transport">virtual_transport</a>, <a href="postconf.5.html#relay_transport">relay_transport</a>, + The following is applicable to Postfix version 2.0 and later. Earlier + versions do not have support for: <a href="postconf.5.html#virtual_transport">virtual_transport</a>, <a href="postconf.5.html#relay_transport">relay_transport</a>, <a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, <a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> or <a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. <b><a href="postconf.5.html#local_transport">local_transport</a> (<a href="local.8.html">local</a>:$<a href="postconf.5.html#myhostname">myhostname</a>)</b> The default mail delivery transport and next-hop destination for - final delivery to domains listed with <a href="postconf.5.html#mydestination">mydestination</a>, and for - [ipaddress] destinations that match $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or + final delivery to domains listed with <a href="postconf.5.html#mydestination">mydestination</a>, and for + [ipaddress] destinations that match $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. <b><a href="postconf.5.html#virtual_transport">virtual_transport</a> (virtual)</b> The default mail delivery transport and next-hop destination for - final delivery to domains listed with $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>. + final delivery to domains listed with $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>. <b><a href="postconf.5.html#relay_transport">relay_transport</a> (relay)</b> The default mail delivery transport and next-hop destination for @@ -160,49 +159,49 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) <b><a href="postconf.5.html#default_transport">default_transport</a> (smtp)</b> The default mail delivery transport and next-hop destination for destinations that do not match $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, - $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mail</a>- + $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mail</a>- <a href="postconf.5.html#virtual_mailbox_domains">box_domains</a>, or $<a href="postconf.5.html#relay_domains">relay_domains</a>. <b><a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> (see 'postconf -d' output)</b> - A list of Postfix features where the pattern "example.com" also - matches subdomains of example.com, instead of requiring an + A list of Postfix features where the pattern "example.com" also + matches subdomains of example.com, instead of requiring an explicit ".example.com" pattern. <b><a href="postconf.5.html#relayhost">relayhost</a> (empty)</b> - The next-hop destination of non-local mail; overrides non-local - domains in recipient addresses. + The next-hop destination(s) for non-local mail; overrides + non-<a href="ADDRESS_CLASS_README.html#local_domain_class">local domains</a> in recipient addresses. <b><a href="postconf.5.html#transport_maps">transport_maps</a> (empty)</b> - Optional lookup tables with mappings from recipient address to + Optional lookup tables with mappings from recipient address to (message delivery transport, next-hop destination). Available in Postfix version 2.3 and later: <b><a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> (empty)</b> - A sender-dependent override for the global <a href="postconf.5.html#relayhost">relayhost</a> parameter + A sender-dependent override for the global <a href="postconf.5.html#relayhost">relayhost</a> parameter setting. Available in Postfix version 2.5 and later: <b><a href="postconf.5.html#empty_address_relayhost_maps_lookup_key">empty_address_relayhost_maps_lookup_key</a> (</b><><b>)</b> - The <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> search string that will be + The <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> search string that will be used instead of the null sender address. Available in Postfix version 2.7 and later: <b><a href="postconf.5.html#empty_address_default_transport_maps_lookup_key">empty_address_default_transport_maps_lookup_key</a> (</b><><b>)</b> - The <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> search string that + The <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> search string that will be used instead of the null sender address. <b><a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> (empty)</b> - A sender-dependent override for the global <a href="postconf.5.html#default_transport">default_transport</a> + A sender-dependent override for the global <a href="postconf.5.html#default_transport">default_transport</a> parameter setting. <b>ADDRESS VERIFICATION CONTROLS</b> - Postfix version 2.1 introduces sender and recipient address verifica- + Postfix version 2.1 introduces sender and recipient address verifica- tion. This feature is implemented by sending probe email messages that - are not actually delivered. By default, address verification probes - use the same route as regular mail. To override specific aspects of + are not actually delivered. By default, address verification probes + use the same route as regular mail. To override specific aspects of message routing for address verification probes, specify one or more of the following: @@ -211,7 +210,7 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) ification probes. <b><a href="postconf.5.html#address_verify_virtual_transport">address_verify_virtual_transport</a> ($<a href="postconf.5.html#virtual_transport">virtual_transport</a>)</b> - Overrides the <a href="postconf.5.html#virtual_transport">virtual_transport</a> parameter setting for address + Overrides the <a href="postconf.5.html#virtual_transport">virtual_transport</a> parameter setting for address verification probes. <b><a href="postconf.5.html#address_verify_relay_transport">address_verify_relay_transport</a> ($<a href="postconf.5.html#relay_transport">relay_transport</a>)</b> @@ -219,11 +218,11 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) ification probes. <b><a href="postconf.5.html#address_verify_default_transport">address_verify_default_transport</a> ($<a href="postconf.5.html#default_transport">default_transport</a>)</b> - Overrides the <a href="postconf.5.html#default_transport">default_transport</a> parameter setting for address + Overrides the <a href="postconf.5.html#default_transport">default_transport</a> parameter setting for address verification probes. <b><a href="postconf.5.html#address_verify_relayhost">address_verify_relayhost</a> ($<a href="postconf.5.html#relayhost">relayhost</a>)</b> - Overrides the <a href="postconf.5.html#relayhost">relayhost</a> parameter setting for address verifica- + Overrides the <a href="postconf.5.html#relayhost">relayhost</a> parameter setting for address verifica- tion probes. <b><a href="postconf.5.html#address_verify_transport_maps">address_verify_transport_maps</a> ($<a href="postconf.5.html#transport_maps">transport_maps</a>)</b> @@ -234,34 +233,34 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) <b><a href="postconf.5.html#address_verify_sender_dependent_relayhost_maps">address_verify_sender_dependent_relayhost_maps</a> ($<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_depen</a>-</b> <b><a href="postconf.5.html#sender_dependent_relayhost_maps">dent_relayhost_maps</a>)</b> - Overrides the <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> parameter setting + Overrides the <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> parameter setting for address verification probes. Available in Postfix version 2.7 and later: <b><a href="postconf.5.html#address_verify_sender_dependent_default_transport_maps">address_verify_sender_dependent_default_transport_maps</a> ($<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_depen</a>-</b> <b><a href="postconf.5.html#sender_dependent_default_transport_maps">dent_default_transport_maps</a>)</b> - Overrides the <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter + Overrides the <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter setting for address verification probes. <b>MISCELLANEOUS CONTROLS</b> <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> - The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- + The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- figuration files. <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b> - How much time a Postfix daemon process may take to handle a + How much time a Postfix daemon process may take to handle a request before it is terminated by a built-in watchdog timer. <b><a href="postconf.5.html#empty_address_recipient">empty_address_recipient</a> (MAILER-DAEMON)</b> The recipient of mail addressed to the null address. <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b> - The time limit for sending or receiving information over an + The time limit for sending or receiving information over an internal communication channel. <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> - The maximum amount of time that an idle Postfix daemon process + The maximum amount of time that an idle Postfix daemon process waits for an incoming connection before terminating voluntarily. <b><a href="postconf.5.html#max_use">max_use</a> (100)</b> @@ -282,20 +281,20 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8) The location of the Postfix top-level queue directory. <b><a href="postconf.5.html#show_user_unknown_table_name">show_user_unknown_table_name</a> (yes)</b> - Display the name of the recipient table in the "User unknown" + Display the name of the recipient table in the "User unknown" responses. <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> The syslog facility of Postfix logging. <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> - A prefix that is prepended to the process name in syslog + A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd". Available in Postfix version 2.0 and later: <b><a href="postconf.5.html#helpful_warnings">helpful_warnings</a> (yes)</b> - Log warnings about problematic configuration settings, and pro- + Log warnings about problematic configuration settings, and pro- vide helpful suggestions. Available in Postfix 3.3 and later: diff --git a/external/ibm-public/postfix/dist/html/verify.8.html b/external/ibm-public/postfix/dist/html/verify.8.html index f1805b01ae3..0d17eea6413 100644 --- a/external/ibm-public/postfix/dist/html/verify.8.html +++ b/external/ibm-public/postfix/dist/html/verify.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - verify(8) </title> </head> <body> <pre> VERIFY(8) VERIFY(8) @@ -65,7 +65,7 @@ VERIFY(8) VERIFY(8) queue. Recipient verification may cause an increased load on down-stream servers in the case of a dictionary attack or a flood of backscatter bounces. Sender address verification may cause your site - to be blacklisted by some providers. + to be denylisted by some providers. If the persistent database ever gets corrupted then the world comes to an end and human intervention is needed. This violates a basic Postfix diff --git a/external/ibm-public/postfix/dist/html/virtual.5.html b/external/ibm-public/postfix/dist/html/virtual.5.html index 97e7e5e3e13..27b1392853b 100644 --- a/external/ibm-public/postfix/dist/html/virtual.5.html +++ b/external/ibm-public/postfix/dist/html/virtual.5.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - virtual(5) </title> </head> <body> <pre> VIRTUAL(5) VIRTUAL(5) @@ -50,8 +50,8 @@ VIRTUAL(5) VIRTUAL(5) Alternatively, the table can be provided as a regular-expression map where patterns are given as regular expressions, or lookups can be - directed to TCP-based server. In those case, the lookups are done in a - slightly different way as described below under "REGULAR EXPRESSION + directed to a TCP-based server. In those case, the lookups are done in + a slightly different way as described below under "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". <b>CASE FOLDING</b> @@ -92,7 +92,7 @@ VIRTUAL(5) VIRTUAL(5) $<b><a href="postconf.5.html#myorigin">myorigin</a></b>, when <i>site</i> is listed in $<b><a href="postconf.5.html#mydestination">mydestination</a></b>, or when it is listed in $<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b> or $<b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b>. - This functionality overlaps with functionality of the local + This functionality overlaps with the functionality of the local <i>aliases</i>(5) database. The difference is that <a href="virtual.5.html"><b>virtual</b>(5)</a> mapping can be applied to non-local addresses. @@ -140,8 +140,8 @@ VIRTUAL(5) VIRTUAL(5) <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and @<i>domain</i>. The <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b> parameter controls whether an - unmatched address extension (<i>+foo</i>) is propagated to the result of table - lookup. + unmatched address extension (<i>+foo</i>) is propagated to the result of a ta- + ble lookup. <b>VIRTUAL ALIAS DOMAINS</b> Besides virtual aliases, the virtual alias table can also be used to @@ -208,8 +208,8 @@ VIRTUAL(5) VIRTUAL(5) <b>TCP-BASED TABLES</b> This section describes how the table lookups change when lookups are directed to a TCP-based server. For a description of the TCP - client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is not - available up to and including Postfix version 2.4. + client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is + available in Postfix 2.5 and later. Each lookup operation uses the entire address once. Thus, <i>user@domain</i> mail addresses are not broken up into their <i>user</i> and <i>@domain</i> con- @@ -227,11 +227,11 @@ VIRTUAL(5) VIRTUAL(5) <b><a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> ($<a href="postconf.5.html#virtual_maps">virtual_maps</a>)</b> Optional lookup tables that alias specific mail addresses or - domains to other local or remote address. + domains to other local or remote addresses. <b><a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> ($<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>)</b> - Postfix is final destination for the specified list of virtual - alias domains, that is, domains for which all addresses are + Postfix is the final destination for the specified list of vir- + tual alias domains, that is, domains for which all addresses are aliased to addresses in other local or remote domains. <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> (canonical, virtual)</b> diff --git a/external/ibm-public/postfix/dist/html/virtual.8.html b/external/ibm-public/postfix/dist/html/virtual.8.html index b15b4d492fb..c02c3624bb5 100644 --- a/external/ibm-public/postfix/dist/html/virtual.8.html +++ b/external/ibm-public/postfix/dist/html/virtual.8.html @@ -1,7 +1,7 @@ <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title> Postfix manual - virtual(8) </title> </head> <body> <pre> VIRTUAL(8) VIRTUAL(8) @@ -118,12 +118,12 @@ VIRTUAL(8) VIRTUAL(8) fatal error. <b>STANDARDS</b> - <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) + <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) <b>DIAGNOSTICS</b> Mail bounces when the recipient has no mailbox or when the recipient is - over disk quota. In all other cases, mail for an existing recipient is - deferred and a warning is logged. + over disk quota. In all other problem cases, mail for an existing + recipient is deferred and a warning is logged. Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. Corrupted message files are marked so that the queue manager can move @@ -173,9 +173,9 @@ VIRTUAL(8) VIRTUAL(8) Available in Postfix version 2.0 and later: <b><a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> ($<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>)</b> - Postfix is final destination for the specified list of domains; - mail is delivered via the $<a href="postconf.5.html#virtual_transport">virtual_transport</a> mail delivery - transport. + Postfix is the final destination for the specified list of + domains; mail is delivered via the $<a href="postconf.5.html#virtual_transport">virtual_transport</a> mail + delivery transport. <b><a href="postconf.5.html#virtual_transport">virtual_transport</a> (virtual)</b> The default mail delivery transport and next-hop destination for @@ -281,7 +281,7 @@ VIRTUAL(8) VIRTUAL(8) Available in Postfix 3.5 and later: - <b>info_log_address_format (external)</b> + <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> The email address form that will be used in non-debug logging (info, warning, etc.). diff --git a/external/ibm-public/postfix/dist/mantools/check-double-cc b/external/ibm-public/postfix/dist/mantools/check-double-cc new file mode 100755 index 00000000000..61ffc5b6614 --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/check-double-cc @@ -0,0 +1,8 @@ +#!/bin/sh + +# Finds double words in C comments. See mantools/comment.c for 'comment' +# source code. + +LANG=C; export LANG + +find src -name '*.[hc]' | xargs cat | comment | mantools/deroff | mantools/find-double | fgrep -vxf proto/stop.double-cc diff --git a/external/ibm-public/postfix/dist/mantools/check-double-install-proto-text b/external/ibm-public/postfix/dist/mantools/check-double-install-proto-text new file mode 100755 index 00000000000..bab88bc6d3c --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/check-double-install-proto-text @@ -0,0 +1,7 @@ +#!/bin/sh + +# Finds double words in install and proto text files. + +LANG=C; export LANG + +(ls *install* proto/* | egrep -v 'stop|Makefile|html|\.proto' | xargs mantools/deroff; cat RELEASE_NOTES) | mantools/find-double | fgrep -vxf proto/stop.double-install-proto-text diff --git a/external/ibm-public/postfix/dist/mantools/check-double-proto-html b/external/ibm-public/postfix/dist/mantools/check-double-proto-html new file mode 100755 index 00000000000..234a7743d49 --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/check-double-proto-html @@ -0,0 +1,7 @@ +#!/bin/sh + +# Finds double words in proto html files. + +LANG=C; export LANG + +ls proto/*.html proto/*.proto | xargs mantools/dehtml | mantools/find-double | fgrep -vxf proto/stop.double-proto-html diff --git a/external/ibm-public/postfix/dist/mantools/check-postfix-files b/external/ibm-public/postfix/dist/mantools/check-postfix-files new file mode 100755 index 00000000000..ea85d40588c --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/check-postfix-files @@ -0,0 +1,32 @@ +#!/bin/sh + +# Reports missing documentation file names in postfix-files. For +# simplicity and maintainability this looks at file basenames only. +# The odds that a file is installed in the wrong place are small. + +trap 'rm -f expected.tmp actual.tmp' 0 1 2 3 15 + +LANG=C; export LANG +LC_ALL=C; export LC_ALL + +# Extract file basenames from postfix-files. + +awk -F: ' + BEGIN { want["f"] = want["h"] = want["l"] = want["p"] = 1 } + want[$2] == 1 { n = split($1, path, "/"); print path[n] } +' conf/postfix-files | sort >actual.tmp + +# Create a list of expected names, excluding files that aren't installed. + +(ls man/man?/* html/*.html |sed 's/.*\///' | egrep -v '^makedefs.1 +^posttls-finger.1 +^qmqp-sink.1 +^qmqp-source.1 +^qshape.1 +^smtp-sink.1 +^smtp-source.1' +ls README_FILES) | sort >expected.tmp + +# Compare the expected names against the names in postfix-files. + +comm -23 expected.tmp actual.tmp diff --git a/external/ibm-public/postfix/dist/mantools/check-postlink b/external/ibm-public/postfix/dist/mantools/check-postlink index ecddefa0032..21472d64ed9 100755 --- a/external/ibm-public/postfix/dist/mantools/check-postlink +++ b/external/ibm-public/postfix/dist/mantools/check-postlink @@ -1,57 +1,57 @@ #!/bin/sh -# Look for missing parameter names in postlink +# Reports parameter names that have no postlink rules. -trap 'rm -f postlink.tmp postconf.tmp check-postlink.tmp 2>/dev/null' 0 1 2 3 15 +LANG=C; export LANG +LC_ALL=C; export LC_ALL -# Extract parameters from postconf.5.html hyperlinks. +trap 'rm -f postlink.tmp postconf.tmp stoplist.tmp 2>/dev/null' 0 1 2 3 15 + +# Extract parameters from postlink script. This also produces names +# of obsolete parameters, and non-parameter names such as SMTPD +# access restrictions and mask names. sed -n '/[ ].*href="postconf\.5\.html#/{ s/^[^#]*#// s/".*// p }' mantools/postlink | sort > postlink.tmp -# -# Extract parameters from postlink script. This also produces names -# of obsolete parameters, and non-parameter names such as SMTPD -# access restrictions and mask names. -postconf -d | sed 's/ =.*//' | sort >postconf.tmp - -# Filter the output through a whitelist. - -cat >check-postlink.tmp <<'EOF' -lmtp_body_checks -lmtp_cname_overrides_servername -lmtp_destination_concurrency_failed_cohort_limit -lmtp_destination_concurrency_negative_feedback -lmtp_destination_concurrency_positive_feedback -lmtp_destination_rate_delay -lmtp_header_checks -lmtp_initial_destination_concurrency -lmtp_mime_header_checks -lmtp_nested_header_checks -local_destination_concurrency_failed_cohort_limit -local_destination_concurrency_negative_feedback -local_destination_concurrency_positive_feedback -local_destination_rate_delay -local_initial_destination_concurrency -relay_destination_concurrency_failed_cohort_limit -relay_destination_concurrency_negative_feedback -relay_destination_concurrency_positive_feedback -relay_destination_rate_delay -relay_initial_destination_concurrency -smtp_destination_concurrency_failed_cohort_limit -smtp_destination_concurrency_negative_feedback -smtp_destination_concurrency_positive_feedback -smtp_destination_rate_delay -smtp_initial_destination_concurrency +# Extract parameters from postconf output, using the stock configurations. + +bin/postconf -dHc conf | sort >postconf.tmp + +# Filter the postconf output through a stoplist. First, parameter +# names prefixed by their service name. + +for xport in error lmtp local relay retry smtp virtual +do + cat <<EOF +${xport}_delivery_slot_cost +${xport}_delivery_slot_discount +${xport}_delivery_slot_loan +${xport}_destination_concurrency_failed_cohort_limit +${xport}_destination_concurrency_limit +${xport}_destination_concurrency_negative_feedback +${xport}_destination_concurrency_positive_feedback +${xport}_destination_rate_delay +${xport}_destination_recipient_limit +${xport}_extra_recipient_limit +${xport}_initial_destination_concurrency +${xport}_minimum_delivery_slots +${xport}_recipient_limit +${xport}_recipient_refill_delay +${xport}_recipient_refill_limit +${xport}_transport_rate_delay +EOF +done >stoplist.tmp + +# Second, pseudo parameters, read-only parameters, etc. + +cat >>stoplist.tmp <<'EOF' stress -virtual_destination_concurrency_failed_cohort_limit -virtual_destination_concurrency_negative_feedback -virtual_destination_concurrency_positive_feedback -virtual_destination_rate_delay -virtual_initial_destination_concurrency EOF -comm -23 postconf.tmp postlink.tmp | fgrep -vx -f check-postlink.tmp +# Report names from postconf that have no rule in mantools/postlink. + +comm -23 postconf.tmp postlink.tmp | fgrep -vx -f stoplist.tmp diff --git a/external/ibm-public/postfix/dist/mantools/check-spell-cc b/external/ibm-public/postfix/dist/mantools/check-spell-cc new file mode 100755 index 00000000000..ab2247019f3 --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/check-spell-cc @@ -0,0 +1,8 @@ +#!/bin/sh + +# Spellchecks comments in C source code. See mantools/comment.c for +# 'comment' source code. + +LANG=C; export LANG + +find . -name *.[hc] | xargs cat | comment | mantools/deroff | spell | fgrep -vxf proto/stop | fgrep -vxf proto/stop.spell-cc diff --git a/external/ibm-public/postfix/dist/mantools/check-spell-install-proto-text b/external/ibm-public/postfix/dist/mantools/check-spell-install-proto-text new file mode 100755 index 00000000000..19b8140a0a3 --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/check-spell-install-proto-text @@ -0,0 +1,7 @@ +#!/bin/sh + +# Spellchecks the release notes, install scripts, and proto non-html files. + +LANG=C; export LANG + +(ls *install* proto/* | egrep -v 'stop|Makefile|html|\.proto' | mantools/deroff; cat RELEASE_NOTES) | spell | fgrep -vxf proto/stop diff --git a/external/ibm-public/postfix/dist/mantools/check-spell-proto-html b/external/ibm-public/postfix/dist/mantools/check-spell-proto-html new file mode 100755 index 00000000000..3d05d6676e5 --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/check-spell-proto-html @@ -0,0 +1,7 @@ +#!/bin/sh + +# Spellchecks the proto HTML files. + +LANG=C; export LANG + +mantools/dehtml proto/*html proto/*.proto | spell | fgrep -vxf proto/stop | fgrep -vxf proto/stop.spell-proto-html diff --git a/external/ibm-public/postfix/dist/mantools/comment.c b/external/ibm-public/postfix/dist/mantools/comment.c new file mode 100644 index 00000000000..04022ebdbf7 --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/comment.c @@ -0,0 +1,68 @@ +/* $NetBSD: comment.c,v 1.1.1.1 2022/10/08 16:09:04 christos Exp $ */ + +#include <stdio.h> + +void copy_comment() +{ + int c; + + while ((c = getchar()) != EOF) { + if (c == '*') { + if ((c = getchar()) == '/') { + putchar('\n'); + return; + } + if (c != EOF) + ungetc(c, stdin); + putchar('*'); + } else { + putchar(c); + } + } +} + +void skip_string(int quote) +{ + int c; + + while ((c = getchar()) != EOF) { + if (c == quote) { + return; + } else if (c == '\\') { + getchar(); + } + } +} + +int main() +{ + int c; + + while ((c = getchar()) != EOF) { + switch (c) { + case '/': + if ((c = getchar()) == '*') { + copy_comment(); + } else if (c == '/') { + while ((c = getchar()) != EOF) { + putchar(c); + if (c == '\n') + break; + } + } else { + if (c != EOF) + ungetc(c, stdin); + } + break; + case '"': + case '\'': + skip_string(c); + break; + case '\\': + (void) getchar(); + break; + default: + break; + } + } +} diff --git a/external/ibm-public/postfix/dist/mantools/deroff b/external/ibm-public/postfix/dist/mantools/deroff new file mode 100755 index 00000000000..d538e6e10a6 --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/deroff @@ -0,0 +1,7 @@ +#!/bin/sh + +sed ' + s/^\.[^ ]*// + s/\\f.//g + s/\\(..//g +' "$@" diff --git a/external/ibm-public/postfix/dist/mantools/find-double b/external/ibm-public/postfix/dist/mantools/find-double new file mode 100755 index 00000000000..371663e88e7 --- /dev/null +++ b/external/ibm-public/postfix/dist/mantools/find-double @@ -0,0 +1,13 @@ +#!/bin/sh + +sed 's/[^A-Z0-9a-z_][^A-Z0-9a-z_]*/ /g' "$@" | awk ' + { for (i = 1; i <= NF; i++) { + if (length($i) > 1 && $(i) == last) { + if (i == 1) + printf("%s ", last) + print + } + last = $(i) + } + } +' diff --git a/external/ibm-public/postfix/dist/mantools/make_soho_readme b/external/ibm-public/postfix/dist/mantools/make_soho_readme index abeddde74b9..fb94c3f651e 100755 --- a/external/ibm-public/postfix/dist/mantools/make_soho_readme +++ b/external/ibm-public/postfix/dist/mantools/make_soho_readme @@ -10,7 +10,7 @@ cat <<'EOF' <title>Postfix Small/Home Office Hints and Tips</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/mantools/makemanidx b/external/ibm-public/postfix/dist/mantools/makemanidx index 1fbdfb998ee..e696fd38c52 100755 --- a/external/ibm-public/postfix/dist/mantools/makemanidx +++ b/external/ibm-public/postfix/dist/mantools/makemanidx @@ -10,7 +10,7 @@ cat <<EOF <title>Postfix Manual Pages </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/mantools/man2html b/external/ibm-public/postfix/dist/mantools/man2html index 2ccb185a140..db17bda5040 100755 --- a/external/ibm-public/postfix/dist/mantools/man2html +++ b/external/ibm-public/postfix/dist/mantools/man2html @@ -14,7 +14,7 @@ done echo "<!doctype html public \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\"> <html> <head> -<meta http-equiv=\"Content-Type\" content=\"text/html; charset=us-ascii\"> +<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"> <title> $title </title> </head> <body> <pre>" diff --git a/external/ibm-public/postfix/dist/mantools/missing-proxy-read-maps b/external/ibm-public/postfix/dist/mantools/missing-proxy-read-maps index 58dc39071c5..11ddc4fbe21 100755 --- a/external/ibm-public/postfix/dist/mantools/missing-proxy-read-maps +++ b/external/ibm-public/postfix/dist/mantools/missing-proxy-read-maps @@ -2,7 +2,7 @@ # Outputs missing mail_params.h lines for the proxy_read_maps default # value. -# + # First, get the proxy_read_maps default value from postconf command # output. This gives us a list of parameter names that are already # present in the proxy_read_maps default value. @@ -36,7 +36,7 @@ while ($line = <MAIL_PARAMS>) { } } close(MAIL_PARAMS) || die "close $mail_params_h: !$\n"; -# + # Produce mail_params.h lines for all parameters that have names # ending in _maps and that are not listed in proxy_read_maps. We get # the full parameter name list from postconf command output. Abort diff --git a/external/ibm-public/postfix/dist/mantools/postconf2man b/external/ibm-public/postfix/dist/mantools/postconf2man index c9aff6d8961..cf5e1612805 100755 --- a/external/ibm-public/postfix/dist/mantools/postconf2man +++ b/external/ibm-public/postfix/dist/mantools/postconf2man @@ -38,6 +38,7 @@ while(<>) { # Even \134 comes out as \e. What brain damage is this? #$block =~ s/\n\./\n\\\&./g; $block =~ s/\n\./\n\134\&./g; + $block =~ s/\n'/\n\134\&'/g; if ($block =~ /<H2>/) { $block =~ s/<H2><a[^>]+>([^<]+)<\/a><\/H2>/\n.SH \1\n/g; $block =~ tr/a-z/A-Z/; @@ -88,7 +89,7 @@ while(<>) { $block =~ s/\s+\n/\n/g; $block =~ s/^\n//g; $block =~ s/\s*<\s*nroffescape\s+([^ >]+)\s*>\s*/\n\1\n/g; - $block =~ s/([a-z][_a-zA-Z0-9-]*)(\([0-9]\))/\\fB\1\\fR\2/g; + $block =~ s/([A-Za-z][_a-zA-Z0-9-]*)(\([0-9]\))/\\fB\1\\fR\2/g; print $block; $wantpp = !($block =~ /^\.(SH|IP)/); } diff --git a/external/ibm-public/postfix/dist/mantools/postlink b/external/ibm-public/postfix/dist/mantools/postlink index 46f187e91cd..2b1ad8b2ad7 100755 --- a/external/ibm-public/postfix/dist/mantools/postlink +++ b/external/ibm-public/postfix/dist/mantools/postlink @@ -32,7 +32,7 @@ while (<>) { $printit = 0; next LINE; } - if (/"[Hh][Tt][Tt][Pp]:/) { + if (/"[Hh][Tt][Tt][Pp][Ss]?:/) { print; $printit = 0; next LINE; @@ -134,23 +134,24 @@ while (<>) { s;\bcon[-</bB>]*\n*[ <bB>]*tent_filter\b;<a href="postconf.5.html#content_filter">$&</a>;g; s;\bdata_direc[-</bB>]*\n*[ <bB>]*tory\b;<a href="postconf.5.html#data_directory">$&</a>;g; s;\bdae[-</bB>]*\n*[ <bB>]*mon_direc[-</bB>]*\n*[ <bB>]*tory\b;<a href="postconf.5.html#daemon_directory">$&</a>;g; + s;\bdaemon_table_open_error_is_fatal\b;<a href="postconf.5.html#daemon_table_open_error_is_fatal">$&</a>;g; s;\bdaemon_timeout\b;<a href="postconf.5.html#daemon_timeout">$&</a>;g; s;\bdebug_peer_level\b;<a href="postconf.5.html#debug_peer_level">$&</a>;g; s;\bdebug_peer_list\b;<a href="postconf.5.html#debug_peer_list">$&</a>;g; s;\bdefault_delivery_status_filter\b;<a href="postconf.5.html#default_delivery_status_filter">$&</a>;g; s;\bdefault_data[-</Bb>]*\n* *[<Bb>]*base_type\b;<a href="postconf.5.html#default_database_type">$&</a>;g; s;\bdefault_deliv[-</Bb>]*\n* *[<Bb>]*ery_slot_cost\b;<a href="postconf.5.html#default_delivery_slot_cost">$&</a>;g; - s;\bdefault_deliv[-</Bb>]*\n* *[<Bb>]*ery_slot_discount\b;<a href="postconf.5.html#default_delivery_slot_discount">$&</a>;g; + s;\bdefault_deliv[-</Bb>]*\n* *[<Bb>]*ery_slot_dis[-</Bb>]*\n* *[<Bb>]*count\b;<a href="postconf.5.html#default_delivery_slot_discount">$&</a>;g; s;\bdefault_deliv[-</Bb>]*\n* *[<Bb>]*ery_slot_loan\b;<a href="postconf.5.html#default_delivery_slot_loan">$&</a>;g; - s;\bdefault_destina[-</Bb>]*\n* *[<Bb>]*tion_concur[-</Bb>]*\n* *[<Bb>]*rency_limit\b;<a href="postconf.5.html#default_destination_concurrency_limit">$&</a>;g; + s;\bdefault_destina[-</Bb>]*\n* *[<Bb>]*tion_con[-</Bb>]*\n* *[<Bb>]*cur[-</Bb>]*\n* *[<Bb>]*rency_limit\b;<a href="postconf.5.html#default_destination_concurrency_limit">$&</a>;g; s;\bdefault_destina[-</Bb>]*\n* *[<Bb>]*tion_recip[-</bB>]*\n* *[<bB>]*i[-</bB>]*\n* *[<bB>]*ent_limit\b;<a href="postconf.5.html#default_destination_recipient_limit">$&</a>;g; s;\bdefault_extra_recipi[-</bB>]*\n* *[<bB>]*ent_limit\b;<a href="postconf.5.html#default_extra_recipient_limit">$&</a>;g; s;\bdefault_minimum_deliv[-</Bb>]*\n* *[<Bb>]*ery_slots\b;<a href="postconf.5.html#default_minimum_delivery_slots">$&</a>;g; s;\bdefault_privs\b;<a href="postconf.5.html#default_privs">$&</a>;g; s;\bdefault_process_limit\b;<a href="postconf.5.html#default_process_limit">$&</a>;g; s;\bdefault_rbl_reply\b;<a href="postconf.5.html#default_rbl_reply">$&</a>;g; - s;\bdefault_recipi[-</bB>]*\n* *[<bB>]*ent_refill_limit\b;<a href="postconf.5.html#default_recipient_refill_limit">$&</a>;g; - s;\bdefault_recipi[-</bB>]*\n* *[<bB>]*ent_refill_delay\b;<a href="postconf.5.html#default_recipient_refill_delay">$&</a>;g; + s;\bdefault_recipi[-</bB>]*\n* *[<bB>]*ent_re[-</bB>]*\n* *[<bB>]*fill_limit\b;<a href="postconf.5.html#default_recipient_refill_limit">$&</a>;g; + s;\bdefault_recipi[-</bB>]*\n* *[<bB>]*ent_re[-</bB>]*\n* *[<bB>]*fill_delay\b;<a href="postconf.5.html#default_recipient_refill_delay">$&</a>;g; s;\bdefault_recip[-</bB>]*\n* *[<bB>]*ient_limit\b;<a href="postconf.5.html#default_recipient_limit">$&</a>;g; s;\bdefault_transport\b;<a href="postconf.5.html#default_transport">$&</a>;g; s;\bsender[-</bB>]*\n* *[<bB>]*_de[-</bB>]*\n* *[<bB>]*pen[-</bB>]*\n* *[<bB>]*dent_de[-</bB>]*\n* *[<bB>]*fault[-</bB>]*\n* *[<bB>]*_trans[-</bB>]*\n* *[<bB>]*port[-</bB>]*\n* *[<bB>]*_maps\b;<a href="postconf.5.html#sender_dependent_default_transport_maps">$&</a>;g; @@ -197,6 +198,7 @@ while (<>) { s;\bheader_address_token_limit\b;<a href="postconf.5.html#header_address_token_limit">$&</a>;g; s;\bheader_checks\b;<a href="postconf.5.html#header_checks">$&</a>;g; s;\bheader_size_limit\b;<a href="postconf.5.html#header_size_limit">$&</a>;g; + s;\bheader_from_format\b;<a href="postconf.5.html#header_from_format">$&</a>;g; s;\bhelpful_warnings\b;<a href="postconf.5.html#helpful_warnings">$&</a>;g; s;\bhome_mailbox\b;<a href="postconf.5.html#home_mailbox">$&</a>;g; s;\bhopcount_limit\b;<a href="postconf.5.html#hopcount_limit">$&</a>;g; @@ -207,7 +209,7 @@ while (<>) { s;\bin_flow_delay\b;<a href="postconf.5.html#in_flow_delay">$&</a>;g; s;\binet_inter[-</bB>]*\n*[ <bB>]*faces\b;<a href="postconf.5.html#inet_interfaces">$&</a>;g; s;\binet_protocols\b;<a href="postconf.5.html#inet_protocols">$&</a>;g; - s;\binitial_desti[-</bB>]*\n*[ <bB>]*nation_concur[-</bB>]*\n*[ <bB>]*rency\b;<a href="postconf.5.html#initial_destination_concurrency">$&</a>;g; + s;\binitial_desti[-</bB>]*\n*[ <bB>]*nation_con[-</bB>]*\n*[ <bB>]*cur[-</bB>]*\n*[ <bB>]*rency\b;<a href="postconf.5.html#initial_destination_concurrency">$&</a>;g; s;\binvalid_hostname_reject_code\b;<a href="postconf.5.html#invalid_hostname_reject_code">$&</a>;g; s;\bipc_idle\b;<a href="postconf.5.html#ipc_idle">$&</a>;g; s;\bipc_timeout\b;<a href="postconf.5.html#ipc_timeout">$&</a>;g; @@ -215,6 +217,7 @@ while (<>) { s;\bline_length_limit\b;<a href="postconf.5.html#line_length_limit">$&</a>;g; s;\blmdb_map_size\b;<a href="postconf.5.html#lmdb_map_size">$&</a>;g; s;\blmtp_address_preference\b;<a href="postconf.5.html#lmtp_address_preference">$&</a>;g; + s;\blmtp_bind_address_enforce\b;<a href="postconf.5.html#lmtp_bind_address_enforce">$&</a>;g; s;\blmtp_body_checks\b;<a href="postconf.5.html#lmtp_body_checks">$&</a>;g; s;\blmtp_cname_overrides_servername\b;<a href="postconf.5.html#lmtp_cname_overrides_servername">$&</a>;g; s;\blmtp_delivery_status_filter\b;<a href="postconf.5.html#lmtp_delivery_status_filter">$&</a>;g; @@ -224,6 +227,8 @@ while (<>) { s;\blmtp_mime_header_checks\b;<a href="postconf.5.html#lmtp_mime_header_checks">$&</a>;g; s;\blmtp_nested_header_checks\b;<a href="postconf.5.html#lmtp_nested_header_checks">$&</a>;g; s;\blmtp_per_record_deadline\b;<a href="postconf.5.html#lmtp_per_record_deadline">$&</a>;g; + s;\blmtp_per_request_deadline\b;<a href="postconf.5.html#lmtp_per_request_deadline">$&</a>;g; + s;\blmtp_min_data_rate\b;<a href="postconf.5.html#lmtp_min_data_rate">$&</a>;g; s;\blmtp_reply_filter\b;<a href="postconf.5.html#lmtp_reply_filter">$&</a>;g; s;\blmtp_sasl_password_maps\b;<a href="postconf.5.html#lmtp_sasl_password_maps">$&</a>;g; s;\blmtp_send_dummy_mail_auth\b;<a href="postconf.5.html#lmtp_send_dummy_mail_auth">$&</a>;g; @@ -268,6 +273,7 @@ while (<>) { s;\blmtp_tls_loglevel\b;<a href="postconf.5.html#lmtp_tls_loglevel">$&</a>;g; s;\blmtp_tls_session_cache_database\b;<a href="postconf.5.html#lmtp_tls_session_cache_database">$&</a>;g; s;\blmtp_tls_session_cache_timeout\b;<a href="postconf.5.html#lmtp_tls_session_cache_timeout">$&</a>;g; + s;\blmtp_tls_wrappermode\b;<a href="postconf.5.html#lmtp_tls_wrappermode">$&</a>;g; s;\blmtp_generic_maps\b;<a href="postconf.5.html#lmtp_generic_maps">$&</a>;g; s;\blmtp_pix_workaround_threshold_time\b;<a href="postconf.5.html#lmtp_pix_workaround_threshold_time">$&</a>;g; s;\blmtp_pix_workaround_delay_time\b;<a href="postconf.5.html#lmtp_pix_workaround_delay_time">$&</a>;g; @@ -395,12 +401,12 @@ while (<>) { s;\bqmqpd_authorized_clients\b;<a href="postconf.5.html#qmqpd_authorized_clients">$&</a>;g; s;\bservice_name\b;<a href="postconf.5.html#service_name">$&</a>;g; - s;\bdefault_desti[-</Bb>]*\n* *[<Bb>]*na[-</Bb>]*\n* *[<Bb>]*tion_concur[-</Bb>]*\n* *[<Bb>]*rency_negative_feedback\b;<a href="postconf.5.html#default_destination_concurrency_negative_feedback">$&</a>;g; - s;\bdefault_desti[-</Bb>]*\n* *[<Bb>]*na[-</Bb>]*\n* *[<Bb>]*tion_concur[-</Bb>]*\n* *[<Bb>]*rency_positive_feedback\b;<a href="postconf.5.html#default_destination_concurrency_positive_feedback">$&</a>;g; - s;\bdefault_desti[-</Bb>]*\n* *[<Bb>]*na[-</Bb>]*\n* *[<Bb>]*tion_con[-</Bb>]*\n* *[<Bb>]*currency_failed_cohort_limit\b;<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">$&</a>;g; + s;\bdefault_desti[-</Bb>]*\n* *[<Bb>]*na[-</Bb>]*\n* *[<Bb>]*tion_con[-</Bb>]*\n* *[<Bb>]*cur[-</Bb>]*\n* *[<Bb>]*rency_negative_feedback\b;<a href="postconf.5.html#default_destination_concurrency_negative_feedback">$&</a>;g; + s;\bdefault_desti[-</Bb>]*\n* *[<Bb>]*na[-</Bb>]*\n* *[<Bb>]*tion_con[-</Bb>]*\n* *[<Bb>]*cur[-</Bb>]*\n* *[<Bb>]*rency_positive_feedback\b;<a href="postconf.5.html#default_destination_concurrency_positive_feedback">$&</a>;g; + s;\bdefault_desti[-</Bb>]*\n* *[<Bb>]*na[-</Bb>]*\n* *[<Bb>]*tion_con[-</Bb>]*\n* *[<Bb>]*cur[-</Bb>]*\n* *[<Bb>]*rency_failed_cohort_limit\b;<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">$&</a>;g; s;\bdestination_concurrency_feedback_debug\b;<a href="postconf.5.html#destination_concurrency_feedback_debug">$&</a>;g; s;\bdefault_destina[-</Bb>]*\n* *[<Bb>]*tion_rate_delay\b;<a href="postconf.5.html#default_destination_rate_delay">$&</a>;g; - s;\bdefault_trans[-<\/bB>]*\n*[ <bB>]*port_rate_delay\b;<a href="postconf.5.html#default_transport_rate_delay">$&</a>;g; + s;\bdefault_trans[-<\/bB>]*\n*[ <bB>]*port_rate_de[-<\/bB>]*\n*[ <bB>]*lay\b;<a href="postconf.5.html#default_transport_rate_delay">$&</a>;g; s;\bmeta_directory\b;<a href="postconf.5.html#meta_directory">$&</a>;g; s;\bqmqpd_client_port_logging\b;<a href="postconf.5.html#qmqpd_client_port_logging">$&</a>;g; @@ -459,6 +465,7 @@ while (<>) { s;\bsmtp_always_send_ehlo\b;<a href="postconf.5.html#smtp_always_send_ehlo">$&</a>;g; s;\bsmtp_bind_address\b;<a href="postconf.5.html#smtp_bind_address">$&</a>;g; s;\bsmtp_bind_address6\b;<a href="postconf.5.html#smtp_bind_address6">$&</a>;g; + s;\bsmtp_bind_address_enforce\b;<a href="postconf.5.html#smtp_bind_address_enforce">$&</a>;g; s;\bsmtp_cname_overrides_servername\b;<a href="postconf.5.html#smtp_cname_overrides_servername">$&</a>;g; s;\bsmtp_connect_timeout\b;<a href="postconf.5.html#smtp_connect_timeout">$&</a>;g; @@ -572,8 +579,9 @@ while (<>) { s;\bsmtpd_proxy_timeout\b;<a href="postconf.5.html#smtpd_proxy_timeout">$&</a>;g; s;\bsmtpd_proxy_options\b;<a href="postconf.5.html#smtpd_proxy_options">$&</a>;g; s;\bsmtpd_recip[-</bB>]*\n* *[<bB>]*ient_limit\b;<a href="postconf.5.html#smtpd_recipient_limit">$&</a>;g; - s;\bsmtpd_recip[-</bB>]*\n* *[<bB>]*ient_restric[-</bB>]*\n* *[<bB>]*tions\b;<a href="postconf.5.html#smtpd_recipient_restrictions">$&</a>;g; + s;\bsmtpd_recip[-</bB>]*\n* *[<bB>]*i[-</bB>]*\n* *[<bB>]*ent_restric[-</bB>]*\n* *[<bB>]*tions\b;<a href="postconf.5.html#smtpd_recipient_restrictions">$&</a>;g; s;\bsmtpd_relay_restrictions\b;<a href="postconf.5.html#smtpd_relay_restrictions">$&</a>;g; + s;\bsmtpd_relay_before_recipient_restrictions\b;<a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">$&</a>;g; s;\bsmtpd_reject_unlisted_recip[-</bB>]*\n* *[<bB>]*ient\b;<a href="postconf.5.html#smtpd_reject_unlisted_recipient">$&</a>;g; s;\bsmtpd_reject_unlisted_sender\b;<a href="postconf.5.html#smtpd_reject_unlisted_sender">$&</a>;g; s;\bsmtpd_restriction_classes\b;<a href="postconf.5.html#smtpd_restriction_classes">$&</a>;g; @@ -693,13 +701,19 @@ while (<>) { s;\bsmtp_reply_filter\b;<a href="postconf.5.html#smtp_reply_filter">$&</a>;g; s;\bsmtp_address_preference\b;<a href="postconf.5.html#smtp_address_preference">$&</a>;g; s;\bsmtp_per_record_deadline\b;<a href="postconf.5.html#smtp_per_record_deadline">$&</a>;g; + s;\bsmtp_per_request_deadline\b;<a href="postconf.5.html#smtp_per_request_deadline">$&</a>;g; + s;\bsmtp_min_data_rate\b;<a href="postconf.5.html#smtp_min_data_rate">$&</a>;g; s;\bsmtp_send_dummy_mail_auth\b;<a href="postconf.5.html#smtp_send_dummy_mail_auth">$&</a>;g; s;\bsmtp_balance_inet_protocols\b;<a href="postconf.5.html#smtp_balance_inet_protocols">$&</a>;g; + s;\binfo_log_address_format\b;<a href="postconf.5.html#info_log_address_format">$&</a>;g; + s;\bdnssec_probe\b;<a href="postconf.5.html#dnssec_probe">$&</a>;g; s;\bsmtp_tls_connection_reuse\b;<a href="postconf.5.html#smtp_tls_connection_reuse">$&</a>;g; s;\blmtp_tls_connection_reuse\b;<a href="postconf.5.html#lmtp_tls_connection_reuse">$&</a>;g; s;\bsmtpd_enforce_tls\b;<a href="postconf.5.html#smtpd_enforce_tls">$&</a>;g; s;\bsmtpd_sasl_tls_security_options\b;<a href="postconf.5.html#smtpd_sasl_tls_security_options">$&</a>;g; s;\bsmtpd_sasl_type\b;<a href="postconf.5.html#smtpd_sasl_type">$&</a>;g; + s;\bsmtpd_sasl_mechanism_filter\b;<a href="postconf.5.html#smtpd_sasl_mechanism_filter">$&</a>;g; + s;\bsmtpd_sasl_service\b;<a href="postconf.5.html#smtpd_sasl_service">$&</a>;g; s;\bsmtpd_start[-</bB>]*\n* *[<bB>]*tls_timeout\b;<a href="postconf.5.html#smtpd_starttls_timeout">$&</a>;g; s;\bsmtpd_tls_CAfile\b;<a href="postconf.5.html#smtpd_tls_CAfile">$&</a>;g; s;\bsmtpd_tls_CApath\b;<a href="postconf.5.html#smtpd_tls_CApath">$&</a>;g; @@ -736,6 +750,8 @@ while (<>) { s;\bsmtpd_reject_footer\b;<a href="postconf.5.html#smtpd_reject_footer">$&</a>;g; s;\bsmtpd_reject_footer_maps\b;<a href="postconf.5.html#smtpd_reject_footer_maps">$&</a>;g; s;\bsmtpd_per_record_deadline\b;<a href="postconf.5.html#smtpd_per_record_deadline">$&</a>;g; + s;\bsmtpd_per_request_deadline\b;<a href="postconf.5.html#smtpd_per_request_deadline">$&</a>;g; + s;\bsmtpd_min_data_rate\b;<a href="postconf.5.html#smtpd_min_data_rate">$&</a>;g; s;\bsmtpd_upstream_proxy_protocol\b;<a href="postconf.5.html#smtpd_upstream_proxy_protocol">$&</a>;g; s;\bsmtpd_upstream_proxy_timeout\b;<a href="postconf.5.html#smtpd_upstream_proxy_timeout">$&</a>;g; s;\btls_daemon_random_bytes\b;<a href="postconf.5.html#tls_daemon_random_bytes">$&</a>;g; @@ -757,7 +773,7 @@ while (<>) { s;\btls_preempt_cipherlist\b;<a href="postconf.5.html#tls_preempt_cipherlist">$&</a>;g; s;\btls_disable_workarounds\b;<a href="postconf.5.html#tls_disable_workarounds">$&</a>;g; s;\btls_append_default_CA\b;<a href="postconf.5.html#tls_append_default_CA">$&</a>;g; - s;\btls_legacy_public_key_fingerprints\b;<a href="postconf.5.html#tls_legacy_public_key_fingerprint">$&</a>;g; + s;\btls_legacy_public_key_fingerprints\b;<a href="postconf.5.html#tls_legacy_public_key_fingerprints">$&</a>;g; s;\btls_dane_digests\b;<a href="postconf.5.html#tls_dane_digests">$&</a>;g; s;\btls_wildcard_matches_multiple_labels\b;<a href="postconf.5.html#tls_wildcard_matches_multiple_labels">$&</a>;g; s;\btls_session_ticket_cipher\b;<a href="postconf.5.html#tls_session_ticket_cipher">$&</a>;g; @@ -770,26 +786,30 @@ while (<>) { s;\bfrozen_delivered_to\b;<a href="postconf.5.html#frozen_delivered_to">$&</a>;g; s;\breset_owner_alias\b;<a href="postconf.5.html#reset_owner_alias">$&</a>;g; s;\benable_long_queue_ids\b;<a href="postconf.5.html#enable_long_queue_ids">$&</a>;g; + s;\benable_threaded_bounces\b;<a href="postconf.5.html#enable_threaded_bounces">$&</a>;g; + s;\bknown_tcp_ports\b;<a href="postconf.5.html#known_tcp_ports">$&</a>;g; # Transport-dependent magical parameters. - - s;(<i>transport</i>)(<b>)?(_destination_concurrency_failed_cohort_limit)\b;$2<a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_destination_concurrency_negative_feedback)\b;$2<a href="postconf.5.html#transport_destination_concurrency_negative_feedback">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_destination_concurrency_positive_feedback)\b;$2<a href="postconf.5.html#transport_destination_concurrency_positive_feedback">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_delivery_slot_cost)\b;$2<a href="postconf.5.html#transport_delivery_slot_cost">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_delivery_slot_discount)\b;$2<a href="postconf.5.html#transport_delivery_slot_discount">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_delivery_slot_loan)\b;$2<a href="postconf.5.html#transport_delivery_slot_loan">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_destination_concurrency_limit)\b;$2<a href="postconf.5.html#transport_destination_concurrency_limit">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_destination_recipient_limit)\b;$2<a href="postconf.5.html#transport_destination_recipient_limit">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_extra_recipient_limit)\b;$2<a href="postconf.5.html#transport_extra_recipient_limit">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_initial_destination_concurrency)\b;$2<a href="postconf.5.html#transport_initial_destination_concurrency">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_minimum_delivery_slots)\b;$2<a href="postconf.5.html#transport_minimum_delivery_slots">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_recipient_limit)\b;$2<a href="postconf.5.html#transport_recipient_limit">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_recipient_refill_delay)\b;$2<a href="postconf.5.html#transport_recipient_refill_delay">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_recipient_refill_limit)\b;$2<a href="postconf.5.html#transport_recipient_refill_limit">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_time_limit)\b;$2<a href="postconf.5.html#transport_time_limit">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_destination_rate_delay)\b;$2<a href="postconf.5.html#transport_destination_rate_delay">$1$3</a>;g; - s;(<i>transport</i>)(<b>)?(_transport_rate_delay)\b;$2<a href="postconf.5.html#transport_transport_rate_delay">$1$3</a>;g; + # Note: Accept non-italic "transport" prefix for content that has been + # converted from troff in C sources. Tooling doesn't support bold+italic. + + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_destination_concurrency_failed_cohort_limit)\b;$2<a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_destination_concurrency_negative_feedback)\b;$2<a href="postconf.5.html#transport_destination_concurrency_negative_feedback">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_destination_concurrency_positive_feedback)\b;$2<a href="postconf.5.html#transport_destination_concurrency_positive_feedback">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_delivery_slot_cost)\b;$2<a href="postconf.5.html#transport_delivery_slot_cost">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_delivery_slot_discount)\b;$2<a href="postconf.5.html#transport_delivery_slot_discount">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_delivery_slot_loan)\b;$2<a href="postconf.5.html#transport_delivery_slot_loan">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_destination_concurrency_limit)\b;$2<a href="postconf.5.html#transport_destination_concurrency_limit">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_destination_recipient_limit)\b;$2<a href="postconf.5.html#transport_destination_recipient_limit">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_extra_recipient_limit)\b;$2<a href="postconf.5.html#transport_extra_recipient_limit">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_initial_destination_concurrency)\b;$2<a href="postconf.5.html#transport_initial_destination_concurrency">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_minimum_delivery_slots)\b;$2<a href="postconf.5.html#transport_minimum_delivery_slots">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_recipient_limit)\b;$2<a href="postconf.5.html#transport_recipient_limit">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_recipient_refill_delay)\b;$2<a href="postconf.5.html#transport_recipient_refill_delay">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_recipient_refill_limit)\b;$2<a href="postconf.5.html#transport_recipient_refill_limit">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_time_limit)\b;$2<a href="postconf.5.html#transport_time_limit">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_destination_rate_delay)\b;$2<a href="postconf.5.html#transport_destination_rate_delay">$1$3</a>;g; + s;((?:<i>)?transport(?:</i>)?)(<b>)?(_transport_rate_delay)\b;$2<a href="postconf.5.html#transport_transport_rate_delay">$1$3</a>;g; # Undo hyperlinks of manual pages with the same name as parameters. @@ -877,6 +897,7 @@ while (<>) { s/[<bB>]*vir[-<\/bB>]*\n*[ <bB>]*tual[<\/bB>]*\(8\)/<a href="virtual.8.html">$&<\/a>/g; s/[<bB>]*cidr_ta[-<\/bB>]*\n*[ <bB>]*ble[<\/bB>]*\(5\)/<a href="cidr_table.5.html">$&<\/a>/g; s/[<bB>]*tcp_ta[-<\/bB>]*\n*[ <bB>]*ble[<\/bB>]*\(5\)/<a href="tcp_table.5.html">$&<\/a>/g; + # Workaround... s/<b><a href="postconf.5.html#body_checks">body_checks<\/a><\/b>\(5\)/<b>body_checks<\/b>(5)/; s/<b><a href="postconf.5.html#header_checks">header_checks<\/a><\/b>\(5\)/<b>header_checks<\/b>(5)/; @@ -1047,8 +1068,6 @@ while (<>) { s;\bpostscreen_pipelining_ttl\b;<a href="postconf.5.html#postscreen_pipelining_ttl">$&</a>;g; s;\bpostscreen_watchdog_timeout\b;<a href="postconf.5.html#postscreen_watchdog_timeout">$&</a>;g; s;\bpostscreen_access_list\b;<a href="postconf.5.html#postscreen_access_list">$&</a>;g; - s;\bpostscreen_whitelist_networks\b;<a href="postconf.5.html#postscreen_whitelist_networks">$&</a>;g; - s;\bpostscreen_black[-</bB>]*\n*[ <bB>]*list_networks\b;<a href="postconf.5.html#postscreen_blacklist_networks">$&</a>;g; s;\bpostscreen_black[-</bB>]*\n*[ <bB>]*list_action\b;<a href="postconf.5.html#postscreen_blacklist_action">$&</a>;g; s;\bpostscreen_client_connection_count_limit\b;<a href="postconf.5.html#postscreen_client_connection_count_limit">$&</a>;g; s;\bpostscreen_tls_security_level\b;<a href="postconf.5.html#postscreen_tls_security_level">$&</a>;g; @@ -1063,6 +1082,10 @@ while (<>) { s;\bpostscreen_whitelist_interfaces\b;<a href="postconf.5.html#postscreen_whitelist_interfaces">$&</a>;g; s;\bpostscreen_upstream_proxy_protocol\b;<a href="postconf.5.html#postscreen_upstream_proxy_protocol">$&</a>;g; s;\bpostscreen_upstream_proxy_timeout\b;<a href="postconf.5.html#postscreen_upstream_proxy_timeout">$&</a>;g; + s;\bpostscreen_allowlist_interfaces\b;<a href="postconf.5.html#postscreen_allowlist_interfaces">$&</a>;g; + s;\bpostscreen_denylist_action\b;<a href="postconf.5.html#postscreen_denylist_action">$&</a>;g; + s;\bpostscreen_dnsbl_allowlist_threshold\b;<a href="postconf.5.html#postscreen_dnsbl_allowlist_threshold">$&</a>;g; + s;\brespectful_logging\b;<a href="postconf.5.html#respectful_logging">$&</a>;g; s;\btlsproxy_watchdog_timeout\b;<a href="postconf.5.html#tlsproxy_watchdog_timeout">$&</a>;g; s;\btlsproxy_enforce_tls\b;<a href="postconf.5.html#tlsproxy_enforce_tls">$&</a>;g; @@ -1107,8 +1130,10 @@ while (<>) { s;\btlsproxy_client_loglevel_parameter\b;<a href="postconf.5.html#tlsproxy_client_loglevel_parameter">$&</a>;g; s;\btlsproxy_client_scert_verifydepth\b;<a href="postconf.5.html#tlsproxy_client_scert_verifydepth">$&</a>;g; + s;\btlsproxy_client_level\b;<a href="postconf.5.html#tlsproxy_client_level">$&</a>;g; s;\btlsproxy_client_security_level\b;<a href="postconf.5.html#tlsproxy_client_security_level">$&</a>;g; s;\btlsproxy_client_per_site\b;<a href="postconf.5.html#tlsproxy_client_per_site">$&</a>;g; + s;\btlsproxy_client_policy\b;<a href="postconf.5.html#tlsproxy_client_policy">$&</a>;g; s;\btlsproxy_client_policy_maps\b;<a href="postconf.5.html#tlsproxy_client_policy_maps">$&</a>;g; s;\btlsproxy_client_use_tls\b;<a href="postconf.5.html#tlsproxy_client_use_tls">$&</a>;g; s;\btlsproxy_client_enforce_tls\b;<a href="postconf.5.html#tlsproxy_client_enforce_tls">$&</a>;g; @@ -1128,6 +1153,9 @@ while (<>) { s;\bpostlog_service_name\b;<a href="postconf.5.html#postlog_service_name">$&</a>;g; s;\bpostlogd_watchdog_timeout\b;<a href="postconf.5.html#postlogd_watchdog_timeout">$&</a>;g; + s;\blocal_login_sender_maps\b;<a href="postconf.5.html#local_login_sender_maps">$&</a>;g; + s;\bempty_address_local_login_sender_maps_lookup_key\b;<a href="postconf.5.html#empty_address_local_login_sender_maps_lookup_key">$&</a>;g; + # Service-defined parameters... s;\bpolicy_time_limit\b;<a href="postconf.5.html#transport_time_limit">$&</a>;g; @@ -1139,9 +1167,9 @@ while (<>) { # Hyperlink URLs and RFC documents - s/(http:\/\/[^ ,"\(\)]*[^ ,"\(\):;!?.])/<a href="$1">$1<\/a>/; + if (!/href=/) { s/(https?:\/\/[^ ,"\(\)]*[^ ,"\(\):;!?.])/<a href="$1">$1<\/a>/; } s/(ftp:\/\/[^ ,"\(\)]*[^ ,"\(\):;!?.])/<a href="$1">$1<\/a>/; - s/\bRFC\s*([1-9]\d*)/<a href="http:\/\/tools.ietf.org\/html\/rfc$1">$&<\/a>/g; + s/\bRFC\s*([1-9]\d*)/<a href="https:\/\/tools.ietf.org\/html\/rfc$1">$&<\/a>/g; # Split README/RFC/parameter/restriction hyperlinks that span line breaks @@ -1160,30 +1188,32 @@ while (<>) { $printit = 0; next LINE; } - s/canonical domains*/<a href="VIRTUAL_README.html#canonical">$&<\/a>/; - s/hosted domains*/<a href="VIRTUAL_README.html#canonical">$&<\/a>/; - #s/other domains*/<a href="VIRTUAL_README.html#canonical">&<\/a>/ - s/virtual alias example/<a href="VIRTUAL_README.html#virtual_alias">$&<\/a>/; - s/virtual mailbox example/<a href="VIRTUAL_README.html#virtual_mailbox">$&<\/a>/; - s/local domains*/<a href="ADDRESS_CLASS_README.html#local_domain_class">$&<\/a>/; - s/virtual alias domains*/<a href="ADDRESS_CLASS_README.html#virtual_alias_class">$&<\/a>/; - s/virtual ALIAS domains*/<a href="ADDRESS_CLASS_README.html#virtual_alias_class">$&<\/a>/; - s/virtual mailbox domains*/<a href="ADDRESS_CLASS_README.html#virtual_mailbox_class">$&<\/a>/; - s/virtual MAILBOX domains*/<a href="ADDRESS_CLASS_README.html#virtual_mailbox_class">$&<\/a>/; - s/relay domains*/<a href="ADDRESS_CLASS_README.html#relay_domain_class">$&<\/a>/; - s/default domains*/<a href="ADDRESS_CLASS_README.html#default_domain_class">$&<\/a>/; - s/mydestination domains*/<a href="ADDRESS_CLASS_README.html#local_domain_class">$&<\/a>/; - s/\b"*maildrop"* *queues*\b/<a href="QSHAPE_README.html#maildrop_queue">$&<\/a>/; - s/\b("*maildrop"*),/<a href="QSHAPE_README.html#maildrop_queue">$1<\/a>,/; - s/\b("*incoming"*) and\b/<a href="QSHAPE_README.html#incoming_queue">$1<\/a> and/; - s/\b("*incoming"*) or\b/<a href="QSHAPE_README.html#incoming_queue">$1<\/a> or/; - s/\b"*incoming"* *queues*\b/<a href="QSHAPE_README.html#incoming_queue">$&<\/a>/; - s/<b> *incoming *<\/b> *queues*\b/<a href="QSHAPE_README.html#incoming_queue">$&<\/a>/; - s/\b"*active"* *queues*\b/<a href="QSHAPE_README.html#active_queue">$&<\/a>/; - s/\b"*deferred"* *queues*\b/<a href="QSHAPE_README.html#deferred_queue">$&<\/a>/; - s/\b"*hold"* *queues*\b/<a href="QSHAPE_README.html#hold_queue">$&<\/a>/; - s/\b("*hold"*),/<a href="QSHAPE_README.html#hold_queue">$1<\/a>,/; - s/\b(postfix *tls)\b/<a href="postfix-tls.1.html">$1<\/a>/; + s/canonical domains*/<a href="VIRTUAL_README.html#canonical">$&<\/a>/g; + s/hosted domains*/<a href="VIRTUAL_README.html#canonical">$&<\/a>/g; + #s/other domains*/<a href="VIRTUAL_README.html#canonical">&<\/a>/g; + s/virtual alias example/<a href="VIRTUAL_README.html#virtual_alias">$&<\/a>/g; + s/virtual mailbox example/<a href="VIRTUAL_README.html#virtual_mailbox">$&<\/a>/g; + s/local domains*/<a href="ADDRESS_CLASS_README.html#local_domain_class">$&<\/a>/g; + s/virtual alias domains*/<a href="ADDRESS_CLASS_README.html#virtual_alias_class">$&<\/a>/g; + s/virtual ALIAS domains*/<a href="ADDRESS_CLASS_README.html#virtual_alias_class">$&<\/a>/g; + s/virtual mailbox domains*/<a href="ADDRESS_CLASS_README.html#virtual_mailbox_class">$&<\/a>/g; + s/virtual MAILBOX domains*/<a href="ADDRESS_CLASS_README.html#virtual_mailbox_class">$&<\/a>/g; + s/relay domains*/<a href="ADDRESS_CLASS_README.html#relay_domain_class">$&<\/a>/g; + s/default domains*/<a href="ADDRESS_CLASS_README.html#default_domain_class">$&<\/a>/g; + s/mydestination domains*/<a href="ADDRESS_CLASS_README.html#local_domain_class">$&<\/a>/g; + s/\b"*maildrop"* *queues*\b/<a href="QSHAPE_README.html#maildrop_queue">$&<\/a>/g; + s/\b("*maildrop"*),/<a href="QSHAPE_README.html#maildrop_queue">$1<\/a>,/g; + s/\b(?<!\/)("*incoming"*),/<a href="QSHAPE_README.html#incoming_queue">$1<\/a>,/g; + s/\b("*incoming"*) and\b/<a href="QSHAPE_README.html#incoming_queue">$1<\/a> and/g; + s/\b("*incoming"*) or\b/<a href="QSHAPE_README.html#incoming_queue">$1<\/a> or/g; + s/\b"*incoming"* *queues*\b/<a href="QSHAPE_README.html#incoming_queue">$&<\/a>/g; + s/<b> *incoming *<\/b> *queues*\b/<a href="QSHAPE_README.html#incoming_queue">$&<\/a>/g; + s/\b("*active"*) and\b/<a href="QSHAPE_README.html#active_queue">$1<\/a> and/g; + s/\b"*active"* *queues*\b/<a href="QSHAPE_README.html#active_queue">$&<\/a>/ig; + s/\b"*deferred"* *queues*\b/<a href="QSHAPE_README.html#deferred_queue">$&<\/a>/g; + s/\b"*hold"* *queues*\b/<a href="QSHAPE_README.html#hold_queue">$&<\/a>/g; + s/\b("*hold"*),/<a href="QSHAPE_README.html#hold_queue">$1<\/a>,/g; + s/\b(postfix *tls)\b/<a href="postfix-tls.1.html">$1<\/a>/g; # Hyperlink map types. @@ -1195,7 +1225,7 @@ while (<>) { s/\b(fail):/<a href="DATABASE_README.html#types">$1<\/a>:/g; s/\b(hash):/<a href="DATABASE_README.html#types">$1<\/a>:/g; s/\b(internal):/<a href="DATABASE_README.html#types">$1<\/a>:/g; - s/\b(ldap):/<a href="ldap_table.5.html">$1<\/a>:/g; + s/\b(ldap[is]?):/<a href="ldap_table.5.html">$1<\/a>:/g; s/\b(lmdb):/<a href="lmdb_table.5.html">$1<\/a>:/g; s/\b(memcache):/<a href="memcache_table.5.html">$1<\/a>:/g; s/\b(mysql):/<a href="mysql_table.5.html">$1<\/a>:/g; @@ -1225,8 +1255,9 @@ while (<>) { s/([^\/])\b(virtual):/$1<a href="virtual.8.html">$2<\/a>:/g; # Database library dependencies. + # Note: Exclude AUXLIBS_SDBM because there is no SDBM_README. - s/\b(AUXLIBS_)([A-Z]+)\b/<a href="$2_README.html">$1$2<\/a>/g; + s/\b(AUXLIBS_(?!SDBM))([A-Z]+)\b/<a href="$2_README.html">$1$2<\/a>/g; } continue { if ($printit) diff --git a/external/ibm-public/postfix/dist/mantools/readme2html b/external/ibm-public/postfix/dist/mantools/readme2html index 64b51114e25..7b4dd444c76 100755 --- a/external/ibm-public/postfix/dist/mantools/readme2html +++ b/external/ibm-public/postfix/dist/mantools/readme2html @@ -11,7 +11,7 @@ echo '<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" <title>Title Here</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/mantools/srctoman b/external/ibm-public/postfix/dist/mantools/srctoman index 9ea45cd8d60..9102201c67d 100755 --- a/external/ibm-public/postfix/dist/mantools/srctoman +++ b/external/ibm-public/postfix/dist/mantools/srctoman @@ -103,6 +103,9 @@ do /^\./{ s/\([^ ]\)-/\1\\-/g } + /^'"'"'/{ + s/^/\\\&/ + } /^[^.]/{ s/-/\\-/g } diff --git a/external/ibm-public/postfix/dist/proto/ADDRESS_CLASS_README.html b/external/ibm-public/postfix/dist/proto/ADDRESS_CLASS_README.html index ac9ac07f55a..ca4bb672258 100644 --- a/external/ibm-public/postfix/dist/proto/ADDRESS_CLASS_README.html +++ b/external/ibm-public/postfix/dist/proto/ADDRESS_CLASS_README.html @@ -7,7 +7,7 @@ <title>Postfix Address Classes </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html b/external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html index 82f870c910e..8c60b765a64 100644 --- a/external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html +++ b/external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html @@ -7,7 +7,7 @@ <title>Postfix Address Rewriting </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -493,8 +493,8 @@ document. </p> </dd> Rewrite "user@host" to "user@host.$mydomain" </dt> <dd> <p> This feature is controlled by the boolean append_dot_mydomain -parameter (default: yes). The purpose is to get consistent treatment -of different forms of the same hostname. </p> +parameter (default: Postfix ≥ 3.0: no, Postfix < 3.0: yes). The purpose +is to get consistent treatment of different forms of the same hostname. </p> <p> NOTE: Postfix versions 2.2 and later rewrite message headers from remote SMTP clients only if the client matches the diff --git a/external/ibm-public/postfix/dist/proto/BACKSCATTER_README.html b/external/ibm-public/postfix/dist/proto/BACKSCATTER_README.html index 855e4aa430e..aae94309183 100644 --- a/external/ibm-public/postfix/dist/proto/BACKSCATTER_README.html +++ b/external/ibm-public/postfix/dist/proto/BACKSCATTER_README.html @@ -7,7 +7,7 @@ <title>Postfix Backscatter Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -302,7 +302,7 @@ many users configure their email addresses as <i>username@example.com</i>, messages with DSN turned on will trigger the REJECT action in the previous section. </p> -<p> If you have such clients then you can to exclude their Message-ID +<p> If you have such clients then you can exclude their Message-ID strings with the two "<tt>Message-ID:.* <!&!</tt>" patterns that are shown in the previous section. Otherwise you will not be able to use the two backscatter rules to stop forged Message ID @@ -382,7 +382,8 @@ above techniques to recognize forgeries. </p> because there is a lot of variation in report formats. The following is only a small example of message header patterns. For a large collection of header and body patterns that recognize virus -notification email, see http://www.dkuug.dk/keld/virus/ +notification email, see +https://web.archive.org/web/20100317123907/http://std.dkuug.dk/keld/virus/ or http://www.t29.dk/antiantivirus.txt. </p> <blockquote> diff --git a/external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html b/external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html index f8d94b02c24..531dbf9d8e0 100644 --- a/external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html +++ b/external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html @@ -7,7 +7,7 @@ <title> Postfix Basic Configuration </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -264,7 +264,7 @@ clients that send mail from outside an authorized network block. This is explained in the SASL_README and TLS_README documents. </p> <p> IMPORTANT: If your machine is connected to a wide area network -then the "mynetworks_style = host" setting may be too friendly. </p> +then the "mynetworks_style = subnet" setting may be too friendly. </p> <p> Examples (specify only one of the following): </p> @@ -286,13 +286,15 @@ parameter value. <ul> -<li> <p> Specify "mynetworks_style = host" when Postfix should -forward mail from only the local machine. </p> +<li> <p> Specify "mynetworks_style = host" (the default when +compatibility_level ≥ 2) when Postfix should forward mail from +only the local machine. </p> -<li> <p> Specify "mynetworks_style = subnet" (the default) when -Postfix should forward mail from SMTP clients in the same IP -subnetworks as the local machine. On Linux, this works correctly -only with interfaces specified with the "ifconfig" command. </p> +<li> <p> Specify "mynetworks_style = subnet" (the default when +compatibility_level < 2) when Postfix should forward mail from +SMTP clients in the same IP subnetworks as the local machine. +On Linux, this works correctly only with interfaces specified +with the "ifconfig" or "ip" command. </p> <li> <p> Specify "mynetworks_style = class" when Postfix should forward mail from SMTP clients in the same IP class A/B/C networks diff --git a/external/ibm-public/postfix/dist/proto/BDAT_README.html b/external/ibm-public/postfix/dist/proto/BDAT_README.html index 60f0d1fa1b0..1891c7b3001 100644 --- a/external/ibm-public/postfix/dist/proto/BDAT_README.html +++ b/external/ibm-public/postfix/dist/proto/BDAT_README.html @@ -7,7 +7,7 @@ <title>Postfix BDAT (CHUNKING) support</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -51,7 +51,7 @@ globally: </p> # The logging alternative: smtpd_discard_ehlo_keywords = chunking # The non-logging alternative: - smtpd_discard_ehlo_keywords = chunking, silent_discard + smtpd_discard_ehlo_keywords = chunking, silent-discard </pre> </blockquote> @@ -170,7 +170,7 @@ then turn off Postfix's CHUNKING announcement as described above. <p> In RFC 4468, the authors write that a client may pipeline commands, and that after sending BURL LAST or BDAT LAST, a client must wait for the server's response. But as this text does not -appear in RFC 3030 which defines BDAT, is it a useless restriction +appear in RFC 3030 which defines BDAT, it is a useless restriction that Postfix will not enforce. </p> </body> diff --git a/external/ibm-public/postfix/dist/proto/BUILTIN_FILTER_README.html b/external/ibm-public/postfix/dist/proto/BUILTIN_FILTER_README.html index 503b0aa9262..939fafb1555 100644 --- a/external/ibm-public/postfix/dist/proto/BUILTIN_FILTER_README.html +++ b/external/ibm-public/postfix/dist/proto/BUILTIN_FILTER_README.html @@ -7,7 +7,7 @@ <title>Postfix Built-in Content Inspection</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -458,8 +458,8 @@ of duplication. </p> Postfix versions do not support the receive_override_options feature. </p> -<p> If you are MX service provider and want to apply disable -head/body checks for some domains, you can configure ONE Postfix +<p> If you are an MX service provider and want to enable header/body +checks only for some domains, you can configure ONE Postfix instance with multiple SMTP server IP addresses in master.cf. Each address provides a different service. </p> diff --git a/external/ibm-public/postfix/dist/proto/CDB_README.html b/external/ibm-public/postfix/dist/proto/CDB_README.html index 352c6adeb9e..3fd09734c49 100644 --- a/external/ibm-public/postfix/dist/proto/CDB_README.html +++ b/external/ibm-public/postfix/dist/proto/CDB_README.html @@ -7,7 +7,7 @@ <title>Postfix CDB Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html b/external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html index 291979d982d..7020dbe2312 100644 --- a/external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html +++ b/external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html @@ -7,7 +7,7 @@ <title>Postfix Backwards-Compatibility Safety Net</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -50,7 +50,7 @@ permanent in main.cf or master.cf, before <a href="#turnoff">turning off the backwards-compatibility safety net</a> as described at the end of this document. </p> -<p> The following messages may be logged: </p> +<p> Logged with compatibility_level < 1: </p> <ul> @@ -60,8 +60,14 @@ default setting append_dot_mydomain=yes </a> </p> <li> <p> <a href="#chroot"> Using backwards-compatible default setting chroot=y</a> </p> +</ul> + +<p> Logged with compatibility_level < 2: </p> + +<ul> + <li><p> <a href="#relay_restrictions"> Using backwards-compatible -default setting smtpd_relay_restrictions = (empty)</a> </p> +default setting "smtpd_relay_restrictions = (empty)"</a> </p> <li> <p> <a href="#mynetworks_style"> Using backwards-compatible default setting mynetworks_style=subnet </a> </p> @@ -74,6 +80,27 @@ default setting smtputf8_enable=no</a> </p> </ul> +<p> Logged with compatibility_level < 3.6: </p> + +<ul> + +<li> <p> <a href="#smtpd_digest"> Using backwards-compatible +default setting smtpd_tls_fingerprint_digest=md5</a> </p> + +<li> <p> <a href="#smtp_digest"> Using backwards-compatible +default setting smtp_tls_fingerprint_digest=md5</a> </p> + +<li> <p> <a href="#smtp_digest"> Using backwards-compatible +default setting lmtp_tls_fingerprint_digest=md5</a> </p> + +<li> <p> <a href="#relay_before_rcpt"> Using backwards-compatible +default setting smtpd_relay_before_recipient_restrictions=no</a> </p> + +<li> <p> <a href="#respectful_logging"> Using backwards-compatible +default setting respectful_logging=no</a> </p> + +</ul> + <p> If such a message is logged in the context of a legitimate request, the system administrator should make the backwards-compatible setting permanent in main.cf or master.cf, as detailed in the @@ -218,7 +245,7 @@ setting mynetworks_style=subnet</a> </h2> <p> The mynetworks_style default value has changed from "subnet" to "host". This parameter is used to implement the "permit_mynetworks" -feature. The change could in unexpected 'access denied' errors after +feature. The change could cause unexpected 'access denied' errors after Postfix is updated from an older version. The backwards-compatibility safety net is designed to prevent such surprises. </p> @@ -327,7 +354,7 @@ explicit list of domain names. </p> <h2> <a name="smtputf8_enable"> Using backwards-compatible default setting smtputf8_enable=no</a> </h2> -<p> The smtputf8_enable default value has changed from "no" to "yes. +<p> The smtputf8_enable default value has changed from "no" to "yes". With the new "yes" setting, the Postfix SMTP server rejects non-ASCII addresses from clients that don't request SMTPUTF8 support, after Postfix is updated from an older version. The backwards-compatibility @@ -366,6 +393,167 @@ in main.cf: </pre> </blockquote> +<h2> <a name="smtpd_digest"> Using backwards-compatible +default setting smtpd_tls_fingerprint_digest=md5</a> </h2> + +<p> The smtpd_tls_fingerprint_digest default value has changed from +"md5" to "sha256". With the new "sha256" setting, the Postfix SMTP +server avoids using the deprecated "md5" algorithm and computes a more +secure digest of the client certificate. </p> + +<p> If you're using the default "md5" setting, or even an explicit +"sha1" (also deprecated) setting, you should consider switching to +"sha256". This will require updating any associated lookup table keys +with the "sha256" digests of the expected client certificate or public +key. </p> + +<p> As long as the smtpd_tls_fingerprint_digest parameter is left at its +implicit default value, and the compatibility_level setting is less than +3.6, Postfix logs a warning each time a client certificate or public key +fingerprint is (potentially) used for access control: </p> + +<blockquote> +<pre> +postfix/smtpd[27560]: using backwards-compatible default setting + smtpd_tls_fingerprint_digest=md5 to compute certificate fingerprints +</pre> +</blockquote> + +<p> Since any client certificate fingerprints are passed in policy service +lookups, and Postfix doesn't know whether the fingerprint will be used, the +warning may also be logged when policy lookups are performed for connections +that used a client certificate, even if the policy service does not in fact +examine the client certificate. To reduce the noise somewhat, such warnings +are issued at most once per smtpd(8) process instance. </p> + +<p> If you prefer to stick with "md5", you can suppress the warnings by +making that setting explicit. After addressing any other compatibility +warnings, you can <a href="#turnoff">update</a> your compatibility level. +</p> + +<blockquote> +<pre> +# <b>postconf smtpd_tls_fingerprint_digest=md5</b> +# <b>postfix reload</b> +</pre> +</blockquote> + +<h2> <a name="smtp_digest"> Using backwards-compatible +default setting smtp_tls_fingerprint_digest=md5</a> </h2> + +<p> The smtp_tls_fingerprint_digest and lmtp_tls_fingerprint_digest +default values have changed from "md5" to "sha256". With the new +"sha256" setting, the Postfix SMTP and LMTP client avoids using the +deprecated "md5" algorithm and computes a more secure digest of the +server certificate. </p> + +<p> If you're using the default "md5" setting, or even an explicit +"sha1" (also deprecated) setting, you should consider switching to +"sha256". This will require updating any "fingerprint" security level +policies in the TLS policy table to specify matching "sha256" digests of +the expected server certificates or public keys. </p> + +<p> As long as the smtp_tls_fingerprint_digest (or LMTP equivalent) +parameter is left at its implicit default value, and the +compatibility_level setting is less than 3.6, Postfix logs a warning each +time the "fingerprint" security level is used to specify matching "md5" +digests of trusted server certificates or public keys: </p> + +<blockquote> +<pre> +postfix/smtp[27560]: using backwards-compatible default setting + smtp_tls_fingerprint_digest=md5 to compute certificate fingerprints +</pre> +</blockquote> + +<p> If you prefer to stick with "md5", you can suppress the warnings by +making that setting explicit. After addressing any other compatibility +warnings, you can <a href="#turnoff">update</a> your compatibility level. +</p> + +<blockquote> +<pre> +# <b>postconf 'smtp_tls_fingerprint_digest = md5' \ + 'lmtp_tls_fingerprint_digest = md5' </b> +# <b>postfix reload</b> +</pre> +</blockquote> + +<h2> <a name="relay_before_rcpt"> Using backwards-compatible +default setting smtpd_relay_before_recipient_restrictions=no</a> </h2> + +<p> The smtpd_relay_before_recipient_restrictions feature was +introduced in Postfix version 3.6, to evaluate smtpd_relay_restrictions +before smtpd_recipient_restrictions. Historically, smtpd_relay_restrictions +was evaluated after smtpd_recipient_restrictions, contradicting +documented behavior. </p> + +<blockquote> <p> Background: smtpd_relay_restrictions is +primarily designed to enforce a mail relaying policy, while +smtpd_recipient_restrictions is primarily designed to enforce spam +blocking policy. Both are evaluated while replying to the RCPT TO +command, and both support the same features. </p> </blockquote> + +<p> To maintain compatibility with earlier versions, Postfix will +keep evaluating smtpd_recipient_restrictions before +smtpd_relay_restrictions, as long as the compatibility_level is +less than 3.6, and the smtpd_relay_before_recipient_restrictions +parameter is left at its implicit default setting. As a reminder, +Postfix may log the following message: </p> + +<blockquote> +<pre> +postfix/smtpd[54696]: using backwards-compatible default setting + smtpd_relay_before_recipient_restrictions=no to reject recipient + "user@example.com" from client "host.example.net[10.0.0.2]" +</pre> +</blockquote> + +<p> If Postfix should keep evaluating smtpd_recipient_restrictions +before smtpd_relay_restrictions, then the system +administrator should make the backwards-compatible setting +"smtpd_relay_before_recipient_restrictions=no" permanent in main.cf: </p> + +<blockquote> +<pre> +# <b> postconf smtpd_relay_before_recipient_restrictions=no </b> +# <b> postfix reload </b> +</pre> +</blockquote> + +<h2> <a name="respectful_logging"> Using backwards-compatible +default setting respectful_logging=no</a> </h2> + +<p> Postfix version 3.6 deprecates configuration parameter names and +logging that suggest white is better than black. Instead it prefers +'allowlist, 'denylist', and variations of those words. While the renamed +configuration parameters have backwards-compatible default values, +the changes in logging could affect logfile analysis tools. </p> + +<p> To avoid breaking existing logfile analysis tools, Postfix will keep +logging the deprecated form, as long as the respectful_logging parameter +is left at its implicit default value, and the compatibility_level +setting is less than 3.6. As a reminder, Postfix may log the following +when a remote SMTP client is allowlisted or denylisted: </p> + +<blockquote> +<pre> +postfix/postscreen[22642]: Using backwards-compatible default setting + respectful_logging=no for client [<i>address</i>]:<i>port</i> +</pre> +</blockquote> + +<p> If Postfix should keep logging the deprecated form, then the +system administrator should make the backwards-compatible setting +"respectful_logging = no" permanent in main.cf. + +<blockquote> +<pre> +# <b>postconf "respectful_logging = no"</b> +# <b>postfix reload</b> +</pre> +</blockquote> + <h2> <a name="turnoff">Turning off the backwards-compatibility safety net</a> </h2> <p> Backwards compatibility is turned off by updating the @@ -390,6 +578,17 @@ warning: To disable backwards compatibility use "postconf compatibility_level=<i <p> Sites that don't care about backwards compatibility may set "compatibility_level = 9999" at their own risk. </p> +<p> Starting with Postfix version 3.6, the compatibility level in +the above warning message is the Postfix version that introduced +the last incompatible change. The level is formatted as +<i>major.minor.patch</i>, where <i>patch</i> is usually omitted and +defaults to zero. Earlier compatibility levels are 0, 1 and 2. </p> + +<p> NOTE: Postfix 3.6 also introduces support for the "<level", +"<=level", and other operators to compare compatibility levels. +With the standard operators "<", "<=", etc., compatibility +level "3.10" would be smaller than "3.9" which is undesirable. </p> + </body> </html> diff --git a/external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html b/external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html index 7ffd7bb04db..bc2e34ed649 100644 --- a/external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html +++ b/external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html @@ -7,7 +7,7 @@ <title>Postfix Connection Cache </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -22,10 +22,6 @@ <p> This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later. </p> -<p> See <a href="TLS_README.html#client_tls_reuse">Client-side TLS -connection reuse</a> for how this connection cache is used to -implement multiple deliveries per TLS-encrypted connection. </p> - <p> Topics covered in this document: </p> <ul> @@ -49,8 +45,8 @@ you</a></h2> <p> With SMTP connection caching, Postfix can deliver multiple messages over the same SMTP connection. By default, Postfix 2.2 -reuses an SMTP connection automatically when a destination has -high volume of mail in the active queue. </p> +reuses a plaintext SMTP connection automatically when a destination has +high volume of mail in the active queue. </p> <p> SMTP Connection caching is a performance feature. Whether or not it actually improves performance depends on the conditions: </p> @@ -62,10 +58,15 @@ when delivering mail to a destination with multiple mail servers, because it can help Postfix to skip over a non-responding server. </p> +<li> <p> SMTP Connection caching can also help with receivers that +impose rate limits on new connections. </p> + <li> <p> Otherwise, the benefits of SMTP connection caching are minor: it eliminates the latency of the TCP handshake (SYN, SYN+ACK, ACK), plus the latency of the SMTP initial handshake (220 greeting, -EHLO command, EHLO response). +EHLO command, EHLO response). With TLS-encrypted connections, this +can save an additional two roundtrips that would otherwise be needed +to send STARTTLS and to resume a TLS session. </p> <li> <p> SMTP Connection caching gives no gains with respect to SMTP session tear-down. The Postfix smtp(8) client normally does @@ -90,7 +91,7 @@ architecture OVERVIEW document. </p> <p> The Postfix connection cache is shared among Postfix mail delivering processes. This maximizes the opportunity to reuse an -open connection. Other MTAs such as Sendmail or exim have a +open connection. Some MTAs such as Sendmail have a non-shared connection cache. Here, a connection can be reused only by the mail delivering process that creates the connection. To get the same performance improvement as with a shared connection cache, @@ -100,47 +101,84 @@ non-shared connections need to be kept open for a longer time. </p> maintains the shared connection cache. With Postfix version 2.2, only the smtp(8) client has support to access this cache. </p> +<p> When SMTP connection caching is enabled (see next section), the +smtp(8) client does not disconnect after a mail transaction, but +gives the connection to the scache(8) server which keeps the +connection open for a limited amount of time. </p> + +<p> After handing over the open connection to the scache(8) server, +the smtp(8) client continues with some other mail delivery request. +Meanwhile, any smtp(8) client process can ask the scache(8) server +for that cached connection and reuse it for mail delivery. </p> + <blockquote> <table> <tr> <td> </td> <td> <tt> /-- </tt> </td> <td align="center" colspan="3" bgcolor="#f0f0ff"> smtp(8) </td> <td colspan="2"> <tt> ---> </tt> Internet </td> </tr> +--> </tt> </td> <td> Internet </td> </tr> <tr> <td align="center" bgcolor="#f0f0ff"> qmgr(8) </td> <td> </td> -<td align="center" rowspan="3"> </td> <td align="center" -rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> <td> </td> +<td align="center" rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> </tr> + +<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" +colspan="4" bgcolor="#f0f0ff"> smtp(8) </td> <td align="left"> + </td> </tr> -<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" -colspan="2" bgcolor="#f0f0ff"> smtp(8) </td> <td align="left"> <tt> ---> </tt> Internet </td> </tr> - -<tr> <td colspan="3"> </td> <td align="center"><tt>^<br>|</tt></td> -<td> </td> </tr> +<tr> <td colspan="2"> </td> <td> </td> <td +align="center"><tt>^<br>|</tt></td> </tr> -<tr> <td colspan="3"> </td> <td align="center" colspan="3" +<tr> <td colspan="2"> </td> <td align="center" colspan="3" bgcolor="#f0f0ff"> scache(8) </td> </tr> </table> </blockquote> -<p> When SMTP connection caching is enabled (see next section), the -smtp(8) client does not disconnect after a mail transaction, but -gives the connection to the scache(8) server which keeps the -connection open for a limited amount of time. </p> +<p> With TLS connection reuse (Postfix 3.4 and later), the Postfix +smtp(8) client connects to a remote SMTP server and sends plaintext +EHLO and STARTTLS commands, then inserts a tlsproxy(8) process into +the connection as shown below. </p> -<p> After handing over the open connection to the scache(8) server, -the smtp(8) client continues with some other mail delivery request. -Meanwhile, any smtp(8) client process can ask the scache(8) server -for that cached connection and reuse it for mail delivery. </p> +<p> After delivering mail, the smtp(8) client hands over the open +smtp(8)-to-tlsproxy(8) connection to the scache(8) server, and +continues with some other mail delivery request. Meanwhile, any +smtp(8) client process can ask the scache(8) server for that cached +connection and reuse it for mail delivery. </p> + +<blockquote> + +<table> + +<tr> <td> </td> <td> <tt> /-- </tt> </td> <td align="center" +colspan="3" bgcolor="#f0f0ff"> smtp(8) </td> <td colspan="2"> <tt> +--> </tt> </td> <td align="center"bgcolor="#f0f0ff"> tlsproxy(8) +</td> <td> <tt> --> </tt> </td> <td> Internet </td> </tr> + +<tr> <td align="center" bgcolor="#f0f0ff"> qmgr(8) </td> <td> </td> +<td align="center" rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> +</tr> + +<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" +colspan="4" bgcolor="#f0f0ff"> smtp(8) </td> <td align="left"> + </td> </tr> + +<tr> <td colspan="2"> </td> <td> </td> <td +align="center"><tt>^<br>|</tt></td> </tr> + +<tr> <td colspan="2"> </td> <td align="center" colspan="3" +bgcolor="#f0f0ff"> scache(8) </td> </tr> + +</table> + +</blockquote> <p> The connection cache can be searched by destination domain name (the right-hand side of the recipient address) and by the IP address of the host at the other end of the connection. This allows Postfix -to reuse a connection even when the remote host is mail server for +to reuse a connection even when the remote host is a mail server for domains with different names. </p> <h2><a name="configuration">Connection cache configuration </a></h2> @@ -209,6 +247,10 @@ lookups is ignored. </p> </blockquote> +<p> See <a href="TLS_README.html#client_tls_reuse">Client-side TLS +connection reuse</a> to enable multiple deliveries over a TLS-encrypted +connection (Postfix version 3.4 and later). </p> + </ul> <h2><a name="safety">Connection cache safety mechanisms </a></h2> diff --git a/external/ibm-public/postfix/dist/proto/CONTENT_INSPECTION_README.html b/external/ibm-public/postfix/dist/proto/CONTENT_INSPECTION_README.html index 98a529d32ad..57d483650ef 100644 --- a/external/ibm-public/postfix/dist/proto/CONTENT_INSPECTION_README.html +++ b/external/ibm-public/postfix/dist/proto/CONTENT_INSPECTION_README.html @@ -7,7 +7,7 @@ <title>Postfix Content Inspection </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/DATABASE_README.html b/external/ibm-public/postfix/dist/proto/DATABASE_README.html index 19bb9ae329d..1db3372588d 100644 --- a/external/ibm-public/postfix/dist/proto/DATABASE_README.html +++ b/external/ibm-public/postfix/dist/proto/DATABASE_README.html @@ -7,7 +7,7 @@ <title>Postfix Lookup Table Overview</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -98,7 +98,7 @@ lookup key exists. Any non-empty lookup result value may be used here: the lookup result is not used. Examples are the local_recipient_maps that determine what local recipients Postfix accepts in mail from the network, the mydestination parameter -that specifies what domains Postfix delivers locally, or the +that specifies what domains Postfix delivers locally for, or the mynetworks parameter that specifies the IP addresses of trusted clients or client networks. Technically, these are lists, not tables. Despite the difference, Postfix lists are described here @@ -326,7 +326,7 @@ also the static: map type. </dd> <dt> <b>internal</b> </dt> -<dd> A non-shared, in-memory hash table. Its content are lost when +<dd> A non-shared, in-memory hash table. Its contents are lost when a process terminates. </dd> <dt> <b>lmdb</b> </dt> diff --git a/external/ibm-public/postfix/dist/proto/DB_README.html b/external/ibm-public/postfix/dist/proto/DB_README.html index 0d4fa39065d..cca3e2b6266 100644 --- a/external/ibm-public/postfix/dist/proto/DB_README.html +++ b/external/ibm-public/postfix/dist/proto/DB_README.html @@ -7,7 +7,7 @@ <title>Postfix Berkeley DB Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -100,6 +100,10 @@ source code, use something like: </p> </pre> </blockquote> +<p> If your Berkeley DB shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-ldb". </p> + <p> Solaris needs this: </p> <blockquote> diff --git a/external/ibm-public/postfix/dist/proto/DEBUG_README.html b/external/ibm-public/postfix/dist/proto/DEBUG_README.html index 2a5b012ab6d..ea62cdc4812 100644 --- a/external/ibm-public/postfix/dist/proto/DEBUG_README.html +++ b/external/ibm-public/postfix/dist/proto/DEBUG_README.html @@ -7,7 +7,7 @@ <title> Postfix Debugging Howto </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -577,11 +577,11 @@ or 1000+ lines of <b>postconf</b> command output. </p> </ul> <li> <p> Better, provide output from the <b>postfinger</b> tool. -This can be found at http://ftp.wl0.org/SOURCES/postfinger. </p> +This can be found at https://github.com/ford--prefect/postfinger. </p> <li> <p> If the problem is SASL related, consider including the output from the <b>saslfinger</b> tool. This can be found at -http://postfix.state-of-mind.de/patrick.koetter/saslfinger/. </p> +https://packages.debian.org/search?keywords=sasl2-bin. </p> <li> <p> If the problem is about too much mail in the queue, consider including output from the <b>qshape</b> tool, as described in the diff --git a/external/ibm-public/postfix/dist/proto/DSN_README.html b/external/ibm-public/postfix/dist/proto/DSN_README.html index 456862b4f35..f1ee0dcd5e4 100644 --- a/external/ibm-public/postfix/dist/proto/DSN_README.html +++ b/external/ibm-public/postfix/dist/proto/DSN_README.html @@ -7,7 +7,7 @@ <title>Postfix DSN Support </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/ETRN_README.html b/external/ibm-public/postfix/dist/proto/ETRN_README.html index 5f9bf7f0f2e..e3e36a47cce 100644 --- a/external/ibm-public/postfix/dist/proto/ETRN_README.html +++ b/external/ibm-public/postfix/dist/proto/ETRN_README.html @@ -7,7 +7,7 @@ <title>Postfix ETRN Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/FILTER_README.html b/external/ibm-public/postfix/dist/proto/FILTER_README.html index 522e728907c..12120f08016 100644 --- a/external/ibm-public/postfix/dist/proto/FILTER_README.html +++ b/external/ibm-public/postfix/dist/proto/FILTER_README.html @@ -7,7 +7,7 @@ <title>Postfix After-Queue Content Filter </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -473,7 +473,7 @@ mail back into Postfix with SMTP on localhost port 10026. </p> <p> For non-SMTP capable content filtering software, Bennett Todd's SMTP proxy implements a nice PERL/SMTP content filtering framework. -See: http://bent.latency.net/smtpprox/. </p> +See: https://web.archive.org/web/20151022025756/http://bent.latency.net/smtpprox/. </p> <p> In the figure below, names followed by a number represent Postfix commands or daemon programs. See the OVERVIEW diff --git a/external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html b/external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html index eee8b09617a..0ed87d6181d 100644 --- a/external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html +++ b/external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html @@ -7,7 +7,7 @@ <title>TLS Forward Secrecy in Postfix</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -176,7 +176,7 @@ and is not recommended for now. </p> <h3> EDH Server support </h3> -<p> Postfix ≥ 2.2 support 1024-bit-prime EDH out of the box, +<p> Postfix ≥ 2.2 supports 1024-bit-prime EDH out of the box, with no additional configuration, but you may want to override the default prime to be 2048 bits long, and you may want to regenerate your primes periodically. See the <a href="#quick-start">quick-start</a> @@ -218,7 +218,7 @@ for the recommended configuration to work around this issue. </p> <h3> EECDH Server support </h3> -<p> Postfix ≥ 2.6 support NIST P-256 EECDH when built with OpenSSL +<p> Postfix ≥ 2.6 supports NIST P-256 EECDH when built with OpenSSL ≥ 1.0.0. When the remote SMTP client also supports EECDH and implements the P-256 curve, forward secrecy just works. </p> @@ -334,7 +334,17 @@ for improved security against pre-computation attacks and for compatibility with Debian-patched Exim SMTP clients that require a ≥ 2048-bit length for the non-export prime. </p> -<p> Execute as root (prime group generation can take a +<p> With Postfix ≥ 3.7 built against OpenSSL version is 3.0.0 or later, when +the value of smtpd_tls_dh1024_param_file is either empty or "<b>auto</b>", the +EDH parameter selection is delegated to the OpenSSL library, which selects +appropriate parameters based on the TLS handshake. This choice is likely to be +the most interoperable with SMTP clients using various TLS libraries, and +custom local parameters are no longer recommended when using Postfix ≥ 3.7 +built against OpenSSL 3.0.0. Just leave smtpd_tls_dh1024_param_file at its +default value (both in main.cf(5) and any master.cf(5) overrides, and let +OpenSSL do the work. </p> + +<p> Otherwise, execute as root (prime group generation can take a few seconds to a few minutes): </p> <blockquote> @@ -350,7 +360,7 @@ few seconds to a few minutes): </p> <p> The Postfix SMTP server EDH parameter files are not secret, after all these parameters are sent to all remote SMTP clients in -the clear. Mode 0644 is fine. </p> +the clear. Mode 0644 is appropriate. </p> <p> You can improve security against pre-computation attacks further by regenerating the Postfix SMTP server EDH parameters periodically @@ -520,7 +530,7 @@ This pattern is likely to persist until some new key-exchange mechanism is invented that also supports forward secrecy. </p> <p> The actual key length and raw algorithm key length -are generally the same with non-export ciphers, but may they +are generally the same with non-export ciphers, but they may differ for the legacy export ciphers where the actual key is artificially shortened. </p> diff --git a/external/ibm-public/postfix/dist/proto/IPV6_README.html b/external/ibm-public/postfix/dist/proto/IPV6_README.html index 25f83538df7..01ea51baeeb 100644 --- a/external/ibm-public/postfix/dist/proto/IPV6_README.html +++ b/external/ibm-public/postfix/dist/proto/IPV6_README.html @@ -7,7 +7,7 @@ <title>Postfix IPv6 Support</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -111,49 +111,22 @@ will use when it makes network connections. </p> <pre> /etc/postfix/main.cf: # You must stop/start Postfix after changing this parameter. - inet_protocols = ipv4 (DEFAULT: enable IPv4 only) inet_protocols = all (enable IPv4, and IPv6 if supported) + inet_protocols = ipv4 (enable IPv4 only) inet_protocols = ipv4, ipv6 (enable both IPv4 and IPv6) inet_protocols = ipv6 (enable IPv6 only) </pre> </blockquote> -<p> By default, Postfix uses IPv4 only, because most systems aren't -attached to an IPv6 network. </p> - -<ul> - -<li> <p> On systems with combined IPv4/IPv6 stacks, attempts to -deliver mail via IPv6 would always fail with "network unreachable", -and those attempts would only slow down Postfix. </p> - -<li> <p> Linux kernels don't even load IPv6 protocol support by -default. Any attempt to use it would fail immediately. </p> - -</ul> +<p> The default is compile-time dependent: "all" when Postfix is built +on a software distribution with IPv6 support, "ipv4" otherwise. </p> <p> Note 1: you must stop and start Postfix after changing the inet_protocols configuration parameter. </p> -<p> Note 2: if you see error messages like the following, then -you're running Linux and need to turn on IPv6 in the kernel: see -http://www.ipv6.org/ for hints and tips. Unlike other systems, -Linux does not have a combined stack for IPv4 and IPv6, and IPv6 -protocol support is not loaded by default. </p> - -<blockquote> -<pre> -postconf: warning: inet_protocols: IPv6 support is disabled: Address family not supported by protocol -postconf: warning: inet_protocols: configuring for IPv4 support only -</pre> -</blockquote> - -<p> Note 3: on older Linux and Solaris systems, the setting +<p> Note 2: on older Linux and Solaris systems, the setting "inet_protocols = ipv6" will not prevent Postfix from -accepting IPv4 connections. Postfix will present the client IP -addresses in IPv6 format, though. In all other cases, Postfix always -presents IPv4 client IP addresses in the traditional dotted quad -IPv4 format. </p> +accepting IPv4 connections. </p> <li> <p> The other new parameter is smtp_bind_address6. This sets the local interface address for outgoing IPv6 SMTP @@ -180,7 +153,7 @@ mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [fe80::]/10 [2001:240:587::] </blockquote> <p> If you did specify the mynetworks parameter value in -main.cf, you need update the mynetworks value to include +main.cf, you need to update the mynetworks value to include the IPv6 networks the system is in. Be sure to specify IPv6 address information inside "<tt>[]</tt>", like this: </p> @@ -209,8 +182,8 @@ over IPv6 before trying IPv4. With more recent Postfix versions, the order of IPv6 versus IPv4 outgoing connection attempts is configurable with the smtp_address_preference parameter. </p> -<li> <p> Postfix versions before 2.6 do not support DNSBL (real-time -blackhole list) lookups for IPv6 client IP addresses. </p> +<li> <p> Postfix versions before 2.6 do not support DNSBL (DNS +blocklist) lookups for IPv6 client IP addresses. </p> <li> <p> IPv6 does not have class A, B, C, etc. networks. With IPv6 networks, the setting "mynetworks_style = class" has the @@ -249,8 +222,8 @@ receiving mail. </p> to listen on loopback network interfaces only. </p> <li> <p> The lmtp_bind_address and lmtp_bind_address6 -features were omitted. The Postfix LMTP client will be absorbed -into the SMTP client, so there is no reason to keep adding features +features were omitted. Postfix version 2.3 merged the LMTP client +into the SMTP client, so there was no reason to keep adding features to the LMTP client. </p> <li> <p> The SMTP server now requires that IPv6 addresses in SMTP diff --git a/external/ibm-public/postfix/dist/proto/LDAP_README.html b/external/ibm-public/postfix/dist/proto/LDAP_README.html index 7b46807ae86..720d1c0d4b0 100644 --- a/external/ibm-public/postfix/dist/proto/LDAP_README.html +++ b/external/ibm-public/postfix/dist/proto/LDAP_README.html @@ -7,7 +7,7 @@ <title>Postfix LDAP Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -96,6 +96,10 @@ your Postfix source tree should work: </p> </pre> </blockquote> +<p> If your LDAP shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lldap". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_LDAP. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded LDAP database client, but only the new @@ -529,7 +533,7 @@ query_filter = (&(mailacceptinggeneralid=%s)(!(|(maildrop="*|*")(maildrop="* </pre> </blockquote> -<li> <p> And for that matter, even for aliases, you may not want users able to +<li> <p> And for that matter, even for aliases, you may not want users to be able to specify their maildrops as programs, includes, etc. This might be particularly pertinent on a "sealed" server where they don't have local UNIX accounts, but exist only in LDAP and Cyrus. You might allow diff --git a/external/ibm-public/postfix/dist/proto/LINUX_README.html b/external/ibm-public/postfix/dist/proto/LINUX_README.html index 30f7a3083c0..76c605f3a7d 100644 --- a/external/ibm-public/postfix/dist/proto/LINUX_README.html +++ b/external/ibm-public/postfix/dist/proto/LINUX_README.html @@ -7,7 +7,7 @@ <title>Postfix and Linux</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -20,10 +20,10 @@ <h2> Host lookup issues </h2> <p> By default Linux /etc/hosts lookups do not support multiple IP -address per hostname. This causes warnings from the Postfix SMTP +addresses per hostname. This causes warnings from the Postfix SMTP server that "hostname XXX does not resolve to address YYY", and is especially a problem with hosts that have both IPv4 and IPv6 -addresses. To fix, turn on support for multiple IP addresses: </p> +addresses. To fix this, turn on support for multiple IP addresses: </p> <blockquote> <pre> @@ -73,7 +73,7 @@ library routines. See the DB_README file for further information. <p> On RedHat Linux 7.1 and later <b>procmail</b> no longer has permission -to write the mail spool directory. Workaround: </p> +to write to the mail spool directory. Workaround: </p> <blockquote> <pre> @@ -81,6 +81,13 @@ to write the mail spool directory. Workaround: </p> </pre> </blockquote> +<h2>Logging in a container</h2> + +<p> When running Postfix inside a container, you can use stdout +logging as described in MAILLOG_README. Alternatives: run syslogd +inside the container, or mount the host's syslog socket inside the +container. </p> + <h2>Syslogd performance</h2> <p> LINUX <b>syslogd</b> uses synchronous writes by default. Because @@ -99,6 +106,14 @@ logfile name: </p> <p> Send a "<b>kill -HUP</b>" to the <b>syslogd</b> to make the change effective. </p> +<h2>Other logging performance issues</h2> + +<p> LINUX <b>systemd</b> intercepts all logging and enforces its +own rate limits before handing off requests to a backend such as +<b>rsyslogd</b> or <b>syslog-ng</b>. On a busy mail server this can +result in information loss. As a workaround, you can use Postfix's +built-in logging as described in MAILLOG_README. </p> + </body> </html> diff --git a/external/ibm-public/postfix/dist/proto/LMDB_README.html b/external/ibm-public/postfix/dist/proto/LMDB_README.html index f380c56b234..a9794cca6ae 100644 --- a/external/ibm-public/postfix/dist/proto/LMDB_README.html +++ b/external/ibm-public/postfix/dist/proto/LMDB_README.html @@ -7,7 +7,7 @@ <title>Postfix OpenLDAP LMDB Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -55,6 +55,10 @@ build Postfix with LMDB support, use something like: </p> </pre> </blockquote> +<p> If your LMDB shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-llmdb". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_LMDB. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded LMDB database client, but only the new diff --git a/external/ibm-public/postfix/dist/proto/LOCAL_RECIPIENT_README.html b/external/ibm-public/postfix/dist/proto/LOCAL_RECIPIENT_README.html index 83e7d3baed7..12828cdc7df 100644 --- a/external/ibm-public/postfix/dist/proto/LOCAL_RECIPIENT_README.html +++ b/external/ibm-public/postfix/dist/proto/LOCAL_RECIPIENT_README.html @@ -7,7 +7,7 @@ <title>Rejecting Unknown Local Recipients with Postfix</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/MAILDROP_README.html b/external/ibm-public/postfix/dist/proto/MAILDROP_README.html index 4657df3ed69..0271ea93743 100644 --- a/external/ibm-public/postfix/dist/proto/MAILDROP_README.html +++ b/external/ibm-public/postfix/dist/proto/MAILDROP_README.html @@ -7,7 +7,7 @@ <title>Postfix + Maildrop Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/MAILLOG_README.html b/external/ibm-public/postfix/dist/proto/MAILLOG_README.html index 9951c6c23eb..5a19a92e5fe 100644 --- a/external/ibm-public/postfix/dist/proto/MAILLOG_README.html +++ b/external/ibm-public/postfix/dist/proto/MAILLOG_README.html @@ -7,7 +7,7 @@ <title>Postfix logging to file or stdout</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -129,7 +129,7 @@ program is configured with the maillog_file_compressor parameter <ul> -<li> <p> This command will not rotate a logfile with pathname under +<li> <p> This command will not rotate a logfile with a pathname under the /dev directory, such as /dev/stdout. </p> <li> <p> This command does not (yet) remove old logfiles. </p> @@ -146,7 +146,7 @@ the /dev directory, such as /dev/stdout. </p> in the background, as well as non-daemon programs for local mail submission or Postfix management. -<li> <p> Logging to Postfix logfile or stdout requires the Postfix +<li> <p> Logging to the Postfix logfile or stdout requires the Postfix postlogd(8) service. This ensures that simultaneous logging from different programs will not get mixed up. </p> diff --git a/external/ibm-public/postfix/dist/proto/MEMCACHE_README.html b/external/ibm-public/postfix/dist/proto/MEMCACHE_README.html index a48f9a82544..d14493582b3 100644 --- a/external/ibm-public/postfix/dist/proto/MEMCACHE_README.html +++ b/external/ibm-public/postfix/dist/proto/MEMCACHE_README.html @@ -7,7 +7,7 @@ <title>Postfix memcache client Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/MILTER_README.html b/external/ibm-public/postfix/dist/proto/MILTER_README.html index 886299f4f75..a0d5ac69264 100644 --- a/external/ibm-public/postfix/dist/proto/MILTER_README.html +++ b/external/ibm-public/postfix/dist/proto/MILTER_README.html @@ -7,7 +7,7 @@ <title>Postfix before-queue Milter support </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -309,7 +309,8 @@ from other Milter applications. </p> <dt> <b>unix:</b><i>pathname</i> </dt> <dd><p>Connect to the local UNIX-domain server that is bound to the specified pathname. If the smtpd(8) or cleanup(8) process runs chrooted, an absolute pathname -is interpreted relative to the Postfix queue directory.</p> </dd> +is interpreted relative to the Postfix queue directory. On many +systems, <b>local</b> is a synonym for <b>unix</b></p> </dd> <dt> <b> inet:</b><i>host</i><b>:</b><i>port</i> </dt> <dd> <p> Connect to the specified TCP port on the specified local or remote @@ -758,7 +759,7 @@ transaction (for example; queue ID, sender, or recipient). </p> you may specify macro default values with the milter_macro_defaults parameter. Specify zero or more <i>name=value</i> pairs separated by comma or whitespace; you may even specify macro names that Postfix does -know about! </p> +not know about! </p> <h2><a name="workarounds">Workarounds</a></h2> diff --git a/external/ibm-public/postfix/dist/proto/MULTI_INSTANCE_README.html b/external/ibm-public/postfix/dist/proto/MULTI_INSTANCE_README.html index a2574df8921..196f804054a 100644 --- a/external/ibm-public/postfix/dist/proto/MULTI_INSTANCE_README.html +++ b/external/ibm-public/postfix/dist/proto/MULTI_INSTANCE_README.html @@ -7,7 +7,7 @@ <title>Managing multiple Postfix instances on a single host</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -259,7 +259,7 @@ EOF </pre> </blockquote> -<p> The test message should be delivered the members of the "mtaadmin" +<p> The test message should be delivered to the members of the "mtaadmin" address group (or whatever address group you choose) with the following headers: </p> @@ -378,7 +378,7 @@ post-filter re-injection SMTP service. Typical additions include: </p> smtpd_relay_restrictions = smtpd_recipient_restrictions = permit_mynetworks, reject - # Tolerate occasional high latency in the content filter. + # Tolerate occasional high latency in the content filter. # smtpd_timeout = 1200s diff --git a/external/ibm-public/postfix/dist/proto/MYSQL_README.html b/external/ibm-public/postfix/dist/proto/MYSQL_README.html index 3b37a006275..db52f02f52e 100644 --- a/external/ibm-public/postfix/dist/proto/MYSQL_README.html +++ b/external/ibm-public/postfix/dist/proto/MYSQL_README.html @@ -7,7 +7,7 @@ <title>Postfix MySQL Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -46,8 +46,7 @@ There is no need to recompile Postfix. </p> which can be obtained from: </p> <blockquote> - <p> http://www.mysql.com/downloads/ <br> - http://sourceforge.net/projects/mysql/ </p> + <p> http://www.mysql.com/downloads/ </p> </blockquote> <p> In order to build Postfix with mysql map support, you will need to add @@ -62,6 +61,10 @@ make -f Makefile.init makefiles \ </pre> </blockquote> +<p> If your MySQL shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lmysqlclient". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_MYSQL. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded MySQL database client, but only the new @@ -174,7 +177,7 @@ main.cf configuration feature.</li> <li> Liviu Daia with further refinements from Jose Luis Tallon and Victor Duchovni developed the common query, result_format, domain and -expansion_limit interface for LDAP, MySQL and PosgreSQL.</li> +expansion_limit interface for LDAP, MySQL and PostgreSQL.</li> </ul> diff --git a/external/ibm-public/postfix/dist/proto/Makefile.in b/external/ibm-public/postfix/dist/proto/Makefile.in index 6f435ee4a6c..511bd4448b9 100644 --- a/external/ibm-public/postfix/dist/proto/Makefile.in +++ b/external/ibm-public/postfix/dist/proto/Makefile.in @@ -35,6 +35,7 @@ HTML = ../html/ADDRESS_CLASS_README.html \ ../html/OVERVIEW.html \ ../html/PACKAGE_README.html ../html/PCRE_README.html \ ../html/PGSQL_README.html \ + ../html/POSTSCREEN_3_5_README.html \ ../html/POSTSCREEN_README.html \ ../html/QSHAPE_README.html \ ../html/RESTRICTION_CLASS_README.html ../html/SASL_README.html \ @@ -82,6 +83,7 @@ README = ../README_FILES/ADDRESS_CLASS_README \ ../README_FILES/OVERVIEW \ ../README_FILES/PACKAGE_README ../README_FILES/PCRE_README \ ../README_FILES/PGSQL_README \ + ../README_FILES/POSTSCREEN_3_5_README \ ../README_FILES/POSTSCREEN_README \ ../README_FILES/QSHAPE_README \ ../README_FILES/RESTRICTION_CLASS_README \ @@ -259,6 +261,9 @@ clobber: ../html/PGSQL_README.html: PGSQL_README.html $(DETAB) $? | $(POSTLINK) >$@ +../html/POSTSCREEN_3_5_README.html: POSTSCREEN_3_5_README.html + $(DETAB) $? | $(POSTLINK) >$@ + ../html/POSTSCREEN_README.html: POSTSCREEN_README.html $(DETAB) $? | $(POSTLINK) >$@ @@ -436,6 +441,9 @@ clobber: ../README_FILES/PGSQL_README: PGSQL_README.html $(DETAB) $? | $(HT2READ) >$@ +../README_FILES/POSTSCREEN_3_5_README: POSTSCREEN_3_5_README.html + $(DETAB) $? | $(HT2READ) >$@ + ../README_FILES/POSTSCREEN_README: POSTSCREEN_README.html $(DETAB) $? | $(HT2READ) >$@ diff --git a/external/ibm-public/postfix/dist/proto/NFS_README.html b/external/ibm-public/postfix/dist/proto/NFS_README.html index e8d44d98be3..0f970ee82c8 100644 --- a/external/ibm-public/postfix/dist/proto/NFS_README.html +++ b/external/ibm-public/postfix/dist/proto/NFS_README.html @@ -7,7 +7,7 @@ <title>Postfix and NFS</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/OVERVIEW.html b/external/ibm-public/postfix/dist/proto/OVERVIEW.html index fc62ce1787e..af743aacfc0 100644 --- a/external/ibm-public/postfix/dist/proto/OVERVIEW.html +++ b/external/ibm-public/postfix/dist/proto/OVERVIEW.html @@ -7,7 +7,7 @@ <title>Postfix Architecture Overview </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -561,21 +561,59 @@ about this feature is in the CONNECTION_CACHE_README document. </p> <tr> <td> </td> <td> <tt> /-- </tt> </td> <td align="center" colspan="3" bgcolor="#f0f0ff"> smtp(8) </td> <td colspan="2"> <tt> ---> </tt> Internet </td> </tr> - +--> </tt> </td> <td> Internet </td> </tr> + <tr> <td align="center" bgcolor="#f0f0ff"> qmgr(8) </td> <td> </td> -<td align="center" rowspan="3"> </td> <td align="center" -rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> <td> </td> +<td align="center" rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> </tr> -<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" -colspan="2" bgcolor="#f0f0ff"> smtp(8) </td> <td align="left"> <tt> ---> </tt> Internet </td> </tr> - -<tr> <td colspan="3"> </td> <td align="center"><tt>^<br>|</tt></td> -<td> </td> </tr> +<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" +colspan="4" bgcolor="#f0f0ff"> smtp(8) </td> <td align="left"> + </td> </tr> + +<tr> <td colspan="2"> </td> <td> </td> <td +align="center"><tt>^<br>|</tt></td> </tr> + +<tr> <td colspan="2"> </td> <td align="center" colspan="3" +bgcolor="#f0f0ff"> scache(8) </td> </tr> + +</table> + +<p> A Postfix smtp(8) client can reuse a TLS-encrypted connection +(with "smtp_tls_connection_reuse = yes"). This can greatly reduce +the overhead of connection setup and improves message delivery +rates. After a Postfix smtp(8) client connects to a remote SMTP +server and sends plaintext EHLO and STARTTLS commands, the smtp(8) +client inserts a tlsproxy(8) process into the connection as shown +below. </p> + +<p> After the mail transaction completes, the Postfix smtp(8) client +gives the smtp(8)-to-tlsproxy(8) connection to the scache(8) +server, which keeps the connection open for a limited amount of +time. The smtp(8) client continues with some other mail delivery +request. Meanwhile, any Postfix smtp(8) client can ask the scache(8) +server for that cached connection and reuse it for mail delivery. +</p> + +<table> + +<tr> <td> </td> <td> <tt> /-- </tt> </td> <td align="center" +colspan="3" bgcolor="#f0f0ff"> smtp(8) </td> <td colspan="2"> <tt> +--> </tt> </td> <td align="center"bgcolor="#f0f0ff"> tlsproxy(8) +</td> <td> <tt> --> </tt> </td> <td> Internet </td> </tr> + +<tr> <td align="center" bgcolor="#f0f0ff"> qmgr(8) </td> <td> </td> +<td align="center" rowspan="3"><tt>|<br>|<br>|<br>|<br>v</tt></td> +</tr> -<tr> <td colspan="3"> </td> <td align="center" colspan="3" +<tr> <td> </td> <td> <tt> \-- </tt> </td> <td align="center" +colspan="4" bgcolor="#f0f0ff"> smtp(8) </td> <td align="left"> + </td> </tr> + +<tr> <td colspan="2"> </td> <td> </td> <td +align="center"><tt>^<br>|</tt></td> </tr> + +<tr> <td colspan="2"> </td> <td align="center" colspan="3" bgcolor="#f0f0ff"> scache(8) </td> </tr> </table> @@ -737,50 +775,94 @@ those numbers were 92% and 95%, respectively. While postscreen(8) keeps the zombies away, more smtpd(8) processes remain available for legitimate clients. </p> -<p> postscreen(8) maintains a temporary whitelist for clients that -pass its tests; by allowing whitelisted clients to skip tests, +<p> postscreen(8) maintains a temporary allowlist for clients that +pass its tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. </p> <p> The postscreen(8) server is available with Postfix 2.8 and later. To keep the implementation simple, postscreen(8) delegates -DNS white/blacklist lookups to dnsblog(8) server processes, and +DNS allow/denylist lookups to dnsblog(8) server processes, and delegates TLS encryption/decryption to tlsproxy(8) server processes. -This delegation is invisible to the remote SMTP client, and is not -shown in the diagram below. </p> +This delegation is invisible to the remote SMTP client. </p> <table> -<tr> <td> zombie </td> </tr> +<tr> <td colspan="2"> </td> <td align="center"> zombie </td> </tr> -<tr> <td> </td> <td align="left"> <tt> \ </tt> </td> </tr> +<tr> <td colspan="3"> </td> <td align="left"> <tt> \ </tt> </td> </tr> -<tr> <td> zombie </td> <td align="left"> <tt> - </tt> </td> <td> +<tr> <td> zombie </td> <td> <tt> - </tt> </td> <td bgcolor="#f0f0ff" align="center"> tlsproxy(8) </td> <td align="left"> <tt> - </tt> </td> <td> </td> <td> </td> <td> </td> <td align="right"> <tt> - </tt> </td> <td bgcolor="#f0f0ff" align="center"> smtpd(8) </td> </tr> -<tr> <td> </td> <td align="right"> <tt> \ </tt> </td> <td> </td> +<tr> <td colspan="3"> </td> <td align="right"> <tt> \ </tt> </td> <td> </td> <td align="left"> <tt> / </tt> </td> </tr> -<tr> <td bgcolor="#f0f0ff" align="center"> other </td> <td> <tt> +<tr> <td colspan="2"> </td> <td bgcolor="#f0f0ff" align="center"> other </td> <td> <tt> --- </tt> </td> <td bgcolor="#f0f0ff" align="center" valign="middle"> postscreen(8) </td> </tr> -<tr> <td> </td> <td align="right"> <tt> / </tt> </td> <td> </td> +<tr> <td colspan="3"> </td> <td align="right"> <tt> / </tt> </td> <td> </td> <td align="right"> <tt> \ </tt> </td> </tr> -<tr> <td bgcolor="#f0f0ff" align="center"> other </td> <td align="left"> +<tr> <td colspan="2"> </td> <td bgcolor="#f0f0ff" align="center"> other </td> <td align="left"> <tt> - </tt> </td> <td> </td> <td> </td> <td> </td> <td align="right"> <tt> - </tt> </td> <td bgcolor="#f0f0ff" align="center"> smtpd(8) </td> </tr> -<tr> <td> </td> <td align="left"> <tt> / </tt> </td> </tr> +<tr> <td colspan="3"> </td> <td align="left"> <tt> / </tt> </td> </tr> -<tr> <td> zombie </td> </tr> +<tr> <td colspan="2"> </td> <td align="center"> zombie </td> </tr> +</table> + +<li> <p>The postlogd(8) server provides an alternative to syslog +logging, which remains the default. This feature is available with +Postfix version 3.4 or later, and supports the following modes: +</p> + + +<ul> + +<li> <p>Logging to file, which addresses a usability problem with +MacOS, and eliminates information loss caused by systemd rate limits. +</p> + +<table> + +<tr> <td bgcolor="#f0f0ff" rowspan="3" valign="middle" align="center"> +commands<br>or daemons</td> <td colspan="4"> </td> </tr> + +<tr> <td colspan="2"> <td> <tt> -> </tt> </td> <td bgcolor="#f0f0ff"> +postlogd(8) </td> <td> <tt> -> </tt> </td> <td> /path/to/file +</td> </tr> + +<tr> <td colspan=6> </td> </tr> </table> +<li> <p>Logging to stdout, which eliminates a syslog dependency +when Postfix runs inside a container. </p> + +<table> + +<tr> <td bgcolor="#f0f0ff" rowspan="3" valign="middle" align="center"> +commands<br>or daemons</td> <td colspan="4"> </td> <td +rowspan="3" align="center"> stdout inherited<br>from "postfix +start-fg" </td> </tr> + +<tr> <td colspan="2"> <tt> -> </tt> </td> <td bgcolor="#f0f0ff"> +postlogd(8) </td> <td> <tt> -> </tt> </td> </tr> + +<tr> <td colspan=5> </td> </tr> + +</table> + +</ul> + +<p> See MAILLOG_README for details and limitations. </p> + </ul> <h2> <a name="commands"> Postfix support commands </a> </h2> diff --git a/external/ibm-public/postfix/dist/proto/PACKAGE_README.html b/external/ibm-public/postfix/dist/proto/PACKAGE_README.html index 98bffd1a8ec..a30d0728702 100644 --- a/external/ibm-public/postfix/dist/proto/PACKAGE_README.html +++ b/external/ibm-public/postfix/dist/proto/PACKAGE_README.html @@ -7,7 +7,7 @@ <title>Guidelines for Package Builders</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/PCRE_README.html b/external/ibm-public/postfix/dist/proto/PCRE_README.html index 1f8059b698d..1741826a3a8 100644 --- a/external/ibm-public/postfix/dist/proto/PCRE_README.html +++ b/external/ibm-public/postfix/dist/proto/PCRE_README.html @@ -7,7 +7,7 @@ <title>Postfix PCRE Support</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -30,39 +30,56 @@ expression implementation that you find on many systems. </p> is given in the pcre_table(5) manual page. Information about PCRE itself can be found at http://www.pcre.org/. </p> -<h2>Building Postfix with PCRE support</h2> +<h2>Using Postfix packages with PCRE support</h2> -<p> These instructions assume that you build Postfix from source -code as described in the INSTALL document. Some modification may -be required if you build Postfix from a vendor-specific source -package. </p> - -<p> Note: to use pcre with Debian GNU/Linux's Postfix, all you +<p> To use pcre with Debian GNU/Linux's Postfix, or with Fedora or +RHEL Postfix, all you need is to install the postfix-pcre package and you're done. There is no need to recompile Postfix. </p> -<p> In some future, Postfix will have a plug-in interface for adding -map types. Until then, you need to compile PCRE support into Postfix. -</p> +<h2>Building Postfix from source with PCRE support</h2> -<p> First of all, you need the PCRE library (Perl Compatible Regular -Expressions), which can be obtained from: </p> +<p> These instructions assume that you build Postfix from source +code as described in the INSTALL document. </p> -<blockquote> -ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/. +<p> To build Postfix from source with pcre support, you need a pcre +library. Install a vendor package, or download the source code from +locations in https://www.pcre.org/ and build that yourself. + +<p> Postfix can build with the pcre2 library or the legacy pcre +library. It's probably easiest to let the Postfix build procedure +pick one. The following commands will first discover if the pcre2 +library is installed, and if that is not available, will discover +if the legacy pcre library is installed. </p> + +<blockquote> +<pre> +$ make -f Makefile.init makefiles +$ make +</pre> </blockquote> -<p> NOTE: pcre versions prior to 2.06 cannot be used. </p> +<p> To build Postfix explicitly with a pcre2 library (Postfix 3.7 +and later): </p> + +<blockquote> +<pre> +$ make -f Makefile.init makefiles \ + "CCARGS=-DHAS_PCRE=2 `pcre2-config --cflags`" \ + "AUXLIBS_PCRE=`pcre2-config --libs8`" +$ make +</pre> +</blockquote> -<p> In order to build Postfix with PCRE support you need to add --DHAS_PCRE and a -I option for the PCRE include file to CCARGS, and -add the path to the PCRE library to AUXLIBS_PCRE, for example: </p> +<p> To build Postfix explicitly with a legacy pcre library (all +Postfix versions): </p> <blockquote> <pre> -make -f Makefile.init makefiles \ - "CCARGS=-DHAS_PCRE `pcre-config --cflags`" \ +$ make -f Makefile.init makefiles \ + "CCARGS=-DHAS_PCRE=1 `pcre-config --cflags`" \ "AUXLIBS_PCRE=`pcre-config --libs`" +$ make </pre> </blockquote> diff --git a/external/ibm-public/postfix/dist/proto/PGSQL_README.html b/external/ibm-public/postfix/dist/proto/PGSQL_README.html index ddbaa383871..61445ba4e8c 100644 --- a/external/ibm-public/postfix/dist/proto/PGSQL_README.html +++ b/external/ibm-public/postfix/dist/proto/PGSQL_README.html @@ -7,7 +7,7 @@ <title>Postfix PostgreSQL Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -57,6 +57,10 @@ the location of the libpq library file. </p> </pre> </blockquote> +<p> If your PostgreSQL shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lpq". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_PGSQL. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded PostgreSQL database client, but only diff --git a/external/ibm-public/postfix/dist/proto/POSTSCREEN_3_5_README.html b/external/ibm-public/postfix/dist/proto/POSTSCREEN_3_5_README.html new file mode 100644 index 00000000000..56db3799add --- /dev/null +++ b/external/ibm-public/postfix/dist/proto/POSTSCREEN_3_5_README.html @@ -0,0 +1,1198 @@ +<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" + "http://www.w3.org/TR/html4/loose.dtd"> + +<head> + +<title>Postfix Postscreen Howto (Postfix 2.8 - 3.5)</title> + +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> + +</head> + +<body> + +<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix Postscreen Howto (Postfix 2.8 - 3.5)</h1> + +<hr> + +<h2> <a name="intro">Introduction</a> </h2> + +<p> This document describes features that are available in Postfix +2.8 - 3.5. </p> + +<p> The Postfix postscreen(8) daemon provides additional protection +against mail server overload. One postscreen(8) process handles +multiple inbound SMTP connections, and decides which clients may +talk to a Postfix SMTP server process. By keeping spambots away, +postscreen(8) leaves more SMTP server processes available for +legitimate clients, and delays the onset of <a +href="STRESS_README.html">server overload</a> conditions. </p> + +<p> postscreen(8) should not be used on SMTP ports that receive +mail from end-user clients (MUAs). In a typical deployment, +postscreen(8) handles the MX service on TCP port 25, while MUA +clients submit mail via the submission service on TCP port 587 which +requires client authentication. Alternatively, a site could set up +a dedicated, non-postscreen, "port 25" server that provides submission +service and client authentication, but no MX service. </p> + +<p> postscreen(8) maintains a temporary allowlist for clients that +pass its tests; by allowing allowlisted clients to skip tests, +postscreen(8) minimizes its impact on legitimate email traffic. +</p> + +<p> postscreen(8) is part of a multi-layer defense. <p> + +<ul> + +<li> <p> As the first layer, postscreen(8) blocks connections from +zombies and other spambots that are responsible for about 90% of +all spam. It is implemented as a single process to make this defense +as inexpensive as possible. </p> + +<li> <p> The second layer implements more complex SMTP-level access +checks with <a href="SMTPD_ACCESS_README.html">Postfix SMTP servers</a>, +<a href="SMTPD_POLICY_README.html">policy daemons</a>, and +<a href="MILTER_README.html">Milter applications</a>. </p> + +<li> <p> The third layer performs light-weight content inspection +with the Postfix built-in header_checks and body_checks. This can +block unacceptable attachments such as executable programs, and +worms or viruses with easy-to-recognize signatures. </p> + +<li> <p> The fourth layer provides heavy-weight content inspection +with external content filters. Typical examples are <a +href="http://www.ijs.si/software/amavisd/">Amavisd-new</a>, <a +href="http://spamassassin.apache.org/">SpamAssassin</a>, and <a +href="MILTER_README.html">Milter applications</a>. </p> + +</ul> + +<p> Each layer reduces the spam volume. The general strategy is to +use the less expensive defenses first, and to use the more expensive +defenses only for the spam that remains. </p> + +<p> Topics in this document: </p> + +<ul> + +<li> <a href="#intro">Introduction</a> + +<li> <a href="#basic">The basic idea behind postscreen(8)</a> + +<li> <a href="#general"> General operation </a> + +<li> <a href="#quick">Quick tests before everything else</a> + +<li> <a href="#before_220"> Tests before the 220 SMTP server greeting </a> + +<li> <a href="#after_220">Tests after the 220 SMTP server greeting</a> + +<li> <a href="#other_error">Other errors</a> + +<li> <a href="#victory">When all tests succeed</a> + +<li> <a href="#config"> Configuring the postscreen(8) service</a> + +<li> <a href="#historical"> Historical notes and credits </a> + +</ul> + +<h2> <a name="basic">The basic idea behind postscreen(8)</a> </h2> + +<p> Most email is spam, and most spam is sent out by zombies (malware +on compromised end-user computers). Wietse expects that the zombie +problem will get worse before things improve, if ever. Without a +tool like postscreen(8) that keeps the zombies away, Postfix would be +spending most of its resources not receiving email. </p> + +<p> The main challenge for postscreen(8) is to make an is-a-zombie +decision based on a single measurement. This is necessary because +many zombies try to fly under the radar and avoid spamming the same +site repeatedly. Once postscreen(8) decides that a client is +not-a-zombie, it allowlists the client temporarily to avoid further +delays for legitimate mail. </p> + +<p> Zombies have challenges too: they have only a limited amount +of time to deliver spam before their IP address becomes denylisted. +To speed up spam deliveries, zombies make compromises in their SMTP +protocol implementation. For example, they speak before their turn, +or they ignore responses from SMTP servers and continue sending +mail even when the server tells them to go away. </p> + +<p> postscreen(8) uses a variety of measurements to recognize +zombies. First, postscreen(8) determines if the remote SMTP client +IP address is denylisted. Second, postscreen(8) looks for protocol +compromises that are made to speed up delivery. These are good +indicators for making is-a-zombie decisions based on single +measurements. </p> + +<p> postscreen(8) does not inspect message content. Message content +can vary from one delivery to the next, especially with clients +that (also) send legitimate email. Content is not a good indicator +for making is-a-zombie decisions based on single measurements, +and that is the problem that postscreen(8) is focused on. </p> + +<h2> <a name="general"> General operation </a> </h2> + +<p> For each connection from an SMTP client, postscreen(8) performs +a number of tests +in the order as described below. Some tests introduce a delay of +a few seconds. postscreen(8) maintains a temporary allowlist for +clients that pass its tests; by allowing allowlisted clients to +skip tests, postscreen(8) minimizes its impact on legitimate email +traffic. </p> + +<p> By default, postscreen(8) hands off all connections to a Postfix +SMTP server process after logging its findings. This mode is useful +for non-destructive testing. </p> + +<p> In a typical production setting, postscreen(8) is configured +to reject mail from clients that fail one or more tests, after +logging the helo, sender and recipient information. </p> + +<p> Note: postscreen(8) is not an SMTP proxy; this is intentional. +The purpose is to keep zombies away from Postfix, with minimal +overhead for legitimate clients. </p> + +<h2> <a name="quick">Quick tests before everything else</a> </h2> + +<p> Before engaging in SMTP-level tests. postscreen(8) queries a +number of local deny and allowlists. These tests speed up the +handling of known clients. </p> + +<ul> + +<li> <a href="#perm_white_black"> Permanent allow/denylist test </a> + +<li> <a href="#temp_white"> Temporary allowlist test </a> + +<li> <a href="#white_veto"> MX Policy test </a> + +</ul> + +<h3> <a name="perm_white_black"> Permanent allow/denylist test </a> </h3> + +<p> The postscreen_access_list parameter (default: permit_mynetworks) +specifies a permanent access list for SMTP client IP addresses. Typically +one would specify something that allowlists local networks, followed +by a CIDR table for selective allow- and denylisting. </p> + +<p> Example: </p> + +<pre> +/etc/postfix/main.cf: + postscreen_access_list = permit_mynetworks, + cidr:/etc/postfix/postscreen_access.cidr + +/etc/postfix/postscreen_access.cidr: + # Rules are evaluated in the order as specified. + # Denylist 192.168.* except 192.168.0.1. + 192.168.0.1 permit + 192.168.0.0/16 reject +</pre> + +<p> See the postscreen_access_list manpage documentation for more +details. </p> + +<p> When the SMTP client address matches a "permit" action, +postscreen(8) logs this with the client address and port number as: +</p> + +<pre> + <b>WHITELISTED</b> <i>[address]:port</i> +</pre> + +<p> The allowlist action is not configurable: immediately hand off the +connection to a Postfix SMTP server process. </p> + +<p> When the SMTP client address matches a "reject" action, +postscreen(8) logs this with the client address and port number as: +</p> + +<pre> + <b>BLACKLISTED</b> <i>[address]:port</i> +</pre> + +<p> The postscreen_blacklist_action parameter specifies the action +that is taken next. See "<a href="#fail_before_220">When tests +fail before the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="temp_white"> Temporary allowlist test </a> </h3> + +<p> The postscreen(8) daemon maintains a <i>temporary</i> +allowlist for SMTP client IP addresses that have passed all +the tests described below. The postscreen_cache_map parameter +specifies the location of the temporary allowlist. The +temporary allowlist is not used for SMTP client addresses +that appear on the <i>permanent</i> access list. </p> + +<p> By default the temporary allowlist is not shared with other +postscreen(8) daemons. See +<a href="#temp_white_sharing"> Sharing +the temporary allowlist </a> below for alternatives. </p> + +<p> When the SMTP client address appears on the temporary +allowlist, postscreen(8) logs this with the client address and port +number as: </p> + +<pre> + <b>PASS OLD</b> <i>[address]:port</i> +</pre> + +<p> The action is not configurable: immediately hand off the +connection to a Postfix SMTP server process. The client is +excluded from further tests until its temporary allowlist +entry expires, as controlled with the postscreen_*_ttl +parameters. Expired entries are silently renewed if possible. </p> + +<h3> <a name="white_veto"> MX Policy test </a> </h3> + +<p> When the remote SMTP client is not on the static access list +or temporary allowlist, postscreen(8) can implement a number of +allowlist tests, before it grants the client a temporary allowlist +status that allows it to talk to a Postfix SMTP server process. </p> + +<p> When postscreen(8) is configured to monitor all primary and +backup MX addresses, it can refuse to allowlist clients that connect +to a backup MX address only (an old spammer trick to take advantage +of backup MX hosts with weaker anti-spam policies than primary MX +hosts). </p> + +<blockquote> <p> NOTE: The following solution is for small sites. +Larger sites would have to share the postscreen(8) cache between +primary and backup MTAs, which would introduce a common point of +failure. </p> </blockquote> + +<ul> + +<li> <p> First, configure the host to listen on both primary and +backup MX addresses. Use the appropriate <tt>ifconfig</tt> or <tt>ip</tt> +command for the local operating system, or update the appropriate +configuration files and "refresh" the network protocol stack. </p> + +<p> <p> Second, configure Postfix to listen on the new IP address +(this step is needed when you have specified inet_interfaces in +main.cf). </p> + +<li> <p> Then, configure postscreen(8) to deny the temporary allowlist +status on the backup MX address(es). An example for Wietse's +server is: </p> + +<pre> +/etc/postfix/main.cf: + postscreen_whitelist_interfaces = !168.100.189.8 static:all +</pre> + +<p> Translation: allow clients to obtain the temporary allowlist +status on all server IP addresses except 168.100.189.8, which is a +backup MX address. </p> + +</ul> + +<p> When a non-allowlisted client connects the backup MX address, +postscreen(8) logs this with the client address and port number as: +</p> + +<pre> + <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> + <b>WHITELIST VETO</b> <i>[address]:port</i> +</pre> + +<p> Translation: the client at <i>[address]:port</i> connected to +the backup MX address 168.100.189.8 while it was not allowlisted. +The client will not be granted the temporary allowlist status, even +if passes all the allowlist tests described below. </p> + +<h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> + +<p> The postscreen_greet_wait parameter specifies a short time +interval before the "220 <i>text</i>..." server greeting, where +postscreen(8) can run a number of tests in parallel. </p> + +<p> When a good client passes these tests, and no "<a +href="#after_220">deep protocol tests</a>" +are configured, postscreen(8) +adds the client to the temporary allowlist and hands off the "live" +connection to a Postfix SMTP server process. The client can then +continue as if postscreen(8) never even existed (except of course +for the short postscreen_greet_wait delay). </p> + +<ul> + +<li> <a href="#pregreet"> Pregreet test </a> + +<li> <a href="#dnsbl"> DNS Allow/denylist test </a> + +<li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> + +</ul> + +<h3> <a name="pregreet"> Pregreet test </a> </h3> + +<p> The SMTP protocol is a classic example of a protocol where the +server speaks before the client. postscreen(8) detects zombies +that are in a hurry and that speak before their turn. This test is +enabled by default. </p> + +<p> The postscreen_greet_banner parameter specifies the <i>text</i> +portion of a "220-<i>text</i>..." teaser banner (default: $smtpd_banner). +Note that this becomes the first part of a multi-line server greeting. +The postscreen(8) daemon sends this before the postscreen_greet_wait +timer is started. The purpose of the teaser banner is to confuse +zombies so that they speak before their turn. It has no effect on +SMTP clients that correctly implement the protocol. </p> + +<p> To avoid problems with poorly-implemented SMTP engines in network +appliances or network testing tools, either exclude them from all +tests with the postscreen_access_list feature or else specify +an empty teaser banner: </p> + +<pre> +/etc/postfix/main.cf: + # Exclude broken clients by allowlisting. Clients in mynetworks + # should always be allowlisted. + postscreen_access_list = permit_mynetworks, + cidr:/etc/postfix/postscreen_access.cidr + +/etc/postfix/postscreen_access.cidr: + 192.168.254.0/24 permit +</pre> + +<pre> +/etc/postfix/main.cf: + # Disable the teaser banner (try allowlisting first if you can). + postscreen_greet_banner = +</pre> + +<p> When an SMTP client sends a command before the +postscreen_greet_wait time has elapsed, postscreen(8) logs this as: +</p> + +<pre> + <b>PREGREET</b> <i>count</i> <b>after</b> <i>time</i> <b>from</b> <i>[address]:port text...</i> +</pre> + +<p> Translation: the client at <i>[address]:port</i> sent <i>count</i> +bytes before its turn to speak. This happened <i>time</i> seconds +after the postscreen_greet_wait timer was started. The <i>text</i> +is what the client sent (truncated to 100 bytes, and with non-printable +characters replaced with C-style escapes such as \r for carriage-return +and \n for newline). </p> + +<p> The postscreen_greet_action parameter specifies the action that +is taken next. See "<a href="#fail_before_220">When tests fail +before the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="dnsbl"> DNS Allow/denylist test </a> </h3> + +<p> The postscreen_dnsbl_sites parameter (default: empty) specifies +a list of DNS blocklist servers with optional filters and weight +factors (positive weights for denylisting, negative for allowlisting). +These servers will be queried in parallel with the reverse client +IP address. This test is disabled by default. </p> + +<blockquote> +<p> +CAUTION: when postscreen rejects mail, its SMTP reply contains the +DNSBL domain name. Use the postscreen_dnsbl_reply_map feature to +hide "password" information in DNSBL domain names. +</p> +</blockquote> + +<p> When the postscreen_greet_wait time has elapsed, and the combined +DNSBL score is equal to or greater than the postscreen_dnsbl_threshold +parameter value, postscreen(8) logs this as: </p> + +<pre> + <b>DNSBL rank</b> <i>count</i> <b>for</b> <i>[address]:port</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> has a combined +DNSBL score of <i>count</i>. </p> + +<p> The postscreen_dnsbl_action parameter specifies the action that +is taken when the combined DNSBL score is equal to or greater than +the threshold. See "<a href="#fail_before_220">When tests fail +before the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> + +<p> When the client address matches the permanent denylist, or +when the client fails the pregreet or DNSBL tests, the action is +specified with postscreen_blacklist_action, postscreen_greet_action, +or postscreen_dnsbl_action, respectively. </p> + +<dl> + +<dt> <b>ignore</b> (default) </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Repeat this test the next time the client connects. This option +is useful for testing and collecting statistics without blocking +mail. </dd> + +<dt> <b>enforce</b> </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver mail +with a 550 SMTP reply, and log the helo/sender/recipient information. +Repeat this test the next time the client connects. </dd> + +<dt> <b>drop</b> </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. </dd> + +</dl> + +<h2> <a name="after_220">Tests after the 220 SMTP server greeting</a> </h2> + +<p> In this phase of the protocol, postscreen(8) implements a +number of "deep protocol" tests. These tests use an SMTP protocol +engine that is built into the postscreen(8) server. </p> + +<p> Important note: these protocol tests are disabled by default. +They are more intrusive than the pregreet and DNSBL tests, and they +have limitations as discussed next. </p> + +<ul> + +<li> <p> The main limitation of "after 220 greeting" tests is that +a new client must disconnect after passing these tests (reason: +postscreen is not a proxy). Then the client must reconnect from +the same IP address before it can deliver mail. The following +measures may help to avoid email delays: </p> + +<ul> + +<li> <p> Allow "good" clients to skip tests with the +postscreen_dnsbl_whitelist_threshold feature (Postfix 2.11 and +later). This is especially effective for sites such as Google that +never retry immediately from the same IP address. </p> + +<li> <p> Small sites: Configure postscreen(8) to listen on multiple +IP addresses, published in DNS as different IP addresses for the +same MX hostname or for different MX hostnames. This avoids mail +delivery delays with clients that reconnect immediately from the +same IP address. </p> + +<li> <p> Large sites: Share the postscreen(8) cache between different +Postfix MTAs with a large-enough memcache_table(5). Again, this +avoids mail delivery delays with clients that reconnect immediately +from the same IP address. </p> + +</ul> + +<li> <p> postscreen(8)'s built-in SMTP engine does not implement the +AUTH, XCLIENT, and XFORWARD features. If you need to make these +services available on port 25, then do not enable the tests after +the 220 server greeting. </p> + +<li> <p> End-user clients should connect directly to the submission +service, so that they never have to deal with postscreen(8)'s tests. +</p> + +</ul> + +<p> The following "after 220 greeting" tests are available: </p> + +<ul> + +<li> <a href="#pipelining">Command pipelining test</a> + +<li> <a href="#non_smtp">Non-SMTP command test</a> + +<li> <a href="#barelf">Bare newline test</a> + +<li> <a href="#fail_after_220">When tests fail after the 220 SMTP server greeting</a> + +</ul> + +<h3> <a name="pipelining">Command pipelining test</a> </h3> + +<p> By default, SMTP is a half-duplex protocol: the sender and +receiver send one command and one response at a time. Unlike the +Postfix SMTP server, postscreen(8) does not announce support +for ESMTP command pipelining. Therefore, clients are not allowed +to send multiple commands. postscreen(8)'s +<a href="#after_220">deep +protocol test</a> for this is disabled by default. </p> + +<p> With "postscreen_pipelining_enable = yes", postscreen(8) detects +zombies that send multiple commands, instead of sending one command +and waiting for the server to reply. </p> + +<p> This test is opportunistically enabled when postscreen(8) has +to use the built-in SMTP engine anyway. This is to make postscreen(8) +logging more informative. </p> + +<p> When a client sends multiple commands, postscreen(8) logs this +as: </p> + +<pre> + <b>COMMAND PIPELINING from</b> <i>[address]:port</i> <b>after</b> <i>command</i>: <i>text</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> sent +multiple SMTP commands, instead of sending one command and then +waiting for the server to reply. This happened after the client +sent <i>command</i>. The <i>text</i> shows part of the input that +was sent too early; it is not logged with Postfix 2.8. </p> + +<p> The postscreen_pipelining_action parameter specifies the action +that is taken next. See "<a href="#fail_after_220">When tests fail +after the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="non_smtp">Non-SMTP command test</a> </h3> + +<p> Some spambots send their mail through open proxies. A symptom +of this is the usage of commands such as CONNECT and other non-SMTP +commands. Just like the Postfix SMTP server's smtpd_forbidden_commands +feature, postscreen(8) has an equivalent postscreen_forbidden_commands +feature to block these clients. postscreen(8)'s +<a href="#after_220">deep +protocol test</a> for this is disabled by default. </p> + +<p> With "postscreen_non_smtp_command_enable = yes", postscreen(8) +detects zombies that send commands specified with the +postscreen_forbidden_commands parameter. This also detects commands +with the syntax of a message header label. The latter is a symptom +that the client is sending message content after ignoring all the +responses from postscreen(8) that reject mail. </p> + +<p> This test is opportunistically enabled when postscreen(8) has +to use the built-in SMTP engine anyway. This is to make postscreen(8) +logging more informative. </p> + +<p> When a client sends non-SMTP commands, postscreen(8) logs this +as: </p> + +<pre> + <b>NON-SMTP COMMAND from</b> <i>[address]:port</i> <b>after</b> <i>command: text</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> sent a +command that matches the postscreen_forbidden_commands +parameter, or that has the syntax of a message header label (text +followed by optional space and ":"). +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<p> The postscreen_non_smtp_command_action parameter specifies +the action that is taken next. See "<a href="#fail_after_220">When +tests fail after the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="barelf">Bare newline test</a> </h3> + +<p> SMTP is a line-oriented protocol: lines have a limited length, +and are terminated with <CR><LF>. Lines ending in a +"bare" <LF>, that is newline not preceded by carriage return, +are not allowed in SMTP. postscreen(8)'s +<a href="#after_220">deep +protocol test</a> for this is disabled by default. </p> + +<p> With "postscreen_bare_newline_enable = yes", postscreen(8) +detects clients that send lines ending in bare newline characters. +</p> + +<p> This test is opportunistically enabled when postscreen(8) has +to use the built-in SMTP engine anyway. This is to make postscreen(8) +logging more informative. </p> + +<p> When a client sends bare newline characters, postscreen(8) logs +this as: +</p> + +<pre> + <b>BARE NEWLINE from</b> <i>[address]:port</i> <b>after</b> <i>command</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> sent a bare +newline character, that is newline not preceded by carriage +return. +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<p> The postscreen_bare_newline_action parameter specifies the +action that is taken next. See "<a href="#fail_after_220">When +tests fail after the 220 SMTP server greeting</a>" below. </p> + +<h3> <a name="fail_after_220">When tests fail after the 220 SMTP server greeting</a> </h3> + +<p> When the client fails the pipelining, non-SMTP command or bare +newline tests, the action is specified with postscreen_pipelining_action, +postscreen_non_smtp_command_action or postscreen_bare_newline_action, +respectively. </p> + +<dl> + +<dt> <b>ignore</b> (default for bare newline) </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Do NOT repeat this test before the result from some other test +expires. + +This option is useful for testing and collecting statistics without +blocking mail permanently. </dd> + +<dt> <b>enforce</b> (default for pipelining) </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver +mail with a 550 SMTP reply, and log the helo/sender/recipient +information. Repeat this test the next time the client connects. +</dd> + +<dt> <b>drop</b> (default for non-SMTP commands) </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. This action is +compatible with the Postfix SMTP server's smtpd_forbidden_commands +feature. </dd> + +</dl> + +<h2> <a name="other_error">Other errors</a> </h2> + +<p> When an SMTP client hangs up unexpectedly, postscreen(8) logs +this as: </p> + +<pre> + <b>HANGUP after</b> <i>time</i> <b>from</b> <i>[address]:port</i> <b>in</b> <i>test name</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> disconnected +unexpectedly, <i>time</i> seconds after the start of the +test named <i>test name</i>. </p> + +<p> There is no punishment for hanging up. A client that hangs up +without sending the QUIT command can still pass all postscreen(8) +tests. </p> + +<!-- + +<p> While an unexpired penalty is in effect, an SMTP client is not +allowed to pass any tests, and postscreen(8) logs each connection +with the remaining amount of penalty time as: </p> + +<pre> + <b>PENALTY</b> <i>time</i> <b>for</b> <i>[address]:port</i> +</pre> + +<p> During this time, all attempts by the client to deliver mail +will be deferred with a 450 SMTP status. </p> + +--> + +<p> The following errors are reported by the built-in SMTP engine. +This engine never accepts mail, therefore it has per-session limits +on the number of commands and on the session length. </p> + +<pre> + <b>COMMAND TIME LIMIT</b> <b>from</b> <i>[address]:port</i> <b>after</b> <i>command</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> reached the +per-command time limit as specified with the postscreen_command_time_limit +parameter. The session is terminated immediately. +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<pre> + <b>COMMAND COUNT LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> reached the +per-session command count limit as specified with the +postscreen_command_count_limit parameter. The session is terminated +immediately. +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<pre> + <b>COMMAND LENGTH LIMIT from</b> <i>[address]:port</i> <b>after</b> <i>command</i> +</pre> + +<p> Translation: the SMTP client at <i>[address]:port</i> reached the +per-command length limit, as specified with the line_length_limit +parameter. The session is terminated immediately. +The "<tt><b>after</b> <i>command</i></tt>" portion is logged with +Postfix 2.10 and later. </p> + +<p> When an SMTP client makes too many connections at the same time, +postscreen(8) rejects the connection with a 421 status code and logs: </p> + +<pre> + <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b> +</pre> + +<p> The postscreen_client_connection_count_limit parameter controls this limit. </p> + +<p> When an SMTP client connects after postscreen(8) has reached a +connection count limit, postscreen(8) rejects the connection with +a 421 status code and logs: </p> + +<pre> + <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all screening ports busy</b> + <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b> +</pre> + +<p> The postscreen_pre_queue_limit and postscreen_post_queue_limit +parameters control these limits. </p> + +<h2> <a name="victory">When all tests succeed</a> </h2> + +<p> When a new SMTP client passes all tests (i.e. it is not allowlisted +via some mechanism), postscreen(8) logs this as: </p> + +<pre> + <b>PASS NEW</b> <i>[address]:port</i> +</pre> + +<p> Where <i>[address]:port</i> are the client IP address and port. +Then, postscreen(8) +creates a temporary allowlist entry that excludes the client IP +address from further tests until the temporary allowlist entry +expires, as controlled with the postscreen_*_ttl parameters. </p> + +<p> When no "<a href="#after_220">deep protocol tests</a>" are +configured, postscreen(8) hands off the "live" connection to a Postfix +SMTP server process. The client can then continue as if postscreen(8) +never even existed (except for the short postscreen_greet_wait delay). +</p> + +<p> When any "<a href="#after_220">deep protocol tests</a>" are +configured, postscreen(8) cannot hand off the "live" connection to +a Postfix SMTP server process in the middle of the session. Instead, +postscreen(8) defers mail delivery attempts with a 4XX status, logs +the helo/sender/recipient information, and waits for the client to +disconnect. The next time the client connects it will be allowed +to talk to a Postfix SMTP server process to deliver its mail. +postscreen(8) mitigates the impact of this limitation by giving +<a href="#after_220">deep protocol tests</a> a long expiration +time. </p> + +<h2> <a name="config"> Configuring the postscreen(8) service</a> +</h2> + +<p> postscreen(8) has been tested on FreeBSD [4-8], Linux 2.[4-6] +and Solaris 9 systems. </p> + +<ul> + +<li> <a href="#enable"> Turning on postscreen(8) without blocking +mail</a> + +<li> <a href="#starttls"> postscreen(8) TLS configuration </a> + +<li> <a href="#blocking"> Blocking mail with postscreen(8) </a> + +<li> <a href="#turnoff"> Turning off postscreen(8) </a> + +<li> <a href="#temp_white_sharing"> Sharing the temporary allowlist +</a> + +</ul> + +<h3> <a name="enable"> Turning on postscreen(8) without blocking mail</a> </h3> + +<p> To enable the postscreen(8) service and log client information +without blocking mail: </p> + +<ol> + +<li> <p> Make sure that local clients and systems with non-standard +SMTP implementations are excluded from any postscreen(8) tests. The +default is to exclude all clients in mynetworks. To exclude additional +clients, for example, third-party performance monitoring tools (these +tend to have broken SMTP implementations): </p> + +<pre> +/etc/postfix/main.cf: + # Exclude broken clients by allowlisting. Clients in mynetworks + # should always be allowlisted. + postscreen_access_list = permit_mynetworks, + cidr:/etc/postfix/postscreen_access.cidr + +/etc/postfix/postscreen_access.cidr: + 192.168.254.0/24 permit +</pre> + +<li> <p> Comment out the "<tt>smtp inet ... smtpd</tt>" service +in master.cf, including any "<tt>-o parameter=value</tt>" entries +that follow. </p> + +<pre> +/etc/postfix/master.cf: + #smtp inet n - n - - smtpd + # -o parameter=value ... +</pre> + +<li> <p> Uncomment the new "<tt>smtpd pass ... smtpd</tt>" service +in master.cf, and duplicate any "<tt>-o parameter=value</tt>" entries +from the smtpd service that was commented out in the previous step. +</p> + +<pre> +/etc/postfix/master.cf: + smtpd pass - - n - - smtpd + -o parameter=value ... +</pre> + +<li> <p> Uncomment the new "<tt>smtp inet ... postscreen</tt>" +service in master.cf. </p> + +<pre> +/etc/postfix/master.cf: + smtp inet n - n - 1 postscreen +</pre> + +<li> <p> Uncomment the new "<tt>tlsproxy unix ... tlsproxy</tt>" +service in master.cf. This service implements STARTTLS support for +postscreen(8). </p> + +<pre> +/etc/postfix/master.cf: + tlsproxy unix - - n - 0 tlsproxy +</pre> + +<li> <p> Uncomment the new "<tt>dnsblog unix ... dnsblog</tt>" +service in master.cf. This service does DNSBL lookups for postscreen(8) +and logs results. </p> + +<pre> +/etc/postfix/master.cf: + dnsblog unix - - n - 0 dnsblog +</pre> + +<li> <p> To enable DNSBL lookups, list some DNS blocklist sites in +main.cf, separated by whitespace. Different sites can have different +weights. For example: + +<pre> +/etc/postfix/main.cf: + postscreen_dnsbl_threshold = 2 + postscreen_dnsbl_sites = zen.spamhaus.org*2 + bl.spamcop.net*1 b.barracudacentral.org*1 +</pre> + +<p> Note: if your DNSBL queries have a "secret" in the domain name, +you must censor this information from the postscreen(8) SMTP replies. +For example: </p> + +<pre> +/etc/postfix/main.cf: + postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply +</pre> + +<pre> +/etc/postfix/dnsbl_reply: + # Secret DNSBL name Name in postscreen(8) replies + secret.zen.dq.spamhaus.net zen.spamhaus.org +</pre> + +<p> The texthash: format is similar to hash: except that there is +no need to run postmap(1) before the file can be used, and that it +does not detect changes after the file is read. It is new with +Postfix version 2.8. </p> + +<li> <p> Read the new configuration with "<tt>postfix reload</tt>". +</p> + +</ol> + +<p> Notes: </p> + +<ul> + +<li> <p> Some postscreen(8) configuration parameters implement +stress-dependent behavior. This is supported only when the default +value is stress-dependent (that is, "postconf -d <i>parametername</i>" +output shows +"<i>parametername</i> = ${stress?<i>something</i>}${stress:<i>something</i>}" or +"<i>parametername</i> = ${stress?{<i>something</i>}:{<i>something</i>}}"). +Other parameters always evaluate as if the stress value is the empty +string. </p> + +<li> <p> See "<a href="#before_220">Tests before the 220 SMTP server +greeting</a>" for details about the logging from these +postscreen(8) tests. </p> + +<li> <p> If you run Postfix 2.6 or earlier you must stop and start +the master daemon ("<tt>postfix stop; postfix start</tt>"). This +is needed because the Postfix "pass" master service type did not +work reliably on all systems. </p> + +</ul> + +<h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> + +<p> postscreen(8) TLS support is available for remote SMTP clients +that aren't allowlisted, including clients that need to renew their +temporary allowlist status. When a remote SMTP client requests TLS +service, postscreen(8) invisibly hands off the connection to a +tlsproxy(8) process. Then, tlsproxy(8) encrypts and decrypts the +traffic between postscreen(8) and the remote SMTP client. One +tlsproxy(8) process can handle multiple SMTP sessions. The number +of tlsproxy(8) processes slowly increases with server load, but it +should always be much smaller than the number of postscreen(8) TLS +sessions. </p> + +<p> TLS support for postscreen(8) and tlsproxy(8) uses the same +parameters as with smtpd(8). We recommend that you keep the relevant +configuration parameters in main.cf. If you must specify "-o +smtpd_mumble=value" parameter overrides in master.cf for a +postscreen-protected smtpd(8) service, then you should specify those +same parameter overrides for the postscreen(8) and tlsproxy(8) +services. </p> + +<h3> <a name="blocking"> Blocking mail with postscreen(8) </a> </h3> + +<p> For compatibility with smtpd(8), postscreen(8) implements the +soft_bounce safety feature. This causes Postfix to reject mail with +a "try again" reply code. </p> + +<ul> + +<li> <p> To turn this on for all of Postfix, specify "<tt>soft_bounce += yes</tt>" in main.cf. </p> + +<li> <p> To turn this on for postscreen(8) only, append "<tt>-o +soft_bounce=yes</tt>" (note: NO SPACES around '=') to the postscreen +entry in master.cf. <p> + +</ul> + +<p> Execute "<tt>postfix reload</tt>" to make the change effective. </p> + +<p> After testing, do not forget to remove the soft_bounce feature, +otherwise senders won't receive their non-delivery notification +until many days later. </p> + +<p> To use the postscreen(8) service to block mail, edit main.cf and +specify one or more of: </p> + +<ul> + +<li> <p> "<tt>postscreen_dnsbl_action = enforce</tt>", to reject +clients that are on DNS blocklists, and to log the helo/sender/recipient +information. With good DNSBLs this reduces the amount of load on +Postfix SMTP servers dramatically. </p> + +<li> <p> "<tt>postscreen_greet_action = enforce</tt>", to reject +clients that talk before their turn, and to log the helo/sender/recipient +information. This stops over half of all known-to-be illegitimate +connections to Wietse's mail server. It is backup protection for +zombies that haven't yet been denylisted. </p> + +<li> <p> You can also enable "<a href="#after_220">deep protocol +tests</a>", but these are more intrusive than the pregreet or DNSBL +tests. </p> + +<p> When a good client passes the "<a href="#after_220">deep +protocol tests</a>", +postscreen(8) adds the client to the temporary +allowlist but it cannot hand off the "live" connection to a Postfix +SMTP server process in the middle of the session. Instead, postscreen(8) +defers mail delivery attempts with a 4XX status, logs the +helo/sender/recipient information, and waits for the client to +disconnect. </p> + +<p> When the good client comes back in a later session, it is allowed +to talk directly to a Postfix SMTP server. See "<a href="#after_220">Tests +after the 220 SMTP server greeting</a>" above for limitations with +AUTH and other features that clients may need. </p> + +<p> An unexpected benefit from "<a href="#after_220">deep protocol +tests</a>" is that some "good" clients don't return after the 4XX +reply; these clients were not so good after all. </p> + +<p> Unfortunately, some senders will retry requests from different +IP addresses, and may never get allowlisted. For this reason, +Wietse stopped using "<a href="#after_220">deep protocol tests</a>" +on his own internet-facing mail server. </p> + +<li> <p> There is also support for permanent denylisting and +allowlisting; see the description of the postscreen_access_list +parameter for details. </p> + +</ul> + +<h3> <a name="turnoff"> Turning off postscreen(8) </a> </h3> + +<p> To turn off postscreen(8) and handle mail directly with Postfix +SMTP server processes: </p> + +<ol> + +<li> <p> Comment out the "<tt>smtp inet ... postscreen</tt>" service +in master.cf, including any "<tt>-o parameter=value</tt>" entries +that follow. </p> + +<pre> +/etc/postfix/master.cf: + #smtp inet n - n - 1 postscreen + # -o parameter=value ... +</pre> + +<li> <p> Comment out the "<tt>dnsblog unix ... dnsblog</tt>" service +in master.cf. </p> + +<pre> +/etc/postfix/master.cf: + #dnsblog unix - - n - 0 dnsblog +</pre> + +<li> <p> Comment out the "<tt>smtpd pass ... smtpd</tt>" service +in master.cf, including any "<tt>-o parameter=value</tt>" entries +that follow. </p> + +<pre> +/etc/postfix/master.cf: + #smtpd pass - - n - - smtpd + # -o parameter=value ... +</pre> + +<li> <p> Comment out the "<tt>tlsproxy unix ... tlsproxy</tt>" +service in master.cf, including any "<tt>-o parameter=value</tt>" +entries that follow. </p> + +<pre> +/etc/postfix/master.cf: + #tlsproxy unix - - n - 0 tlsproxy + # -o parameter=value ... +</pre> + +<li> <p> Uncomment the "<tt>smtp inet ... smtpd</tt>" service in +master.cf, including any "<tt>-o parameter=value</tt>" entries that +may follow. </p> + +<pre> +/etc/postfix/master.cf: + smtp inet n - n - - smtpd + -o parameter=value ... +</pre> + +<li> <p> Read the new configuration with "<tt>postfix reload</tt>". +</p> + +</ol> + +<h3> <a name="temp_white_sharing"> Sharing the temporary allowlist </a> </h3> + +<p> By default, the temporary allowlist is not shared between +multiple postscreen(8) daemons. To enable sharing, choose one +of the following options: </p> + +<ul> + +<li> <p> A non-persistent memcache: temporary allowlist can be shared + between postscreen(8) daemons on the same host or different + hosts. Disable cache cleanup (postscreen_cache_cleanup_interval + = 0) in all postscreen(8) daemons because memcache: has no + first-next API (but see example 4 below for memcache: with + persistent backup). This requires Postfix 2.9 or later. </p> + + <pre> + # Example 1: non-persistent memcache: allowlist. + /etc/postfix/main.cf: + postscreen_cache_map = memcache:/etc/postfix/postscreen_cache + postscreen_cache_cleanup_interval = 0 + + /etc/postfix/postscreen_cache: + memcache = inet:127.0.0.1:11211 + key_format = postscreen:%s + </pre> + +<li> <p> + A persistent lmdb: temporary allowlist can be shared between + postscreen(8) daemons that run under the same master(8) daemon, + or under different master(8) daemons on the same host. Disable + cache cleanup (postscreen_cache_cleanup_interval = 0) in all + postscreen(8) daemons except one that is responsible for cache + cleanup. This requires Postfix 2.11 or later. </p> + + <pre> + # Example 2: persistent lmdb: allowlist. + /etc/postfix/main.cf: + postscreen_cache_map = lmdb:$data_directory/postscreen_cache + # See note 1 below. + # postscreen_cache_cleanup_interval = 0 + </pre> + +<li> <p> Other kinds of persistent temporary allowlist can be shared + only between postscreen(8) daemons that run under the same + master(8) daemon. In this case, temporary allowlist access must + be shared through the proxymap(8) daemon. This requires Postfix + 2.9 or later. </p> + + <pre> + # Example 3: proxied btree: allowlist. + /etc/postfix/main.cf: + postscreen_cache_map = + proxy:btree:/var/lib/postfix/postscreen_cache + # See note 1 below. + # postscreen_cache_cleanup_interval = 0 + + # Example 4: proxied btree: allowlist with memcache: accelerator. + /etc/postfix/main.cf: + postscreen_cache_map = memcache:/etc/postfix/postscreen_cache + proxy_write_maps = + proxy:btree:/var/lib/postfix/postscreen_cache + ... other proxied tables ... + # See note 1 below. + # postscreen_cache_cleanup_interval = 0 + + /etc/postfix/postscreen_cache: + # Note: the $data_directory macro is not defined in this context. + memcache = inet:127.0.0.1:11211 + backup = proxy:btree:/var/lib/postfix/postscreen_cache + key_format = postscreen:%s + </pre> + + <p> Note 1: disable cache cleanup (postscreen_cache_cleanup_interval + = 0) in all postscreen(8) daemons except one that is responsible + for cache cleanup. </p> + + <p> Note 2: postscreen(8) cache sharing via proxymap(8) requires Postfix + 2.9 or later; earlier proxymap(8) implementations don't support + cache cleanup. </p> + +</ul> + +<h2> <a name="historical"> Historical notes and credits </a> </h2> + +<p> Many ideas in postscreen(8) were explored in earlier work by +Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic +Control. </p> + +<p> Wietse threw together a crude prototype with pregreet and dnsbl +support in June 2009, because he needed something new for a Mailserver +conference presentation in July. Ralf Hildebrandt ran this code on +several servers to collect real-world statistics. This version used +the dnsblog(8) ad-hoc DNS client program. </p> + +<p> Wietse needed new material for a LISA conference presentation +in November 2010, so he added support for DNSBL weights and filters +in August, followed by a major code rewrite, deep protocol tests, +helo/sender/recipient logging, and stress-adaptive behavior in +September. Ralf Hildebrandt ran this code on several servers to +collect real-world statistics. This version still used the embarrassing +dnsblog(8) ad-hoc DNS client program. </p> + +<p> Wietse added STARTTLS support in December 2010. This makes +postscreen(8) usable for sites that require TLS support. The +implementation introduces the tlsproxy(8) event-driven TLS proxy +that decrypts/encrypts the sessions for multiple SMTP clients. </p> + +<p> The tlsproxy(8) implementation led to the discovery of a "new" +class of vulnerability (<a +href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0411" +>CVE-2011-0411</a>) that affected multiple implementations of SMTP, +POP, IMAP, NNTP, and FTP over TLS. </p> + +<p> postscreen(8) was officially released as part of the Postfix +2.8 stable release in January 2011.</p> + +</body> + +</html> diff --git a/external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html b/external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html index 66f8f87707a..8ab32359dd1 100644 --- a/external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html +++ b/external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html @@ -5,7 +5,7 @@ <title>Postfix Postscreen Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -18,7 +18,8 @@ <h2> <a name="intro">Introduction</a> </h2> <p> This document describes features that are available in Postfix -2.8 and later. </p> +3.6 and later. See <a href="POSTSCREEN_3_5_README.html"> +POSTSCREEN_3_5_README.html</a> for Postfix versions 2.8 - 3.5. </p> <p> The Postfix postscreen(8) daemon provides additional protection against mail server overload. One postscreen(8) process handles @@ -36,8 +37,8 @@ requires client authentication. Alternatively, a site could set up a dedicated, non-postscreen, "port 25" server that provides submission service and client authentication, but no MX service. </p> -<p> postscreen(8) maintains a temporary whitelist for clients that -pass its tests; by allowing whitelisted clients to skip tests, +<p> postscreen(8) maintains a temporary allowlist for clients that +pass its tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. </p> @@ -110,11 +111,11 @@ spending most of its resources not receiving email. </p> decision based on a single measurement. This is necessary because many zombies try to fly under the radar and avoid spamming the same site repeatedly. Once postscreen(8) decides that a client is -not-a-zombie, it whitelists the client temporarily to avoid further +not-a-zombie, it allowlists the client temporarily to avoid further delays for legitimate mail. </p> <p> Zombies have challenges too: they have only a limited amount -of time to deliver spam before their IP address becomes blacklisted. +of time to deliver spam before their IP address becomes denylisted. To speed up spam deliveries, zombies make compromises in their SMTP protocol implementation. For example, they speak before their turn, or they ignore responses from SMTP servers and continue sending @@ -122,7 +123,7 @@ mail even when the server tells them to go away. </p> <p> postscreen(8) uses a variety of measurements to recognize zombies. First, postscreen(8) determines if the remote SMTP client -IP address is blacklisted. Second, postscreen(8) looks for protocol +IP address is denylisted. Second, postscreen(8) looks for protocol compromises that are made to speed up delivery. These are good indicators for making is-a-zombie decisions based on single measurements. </p> @@ -138,8 +139,8 @@ and that is the problem that postscreen(8) is focused on. </p> <p> For each connection from an SMTP client, postscreen(8) performs a number of tests in the order as described below. Some tests introduce a delay of -a few seconds. postscreen(8) maintains a temporary whitelist for -clients that pass its tests; by allowing whitelisted clients to +a few seconds. postscreen(8) maintains a temporary allowlist for +clients that pass its tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. </p> @@ -158,25 +159,25 @@ overhead for legitimate clients. </p> <h2> <a name="quick">Quick tests before everything else</a> </h2> <p> Before engaging in SMTP-level tests. postscreen(8) queries a -number of local black and whitelists. These tests speed up the +number of local deny and allowlists. These tests speed up the handling of known clients. </p> <ul> -<li> <a href="#perm_white_black"> Permanent white/blacklist test </a> +<li> <a href="#perm_allow_deny"> Permanent allow/denylist test </a> -<li> <a href="#temp_white"> Temporary whitelist test </a> +<li> <a href="#temp_allow"> Temporary allowlist test </a> -<li> <a href="#white_veto"> MX Policy test </a> +<li> <a href="#allow_veto"> MX Policy test </a> </ul> -<h3> <a name="perm_white_black"> Permanent white/blacklist test </a> </h3> +<h3> <a name="perm_allow_deny"> Permanent allow/denylist test </a> </h3> <p> The postscreen_access_list parameter (default: permit_mynetworks) specifies a permanent access list for SMTP client IP addresses. Typically -one would specify something that whitelists local networks, followed -by a CIDR table for selective white- and blacklisting. </p> +one would specify something that allowlists local networks, followed +by a CIDR table for selective allow- and denylisting. </p> <p> Example: </p> @@ -187,7 +188,7 @@ by a CIDR table for selective white- and blacklisting. </p> /etc/postfix/postscreen_access.cidr: # Rules are evaluated in the order as specified. - # Blacklist 192.168.* except 192.168.0.1. + # Denylist 192.168.* except 192.168.0.1. 192.168.0.1 permit 192.168.0.0/16 reject </pre> @@ -199,40 +200,51 @@ details. </p> postscreen(8) logs this with the client address and port number as: </p> +<blockquote> <pre> - <b>WHITELISTED</b> <i>[address]:port</i> +<b>ALLOWLISTED</b> <i>[address]:port</i> </pre> +</blockquote> + +<blockquote> <p> Use the respectful_logging configuration parameter to +select a deprecated form of this logging. </p> </blockquote> -<p> The whitelist action is not configurable: immediately hand off the +<p> The allowlist action is not configurable: immediately hand off the connection to a Postfix SMTP server process. </p> <p> When the SMTP client address matches a "reject" action, postscreen(8) logs this with the client address and port number as: </p> +<blockquote> <pre> - <b>BLACKLISTED</b> <i>[address]:port</i> +<b>DENYLISTED</b> <i>[address]:port</i> </pre> +</blockquote> -<p> The postscreen_blacklist_action parameter specifies the action +<blockquote> <p> Use the respectful_logging configuration parameter to +select a deprecated form of this logging. </p> </blockquote> + +<p> The postscreen_denylist_action parameter specifies the action that is taken next. See "<a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a>" below. </p> -<h3> <a name="temp_white"> Temporary whitelist test </a> </h3> +<h3> <a name="temp_allow"> Temporary allowlist test </a> </h3> <p> The postscreen(8) daemon maintains a <i>temporary</i> -whitelist for SMTP client IP addresses that have passed all +allowlist for SMTP client IP addresses that have passed all the tests described below. The postscreen_cache_map parameter -specifies the location of the temporary whitelist. The -temporary whitelist is not used for SMTP client addresses +specifies the location of the temporary allowlist. The +temporary allowlist is not used for SMTP client addresses that appear on the <i>permanent</i> access list. </p> -<p> By default the temporary whitelist is not shared with other -postscreen(8) daemons. See <a href="#temp_white_sharing"> Sharing -the temporary whitelist </a> below for alternatives. </p> +<p> By default the temporary allowlist is not shared with other +postscreen(8) daemons. See +<a href="#temp_allow_sharing"> Sharing +the temporary allowlist </a> below for alternatives. </p> <p> When the SMTP client address appears on the temporary -whitelist, postscreen(8) logs this with the client address and port +allowlist, postscreen(8) logs this with the client address and port number as: </p> <pre> @@ -241,19 +253,19 @@ number as: </p> <p> The action is not configurable: immediately hand off the connection to a Postfix SMTP server process. The client is -excluded from further tests until its temporary whitelist +excluded from further tests until its temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. Expired entries are silently renewed if possible. </p> -<h3> <a name="white_veto"> MX Policy test </a> </h3> +<h3> <a name="allow_veto"> MX Policy test </a> </h3> <p> When the remote SMTP client is not on the static access list -or temporary whitelist, postscreen(8) can implement a number of -whitelist tests, before it grants the client a temporary whitelist +or temporary allowlist, postscreen(8) can implement a number of +allowlist tests, before it grants the client a temporary allowlist status that allows it to talk to a Postfix SMTP server process. </p> <p> When postscreen(8) is configured to monitor all primary and -backup MX addresses, it can refuse to whitelist clients that connect +backup MX addresses, it can refuse to allowlist clients that connect to a backup MX address only (an old spammer trick to take advantage of backup MX hosts with weaker anti-spam policies than primary MX hosts). </p> @@ -266,42 +278,45 @@ failure. </p> </blockquote> <ul> <li> <p> First, configure the host to listen on both primary and -backup MX addresses. Use the appropriate <tt>ifconfig</tt> command -for the local operating system, or update the appropriate configuration -files and "refresh" the network protocol stack. </p> +backup MX addresses. Use the appropriate <tt>ifconfig</tt> or <tt>ip</tt> +command for the local operating system, or update the appropriate +configuration files and "refresh" the network protocol stack. </p> <p> <p> Second, configure Postfix to listen on the new IP address (this step is needed when you have specified inet_interfaces in main.cf). </p> -<li> <p> Then, configure postscreen(8) to deny the temporary whitelist +<li> <p> Then, configure postscreen(8) to deny the temporary allowlist status on the backup MX address(es). An example for Wietse's server is: </p> <pre> /etc/postfix/main.cf: - postscreen_whitelist_interfaces = !168.100.189.8 static:all + postscreen_allowlist_interfaces = !168.100.189.8 static:all </pre> -<p> Translation: allow clients to obtain the temporary whitelist +<p> Translation: allow clients to obtain the temporary allowlist status on all server IP addresses except 168.100.189.8, which is a backup MX address. </p> </ul> -<p> When a non-whitelisted client connects the backup MX address, +<p> When a non-allowlisted client connects the backup MX address, postscreen(8) logs this with the client address and port number as: </p> -<pre> - <b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> - <b>WHITELIST VETO</b> <i>[address]:port</i> -</pre> +<blockquote> <pre> +<b>CONNECT from</b> <i>[address]:port</i> <b>to [168.100.189.8]:25</b> +<b>ALLOWLIST VETO</b> <i>[address]:port</i> +</pre> </blockquote> + +<blockquote> <p> Use the respectful_logging configuration parameter to +select a deprecated form of this logging. </p> </blockquote> <p> Translation: the client at <i>[address]:port</i> connected to -the backup MX address 168.100.189.8 while it was not whitelisted. -The client will not be granted the temporary whitelist status, even -if passes all the whitelist tests described below. </p> +the backup MX address 168.100.189.8 while it was not allowlisted. +The client will not be granted the temporary allowlist status, even +if passes all the allowlist tests described below. </p> <h2> <a name="before_220"> Tests before the 220 SMTP server greeting </a> </h2> @@ -310,8 +325,9 @@ interval before the "220 <i>text</i>..." server greeting, where postscreen(8) can run a number of tests in parallel. </p> <p> When a good client passes these tests, and no "<a -href="#after_220">deep protocol tests</a>" are configured, postscreen(8) -adds the client to the temporary whitelist and hands off the "live" +href="#after_220">deep protocol tests</a>" +are configured, postscreen(8) +adds the client to the temporary allowlist and hands off the "live" connection to a Postfix SMTP server process. The client can then continue as if postscreen(8) never even existed (except of course for the short postscreen_greet_wait delay). </p> @@ -320,7 +336,7 @@ for the short postscreen_greet_wait delay). </p> <li> <a href="#pregreet"> Pregreet test </a> -<li> <a href="#dnsbl"> DNS White/blacklist test </a> +<li> <a href="#dnsbl"> DNS Allow/denylist test </a> <li> <a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a> @@ -348,8 +364,8 @@ an empty teaser banner: </p> <pre> /etc/postfix/main.cf: - # Exclude broken clients by whitelisting. Clients in mynetworks - # should always be whitelisted. + # Exclude broken clients by allowlisting. Clients in mynetworks + # should always be allowlisted. postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr @@ -359,7 +375,7 @@ an empty teaser banner: </p> <pre> /etc/postfix/main.cf: - # Disable the teaser banner (try whitelisting first if you can). + # Disable the teaser banner (try allowlisting first if you can). postscreen_greet_banner = </pre> @@ -382,11 +398,11 @@ and \n for newline). </p> is taken next. See "<a href="#fail_before_220">When tests fail before the 220 SMTP server greeting</a>" below. </p> -<h3> <a name="dnsbl"> DNS White/blacklist test </a> </h3> +<h3> <a name="dnsbl"> DNS Allow/denylist test </a> </h3> <p> The postscreen_dnsbl_sites parameter (default: empty) specifies a list of DNS blocklist servers with optional filters and weight -factors (positive weights for blacklisting, negative for whitelisting). +factors (positive weights for denylisting, negative for allowlisting). These servers will be queried in parallel with the reverse client IP address. This test is disabled by default. </p> @@ -416,9 +432,9 @@ before the 220 SMTP server greeting</a>" below. </p> <h3> <a name="fail_before_220">When tests fail before the 220 SMTP server greeting</a> </h3> -<p> When the client address matches the permanent blacklist, or +<p> When the client address matches the permanent denylist, or when the client fails the pregreet or DNSBL tests, the action is -specified with postscreen_blacklist_action, postscreen_greet_action, +specified with postscreen_denylist_action, postscreen_greet_action, or postscreen_dnsbl_action, respectively. </p> <dl> @@ -464,9 +480,9 @@ measures may help to avoid email delays: </p> <ul> <li> <p> Allow "good" clients to skip tests with the -postscreen_dnsbl_whitelist_threshold feature (Postfix 2.11 and -later). This is especially effective for sites such as Google that -never retry immediately from the same IP address. </p> +postscreen_dnsbl_allowlist_threshold feature. This is especially effective +for large providers that usually don't retry from the same IP +address. </p> <li> <p> Small sites: Configure postscreen(8) to listen on multiple IP addresses, published in DNS as different IP addresses for the @@ -512,7 +528,8 @@ service, so that they never have to deal with postscreen(8)'s tests. receiver send one command and one response at a time. Unlike the Postfix SMTP server, postscreen(8) does not announce support for ESMTP command pipelining. Therefore, clients are not allowed -to send multiple commands. postscreen(8)'s <a href="#after_220">deep +to send multiple commands. postscreen(8)'s +<a href="#after_220">deep protocol test</a> for this is disabled by default. </p> <p> With "postscreen_pipelining_enable = yes", postscreen(8) detects @@ -546,7 +563,8 @@ after the 220 SMTP server greeting</a>" below. </p> of this is the usage of commands such as CONNECT and other non-SMTP commands. Just like the Postfix SMTP server's smtpd_forbidden_commands feature, postscreen(8) has an equivalent postscreen_forbidden_commands -feature to block these clients. postscreen(8)'s <a href="#after_220">deep +feature to block these clients. postscreen(8)'s +<a href="#after_220">deep protocol test</a> for this is disabled by default. </p> <p> With "postscreen_non_smtp_command_enable = yes", postscreen(8) @@ -583,7 +601,8 @@ tests fail after the 220 SMTP server greeting</a>" below. </p> <p> SMTP is a line-oriented protocol: lines have a limited length, and are terminated with <CR><LF>. Lines ending in a "bare" <LF>, that is newline not preceded by carriage return, -are not allowed in SMTP. postscreen(8)'s <a href="#after_220">deep +are not allowed in SMTP. postscreen(8)'s +<a href="#after_220">deep protocol test</a> for this is disabled by default. </p> <p> With "postscreen_bare_newline_enable = yes", postscreen(8) @@ -736,7 +755,7 @@ parameters control these limits. </p> <h2> <a name="victory">When all tests succeed</a> </h2> -<p> When a new SMTP client passes all tests (i.e. it is not whitelisted +<p> When a new SMTP client passes all tests (i.e. it is not allowlisted via some mechanism), postscreen(8) logs this as: </p> <pre> @@ -745,8 +764,8 @@ via some mechanism), postscreen(8) logs this as: </p> <p> Where <i>[address]:port</i> are the client IP address and port. Then, postscreen(8) -creates a temporary whitelist entry that excludes the client IP -address from further tests until the temporary whitelist entry +creates a temporary allowlist entry that excludes the client IP +address from further tests until the temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. </p> <p> When no "<a href="#after_220">deep protocol tests</a>" are @@ -783,7 +802,7 @@ mail</a> <li> <a href="#turnoff"> Turning off postscreen(8) </a> -<li> <a href="#temp_white_sharing"> Sharing the temporary whitelist +<li> <a href="#temp_allow_sharing"> Sharing the temporary allowlist </a> </ul> @@ -803,8 +822,8 @@ tend to have broken SMTP implementations): </p> <pre> /etc/postfix/main.cf: - # Exclude broken clients by whitelisting. Clients in mynetworks - # should always be whitelisted. + # Exclude broken clients by allowlisting. Clients in mynetworks + # should always be allowlisted. postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr @@ -902,14 +921,15 @@ Postfix version 2.8. </p> <li> <p> Some postscreen(8) configuration parameters implement stress-dependent behavior. This is supported only when the default value is stress-dependent (that is, "postconf -d <i>parametername</i>" -output shows "<i>parametername</i> = -${stress?<i>something</i>}${stress:<i>something</i>}"). +output shows +"<i>parametername</i> = ${stress?<i>something</i>}${stress:<i>something</i>}" or +"<i>parametername</i> = ${stress?{<i>something</i>}:{<i>something</i>}}"). Other parameters always evaluate as if the stress value is the empty string. </p> <li> <p> See "<a href="#before_220">Tests before the 220 SMTP server -greeting</a>" for details about the logging from these postscreen(8) -tests. </p> +greeting</a>" for details about the logging from these +postscreen(8) tests. </p> <li> <p> If you run Postfix 2.6 or earlier you must stop and start the master daemon ("<tt>postfix stop; postfix start</tt>"). This @@ -921,8 +941,8 @@ work reliably on all systems. </p> <h3> <a name="starttls"> postscreen(8) TLS configuration </a> </h3> <p> postscreen(8) TLS support is available for remote SMTP clients -that aren't whitelisted, including clients that need to renew their -temporary whitelist status. When a remote SMTP client requests TLS +that aren't allowlisted, including clients that need to renew their +temporary allowlist status. When a remote SMTP client requests TLS service, postscreen(8) invisibly hands off the connection to a tlsproxy(8) process. Then, tlsproxy(8) encrypts and decrypts the traffic between postscreen(8) and the remote SMTP client. One @@ -976,15 +996,16 @@ Postfix SMTP servers dramatically. </p> clients that talk before their turn, and to log the helo/sender/recipient information. This stops over half of all known-to-be illegitimate connections to Wietse's mail server. It is backup protection for -zombies that haven't yet been blacklisted. </p> +zombies that haven't yet been denylisted. </p> <li> <p> You can also enable "<a href="#after_220">deep protocol tests</a>", but these are more intrusive than the pregreet or DNSBL tests. </p> <p> When a good client passes the "<a href="#after_220">deep -protocol tests</a>", postscreen(8) adds the client to the temporary -whitelist but it cannot hand off the "live" connection to a Postfix +protocol tests</a>", +postscreen(8) adds the client to the temporary +allowlist but it cannot hand off the "live" connection to a Postfix SMTP server process in the middle of the session. Instead, postscreen(8) defers mail delivery attempts with a 4XX status, logs the helo/sender/recipient information, and waits for the client to @@ -1000,12 +1021,12 @@ tests</a>" is that some "good" clients don't return after the 4XX reply; these clients were not so good after all. </p> <p> Unfortunately, some senders will retry requests from different -IP addresses, and may never get whitelisted. For this reason, +IP addresses, and may never get allowlisted. For this reason, Wietse stopped using "<a href="#after_220">deep protocol tests</a>" on his own internet-facing mail server. </p> -<li> <p> There is also support for permanent blacklisting and -whitelisting; see the description of the postscreen_access_list +<li> <p> There is also support for permanent denylisting and +allowlisting; see the description of the postscreen_access_list parameter for details. </p> </ul> @@ -1070,15 +1091,15 @@ may follow. </p> </ol> -<h3> <a name="temp_white_sharing"> Sharing the temporary whitelist </a> </h3> +<h3> <a name="temp_allow_sharing"> Sharing the temporary allowlist </a> </h3> -<p> By default, the temporary whitelist is not shared between +<p> By default, the temporary allowlist is not shared between multiple postscreen(8) daemons. To enable sharing, choose one of the following options: </p> <ul> -<li> <p> A non-persistent memcache: temporary whitelist can be shared +<li> <p> A non-persistent memcache: temporary allowlist can be shared between postscreen(8) daemons on the same host or different hosts. Disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons because memcache: has no @@ -1086,7 +1107,7 @@ of the following options: </p> persistent backup). This requires Postfix 2.9 or later. </p> <pre> - # Example 1: non-persistent memcache: whitelist. + # Example 1: non-persistent memcache: allowlist. /etc/postfix/main.cf: postscreen_cache_map = memcache:/etc/postfix/postscreen_cache postscreen_cache_cleanup_interval = 0 @@ -1097,7 +1118,7 @@ of the following options: </p> </pre> <li> <p> - A persistent lmdb: temporary whitelist can be shared between + A persistent lmdb: temporary allowlist can be shared between postscreen(8) daemons that run under the same master(8) daemon, or under different master(8) daemons on the same host. Disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all @@ -1105,28 +1126,28 @@ of the following options: </p> cleanup. This requires Postfix 2.11 or later. </p> <pre> - # Example 2: persistent lmdb: whitelist. + # Example 2: persistent lmdb: allowlist. /etc/postfix/main.cf: postscreen_cache_map = lmdb:$data_directory/postscreen_cache # See note 1 below. # postscreen_cache_cleanup_interval = 0 </pre> -<li> <p> Other kinds of persistent temporary whitelist can be shared +<li> <p> Other kinds of persistent temporary allowlist can be shared only between postscreen(8) daemons that run under the same - master(8) daemon. In this case, temporary whitelist access must + master(8) daemon. In this case, temporary allowlist access must be shared through the proxymap(8) daemon. This requires Postfix 2.9 or later. </p> <pre> - # Example 3: proxied btree: whitelist. + # Example 3: proxied btree: allowlist. /etc/postfix/main.cf: postscreen_cache_map = proxy:btree:/var/lib/postfix/postscreen_cache # See note 1 below. # postscreen_cache_cleanup_interval = 0 - # Example 4: proxied btree: whitelist with memcache: accelerator. + # Example 4: proxied btree: allowlist with memcache: accelerator. /etc/postfix/main.cf: postscreen_cache_map = memcache:/etc/postfix/postscreen_cache proxy_write_maps = @@ -1186,7 +1207,8 @@ POP, IMAP, NNTP, and FTP over TLS. </p> <p> postscreen(8) was officially released as part of the Postfix 2.8 stable release in January 2011.</p> -</body> +<p> Noel Jones helped with the Postfix 3.6 transition towards respectful +documentation. </p> +</body> </html> - diff --git a/external/ibm-public/postfix/dist/proto/QSHAPE_README.html b/external/ibm-public/postfix/dist/proto/QSHAPE_README.html index 14209fed8c9..6956b46c726 100644 --- a/external/ibm-public/postfix/dist/proto/QSHAPE_README.html +++ b/external/ibm-public/postfix/dist/proto/QSHAPE_README.html @@ -7,7 +7,7 @@ <title>Postfix Bottleneck Analysis</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -120,11 +120,11 @@ minutes old and 12 older than 1280 minutes (1440 minutes in a day). <p> When the output is a terminal intermediate results showing the top 20 domains (-n option) are displayed after every 1000 messages (-N option) and the final output also shows only the top 20 domains. This makes -qshape useful even when the deferred queue is very large and it may -otherwise take prohibitively long to read the entire deferred queue. </p> +qshape useful even when the "deferred" queue is very large and it may +otherwise take prohibitively long to read the entire "deferred" queue. </p> <p> By default, qshape shows statistics for the union of both the -incoming and active queues which are the most relevant queues to +"incoming" and "active" queues which are the most relevant queues to look at when analyzing performance. </p> <p> One can request an alternate list of queues: </p> @@ -136,8 +136,8 @@ $ qshape incoming active deferred </pre> </blockquote> -<p> this will show the age distribution of the deferred queue or -the union of the incoming active and deferred queues. </p> +<p> this will show the age distribution of the "deferred" queue or +the union of the "incoming", "active" and "deferred" queues. </p> <p> Command line options control the number of display "buckets", the age limit for the smallest bucket, display of parent domain @@ -154,7 +154,7 @@ dominate the queue sender or recipient counts, approximately when a burst of mail started, and when it stopped. </p> <p> The problem destinations or sender domains appear near the top -left corner of the output table. Remember that the active queue +left corner of the output table. Remember that the "active" queue can accommodate up to 20000 ($qmgr_message_active_limit) messages. To check whether this limit has been reached, use: </p> @@ -164,11 +164,11 @@ $ qshape -s active <i>(show sender statistics)</i> </pre> </blockquote> -<p> If the total sender count is below 20000 the active queue is +<p> If the total sender count is below 20000 the "active" queue is not yet saturated, any high volume sender domains show near the top of the output. -<p> With oqmgr(8) the active queue is also limited to at most 20000 +<p> With oqmgr(8) the "active" queue is also limited to at most 20000 recipient addresses ($qmgr_message_recipient_limit). To check for exhaustion of this limit use: </p> @@ -223,15 +223,15 @@ output. </p> <h2><a name="healthy">Example 1: Healthy queue</a></h2> -<p> When looking at just the incoming and active queues, under -normal conditions (no congestion) the incoming and active queues +<p> When looking at just the "incoming" and "active" queues, under +normal conditions (no congestion) the "incoming" and "active" queues are nearly empty. Mail leaves the system almost as quickly as it -comes in or is deferred without congestion in the active queue. +comes in or is deferred without congestion in the "active" queue. </p> <blockquote> <pre> -$ qshape <i>(show incoming and active queue status)</i> +$ qshape <i>(show "incoming" and "active" queue status)</i> T 5 10 20 40 80 160 320 640 1280 1280+ TOTAL 5 0 0 0 1 0 0 0 1 1 2 @@ -239,9 +239,9 @@ $ qshape <i>(show incoming and active queue status)</i> </pre> </blockquote> -<p> If one looks at the two queues separately, the incoming queue +<p> If one looks at the two queues separately, the "incoming" queue is empty or perhaps briefly has one or two messages, while the -active queue holds more messages and for a somewhat longer time: +"active" queue holds more messages and for a somewhat longer time: </p> <blockquote> @@ -266,7 +266,7 @@ dictionary attack bounces</a></h2> available for some of the hosted domains. Dictionary attacks on the unvalidated domains result in bounce backscatter. The bounces dominate the queue, but with proper tuning they do not saturate the -incoming or active queues. The high volume of deferred mail is not +"incoming" or "active" queues. The high volume of deferred mail is not a direct cause for alarm. </p> <blockquote> @@ -290,7 +290,7 @@ $ qshape deferred | head is the tail end of the time distribution, showing that short term arrival rates are moderate. Larger numbers and lower message ages are more indicative of current trouble. Old mail still going nowhere -is largely harmless so long as the active and incoming queues are +is largely harmless so long as the "active" and "incoming" queues are short. We can also see that the groups.msn.com undeliverables are low rate steady stream rather than a concentrated dictionary attack that is now over. </p> @@ -318,8 +318,9 @@ most of the messages are bounces. </p> queue</a></h2> <p> This example is taken from a Feb 2004 discussion on the Postfix -Users list. Congestion was reported with the active and incoming -queues large and not shrinking despite very large delivery agent +Users list. Congestion was reported with the +"active" and "incoming" queues +large and not shrinking despite very large delivery agent process limits. The thread is archived at: http://groups.google.com/groups?threadm=c0b7js$2r65$1@FreeBSD.csie.NCTU.edu.tw and @@ -331,7 +332,7 @@ that all the messages were for just a few destinations: </p> <blockquote> <pre> -$ qshape <i>(show incoming and active queue status)</i> +$ qshape <i>(show "incoming" and "active" queue status)</i> T A 5 10 20 40 80 160 320 320+ TOTAL 11775 9996 0 0 1 1 42 94 221 1420 @@ -341,10 +342,10 @@ $ qshape <i>(show incoming and active queue status)</i> </pre> </blockquote> -<p> The "A" column showed the count of messages in the active queue, -and the numbered columns showed totals for the deferred queue. At -10000 messages (Postfix 1.x active queue size limit) the active -queue is full. The incoming was growing rapidly. </p> +<p> The "A" column showed the count of messages in the "active" queue, +and the numbered columns showed totals for the "deferred" queue. At +10000 messages (Postfix 1.x "active" queue size limit) the "active" queue +is full. The "incoming" queue was growing rapidly. </p> <p> With the trouble destinations clearly identified, the administrator quickly found and fixed the problem. It is substantially harder to @@ -356,8 +357,8 @@ one message at a time. </p> <h2><a name="backlog">Example 4: High volume destination backlog</a></h2> <p> When a site you send a lot of email to is down or slow, mail -messages will rapidly build up in the deferred queue, or worse, in -the active queue. The qshape output will show large numbers for +messages will rapidly build up in the "deferred" queue, or worse, in +the "active" queue. The qshape output will show large numbers for the destination domain in all age buckets that overlap the starting time of the problem: </p> @@ -373,13 +374,13 @@ $ qshape deferred | head </blockquote> <p> Here the "highvolume.com" destination is continuing to accumulate -deferred mail. The incoming and active queues are fine, but the -deferred queue started growing some time between 1 and 2 hours ago +deferred mail. The "incoming" and "active" queues are fine, but the +"deferred" queue started growing some time between 1 and 2 hours ago and continues to grow. </p> <p> If the high volume destination is not down, but is instead -slow, one might see similar congestion in the active queue. Active -queue congestion is a greater cause for alarm; one might need to +slow, one might see similar congestion in the "active" queue. +"Active" queue congestion is a greater cause for alarm; one might need to take measures to ensure that the mail is deferred instead or even add an access(5) rule asking the sender to try again later. </p> @@ -616,7 +617,7 @@ submission rate or perhaps excessive CPU consumption in the cleanup(8) service due to excessive body_checks, or (Postfix ≥ 2.3) high latency milters. </p> -<p> Note, that once the active queue is full, the cleanup service +<p> Note, that once the "active" queue is full, the cleanup service will attempt to slow down message injection by pausing $in_flow_delay for each message. In this case "maildrop" queue congestion may be a consequence of congestion downstream, rather than a problem in @@ -651,8 +652,8 @@ can be used to manually release messages into the "deferred" queue. <p> Messages can potentially stay in the "hold" queue longer than $maximal_queue_lifetime. If such "old" messages need to be released from -the "hold" queue, they should typically be moved into the "maildrop" -queue using "postsuper -r", so that the message gets a new timestamp and +the "hold" queue, they should typically be moved into the "maildrop" queue +using "postsuper -r", so that the message gets a new timestamp and is given more than one opportunity to be delivered. Messages that are "young" can be moved directly into the "deferred" queue using "postsuper -H". </p> @@ -672,21 +673,21 @@ notifies the queue manager of new mail arrival. The queue manager ignores incomplete queue files whose mode is 0600, as these are still being written by cleanup. </p> -<p> The queue manager scans the incoming queue bringing any new -mail into the "active" queue if the active queue resource limits -have not been exceeded. By default, the active queue accommodates -at most 20000 messages. Once the active queue message limit is -reached, the queue manager stops scanning the incoming (and deferred, -see below) queue. </p> +<p> The queue manager scans the "incoming" queue bringing any new +mail into the "active" queue if the "active" queue resource limits +have not been exceeded. By default, the "active" queue accommodates +at most 20000 messages. Once the "active" queue message limit is +reached, the queue manager stops scanning the "incoming" queue +(and the "deferred" queue, see below). </p> -<p> Under normal conditions the incoming queue is nearly empty (has +<p> Under normal conditions the "incoming" queue is nearly empty (has only mode 0600 files), with the queue manager able to import new -messages into the active queue as soon as they become available. +messages into the "active" queue as soon as they become available. </p> -<p> The incoming queue grows when the message input rate spikes +<p> The "incoming" queue grows when the message input rate spikes above the rate at which the queue manager can import messages into -the active queue. The main factors slowing down the queue manager +the "active" queue. The main factors slowing down the queue manager are disk I/O and lookup queries to the trivial-rewrite service. If the queue manager is routinely not keeping up, consider not using "slow" lookup services (MySQL, LDAP, ...) for transport lookups or speeding @@ -712,8 +713,8 @@ to 1 message per second, but is not strong enough to deflect an excessive input rate from many sources at the same time. </p> <p> If a server is being hammered from multiple directions, consider -raising the in_flow_delay to 10 seconds, but only if the incoming -queue is growing even while the active queue is not full and the +raising the in_flow_delay to 10 seconds, but only if the "incoming" queue +is growing even while the "active" queue is not full and the trivial-rewrite service is using a fast transport lookup mechanism. </p> @@ -723,8 +724,8 @@ trivial-rewrite service is using a fast transport lookup mechanism. ensure fast and fair delivery of mail to all destinations within designated resource limits. </p> -<p> The active queue is somewhat analogous to an operating system's -process run queue. Messages in the active queue are ready to be +<p> The "active" queue is somewhat analogous to an operating system's +process run queue. Messages in the "active" queue are ready to be sent (runnable), but are not necessarily in the process of being sent (running). </p> @@ -732,15 +733,14 @@ sent (running). </p> as a directory on disk, the real "active" queue is a set of data structures in the memory of the queue manager process. </p> -<p> Messages in the "maildrop", "hold", "incoming" and "deferred" -queues (see below) do not occupy memory; they are safely stored on +<p> Messages in the "maildrop", "hold", "incoming" and "deferred" queues +(see below) do not occupy memory; they are safely stored on disk waiting for their turn to be processed. The envelope information for messages in the "active" queue is managed in memory, allowing the queue manager to do global scheduling, allocating available -delivery agent processes to an appropriate message in the active -queue. </p> +delivery agent processes to an appropriate message in the "active" queue. </p> -<p> Within the active queue, (multi-recipient) messages are broken +<p> Within the "active" queue, (multi-recipient) messages are broken up into groups of recipients that share the same transport/nexthop combination; the group size is capped by the transport's recipient concurrency limit. </p> @@ -756,15 +756,15 @@ concurrency limits. Per-recipient limits are appropriate when performing final delivery to mailboxes rather than when relaying to a remote server. </p> -<p> Congestion occurs in the active queue when one or more destinations +<p> Congestion occurs in the "active" queue when one or more destinations drain slower than the corresponding message input rate. </p> -<p> Input into the active queue comes both from new mail in the "incoming" -queue, and retries of mail in the "deferred" queue. Should the "deferred" -queue get really large, retries of old mail can dominate the arrival +<p> Input into the "active" queue comes both from new mail in the "incoming" queue, +and retries of mail in the "deferred" queue. Should the "deferred" queue +get really large, retries of old mail can dominate the arrival rate of new mail. Systems with more CPU, faster disks and more network -bandwidth can deal with larger deferred queues, but as a rule of thumb -the deferred queue scales to somewhere between 100,000 and 1,000,000 +bandwidth can deal with larger "deferred" queues, but as a rule of thumb +the "deferred" queue scales to somewhere between 100,000 and 1,000,000 messages with good performance unlikely above that "limit". Systems with queues this large should typically stop accepting new mail, or put the backlog "on hold" until the underlying issue is fixed (provided that @@ -773,12 +773,12 @@ there is enough capacity to handle just the new mail). </p> <p> When a destination is down for some time, the queue manager will mark it dead, and immediately defer all mail for the destination without trying to assign it to a delivery agent. In this case the messages -will quickly leave the active queue and end up in the deferred queue +will quickly leave the "active" queue and end up in the "deferred" queue (with Postfix < 2.4, this is done directly by the queue manager, with Postfix ≥ 2.4 this is done via the "retry" delivery agent). </p> <p> When the destination is instead simply slow, or there is a problem -causing an excessive arrival rate the active queue will grow and will +causing an excessive arrival rate the "active" queue will grow and will become dominated by mail to the congested destination. </p> <p> The only way to reduce congestion is to either reduce the input @@ -818,7 +818,7 @@ throughput falls to just over 1 message per second. </p> <p> The best way to avoid bottlenecks when one or more MX hosts is non-responsive is to use connection caching. Connection caching was introduced with Postfix 2.2 and is by default enabled on demand for -destinations with a backlog of mail in the active queue. When connection +destinations with a backlog of mail in the "active" queue. When connection caching is in effect for a particular destination, established connections are re-used to send additional messages, this reduces the number of connections made per message delivery and maintains good throughput even @@ -849,20 +849,20 @@ transport allocates a separate delivery agent pool to these destinations and allows separate tuning of timeouts and concurrency limits. </p> <p> Another common cause of congestion is unwarranted flushing of the -entire deferred queue. The deferred queue holds messages that are likely +entire "deferred" queue. The "deferred" queue holds messages that are likely to fail to be delivered and are also likely to be slow to fail delivery -(time out). As a result the most common reaction to a large deferred queue +(time out). As a result the most common reaction to a large "deferred" queue (flush it!) is more than likely counter-productive, and typically makes -the congestion worse. Do not flush the deferred queue unless you expect +the congestion worse. Do not flush the "deferred" queue unless you expect that most of its content has recently become deliverable (e.g. relayhost back up after an outage)! </p> <p> Note that whenever the queue manager is restarted, there may -already be messages in the active queue directory, but the "real" -active queue in memory is empty. In order to recover the in-memory -state, the queue manager moves all the active queue messages -back into the incoming queue, and then uses its normal incoming -queue scan to refill the active queue. The process of moving all +already be messages in the "active" queue directory, but the "real" +"active" queue in memory is empty. In order to recover the in-memory +state, the queue manager moves all the "active" queue messages +back into the "incoming" queue, and then uses its normal "incoming" queue +scan to refill the "active" queue. The process of moving all the messages back and forth, redoing transport table (trivial-rewrite(8) resolve service) lookups, and re-importing the messages back into memory is expensive. At all costs, avoid frequent restarts of the @@ -872,20 +872,20 @@ queue manager (e.g. via frequent execution of "postfix reload"). </p> <p> When all the deliverable recipients for a message are delivered, and for some recipients delivery failed for a transient reason (it -might succeed later), the message is placed in the deferred queue. +might succeed later), the message is placed in the "deferred" queue. </p> -<p> The queue manager scans the deferred queue periodically. The scan -interval is controlled by the queue_run_delay parameter. While a deferred -queue scan is in progress, if an incoming queue scan is also in progress -(ideally these are brief since the incoming queue should be short), the -queue manager alternates between looking for messages in the "incoming" -queue and in the "deferred" queue. This "round-robin" strategy prevents -starvation of either the incoming or the deferred queues. </p> - -<p> Each deferred queue scan only brings a fraction of the deferred -queue back into the active queue for a retry. This is because each -message in the deferred queue is assigned a "cool-off" time when +<p> The queue manager scans the "deferred" queue periodically. The scan +interval is controlled by the queue_run_delay parameter. While a "deferred" queue +scan is in progress, if an "incoming" queue scan is also in progress +(ideally these are brief since the "incoming" queue should be short), the +queue manager alternates between looking for messages in the "incoming" queue +and in the "deferred" queue. This "round-robin" strategy prevents +starvation of either the "incoming" or the "deferred" queues. </p> + +<p> Each "deferred" queue scan only brings a fraction of the "deferred" queue +back into the "active" queue for a retry. This is because each +message in the "deferred" queue is assigned a "cool-off" time when it is deferred. This is done by time-warping the modification time of the queue file into the future. The queue file is not eligible for a retry if its modification time is not yet reached. @@ -897,36 +897,36 @@ the message's age in the queue, and adjusting up or down to lie within the limits. This means that young messages are initially retried more often than old messages. </p> -<p> If a high volume site routinely has large deferred queues, it +<p> If a high volume site routinely has large "deferred" queues, it may be useful to adjust the queue_run_delay, minimal_backoff_time and maximal_backoff_time to provide short enough delays on first failure (Postfix ≥ 2.4 has a sensibly low minimal backoff time by default), with perhaps longer delays after multiple failures, to reduce the retransmission rate of old messages and thereby reduce the quantity -of previously deferred mail in the active queue. If you want a really +of previously deferred mail in the "active" queue. If you want a really low minimal_backoff_time, you may also want to lower queue_run_delay, but understand that more frequent scans will increase the demand for disk I/O. </p> -<p> One common cause of large deferred queues is failure to validate +<p> One common cause of large "deferred" queues is failure to validate recipients at the SMTP input stage. Since spammers routinely launch dictionary attacks from unrepliable sender addresses, the bounces -for invalid recipient addresses clog the deferred queue (and at high -volumes proportionally clog the active queue). Recipient validation +for invalid recipient addresses clog the "deferred" queue (and at high +volumes proportionally clog the "active" queue). Recipient validation is strongly recommended through use of the local_recipient_maps and relay_recipient_maps parameters. Even when bounces drain quickly they inundate innocent victims of forgery with unwanted email. To avoid this, do not accept mail for invalid recipients. </p> <p> When a host with lots of deferred mail is down for some time, -it is possible for the entire deferred queue to reach its retry -time simultaneously. This can lead to a very full active queue once +it is possible for the entire "deferred" queue to reach its retry +time simultaneously. This can lead to a very full "active" queue once the host comes back up. The phenomenon can repeat approximately every maximal_backoff_time seconds if the messages are again deferred after a brief burst of congestion. Perhaps, a future Postfix release will add a random offset to the retry time (or use a combination -of strategies) to reduce the odds of repeated complete deferred -queue flushes. </p> +of strategies) to reduce the odds of repeated complete "deferred" queue +flushes. </p> <h2><a name="credits">Credits</a></h2> diff --git a/external/ibm-public/postfix/dist/proto/RESTRICTION_CLASS_README.html b/external/ibm-public/postfix/dist/proto/RESTRICTION_CLASS_README.html index 0ebce0fe8dc..4988a335500 100644 --- a/external/ibm-public/postfix/dist/proto/RESTRICTION_CLASS_README.html +++ b/external/ibm-public/postfix/dist/proto/RESTRICTION_CLASS_README.html @@ -7,7 +7,7 @@ <title>Postfix Per-Client/User/etc. Access Control</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/SASL_README.html b/external/ibm-public/postfix/dist/proto/SASL_README.html index 89b1cf40185..c70d2423332 100644 --- a/external/ibm-public/postfix/dist/proto/SASL_README.html +++ b/external/ibm-public/postfix/dist/proto/SASL_README.html @@ -5,7 +5,7 @@ <title>Postfix SASL Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -960,9 +960,9 @@ file entries: </p> <dt>ldapdb_uri</dt> -<dd> <p> Specify either <code>ldapi://</code> for to connect over +<dd> <p> Specify either <code>ldapi://</code> to connect over a UNIX-domain socket, <code>ldap://</code> for an unencrypted TCP -connection or <code>ldaps://</code> for an encrypted TCP connection. +connection, or <code>ldaps://</code> for an encrypted TCP connection. </p> </dd> <dt>ldapdb_id</dt> @@ -1697,10 +1697,9 @@ that use the non-standard "<code>AUTH=<em>method.</em>...</code>" syntax in response to the EHLO command; this requires no additional Postfix client configuration. </p> </li> -<li> <p> The Postfix SMTP client does not support the obsolete -"wrappermode" protocol, which uses TCP port <code>465</code> on the -SMTP server. See TLS_README for a solution that uses the -<code>stunnel</code> command. </p> </li> +<li> <p> With the setting "smtp_tls_wrappermode = yes", the Postfix +SMTP client supports the "wrappermode" protocol, which uses TCP +port 465 on the SMTP server (Postfix 3.0 and later). </p> </li> <li> <p> With the <code>smtp_sasl_password_maps</code> parameter, we configure the Postfix SMTP client to send username and password @@ -1810,14 +1809,14 @@ resort. </p> tables into one single MySQL database, and configure different Postfix queries to extract the appropriate information. </p> -<li> <p> Specify dbm instead of hash if your system uses dbm files -instead of db files. To find out what lookup tables Postfix supports, -use the command "postconf -m". </p> +<li> <p> Specify <b>dbm</b> instead of <b>hash</b> if your system uses +<b>dbm</b> files instead of <b>db</b> files. To find out what lookup +tables Postfix supports, use the command "<b>postconf -m</b>". </p> -<li> <p> Execute the command "postmap /etc/postfix/sasl_passwd" +<li> <p> Execute the command "<b>postmap /etc/postfix/sasl_passwd</b>" whenever you change the sasl_passwd table. </p> -<li> <p> Execute the command "postmap /etc/postfix/sender_relay" +<li> <p> Execute the command "<b>postmap /etc/postfix/sender_relay</b>" whenever you change the sender_relay table. </p> </ul> @@ -2048,7 +2047,7 @@ necessary; it just makes Postfix configuration a little more convenient because you don't have to specify the SASL plug-in type in the Postfix main.cf file (but this may cause surprises when you switch to a later Postfix version that is built with the default -SASL type of <code>sasl</code>). </p> +SASL type of <code>cyrus</code>). </p> </li> @@ -2078,7 +2077,7 @@ TLS_README for details. </p> <h4><a name="build_sasl">Building the Cyrus SASL library</a></h4> <p> Postfix works with cyrus-sasl-1.5.x or cyrus-sasl-2.1.x, which are -available from ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/. </p> +available from https://github.com/cyrusimap/cyrus-sasl/releases. </p> <blockquote> @@ -2128,6 +2127,10 @@ definitions: </p> -I/usr/local/include/sasl" AUXLIBS="-L/usr/local/lib -lsasl2"</strong> </pre> +<p> If your Cyrus SASL shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lsasl2". </p> + </dd> <dt>Cyrus SASL version 1.5.x</dt> @@ -2185,7 +2188,7 @@ it unless you are forced to. The makers of Cyrus SASL write: </p> <blockquote> <i> This library is being deprecated and applications should transition to using the SASLv2 library</i> (source: <a -href="http://cyrusimap.web.cmu.edu/downloads.html">Project Cyrus: +href="http://www.cyrusimap.org/download.html">Project Cyrus: Downloads</a>). </blockquote> <p> If you still need to set it up, here's a quick rundown: </p> diff --git a/external/ibm-public/postfix/dist/proto/SCHEDULER_README.html b/external/ibm-public/postfix/dist/proto/SCHEDULER_README.html index f1fbbb2b375..d80b8f4e367 100644 --- a/external/ibm-public/postfix/dist/proto/SCHEDULER_README.html +++ b/external/ibm-public/postfix/dist/proto/SCHEDULER_README.html @@ -7,7 +7,7 @@ <title>Postfix Queue Scheduler</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -720,7 +720,7 @@ nqmgr </a> </h3> <p> Let's start by recapitulating the structures and terms used when -referring to queue manager and how it operates. Many of these are +referring to the queue manager and how it operates. Many of these are partially described elsewhere, but it is nice to have a coherent overview in one place: @@ -745,7 +745,7 @@ it shall talk to) and jobs (referencing the messages it shall deliver). </p> <li> <p> Each transport queue (not to be confused with the on-disk -active queue or incoming queue) groups everything what is going be +"active" queue or "incoming" queue) groups everything what is going be delivered to given destination (aka nexthop) by its transport. Each queue belongs to one transport, so each destination may be referred to by several queues, one for each transport. Each queue maintains @@ -795,7 +795,7 @@ up the message </a> </h3> <p> -Whenever <tt>nqmgr</tt> moves a queue file into the active queue, +Whenever <tt>nqmgr</tt> moves a queue file into the "active" queue, the following happens: It reads all necessary information from the queue file as <tt>oqmgr</tt> does, and also reads as many recipients as possible - more on that later, for now let's just pretend it @@ -809,7 +809,7 @@ Then it resolves the recipients as <tt>oqmgr</tt> does, which means obtaining (address, nexthop, transport) triple for each recipient. For each triple, it finds the transport; if it does not exist yet, it instantiates it (unless it's dead). Within the -transport, it finds the destination queue for given nexthop; if it +transport, it finds the destination queue for the given nexthop; if it does not exist yet, it instantiates it (unless it's dead). The triple is then bound to given destination queue. This happens in qmgr_resolve() and is basically the same as in <tt>oqmgr</tt>. @@ -826,9 +826,10 @@ the bound destination queue within this jobs context; if it does not exist yet, it instantiates it. Finally, it stores the address from the resolved triple to the recipient entry which is appended to both the queue entry list and the peer entry list. The addresses -for same nexthop are batched in the entries up to recipient_concurrency -limit for that transport. This happens in qmgr_assign() and apart -from that it operates with job and peer structures it is basically the +for the same nexthop are batched in the entries up to the +<i>transport</i>_destination_recipient_limit for that transport. +This happens in qmgr_message_assign(), and apart +from that it operates with job and peer structures, it is basically the same as in <tt>oqmgr</tt>. </p> @@ -845,9 +846,9 @@ time is important as we will see shortly. <p> -[Now you should have pretty good idea what is the state of the -<tt>nqmgr</tt> after couple of messages was picked up, what is the -relation between all those job, peer, queue and entry structures.] +[Now you should have a pretty good idea what the state of the +<tt>nqmgr</tt> is after a couple of messages were picked up, and what the +relation is between all those job, peer, queue and entry structures.] </p> @@ -894,7 +895,8 @@ was picked up by the <tt>nqmgr</tt>. So by default we get the top-level round-robin transport, and within each transport we get the FIFO message delivery. The round-robin of the peers by the destination is perhaps of little importance in most real-life cases -(unless the recipient_concurrency limit is reached, in one job there +(unless the <i>transport</i>_destination_recipient_limit is reached, +in one job there is only one peer structure for each destination), but theoretically it makes sure that even within single jobs, destinations are treated fairly. @@ -986,11 +988,11 @@ mail followed by two two-recipient mails? The simple answer would be to use delivery sequence <tt>12121313</tt>. But the problem is that this does not scale well. Imagine you have -mail with thousand recipients followed by mail with hundred recipients. +mail with a thousand recipients followed by mail with a hundred recipients. It is tempting to suggest the delivery sequence like <tt>121212....</tt>, but alas! Imagine there arrives another mail with say ten recipients. But there are no free slots anymore, so it can't slip by, not even -if it had just only one recipients. It will be stuck until the +if it had only one recipient. It will be stuck until the hundred-recipient mail is delivered, which really sucks. </p> @@ -998,7 +1000,7 @@ hundred-recipient mail is delivered, which really sucks. <p> So, it becomes obvious that while inflating the message to get -free slots is great idea, one has to be really careful of how the +free slots is a great idea, one has to be really careful of how the free slots are assigned, otherwise one might corner himself. So, how does <tt>nqmgr</tt> really use the free slots? @@ -1032,7 +1034,7 @@ thousand recipient mail? <p> -Well, despite it looks so at the first glance, another trick will +Well, despite the fact that it looks so at the first glance, another trick will allow us to answer "no, we are not!". If we had said that we will inflate the delivery time twice at maximum, and then we consider every other slot as a free slot, then we would overinflate in case @@ -1056,7 +1058,7 @@ transport has a <i>transport</i>_delivery_slot_cost parameter, which defaults to default_delivery_slot_cost parameter which is set to 5 by default. This is the k from the paragraph above. Each time k entries of the job are selected for delivery, this counter is -incremented by one. Once there are some slots accumulated, job which +incremented by one. Once there are some slots accumulated, a job which requires no more than that number of slots to be fully delivered can preempt this job. @@ -1066,7 +1068,7 @@ can preempt this job. [Well, the truth is, the counter is incremented every time an entry is selected and it is divided by k when it is used. -But for the understanding it's good enough to use +But to understand, it's good enough to use the above approximation of the truth.] </p> @@ -1083,7 +1085,7 @@ and when does all this exactly happen? <p> The answer for the first part is simple. The job whose entry was -selected the last time is so called current job. Normally, it is +selected the last time is the so called current job. Normally, it is the first job on the scheduler's job list, but destination concurrency limits may change this as we will see later. It is always only the current job which may get preempted. @@ -1092,7 +1094,7 @@ current job which may get preempted. <p> -Now for the second part. The current job has certain amount of +Now for the second part. The current job has a certain amount of recipient entries, and as such may accumulate at maximum some amount of available delivery slots. It might have already accumulated some, and perhaps even already used some when it was preempted before @@ -1111,8 +1113,8 @@ That is, the older the job is, the more we should try to deliver it in order to get best message delivery rates. These rates are of course subject to how many recipients the message has, therefore the division by the recipient (entry) count. No one shall be surprised -that message with n recipients takes n times longer to deliver than -message with one recipient. +that a message with n recipients takes n times longer to deliver than +a message with one recipient. </p> @@ -1124,9 +1126,9 @@ delivered within the number of slots the current job already accumulated? Why do we need to estimate how much it has yet to accumulate? If you found out the answer, congratulate yourself. If we did it this simple way, we would always choose the candidate -with least recipient entries. If there were enough single recipient +with the fewest recipient entries. If there were enough single recipient mails coming in, they would always slip by the bulk mail as soon -as possible, and the two and more recipients mail would never get +as possible, and the two or more recipients mail would never get a chance, no matter how long they have been sitting around in the job list. @@ -1134,7 +1136,7 @@ job list. <p> -This candidate selection has interesting implication - that when +This candidate selection has an interesting implication - that when we choose the best candidate for preemption (this is done in qmgr_choose_candidate()), it may happen that we may not use it for preemption immediately. This leads to an answer to the last part @@ -1148,12 +1150,12 @@ The preemption attempt happens every time next transport's recipient entry is to be chosen for delivery. To avoid needless overhead, the preemption is not attempted if the current job could never accumulate more than <i>transport</i>_minimum_delivery_slots (defaults to -default_minimum_delivery_slots which defaults to 3). If there is +default_minimum_delivery_slots which defaults to 3). If there are already enough accumulated slots to preempt the current job by the chosen best candidate, it is done immediately. This basically means that the candidate is moved in front of the current job on the scheduler's job list and decreasing the accumulated slot counter -by the amount used by the candidate. If there is not enough slots... +by the amount used by the candidate. If there are not enough slots... well, I could say that nothing happens and the another preemption is attempted the next time. But that's not the complete truth. @@ -1164,13 +1166,13 @@ is attempted the next time. But that's not the complete truth. The truth is that it turns out that it is not really necessary to wait until the jobs counter accumulates all the delivery slots in advance. Say we have ten-recipient mail followed by two two-recipient -mails. If the preemption happened when enough delivery slot accumulate +mails. If the preemption happened when enough delivery slots accumulate (assuming slot cost 2), the delivery sequence becomes <tt>11112211113311</tt>. Now what would we get if we would wait only for 50% of the necessary slots to accumulate and we promise we would wait for the remaining 50% later, after we get back -to the preempted job? If we use such slot loan, the delivery sequence -becomes <tt>11221111331111</tt>. As we can see, it makes it no +to the preempted job? If we use such a slot loan, the delivery sequence +becomes <tt>11221111331111</tt>. As we can see, it makes it not considerably worse for the delivery of the ten-recipient mail, but it allows the small messages to be delivered sooner. @@ -1192,15 +1194,15 @@ accumulated so far. <p> -And it pretty much concludes this chapter. +And that pretty much concludes this chapter. </p> <p> [Now you should have a feeling that you pretty much understand the -scheduler and the preemption, or at least that you will have it -after you read the last chapter couple more times. You shall clearly +scheduler and the preemption, or at least that you will have +after you read the last chapter a couple more times. You shall clearly see the job list and the preemption happening at its head, in ideal delivery conditions. The feeling of understanding shall last until you start wondering what happens if some of the jobs are blocked, @@ -1226,17 +1228,17 @@ selected by the scheduler? <p> -From user's point of view it is all simple. If some of the peers +From the user's point of view it is all simple. If some of the peers of a job can't be selected, those peers are simply skipped by the entry selection algorithm (the pseudo-code described before) and only the selectable ones are used. If none of the peers may be selected, the job is declared a "blocker job". Blocker jobs are skipped by the entry selection algorithm and they are also excluded -from the candidates for preemption of current job. Thus the scheduler +from the candidates for preemption of the current job. Thus the scheduler effectively behaves as if the blocker jobs didn't exist on the job list at all. As soon as at least one of the peers of a blocker job becomes unblocked (that is, the delivery agent handling the delivery -of the recipient entry for given destination successfully finishes), +of the recipient entry for the given destination successfully finishes), the job's blocker status is removed and the job again participates in all further scheduler actions normally. @@ -1298,8 +1300,8 @@ this change because of blockers? <p> -The answer is: a lot. Any job may become blocker job at any time, -and also become normal job again at any time. This has several +The answer is: a lot. Any job may become a blocker job at any time, +and also become a normal job again at any time. This has several important implications: </p> @@ -1320,7 +1322,7 @@ unblocked and is completed... You get the idea. <p> [Interesting side note: even when jobs are delivered out of order, -from single destination's point of view the jobs are still delivered +from a single destination's point of view the jobs are still delivered in the expected order (that is, FIFO unless there was some preemption involved). This is because whenever a destination queue becomes unblocked (the destination limit allows selection of more recipient @@ -1371,7 +1373,7 @@ huh? <p> If I illustrate the relations after the above mentioned examples -(but those in point 1)), the situation would look like this: +(but those in point 1), the situation would look like this: </p> @@ -1398,8 +1400,8 @@ Now how does <tt>nqmgr</tt> deal with all these complicated relations? <p> Well, it maintains them all as described, but fortunately, all these -relations are necessary only for purposes of proper counting of -available delivery slots. For purposes of ordering the jobs for +relations are necessary only for the purpose of proper counting of +available delivery slots. For the purpose of ordering the jobs for entry selection, the original rule still applies: "the job preempting the current job is moved in front of the current job on the job list". So for entry selection purposes, the job relations remain @@ -1428,8 +1430,8 @@ are simply ignored. <p> -[By now, you should have a feeling that there is more things going -under the hood than you ever wanted to know. You decide that +[By now, you should have a feeling that there are more things going +on under the hood than you ever wanted to know. You decide that forgetting about this chapter is the best you can do for the sake of your mind's health and you basically stick with the idea how the scheduler works in ideal conditions, when there are no blockers, @@ -1443,11 +1445,11 @@ limits </a> </h3> <p> When discussing the <tt>nqmgr</tt> scheduler, we have so far assumed -that all recipients of all messages in the active queue are completely -read into the memory. This is simply not true. There is an upper +that all recipients of all messages in the "active" queue are completely +read into memory. This is simply not true. There is an upper bound on the amount of memory the <tt>nqmgr</tt> may use, and therefore it must impose some limits on the information it may store -in the memory at any given time. +in memory at any given time. </p> @@ -1456,11 +1458,11 @@ in the memory at any given time. First of all, not all messages may be read in-core at once. At any time, only qmgr_message_active_limit messages may be read in-core at maximum. When read into memory, the messages are picked from the -incoming and deferred message queues and moved to the active queue -(incoming having priority), so if there is more than -qmgr_message_active_limit messages queued in the active queue, the -rest will have to wait until (some of) the messages in the active -queue are completely delivered (or deferred). +"incoming" and "deferred" queues and moved to the "active" queue +(incoming having priority), so if there are more than +qmgr_message_active_limit messages queued in the "active" queue, the +rest will have to wait until (some of) the messages in the "active" queue +are completely delivered (or deferred). </p> @@ -1468,11 +1470,11 @@ queue are completely delivered (or deferred). Even with the limited amount of in-core messages, there is another limit which must be imposed in order to avoid memory exhaustion. -Each message may contain huge amount of recipients (tens or hundreds +Each message may contain a huge number of recipients (tens or hundreds of thousands are not uncommon), so if <tt>nqmgr</tt> read all -recipients of all messages in the active queue, it may easily run +recipients of all messages in the "active" queue, it may easily run out of memory. Therefore there must be some upper bound on the -amount of message recipients which are read into the memory at the +amount of message recipients which are read into memory at the same time. </p> @@ -1490,8 +1492,8 @@ affects the <tt>nqmgr</tt> and its scheduler. The message limit is straightforward - it just limits the size of the lookahead the <tt>nqmgr</tt>'s scheduler has when choosing which -message can preempt the current one. Messages not in the active -queue simply are not considered at all. +message can preempt the current one. Messages not in the "active" queue +are simply not considered at all. </p> @@ -1517,12 +1519,12 @@ of recipient entries. With unread recipients, it is not clear how many recipient entries there will be, as they are subject to per-destination grouping. It is not even clear to what transports (and thus jobs) the recipients will be assigned. And with messages -coming from the deferred queue, it is not even clear how many unread +coming from the "deferred" queue, it is not even clear how many unread recipients are still to be delivered. This all means that the scheduler must use only estimates of how many recipients entries there will be. Fortunately, it is possible to estimate the minimum and maximum correctly, so the scheduler can always err on the safe -side. Obviously, the better the estimates, the better results, so +side. Obviously, the better the estimates, the better the results, so it is best when we are able to read all recipients in-core and turn the estimates into exact counts, or at least try to read as many as possible to make the estimates as accurate as possible. @@ -1552,9 +1554,9 @@ it achieve it? <p> Perhaps the easiest solution would be to say that each message may -have at maximum X recipients stored in-core, but such solution would +have at maximum X recipients stored in-core, but such a solution would be poor for several reasons. With reasonable qmgr_message_active_limit -values, the X would have to be quite low to maintain reasonable +values, the X would have to be quite low to maintain a reasonable memory footprint. And with low X lots of things would not work well. The <tt>nqmgr</tt> would have problems to use the <i>transport</i>_destination_recipient_limit efficiently. The @@ -1568,11 +1570,11 @@ again. <p> Therefore it seems reasonable to have a solution which does not use -a limit imposed on per-message basis, but which maintains a pool +a limit imposed on a per-message basis, but which maintains a pool of available recipient slots, which can be shared among all messages in the most efficient manner. And as we do not want separate transports to compete for resources whenever possible, it seems -appropriate to maintain such recipient pool for each transport +appropriate to maintain such a recipient pool for each transport separately. This is the general idea, now how does it work in practice? @@ -1580,13 +1582,13 @@ practice? <p> -First we have to solve little chicken-and-egg problem. If we want +First we have to solve a little chicken-and-egg problem. If we want to use the per-transport recipient pools, we first need to know to -what transport(s) is the message assigned. But we will find that -out only after we read in the recipients first. So it is obvious +what transport(s) the message is assigned. But we will find that +out only after we first read in the recipients. So it is obvious that we first have to read in some recipients, use them to find out -to what transports is the message to be assigned, and only after -that we can use the per-transport recipient pools. +to what transports the message is to be assigned, and only after +that can we use the per-transport recipient pools. </p> @@ -1595,12 +1597,12 @@ that we can use the per-transport recipient pools. Now how many recipients shall we read for the first time? This is what qmgr_message_recipient_minimum and qmgr_message_recipient_limit values control. The qmgr_message_recipient_minimum value specifies -how many recipients of each message we will read for the first time, +how many recipients of each message we will read the first time, no matter what. It is necessary to read at least one recipient before we can assign the message to a transport and create the first job. However, reading only qmgr_message_recipient_minimum recipients even if there are only few messages with few recipients in-core would -be wasteful. Therefore if there is less than qmgr_message_recipient_limit +be wasteful. Therefore if there are fewer than qmgr_message_recipient_limit recipients in-core so far, the first batch of recipients may be larger than qmgr_message_recipient_minimum - as large as is required to reach the qmgr_message_recipient_limit limit. @@ -1624,10 +1626,10 @@ qmgr_message_recipient_minimum amount which always applies). <p> -For example, if a message has three jobs, first with 1 recipient -still in-core and 4 recipient slots, second with 5 recipient in-core -and 5 recipient slots, and third with 2 recipients in-core and 0 -recipient slots, it has 1+5+2=7 recipients in-core and 4+5+0=9 jobs' +For example, if a message has three jobs, the first with 1 recipient +still in-core and 4 recipient slots, the second with 5 recipients in-core +and 5 recipient slots, and the third with 2 recipients in-core and 0 +recipient slots, it has 1+5+2=8 recipients in-core and 4+5+0=9 jobs' recipients slots in total. This means that we could immediately read 2+qmgr_message_recipient_minimum more recipients of that message in core. @@ -1675,9 +1677,9 @@ More specifically, each time a job is created and appended to the job list, it gets all unused recipient slots from its transport's pool. It keeps them until all recipients of its message are read. When this happens, all unused recipient slots are transferred to -the next job (which is now in fact now first such job) on the job +the next job (which is now in fact the first such job) on the job list which still has some recipients unread, or eventually back to -the transport pool if there is no such job. Such transfer then also +the transport pool if there is no such job. Such a transfer then also happens whenever a recipient entry of that job is delivered. </p> @@ -1685,10 +1687,10 @@ happens whenever a recipient entry of that job is delivered. <p> There is also a scenario when a job is not appended to the end of -the job list (for example it was created as a result of second or +the job list (for example it was created as a result of a second or later recipient batch). Then it works exactly as above, except that if it was put in front of the first unread job (that is, the job -of a message which still has some unread recipients in queue file), +of a message which still has some unread recipients in the queue file), that job is first forced to return all of its unused recipient slots to the transport pool. @@ -1705,21 +1707,21 @@ as they still have recipients in-core (the maximum is there because of the sponsoring mentioned before) and the jobs after this job get nothing from the transport recipient pool (unless they got something before and then the first unread job was created and enqueued in -front of them later - in such case the also get at maximum as many +front of them later - in such a case, they also get at maximum as many slots as they have recipients in-core). </p> <p> -Things work fine in such state for most of the time, because the -current job is either completely read in-core or has as much recipient +Things work fine in such a state for most of the time, because the +current job is either completely read in-core or has as many recipient slots as there are, but there is one situation which we still have to take care of specially. Imagine if the current job is preempted by some unread job from the job list and there are no more recipient slots available, so this new current job could read only batches of qmgr_message_recipient_minimum recipients at a time. This would -really degrade performance. For this reason, each transport has +really degrade performance. For this reason, each transport has an extra pool of <i>transport</i>_extra_recipient_limit recipient slots, dedicated exactly for this situation. Each time an unread job preempts the current job, it gets half of the remaining recipient @@ -1730,7 +1732,7 @@ slots from the normal pool and this extra pool. <p> And that's it. It sure does sound pretty complicated, but fortunately -most people don't really have to care how exactly it works as long +most people don't really have to care exactly how it works as long as it works. Perhaps the only important things to know for most people are the following upper bound formulas: @@ -1783,7 +1785,7 @@ where the sum is over all used transports. <p> And this terribly complicated chapter concludes the documentation -of <tt>nqmgr</tt> scheduler. +of the <tt>nqmgr</tt> scheduler. </p> @@ -1793,7 +1795,7 @@ of <tt>nqmgr</tt> scheduler. inside out. In practice, you still hope that you will never have to really understand the last or last two chapters completely, and fortunately most people really won't. Understanding how the scheduler -works in ideal conditions is more than good enough for vast majority +works in ideal conditions is more than good enough for the vast majority of users.] </p> diff --git a/external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html b/external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html index af73f78b58c..ce38bc82c02 100644 --- a/external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html +++ b/external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html @@ -7,7 +7,7 @@ <title>Postfix SMTP relay and access control </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -55,7 +55,7 @@ policies </a> </h2> Mail servers happily forwarded mail on behalf of anyone towards any destination. On today's Internet, spammers abuse servers that forward mail from arbitrary systems, and abused systems end up on -anti-spammer blacklists. See, for example, the information on +anti-spammer denylists. See, for example, the information on http://www.mail-abuse.org/ and other websites. </p> <p> By default, Postfix has a moderately restrictive approach to @@ -87,11 +87,11 @@ SMTP client implementations. Protocol-oriented access controls become less useful over time as spammers and worm writers learn to read RFC documents. </p> -<li> <p> Blacklist oriented: some SMTP server access controls -query blacklists with known to be bad sites such as open mail +<li> <p> Denylist oriented: some SMTP server access controls +query denylists with known to be bad sites such as open mail relays, open web proxies, and home computers that have been compromised and that are under remote control by criminals. The -effectiveness of these blacklists depends on how complete and how +effectiveness of these denylists depends on how complete and how up to date they are. </p> <li> <p> Threshold oriented: some SMTP server access controls attempt @@ -218,8 +218,9 @@ some restriction produces a result of PERMIT, REJECT or DEFER (try again later). The end of each list is equivalent to a PERMIT result. By placing a PERMIT restriction before a REJECT restriction you can make exceptions for specific clients or users. This is called -whitelisting; the fourth example above allows mail from local -networks but otherwise rejects mail to arbitrary destinations. </p> +allowlisting; the smtpd_relay_restrictions example above allows mail from local +networks, and from SASL authenticated clients, but otherwise rejects mail +to arbitrary destinations. </p> <p> The table below summarizes the purpose of each SMTP access restriction list. All lists use the exact same syntax; they differ @@ -320,7 +321,7 @@ until the RCPT TO command, it can log the sender and the recipient address. This is more useful than logging only the client hostname and IP address and not knowing whose mail was being blocked. </p> -<li> <p> Mixing is needed for complex whitelisting policies. For +<li> <p> Mixing is needed for complex allowlisting policies. For example, in order to reject local sender addresses in mail from non-local clients, you need to be able to mix restrictions on client information with restrictions on sender information in the same diff --git a/external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html b/external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html index e2554b217e1..b8df76eaa29 100644 --- a/external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html +++ b/external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html @@ -7,7 +7,7 @@ <title>Postfix SMTP Access Policy Delegation </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -24,8 +24,8 @@ block or accept mail at specific SMTP protocol stages. In addition, the Postfix SMTP server can delegate decisions to an external policy server (Postfix 2.1 and later). </p> -<p> With this policy delegation mechanism, a simple <a href="#greylist"> -greylist </a> policy can be implemented with only a dozen lines of +<p> With this policy delegation mechanism, a simple +<a href="#greylist">greylist</a> policy can be implemented with only a dozen lines of Perl, as is shown at the end of this document. A complete example can be found in the Postfix source code, in the directory examples/smtpd-policy. </p> @@ -269,7 +269,7 @@ a TCP socket at 127.0.0.1 port 9998. The second example specifies an absolute pathname of a UNIX-domain socket. The third example specifies a pathname relative to the Postfix queue directory; use this for policy servers that are spawned by the Postfix master -daemon. </p> +daemon. On many systems, "local" is a synonym for "unix".</p> <p> To create a policy service that listens on a UNIX-domain socket called "policy", and that runs under control of the Postfix spawn(8) @@ -316,7 +316,7 @@ open relay. </p> <li> <p> Line 11: this increases the time that a policy server process may run to 3600 seconds. The default time limit of 1000 -seconds is too short; the policy daemon needs to run long as the +seconds is too short; the policy daemon needs to run as long as the SMTP server process that talks to it. See the spawn(8) manpage for more information about the <i>transport</i>_time_limit parameter. </p> @@ -565,7 +565,7 @@ each request and reply. </p> <li> <p> Line 6: this increases the time that a greylist server process may run to 3600 seconds. The default time limit of 1000 -seconds is too short; the greylist daemon needs to run long as the +seconds is too short; the greylist daemon needs to run as long as the SMTP server process that talks to it. See the spawn(8) manpage for more information about the <i>transport</i>_time_limit parameter. </p> @@ -615,7 +615,7 @@ client/server configuration</a>" section above. </p> domains that often appear in forged email. At some point in cyberspace/time a list of frequently forged MAIL FROM domains could be found at -http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in. +https://web.archive.org/web/20080526153208/http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in. <blockquote> <pre> @@ -672,7 +672,7 @@ exceptions for mailing lists that use one-time sender addresses, because each message will be delayed due to greylisting, and the one-time sender addresses can pollute your greylist database relatively quickly. Instead of making exceptions, you can automatically -whitelist clients that survive greylisting repeatedly; this avoids +allowlist clients that survive greylisting repeatedly; this avoids most of the delays and most of the database pollution problem. </p> <blockquote> @@ -746,11 +746,11 @@ $database_name="/var/mta/greylist.db"; $greylist_delay=60; # -# Auto-whitelist threshold. Specify 0 to disable, or the number of +# Auto-allowlist threshold. Specify 0 to disable, or the number of # successful "come backs" after which a client is no longer subject # to greylisting. # -$auto_whitelist_threshold = 10; +$auto_allowlist_threshold = 10; # # Demo SMTPD access policy routine. The result is an action just like @@ -763,10 +763,10 @@ sub smtpd_access_policy { # Open the database on the fly. open_database() unless $database_obj; - # Search the auto-whitelist. - if ($auto_whitelist_threshold > 0) { + # Search the auto-allowlist. + if ($auto_allowlist_threshold > 0) { $count = read_database($attr{"client_address"}); - if ($count > $auto_whitelist_threshold) { + if ($count > $auto_allowlist_threshold) { return "dunno"; } } @@ -795,8 +795,8 @@ sub smtpd_access_policy { # syslog $syslog_priority, "request age %d", $now - $time_stamp if $verbose; if ($now - $time_stamp > $greylist_delay) { - # Update the auto-whitelist. - if ($auto_whitelist_threshold > 0) { + # Update the auto-allowlist. + if ($auto_allowlist_threshold > 0) { update_database($attr{"client_address"}, $count + 1); } return "dunno"; diff --git a/external/ibm-public/postfix/dist/proto/SMTPD_PROXY_README.html b/external/ibm-public/postfix/dist/proto/SMTPD_PROXY_README.html index 0b5780719a9..710183b7b89 100644 --- a/external/ibm-public/postfix/dist/proto/SMTPD_PROXY_README.html +++ b/external/ibm-public/postfix/dist/proto/SMTPD_PROXY_README.html @@ -7,7 +7,7 @@ <title>Postfix Before-Queue Content Filter </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -199,8 +199,9 @@ usual. </p> <p> The content filter itself is not described here. You can use any filter that is SMTP enabled. For non-SMTP capable content filtering software, Bennett Todd's SMTP proxy implements a nice -Perl-based framework. See: http://bent.latency.net/smtpprox/ or -https://github.com/jnorell/smtpprox.</p> +Perl-based framework. See: +https://web.archive.org/web/20151022025756/http://bent.latency.net/smtpprox/ +or https://github.com/jnorell/smtpprox/ </p> <blockquote> @@ -351,8 +352,8 @@ the top of the master.cf file: </p> <p> By default, the filter has 100 seconds to do its work. If it takes longer then Postfix gives up and reports an error to the -remote SMTP client. You can increase this time limit (see configuration -parameter section below) but doing so is pointless because you +remote SMTP client. You can increase this time limit (see the <a href="#parameters">"Configuration +parameters"</a> section below) but doing so is pointless because you can't control when the remote SMTP client times out. </p> <h2><a name="parameters">Configuration parameters</a></h2> diff --git a/external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html b/external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html index 9389297ad05..c0e5608381d 100644 --- a/external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html +++ b/external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html @@ -244,7 +244,7 @@ turned on (smtputf8_enable = yes). </p> <p> For compatibility with pre-SMTPUTF8 environments, Postfix does not automatically set the "SMTPUTF8 requested" flag on messages -from non-SMTPUTF8 clients that contain an UTF-8 header value or +from non-SMTPUTF8 clients that contain a UTF-8 header value or UTF-8 address localpart. This would make such messages undeliverable to non-SMTPUTF8 servers, and could be a barrier to SMTPUTF8 adoption. </p> diff --git a/external/ibm-public/postfix/dist/proto/SQLITE_README.html b/external/ibm-public/postfix/dist/proto/SQLITE_README.html index 2cd36ad59ca..598f80cf2b2 100644 --- a/external/ibm-public/postfix/dist/proto/SQLITE_README.html +++ b/external/ibm-public/postfix/dist/proto/SQLITE_README.html @@ -7,7 +7,7 @@ <title>Postfix SQLite Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -48,6 +48,10 @@ make -f Makefile.init makefiles \ </pre> </blockquote> +<p> If your SQLite shared library is in a directory that the RUN-TIME +linker does not know about, add a "-Wl,-R,/path/to/directory" option after +"-lsqlite3". </p> + <p> Postfix versions before 3.0 use AUXLIBS instead of AUXLIBS_SQLITE. With Postfix 3.0 and later, the old AUXLIBS variable still supports building a statically-loaded SQLite database client, but only the new @@ -94,12 +98,6 @@ dbpath = /some/path/to/sqlite_database query = SELECT forw_addr FROM mxaliases WHERE alias='%s' AND status='paid' </pre> -<h2>Additional notes</h2> - -<p> The SQLite configuration interface setup allows for multiple -sqlite databases: you can use one for a virtual table, one for an -access table, and one for an aliases table if you want. </p> - <h2>Credits</h2> <p> SQLite support was added with Postfix version 2.8. </p> diff --git a/external/ibm-public/postfix/dist/proto/STANDARD_CONFIGURATION_README.html b/external/ibm-public/postfix/dist/proto/STANDARD_CONFIGURATION_README.html index 4fbea57f576..b4f4efcf5a9 100644 --- a/external/ibm-public/postfix/dist/proto/STANDARD_CONFIGURATION_README.html +++ b/external/ibm-public/postfix/dist/proto/STANDARD_CONFIGURATION_README.html @@ -7,7 +7,7 @@ <title>Postfix Standard Configuration Examples</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -168,7 +168,7 @@ at their default settings. </p> <p> First we present the non-mailhost configuration, because it is the simpler one. This machine sends mail as "user@example.com" and -is final destination for "user@hostname.example.com". </p> +is the final destination for "user@hostname.example.com". </p> <blockquote> <pre> @@ -198,7 +198,7 @@ a firewall</a>". </p> </ul> <p> Next we present the mailhost configuration. This machine sends -mail as "user@example.com" and is final destination for +mail as "user@example.com" and is the final destination for "user@hostname.example.com" as well as "user@example.com". </p> <blockquote> @@ -341,7 +341,7 @@ All the mail to these two accounts is forwarded to an inside address. only address literals matching $inet_interfaces or $proxy_interfaces are deemed local. So "localpart@[a.d.d.r]" can be matched as simply "localpart" in canonical(5) and virtual(5). This avoids the need to -specify firewall IP addresses into Postfix configuration files. </p> +specify firewall IP addresses in Postfix configuration files. </p> </ul> @@ -478,7 +478,7 @@ mail_version</b>". </p> <p> The following example presents additional configuration. You need to combine this with basic configuration information as -discussed the first half of this document. </p> +discussed in the first half of this document. </p> <blockquote> <pre> @@ -526,7 +526,7 @@ you edit the transport table. </p> <h2><a name="backup">Configuring Postfix as primary or backup MX host for a remote site</a></h2> <p> This section presents additional configuration. You need to -combine this with basic configuration information as discussed the +combine this with basic configuration information as discussed in the first half of this document. </p> <p> When your system is SECONDARY MX host for a remote site this @@ -642,7 +642,7 @@ of the time. For dialup connections that are up 24x7, see the <a href="#local_network">local area network</a> section above. </p> <p> This section presents additional configuration. You need to -combine this with basic configuration information as discussed the +combine this with basic configuration information as discussed in the first half of this document. </p> <p> If you do not have your own hostname and IP address (usually @@ -749,7 +749,7 @@ send mail between users on the same machine. </p> <p> The following example presents additional configuration. You need to combine this with basic configuration information as -discussed the first half of this document. </p> +discussed in the first half of this document. </p> <blockquote> <pre> @@ -797,7 +797,7 @@ address of their own.</p> <p> The following example presents additional configuration. You need to combine this with basic configuration information as -discussed the first half of this document. </p> +discussed in the first half of this document. </p> <blockquote> <pre> diff --git a/external/ibm-public/postfix/dist/proto/STRESS_README.html b/external/ibm-public/postfix/dist/proto/STRESS_README.html index b5e3ccbfeb3..30fa5f2261f 100644 --- a/external/ibm-public/postfix/dist/proto/STRESS_README.html +++ b/external/ibm-public/postfix/dist/proto/STRESS_README.html @@ -7,7 +7,7 @@ <title>Postfix Stress-Dependent Configuration</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -354,7 +354,7 @@ such as SMTP access maps. The Postfix SMTP server will reject mail and disconnect without waiting for the remote SMTP client to send a QUIT command. </p> -<li> <p> To hang up connections from blacklisted zombies, you can +<li> <p> To hang up connections from denylisted zombies, you can set specific Postfix SMTP server reject codes for specific RBLs, and for individual responses from specific RBLs. We'll use zen.spamhaus.org as an example; by the time you read this document, @@ -543,7 +543,7 @@ services that accept remote connections. </p> <p> The postscreen(8) daemon, introduced with Postfix 2.8, provides additional protection against mail server overload. One postscreen(8) process handles multiple inbound SMTP connections, and decides which -clients may to talk to a Postfix SMTP server process. By keeping +clients may talk to a Postfix SMTP server process. By keeping spambots away, postscreen(8) leaves more SMTP server processes available for legitimate clients, and delays the onset of server overload conditions. </p> diff --git a/external/ibm-public/postfix/dist/proto/TLS_LEGACY_README.html b/external/ibm-public/postfix/dist/proto/TLS_LEGACY_README.html index 1bc80e83338..dacf1c138d3 100644 --- a/external/ibm-public/postfix/dist/proto/TLS_LEGACY_README.html +++ b/external/ibm-public/postfix/dist/proto/TLS_LEGACY_README.html @@ -7,7 +7,7 @@ <title>Postfix legacy TLS Support </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -35,7 +35,7 @@ SMTP mail or with SASL authentication. <p> Postfix version 2.2 introduces support for TLS as described in RFC 3207. TLS Support for older Postfix versions was available as an add-on patch. The section "<a href="#compat">Compatibility with -Postfix < 2.2 TLS support</a>" below discusses the differences +Postfix < 2.2 TLS support</a>" below discusses the differences between these implementations. </p> <p> Topics covered in this document: </p> @@ -54,7 +54,7 @@ between these implementations. </p> <li><a href="#problems"> Reporting problems </a> -<li><a href="#compat">Compatibility with Postfix < 2.2 TLS support</a> +<li><a href="#compat">Compatibility with Postfix < 2.2 TLS support</a> <li><a href="#credits"> Credits </a> @@ -225,7 +225,7 @@ key configuration </a> </h3> <p> In order to use TLS, the Postfix SMTP server needs a certificate and a private key. Both must be in "pem" format. The private key must not be encrypted, meaning: the key must be accessible without -password. Both certificate and private key may be in the same +a password. Both certificate and private key may be in the same file. </p> <p> Both RSA and DSA certificates are supported. Typically you will @@ -253,7 +253,7 @@ CA". Create the server.pem file with: </p> </blockquote> <p> A Postfix SMTP server certificate supplied here must be usable -as SSL server certificate and hence pass the "openssl verify -purpose +as an SSL server certificate and hence pass the "openssl verify -purpose sslserver ..." test. </p> <p> A client that trusts the root CA has a local copy of the root @@ -616,7 +616,7 @@ as a key for the specified access(5) table. </p> </dd> <p> The permit_tls_all_clientcerts feature must be used with caution, because it can result in too many access permissions. Use this feature only if a special CA issues the client certificates, and -only if this CA is listed as trusted CA. If other CAs are trusted, +only if this CA is listed as a trusted CA. If other CAs are trusted, any owner of a valid client certificate would be authorized. The permit_tls_all_clientcerts feature can be practical for a specially created email relay server. </p> @@ -663,7 +663,7 @@ the user or host.</p> <p> To influence the Postfix SMTP server cipher selection scheme, you can give cipherlist string. A detailed description would go -to far here; please refer to the OpenSSL documentation. If you +too far here; please refer to the OpenSSL documentation. If you don't know what to do with it, simply don't touch it and leave the (openssl-)compiled in default! </p> @@ -778,7 +778,7 @@ certificate is presented. </p> key/certificate pair as the Postfix SMTP server. If a certificate is to be presented, it must be in "pem" format. The private key must not be encrypted, meaning: it must be accessible without -password. Both parts (certificate and private key) may be in the +a password. Both parts (certificate and private key) may be in the same file. </p> <p> In order for remote SMTP servers to verify the Postfix SMTP @@ -798,7 +798,7 @@ Create the client.pem file with: </p> </blockquote> <p> A Postfix SMTP client certificate supplied here must be usable -as SSL client certificate and hence pass the "openssl verify -purpose +as an SSL client certificate and hence pass the "openssl verify -purpose sslclient ..." test. </p> <p> A server that trusts the root CA has a local copy of the root @@ -1156,9 +1156,9 @@ smtp_tls_enforce_peername. Note: "smtp_enforce_tls = yes" and "smtp_tls_enforce_peername = yes" imply "smtp_use_tls = yes". </p> <li> <p> When both hostname and next-hop destination lookups produce -a result, the more specific per-site policy (NONE, MUST, etc) +a result, the more specific per-site policy (NONE, MUST, etc.) overrides the less specific one (MAY), and the more secure per-site -policy (MUST, etc) overrides the less secure one (NONE). </p> +policy (MUST, etc.) overrides the less secure one (NONE). </p> <li> <p> After the per-site policy lookups are combined, the result generally overrides the global policy. The exception is the less @@ -1215,7 +1215,7 @@ verification. This feature requires Postfix 2.2.9 or later. </p> example.org NONE # TLS should not be used with the host <i>smtp.example.com</i>. - smtp.example.com NONE + [smtp.example.com] NONE </pre> </blockquote> @@ -1266,7 +1266,7 @@ special CA which then issues the actual certificate...) </p> <p> To influence the Postfix SMTP client cipher selection scheme, you can give cipherlist string. A detailed description would go -to far here; please refer to the OpenSSL documentation. If you +too far here; please refer to the OpenSSL documentation. If you don't know what to do with it, simply don't touch it and leave the (openssl-)compiled in default! </p> @@ -1539,7 +1539,7 @@ Patches, when possible, are greatly appreciated too. </p> </ul> -<h2><a name="compat">Compatibility with Postfix <2.2 TLS support</a></h2> +<h2><a name="compat">Compatibility with Postfix < 2.2 TLS support</a></h2> <p> Postfix version 2.2 TLS support is based on the Postfix/TLS patch by Lutz Jänicke, but differs in a few minor ways. </p> diff --git a/external/ibm-public/postfix/dist/proto/TUNING_README.html b/external/ibm-public/postfix/dist/proto/TUNING_README.html index c5641f2ce3f..61b37bdb24e 100644 --- a/external/ibm-public/postfix/dist/proto/TUNING_README.html +++ b/external/ibm-public/postfix/dist/proto/TUNING_README.html @@ -7,7 +7,7 @@ <title>Postfix Performance Tuning</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -409,9 +409,9 @@ especially if the gateway forwards to multiple MX hosts. When all MX hosts are up and accepting connections in a timely fashion, throughput will be high. If any MX host is down and completely unresponsive, the average connection latency rises to at least 1/N -* $smtp_connection_timeout, if there are N MX hosts. This limits +* $smtp_connect_timeout, if there are N MX hosts. This limits throughput to at most the destination concurrency * N / -$smtp_connection_timeout. </p> +$smtp_connect_timeout. </p> <p> For example, with a destination concurrency of 100 and 2 MX hosts, each host will handle up to 50 simultaneous connections. If @@ -422,9 +422,9 @@ multiple MX hosts need a lower connection timeout, values as low as 5s or even 1s can be used to prevent congestion when one or more, but not all MX hosts are down. </p> -<p> If necessary, set a higher transport_destination_concurrency_limit +<p> If necessary, set a higher <i>transport</i>_destination_concurrency_limit (in main.cf since this is a queue manager parameter) and a lower -smtp_connection_timeout (with a "-o" override in master.cf since +smtp_connect_timeout (with a "-o" override in master.cf since this parameter has no per-transport name) for the relay transport and any transports dedicated for specific high volume destinations. </p> diff --git a/external/ibm-public/postfix/dist/proto/UUCP_README.html b/external/ibm-public/postfix/dist/proto/UUCP_README.html index c614ceeb3ed..e677a77dbab 100644 --- a/external/ibm-public/postfix/dist/proto/UUCP_README.html +++ b/external/ibm-public/postfix/dist/proto/UUCP_README.html @@ -7,7 +7,7 @@ <title>Postfix and UUCP </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/VERP_README.html b/external/ibm-public/postfix/dist/proto/VERP_README.html index a4b1b3810fd..e442c894300 100644 --- a/external/ibm-public/postfix/dist/proto/VERP_README.html +++ b/external/ibm-public/postfix/dist/proto/VERP_README.html @@ -7,7 +7,7 @@ <title>Postfix VERP Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/VIRTUAL_README.html b/external/ibm-public/postfix/dist/proto/VIRTUAL_README.html index ac11f192c28..1c5aecc0c65 100644 --- a/external/ibm-public/postfix/dist/proto/VIRTUAL_README.html +++ b/external/ibm-public/postfix/dist/proto/VIRTUAL_README.html @@ -7,7 +7,7 @@ <title>Postfix Virtual Domain Hosting Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> @@ -62,7 +62,7 @@ domains, non-UNIX accounts</a> <h2><a name="canonical">Canonical versus hosted versus other domains</a></h2> -<p>Most Postfix systems are <b>final destination</b> for only a +<p>Most Postfix systems are the <b>final destination</b> for only a few domain names. These include the hostnames and [the IP addresses] of the machine that Postfix runs on, and sometimes also include the parent domain of the hostname. The remainder of this document @@ -71,7 +71,7 @@ usually implemented with the Postfix local domain address class, as defined in the ADDRESS_CLASS_README file.</p> <p> Besides the canonical domains, Postfix can be configured to be -<b>final destination</b> for any number of additional domains. +the <b>final destination</b> for any number of additional domains. These domains are called hosted, because they are not directly associated with the name of the machine itself. Hosted domains are usually implemented with the virtual alias domain address class @@ -87,7 +87,7 @@ relay domain address class, as defined in the ADDRESS_CLASS_README file. </p> <p> Finally, Postfix can be configured as a transit host for sending -mail across the internet. Obviously, Postfix is not final destination +mail across the internet. Obviously, Postfix is not the final destination for such mail. This function is available only for authorized clients and/or users, and is implemented by the default domain address class, as defined in the ADDRESS_CLASS_README file. </p> diff --git a/external/ibm-public/postfix/dist/proto/XCLIENT_README.html b/external/ibm-public/postfix/dist/proto/XCLIENT_README.html index e4e2f0a1f92..6393c09b827 100644 --- a/external/ibm-public/postfix/dist/proto/XCLIENT_README.html +++ b/external/ibm-public/postfix/dist/proto/XCLIENT_README.html @@ -7,7 +7,7 @@ <title>Postfix XCLIENT Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/XFORWARD_README.html b/external/ibm-public/postfix/dist/proto/XFORWARD_README.html index 18cef6c95f6..1165e98b0d7 100644 --- a/external/ibm-public/postfix/dist/proto/XFORWARD_README.html +++ b/external/ibm-public/postfix/dist/proto/XFORWARD_README.html @@ -7,7 +7,7 @@ <title>Postfix XFORWARD Howto</title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/access b/external/ibm-public/postfix/dist/proto/access index e01cc0f0e9e..0fe2a899ede 100644 --- a/external/ibm-public/postfix/dist/proto/access +++ b/external/ibm-public/postfix/dist/proto/access @@ -29,7 +29,7 @@ # # Alternatively, the table can be provided as a regular-expression # map where patterns are given as regular expressions, or lookups -# can be directed to TCP-based server. In those cases, the lookups +# can be directed to a TCP-based server. In those cases, the lookups # are done in a slightly different way as described below under # "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". # CASE FOLDING @@ -199,7 +199,7 @@ # .sp # This feature is available in Postfix 2.1 and later. # .IP "\fBDEFER_IF_PERMIT \fIoptional text...\fR -# Defer the request if some later restriction would result in a +# Defer the request if some later restriction would result in # an explicit or implicit PERMIT action. # Reply with "\fB$access_map_defer_code 4.7.1 \fI optional # text...\fR" when the diff --git a/external/ibm-public/postfix/dist/proto/aliases b/external/ibm-public/postfix/dist/proto/aliases index 6442ac1d558..ed01ec0c96c 100644 --- a/external/ibm-public/postfix/dist/proto/aliases +++ b/external/ibm-public/postfix/dist/proto/aliases @@ -164,9 +164,8 @@ # \fIlistname\fR-request address localparts when the recipient_delimiter # is set to "-". # .IP "\fBrecipient_delimiter (empty)\fR" -# The set of characters that can separate a user name from its -# extension (example: user+foo), or a .forward file name from its -# extension (example: .forward+foo). +# The set of characters that can separate an email address +# localpart, user name, or a .forward file name from its extension. # .PP # Available in Postfix version 2.3 and later: # .IP "\fBfrozen_delivered_to (yes)\fR" diff --git a/external/ibm-public/postfix/dist/proto/canonical b/external/ibm-public/postfix/dist/proto/canonical index de9e19143da..6364d3e1dae 100644 --- a/external/ibm-public/postfix/dist/proto/canonical +++ b/external/ibm-public/postfix/dist/proto/canonical @@ -27,7 +27,7 @@ # # Alternatively, the table can be provided as a regular-expression # map where patterns are given as regular expressions, or lookups -# can be directed to TCP-based server. In those cases, the lookups +# can be directed to a TCP-based server. In those cases, the lookups # are done in a slightly different way as described below under # "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". # @@ -226,7 +226,7 @@ # off in email addresses. # .IP "\fBmasquerade_exceptions (empty)\fR" # Optional list of user names that are not subjected to address -# masquerading, even when their address matches $masquerade_domains. +# masquerading, even when their addresses match $masquerade_domains. # .IP "\fBmydestination ($myhostname, localhost.$mydomain, localhost)\fR" # The list of domains that are delivered via the $local_transport # mail delivery transport. diff --git a/external/ibm-public/postfix/dist/proto/cidr_table b/external/ibm-public/postfix/dist/proto/cidr_table index 91ac7e716bf..5b4dd65eb59 100644 --- a/external/ibm-public/postfix/dist/proto/cidr_table +++ b/external/ibm-public/postfix/dist/proto/cidr_table @@ -98,14 +98,44 @@ # # Note: address information may be enclosed inside "[]" but # this form is not required. +# INLINE SPECIFICATION +# .ad +# .fi +# The contents of a table may be specified in the table name. +# The basic syntax is: +# +# .nf +# main.cf: +# \fIparameter\fR \fB= .. cidr:{ { \fIrule-1\fB }, { \fIrule-2\fB } .. } ..\fR +# +# master.cf: +# \fB.. -o { \fIparameter\fR \fB= .. cidr:{ { \fIrule-1\fB }, { \fIrule-2\fB } .. } .. } ..\fR +# .fi +# +# Postfix ignores whitespace after '{' and before '}', and +# writes each \fIrule\fR as one text line to an in-memory +# file: +# +# .nf +# in-memory file: +# rule-1 +# rule-2 +# .. +# .fi +# +# Postfix parses the result as if it is a file in /etc/postfix. +# +# Note: if a rule contains \fB$\fR, specify \fB$$\fR to keep +# Postfix from trying to do \fI$name\fR expansion as it +# evaluates a parameter value. # EXAMPLE SMTPD ACCESS MAP # .nf # /etc/postfix/main.cf: # smtpd_client_restrictions = ... cidr:/etc/postfix/client.cidr ... # # /etc/postfix/client.cidr: -# # Rule order matters. Put more specific whitelist entries -# # before more general blacklist entries. +# # Rule order matters. Put more specific allowlist entries +# # before more general denylist entries. # 192.168.1.1 OK # 192.168.0.0/16 REJECT # 2001:db8::1 OK diff --git a/external/ibm-public/postfix/dist/proto/generic b/external/ibm-public/postfix/dist/proto/generic index 77d62252b4a..fdeb1eac56a 100644 --- a/external/ibm-public/postfix/dist/proto/generic +++ b/external/ibm-public/postfix/dist/proto/generic @@ -41,7 +41,7 @@ # # Alternatively, the table can be provided as a regular-expression # map where patterns are given as regular expressions, or lookups -# can be directed to TCP-based server. In those case, the lookups +# can be directed to a TCP-based server. In those cases, the lookups # are done in a slightly different way as described below under # "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". # CASE FOLDING @@ -134,7 +134,7 @@ # This section describes how the table lookups change when lookups # are directed to a TCP-based server. For a description of the TCP # client/server lookup protocol, see \fBtcp_table\fR(5). -# This feature is not available up to and including Postfix version 2.4. +# This feature is available in Postfix 2.5 and later. # # Each lookup operation uses the entire address once. Thus, # \fIuser@domain\fR mail addresses are not broken up into their @@ -178,29 +178,32 @@ # The following \fBmain.cf\fR parameters are especially relevant. # The text below provides only a parameter summary. See # \fBpostconf\fR(5) for more details including examples. -# .IP \fBsmtp_generic_maps\fR -# Address mapping lookup table for envelope and header sender -# and recipient addresses while delivering mail via SMTP. -# .IP \fBpropagate_unmatched_extensions\fR -# A list of address rewriting or forwarding mechanisms that propagate -# an address extension from the original address to the result. -# Specify zero or more of \fBcanonical\fR, \fBvirtual\fR, \fBalias\fR, -# \fBforward\fR, \fBinclude\fR, or \fBgeneric\fR. +# .IP "\fBsmtp_generic_maps (empty)\fR" +# Optional lookup tables that perform address rewriting in the +# Postfix SMTP client, typically to transform a locally valid address into +# a globally valid address when sending mail across the Internet. +# .IP "\fBpropagate_unmatched_extensions (canonical, virtual)\fR" +# What address lookup tables copy an address extension from the lookup +# key to the lookup result. # .PP # Other parameters of interest: -# .IP \fBinet_interfaces\fR -# The network interface addresses that this system receives mail on. -# You need to stop and start Postfix when this parameter changes. -# .IP \fBproxy_interfaces\fR -# Other interfaces that this machine receives mail on by way of a -# proxy agent or network address translator. -# .IP \fBmydestination\fR -# List of domains that this mail system considers local. -# .IP \fBmyorigin\fR -# The domain that is appended to locally-posted mail. -# .IP \fBowner_request_special\fR -# Give special treatment to \fBowner-\fIxxx\fR and \fIxxx\fB-request\fR -# addresses. +# .IP "\fBinet_interfaces (all)\fR" +# The network interface addresses that this mail system receives +# mail on. +# .IP "\fBproxy_interfaces (empty)\fR" +# The network interface addresses that this mail system receives mail +# on by way of a proxy or network address translation unit. +# .IP "\fBmydestination ($myhostname, localhost.$mydomain, localhost)\fR" +# The list of domains that are delivered via the $local_transport +# mail delivery transport. +# .IP "\fBmyorigin ($myhostname)\fR" +# The domain name that locally-posted mail appears to come +# from, and that locally posted mail is delivered to. +# .IP "\fBowner_request_special (yes)\fR" +# Enable special treatment for owner-\fIlistname\fR entries in the +# \fBaliases\fR(5) file, and don't split owner-\fIlistname\fR and +# \fIlistname\fR-request address localparts when the recipient_delimiter +# is set to "-". # SEE ALSO # postmap(1), Postfix lookup table manager # postconf(5), configuration parameters diff --git a/external/ibm-public/postfix/dist/proto/ldap_table b/external/ibm-public/postfix/dist/proto/ldap_table index b770e4a162e..fe3626a9020 100644 --- a/external/ibm-public/postfix/dist/proto/ldap_table +++ b/external/ibm-public/postfix/dist/proto/ldap_table @@ -146,9 +146,9 @@ # For the \fBsearch_base\fR parameter, the upper-case equivalents # of the above expansions behave identically to their lower-case # counter-parts. With the \fBresult_format\fR parameter (previously -# called \fBresult_filter\fR see the COMPATIBILITY section and below), -# they expand to the corresponding components of input key rather -# than the result value. +# called \fBresult_filter\fR see the OTHER OBSOLETE FEATURES section +# and below), they expand to the corresponding components of input +# key rather than the result value. # .IP "\fB%[1-9]\fR" # The patterns %1, %2, ... %9 are replaced by the corresponding # most significant component of the input key's domain. If the @@ -189,9 +189,9 @@ # The upper-case equivalents of the above expansions behave in the # \fBquery_filter\fR parameter identically to their lower-case # counter-parts. With the \fBresult_format\fR parameter (previously -# called \fBresult_filter\fR see the COMPATIBILITY section and below), -# they expand to the corresponding components of input key rather -# than the result value. +# called \fBresult_filter\fR see the OTHER OBSOLETE FEATURES section +# and below), they expand to the corresponding components of input +# key rather than the result value. # .IP # The above %S, %U and %D expansions are available with Postfix 2.2 # and later. @@ -268,7 +268,7 @@ # NOTE: DO NOT put quotes around the result format! # .IP "\fBdomain (default: no domain list)\fR" # This is a list of domain names, paths to files, or -# dictionaries. When specified, only fully qualified search +# "type:table" databases. When specified, only fully qualified search # keys with a *non-empty* localpart and a matching domain # are eligible for lookup: 'user' lookups, bare domain lookups # and "@domain" lookups are not performed. This can significantly diff --git a/external/ibm-public/postfix/dist/proto/lmdb_table b/external/ibm-public/postfix/dist/proto/lmdb_table index 53a9cd90355..5bbbc14d383 100644 --- a/external/ibm-public/postfix/dist/proto/lmdb_table +++ b/external/ibm-public/postfix/dist/proto/lmdb_table @@ -39,9 +39,9 @@ # or domain portion. This behavior is also found with, for # example, btree:, hash:, or ldap: tables. # -# Unlike other flat-file Postfix databases, changes to -# an LMDB database do not trigger automatic daemon program -# restart, and do not require "\fBpostfix reload\fR". +# Changes to an LMDB database do not trigger an automatic +# daemon restart, and do not require a daemon restart with +# "\fBpostfix reload\fR". # RELIABILITY # .ad # .fi @@ -82,8 +82,8 @@ # Short-lived programs automatically pick up changes to # main.cf. With long-running daemon programs, Use the command # "\fBpostfix reload\fR" after a configuration change. -# .IP "\fBlmdb_map_size (default: 16777216)\fR" -# The initial LMDB database size limit in bytes. +# .IP "\fBlmdb_map_size (16777216)\fR" +# The initial OpenLDAP LMDB database size limit in bytes. # SEE ALSO # postconf(1), Postfix supported lookup tables # postmap(1), Postfix lookup table maintenance diff --git a/external/ibm-public/postfix/dist/proto/master b/external/ibm-public/postfix/dist/proto/master index 670b800a12b..28040b69a0b 100644 --- a/external/ibm-public/postfix/dist/proto/master +++ b/external/ibm-public/postfix/dist/proto/master @@ -9,7 +9,7 @@ # a larger number of services that run in the background. # # Postfix services are implemented by daemon processes. These -# run in the background under control of the \fBmaster\fR(8) +# run in the background, started on-demand by the \fBmaster\fR(8) # process. The master.cf configuration file defines how a # client program connects to a service, and what daemon # program runs when a service is requested. Most daemon @@ -20,7 +20,7 @@ # All daemons specified here must speak a Postfix-internal # protocol. In order to execute non-Postfix software use the # \fBlocal\fR(8), \fBpipe\fR(8) or \fBspawn\fR(8) services, or -# run the server under control by \fBinetd\fR(8) or equivalent. +# execute the software with \fBinetd\fR(8) or equivalent. # .PP # After changing master.cf you must execute "\fBpostfix reload\fR" # to reload the configuration. @@ -117,7 +117,9 @@ # This feature is available as of Postfix version 2.5. # .RE # .IP "\fBPrivate (default: y)\fR" -# Whether or not access is restricted to the mail system. +# Whether a service is internal to Postfix (pathname starts +# with \fBprivate/\fR), or exposed through Postfix command-line +# tools (pathname starts with \fBpublic/\fR). # Internet (type \fBinet\fR) services can't be private. # .IP "\fBUnprivileged (default: y)\fR" # Whether the service runs with root privileges or as the @@ -127,7 +129,7 @@ # .sp # The \fBlocal\fR(8), \fBpipe\fR(8), \fBspawn\fR(8), and # \fBvirtual\fR(8) daemons require privileges. -# .IP "\fBChroot (default: Postfix >= 3.0: n, Postfix <3.0: y)\fR" +# .IP "\fBChroot (default: Postfix >= 3.0: n, Postfix < 3.0: y)\fR" # Whether or not the service runs chrooted to the mail queue # directory (pathname is controlled by the \fBqueue_directory\fR # configuration variable in the main.cf file). diff --git a/external/ibm-public/postfix/dist/proto/mysql_table b/external/ibm-public/postfix/dist/proto/mysql_table index b4c7c75b007..6870acf40af 100644 --- a/external/ibm-public/postfix/dist/proto/mysql_table +++ b/external/ibm-public/postfix/dist/proto/mysql_table @@ -16,7 +16,7 @@ # In order to use MySQL lookups, define a MySQL source as a lookup # table in main.cf, for example: # .nf -# alias_maps = mysql:/etc/mysql-aliases.cf +# alias_maps = mysql:/etc/postfix/mysql-aliases.cf # .fi # # The file /etc/postfix/mysql-aliases.cf has the same format as @@ -46,8 +46,9 @@ # .IP "\fBhosts\fR" # The hosts that Postfix will try to connect to and query from. # Specify \fIunix:\fR for UNIX domain sockets, \fIinet:\fR for TCP -# connections (default). Example: +# connections (default). Examples: # .nf +# hosts = inet:host1.some.domain inet:host2.some.domain:port # hosts = host1.some.domain host2.some.domain:port # hosts = unix:/file/name # .fi @@ -190,10 +191,10 @@ # # NOTE: DO NOT put quotes around the result format! # .IP "\fBdomain (default: no domain list)\fR" -# This is a list of domain names, paths to files, or -# dictionaries. When specified, only fully qualified search -# keys with a *non-empty* localpart and a matching domain -# are eligible for lookup: 'user' lookups, bare domain lookups +# This is a list of domain names, paths to files, or "type:table" +# databases. When specified, only fully qualified search keys +# with a *non-empty* localpart and a matching domain are +# eligible for lookup: 'user' lookups, bare domain lookups # and "@domain" lookups are not performed. This can significantly # reduce the query load on the MySQL server. # .nf diff --git a/external/ibm-public/postfix/dist/proto/pcre_table b/external/ibm-public/postfix/dist/proto/pcre_table index 7f15a8197c5..cd2bd921f7a 100644 --- a/external/ibm-public/postfix/dist/proto/pcre_table +++ b/external/ibm-public/postfix/dist/proto/pcre_table @@ -29,6 +29,10 @@ # -\fR <\fIfile\fR" for header_checks(5) patterns, and # "\fBpostmap -bmq -\fR <\fIfile\fR" for body_checks(5) # (Postfix 2.6 and later). +# +# This driver can be built with the pcre2 library (Postfix +# 3.7 and later), or with the legacy pcre library (all Postfix +# versions). # COMPATIBILITY # .ad # .fi @@ -73,7 +77,7 @@ # starts with whitespace continues a logical line. # .PP # Each pattern is a perl-like regular expression. The expression -# delimiter can be any non-alphanumerical character, except +# delimiter can be any non-alphanumeric character, except # whitespace or characters # that have special meaning (traditionally the forward slash is used). # The regular expression can contain whitespace. @@ -86,12 +90,12 @@ # Toggles the case sensitivity flag. By default, matching is case # insensitive. # .IP "\fBm\fR (default: off)" -# Toggles the PCRE_MULTILINE flag. When this flag is on, the \fB^\fR +# Toggles the pcre MULTILINE flag. When this flag is on, the \fB^\fR # and \fB$\fR metacharacters match immediately after and immediately # before a newline character, respectively, in addition to # matching at the start and end of the subject string. # .IP "\fBs\fR (default: on)" -# Toggles the PCRE_DOTALL flag. When this flag is on, the \fB.\fR +# Toggles the pcre DOTALL flag. When this flag is on, the \fB.\fR # metacharacter matches the newline character. With # Postfix versions prior to 2.0, the flag is off by # default, which is inconvenient for multi-line message header @@ -104,31 +108,33 @@ # .sp # Note: do not use \fB#\fIcomment\fR after patterns. # .IP "\fBA\fR (default: off)" -# Toggles the PCRE_ANCHORED flag. When this flag is on, +# Toggles the pcre ANCHORED flag. When this flag is on, # the pattern is forced to be "anchored", that is, it is # constrained to match only at the start of the string which # is being searched (the "subject string"). This effect can # also be achieved by appropriate constructs in the pattern # itself. # .IP "\fBE\fR (default: off)" -# Toggles the PCRE_DOLLAR_ENDONLY flag. When this flag is on, +# Toggles the pcre DOLLAR_ENDONLY flag. When this flag is on, # a \fB$\fR metacharacter in the pattern matches only at the # end of the subject string. Without this flag, a dollar also # matches immediately before the final character if it is a # newline character (but not before any other newline -# characters). This flag is ignored if PCRE_MULTILINE +# characters). This flag is ignored if the pcre MULTILINE # flag is set. # .IP "\fBU\fR (default: off)" -# Toggles the ungreedy matching flag. When this flag is on, +# Toggles the pcre UNGREEDY flag. When this flag is on, # the pattern matching engine inverts the "greediness" of # the quantifiers so that they are not greedy by default, # but become greedy if followed by "?". This flag can also # set by a (?U) modifier within the pattern. # .IP "\fBX\fR (default: off)" -# Toggles the PCRE_EXTRA flag. +# Toggles the pcre EXTRA flag. # When this flag is on, any backslash in a pattern that is # followed by a letter that has no special meaning causes an # error, thus reserving these combinations for future expansion. +# +# This feature is not supported with PCRE2. # SEARCH ORDER # .ad # .fi @@ -151,10 +157,41 @@ # a $ character as output. # The macros in the result string may need to be written as # ${n} or $(n) if they aren't followed by whitespace. +# This feature does not support pcre2 substring names. # # Note: since negated patterns (those preceded by \fB!\fR) return a # result when the expression does not match, substitutions are not # available for negated patterns. +# INLINE SPECIFICATION +# .ad +# .fi +# The contents of a table may be specified in the table name. +# The basic syntax is: +# +# .nf +# main.cf: +# \fIparameter\fR \fB= .. pcre:{ { \fIrule-1\fB }, { \fIrule-2\fB } .. } ..\fR +# +# master.cf: +# \fB.. -o { \fIparameter\fR \fB= .. pcre:{ { \fIrule-1\fB }, { \fIrule-2\fB } .. } .. } ..\fR +# .fi +# +# Postfix ignores whitespace after '{' and before '}', and +# writes each \fIrule\fR as one text line to an in-memory +# file: +# +# .nf +# in-memory file: +# rule-1 +# rule-2 +# .. +# .fi +# +# Postfix parses the result as if it is a file in /etc/postfix. +# +# Note: if a rule contains \fB$\fR, specify \fB$$\fR to keep +# Postfix from trying to do \fI$name\fR expansion as it +# evaluates a parameter value. # EXAMPLE SMTPD ACCESS MAP # # Protect your outgoing majordomo exploders # /^(?!owner-)(.*)-outgoing@(.*)/ 550 Use ${1}@${2} instead diff --git a/external/ibm-public/postfix/dist/proto/pgsql_table b/external/ibm-public/postfix/dist/proto/pgsql_table index fefc7a830ef..f5d96833c8c 100644 --- a/external/ibm-public/postfix/dist/proto/pgsql_table +++ b/external/ibm-public/postfix/dist/proto/pgsql_table @@ -16,7 +16,7 @@ # databases. In order to use PostgreSQL lookups, define a # PostgreSQL source as a lookup table in main.cf, for example: # .nf -# alias_maps = pgsql:/etc/pgsql-aliases.cf +# alias_maps = pgsql:/etc/postfix/pgsql-aliases.cf # .fi # # The file /etc/postfix/pgsql-aliases.cf has the same format as @@ -53,6 +53,7 @@ # Examples: # .nf # hosts = postgresql://username@example.com/tablename?sslmode=require +# hosts = inet:host1.some.domain inet:host2.some.domain:port # hosts = host1.some.domain host2.some.domain:port # hosts = unix:/file/name # .fi @@ -130,7 +131,7 @@ # \fBselect_function\fR, \fBquery\fR, \fBselect_field\fR, ... # # With Postfix 2.2 the \fBquery\fR parameter has highest precedence, -# see COMPATIBILITY above. +# see OBSOLETE QUERY INTERFACES below. # # NOTE: DO NOT put quotes around the \fBquery\fR parameter. # .IP "\fBresult_format (default: \fB%s\fR)\fR" @@ -176,8 +177,8 @@ # # NOTE: DO NOT put quotes around the result format! # .IP "\fBdomain (default: no domain list)\fR" -# This is a list of domain names, paths to files, or -# dictionaries. When specified, only fully qualified search +# This is a list of domain names, paths to files, or "type:table" +# databases. When specified, only fully qualified search # keys with a *non-empty* localpart and a matching domain # are eligible for lookup: 'user' lookups, bare domain lookups # and "@domain" lookups are not performed. This can significantly diff --git a/external/ibm-public/postfix/dist/proto/postconf.html.prolog b/external/ibm-public/postfix/dist/proto/postconf.html.prolog index a7d41eec04f..530d7b43c93 100644 --- a/external/ibm-public/postfix/dist/proto/postconf.html.prolog +++ b/external/ibm-public/postfix/dist/proto/postconf.html.prolog @@ -7,7 +7,7 @@ <title>Postfix Configuration Parameters </title> -<meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> diff --git a/external/ibm-public/postfix/dist/proto/regexp_table b/external/ibm-public/postfix/dist/proto/regexp_table index 88fcdedd674..969b8a9f8a1 100644 --- a/external/ibm-public/postfix/dist/proto/regexp_table +++ b/external/ibm-public/postfix/dist/proto/regexp_table @@ -47,7 +47,7 @@ # input string against the patterns between \fBif\fR and # \fBendif\fR. The \fBif\fR..\fBendif\fR can nest. # .sp -# Note: do not prepend whitespace to patterns inside +# Note: do not prepend whitespace to patterns inside # \fBif\fR..\fBendif\fR. # .sp # This feature is available in Postfix 2.1 and later. @@ -57,7 +57,7 @@ # match that input string against the patterns between \fBif\fR # and \fBendif\fR. The \fBif\fR..\fBendif\fR can nest. # .sp -# Note: do not prepend whitespace to patterns inside +# Note: do not prepend whitespace to patterns inside # \fBif\fR..\fBendif\fR. # .sp # This feature is available in Postfix 2.1 and later. @@ -119,6 +119,36 @@ # Note: since negated patterns (those preceded by \fB!\fR) return a # result when the expression does not match, substitutions are not # available for negated patterns. +# INLINE SPECIFICATION +# .ad +# .fi +# The contents of a table may be specified in the table name. +# The basic syntax is: +# +# .nf +# main.cf: +# \fIparameter\fR \fB= .. regexp:{ { \fIrule-1\fB }, { \fIrule-2\fB } .. } ..\fR +# +# master.cf: +# \fB.. -o { \fIparameter\fR \fB= .. regexp:{ { \fIrule-1\fB }, { \fIrule-2\fB } .. } .. } ..\fR +# .fi +# +# Postfix ignores whitespace after '{' and before '}', and +# writes each \fIrule\fR as one text line to an in-memory +# file: +# +# .nf +# in-memory file: +# rule-1 +# rule-2 +# .. +# .fi +# +# Postfix parses the result as if it is a file in /etc/postfix. +# +# Note: if a rule contains \fB$\fR, specify \fB$$\fR to keep +# Postfix from trying to do \fI$name\fR expansion as it +# evaluates a parameter value. # EXAMPLE SMTPD ACCESS MAP # # Disallow sender-specified routing. This is a must if you relay mail # # for other domains. diff --git a/external/ibm-public/postfix/dist/proto/relocated b/external/ibm-public/postfix/dist/proto/relocated index c716a21659f..a0a54cadf1d 100644 --- a/external/ibm-public/postfix/dist/proto/relocated +++ b/external/ibm-public/postfix/dist/proto/relocated @@ -21,7 +21,7 @@ # # Alternatively, the table can be provided as a regular-expression # map where patterns are given as regular expressions, or lookups -# can be directed to TCP-based server. In those case, the lookups +# can be directed to a TCP-based server. In those case, the lookups # are done in a slightly different way as described below under # "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". # @@ -84,7 +84,7 @@ # expression lookup table syntax, see \fBregexp_table\fR(5) or # \fBpcre_table\fR(5). For a description of the TCP client/server # table lookup protocol, see \fBtcp_table\fR(5). -# This feature is not available up to and including Postfix version 2.4. +# This feature is available in Postfix 2.5 and later. # # Each pattern is a regular expression that is applied to the entire # address being looked up. Thus, \fIuser@domain\fR mail addresses are not @@ -103,7 +103,7 @@ # This section describes how the table lookups change when lookups # are directed to a TCP-based server. For a description of the TCP # client/server lookup protocol, see \fBtcp_table\fR(5). -# This feature is not available up to and including Postfix version 2.4. +# This feature is available in Postfix 2.5 and later. # # Each lookup operation uses the entire address once. Thus, # \fIuser@domain\fR mail addresses are not broken up into their @@ -119,20 +119,23 @@ # The following \fBmain.cf\fR parameters are especially relevant. # The text below provides only a parameter summary. See # \fBpostconf\fR(5) for more details including examples. -# .IP \fBrelocated_maps\fR -# List of lookup tables for relocated users or sites. +# .IP "\fBrelocated_maps (empty)\fR" +# Optional lookup tables with new contact information for users or +# domains that no longer exist. # .PP # Other parameters of interest: -# .IP \fBinet_interfaces\fR -# The network interface addresses that this system receives mail on. -# You need to stop and start Postfix when this parameter changes. -# .IP \fBmydestination\fR -# List of domains that this mail system considers local. -# .IP \fBmyorigin\fR -# The domain that is appended to locally-posted mail. -# .IP \fBproxy_interfaces\fR -# Other interfaces that this machine receives mail on by way of a -# proxy agent or network address translator. +# .IP "\fBinet_interfaces (all)\fR" +# The network interface addresses that this mail system receives +# mail on. +# .IP "\fBmydestination ($myhostname, localhost.$mydomain, localhost)\fR" +# The list of domains that are delivered via the $local_transport +# mail delivery transport. +# .IP "\fBmyorigin ($myhostname)\fR" +# The domain name that locally-posted mail appears to come +# from, and that locally posted mail is delivered to. +# .IP "\fBproxy_interfaces (empty)\fR" +# The network interface addresses that this mail system receives mail +# on by way of a proxy or network address translation unit. # SEE ALSO # trivial-rewrite(8), address resolver # postmap(1), Postfix lookup table manager diff --git a/external/ibm-public/postfix/dist/proto/sqlite_table b/external/ibm-public/postfix/dist/proto/sqlite_table index aeaba341d7a..a4edf72e893 100644 --- a/external/ibm-public/postfix/dist/proto/sqlite_table +++ b/external/ibm-public/postfix/dist/proto/sqlite_table @@ -16,7 +16,7 @@ # In order to use SQLite lookups, define an SQLite source as a lookup # table in main.cf, for example: # .nf -# alias_maps = sqlite:/etc/sqlite-aliases.cf +# alias_maps = sqlite:/etc/postfix/sqlite-aliases.cf # .fi # # The file /etc/postfix/sqlite-aliases.cf has the same format as @@ -156,8 +156,8 @@ # # NOTE: DO NOT put quotes around the result format! # .IP "\fBdomain (default: no domain list)\fR" -# This is a list of domain names, paths to files, or -# dictionaries. When specified, only fully qualified search +# This is a list of domain names, paths to files, or "type:table" +# databases. When specified, only fully qualified search # keys with a *non-empty* localpart and a matching domain # are eligible for lookup: 'user' lookups, bare domain lookups # and "@domain" lookups are not performed. This can significantly diff --git a/external/ibm-public/postfix/dist/proto/stop b/external/ibm-public/postfix/dist/proto/stop index 85a3d562ce3..8682f8e5329 100644 --- a/external/ibm-public/postfix/dist/proto/stop +++ b/external/ibm-public/postfix/dist/proto/stop @@ -1537,3 +1537,28 @@ inline mtime snprintf sprintf +allowlist +allowlisted +denylist +denylisted +ALLOWLIST +ALLOWLISTED +DENYLIST +DENYLISTED +epilog +prolog +proto +ICMP +NORANDOMIZE +wallclock +BDAT +IPL +yyyy +yyyymmdd +Incompat +Junod +gid +json +postlogd +proxied +raf diff --git a/external/ibm-public/postfix/dist/proto/stop.double-cc b/external/ibm-public/postfix/dist/proto/stop.double-cc new file mode 100644 index 00000000000..1e9b3de22b0 --- /dev/null +++ b/external/ibm-public/postfix/dist/proto/stop.double-cc @@ -0,0 +1,330 @@ +void void rewrite_proto stream + Strip trailing dot at end of domain but not dot dot or dot This + strip source routed addresses site site user domain +transport_lookup transport_lookup finds the channel and nexthop for the given + Typically the nexthop specifies a hostname hostname TCP Port or the +resolve_addr resolve_addr resolve address according to rule set + technically incorrect this is needed to stop user domain domain relay + needs white space but stuff stuff does not This is not a + where stuff stuff does not happen + Strip trailing dot at end of domain but not dot dot or at dot +XXX XXX Short cut invalid address forms + Connect via TCP to domain domain port port The default + Connect via TCP to domain domain port port The default +files files that are owned by the wrong user or files that have world write + name is is not defined + conditionally to value when name is is not +MUMBLE_TODO MUMBLE_TODO flags must not be cleared once raised The _TODO_TO_PASS and +psc_todo_tests psc_todo_tests overwrites all per session flag bits and + Either hand off the socket to a real SMTP engine or say bye bye +char char context +inet_pton inet_pton +void void psc_early_tests state +void void psc_smtpd_init void +void void psc_smtpd_tests state + IP postscreen_dnsbl_max_ttl postscreen_dnsbl_ttl postscreen_dnsbl_ttl 1 h + WARNING WARNING WARNING + WARNING WARNING WARNING + The event driven TLS I O implementation is founded on on line OpenSSL +unused unused + IP f command command + IP q command command + IP Q command command + IP r command command + IP s command command + TCP port port Both host and port may be +void void + reset_cmd_flags reset per command command flags + set_cmd_flags set per command command flags + Connect via TCP to host host port port The default + Connect via TCP to host host port port The default +argv argv command +time time of entry into active queue +peer peer entries +FD_SETSIZE FD_SETSIZE +FD_SETSIZE FD_SETSIZE +FD_SETSIZE FD_SETSIZE + var spool postfix incoming incoming queue + var spool postfix active active queue + var spool postfix deferred deferred queue +time time of entry into active queue +FD_SETSIZE FD_SETSIZE +FD_SETSIZE FD_SETSIZE +FD_SETSIZE FD_SETSIZE + var spool postfix incoming incoming queue + var spool postfix active active queue + var spool postfix deferred deferred queue +XXX XXX + WARNING WARNING WARNING + WARNING WARNING WARNING +NOTREACHED NOTREACHED + If not connected to stdin stdin must not be a terminal + WARNING WARNING WARNING + WARNING WARNING WARNING + WARNING WARNING WARNING + WARNING WARNING WARNING + WARNING WARNING WARNING + WARNING WARNING WARNING + WARNING WARNING WARNING + WARNING WARNING WARNING + If not connected to stdin stdin must not be a terminal +select select + If not connected to stdin stdin must not be a terminal + main main program +this this first +linkage linkage + Postfix master master cf file processing +select select + If not connected to stdin stdin must not be a terminal + response to stress level changes Doing so would would contaminate + IP CA_MAIL_SERVER_EXIT void void + If not connected to stdin stdin must not be a terminal +smtp_site_fail smtp_site_fail handles the case where the program fails to + We can t avoid copying copying lots of strings into VSTRING buffers +binding binding properties passivated +endpoint endpoint properties passivated +safety safety +XXX XXX + See src tls tls_level c and src tls tls h Levels above encrypt require +smtp_rcpt_done smtp_rcpt_done +smtp_rcpt_done smtp_rcpt_done +smtp_rcpt_done smtp_rcpt_done + Ignore out of protocol enhanced status codes codes that accompany 3XX + IP name name +void void +FALLTHROUGH FALLTHROUGH +HAS_PCRE HAS_PCRE +HAS_PCRE HAS_PCRE + any any + typedef DICT DICT_OPEN_FN const char int int +EDIT_FILE EDIT_FILE edit_file_open original_path output_flags output_mode +void void +nvtable_locate nvtable_locate returns a pointer to the entry that was stored +legacy legacy + for symlinks owned by root NEVER NEVER make exceptions for symlinks + sanitize sanitize db_get put del result + simple attr attr name colon attr value newline +void void htable_free table free_fn +void void htable_walk table action ptr +htable_locate htable_locate returns a pointer to the entry that was stored + IP CA_VSTREAM_POPEN_WAITPID_FN pid_t pid_t WAIT_STATUS_T int +optimization optimization +msg_fatal msg_fatal reports an unrecoverable error and terminates the program + compare compare the address family and network address or + numbers or number number ranges + v4pattern v4field v4field v4field v4field + v4pattern v4field v4field v4field v4field + v4pattern v4field v4field v4field v4field + v4seq_member v4octet v4octet v4octet + v4seq_member v4octet v4octet v4octet +Corruption Corruption + main main program +privileges privileges +DICT_THASH_OPEN_RETURN DICT_THASH_OPEN_RETURN + Fatal errors cannot open file file write error out of memory +found found +found found +XXX XXX maybe earlier +XXX XXX + verified RedHat 3 03 + Bits per byte byte in vector bit offset in byte bytes per set + echo echo text received on stdin + request request a bunch of timer events + Fatal errors cannot open file file write error out of memory +found found +found found + concatenate concatenate null terminated list of strings +void void context +void void binhash_free table free_fn +void void binhash_walk table action ptr +binhash_locate binhash_locate returns a pointer to the entry that was stored +width width precision separator + and whitespace characters must be replaced by XX XX being the + and whitespace characters and the by XX XX being the two digit + Fatal errors cannot open file file write error out of +privileges privileges + Example 00000000000000000000000000000001 01 80 10 80 lo + text text +void void +matched matched text +SUNOS5 SUNOS5 + casefold casefold text for caseless comparison + simple name string string simple name + attribute list attribute attribute attribute list + attribute list attribute attribute attribute list + attribute string string +string string ISO Latin 1 character set except the character + WARNING WARNING WARNING + WARNING WARNING WARNING + Example checking infrastructure for int int const int + Example variables with type int int const int +int int int_val + host port host host +host host port host host + host port host host + port port + host port host host + host port host host port port + host port host host port port + simple attr attr name null attr value null + IP CA_SLMDB_CTL_LONGJMP_FN void void int + IP CA_SLMDB_CTL_NOTIFY_FN void void int + IP CA_SLMDB_CTL_ASSERT_FN void void const char + DICT dict_static_open name name dict_flags +buffer buffer length +privileges privileges +key key length + simple attr attr name attr value newline + attr name any string without null or or newline + var spool postfix maildrop maildrop queue + WARNING WARNING WARNING + WARNING WARNING WARNING +lmdb lmdb supports concurrent writes and reads from different +private private +private private + var spool postfix private private class endpoints + var spool postfix public public class endpoints +messages messages put on hold +option option disables UTF 8 syntax checks on query keys and +option option disables UTF 8 syntax checks on query keys and +lmdb lmdb supports concurrent writes and reads from different +peer peer +void void +XXX XXX + relay loopholes with user domain domain when relaying mail to a + Strip one trailing dot but not dot dot +void void +headers headers after multipart boundary + by XX XX being the two digit uppercase hexadecimal equivalent +must must +request request completed unsuccessfully +DSN_BUF DSN_BUF dsb_create void +DSN_SPLIT DSN_SPLIT dsn_split dp def_dsn text + that registers operators such as level level that compare + var_maillog_file var_maillog_file import_service_path 0 + IP address address family information and the numerical TCP port +privileges privileges +void void rcpb_reset rcpb + The entire lookup key key +DSN DSN dsn_create status action reason dtype dtext mtype mname + When specified with a flush request request that +storage storage +message message size + starts with or or the prefix which will be used + with or or the prefix which will be used to obtain +strings strings with digits uppercase letters and lowercase +safe_strtoul safe_strtoul implements similar functionality as strtoul + typedef LOGIN_SENDER_MATCH LOGIN_SENDER_MATCH +LOGIN_SENDER_MATCH LOGIN_SENDER_MATCH login_sender_create +void void anvil_clnt_free anvil_clnt +privileges privileges + characters specified with special with x XX XX being +0000 0000 0000 007 F 0x xxxxxx +0000 0000 0000 007 F 0x xxxxxx + https github com aox aox blob master encodings utf cpp with +FALLTHROUGH FALLTHROUGH + Detail format is digit digit 1 3 digit 1 3 +encoding encoding domain +domain domain +domain domain +encoding encoding +XXX XXX EAI inspect encoded message global +domain domain +MBOX MBOX mbox_open path flags mode st user group lock_style + incomplete address address rewriting alias expansion automatic BCC +unquoted unquoted form then quoted + records data offset offset of the first REC_TYPE_NORM or REC_TYPE_CONT +DELIVER_REQUEST DELIVER_REQUEST deliver_request_read stream +MAIL_VERSION MAIL_VERSION mail_version_parse version_string why +dict_xx_open dict_xx_open result + When specified with a flush request request that +MAIL_STREAM MAIL_STREAM mail_stream_file queue class service mode + starts with or or the prefix which will be used to +hosts hosts on which databases reside + or maptype mapname search name name The search + with or or the prefix which will be used to obtain +the the message delivery record +MKMAP MKMAP mkmap_open type path open_flags dict_flags +BOUNCE_LOG BOUNCE_LOG bounce_log_open queue id flags mode + internal external external first +context context for queue file changes +sender sender transport +SMFIM_EOH SMFIM_EOH SMFIM_EOM +value value to string +RE RE +PCF_MASTER_ENT PCF_MASTER_ENT local_scope +to to instantiate legacy per dbms parameters and to examine + tls_digest_encode encode message digest binary blob as xx xx +logged logged +logged logged + DNS at the dane dane only and half dane security levels or be +void void tls_pre_jail_init TLS_ROLE +TLS_ROLE TLS_ROLE role +and and the protocol version floor ceiling given a list plist of + of the form name name hexvalue hexvalue If plist + of the form name name hexvalue hexvalue If plist +XXX XXX We re ignoring the function name do we want to log it + If the match is required unambiguous insist that that no other values + etc postfix canonical canonical mapping table + etc postfix virtual virtual mapping table +void void +regions regions with body content +SASLv2 SASLv2 s sasl_server_new takes two new parameters to specify local and +SASLv2 SASLv2 s sasl_client_new takes two new parameters to specify local and + All 5xx replies must have a 5 xx xx detail code + Truncate hostnames ending in dot but not dot dot + Truncate hostnames ending in dot but not dot dot + Truncate hostnames ending in dot but not dot dot + Truncate names ending in dot but not dot dot +200412 200412 + Reject mail to unknown addresses in local domains domains that +client client name +stuff stuff +counter counter +Milter Milter initialization status +USE_TLSPROXY USE_TLSPROXY +address address family +void void +probed probed if non zero the time the currently outstanding address probe was + recipient lists and some MUAs even specify word word address +VERP VERP +NOTREACHED NOTREACHED +NOTREACHED NOTREACHED +NOTREACHED NOTREACHED +NOTREACHED NOTREACHED +NOTREACHED NOTREACHED +NOTREACHED NOTREACHED +NOTREACHED NOTREACHED +key key +key key +key key +key key +key key +key key +key key +key key +key key +key key +key key +key key +key key +key key +key key +key key +key key + Fatal error error opening existing file +void void bounce_cleanup_unregister void + Fatal error error opening existing file +BOUNCE_TEMPLATES BOUNCE_TEMPLATES bounce_templates_create void +void void bounce_templates_free templates + Fatal error error opening existing file + also showq showq c +name name length +BOUNCE_INFO BOUNCE_INFO bounce_mail_init service queue_name queue_id encoding + Fatal error error opening existing file +more more useful and more consistent + Fatal error error opening existing file + Fatal error error opening existing file +XXX XXX + int compar DNS_RR DNS_RR +USE_FNV_32BIT USE_FNV_32BIT diff --git a/external/ibm-public/postfix/dist/proto/stop.double-install-proto-text b/external/ibm-public/postfix/dist/proto/stop.double-install-proto-text new file mode 100644 index 00000000000..338286eb8ee --- /dev/null +++ b/external/ibm-public/postfix/dist/proto/stop.double-install-proto-text @@ -0,0 +1,41 @@ +bind bind no +bind bind sasl +bind bind yes + command_directory command_directory + Content Disposition Type name es es e 2E + daemon_directory daemon_directory + data_directory data_directory +done done + echo 0 Error unknown type type for path in meta postfix files 1 2 + echo echo 0 Error name should be an absolute path name 1 2 +esac esac + eval echo n name name c + eval group group + eval owner owner +example example com uucp example +file contains only a small subset of all parameters parameters +group group + html_directory html_directory + IP domain address address + IP pattern address address + IP user address address + IP user domain address address + mail_owner mail_owner + mailq_path mailq_path + manpage_directory manpage_directory + meta_directory meta_directory + newaliases_path newaliases_path + nisplus name s name name name column + postmap q nisplus name s name name inputfile + postmap q string nisplus name s name name +postmaster postmaster root + queue_directory queue_directory + readme_directory readme_directory +root root you + sample_directory sample_directory + sendmail_path sendmail_path + server_host ldap ldap example com 1444 + setgid_group setgid_group + shlib_directory shlib_directory + user foo domain user domain domain +virtual virtual alias domain anything right hand content does not matter diff --git a/external/ibm-public/postfix/dist/proto/stop.double-proto-html b/external/ibm-public/postfix/dist/proto/stop.double-proto-html new file mode 100644 index 00000000000..a7e78243d53 --- /dev/null +++ b/external/ibm-public/postfix/dist/proto/stop.double-proto-html @@ -0,0 +1,247 @@ + 1 000 000 messages with good performance unlikely above that limit + 10 10 Mandatory configuration file edits + 11 11 To chroot or not to chroot + 12 12 Care and feeding of the Postfix system +14 rbl_domain rbl_reason rbl_reason +168 100 189 2 255 255 255 224 +18 rbl_domain rbl_reason rbl_reason + 1 ffff ffff ffff ffff ffff ffff ffff ffff +2001 240 587 0 2d0 b7ff fe88 2ca7 ffff ffff ffff ffff + 31 sasldb Accounts are stored stored in a Cyrus SASL Berkeley DB + 33 ldapdb Accounts are stored stored in an LDAP database + 4 yes yes yes never 100 +5 postmaster postmaster example com +5 root root localhost +6 abuse abuse example com +80821 S 0 00 24 smtpd n smtp t inet u c o stress yes +83326 S 0 00 28 smtpd n smtp t inet u c o stress +84345 Ss 0 00 11 usr bin perl usr libexec postfix smtpd policy pl + 8 SENDMAIL usr sbin sendmail G i NEVER NEVER NEVER use t here +address localpart as per RFC 822 so that additional or or +all all Maximum per destination delivery concurrency +and cost cost 1 times more than if the preemptive scheduler was + and sneak in the ten recipient mail Wait wait wait Could we Aren t + aNULL aNULL kEECDH kEDH RC4 eNULL EXPORT LOW STRENGTH +Arrival Date Sun 26 Nov 2006 17 01 01 0500 EST +attacks with user domain domain addresses when Postfix provides +authzTo authzTo dn regex uniqueIdentifier ou people dc example dc com + AUXLIBS AUXLIBS options for LDAP or TLS etc +blockquote blockquote + broken smtp smtp o smtp_quote_rfc821_envelope no +ccert_fingerprint C2 9D F4 87 71 73 73 D9 18 E7 C2 F3 C1 DA 6E 04 +command_directory command_directory + concurrency concurrency limit +config_directory config_directory +daemon_directory daemon_directory +data_directory data_directory +Date Sun 26 Nov 2006 17 01 01 0500 EST +dd dd Alternatively check_ccert_access accepts an explicit search +dd dd check_ccert_access type table search_order cert_fingerprint +dd dd The commas are optional dd +dd dd The default algorithm is b sha256 b with Postfix ge 3 6 + dd No TLS TLS will not be used unless enabled for specific +Dec 4 04 30 09 hostname postfix smtpd 58549 NOQUEUE reject + default_transport uucp uucp gateway + different client IP addresses Lookup results override the the global +Documentation Documentation is available as README files start with the file +done done +done done + dt b a name check_address_map check_address_map a i a href DATABASE_RE + dt b a name check_ccert_access check_ccert_access a i a href DATABASE_ + dt b a name check_client_a_access check_client_a_access a i a href DAT + dt b a name check_client_access check_client_access a i a href DATABAS + dt b a name check_client_mx_access check_client_mx_access a i a href D + dt b a name check_client_ns_access check_client_ns_access a i a href D + dt b a name check_etrn_access check_etrn_access a i a href DATABASE_RE + dt b a name check_helo_a_access check_helo_a_access a i a href DATABAS + dt b a name check_helo_access check_helo_access a i a href DATABASE_RE + dt b a name check_helo_mx_access check_helo_mx_access a i a href DATAB + dt b a name check_helo_ns_access check_helo_ns_access a i a href DATAB + dt b a name check_policy_service check_policy_service i servername i a + dt b a name check_recipient_a_access check_recipient_a_access a i a hre + dt b a name check_recipient_access check_recipient_access a i a href D + dt b a name check_recipient_mx_access check_recipient_mx_access a i a h + dt b a name check_recipient_ns_access check_recipient_ns_access a i a h + dt b a name check_sasl_access check_sasl_access a i a href DATABASE_RE + dt b a name check_sender_a_access check_sender_a_access a i a href DAT + dt b a name check_sender_access check_sender_access a i a href DATABAS + dt b a name check_sender_mx_access check_sender_mx_access a i a href D + dt b a name check_sender_ns_access check_sender_ns_access a i a href D + dt b a name defer defer a b dt + dt b a name defer_if_permit defer_if_permit a b dt + dt b a name defer_if_reject defer_if_reject a b dt + dt b a name defer_unauth_destination defer_unauth_destination a b dt + dt b a name no_address_mappings no_address_mappings a b dt + dt b a name no_header_body_checks no_header_body_checks a b dt + dt b a name no_milters no_milters a b dt + dt b a name no_unknown_recipient_checks no_unknown_recipient_checks a b + dt b a name permit_auth_destination permit_auth_destination a b dt + dt b a name permit_dnswl_client permit_dnswl_client i dnswl_domain d d d d + dt b a name permit_inet_interfaces permit_inet_interfaces a b dt + dt b a name permit_mx_backup permit_mx_backup a b dt + dt b a name permit_mynetworks permit_mynetworks a b dt + dt b a name permit permit a b dt + dt b a name permit_rhswl_client permit_rhswl_client i rhswl_domain d d d d + dt b a name permit_sasl_authenticated permit_sasl_authenticated a b dt + dt b a name permit_tls_all_clientcerts permit_tls_all_clientcerts a b + dt b a name permit_tls_clientcerts permit_tls_clientcerts a b dt + dt b a name reject_invalid_helo_hostname reject_invalid_helo_hostname a + dt b a name reject_multi_recipient_bounce reject_multi_recipient_bounce a + dt b a name reject_non_fqdn_helo_hostname reject_non_fqdn_helo_hostname a + dt b a name reject_non_fqdn_recipient reject_non_fqdn_recipient a b dt + dt b a name reject_non_fqdn_sender reject_non_fqdn_sender a b dt + dt b a name reject_plaintext_session reject_plaintext_session a b dt + dt b a name reject_rbl_client reject_rbl_client i rbl_domain d d d d i + dt b a name reject reject a b dt + dt b a name reject_rhsbl_client reject_rhsbl_client i rbl_domain d d d d + dt b a name reject_rhsbl_helo reject_rhsbl_helo i rbl_domain d d d d i + dt b a name reject_rhsbl_recipient reject_rhsbl_recipient i rbl_domain d d + dt b a name reject_rhsbl_reverse_client reject_rhsbl_reverse_client i rbl_ + dt b a name reject_rhsbl_sender reject_rhsbl_sender i rbl_domain d d d d + dt b a name reject_sender_login_mismatch reject_sender_login_mismatch a + dt b a name reject_unauth_destination reject_unauth_destination a b dt + dt b a name reject_unauth_pipelining reject_unauth_pipelining a b dt + dt b a name reject_unknown_client_hostname reject_unknown_client_hostname + dt b a name reject_unknown_helo_hostname reject_unknown_helo_hostname a + dt b a name reject_unknown_recipient_domain reject_unknown_recipient_domain + dt b a name reject_unknown_sender_domain reject_unknown_sender_domain a + dt b a name reject_unlisted_recipient reject_unlisted_recipient a b wi + dt b a name reject_unlisted_sender reject_unlisted_sender a b dt + dt b a name reject_unverified_recipient reject_unverified_recipient a b + dt b a name reject_unverified_sender reject_unverified_sender a b dt + dt b a name sleep sleep i seconds i a b dt + dt b a name warn_if_reject warn_if_reject a b dt +dt dt b i a href DATABASE_README html type table a i b dt +dt dt b i number i i number i b dt + dt dt dd 0 Disable logging of TLS activity dd + dt dt dd 1 Log only a summary message on TLS handshake completion + dt dt dd 2 Also log levels during TLS negotiation dd + dt dt dd 3 Also log hexadecimal and ASCII dump of TLS negotiation + dt dt dd 4 Also log hexadecimal and ASCII dump of complete + dude dude example com + eliminates the latency of the TCP handshake SYN SYN ACK ACK + example com uucp uucp host + example MAIL RCPT BDAT BDAT MAIL RCPT BDAT without ever having to + export MANPATH MANPATH pwd man MANPATH +fe80 1 2d0 b7ff fe88 2ca7 ffff ffff ffff ffff +fe80 5 1 ffff ffff ffff ffff +file allows for robust handling of temporary delivery errors errors +Filtered Filtered +for the file name when a pattern is a type table table specification +from host example com 192 168 0 2 TLSv1 with cipher cipher name +generic generic a restrictions These restrictions are applicable in + groups msn com 63 2 1 2 4 4 14 14 14 8 0 + highvolume com 4000 160 160 320 640 1280 1440 0 0 0 0 +host host port host port address or address port the form + http www umich edu dirsvcs ldap ldap html or OpenLDAP + id 84863BC0E5 Sun 26 Nov 2006 17 01 01 0500 EST + if concurrency concurrency limit + ifconfig en0 alias address netmask 255 255 255 255 + inet_addr_local inet_addr_local configured 2 IPv4 addresses + inet_addr_local inet_addr_local configured 4 IPv6 addresses +insiders_only insiders_only check_sender_access hash etc postfix insiders reject +in the form of a domain name hostname hostname port hostname port +into memory such as pcre regexp or texthash texthash is similar + jane jane janes preferred machine + joe joe joes preferred machine + Line 8 NEVER NEVER NEVER use the t command line option here It +listname listname request + lists sourceforge net 2313 2313 0 0 0 0 0 0 0 0 +local local 8 +local_only local_only +maildrop maildrop +maildrop maildrop owner cn root dc your dc com +make make makefiles CC opt ansic bin cc Ae HP UX +make make makefiles CC purify cc + man man man5 postconf 5 less +master_service_disable foo inet inet +multi_instance_enable multi_instance_enable +multi_instance_group multi_instance_group +multi_instance_name multi_instance_name +mydestination myhostname localhost mydomain mydomain + mydomain to an incomplete address address rewriting alias +mynetworks mynetworks 127 0 0 0 8 168 100 189 0 28 1 128 fe80 10 2001 240 587 +mynetworks mynetworks hash etc postfix network_table +Name lt user example com gt gt i Postfix will ignore the i User + name name port name or name port + NOTE Postfix 3 6 also introduces support for the level level +number number ranges Postfix version 2 8 and later If no +numbers or number number ranges Postfix version 2 8 and later +one or more separated numbers or number number ranges + openssl req new key key +or more separated numbers or number number ranges p +or number number ranges Postfix version 2 8 and later If no + ownership of system directories such as etc usr usr bin var + PARAM postscreen_dnsbl_max_ttl postscreen_dnsbl_ttl postscreen_dnsbl_ttl + patterns list multiple domain names as domain domain + p Note 2 address information may be enclosed inside tt tt + postfix 12345 12345 postfix no where no shell + Postfix 2 3 2 5 to hang up on clients that that match + Postfix has TWO sets of mail filters filters that are used for +Postfix Postfix can use an LDAP directory as a source for any of its lookups + Postfix Postfix passes the status back to the remote SMTP + Postfix Postfix will send the mail back to the sender address +pre pre +query_filter mailacceptinggeneralid s maildrop maildrop +queue_directory queue_directory +Received from localhost localhost 127 0 0 1 +Received Received from porcupine org +rejected rejected recipients are available on request by the Milter + rewrite 8 none none + Say we have ten recipient mail followed by two two recipient mails If + separated numbers or number number ranges If no +smtpd_recipient_restrictions smtpd_recipient_restrictions +smtpd_relay_restrictions smtpd_relay_restrictions +smtpd_relay_restrictions smtpd_relay_restrictions + smtpd_tls_mandatory_protocols SSLv2 SSLv3 TLSv1 TLSv1 1 +smtpd_tls_mandatory_protocols SSLv2 SSLv3 TLSv1 TLSv1 1 + smtp smtp o smtp_bind_address 11 22 33 44 + smtp smtp o smtp_bind_address6 1 2 3 4 5 6 7 8 + smtp_tls_mandatory_protocols SSLv2 SSLv3 TLSv1 TLSv1 1 +smtp_tls_mandatory_protocols SSLv2 SSLv3 TLSv1 TLSv1 1 + SSLv3 TLSv1 TLSv1 1 TLSv1 2 and TLSv1 3 Starting with + T 5 10 20 40 80 160 320 640 1280 1280 + T A 5 10 20 40 80 160 320 320 + The and match and literally Without the the + The matches literally Without the the would +Therefore 301 0301 0x301 and 0x0301 are all equivalent to + The syntax of name value value name value and name value +the the backed up domain tld domain This prevents your mail queue + tls_random_source dev dev urandom + tls_random_source dev dev urandom +tls_random_source dev dev urandom +TLS TLS support in the LMTP delivery agent + TLSv1 3 with cipher TLS_AES_256_GCM_SHA384 256 256 bits + to flush flush 8 Deferred +to host example com 192 168 0 2 25 TLSv1 with cipher cipher name + to server example TLSv1 3 with cipher TLS_AES_256_GCM_SHA384 256 256 bits + TOTAL 5000 200 200 400 800 1600 1000 200 200 200 200 +transport transport + tt tt in the authorized_verp_clients value and in files + tt tt in the mynetworks value and in files specified with + tt tt in the smtpd_authorized_verp_clients value and in + tt tt in the smtpd_authorized_xclient_hosts value and in + tt tt in the smtpd_authorized_xforward_hosts value and in + tt tt in the smtpd_client_event_limit_exceptions value and + tt tt in the smtpd_sasl_exceptions_networks value and in + tt tt p +two two recipient mails + uid cn cn auth +Unfiltered Unfiltered + unknown recipients in local domains domains that match mydestination + Use blockquote pre pre blockquote for examples + Use pre pre for the Examples section at the end +username username + user sourceforge net 7678 7678 0 0 0 0 0 0 0 0 + using TLSv1 3 with cipher TLS_AES_256_GCM_SHA384 256 256 bits + using TLSv1 with cipher cipher name +var var spool and so on This is especially an issue if you executed +With the standard operators lt lt etc compatibility + yes yes yes never 100 +zombie zombie tlsproxy 8 smtpd 8 + and 1 000 000 messages with good performance unlikely above that +dt dt b name value b Postfix ge 3 0 dt + dt dt dd 3 Also log the hexadecimal and ASCII dump of the + dt dt dd 4 Also log the hexadecimal and ASCII dump of complete + parametername stress something something Other + p Note on OpenBSD systems specify dev dev arandom when dev dev urandom diff --git a/external/ibm-public/postfix/dist/proto/stop.spell-cc b/external/ibm-public/postfix/dist/proto/stop.spell-cc new file mode 100644 index 00000000000..9166298536a --- /dev/null +++ b/external/ibm-public/postfix/dist/proto/stop.spell-cc @@ -0,0 +1,1784 @@ +Aarnio +abcd +ABI +ABNF +abounce +accessor +ack +acked +acknowledgement +acl +ACL +adaptor +ADDCH +adddr +addenv +addn +Addr +addrbuf +ADDRFAMILY +addrinfo +ADDRINFO +addrs +adefer +adelay +adhoc +adomain +aes +af +AFS +Aho +ai +aierr +AIX +al +alg +algbits +algcode +allalnum +allascii +allbits +alldig +Allgemeine +ALLOC +allocator +Allowlist +allowlisting +ALLPERMS +ALLPKTS +allprint +Allright +allspace +alphanum +alphanumerics +androsyn +aox +ap +api +APIs +appl +APPL +ar +arg +argc +Argh +argi +argl +argp +Args +ARGS +ARGV +argvp +arpa +ARPA +aRv +ascii +aslo +ast +async +atol +atrace +ATTR +attrp +attrs +atype +Auch +auths +autoclass +Autodetect +Autodetection +automagically +AUTOUTF +AUXULIARY +AWK +Axel +Backoff +BADFLAGS +BADHINTS +balpar +basename +Basename +bdat +BDAT +bdehnoqv +BDFORXhqu +beh +bfFhimnNoprsuUvw +BH +BINARYMIME +binhash +BINHASH +BIOs +bitclean +BITCLEAN +bitmasks +bitrot +Bitrot +bitset +bitwise +Bitwise +blackholes +blocklisted +bona +bool +BOOL +booleans +br +bsmtp +BST +buf +BUF +BUFIZ +buflen +bufp +BUFSIZ +bufsize +BUFSIZE +bufstat +bugtraq +byuid +bzero +cachable +cacheable +canonicalization +canonicalize +Canonicalize +canonicalized +CANONNAME +CAPTURECOUNT +carriagecontrol +carriagereturn +Carsten +CASEF +Casefold +casefolded +casefoldx +casemapped +cC +ccerts +cdbm +CDBM +cdbq +CDE +certkey +certmatch +cfg +CFG +chainfiles +ChangeCipherSpec +charactersets +charset +checkdir +Chroot +CHROOT +chrooting +Ciphersuite +cleanenv +clearerr +clist +clnt +CLNT +clobbber +closefrom +closelog +CLR +clumsify +cmalloc +cmd +CMD +cmdp +cmds +cmp +cmsg +CMSG +CNAMEs +codepoint +Codepoint +codepoints +colocated +comingle +compar +COMPAT +comsat +COND +CONF +conn +const +Const +conv +cooldown +Coverity +cpio +cpp +cptr +CPTR +CPUs +CREAT +CRLF +ctable +CTABLE +ctext +ctime +ctl +CTL +ctype +CUID +curr +cvt +CWD +cz +da +datagram +datagrams +datalink +dbms +dbopen +dbpath +DCL +dcs +Dditvw +dealloc +deallocate +deallocates +deallocating +deallocation +debian +decapsulate +DECnet +decrypt +decryptable +decrypted +decrypting +DEFL +DEFLT +deflts +DEFNAME +DEFNAMES +DEFPATH +defport +DEFS +defval +del +delim +delims +deliverability +delrcpt +DELRCPT +denylisting +dequote +dereference +dereferencing +deserialization +Dest +DEST +DESTADDR +DESTPORT +destructor +df +DFFF +dfhHnopvx +DFL +DFXP +dgram +DGRAM +DHparams +dhs +Dik +dirent +dirname +dirs +DISCONN +DJB +DJBDNS +DJB's +dlen +dlfunc +DLL +DNSBLOG +DNSBNL +dNSName +DNSRCH +dnsxl +DNSXL +dom +dont +DONT +doproto +DORX +dotforward +dp +Driehuis +dsb +DSB +dsbuf +DSNs +dst +dtext +DTEXT +DTXT +dtype +DTYPE +dumpfile +dup +DUP +DUPFD +dups +dymap +EACCES +EADDRINUSE +EAGAIN +EBADF +ec +ECONNABORTED +ECONNREFUSED +ECONNRESET +eddd +EDQUOT +ee +EEXIST +EFBC +EFBDA +EFBIG +egid +Eindhoven +EINTR +EINVAL +Elektrotechnik +elif +else's +elsize +empt +emptive +Emtpy +emul +ENDIF +ENDIFs +endp +endpt +ENOBUFS +ENOENT +ENOMEM +ENOSPC +ENOTCONN +ent +ENT +entrancy +enum +ENUM +env +ENV +ENVFROM +envid +ENVID +ENVRCPT +eob +EOB +eod +eof +EOL +eother +EOVERFLOW +EPERM +epilog +EPIPE +EPROTO +epv +eq +EQ +ERANGE +errno +errstr +Eschborn +especials +ESTALE +et +ETIMEDOUT +eugid +EUGID +euid +EV +eval +EVAL +EVP +EXCHANGER +exchangers +execvp +expar +EXPN +expr +EXPR +extern +extpar +EXTPAR +FALLTHROUGH +FALLTRHOUGH +fam +Fawcett +fbck +fchmod +fclose +FCNTL +fdclose +FDD +FDEF +fdopen +fds +fdtable +feof +ferror +FFDHE +FFF +FFFE +FFFF +fflush +fg +fgetc +fgets +fh +fhHovx +fi +fide +fifo +FIFOs +filedes +fileno +filesystem +filesystems +filt +FILT +findenv +fixme +Fixme +FLD +fmt +fn +FN +FoldCase +fopen +forcetlsa +FOREACH +formatter +formfeed +Forststrasse +fovx +fp +fprint +fprintf +fpt +fpurge +fputc +fputs +fread +freeaddrinfo +fron +fscanf +fsck +fseek +fset +fsops +fsspace +fsstone +fstat +fsync +ftell +ftime +ftimeout +ftimeval +ftruncate +fu +fullname +fullwidth +func +FUNC +futimes +fwi +fwrite +gai +GECOS +Geoff +GETC +GETCHAR +getegid +getenv +geteuid +getgrnam +gethostbyaddr +GETHOSTBYNAME +getnameinfo +GETNAMEINFO +getopt +GETOPT +getpid +getpw +getsockopt +gettimeofday +getuid +ghostgun +giasbm +gid +GID +ging +github +GLIBC +glibc's +globals +gmtoff +gn +Goedel's +goto +GOTO +gotsigchld +gotsighup +grey +groupid +grr +Grr +halfdane +halfwidth +handoff +HaProxy +hardlink +hardlinks +hbc +HBC +hc +hdr +HDR +hdrs +HDRS +hdrval +HelloRetryRequest +helohost +herror +hexdump +hexvalue +hfrom +HFROM +HGMP +Hinxton +HMAC +honoured +hostaddr +HOSTADDR +hostmumble +Hostname +HOSTNAME +hostport +hostrr +hport +HPUX +HRR +htable +HTABLE +htonl +htons +https +HUP +ial +icgroup +ICT +IDENT +ideographic +idna +IDNA +ifdefs +IFF +ifinet +IFINET +IFMT +ifself +IGN +illumos +IMPL +INADDR +incr +INCR +indexable +Indexable +indirections +ing +INIT +initializations +initializer +inj +Inlined +inlining +instantiation +interruptible +intra +INTV +intval +inum +INVAL +ioctls +iostuff +iov +iovlen +ipaddr +IPD +ipmatch +IPPROTO +isalnum +ISALNUM +isascii +ISASCII +iscntrl +isjmp +ISMARKED +isprint +ISSET +issetuid +ISSOCK +ISXXX +iter +ITER +iterator's +iterators's +itty +Jaenicke +jbuf +JCL +jeffm +JIT +jmp +johhny +jq +json +JSON +KAME +Karlsruhe +kB +Keean +keepalive +keepalives +Kellerspeicherpegelanzeiger +Kernighan +keyfile +keyname +Kilani +killme +Kirch +koobera +Kouhei +Krahmer +lastl +latencies +lateron +ldapone +LDH +len +LEV +leven +lex +lexicals +lf +lflags +libbind +LIBC +libdata +libfuncs +libmaster +libmemcache +Libmilter +libname +libresolv +libtls +libunbound +libutil +lims +lineno +liveness +lnsl +LOCALDOMAIN +LOCALPART +Logfile +Logfiles +logmask +logopts +logrotate +logtag +logwriter +LOGWRITER +LONGJMP +longjump +Lookups +lowfd +lowfrom +lposix +lseek +lsm +LSM +lsocket +lstat +Lstat +ltype +lvalue +lvalues +lx +LY +macrps +MAILLOG +makedef +malloc +mallocs +mapnames +MAPNAMES +mapsize +maptypes +masq +masterp +matchlist +Matti +maxdepth +maxlen +MAXLEN +MaxProtocol +MAXSEG +maxsize +mbox +MBOX +mdalg +mdb +MDB +MECH +Meer +memcaches +memcat +memchr +memcmp +memcpy +memmove +memopen +memreopen +memset +MERCHANTABILITY +mesg +MESG +midna +MILTER +milter's +MILTERS +MinProtocol +minrate +minssf +Mis +misconfiguration +mkdirs +mkfifo +mkmap +MKMAP +mmap +MMNNFFPPS +mname +MNAME +Montegancedo +MQID +MRU +msgs +msk +mss +MSS +mtp +MTU +mtype +MTYPE +MUL +multf +multibyte +multiline +multiserver +multivalued +mutexes +Muuss +MVCC +mvect +MVECT +mxrr +MXs +myaddrinfo +mydest +mydomainname +myflock +MYFLOCK +myfree +mygroup +mymalloc +mymemdup +mypasswd +mypwcache +mypwd +mypwenter +mypwfree +mypwnam +mypwuid +myrand +myrealloc +mysqlsource +mysrand +mystrdup +mystrndup +mystrtok +mystrtokdq +mystrtokq +na +Nagle +Nagle's +nam +namaddr +namadr +NAMADR +namechecks +NAMELEN +namelength +nameser +namespace +namespaces +nameval +NAMEVAL +namme +nasties +natively +NATs +nbbio +NBBIO +nbool +NBOOL +nbytes +nc +ncache +Ncache +NCACHE +nd +ndbm +ndr +nelm +netblock +netdb +NetInfo +Netstring +NETSTRING +netstrings +newcontext +newd +newpath +newqeueid +newqueueid +newtls +nexhop +NeXT +NEXTHOP +nexthops +nf +Nfinoprsuvw +NFS +ni +nid +NID +nids +nint +NINT +nlink +nlinks +nnn +NOCLOSE +NODELAY +nodename +noexcept +NOEXT +noforward +NOKEY +NOLOCK +NOMEMINIT +NONAME +NONDEF +nonl +noop +Noop +nop +NOP +NORETURN +normalizer +NOSUB +notfound +NOTFOUND +NOTHROTTLE +NOTREACHED +nowait +NOWAIT +np +nparts +nr +Nr +nscd +ntls +ntohs +ntop +NUL +nulll +nullmx +nullMX +NULLMX +num +NUMERICHOST +nvtable +NVTABLE +nxxx +oact +Oaktree +oconv +offsetof +OID +oldd +oldlog +oldstyle +oname +OpenLDAP's +openlog +operability +OPs +OPTNEG +orcpt +ORCPT +ord +ot +ourself +overallocate +ownreq +ozz +padchar +padlen +pagein +pageout +PARAM +parametername +params +PARAMS +paren +parens +parm +parsable +parseline +parsers +Pashkov +passivate +Passivate +passivated +passivation +pathame +Pathname +pathp +patrik +pcf +PCF +pclose +pcs +PDDMDS +pdelay +PDMS +pedantism +peekfd +peercert +permited +pfxs +PGRES +PGresult +pgsqlsource +Pieter +Pipelining +PKCS +PKEY +PKIX +PLAINTEXT +Plauger +plist +plmysql +PLMYSQL +plpgsql +PLPGSQL +PMilter +Pn +pname +POB +popen +POPEN +portnum +PORTP +pos +posix +Posix +postcondition +Postcondition +postexpire +POSTFIX +postgresql +Postgresql +Postlog +postlogd +Postprocessing +postremove +postrename +postrmdir +posttls +PPTR +PQescapeString +PQescapeStringConn +prabhat +PRE +precedences +pred +predefines +prefetch +prefi +pregreet +PREGREET +pregreeting +preimage +Preload +prepended +prepending +Prepending +prepends +preprocessed +Preprocessing +PREREQ +prescan +printfck +PRINTFLIKE +PRINTFPTRLIKE +PRNGD +PROC +procname +procnet +PROCNET +progname +programmatically +prolog +proto +Proto +protomask +prototyped +PROX +proxied +Proxied +PROXYING +Proxymappers +psc +PSC +pseudofield +pseudothread +pseudothreads +PSS +psSv +PTHREAD +pton +PTRs +pushback +PUTC +PUTCHAR +putenv +pv +qfile +qflags +qI +qIqueueid +qname +qnameval +qsort +QSTRING +ratbox +raxoft +rcode +RCODE +rcpb +RCPTs +rdb +rdev +rdonly +RDONLY +rdwr +RDWR +readdir +readline +readlline +readllines +readwrite +realloc +recdump +recip +RECIP +reclen +reconnection +recurse +Recurse +RECURSE +Recurses +recursing +recv +RECV +Redhat +Redistributions +reentrancy +REENTRANCY +reentrant +refcounts +refesh +regerror +reget +REGSUB +relop +RELOP +relops +rendez +repl +replayer +replycode +representable +requestor +requestors +requeuing +resflags +responder +restartable +resync +resynchronize +ret +RET +retransmission +retransmit +retryable +retval +revalidate +revalidated +rewriter +rfind +rflag +rflags +rh +RHS +RHSBL +rhswl +RHSWL +Ribbens +rl +RLIM +RMTA +rname +RO +Roel +roques +roundtrips +rp +RPCs +RQST +rr +RRDATA +rrlist +RRSIG +rtnetlink +ruleset +RWR +sa +salen +SAML +sanitization +Santize +sb +SCACHE +SCANFLIKE +SCCS +Schoenmakers +Schupke +scott +screener +sdelay +SDK's +seach +seekable +selectable +sendfd +sendmsg +sep +serv +SERV +serverid +serverout +servers's +servicename +servname +SERVNAME +SERVPORT +sess +SESS +setegid +Setenv +seteuid +setgroups +Sethi +setrlimit +setsid +setsockopt +setuid +sgid +sig +SIG +sigaction +sigaddset +SIGALRM +sigchld +SIGCHLD +sigdeath +sigdelay +sigemptyset +sighup +SIGILL +siginit +SIGINT +SIGKILL +signum +SIGPIPE +sigprocmask +SIGQUIT +sigresume +SIGSEGV +sigset +sigsetup +sigval +silenty +siocgif +SIOCGIFCONF +SIOCGIFNETMASK +siocglif +SIOCGLIFCONF +SIOCGLIFNETMASK +SIOCLIF +sizeof +skipblanks +sl +SLMDB +SLMs +smap +SMFIF +SMFIM +sni +SOA +sockaddr +SOCKADDR +Socketmap +socketmapname +socketmaps +socketpair +socklen +sockmap +socktype +SOCKTYPE +sofar +softerror +softlinks +SOML +soname +sp +SPARC +spawner +Spead +SPID +splitq +splitter +sqlitecon +sqrt +SRC +srv +srvr +sscanf +SSF +ssize +ssscanf +stackable +starttime +STATCUR +STATFAIL +statp +STATUNTRIED +StatusOr +statusp +stdarg +stderr +STDERR +STDIN +stdout +STDOUT +steenkeeng +stmt +str +STR +strcasecmp +strcat +strcpy +streamlf +STREAMLF +STREQ +strerror +STRERROR +strflags +strftime +stringops +strlen +STRLEN +strncasecmp +strncat +strncpy +strrecord +STRREF +strspn +strtol +strtoul +strtype +struct +structs +strval +STS +stuffozz +stye +subclasses +subcommand +subdirectories +Subdirectory +subjectAltName +subjectAltNames +sublist +sublists +Subnet +subnets +subopen +subpatterns +Substring +substrings +subtype +subtypes +succ +sudo +sunislelodge +superblocks +superset +supprt +Sutou +SVID +swb +Symas +symlinked +symlink's +symlinks +syscall +SYSCALL +sysconf +Syslog +syslogged +syslogging +sysv +TAAAA +tailp +tas +teardown +Tempfail +tempfailed +testcase +testname +th +tha +thash +THASH +theadsafe +threadsafe +thusly +timecmp +timeval +timval +tindx +tItp +tkt +TLScontext +tlsext +tlsfinger +tlsmgrmem +tlsmgr's +tlsp +TLSP +TLSPKTS +TLSPROXY +TLVs +tm +tmpbuf +ToASCII +TOCTOU +Todo +TODO +TOFILE +tok +TOK +tokenize +Tokenize +tokenizer +tokenizes +tokenizing +tokval +toUTF +tp +translit +transp +TRANSP +treibsand +tresspassers +trimblanks +trivally +TRNC +TRUNC +TRUSTAD +trustfile +TTL +TTLs +tty +tunable +Tunable +Tunables +tv +txn +TXT +Typechecking +TYPECONNSTRING +typedef +typedefs +TYPEINET +TYPEUNIX +ucasemap +uchar +UDP +ug +ugid +uic +uidna +UIDNA +UIDs +uint +ULIMIT +Ullman +ulong +ULONG +ultostr +Ultrix +ulval +un +unalias +uname +UNAUTH +unbuffered +uncache +Uncomment +undef +UNDEF +Undefine +Undeliverable +unescape +UNFAIL +unformatted +unget +ungetc +Unhandled +unicode +unimpl +uniq +unistd +unitialized +Universitaetsplatz +UnixWare +unk +unlink +Unlink +unlinked +unlinking +unlockfile +unmark +Unmark +unmarks +Unoptimized +Unparsable +unparse +unparsed +unparser +unparsing +UNPROTO +unprototyped +unregister +unregistering +unregisters +unselect +unselected +unsetenv +unsets +UNSPEC +unterminated +unthrottle +Unthrottle +UNTHROTTLE +UNTRUSTED +upass +upd +updatable +UPDATABLE +Upref +uprefs +URI +URIs +url +useauto +usebits +usec +usleep +USR +utf +utime +UTS +uva +uxtext +va +valgrind +validator +VALIDATOR +variadic +vbuf +VBUF +VBUFs +vdsb +ve +ver +verifier +verpified +VERPify +vfprintf +vfy +vmailer +Vmailer +vmilter +VMS +vmsg +Vn +vopened +vous +vp +vprint +vprintf +vscan +vsmtp +vsmtpd +vsnl +VSNL +vsprintf +vstream +VSTREAM +Vstreams +VSTREAM's +VSTREAMs +VSTREAMS +vstring +VSTRING +VSTRINGs +vtrace +waitpid +WAITPID +Wakeup +WAKEUP +wat +webservers +WeiYu +Wformat +whatsup +Whitespace +WIFSTOPPED +wil +wildcarded +Wimplicit +wireshark +Wmissing +Woops +Wparentheses +wr +Wrappermode +WRITEMAP +WRONLY +wsp +Wstrict +Wswitch +WTF +Wuninitialized +Wunused +XCPT +xdelay +xe +xfers +xmask +xport +xsasl +XSASL +XSH +xt +XTRA +XVxy +xxdbx +xxgdb +xxxx +XXXXX +xxxxxx +XXXXXXX +YASLM +yeardays +yyyy +yyyymmdd +zA +zer +Zmailer +AMD +All's +BIO +BTU +CALLBACK +CHUNKING +CO +CONT +CV +Callback +Cert +Compaq +DBL +DBMS +DICT +DP +Deferrals +ENC +EXCL +EXP +EXT +Ff +Goode +Grandfathered +INST +Inline +Kluge +LANG +LIB +LP +MAI +MGR +MIPS +MISC +MSG +MULTIPART +Majordomo +Misc +Mn +NB +NR +OBS +ORIG +OTOH +PF +PP +PX +Pf +Plugins +REC +RR +Rcpt +Regexp +SB +SC +SEQ +SN +STAT +STATS +STD +Siemens +Simplistically +Stat +UK +UNICODE +USERNAME +UTC +Unicode +Username +VA +ab +alphanumerical +app +av +barf +beholder's +bidirectionally +binding's +bio +builtin +callback +callbacks +ch +chg +comm +comp +crappy +def +deferrals +diff +enc +excl +exp +ext +externalized +gazillions +ht +incl +instance's +key's +kluge +masqueraded +maxed +metadata +mgr +mp +neg +op +ops +perms +pf +piggybacked +pref +proactive +proactively +proxy's +pt +reanimates +rec +refactor +regexps +request's +rollover +schlepping +scratchpad +seq +singlets +stat +stats +trespassing +ts +val +vars +verboten +versioning +wiki +DSTRICT +FNV +NONBLOCK +Vo +chongo +fnv +isthe +ldseed +softwareengineering +stackexchange +stdint +Noll diff --git a/external/ibm-public/postfix/dist/proto/stop.spell-proto-html b/external/ibm-public/postfix/dist/proto/stop.spell-proto-html new file mode 100644 index 00000000000..a4ad7c594dd --- /dev/null +++ b/external/ibm-public/postfix/dist/proto/stop.spell-proto-html @@ -0,0 +1,350 @@ +ABNF +ADAgECAhQSv +adhoc +ADME +aes +af +ahQkZ +AIX +Allowlist +allowlisting +allowlists +alphanumerics +amavisd +ame +apache +ASE +ATABASE +ated +attractor +authc +Axel +backported +Backscatter +BAQEFAASCBKcwggSjAgEAAoIBAQDc +barelf +bC +BDAT +BgBQGBg +BINARYMIME +bona +BQ +br +CAQAwBQYDK +Carsten +CdUaexKP +ce +certN +cflags +cgi +CHACHA +chainN +ching +ciphe +cldr +cOkjtAH +COMPAT +concurrenc +conn +Crespo +cronjob +csie +cve +cvename +Cy +cyrusimap +DATAB +DATABAS +dbpath +DCCAeCgAwIBAgIUIUkrbk +deduplication +Denylist +denylisting +denylists +der +dereferencing +DESTADDR +destinatio +DESTPORT +dfn +dgram +dH +DISPLA +dll +dom +doma +dont +DONT +dq +ecdsacerts +ecdsakey +EEXIST +eeYOxyThMA +Efbz +egv +else's +ENOENT +exchangers +exploder +fb +fe +fg +fi +fide +fifo +filesystem +fmsiQoRHzAFBgMrZXEwFDESMBAG +fprint +Fq +GAemPCT +ge +gid +GID +github +Gunnar +hardlink +hea +hecks +HGVNTK +HHMMSS +hostn +HOSTNAME +hre +href +HswDQYJKoZIhvcNAQEL +https +HuNn +HUP +iana +IDENT +idna +IDNA +ijs +imit +IU +jane +Jänicke +Jänicke's +jByBifpIe +jnorell +joe +js +jsp +kali +KAME +KazmyRi +keld +keyN +Kilani +krcaJvDSMgvu +KypOZPNPF +lan +latencies +li +libmemcache +libs +lient +limi +LNler +Logfile +logrotate +LOGTAG +lookahead +Lookups +lsqlite +lt +MAILLOG +mbox +MEcCAQAwBQYDK +MessageLabs +MIDDLEBOX +MIIBdjCB +MIIBKzCB +MIIC +MIIEvQIBADANBgkqhkiG +MILTER +mit +mitre +mtaadmin +MTAADMIN +mtadmin +mua +mygroup +myinst +NAbIJaDBqZb +nameservers +namespace +nat +nC +ncache +NCALLS +NCTU +newgroup +NFS +nH +ninit +NNTP +noop +nroffescape +nullmx +nulPzwUo +nzHQJ +OGvpyrMlm +oP +opendmarc +orion +oth +overinflate +oyE +PARAM +parametername +params +parsers +Pathname +pfs +pkgsrc +POSTFIX +postlogd +pQcWsx +precedences +pregreet +Pregreet +PREGREET +prepended +prepending +prepends +proble +proxied +Pseudocode +PSS +punycode +qADAgECAhQaw +qi +qmznjbD +Quanah +QusgkahH +Ralf +relayhos +RESOLV +resolvers +retransmission +retransmits +retransmitted +rf +rflRreYuUZBp +rhswl +Rirz +rL +rMZDAFBgMrZXAwFDESMBAG +RolyeiE +roundtrips +RPCZDrPX +rsacerts +rsachain +rsakey +rsyslog +runnable +SASLAUTHD +scheduler's +schemas +se +selectable +ser +SESS +si +SLcOiXFHXlxp +smarthost +smatch +sni +Softw +sp +spamassassin +spambot +sqrt +stderr +stdout +Stdout +stname +strftime +subdirectories +suboptimal +suid +suiteb +systemd +sz +tDc +tempfailing +th +threadm +threadsafe +tname +TRE +trusteddomain +TTL +tu +tw +TXT +uname +Uncomment +Undeliverable +unexpanded +unextended +unicode +unrefreshed +unrepliable +Unselective +unvalidated +uva +vali +VwBCIEIEJfbbO +VxBDsEOQf +VZuh +Whitespace +wi +wip +wKsTGDH +wzFd +xhtml +YPDWxEHom +YWH +yYhh +zdlPQR +Aren +rejec +debian +prox +vir +AAA +Admin +CHUNKING +DAT +Downsides +Firefox +Inline +Jänicke's +LANG +NZ +Plugin +Plugins +Unicode +WHITELIST +bk +ch +chg +chunking +comm +dbl +downsides +fer +gt +hos +injectors +kinks +pkg +rollover +rs +subj +wiki +Jà +ng +rsyslogd diff --git a/external/ibm-public/postfix/dist/proto/transport b/external/ibm-public/postfix/dist/proto/transport index 49b3441d851..c5ffff2ac9f 100644 --- a/external/ibm-public/postfix/dist/proto/transport +++ b/external/ibm-public/postfix/dist/proto/transport @@ -54,7 +54,7 @@ # # Alternatively, the table can be provided as a regular-expression # map where patterns are given as regular expressions, or lookups -# can be directed to TCP-based server. In those case, the lookups +# can be directed to a TCP-based server. In those case, the lookups # are done in a slightly different way as described below under # "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". # CASE FOLDING @@ -79,7 +79,8 @@ # starts with whitespace continues a logical line. # .PP # The \fIpattern\fR specifies an email address, a domain name, or -# a domain name hierarchy, as described in section "TABLE LOOKUP". +# a domain name hierarchy, as described in section "TABLE +# SEARCH ORDER". # # The \fIresult\fR is of the form \fItransport:nexthop\fR and # specifies how or where to deliver mail. This is described in diff --git a/external/ibm-public/postfix/dist/proto/virtual b/external/ibm-public/postfix/dist/proto/virtual index 8f047322f67..84edde41c7b 100644 --- a/external/ibm-public/postfix/dist/proto/virtual +++ b/external/ibm-public/postfix/dist/proto/virtual @@ -47,7 +47,7 @@ # # Alternatively, the table can be provided as a regular-expression # map where patterns are given as regular expressions, or lookups -# can be directed to TCP-based server. In those case, the lookups +# can be directed to a TCP-based server. In those case, the lookups # are done in a slightly different way as described below under # "REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES". # CASE FOLDING @@ -89,7 +89,7 @@ # $\fBmydestination\fR, or when it is listed in $\fBinet_interfaces\fR # or $\fBproxy_interfaces\fR. # .sp -# This functionality overlaps with functionality of the local +# This functionality overlaps with the functionality of the local # \fIaliases\fR(5) database. The difference is that \fBvirtual\fR(5) # mapping can be applied to non-local addresses. # .IP "@\fIdomain address, address, ...\fR" @@ -145,7 +145,7 @@ # # The \fBpropagate_unmatched_extensions\fR parameter controls whether # an unmatched address extension (\fI+foo\fR) is propagated to the -# result of table lookup. +# result of a table lookup. # VIRTUAL ALIAS DOMAINS # .ad # .fi @@ -224,7 +224,7 @@ # This section describes how the table lookups change when lookups # are directed to a TCP-based server. For a description of the TCP # client/server lookup protocol, see \fBtcp_table\fR(5). -# This feature is not available up to and including Postfix version 2.4. +# This feature is available in Postfix 2.5 and later. # # Each lookup operation uses the entire address once. Thus, # \fIuser@domain\fR mail addresses are not broken up into their @@ -243,9 +243,9 @@ # a configuration change. # .IP "\fBvirtual_alias_maps ($virtual_maps)\fR" # Optional lookup tables that alias specific mail addresses or domains -# to other local or remote address. +# to other local or remote addresses. # .IP "\fBvirtual_alias_domains ($virtual_alias_maps)\fR" -# Postfix is final destination for the specified list of virtual +# Postfix is the final destination for the specified list of virtual # alias domains, that is, domains for which all addresses are aliased # to addresses in other local or remote domains. # .IP "\fBpropagate_unmatched_extensions (canonical, virtual)\fR" diff --git a/external/ibm-public/postfix/dist/src/bounce/2template_test.in b/external/ibm-public/postfix/dist/src/bounce/2template_test.in index 8afb4cef9cb..e45fd326634 100644 --- a/external/ibm-public/postfix/dist/src/bounce/2template_test.in +++ b/external/ibm-public/postfix/dist/src/bounce/2template_test.in @@ -1,6 +1,6 @@ failure_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Undelivered Mail Returned to Sender Postmaster-Subject: Postmaster Copy: Undelivered Mail @@ -19,7 +19,7 @@ EOF delay_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Delayed Mail (still being retried) Postmaster-Subject: Postmaster Warning: Delayed Mail @@ -42,7 +42,7 @@ EOF success_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Successful Mail Delivery Report This is the mail system at host $myhostname. @@ -57,7 +57,7 @@ EOF verify_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Mail Delivery Status Report This is the mail system at host $myhostname. @@ -68,7 +68,7 @@ Enclosed is the mail delivery report that you requested. EOF failure_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Undelivered Mail Returned to Sender Postmaster-Subject: Postmaster Copy: Undelivered Mail @@ -87,7 +87,7 @@ EOF delay_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Delayed Mail (still being retried) Postmaster-Subject: Postmaster Warning: Delayed Mail @@ -110,7 +110,7 @@ EOF success_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Successful Mail Delivery Report This is the mail system at host $myhostname. @@ -125,7 +125,7 @@ EOF verify_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Mail Delivery Status Report This is the mail system at host $myhostname. diff --git a/external/ibm-public/postfix/dist/src/bounce/Makefile.in b/external/ibm-public/postfix/dist/src/bounce/Makefile.in index 80f038f983d..969413a0003 100644 --- a/external/ibm-public/postfix/dist/src/bounce/Makefile.in +++ b/external/ibm-public/postfix/dist/src/bounce/Makefile.in @@ -11,7 +11,7 @@ HDRS = TESTSRC = DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE) CFLAGS = $(DEBUG) $(OPT) $(DEFS) -TESTPROG= +TESTPROG= bounce_notify_util_tester PROG = bounce SAMPLES = ../../conf/bounce.cf.default INC_DIR = ../../include @@ -31,10 +31,6 @@ $(PROG): $(OBJS) $(LIBS) rm -f $@ ./annotate.sh <template_test.ref >$@ -main.cf: - echo queue_directory=. >main.cf - echo myhostname=example.com >>main.cf - $(OBJS): ../../conf/makedefs.out Makefile: Makefile.in @@ -42,7 +38,13 @@ Makefile: Makefile.in test: $(TESTPROG) -tests: update template_test 2template_test +tests: update template_test obs_template_test 2template_test \ + with-msgid-with-long-line_test \ + with-msgid-with-eoh-event_test \ + with-msgid-no-eoh-event_test \ + no-msgid-with-eoh-event_test \ + no-msgid-no-eoh-event_test \ + with-msgid-with-filter_test root_tests: @@ -68,21 +70,254 @@ clean: tidy: clean +BOUNCE_NOTIFY_UTIL_TESTER_OBJS = bounce_notify_util_tester.o \ + bounce_notify_util.o bounce_template.o bounce_templates.o + +bounce_notify_util_tester: $(BOUNCE_NOTIFY_UTIL_TESTER_OBJS) $(LIBS) + $(CC) -DTEST $(CFLAGS) -o $@ $(BOUNCE_NOTIFY_UTIL_TESTER_OBJS) \ + $(LIBS) $(SYSLIBS) + # Avoid dependency on installed Postfix. # XXX This still requires that default_privs, mail_owner etc. accounts exist. -template_test: $(PROG) main.cf template_test.ref +template_test: $(PROG) template_test.ref + echo queue_directory=. >main.cf + echo myhostname=example.com >>main.cf + echo header_from_format=standard >>main.cf + touch -t 197101010000 main.cf MAIL_CONFIG=. ./$(PROG) -SVzndump_templates >template_test.tmp diff template_test.ref template_test.tmp MAIL_CONFIG=. ./$(PROG) -SVzndump_templates \ -o bounce_template_file=template_test.ref > template_test.tmp diff template_test.ref template_test.tmp - rm -f template_test.tmp + rm -f template_test.tmp main.cf -2template_test: $(PROG) main.cf template_test.ref 2template_test.in +obs_template_test: $(PROG) obs_template_test.ref + echo queue_directory=. >main.cf + echo myhostname=example.com >>main.cf + echo header_from_format=obsolete >>main.cf + touch -t 197101010000 main.cf + MAIL_CONFIG=. ./$(PROG) -SVzndump_templates >template_test.tmp + diff obs_template_test.ref template_test.tmp + rm -f template_test.tmp main.cf + +2template_test: $(PROG) template_test.ref 2template_test.in + echo queue_directory=. >main.cf + echo myhostname=example.com >>main.cf + touch -t 197101010000 main.cf MAIL_CONFIG=. ./$(PROG) -SVzndump_templates \ -o bounce_template_file=2template_test.in > template_test.tmp diff template_test.ref template_test.tmp - rm -f template_test.tmp + rm -f template_test.tmp main.cf + +with-msgid-with-long-line_test: bounce_notify_util_tester \ + msgfile-with-msgid-with-long-line logfile-with-msgid-with-long-line \ + with-msgid-with-long-line-no-thread.ref \ + with-msgid-with-long-line-with-thread.ref + rm -rf queue main.cf + echo 'enable_threaded_bounces = no' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-with-msgid-with-long-line queue/bounce/msgid + cp msgfile-with-msgid-with-long-line queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > with-msgid-with-long-line-no-thread.tmp + diff with-msgid-with-long-line-no-thread.ref with-msgid-with-long-line-no-thread.tmp + rm -f with-msgid-with-long-line-no-thread.tmp + : + rm -rf queue main.cf + echo 'enable_threaded_bounces = yes' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-with-msgid-with-long-line queue/bounce/msgid + cp msgfile-with-msgid-with-long-line queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > with-msgid-with-long-line-with-thread.tmp + diff with-msgid-with-long-line-with-thread.ref with-msgid-with-long-line-with-thread.tmp + rm -f with-msgid-with-long-line-with-thread.tmp + rm -rf queue main.cf + +with-msgid-with-eoh-event_test: bounce_notify_util_tester \ + msgfile-with-msgid-with-eoh-event logfile-with-msgid-with-eoh-event \ + with-msgid-with-eoh-event-no-thread.ref \ + with-msgid-with-eoh-event-with-thread.ref + rm -rf queue main.cf + echo 'enable_threaded_bounces = no' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-with-msgid-with-eoh-event queue/bounce/msgid + cp msgfile-with-msgid-with-eoh-event queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > with-msgid-with-eoh-event-no-thread.tmp + diff with-msgid-with-eoh-event-no-thread.ref with-msgid-with-eoh-event-no-thread.tmp + rm -f with-msgid-with-eoh-event-no-thread.tmp + : + rm -rf queue main.cf + echo 'enable_threaded_bounces = yes' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-with-msgid-with-eoh-event queue/bounce/msgid + cp msgfile-with-msgid-with-eoh-event queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > with-msgid-with-eoh-event-with-thread.tmp + diff with-msgid-with-eoh-event-with-thread.ref with-msgid-with-eoh-event-with-thread.tmp + rm -f with-msgid-with-eoh-event-with-thread.tmp + rm -rf queue main.cf + +with-msgid-no-eoh-event_test: bounce_notify_util_tester \ + msgfile-with-msgid-no-eoh-event logfile-with-msgid-no-eoh-event \ + with-msgid-no-eoh-event-no-thread.ref \ + with-msgid-no-eoh-event-with-thread.ref + rm -rf queue main.cf + echo 'enable_threaded_bounces = no' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-with-msgid-no-eoh-event queue/bounce/msgid + cp msgfile-with-msgid-no-eoh-event queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > with-msgid-no-eoh-event-no-thread.tmp + diff with-msgid-no-eoh-event-no-thread.ref with-msgid-no-eoh-event-no-thread.tmp + rm -f with-msgid-no-eoh-event-no-thread.tmp + : + rm -rf queue main.cf + echo 'enable_threaded_bounces = yes' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-with-msgid-no-eoh-event queue/bounce/msgid + cp msgfile-with-msgid-no-eoh-event queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > with-msgid-no-eoh-event-with-thread.tmp + diff with-msgid-no-eoh-event-with-thread.ref with-msgid-no-eoh-event-with-thread.tmp + rm -f with-msgid-no-eoh-event-with-thread.tmp + rm -rf queue main.cf + +no-msgid-with-eoh-event_test: bounce_notify_util_tester \ + msgfile-no-msgid-with-eoh-event logfile-no-msgid-with-eoh-event \ + no-msgid-with-eoh-event-no-thread.ref \ + no-msgid-with-eoh-event-with-thread.ref + rm -rf queue main.cf + echo 'enable_threaded_bounces = no' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-no-msgid-with-eoh-event queue/bounce/msgid + cp msgfile-no-msgid-with-eoh-event queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > no-msgid-with-eoh-event-no-thread.tmp + diff no-msgid-with-eoh-event-no-thread.ref no-msgid-with-eoh-event-no-thread.tmp + rm -f no-msgid-with-eoh-event-no-thread.tmp + : + rm -rf queue main.cf + echo 'enable_threaded_bounces = yes' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-no-msgid-with-eoh-event queue/bounce/msgid + cp msgfile-no-msgid-with-eoh-event queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > no-msgid-with-eoh-event-with-thread.tmp + diff no-msgid-with-eoh-event-with-thread.ref no-msgid-with-eoh-event-with-thread.tmp + rm -f no-msgid-with-eoh-event-with-thread.tmp + rm -rf queue main.cf + +no-msgid-no-eoh-event_test: bounce_notify_util_tester \ + msgfile-no-msgid-no-eoh-event logfile-no-msgid-no-eoh-event \ + no-msgid-no-eoh-event-no-thread.ref \ + no-msgid-no-eoh-event-with-thread.ref + rm -rf queue main.cf + echo 'enable_threaded_bounces = no' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-no-msgid-no-eoh-event queue/bounce/msgid + cp msgfile-no-msgid-no-eoh-event queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > no-msgid-no-eoh-event-no-thread.tmp + diff no-msgid-no-eoh-event-no-thread.ref no-msgid-no-eoh-event-no-thread.tmp + rm -f no-msgid-no-eoh-event-no-thread.tmp + : + rm -rf queue main.cf + echo 'enable_threaded_bounces = yes' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-no-msgid-no-eoh-event queue/bounce/msgid + cp msgfile-no-msgid-no-eoh-event queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > no-msgid-no-eoh-event-with-thread.tmp + diff no-msgid-no-eoh-event-with-thread.ref no-msgid-no-eoh-event-with-thread.tmp + rm -f no-msgid-no-eoh-event-with-thread.tmp + rm -rf queue main.cf + +with-msgid-with-filter_test: bounce_notify_util_tester \ + msgfile-with-msgid-with-filter logfile-with-msgid-with-filter \ + with-msgid-with-filter-no-thread.ref \ + with-msgid-with-filter-with-thread.ref + rm -rf queue main.cf + echo 'enable_threaded_bounces = no' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-with-msgid-with-filter queue/bounce/msgid + cp msgfile-with-msgid-with-filter queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > with-msgid-with-filter-no-thread.tmp + diff with-msgid-with-filter-no-thread.ref with-msgid-with-filter-no-thread.tmp + rm -f with-msgid-with-filter-no-thread.tmp + : + rm -rf queue main.cf + echo 'enable_threaded_bounces = yes' >main.cf + echo 'queue_directory = queue' >>main.cf + echo 'myhostname = mail.example' >>main.cf + touch -t 197101010000 main.cf + mkdir -p queue/active queue/bounce + cp logfile-with-msgid-with-filter queue/bounce/msgid + cp msgfile-with-msgid-with-filter queue/active/msgid + $(SHLIB_ENV) $(VALGRIND) ./bounce_notify_util_tester \ + -c. bounce active msgid 2>&1 | \ + sed 's;msgid.[0-9]*/mail.example;msgid.unix-time/mail.example;' \ + > with-msgid-with-filter-with-thread.tmp + diff with-msgid-with-filter-with-thread.ref with-msgid-with-filter-with-thread.tmp + rm -f with-msgid-with-filter-with-thread.tmp + rm -rf queue main.cf depend: $(MAKES) (sed '1,/^# do not edit/!d' Makefile.in; \ @@ -102,6 +337,7 @@ bounce.o: ../../include/deliver_request.h bounce.o: ../../include/dsb_scan.h bounce.o: ../../include/dsn.h bounce.o: ../../include/dsn_buf.h +bounce.o: ../../include/hfrom_format.h bounce.o: ../../include/htable.h bounce.o: ../../include/iostuff.h bounce.o: ../../include/load_file.h @@ -216,6 +452,7 @@ bounce_notify_util.o: ../../include/dsn.h bounce_notify_util.o: ../../include/dsn_buf.h bounce_notify_util.o: ../../include/dsn_mask.h bounce_notify_util.o: ../../include/events.h +bounce_notify_util.o: ../../include/header_opts.h bounce_notify_util.o: ../../include/htable.h bounce_notify_util.o: ../../include/int_filt.h bounce_notify_util.o: ../../include/iostuff.h @@ -249,6 +486,31 @@ bounce_notify_util.o: ../../include/vstring.h bounce_notify_util.o: bounce_notify_util.c bounce_notify_util.o: bounce_service.h bounce_notify_util.o: bounce_template.h +bounce_notify_util_tester.o: ../../include/attr.h +bounce_notify_util_tester.o: ../../include/bounce_log.h +bounce_notify_util_tester.o: ../../include/check_arg.h +bounce_notify_util_tester.o: ../../include/dsn.h +bounce_notify_util_tester.o: ../../include/dsn_buf.h +bounce_notify_util_tester.o: ../../include/dsn_mask.h +bounce_notify_util_tester.o: ../../include/hfrom_format.h +bounce_notify_util_tester.o: ../../include/htable.h +bounce_notify_util_tester.o: ../../include/mail_conf.h +bounce_notify_util_tester.o: ../../include/mail_params.h +bounce_notify_util_tester.o: ../../include/msg.h +bounce_notify_util_tester.o: ../../include/mymalloc.h +bounce_notify_util_tester.o: ../../include/nvtable.h +bounce_notify_util_tester.o: ../../include/rcpt_buf.h +bounce_notify_util_tester.o: ../../include/rec_type.h +bounce_notify_util_tester.o: ../../include/recipient_list.h +bounce_notify_util_tester.o: ../../include/record.h +bounce_notify_util_tester.o: ../../include/sys_defs.h +bounce_notify_util_tester.o: ../../include/test_main.h +bounce_notify_util_tester.o: ../../include/vbuf.h +bounce_notify_util_tester.o: ../../include/vstream.h +bounce_notify_util_tester.o: ../../include/vstring.h +bounce_notify_util_tester.o: bounce_notify_util_tester.c +bounce_notify_util_tester.o: bounce_service.h +bounce_notify_util_tester.o: bounce_template.h bounce_notify_verp.o: ../../include/attr.h bounce_notify_verp.o: ../../include/bounce.h bounce_notify_verp.o: ../../include/bounce_log.h @@ -320,7 +582,11 @@ bounce_one_service.o: bounce_one_service.c bounce_one_service.o: bounce_service.h bounce_one_service.o: bounce_template.h bounce_template.o: ../../include/attr.h +bounce_template.o: ../../include/bounce_log.h bounce_template.o: ../../include/check_arg.h +bounce_template.o: ../../include/dsn.h +bounce_template.o: ../../include/dsn_buf.h +bounce_template.o: ../../include/hfrom_format.h bounce_template.o: ../../include/htable.h bounce_template.o: ../../include/iostuff.h bounce_template.o: ../../include/is_header.h @@ -333,12 +599,15 @@ bounce_template.o: ../../include/midna_domain.h bounce_template.o: ../../include/msg.h bounce_template.o: ../../include/mymalloc.h bounce_template.o: ../../include/nvtable.h +bounce_template.o: ../../include/rcpt_buf.h +bounce_template.o: ../../include/recipient_list.h bounce_template.o: ../../include/split_at.h bounce_template.o: ../../include/stringops.h bounce_template.o: ../../include/sys_defs.h bounce_template.o: ../../include/vbuf.h bounce_template.o: ../../include/vstream.h bounce_template.o: ../../include/vstring.h +bounce_template.o: bounce_service.h bounce_template.o: bounce_template.c bounce_template.o: bounce_template.h bounce_templates.o: ../../include/attr.h diff --git a/external/ibm-public/postfix/dist/src/bounce/bounce_notify_util_tester.c b/external/ibm-public/postfix/dist/src/bounce/bounce_notify_util_tester.c new file mode 100644 index 00000000000..6743716ed8e --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/bounce_notify_util_tester.c @@ -0,0 +1,169 @@ +/* $NetBSD: bounce_notify_util_tester.c,v 1.1.1.1 2022/10/08 16:09:06 christos Exp $ */ + + /* + * System library. + */ +#include <sys_defs.h> +#include <stdlib.h> +#include <sys/stat.h> + + /* + * Utility library. + */ +#include <msg.h> +#include <vstream.h> +#include <vstring.h> + + /* + * Global library. + */ +#include <dsn_mask.h> +#include <mail_params.h> +#include <record.h> +#include <rec_type.h> +#include <hfrom_format.h> + + /* + * Bounce service. + */ +#include <bounce_service.h> +#include <bounce_template.h> + + /* + * Testing library. + */ +#include <test_main.h> + +#define TEST_ENCODING "7bit" +#define NO_SMTPUTF8 (0) +#define TEST_DSN_ENVID "TEST-ENVID" +#define TEST_RECIPIENT "test-recipient" + +#define STR(x) vstring_str(x) +#define LEN(x) VSTRING_LEN(x) + +/* test_driver - test driver */ + +static void test_driver(int argc, char **argv) +{ + BOUNCE_TEMPLATES *bounce_templates; + BOUNCE_INFO *bounce_info; + VSTRING *message_buf; + VSTREAM *message_stream; + VSTRING *rec_buf; + int rec_type; + + /* + * Sanity checks. + */ + if (argc != 4) + msg_fatal("usage: %s [options] service queue_name queue_id", argv[0]); + + if (chdir(var_queue_dir) < 0) + msg_fatal("chdir %s: %m", var_queue_dir); + + bounce_hfrom_format = + hfrom_format_parse(VAR_HFROM_FORMAT, var_hfrom_format); + + /* + * Write one message to VSTRING. + */ + message_buf = vstring_alloc(100); + if ((message_stream = vstream_memopen(message_buf, O_WRONLY)) == 0) + msg_fatal("vstream_memopen O_WRONLY: %m"); + bounce_templates = bounce_templates_create(); + bounce_info = bounce_mail_init(argv[1], argv[2], argv[3], + TEST_ENCODING, NO_SMTPUTF8, TEST_DSN_ENVID, + bounce_templates->failure); + if (bounce_header(message_stream, bounce_info, TEST_RECIPIENT, + NO_POSTMASTER_COPY) < 0) + msg_fatal("bounce_header: %m"); + if (bounce_diagnostic_log(message_stream, bounce_info, + DSN_NOTIFY_OVERRIDE) <= 0) + msg_fatal("bounce_diagnostic_log: %m"); + if (bounce_header_dsn(message_stream, bounce_info) != 0) + msg_fatal("bounce_header_dsn: %m"); + if (bounce_diagnostic_dsn(message_stream, bounce_info, + DSN_NOTIFY_OVERRIDE) <= 0) + msg_fatal("bounce_diagnostic_dsn: %m"); + bounce_original(message_stream, bounce_info, DSN_RET_FULL); + if (vstream_fclose(message_stream) != 0) + msg_fatal("vstream_fclose: %m"); + bounce_mail_free(bounce_info); + + /* + * Render the bounce message in human-readable form. + */ + if ((message_stream = vstream_memopen(message_buf, O_RDONLY)) == 0) + msg_fatal("vstream_memopen O_RDONLY: %m"); + rec_buf = vstring_alloc(100); + while ((rec_type = rec_get(message_stream, rec_buf, 0)) > 0) { + switch (rec_type) { + case REC_TYPE_CONT: + vstream_printf("%.*s", (int) LEN(rec_buf), STR(rec_buf)); + break; + case REC_TYPE_NORM: + vstream_printf("%.*s\n", (int) LEN(rec_buf), STR(rec_buf)); + break; + default: + msg_panic("unexpected message record type %d", rec_type); + } + vstream_fflush(VSTREAM_OUT); + } + if (vstream_fclose(message_stream) != 0) + msg_fatal("vstream_fclose: %m"); + vstring_free(rec_buf); + + /* + * Clean up. + */ + exit(0); +} + +int var_bounce_limit; +int var_max_queue_time; +int var_delay_warn_time; +char *var_notify_classes; +char *var_bounce_rcpt; +char *var_2bounce_rcpt; +char *var_delay_rcpt; +char *var_bounce_tmpl; +bool var_threaded_bounce; +char *var_hfrom_format; /* header_from_format */ + +int bounce_hfrom_format; + +int main(int argc, char **argv) +{ + static const CONFIG_INT_TABLE int_table[] = { + VAR_BOUNCE_LIMIT, DEF_BOUNCE_LIMIT, &var_bounce_limit, 1, 0, + 0, + }; + static const CONFIG_TIME_TABLE time_table[] = { + VAR_MAX_QUEUE_TIME, DEF_MAX_QUEUE_TIME, &var_max_queue_time, 0, 8640000, + VAR_DELAY_WARN_TIME, DEF_DELAY_WARN_TIME, &var_delay_warn_time, 0, 0, + 0, + }; + static const CONFIG_STR_TABLE str_table[] = { + VAR_NOTIFY_CLASSES, DEF_NOTIFY_CLASSES, &var_notify_classes, 0, 0, + VAR_BOUNCE_RCPT, DEF_BOUNCE_RCPT, &var_bounce_rcpt, 1, 0, + VAR_2BOUNCE_RCPT, DEF_2BOUNCE_RCPT, &var_2bounce_rcpt, 1, 0, + VAR_DELAY_RCPT, DEF_DELAY_RCPT, &var_delay_rcpt, 1, 0, + VAR_BOUNCE_TMPL, DEF_BOUNCE_TMPL, &var_bounce_tmpl, 0, 0, + VAR_HFROM_FORMAT, DEF_HFROM_FORMAT, &var_hfrom_format, 1, 0, + 0, + }; + static const CONFIG_NBOOL_TABLE nbool_table[] = { + VAR_THREADED_BOUNCE, DEF_THREADED_BOUNCE, &var_threaded_bounce, + 0, + }; + + test_main(argc, argv, test_driver, + CA_TEST_MAIN_INT_TABLE(int_table), + CA_TEST_MAIN_STR_TABLE(str_table), + CA_TEST_MAIN_TIME_TABLE(time_table), + CA_TEST_MAIN_NBOOL_TABLE(nbool_table), + 0); + + exit(0); +} diff --git a/external/ibm-public/postfix/dist/src/bounce/logfile-no-msgid-no-eoh-event b/external/ibm-public/postfix/dist/src/bounce/logfile-no-msgid-no-eoh-event new file mode 100644 index 00000000000..50233c81795 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/logfile-no-msgid-no-eoh-event @@ -0,0 +1,13 @@ + +recipient = rcpt-address +original_recipient = rcpt-orig_addr +offset = 272 +notify_flags = rcpt-dsn_notify +status = dsn-status +action = dsn-action +diag_type = dsn-dtype +diag_text = dsn-dtext +mta_type = dsn-mtype +mta_mname = dsn-mname +reason = dsn-reason + diff --git a/external/ibm-public/postfix/dist/src/bounce/logfile-no-msgid-with-eoh-event b/external/ibm-public/postfix/dist/src/bounce/logfile-no-msgid-with-eoh-event new file mode 100644 index 00000000000..00473a8e2ec --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/logfile-no-msgid-with-eoh-event @@ -0,0 +1,13 @@ + +recipient = rcpt-address +original_recipient = rcpt-orig_addr +offset = 271 +notify_flags = rcpt-dsn_notify +status = dsn-status +action = dsn-action +diag_type = dsn-dtype +diag_text = dsn-dtext +mta_type = dsn-mtype +mta_mname = dsn-mname +reason = dsn-reason + diff --git a/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-no-eoh-event b/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-no-eoh-event new file mode 100644 index 00000000000..00473a8e2ec --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-no-eoh-event @@ -0,0 +1,13 @@ + +recipient = rcpt-address +original_recipient = rcpt-orig_addr +offset = 271 +notify_flags = rcpt-dsn_notify +status = dsn-status +action = dsn-action +diag_type = dsn-dtype +diag_text = dsn-dtext +mta_type = dsn-mtype +mta_mname = dsn-mname +reason = dsn-reason + diff --git a/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-eoh-event b/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-eoh-event new file mode 100644 index 00000000000..00473a8e2ec --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-eoh-event @@ -0,0 +1,13 @@ + +recipient = rcpt-address +original_recipient = rcpt-orig_addr +offset = 271 +notify_flags = rcpt-dsn_notify +status = dsn-status +action = dsn-action +diag_type = dsn-dtype +diag_text = dsn-dtext +mta_type = dsn-mtype +mta_mname = dsn-mname +reason = dsn-reason + diff --git a/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-filter b/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-filter new file mode 100644 index 00000000000..4d562166204 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-filter @@ -0,0 +1,13 @@ + +recipient = rcpt-address +original_recipient = rcpt-orig_addr +offset = 291 +notify_flags = rcpt-dsn_notify +status = dsn-status +action = dsn-action +diag_type = dsn-dtype +diag_text = dsn-dtext +mta_type = dsn-mtype +mta_mname = dsn-mname +reason = dsn-reason + diff --git a/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-long-line b/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-long-line new file mode 100644 index 00000000000..00473a8e2ec --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-long-line @@ -0,0 +1,13 @@ + +recipient = rcpt-address +original_recipient = rcpt-orig_addr +offset = 271 +notify_flags = rcpt-dsn_notify +status = dsn-status +action = dsn-action +diag_type = dsn-dtype +diag_text = dsn-dtext +mta_type = dsn-mtype +mta_mname = dsn-mname +reason = dsn-reason + diff --git a/external/ibm-public/postfix/dist/src/bounce/msgfile-no-msgid-no-eoh-event b/external/ibm-public/postfix/dist/src/bounce/msgfile-no-msgid-no-eoh-event Binary files differnew file mode 100755 index 00000000000..694f5dbbf3a --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/msgfile-no-msgid-no-eoh-event diff --git a/external/ibm-public/postfix/dist/src/bounce/msgfile-no-msgid-with-eoh-event b/external/ibm-public/postfix/dist/src/bounce/msgfile-no-msgid-with-eoh-event Binary files differnew file mode 100755 index 00000000000..b3b795e8646 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/msgfile-no-msgid-with-eoh-event diff --git a/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-no-eoh-event b/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-no-eoh-event Binary files differnew file mode 100755 index 00000000000..cc16c666f15 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-no-eoh-event diff --git a/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-eoh-event b/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-eoh-event Binary files differnew file mode 100755 index 00000000000..ffe30c46f83 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-eoh-event diff --git a/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-filter b/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-filter Binary files differnew file mode 100755 index 00000000000..d6e77c4a74e --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-filter diff --git a/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-long-line b/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-long-line Binary files differnew file mode 100755 index 00000000000..69d2801c093 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-long-line diff --git a/external/ibm-public/postfix/dist/src/bounce/no-msgid-no-eoh-event-no-thread.ref b/external/ibm-public/postfix/dist/src/bounce/no-msgid-no-eoh-event-no-thread.ref new file mode 100644 index 00000000000..630734d2ec7 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/no-msgid-no-eoh-event-no-thread.ref @@ -0,0 +1,47 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 19:04:29 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CklpP1JjKz4w4Z; Mon, 30 Nov 2020 00:04:29 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Subject: no-msgid-no-eoh-event + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/no-msgid-no-eoh-event-with-thread.ref b/external/ibm-public/postfix/dist/src/bounce/no-msgid-no-eoh-event-with-thread.ref new file mode 100644 index 00000000000..630734d2ec7 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/no-msgid-no-eoh-event-with-thread.ref @@ -0,0 +1,47 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 19:04:29 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CklpP1JjKz4w4Z; Mon, 30 Nov 2020 00:04:29 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Subject: no-msgid-no-eoh-event + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/no-msgid-with-eoh-event-no-thread.ref b/external/ibm-public/postfix/dist/src/bounce/no-msgid-with-eoh-event-no-thread.ref new file mode 100644 index 00000000000..39b5841d295 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/no-msgid-with-eoh-event-no-thread.ref @@ -0,0 +1,49 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 19:11:52 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4Cklyw0HDKz4w4Z; Mon, 30 Nov 2020 00:11:52 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Subject: no-msgid-with-eoh-event + +body text + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/no-msgid-with-eoh-event-with-thread.ref b/external/ibm-public/postfix/dist/src/bounce/no-msgid-with-eoh-event-with-thread.ref new file mode 100644 index 00000000000..39b5841d295 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/no-msgid-with-eoh-event-with-thread.ref @@ -0,0 +1,49 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 19:11:52 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4Cklyw0HDKz4w4Z; Mon, 30 Nov 2020 00:11:52 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Subject: no-msgid-with-eoh-event + +body text + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/obs_template_test.ref b/external/ibm-public/postfix/dist/src/bounce/obs_template_test.ref new file mode 100644 index 00000000000..e03bb5b8b46 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/obs_template_test.ref @@ -0,0 +1,68 @@ +failure_template = <<EOF +Charset: us-ascii +From: MAILER-DAEMON (Mail Delivery System) +Subject: Undelivered Mail Returned to Sender +Postmaster-Subject: Postmaster Copy: Undelivered Mail + +This is the mail system at host $myhostname. + +I'm sorry to have to inform you that your message could not +be delivered to one or more recipients. It's attached below. + +For further assistance, please send mail to postmaster. + +If you do so, please include this problem report. You can +delete your own text from the attached returned message. + + The mail system +EOF + +delay_template = <<EOF +Charset: us-ascii +From: MAILER-DAEMON (Mail Delivery System) +Subject: Delayed Mail (still being retried) +Postmaster-Subject: Postmaster Warning: Delayed Mail + +This is the mail system at host $myhostname. + +#################################################################### +# THIS IS A WARNING ONLY. YOU DO NOT NEED TO RESEND YOUR MESSAGE. # +#################################################################### + +Your message could not be delivered for more than $delay_warning_time_hours hour(s). +It will be retried until it is $maximal_queue_lifetime_days day(s) old. + +For further assistance, please send mail to postmaster. + +If you do so, please include this problem report. You can +delete your own text from the attached returned message. + + The mail system +EOF + +success_template = <<EOF +Charset: us-ascii +From: MAILER-DAEMON (Mail Delivery System) +Subject: Successful Mail Delivery Report + +This is the mail system at host $myhostname. + +Your message was successfully delivered to the destination(s) +listed below. If the message was delivered to mailbox you will +receive no further notifications. Otherwise you may still receive +notifications of mail delivery errors from other systems. + + The mail system +EOF + +verify_template = <<EOF +Charset: us-ascii +From: MAILER-DAEMON (Mail Delivery System) +Subject: Mail Delivery Status Report + +This is the mail system at host $myhostname. + +Enclosed is the mail delivery report that you requested. + + The mail system +EOF diff --git a/external/ibm-public/postfix/dist/src/bounce/template_test.ref b/external/ibm-public/postfix/dist/src/bounce/template_test.ref index e03bb5b8b46..381c14dcad6 100644 --- a/external/ibm-public/postfix/dist/src/bounce/template_test.ref +++ b/external/ibm-public/postfix/dist/src/bounce/template_test.ref @@ -1,6 +1,6 @@ failure_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Undelivered Mail Returned to Sender Postmaster-Subject: Postmaster Copy: Undelivered Mail @@ -19,7 +19,7 @@ EOF delay_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Delayed Mail (still being retried) Postmaster-Subject: Postmaster Warning: Delayed Mail @@ -42,7 +42,7 @@ EOF success_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Successful Mail Delivery Report This is the mail system at host $myhostname. @@ -57,7 +57,7 @@ EOF verify_template = <<EOF Charset: us-ascii -From: MAILER-DAEMON (Mail Delivery System) +From: Mail Delivery System <MAILER-DAEMON> Subject: Mail Delivery Status Report This is the mail system at host $myhostname. diff --git a/external/ibm-public/postfix/dist/src/bounce/with-msgid-no-eoh-event-no-thread.ref b/external/ibm-public/postfix/dist/src/bounce/with-msgid-no-eoh-event-no-thread.ref new file mode 100644 index 00000000000..020d9a4c1d2 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/with-msgid-no-eoh-event-no-thread.ref @@ -0,0 +1,49 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 10:30:41 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CkXPY0myNz4w4g; Sun, 29 Nov 2020 15:30:41 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Message-Id: <12345@mta-name.example> +Subject: with-msgid-no-eoh-event +Date: Sun, 29 Nov 2020 15:30:41 +0000 (UTC) + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/with-msgid-no-eoh-event-with-thread.ref b/external/ibm-public/postfix/dist/src/bounce/with-msgid-no-eoh-event-with-thread.ref new file mode 100644 index 00000000000..d2aadd08883 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/with-msgid-no-eoh-event-with-thread.ref @@ -0,0 +1,51 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +References: <12345@mta-name.example> +In-Reply-To: <12345@mta-name.example> +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 10:30:41 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CkXPY0myNz4w4g; Sun, 29 Nov 2020 15:30:41 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Message-Id: <12345@mta-name.example> +Subject: with-msgid-no-eoh-event +Date: Sun, 29 Nov 2020 15:30:41 +0000 (UTC) + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-eoh-event-no-thread.ref b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-eoh-event-no-thread.ref new file mode 100644 index 00000000000..70afb5f333a --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-eoh-event-no-thread.ref @@ -0,0 +1,51 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 10:30:41 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CkXPY10M8z4w4l; Sun, 29 Nov 2020 15:30:41 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Message-Id: <12345@mta-name.example> +Subject: with-msgid-with-eoh-event +Date: Sun, 29 Nov 2020 15:30:41 +0000 (UTC) + +body text + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-eoh-event-with-thread.ref b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-eoh-event-with-thread.ref new file mode 100644 index 00000000000..e46afbe9fe7 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-eoh-event-with-thread.ref @@ -0,0 +1,53 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +References: <12345@mta-name.example> +In-Reply-To: <12345@mta-name.example> +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 10:30:41 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CkXPY10M8z4w4l; Sun, 29 Nov 2020 15:30:41 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Message-Id: <12345@mta-name.example> +Subject: with-msgid-with-eoh-event +Date: Sun, 29 Nov 2020 15:30:41 +0000 (UTC) + +body text + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-filter-no-thread.ref b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-filter-no-thread.ref new file mode 100644 index 00000000000..fa30ddfdb99 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-filter-no-thread.ref @@ -0,0 +1,48 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sat, 5 Dec 2020 13:31:48 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CpJ7m6tprz4w4Y; Sat, 5 Dec 2020 18:31:48 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Message-Id: <12345@mta-name.example> +Subject: with-msgid-no-eoh-event + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-filter-with-thread.ref b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-filter-with-thread.ref new file mode 100644 index 00000000000..14d33730d0b --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-filter-with-thread.ref @@ -0,0 +1,50 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +References: <12345@mta-name.example> +In-Reply-To: <12345@mta-name.example> +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sat, 5 Dec 2020 13:31:48 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CpJ7m6tprz4w4Y; Sat, 5 Dec 2020 18:31:48 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Message-Id: <12345@mta-name.example> +Subject: with-msgid-no-eoh-event + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-long-line-no-thread.ref b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-long-line-no-thread.ref new file mode 100644 index 00000000000..fa5268bb8ba --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-long-line-no-thread.ref @@ -0,0 +1,50 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 10:30:41 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CkXPY194lz4w4n; Sun, 29 Nov 2020 15:30:41 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Whatever: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +Message-Id: <12345@mta-name.example> +Subject: with-msgid-with-long-line +Date: Sun, 29 Nov 2020 15:30:41 +0000 (UTC) + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-long-line-with-thread.ref b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-long-line-with-thread.ref new file mode 100644 index 00000000000..04e96d68cc0 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/bounce/with-msgid-with-long-line-with-thread.ref @@ -0,0 +1,52 @@ +From: Mail Delivery System <MAILER-DAEMON> +Subject: Undelivered Mail Returned to Sender +To: test-recipient +References: <12345@mta-name.example> +In-Reply-To: <12345@mta-name.example> +Auto-Submitted: auto-replied +MIME-Version: 1.0 +Content-Type: multipart/report; report-type=delivery-status; + boundary="msgid.unix-time/mail.example" +Content-Transfer-Encoding: 7bit + +This is a MIME-encapsulated message. + +--msgid.unix-time/mail.example +Content-Description: Notification +Content-Type: text/plain; charset=us-ascii + + +<rcpt-address> (expanded from <rcpt-orig_addr>): dsn-reason + +--msgid.unix-time/mail.example +Content-Description: Delivery report +Content-Type: message/delivery-status + +Reporting-MTA: dns; mail.example +Original-Envelope-Id: TEST-ENVID +X-Postfix-Queue-ID: msgid +X-Postfix-Sender: rfc822; sender@sender.example +Arrival-Date: Sun, 29 Nov 2020 10:30:41 -0500 (EST) + +Final-Recipient: rfc822; rcpt-address +Original-Recipient: rfc822; rcpt-orig_addr +Action: failed +Status: dsn-status +Remote-MTA: dsn-mtype; dsn-mname +Diagnostic-Code: dsn-dtype; dsn-dtext + +--msgid.unix-time/mail.example +Content-Description: Undelivered Message +Content-Type: message/rfc822 + +Return-Path: <sender@sender.example> +Received: by wzv.porcupine.org (Postfix, from userid 0) + id 4CkXPY194lz4w4n; Sun, 29 Nov 2020 15:30:41 +0000 (UTC) +From: <sender@sender.example> +To: <recipient@recipient.example> +Whatever: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +Message-Id: <12345@mta-name.example> +Subject: with-msgid-with-long-line +Date: Sun, 29 Nov 2020 15:30:41 +0000 (UTC) + +--msgid.unix-time/mail.example-- diff --git a/external/ibm-public/postfix/dist/src/cleanup/Makefile.in b/external/ibm-public/postfix/dist/src/cleanup/Makefile.in index 546aae1c948..8a3c18c956c 100644 --- a/external/ibm-public/postfix/dist/src/cleanup/Makefile.in +++ b/external/ibm-public/postfix/dist/src/cleanup/Makefile.in @@ -86,23 +86,25 @@ milter_tests: cleanup_milter_test bug_tests \ cleanup_milter_test15a cleanup_milter_test15b cleanup_milter_test15c \ cleanup_milter_test15d cleanup_milter_test15e cleanup_milter_test15f \ cleanup_milter_test15g cleanup_milter_test15h cleanup_milter_test15i \ - cleanup_milter_test16a cleanup_milter_test16b + cleanup_milter_test16a cleanup_milter_test16b cleanup_milter_test17a \ + cleanup_milter_test17b cleanup_milter_test17c cleanup_milter_test17d \ + cleanup_milter_test17e cleanup_milter_test17f cleanup_milter_test17g root_tests: cleanup_masquerade_test: cleanup_masquerade cleanup_masq.ref rm -f cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade '' a.b.c,b.c xxx@aa.a.b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade '' A.B.C,B.C xxx@aa.a.b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade '' a.b.c,b.c xxx@AA.A.B.C >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade 'xxx' a.b.c,b.c xxx@aa.a.b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade 'yyy' a.b.c,b.c xxx@aa.a.b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade '' !a.b.c,b.c xxx@aa.a.b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade '' a.b.c,b.c xxx@a.b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade '' !a.b.c,b.c xxx@a.b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade '' a.b.c,b.c xxx@aaa.b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade '' a.b.c,b.c xxx@b.c >>cleanup_masq.tmp - $(SHLIB_ENV) ./cleanup_masquerade 'fail:whatever' xy xxx@b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade '' a.b.c,b.c xxx@aa.a.b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade '' A.B.C,B.C xxx@aa.a.b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade '' a.b.c,b.c xxx@AA.A.B.C >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade 'xxx' a.b.c,b.c xxx@aa.a.b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade 'yyy' a.b.c,b.c xxx@aa.a.b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade '' !a.b.c,b.c xxx@aa.a.b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade '' a.b.c,b.c xxx@a.b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade '' !a.b.c,b.c xxx@a.b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade '' a.b.c,b.c xxx@aaa.b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade '' a.b.c,b.c xxx@b.c >>cleanup_masq.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_masquerade 'fail:whatever' xy xxx@b.c >>cleanup_masq.tmp diff cleanup_masq.ref cleanup_masq.tmp rm -f cleanup_masq.tmp @@ -115,10 +117,10 @@ bug1_test: cleanup_milter bug1.file bug1.in bug1.ref bug1.text.ref \ ../postcat/postcat cp bug1.file bug1.file.tmp chmod u+w bug1.file.tmp - $(SHLIB_ENV) ./cleanup_milter <bug1.in - $(SHLIB_ENV) ../postcat/postcat -ov bug1.file.tmp 2>/dev/null >bug1.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <bug1.in + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov bug1.file.tmp 2>/dev/null >bug1.tmp diff bug1.ref bug1.tmp - $(SHLIB_ENV) ../postcat/postcat bug1.file.tmp 2>/dev/null >bug1.tmp + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat bug1.file.tmp 2>/dev/null >bug1.tmp diff bug1.text.ref bug1.tmp rm -f bug1.file.tmp bug1.tmp @@ -126,10 +128,10 @@ bug2_test: cleanup_milter bug2.file bug2.in bug2.ref bug2.text.ref \ ../postcat/postcat cp bug2.file bug2.file.tmp chmod u+w bug2.file.tmp - $(SHLIB_ENV) ./cleanup_milter <bug2.in - $(SHLIB_ENV) ../postcat/postcat -ov bug2.file.tmp 2>/dev/null >bug2.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <bug2.in + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov bug2.file.tmp 2>/dev/null >bug2.tmp diff bug2.ref bug2.tmp - $(SHLIB_ENV) ../postcat/postcat bug2.file.tmp 2>/dev/null >bug2.tmp + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat bug2.file.tmp 2>/dev/null >bug2.tmp diff bug2.text.ref bug2.tmp rm -f bug2.file.tmp bug2.tmp @@ -137,10 +139,10 @@ bug3_test: cleanup_milter bug3.file bug3.in bug3.ref bug3.text.ref \ ../postcat/postcat cp bug3.file bug3.file.tmp chmod u+w bug3.file.tmp - $(SHLIB_ENV) ./cleanup_milter <bug3.in - $(SHLIB_ENV) ../postcat/postcat -ov bug3.file.tmp 2>/dev/null >bug3.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <bug3.in + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov bug3.file.tmp 2>/dev/null >bug3.tmp diff bug3.ref bug3.tmp - $(SHLIB_ENV) ../postcat/postcat bug3.file.tmp 2>/dev/null >bug3.tmp + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat bug3.file.tmp 2>/dev/null >bug3.tmp diff bug3.text.ref bug3.tmp rm -f bug3.file.tmp bug3.tmp @@ -150,8 +152,8 @@ cleanup_milter_test: cleanup_milter test-queue-file cleanup_milter.in1 \ cleanup_milter.ref1 ../postcat/postcat cp test-queue-file test-queue-file.tmp chmod u+w test-queue-file.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in1 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref1 cleanup_milter.tmp rm -f test-queue-file.tmp cleanup_milter.tmp @@ -159,8 +161,8 @@ cleanup_milter_test2: cleanup_milter test-queue-file2 cleanup_milter.in2 \ cleanup_milter.ref2 ../postcat/postcat cp test-queue-file2 test-queue-file2.tmp chmod u+w test-queue-file2.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in2 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file2.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file2.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref2 cleanup_milter.tmp rm -f test-queue-file2.tmp cleanup_milter.tmp @@ -168,8 +170,8 @@ cleanup_milter_test3: cleanup_milter test-queue-file3 cleanup_milter.in3 \ cleanup_milter.ref3 ../postcat/postcat cp test-queue-file3 test-queue-file3.tmp chmod u+w test-queue-file3.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in3 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file3.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in3 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file3.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref3 cleanup_milter.tmp rm -f test-queue-file3.tmp cleanup_milter.tmp @@ -178,18 +180,18 @@ cleanup_milter_test4: cleanup_milter test-queue-file4 cleanup_milter.in4a \ test-queue-file4 ../postcat/postcat cp test-queue-file4 test-queue-file4.tmp chmod u+w test-queue-file4.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in4a - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file4.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in4a + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file4.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref4 cleanup_milter.tmp cp test-queue-file4 test-queue-file4.tmp chmod u+w test-queue-file4.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in4b - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file4.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in4b + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file4.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref4 cleanup_milter.tmp cp test-queue-file4 test-queue-file4.tmp chmod u+w test-queue-file4.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in4c - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file4.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in4c + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file4.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref4 cleanup_milter.tmp rm -f test-queue-file4.tmp cleanup_milter.tmp @@ -197,8 +199,8 @@ cleanup_milter_test5: cleanup_milter test-queue-file5 cleanup_milter.in5 \ cleanup_milter.ref5 ../postcat/postcat cp test-queue-file5 test-queue-file5.tmp chmod u+w test-queue-file5.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in5 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file5.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in5 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file5.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref5 cleanup_milter.tmp rm -f test-queue-file5.tmp cleanup_milter.tmp @@ -209,8 +211,8 @@ cleanup_milter_test6a: cleanup_milter test-queue-file6 cleanup_milter.in6a \ cleanup_milter.ref6a test-queue-file6 ../postcat/postcat cp test-queue-file6 test-queue-file6.tmp chmod u+w test-queue-file6.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in6a - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file6.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in6a + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file6.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref6a cleanup_milter.tmp rm -f test-queue-file6.tmp cleanup_milter.tmp @@ -218,8 +220,8 @@ cleanup_milter_test6b: cleanup_milter test-queue-file6 cleanup_milter.in6b \ cleanup_milter.ref6b ../postcat/postcat cp test-queue-file6 test-queue-file6.tmp chmod u+w test-queue-file6.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in6b - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file6.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in6b + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file6.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref6b cleanup_milter.tmp rm -f test-queue-file6.tmp cleanup_milter.tmp @@ -227,8 +229,8 @@ cleanup_milter_test6c: cleanup_milter test-queue-file6 cleanup_milter.in6c \ cleanup_milter.ref6c ../postcat/postcat cp test-queue-file6 test-queue-file6.tmp chmod u+w test-queue-file6.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in6c - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file6.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in6c + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file6.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref6c cleanup_milter.tmp rm -f test-queue-file6.tmp cleanup_milter.tmp @@ -236,8 +238,8 @@ cleanup_milter_test7: cleanup_milter test-queue-file7 cleanup_milter.in7 \ cleanup_milter.ref7 ../postcat/postcat cp test-queue-file7 test-queue-file7.tmp chmod u+w test-queue-file7.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in7 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file7.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in7 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file7.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref7 cleanup_milter.tmp rm -f test-queue-file7.tmp cleanup_milter.tmp @@ -245,8 +247,8 @@ cleanup_milter_test8: cleanup_milter test-queue-file8 cleanup_milter.in8 \ cleanup_milter.ref8 ../postcat/postcat cp test-queue-file8 test-queue-file8.tmp chmod u+w test-queue-file8.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in8 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file8.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in8 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file8.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref8 cleanup_milter.tmp rm -f test-queue-file8.tmp cleanup_milter.tmp @@ -254,8 +256,8 @@ cleanup_milter_test9: cleanup_milter test-queue-file9 cleanup_milter.in9 \ cleanup_milter.ref9 ../postcat/postcat cp test-queue-file9 test-queue-file9.tmp chmod u+w test-queue-file9.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in9 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file9.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in9 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file9.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref9 cleanup_milter.tmp rm -f test-queue-file9.tmp cleanup_milter.tmp @@ -263,8 +265,8 @@ cleanup_milter_test10a: cleanup_milter test-queue-file10 cleanup_milter.in10a \ cleanup_milter.ref10a ../postcat/postcat cp test-queue-file10 test-queue-file10.tmp chmod u+w test-queue-file10.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in10a - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in10a + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref10a cleanup_milter.tmp rm -f test-queue-file10.tmp cleanup_milter.tmp @@ -272,8 +274,8 @@ cleanup_milter_test10b: cleanup_milter test-queue-file10 cleanup_milter.in10b \ cleanup_milter.ref10b ../postcat/postcat cp test-queue-file10 test-queue-file10.tmp chmod u+w test-queue-file10.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in10b - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in10b + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref10b cleanup_milter.tmp rm -f test-queue-file10.tmp cleanup_milter.tmp @@ -281,8 +283,8 @@ cleanup_milter_test10c: cleanup_milter test-queue-file10 cleanup_milter.in10c \ cleanup_milter.ref10c ../postcat/postcat cp test-queue-file10 test-queue-file10.tmp chmod u+w test-queue-file10.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in10c - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in10c + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref10c cleanup_milter.tmp rm -f test-queue-file10.tmp cleanup_milter.tmp @@ -290,8 +292,8 @@ cleanup_milter_test10d: cleanup_milter test-queue-file10 cleanup_milter.in10c \ cleanup_milter.ref10d ../postcat/postcat cp test-queue-file10 test-queue-file10.tmp chmod u+w test-queue-file10.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in10d - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in10d + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref10d cleanup_milter.tmp rm -f test-queue-file10.tmp cleanup_milter.tmp @@ -299,8 +301,8 @@ cleanup_milter_test10e: cleanup_milter test-queue-file10 cleanup_milter.in10c \ cleanup_milter.ref10e ../postcat/postcat cp test-queue-file10 test-queue-file10.tmp chmod u+w test-queue-file10.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in10e - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in10e + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file10.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref10e cleanup_milter.tmp rm -f test-queue-file10.tmp cleanup_milter.tmp @@ -308,8 +310,8 @@ cleanup_milter_test11: cleanup_milter test-queue-file11 cleanup_milter.in11 \ cleanup_milter.ref11 ../postcat/postcat cp test-queue-file11 test-queue-file11.tmp chmod u+w test-queue-file11.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in11 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file11.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in11 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file11.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref11 cleanup_milter.tmp rm -f test-queue-file11.tmp cleanup_milter.tmp @@ -317,8 +319,8 @@ cleanup_milter_test12: cleanup_milter test-queue-file12 cleanup_milter.in12 \ cleanup_milter.ref12 ../postcat/postcat cp test-queue-file12 test-queue-file12.tmp chmod u+w test-queue-file12.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in12 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file12.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in12 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file12.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref12 cleanup_milter.tmp rm -f test-queue-file12.tmp cleanup_milter.tmp @@ -326,8 +328,8 @@ cleanup_milter_test13a: cleanup_milter test-queue-file13a cleanup_milter.in13a \ cleanup_milter.ref13a ../postcat/postcat cp test-queue-file13a test-queue-file13a.tmp chmod u+w test-queue-file13a.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13a - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13a.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13a + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13a.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13a cleanup_milter.tmp rm -f test-queue-file13a.tmp cleanup_milter.tmp @@ -335,8 +337,8 @@ cleanup_milter_test13b: cleanup_milter test-queue-file13b cleanup_milter.in13b \ cleanup_milter.ref13b ../postcat/postcat cp test-queue-file13b test-queue-file13b.tmp chmod u+w test-queue-file13b.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13b - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13b.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13b + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13b.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13b cleanup_milter.tmp rm -f test-queue-file13b.tmp cleanup_milter.tmp @@ -344,8 +346,8 @@ cleanup_milter_test13c: cleanup_milter test-queue-file13c cleanup_milter.in13c \ cleanup_milter.ref13c ../postcat/postcat cp test-queue-file13c test-queue-file13c.tmp chmod u+w test-queue-file13c.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13c - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13c.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13c + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13c.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13c cleanup_milter.tmp rm -f test-queue-file13c.tmp cleanup_milter.tmp @@ -353,8 +355,8 @@ cleanup_milter_test13d: cleanup_milter test-queue-file13d cleanup_milter.in13d \ cleanup_milter.ref13d ../postcat/postcat cp test-queue-file13d test-queue-file13d.tmp chmod u+w test-queue-file13d.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13d - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13d.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13d + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13d.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13d cleanup_milter.tmp rm -f test-queue-file13d.tmp cleanup_milter.tmp @@ -362,8 +364,8 @@ cleanup_milter_test13e: cleanup_milter test-queue-file13e cleanup_milter.in13e \ cleanup_milter.ref13e ../postcat/postcat cp test-queue-file13e test-queue-file13e.tmp chmod u+w test-queue-file13e.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13e - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13e.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13e + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13e.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13e cleanup_milter.tmp rm -f test-queue-file13e.tmp cleanup_milter.tmp @@ -371,8 +373,8 @@ cleanup_milter_test13g: cleanup_milter test-queue-file13g cleanup_milter.in13g \ cleanup_milter.ref13g ../postcat/postcat cp test-queue-file13g test-queue-file13g.tmp chmod u+w test-queue-file13g.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13g - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13g.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13g + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13g.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13g cleanup_milter.tmp rm -f test-queue-file13g.tmp cleanup_milter.tmp @@ -380,8 +382,8 @@ cleanup_milter_test13h: cleanup_milter test-queue-file13h cleanup_milter.in13h \ cleanup_milter.ref13h ../postcat/postcat cp test-queue-file13h test-queue-file13h.tmp chmod u+w test-queue-file13h.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13h - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13h.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13h + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13h.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13h cleanup_milter.tmp rm -f test-queue-file13h.tmp cleanup_milter.tmp @@ -389,8 +391,8 @@ cleanup_milter_test13i: cleanup_milter test-queue-file13i cleanup_milter.in13i \ cleanup_milter.ref13i ../postcat/postcat cp test-queue-file13i test-queue-file13i.tmp chmod u+w test-queue-file13i.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13i - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13i.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13i + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13i.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13i cleanup_milter.tmp rm -f test-queue-file13i.tmp cleanup_milter.tmp @@ -398,8 +400,8 @@ cleanup_milter_test13f: cleanup_milter test-queue-file13f cleanup_milter.in13f \ cleanup_milter.ref13f ../postcat/postcat cp test-queue-file13f test-queue-file13f.tmp chmod u+w test-queue-file13f.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13f - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13f.tmp 2>/dev/null >cleanup_milter.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in13f + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file13f.tmp 2>/dev/null >cleanup_milter.tmp diff cleanup_milter.ref13f cleanup_milter.tmp rm -f test-queue-file13f.tmp cleanup_milter.tmp @@ -408,9 +410,9 @@ cleanup_milter_test14a: cleanup_milter test-queue-file14 cleanup_milter.in14a \ cleanup_milter.reg14a cp test-queue-file14 test-queue-file14a.tmp chmod u+w test-queue-file14a.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14a 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in14a 2>cleanup_milter.tmp1 diff cleanup_milter.ref14a1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file14a.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file14a.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref14a2 cleanup_milter.tmp2 rm -f test-queue-file14a.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -419,9 +421,9 @@ cleanup_milter_test14b: cleanup_milter test-queue-file14 cleanup_milter.in14b \ cleanup_milter.reg14b cp test-queue-file14 test-queue-file14b.tmp chmod u+w test-queue-file14b.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14b 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in14b 2>cleanup_milter.tmp1 diff cleanup_milter.ref14b1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file14b.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file14b.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref14b2 cleanup_milter.tmp2 rm -f test-queue-file14b.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -430,9 +432,9 @@ cleanup_milter_test14c: cleanup_milter test-queue-file14 cleanup_milter.in14c \ cleanup_milter.reg14c cp test-queue-file14 test-queue-file14c.tmp chmod u+w test-queue-file14c.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14c 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in14c 2>cleanup_milter.tmp1 diff cleanup_milter.ref14c1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file14c.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file14c.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref14c2 cleanup_milter.tmp2 rm -f test-queue-file14c.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -441,9 +443,9 @@ cleanup_milter_test14d: cleanup_milter test-queue-file14 cleanup_milter.in14d \ cleanup_milter.reg14d cp test-queue-file14 test-queue-file14d.tmp chmod u+w test-queue-file14d.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14d 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in14d 2>cleanup_milter.tmp1 diff cleanup_milter.ref14d1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file14d.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file14d.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref14d2 cleanup_milter.tmp2 rm -f test-queue-file14d.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -452,9 +454,9 @@ cleanup_milter_test14e: cleanup_milter test-queue-file14 cleanup_milter.in14e \ cleanup_milter.reg14e cp test-queue-file14 test-queue-file14e.tmp chmod u+w test-queue-file14e.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14e 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in14e 2>cleanup_milter.tmp1 diff cleanup_milter.ref14e1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file14e.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file14e.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref14e2 cleanup_milter.tmp2 rm -f test-queue-file14e.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -463,9 +465,9 @@ cleanup_milter_test14f: cleanup_milter test-queue-file14 cleanup_milter.in14f \ cleanup_milter.reg14f cp test-queue-file14 test-queue-file14f.tmp chmod u+w test-queue-file14f.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14f 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in14f 2>cleanup_milter.tmp1 diff cleanup_milter.ref14f1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file14f.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file14f.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref14f2 cleanup_milter.tmp2 rm -f test-queue-file14f.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -474,9 +476,9 @@ cleanup_milter_test14g: cleanup_milter test-queue-file14 cleanup_milter.in14g \ cleanup_milter.reg14g cp test-queue-file14 test-queue-file14g.tmp chmod u+w test-queue-file14g.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in14g 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in14g 2>cleanup_milter.tmp1 diff cleanup_milter.ref14g1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file14g.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file14g.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref14g2 cleanup_milter.tmp2 rm -f test-queue-file14g.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -485,9 +487,9 @@ cleanup_milter_test15a: cleanup_milter test-queue-file15 cleanup_milter.in15a \ cleanup_milter.reg15a cp test-queue-file15 test-queue-file15a.tmp chmod u+w test-queue-file15a.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15a 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15a 2>cleanup_milter.tmp1 diff cleanup_milter.ref15a1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15a.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15a.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15a2 cleanup_milter.tmp2 rm -f test-queue-file15a.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -496,9 +498,9 @@ cleanup_milter_test15b: cleanup_milter test-queue-file15 cleanup_milter.in15b \ cleanup_milter.reg15b cp test-queue-file15 test-queue-file15b.tmp chmod u+w test-queue-file15b.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15b 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15b 2>cleanup_milter.tmp1 diff cleanup_milter.ref15b1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15b.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15b.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15b2 cleanup_milter.tmp2 rm -f test-queue-file15b.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -507,9 +509,9 @@ cleanup_milter_test15c: cleanup_milter test-queue-file15 cleanup_milter.in15c \ cleanup_milter.reg15c cp test-queue-file15 test-queue-file15c.tmp chmod u+w test-queue-file15c.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15c 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15c 2>cleanup_milter.tmp1 diff cleanup_milter.ref15c1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15c.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15c.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15c2 cleanup_milter.tmp2 rm -f test-queue-file15c.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -518,9 +520,9 @@ cleanup_milter_test15d: cleanup_milter test-queue-file15 cleanup_milter.in15d \ cleanup_milter.reg15d cp test-queue-file15 test-queue-file15d.tmp chmod u+w test-queue-file15d.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15d 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15d 2>cleanup_milter.tmp1 diff cleanup_milter.ref15d1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15d.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15d.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15d2 cleanup_milter.tmp2 rm -f test-queue-file15d.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -529,9 +531,9 @@ cleanup_milter_test15e: cleanup_milter test-queue-file15 cleanup_milter.in15e \ cleanup_milter.reg15e cp test-queue-file15 test-queue-file15e.tmp chmod u+w test-queue-file15e.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15e 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15e 2>cleanup_milter.tmp1 diff cleanup_milter.ref15e1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15e.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15e.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15e2 cleanup_milter.tmp2 rm -f test-queue-file15e.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -540,9 +542,9 @@ cleanup_milter_test15f: cleanup_milter test-queue-file15 cleanup_milter.in15f \ cleanup_milter.reg15f cp test-queue-file15 test-queue-file15f.tmp chmod u+w test-queue-file15f.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15f 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15f 2>cleanup_milter.tmp1 diff cleanup_milter.ref15f1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15f.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15f.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15f2 cleanup_milter.tmp2 rm -f test-queue-file15f.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -551,9 +553,9 @@ cleanup_milter_test15g: cleanup_milter test-queue-file15 cleanup_milter.in15g \ cleanup_milter.reg15g cp test-queue-file15 test-queue-file15g.tmp chmod u+w test-queue-file15g.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15g 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15g 2>cleanup_milter.tmp1 diff cleanup_milter.ref15g1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15g.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15g.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15g2 cleanup_milter.tmp2 rm -f test-queue-file15g.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -562,9 +564,9 @@ cleanup_milter_test15h: cleanup_milter test-queue-file15 cleanup_milter.in15h \ cleanup_milter.reg15h cp test-queue-file15 test-queue-file15h.tmp chmod u+w test-queue-file15h.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15h 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15h 2>cleanup_milter.tmp1 diff cleanup_milter.ref15h1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15h.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15h.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15h2 cleanup_milter.tmp2 rm -f test-queue-file15h.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -573,9 +575,9 @@ cleanup_milter_test15i: cleanup_milter test-queue-file15 cleanup_milter.in15i \ cleanup_milter.reg15i cp test-queue-file15 test-queue-file15i.tmp chmod u+w test-queue-file15i.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in15i 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in15i 2>cleanup_milter.tmp1 diff cleanup_milter.ref15i1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file15i.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file15i.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref15i2 cleanup_milter.tmp2 rm -f test-queue-file15i.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -583,9 +585,9 @@ cleanup_milter_test16a: cleanup_milter test-queue-file16 cleanup_milter.in16a \ cleanup_milter.ref16a1 ../postcat/postcat cleanup_milter.ref16a2 cp test-queue-file16 test-queue-file16a.tmp chmod u+w test-queue-file16a.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in16a 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in16a 2>cleanup_milter.tmp1 diff cleanup_milter.ref16a1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file16a.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file16a.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref16a2 cleanup_milter.tmp2 rm -f test-queue-file16a.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 @@ -593,12 +595,82 @@ cleanup_milter_test16b: cleanup_milter test-queue-file16 cleanup_milter.in16b \ cleanup_milter.ref16b1 ../postcat/postcat cleanup_milter.ref16b2 cp test-queue-file16 test-queue-file16b.tmp chmod u+w test-queue-file16b.tmp - $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in16b 2>cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in16b 2>cleanup_milter.tmp1 diff cleanup_milter.ref16b1 cleanup_milter.tmp1 - $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file16b.tmp 2>/dev/null >cleanup_milter.tmp2 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file16b.tmp 2>/dev/null >cleanup_milter.tmp2 diff cleanup_milter.ref16b2 cleanup_milter.tmp2 rm -f test-queue-file16b.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 +cleanup_milter_test17a: cleanup_milter test-queue-file17 cleanup_milter.in17a \ + cleanup_milter.ref17a1 ../postcat/postcat cleanup_milter.ref17a2 + cp test-queue-file17 test-queue-file17a.tmp + chmod u+w test-queue-file17a.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in17a 2>cleanup_milter.tmp1 + diff cleanup_milter.ref17a1 cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file17a.tmp 2>/dev/null >cleanup_milter.tmp2 + diff cleanup_milter.ref17a2 cleanup_milter.tmp2 + rm -f test-queue-file17a.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 + +cleanup_milter_test17b: cleanup_milter test-queue-file17 cleanup_milter.in17b \ + cleanup_milter.ref17b1 ../postcat/postcat cleanup_milter.ref17b2 + cp test-queue-file17 test-queue-file17b.tmp + chmod u+w test-queue-file17b.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in17b 2>cleanup_milter.tmp1 + diff cleanup_milter.ref17b1 cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file17b.tmp 2>/dev/null >cleanup_milter.tmp2 + diff cleanup_milter.ref17b2 cleanup_milter.tmp2 + rm -f test-queue-file17b.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 + +cleanup_milter_test17c: cleanup_milter test-queue-file17 cleanup_milter.in17c \ + cleanup_milter.ref17c1 ../postcat/postcat cleanup_milter.ref17c2 + cp test-queue-file17 test-queue-file17c.tmp + chmod u+w test-queue-file17c.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in17c 2>cleanup_milter.tmp1 + diff cleanup_milter.ref17c1 cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file17c.tmp 2>/dev/null >cleanup_milter.tmp2 + diff cleanup_milter.ref17c2 cleanup_milter.tmp2 + rm -f test-queue-file17c.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 + +cleanup_milter_test17d: cleanup_milter test-queue-file17 cleanup_milter.in17d \ + cleanup_milter.ref17d1 ../postcat/postcat cleanup_milter.ref17d2 + cp test-queue-file17 test-queue-file17d.tmp + chmod u+w test-queue-file17d.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in17d 2>cleanup_milter.tmp1 + diff cleanup_milter.ref17d1 cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file17d.tmp 2>/dev/null >cleanup_milter.tmp2 + diff cleanup_milter.ref17d2 cleanup_milter.tmp2 + rm -f test-queue-file17d.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 + +cleanup_milter_test17e: cleanup_milter test-queue-file17 cleanup_milter.in17e \ + cleanup_milter.ref17e1 ../postcat/postcat cleanup_milter.ref17e2 + cp test-queue-file17 test-queue-file17e.tmp + chmod u+w test-queue-file17e.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in17e 2>cleanup_milter.tmp1 + diff cleanup_milter.ref17e1 cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file17e.tmp 2>/dev/null >cleanup_milter.tmp2 + diff cleanup_milter.ref17e2 cleanup_milter.tmp2 + rm -f test-queue-file17e.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 + +cleanup_milter_test17f: cleanup_milter test-queue-file17 cleanup_milter.in17f \ + cleanup_milter.ref17f1 ../postcat/postcat cleanup_milter.ref17f2 + cp test-queue-file17 test-queue-file17f.tmp + chmod u+w test-queue-file17f.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in17f 2>cleanup_milter.tmp1 + diff cleanup_milter.ref17f1 cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file17f.tmp 2>/dev/null >cleanup_milter.tmp2 + diff cleanup_milter.ref17f2 cleanup_milter.tmp2 + rm -f test-queue-file17f.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 + +cleanup_milter_test17g: cleanup_milter test-queue-file17 cleanup_milter.in17g \ + cleanup_milter.ref17g1 ../postcat/postcat cleanup_milter.ref17g2 + cp test-queue-file17 test-queue-file17g.tmp + chmod u+w test-queue-file17g.tmp + $(SHLIB_ENV) $(VALGRIND) ./cleanup_milter <cleanup_milter.in17g 2>cleanup_milter.tmp1 + diff cleanup_milter.ref17g1 cleanup_milter.tmp1 + $(SHLIB_ENV) $(VALGRIND) ../postcat/postcat -ov test-queue-file17g.tmp 2>/dev/null >cleanup_milter.tmp2 + diff cleanup_milter.ref17g2 cleanup_milter.tmp2 + rm -f test-queue-file17g.tmp cleanup_milter.tmp1 cleanup_milter.tmp2 + depend: $(MAKES) (sed '1,/^# do not edit/!d' Makefile.in; \ set -e; for i in [a-z][a-z0-9]*.c; do \ @@ -924,6 +996,7 @@ cleanup_init.o: ../../include/ext_prop.h cleanup_init.o: ../../include/flush_clnt.h cleanup_init.o: ../../include/header_body_checks.h cleanup_init.o: ../../include/header_opts.h +cleanup_init.o: ../../include/hfrom_format.h cleanup_init.o: ../../include/htable.h cleanup_init.o: ../../include/iostuff.h cleanup_init.o: ../../include/mail_addr.h @@ -1065,6 +1138,7 @@ cleanup_message.o: ../../include/dsn_util.h cleanup_message.o: ../../include/ext_prop.h cleanup_message.o: ../../include/header_body_checks.h cleanup_message.o: ../../include/header_opts.h +cleanup_message.o: ../../include/hfrom_format.h cleanup_message.o: ../../include/htable.h cleanup_message.o: ../../include/info_log_addr_form.h cleanup_message.o: ../../include/iostuff.h diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17a b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17a new file mode 100644 index 00000000000..c7eb3614b21 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17a @@ -0,0 +1,9 @@ +#verbose on +open test-queue-file17a.tmp +# +# Delete a recipient. Then add the recipient back. + +del_rcpt user@example.com +add_rcpt user@example.com + +close diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17b b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17b new file mode 100644 index 00000000000..654f9f5e2bc --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17b @@ -0,0 +1,10 @@ +#verbose on +open test-queue-file17b.tmp +# +# Delete a recipient. Then add the recipient back, with a DSN NOTIFY +# record instead of a DSN original recipient. + +del_rcpt user@example.com +add_rcpt_par user@example.com NOTIFY=never + +close diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17c b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17c new file mode 100644 index 00000000000..8c34db41599 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17c @@ -0,0 +1,12 @@ +#verbose on +open test-queue-file17c.tmp +# +# Delete a recipient. Then add the recipient back, with a DSN NOTIFY +# record instead of a DSN original recipient. Then add the same again. +# The second command should be ignored as a duplicate. + +del_rcpt user@example.com +add_rcpt_par user@example.com NOTIFY=never +add_rcpt_par user@example.com NOTIFY=never + +close diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17d b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17d new file mode 100644 index 00000000000..46ac8ffebad --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17d @@ -0,0 +1,18 @@ +#verbose on +open test-queue-file17d.tmp +# +# Delete a recipient. Then add the recipient back, with a DSN NOTIFY +# record instead of a DSN original recipient. Then add the same again. +# The second command should be ignored as a duplicate. + +del_rcpt user@example.com +add_rcpt_par user@example.com NOTIFY=never +add_rcpt_par user@example.com NOTIFY=never + +# The above has confirmed that recipient is in the duplicate filter. +# Now verify that del_rcpt will delete it, and that a subsequent +# add_rcpt_par will NOT be ignored. +del_rcpt user@example.com +add_rcpt_par user@example.com NOTIFY=never + +close diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17e b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17e new file mode 100644 index 00000000000..e2e254641ce --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17e @@ -0,0 +1,12 @@ +#verbose on +open test-queue-file17e.tmp +# +# Delete a recipient. Then add the recipient back. + +enable_original_recipient 0 +enable_original_recipient + +del_rcpt user@example.com +add_rcpt user@example.com + +close diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17f b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17f new file mode 100644 index 00000000000..03d85c022e6 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17f @@ -0,0 +1,15 @@ +#verbose on +open test-queue-file17f.tmp +# +# Delete a recipient. Then add the recipient back. + +enable_original_recipient 0 +enable_original_recipient + +del_rcpt user@example.com +add_rcpt user@example.com + +# Adding the recipient another time should be a NOOP. +add_rcpt user@example.com + +close diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17g b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17g new file mode 100644 index 00000000000..e7225eca8b5 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17g @@ -0,0 +1,23 @@ +#verbose on +open test-queue-file17g.tmp +# +# Delete a recipient. This leaves a deleted recipient in the queue +# file. Then add the recipient back. +# +enable_original_recipient 0 +enable_original_recipient + +del_rcpt user@example.com +add_rcpt user@example.com + +# Adding the recipient another time should be a NOOP. +add_rcpt user@example.com + +# Deleting the recipient should remove it from the duplicate filter. +# This leaves a deleted recipient in the queue file. +# Therefore adding the recipient will not be a NOOP. + +del_rcpt user@example.com +add_rcpt user@example.com + +close diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17a1 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17a1 new file mode 100644 index 00000000000..eab5a83d68c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17a1 @@ -0,0 +1 @@ +./cleanup_milter: flags = enable_header_body_filter enable_milters diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17a2 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17a2 new file mode 100644 index 00000000000..18037a85ea9 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17a2 @@ -0,0 +1,30 @@ +*** ENVELOPE RECORDS test-queue-file17a.tmp *** + 0 message_size: 343 215 1 0 343 0 + 97 message_arrival_time: Tue Nov 18 16:43:29 2014 + 116 create_time: Tue Nov 18 16:43:29 2014 + 140 named_attribute: rewrite_context=local + 163 sender_fullname: Wietse Venema + 178 sender: user@example.com + 196 pointer_record: 654 + 654 original_recipient: user@example.com + 672 recipient: user@example.com + 690 pointer_record: 213 + 213 *** MESSAGE CONTENTS test-queue-file17a.tmp *** + 215 regular_text: Received: by host.example.com (Postfix, from userid 1001) + 274 regular_text: id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 331 regular_text: To: user@example.com + 353 regular_text: Subject: test + 368 padding: 0 + 371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com> + 431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 476 regular_text: From: user@example.com (Wietse Venema) + 516 pointer_record: 0 + 533 regular_text: + 535 regular_text: test + 541 pointer_record: 0 + 558 *** HEADER EXTRACTED test-queue-file17a.tmp *** + 560 pointer_record: 0 + 577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com + 616 original_recipient: user@example.com + 634 canceled_recipient: user@example.com + 652 *** MESSAGE FILE END test-queue-file17a.tmp *** diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17b1 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17b1 new file mode 100644 index 00000000000..eab5a83d68c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17b1 @@ -0,0 +1 @@ +./cleanup_milter: flags = enable_header_body_filter enable_milters diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17b2 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17b2 new file mode 100644 index 00000000000..4df043d4a02 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17b2 @@ -0,0 +1,31 @@ +*** ENVELOPE RECORDS test-queue-file17b.tmp *** + 0 message_size: 343 215 1 0 343 0 + 97 message_arrival_time: Tue Nov 18 16:43:29 2014 + 116 create_time: Tue Nov 18 16:43:29 2014 + 140 named_attribute: rewrite_context=local + 163 sender_fullname: Wietse Venema + 178 sender: user@example.com + 196 pointer_record: 654 + 654 named_attribute: notify_flags=1 + 670 original_recipient: user@example.com + 688 recipient: user@example.com + 706 pointer_record: 213 + 213 *** MESSAGE CONTENTS test-queue-file17b.tmp *** + 215 regular_text: Received: by host.example.com (Postfix, from userid 1001) + 274 regular_text: id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 331 regular_text: To: user@example.com + 353 regular_text: Subject: test + 368 padding: 0 + 371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com> + 431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 476 regular_text: From: user@example.com (Wietse Venema) + 516 pointer_record: 0 + 533 regular_text: + 535 regular_text: test + 541 pointer_record: 0 + 558 *** HEADER EXTRACTED test-queue-file17b.tmp *** + 560 pointer_record: 0 + 577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com + 616 original_recipient: user@example.com + 634 canceled_recipient: user@example.com + 652 *** MESSAGE FILE END test-queue-file17b.tmp *** diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17c1 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17c1 new file mode 100644 index 00000000000..eab5a83d68c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17c1 @@ -0,0 +1 @@ +./cleanup_milter: flags = enable_header_body_filter enable_milters diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17c2 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17c2 new file mode 100644 index 00000000000..509af4115f6 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17c2 @@ -0,0 +1,31 @@ +*** ENVELOPE RECORDS test-queue-file17c.tmp *** + 0 message_size: 343 215 1 0 343 0 + 97 message_arrival_time: Tue Nov 18 16:43:29 2014 + 116 create_time: Tue Nov 18 16:43:29 2014 + 140 named_attribute: rewrite_context=local + 163 sender_fullname: Wietse Venema + 178 sender: user@example.com + 196 pointer_record: 654 + 654 named_attribute: notify_flags=1 + 670 original_recipient: user@example.com + 688 recipient: user@example.com + 706 pointer_record: 213 + 213 *** MESSAGE CONTENTS test-queue-file17c.tmp *** + 215 regular_text: Received: by host.example.com (Postfix, from userid 1001) + 274 regular_text: id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 331 regular_text: To: user@example.com + 353 regular_text: Subject: test + 368 padding: 0 + 371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com> + 431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 476 regular_text: From: user@example.com (Wietse Venema) + 516 pointer_record: 0 + 533 regular_text: + 535 regular_text: test + 541 pointer_record: 0 + 558 *** HEADER EXTRACTED test-queue-file17c.tmp *** + 560 pointer_record: 0 + 577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com + 616 original_recipient: user@example.com + 634 canceled_recipient: user@example.com + 652 *** MESSAGE FILE END test-queue-file17c.tmp *** diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17d1 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17d1 new file mode 100644 index 00000000000..eab5a83d68c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17d1 @@ -0,0 +1 @@ +./cleanup_milter: flags = enable_header_body_filter enable_milters diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17d2 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17d2 new file mode 100644 index 00000000000..846ac33cda3 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17d2 @@ -0,0 +1,35 @@ +*** ENVELOPE RECORDS test-queue-file17d.tmp *** + 0 message_size: 343 215 1 0 343 0 + 97 message_arrival_time: Tue Nov 18 16:43:29 2014 + 116 create_time: Tue Nov 18 16:43:29 2014 + 140 named_attribute: rewrite_context=local + 163 sender_fullname: Wietse Venema + 178 sender: user@example.com + 196 pointer_record: 654 + 654 named_attribute: notify_flags=1 + 670 original_recipient: user@example.com + 688 canceled_recipient: user@example.com + 706 pointer_record: 723 + 723 named_attribute: notify_flags=1 + 739 original_recipient: user@example.com + 757 recipient: user@example.com + 775 pointer_record: 213 + 213 *** MESSAGE CONTENTS test-queue-file17d.tmp *** + 215 regular_text: Received: by host.example.com (Postfix, from userid 1001) + 274 regular_text: id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 331 regular_text: To: user@example.com + 353 regular_text: Subject: test + 368 padding: 0 + 371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com> + 431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 476 regular_text: From: user@example.com (Wietse Venema) + 516 pointer_record: 0 + 533 regular_text: + 535 regular_text: test + 541 pointer_record: 0 + 558 *** HEADER EXTRACTED test-queue-file17d.tmp *** + 560 pointer_record: 0 + 577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com + 616 original_recipient: user@example.com + 634 canceled_recipient: user@example.com + 652 *** MESSAGE FILE END test-queue-file17d.tmp *** diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17e1 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17e1 new file mode 100644 index 00000000000..b78b1a285c6 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17e1 @@ -0,0 +1,2 @@ +./cleanup_milter: enable_original_recipient: 0 +./cleanup_milter: flags = enable_header_body_filter enable_milters diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17e2 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17e2 new file mode 100644 index 00000000000..7e523f69e20 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17e2 @@ -0,0 +1,30 @@ +*** ENVELOPE RECORDS test-queue-file17e.tmp *** + 0 message_size: 343 215 1 0 343 0 + 97 message_arrival_time: Tue Nov 18 16:43:29 2014 + 116 create_time: Tue Nov 18 16:43:29 2014 + 140 named_attribute: rewrite_context=local + 163 sender_fullname: Wietse Venema + 178 sender: user@example.com + 196 pointer_record: 654 + 654 original_recipient: user@example.com + 672 recipient: user@example.com + 690 pointer_record: 213 + 213 *** MESSAGE CONTENTS test-queue-file17e.tmp *** + 215 regular_text: Received: by host.example.com (Postfix, from userid 1001) + 274 regular_text: id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 331 regular_text: To: user@example.com + 353 regular_text: Subject: test + 368 padding: 0 + 371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com> + 431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 476 regular_text: From: user@example.com (Wietse Venema) + 516 pointer_record: 0 + 533 regular_text: + 535 regular_text: test + 541 pointer_record: 0 + 558 *** HEADER EXTRACTED test-queue-file17e.tmp *** + 560 pointer_record: 0 + 577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com + 616 original_recipient: user@example.com + 634 canceled_recipient: user@example.com + 652 *** MESSAGE FILE END test-queue-file17e.tmp *** diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17f1 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17f1 new file mode 100644 index 00000000000..b78b1a285c6 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17f1 @@ -0,0 +1,2 @@ +./cleanup_milter: enable_original_recipient: 0 +./cleanup_milter: flags = enable_header_body_filter enable_milters diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17f2 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17f2 new file mode 100644 index 00000000000..ce185910e45 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17f2 @@ -0,0 +1,30 @@ +*** ENVELOPE RECORDS test-queue-file17f.tmp *** + 0 message_size: 343 215 1 0 343 0 + 97 message_arrival_time: Tue Nov 18 16:43:29 2014 + 116 create_time: Tue Nov 18 16:43:29 2014 + 140 named_attribute: rewrite_context=local + 163 sender_fullname: Wietse Venema + 178 sender: user@example.com + 196 pointer_record: 654 + 654 original_recipient: user@example.com + 672 recipient: user@example.com + 690 pointer_record: 213 + 213 *** MESSAGE CONTENTS test-queue-file17f.tmp *** + 215 regular_text: Received: by host.example.com (Postfix, from userid 1001) + 274 regular_text: id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 331 regular_text: To: user@example.com + 353 regular_text: Subject: test + 368 padding: 0 + 371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com> + 431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 476 regular_text: From: user@example.com (Wietse Venema) + 516 pointer_record: 0 + 533 regular_text: + 535 regular_text: test + 541 pointer_record: 0 + 558 *** HEADER EXTRACTED test-queue-file17f.tmp *** + 560 pointer_record: 0 + 577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com + 616 original_recipient: user@example.com + 634 canceled_recipient: user@example.com + 652 *** MESSAGE FILE END test-queue-file17f.tmp *** diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17g1 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17g1 new file mode 100644 index 00000000000..b78b1a285c6 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17g1 @@ -0,0 +1,2 @@ +./cleanup_milter: enable_original_recipient: 0 +./cleanup_milter: flags = enable_header_body_filter enable_milters diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17g2 b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17g2 new file mode 100644 index 00000000000..938eeed4790 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17g2 @@ -0,0 +1,33 @@ +*** ENVELOPE RECORDS test-queue-file17g.tmp *** + 0 message_size: 343 215 1 0 343 0 + 97 message_arrival_time: Tue Nov 18 16:43:29 2014 + 116 create_time: Tue Nov 18 16:43:29 2014 + 140 named_attribute: rewrite_context=local + 163 sender_fullname: Wietse Venema + 178 sender: user@example.com + 196 pointer_record: 654 + 654 original_recipient: user@example.com + 672 canceled_recipient: user@example.com + 690 pointer_record: 707 + 707 original_recipient: user@example.com + 725 recipient: user@example.com + 743 pointer_record: 213 + 213 *** MESSAGE CONTENTS test-queue-file17g.tmp *** + 215 regular_text: Received: by host.example.com (Postfix, from userid 1001) + 274 regular_text: id 663E22172797; Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 331 regular_text: To: user@example.com + 353 regular_text: Subject: test + 368 padding: 0 + 371 regular_text: Message-Id: <20141118214329.663E22172797@host.example.com> + 431 regular_text: Date: Tue, 18 Nov 2014 16:43:29 -0500 (EST) + 476 regular_text: From: user@example.com (Wietse Venema) + 516 pointer_record: 0 + 533 regular_text: + 535 regular_text: test + 541 pointer_record: 0 + 558 *** HEADER EXTRACTED test-queue-file17g.tmp *** + 560 pointer_record: 0 + 577 named_attribute: dsn_orig_rcpt=rfc822;user@example.com + 616 original_recipient: user@example.com + 634 canceled_recipient: user@example.com + 652 *** MESSAGE FILE END test-queue-file17g.tmp *** diff --git a/external/ibm-public/postfix/dist/src/cleanup/test-queue-file17 b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file17 Binary files differnew file mode 100644 index 00000000000..3f7c5f3e61b --- /dev/null +++ b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file17 diff --git a/external/ibm-public/postfix/dist/src/dns/Makefile.in b/external/ibm-public/postfix/dist/src/dns/Makefile.in index aec91e0b5e2..795f9ba2a80 100644 --- a/external/ibm-public/postfix/dist/src/dns/Makefile.in +++ b/external/ibm-public/postfix/dist/src/dns/Makefile.in @@ -1,10 +1,10 @@ SHELL = /bin/sh SRCS = dns_lookup.c dns_rr.c dns_strerror.c dns_strtype.c dns_rr_to_pa.c \ dns_sa_to_rr.c dns_rr_eq_sa.c dns_rr_to_sa.c dns_strrecord.c \ - dns_rr_filter.c dns_str_resflags.c + dns_rr_filter.c dns_str_resflags.c dns_sec.c OBJS = dns_lookup.o dns_rr.o dns_strerror.o dns_strtype.o dns_rr_to_pa.o \ dns_sa_to_rr.o dns_rr_eq_sa.o dns_rr_to_sa.o dns_strrecord.o \ - dns_rr_filter.o dns_str_resflags.o + dns_rr_filter.o dns_str_resflags.o dns_sec.o HDRS = dns.h TESTSRC = test_dns_lookup.c test_alias_token.c DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE) @@ -76,7 +76,7 @@ update: $(LIB_DIR)/$(LIB) $(HDRS) done cd $(INC_DIR); chmod 644 $(HDRS) -test_dns_lookup: test_dns_lookup.c $(LIB) $(LIBS) +test_dns_lookup: test_dns_lookup.c all $(LIB) $(LIBS) $(CC) $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) dns_rr_to_pa: $(LIB) $(LIBS) @@ -346,6 +346,18 @@ dns_sa_to_rr.o: ../../include/vbuf.h dns_sa_to_rr.o: ../../include/vstring.h dns_sa_to_rr.o: dns.h dns_sa_to_rr.o: dns_sa_to_rr.c +dns_sec.o: ../../include/check_arg.h +dns_sec.o: ../../include/mail_params.h +dns_sec.o: ../../include/msg.h +dns_sec.o: ../../include/myaddrinfo.h +dns_sec.o: ../../include/mymalloc.h +dns_sec.o: ../../include/sock_addr.h +dns_sec.o: ../../include/split_at.h +dns_sec.o: ../../include/sys_defs.h +dns_sec.o: ../../include/vbuf.h +dns_sec.o: ../../include/vstring.h +dns_sec.o: dns.h +dns_sec.o: dns_sec.c dns_str_resflags.o: ../../include/check_arg.h dns_str_resflags.o: ../../include/myaddrinfo.h dns_str_resflags.o: ../../include/name_mask.h diff --git a/external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.in b/external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.in index 89834d5c67a..e8b6f833ef5 100644 --- a/external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.in +++ b/external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.in @@ -1,4 +1,4 @@ -spike.porcupine.org 168.100.189.2 -spike.porcupine.org 168.100.189.3 +spike.porcupine.org 168.100.3.2 +spike.porcupine.org 168.100.3.3 spike.porcupine.org 2604:8d00:189::2 spike.porcupine.org 2604:8d00:189::3 diff --git a/external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.ref b/external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.ref index 75fb0c3d42e..45e6b785bc0 100644 --- a/external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.ref +++ b/external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.ref @@ -1,22 +1,22 @@ -168.100.189.2 =?= 168.100.189.2 +168.100.3.2 =?= 168.100.3.2 tested by function: yes tested by macro: yes -2604:8d00:189::2 =?= 168.100.189.2 +2604:8d00:189::2 =?= 168.100.3.2 tested by function: no tested by macro: no -168.100.189.2 =?= 168.100.189.3 +168.100.3.2 =?= 168.100.3.3 tested by function: no tested by macro: no -2604:8d00:189::2 =?= 168.100.189.3 +2604:8d00:189::2 =?= 168.100.3.3 tested by function: no tested by macro: no -168.100.189.2 =?= 2604:8d00:189::2 +168.100.3.2 =?= 2604:8d00:189::2 tested by function: no tested by macro: no 2604:8d00:189::2 =?= 2604:8d00:189::2 tested by function: yes tested by macro: yes -168.100.189.2 =?= 2604:8d00:189::3 +168.100.3.2 =?= 2604:8d00:189::3 tested by function: no tested by macro: no 2604:8d00:189::2 =?= 2604:8d00:189::3 diff --git a/external/ibm-public/postfix/dist/src/dns/dns_rr_to_pa.ref b/external/ibm-public/postfix/dist/src/dns/dns_rr_to_pa.ref index 86c022d56a6..db1c7af1d68 100644 --- a/external/ibm-public/postfix/dist/src/dns/dns_rr_to_pa.ref +++ b/external/ibm-public/postfix/dist/src/dns/dns_rr_to_pa.ref @@ -1,2 +1,2 @@ -spike.porcupine.org -> 168.100.189.2 +spike.porcupine.org -> 168.100.3.2 spike.porcupine.org -> 2604:8d00:189::2 diff --git a/external/ibm-public/postfix/dist/src/dns/dns_rr_to_sa.ref b/external/ibm-public/postfix/dist/src/dns/dns_rr_to_sa.ref index 217b9a25308..8a114b50fba 100644 --- a/external/ibm-public/postfix/dist/src/dns/dns_rr_to_sa.ref +++ b/external/ibm-public/postfix/dist/src/dns/dns_rr_to_sa.ref @@ -1,2 +1,2 @@ -spike.porcupine.org 25 -> 168.100.189.2 25 +spike.porcupine.org 25 -> 168.100.3.2 25 spike.porcupine.org 25 -> 2604:8d00:189::2 25 diff --git a/external/ibm-public/postfix/dist/src/dns/dns_sa_to_rr.ref b/external/ibm-public/postfix/dist/src/dns/dns_sa_to_rr.ref index 86c022d56a6..db1c7af1d68 100644 --- a/external/ibm-public/postfix/dist/src/dns/dns_sa_to_rr.ref +++ b/external/ibm-public/postfix/dist/src/dns/dns_sa_to_rr.ref @@ -1,2 +1,2 @@ -spike.porcupine.org -> 168.100.189.2 +spike.porcupine.org -> 168.100.3.2 spike.porcupine.org -> 2604:8d00:189::2 diff --git a/external/ibm-public/postfix/dist/src/dns/dns_sec.c b/external/ibm-public/postfix/dist/src/dns/dns_sec.c new file mode 100644 index 00000000000..b6f8c7f5a8a --- /dev/null +++ b/external/ibm-public/postfix/dist/src/dns/dns_sec.c @@ -0,0 +1,146 @@ +/* $NetBSD: dns_sec.c,v 1.1.1.1 2022/10/08 16:09:06 christos Exp $ */ + +/*++ +/* NAME +/* dns_sec 3 +/* SUMMARY +/* DNSSEC validation availability +/* SYNOPSIS +/* #include <dns.h> +/* +/* DNS_SEC_STATS_SET( +/* int flags) +/* +/* DNS_SEC_STATS_TEST( +/* int flags) +/* +/* void dns_sec_probe( +/* int rflags) +/* DESCRIPTION +/* This module maintains information about the availability of +/* DNSSEC validation, in global flags that summarize +/* process-lifetime history. +/* .IP DNS_SEC_FLAG_AVAILABLE +/* The process has received at least one DNSSEC validated +/* response to a query that requested DNSSEC validation. +/* .IP DNS_SEC_FLAG_DONT_PROBE +/* The process has sent a DNSSEC probe (see below), or DNSSEC +/* probing is disabled by configuration. +/* .PP +/* DNS_SEC_STATS_SET() sets one or more DNS_SEC_FLAG_* flags, +/* and DNS_SEC_STATS_TEST() returns non-zero if any of the +/* specified flags is set. +/* +/* dns_sec_probe() generates a query to the target specified +/* with the \fBdnssec_probe\fR configuration parameter. It +/* sets the DNS_SEC_FLAG_DONT_PROBE flag, and it calls +/* dns_lookup() which sets DNS_SEC_FLAG_AVAILABLE if it receives +/* a DNSSEC validated response. Preconditions: +/* .IP \(bu +/* The rflags argument must request DNSSEC validation (in the +/* same manner as dns_lookup() rflags argument). +/* .IP \(bu +/* The DNS_SEC_FLAG_AVAILABLE and DNS_SEC_FLAG_DONT_PROBE +/* flags must be false. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#include <sys_defs.h> + + /* + * Utility library. + */ +#include <msg.h> +#include <mymalloc.h> +#include <split_at.h> +#include <vstring.h> + + /* + * Global library. + */ +#include <mail_params.h> + + /* + * DNS library. + */ +#include <dns.h> + +int dns_sec_stats; + +/* dns_sec_probe - send a probe to establish DNSSEC viability */ + +void dns_sec_probe(int rflags) +{ + const char myname[] = "dns_sec_probe"; + char *saved_dnssec_probe; + char *qname; + int qtype; + DNS_RR *rrlist = 0; + int dns_status; + VSTRING *why; + + /* + * Sanity checks. + */ + if (!DNS_WANT_DNSSEC_VALIDATION(rflags)) + msg_panic("%s: DNSSEC is not requested", myname); + if (DNS_SEC_STATS_TEST(DNS_SEC_FLAG_DONT_PROBE)) + msg_panic("%s: DNSSEC probe was already sent, or probing is disabled", + myname); + if (DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE)) + msg_panic("%s: already have validated DNS response", myname); + + /* + * Don't recurse. + */ + DNS_SEC_STATS_SET(DNS_SEC_FLAG_DONT_PROBE); + + /* + * Don't probe. + */ + if (*var_dnssec_probe == 0) + return; + + /* + * Parse the probe spec. Format is type:resource. + */ + saved_dnssec_probe = mystrdup(var_dnssec_probe); + if ((qname = split_at(saved_dnssec_probe, ':')) == 0 || *qname == 0 + || (qtype = dns_type(saved_dnssec_probe)) == 0) + msg_fatal("malformed %s value: %s format is qtype:qname", + VAR_DNSSEC_PROBE, var_dnssec_probe); + + why = vstring_alloc(100); + dns_status = dns_lookup(qname, qtype, rflags, &rrlist, (VSTRING *) 0, why); + if (!DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE)) + msg_warn("DNSSEC validation may be unavailable"); + else if (msg_verbose) + msg_info(VAR_DNSSEC_PROBE + " '%s' received a response that is DNSSEC validated", + var_dnssec_probe); + switch (dns_status) { + default: + if (!DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE)) + msg_warn("reason: " VAR_DNSSEC_PROBE + " '%s' received a response that is not DNSSEC validated", + var_dnssec_probe); + if (rrlist) + dns_rr_free(rrlist); + break; + case DNS_RETRY: + case DNS_FAIL: + msg_warn("reason: " VAR_DNSSEC_PROBE " '%s' received no response: %s", + var_dnssec_probe, vstring_str(why)); + break; + } + myfree(saved_dnssec_probe); + vstring_free(why); +} diff --git a/external/ibm-public/postfix/dist/src/dns/error.ref b/external/ibm-public/postfix/dist/src/dns/error.ref index 806cfe042c9..c535153fb25 100644 --- a/external/ibm-public/postfix/dist/src/dns/error.ref +++ b/external/ibm-public/postfix/dist/src/dns/error.ref @@ -1,8 +1,8 @@ ./test_dns_lookup: lookup spike.porcupine.org type A flags RES_USE_DNSSEC ./test_dns_lookup: dns_query: spike.porcupine.org (A): OK ./test_dns_lookup: dns_get_answer: type A for spike.porcupine.org -./test_dns_lookup: dict_regexp_lookup: error.reg: spike.porcupine.org. 3600 IN A 168.100.189.2 -./test_dns_lookup: maps_find: DNS reply filter: regexp:error.reg(0,lock|fold_fix): spike.porcupine.org. 3600 IN A 168.100.189.2 = oops +./test_dns_lookup: dict_regexp_lookup: error.reg: spike.porcupine.org. 3600 IN A 168.100.3.2 +./test_dns_lookup: maps_find: DNS reply filter: regexp:error.reg(0,lock|fold_fix): spike.porcupine.org. 3600 IN A 168.100.3.2 = oops ./test_dns_lookup: warning: DNS reply filter: unknown DNS filter action: "oops" ./test_dns_lookup: lookup spike.porcupine.org type AAAA flags RES_USE_DNSSEC ./test_dns_lookup: dns_query: spike.porcupine.org (AAAA): OK diff --git a/external/ibm-public/postfix/dist/src/dns/no-a.ref b/external/ibm-public/postfix/dist/src/dns/no-a.ref index 88ba511c483..5dff824a65a 100644 --- a/external/ibm-public/postfix/dist/src/dns/no-a.ref +++ b/external/ibm-public/postfix/dist/src/dns/no-a.ref @@ -1,9 +1,9 @@ ./test_dns_lookup: lookup spike.porcupine.org type A flags RES_USE_DNSSEC ./test_dns_lookup: dns_query: spike.porcupine.org (A): OK ./test_dns_lookup: dns_get_answer: type A for spike.porcupine.org -./test_dns_lookup: dict_regexp_lookup: no-a.reg: spike.porcupine.org. 3600 IN A 168.100.189.2 -./test_dns_lookup: maps_find: DNS reply filter: regexp:no-a.reg(0,lock|fold_fix): spike.porcupine.org. 3600 IN A 168.100.189.2 = ignore -./test_dns_lookup: ignoring DNS RR: spike.porcupine.org. 3600 IN A 168.100.189.2 +./test_dns_lookup: dict_regexp_lookup: no-a.reg: spike.porcupine.org. 3600 IN A 168.100.3.2 +./test_dns_lookup: maps_find: DNS reply filter: regexp:no-a.reg(0,lock|fold_fix): spike.porcupine.org. 3600 IN A 168.100.3.2 = ignore +./test_dns_lookup: ignoring DNS RR: spike.porcupine.org. 3600 IN A 168.100.3.2 ./test_dns_lookup: lookup spike.porcupine.org type AAAA flags RES_USE_DNSSEC ./test_dns_lookup: dns_query: spike.porcupine.org (AAAA): OK ./test_dns_lookup: dns_get_answer: type AAAA for spike.porcupine.org diff --git a/external/ibm-public/postfix/dist/src/dns/no-aaaa.ref b/external/ibm-public/postfix/dist/src/dns/no-aaaa.ref index f2a678c3303..657c69b0881 100644 --- a/external/ibm-public/postfix/dist/src/dns/no-aaaa.ref +++ b/external/ibm-public/postfix/dist/src/dns/no-aaaa.ref @@ -1,8 +1,8 @@ ./test_dns_lookup: lookup spike.porcupine.org type A flags RES_USE_DNSSEC ./test_dns_lookup: dns_query: spike.porcupine.org (A): OK ./test_dns_lookup: dns_get_answer: type A for spike.porcupine.org -./test_dns_lookup: dict_regexp_lookup: no-aaaa.reg: spike.porcupine.org. 3600 IN A 168.100.189.2 -./test_dns_lookup: maps_find: DNS reply filter: spike.porcupine.org. 3600 IN A 168.100.189.2: not found +./test_dns_lookup: dict_regexp_lookup: no-aaaa.reg: spike.porcupine.org. 3600 IN A 168.100.3.2 +./test_dns_lookup: maps_find: DNS reply filter: spike.porcupine.org. 3600 IN A 168.100.3.2: not found ./test_dns_lookup: lookup spike.porcupine.org type AAAA flags RES_USE_DNSSEC ./test_dns_lookup: dns_query: spike.porcupine.org (AAAA): OK ./test_dns_lookup: dns_get_answer: type AAAA for spike.porcupine.org @@ -10,4 +10,4 @@ ./test_dns_lookup: maps_find: DNS reply filter: regexp:no-aaaa.reg(0,lock|fold_fix): spike.porcupine.org. 3600 IN AAAA 2604:8d00:189::2 = ignore ./test_dns_lookup: ignoring DNS RR: spike.porcupine.org. 3600 IN AAAA 2604:8d00:189::2 spike.porcupine.org: fqdn: spike.porcupine.org -ad: 0, rr: spike.porcupine.org. 3600 IN A 168.100.189.2 +ad: 0, rr: spike.porcupine.org. 3600 IN A 168.100.3.2 diff --git a/external/ibm-public/postfix/dist/src/dns/nullmx_test.ref b/external/ibm-public/postfix/dist/src/dns/nullmx_test.ref index 2386b53611a..1a9cab291d0 100644 --- a/external/ibm-public/postfix/dist/src/dns/nullmx_test.ref +++ b/external/ibm-public/postfix/dist/src/dns/nullmx_test.ref @@ -5,4 +5,4 @@ ./test_dns_lookup: dns_query: nullmx.porcupine.org (A): OK ./test_dns_lookup: dns_get_answer: type A for nullmx.porcupine.org nullmx.porcupine.org: fqdn: nullmx.porcupine.org -ad: 0, rr: nullmx.porcupine.org. 3600 IN A 168.100.189.13 +ad: 0, rr: nullmx.porcupine.org. 3600 IN A 168.100.3.13 diff --git a/external/ibm-public/postfix/dist/src/global/Makefile.in b/external/ibm-public/postfix/dist/src/global/Makefile.in index 14f7283e306..0944a75a9f3 100644 --- a/external/ibm-public/postfix/dist/src/global/Makefile.in +++ b/external/ibm-public/postfix/dist/src/global/Makefile.in @@ -36,7 +36,9 @@ SRCS = abounce.c anvil_clnt.c been_here.c bounce.c bounce_log.c \ smtputf8.c mail_conf_over.c mail_parm_split.c midna_adomain.c \ mail_addr_form.c quote_flags.c maillog_client.c \ normalize_mailhost_addr.c map_search.c reject_deliver_request.c \ - info_log_addr_form.c + info_log_addr_form.c sasl_mech_filter.c login_sender_match.c \ + test_main.c compat_level.c config_known_tcp_ports.c \ + hfrom_format.c OBJS = abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \ canon_addr.o cfg_parser.o cleanup_strerror.o cleanup_strflags.o \ clnt_stream.o conv_time.o db_common.o debug_peer.o debug_process.o \ @@ -74,7 +76,9 @@ OBJS = abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \ smtputf8.o attr_override.o mail_parm_split.o midna_adomain.o \ $(NON_PLUGIN_MAP_OBJ) mail_addr_form.o quote_flags.o maillog_client.o \ normalize_mailhost_addr.o map_search.o reject_deliver_request.o \ - info_log_addr_form.o + info_log_addr_form.o sasl_mech_filter.o login_sender_match.o \ + test_main.o compat_level.o config_known_tcp_ports.o \ + hfrom_format.o # MAP_OBJ is for maps that may be dynamically loaded with dynamicmaps.cf. # When hard-linking these maps, makedefs sets NON_PLUGIN_MAP_OBJ=$(MAP_OBJ), # otherwise it sets the PLUGIN_* macros. @@ -109,7 +113,9 @@ HDRS = abounce.h anvil_clnt.h been_here.h bounce.h bounce_log.h \ haproxy_srvr.h dsn_filter.h dynamicmaps.h uxtext.h smtputf8.h \ attr_override.h mail_parm_split.h midna_adomain.h mail_addr_form.h \ maillog_client.h normalize_mailhost_addr.h map_search.h \ - info_log_addr_form.h + info_log_addr_form.h sasl_mech_filter.h login_sender_match.h \ + test_main.h compat_level.h config_known_tcp_ports.h \ + hfrom_format.h TESTSRC = rec2stream.c stream2rec.c recdump.c DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE) CFLAGS = $(DEBUG) $(OPT) $(DEFS) @@ -125,7 +131,8 @@ TESTPROG= domain_list dot_lockfile mail_addr_crunch mail_addr_find \ data_redirect addr_match_list safe_ultostr verify_sender_addr \ mail_version mail_dict server_acl uxtext mail_parm_split \ fold_addr smtp_reply_footer mail_addr_map normalize_mailhost_addr \ - haproxy_srvr map_search + haproxy_srvr map_search delivered_hdr login_sender_match \ + compat_level config_known_tcp_ports hfrom_format LIBS = ../../lib/lib$(LIB_PREFIX)util$(LIB_SUFFIX) LIB_DIR = ../../lib @@ -393,6 +400,21 @@ haproxy_srvr: haproxy_srvr.c $(LIB) $(LIBS) map_search: map_search.c $(LIB) $(LIBS) $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) +delivered_hdr: delivered_hdr.c $(LIB) $(LIBS) + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) + +login_sender_match: login_sender_match.c $(LIB) $(LIBS) + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) + +compat_level: compat_level.c $(LIB) $(LIBS) + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) + +hfrom_format: hfrom_format.c $(LIB) $(LIBS) + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) + +config_known_tcp_ports: config_known_tcp_ports.c $(LIB) $(LIBS) + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) + tests: tok822_test mime_tests strip_addr_test tok822_limit_test \ xtext_test scache_multi_test ehlo_mask_test \ namadr_list_test mail_conf_time_test header_body_checks_tests \ @@ -400,7 +422,9 @@ tests: tok822_test mime_tests strip_addr_test tok822_limit_test \ safe_ultostr_test mail_parm_split_test fold_addr_test \ smtp_reply_footer_test off_cvt_test mail_addr_crunch_test \ mail_addr_find_test mail_addr_map_test quote_822_local_test \ - normalize_mailhost_addr_test haproxy_srvr_test map_search_test + normalize_mailhost_addr_test haproxy_srvr_test map_search_test \ + delivered_hdr_test login_sender_match_test compat_level_test \ + config_known_tcp_ports_test hfrom_format_test mime_tests: mime_test mime_nest mime_8bit mime_dom mime_trunc mime_cvt \ mime_cvt2 mime_cvt3 mime_garb1 mime_garb2 mime_garb3 mime_garb4 @@ -728,6 +752,44 @@ map_search_test: update map_search map_search.ref diff map_search.ref map_search.tmp rm -f map_search.tmp +delivered_hdr_test: update delivered_hdr delivered_hdr.ref + -$(SHLIB_ENV) $(VALGRIND) ./delivered_hdr >delivered_hdr.tmp 2>&1 + diff delivered_hdr.ref delivered_hdr.tmp + rm -f delivered_hdr.tmp + +login_sender_match_test: update login_sender_match login_sender_match.ref + -$(SHLIB_ENV) $(VALGRIND) ./login_sender_match >login_sender_match.tmp 2>&1 + diff login_sender_match.ref login_sender_match.tmp + rm -f login_sender_match.tmp + +compat_level_test: compat_level_expand_test compat_level_convert_test + +compat_level_expand_test: update compat_level compat_level_expand.in \ + compat_level_expand.ref + -$(SHLIB_ENV) $(VALGRIND) ./compat_level -x <compat_level_expand.in >compat_level_expand.tmp 2>&1 + diff compat_level_expand.ref compat_level_expand.tmp + rm -f compat_level_expand.tmp + +compat_level_convert_test: update compat_level compat_level_convert.in \ + compat_level_convert.ref + -$(SHLIB_ENV) $(VALGRIND) ./compat_level -c <compat_level_convert.in >compat_level_convert.tmp 2>&1 + diff compat_level_convert.ref compat_level_convert.tmp + rm -f compat_level_convert.tmp + +config_known_tcp_ports_test: update config_known_tcp_ports \ + config_known_tcp_ports.ref + -$(SHLIB_ENV) $(VALGRIND) ./config_known_tcp_ports \ + >config_known_tcp_ports.tmp 2>&1 + diff config_known_tcp_ports.ref config_known_tcp_ports.tmp + rm -f config_known_tcp_ports.tmp + +hfrom_format_test: update hfrom_format \ + hfrom_format.ref + -$(SHLIB_ENV) $(VALGRIND) ./hfrom_format \ + >hfrom_format.tmp 2>&1 + diff hfrom_format.ref hfrom_format.tmp + rm -f hfrom_format.tmp + printfck: $(OBJS) $(PROG) rm -rf printfck mkdir printfck @@ -930,6 +992,27 @@ clnt_stream.o: clnt_stream.c clnt_stream.o: clnt_stream.h clnt_stream.o: mail_params.h clnt_stream.o: mail_proto.h +compat_level.o: ../../include/check_arg.h +compat_level.o: ../../include/mac_expand.h +compat_level.o: ../../include/mac_parse.h +compat_level.o: ../../include/msg.h +compat_level.o: ../../include/sane_strtol.h +compat_level.o: ../../include/sys_defs.h +compat_level.o: ../../include/vbuf.h +compat_level.o: ../../include/vstring.h +compat_level.o: compat_level.c +compat_level.o: compat_level.h +config_known_tcp_ports.o: ../../include/argv.h +config_known_tcp_ports.o: ../../include/check_arg.h +config_known_tcp_ports.o: ../../include/known_tcp_ports.h +config_known_tcp_ports.o: ../../include/msg.h +config_known_tcp_ports.o: ../../include/mymalloc.h +config_known_tcp_ports.o: ../../include/stringops.h +config_known_tcp_ports.o: ../../include/sys_defs.h +config_known_tcp_ports.o: ../../include/vbuf.h +config_known_tcp_ports.o: ../../include/vstring.h +config_known_tcp_ports.o: config_known_tcp_ports.c +config_known_tcp_ports.o: config_known_tcp_ports.h conv_time.o: ../../include/msg.h conv_time.o: ../../include/sys_defs.h conv_time.o: conv_time.c @@ -1057,6 +1140,7 @@ deliver_pass.o: deliver_request.h deliver_pass.o: dsb_scan.h deliver_pass.o: dsn.h deliver_pass.o: dsn_buf.h +deliver_pass.o: info_log_addr_form.h deliver_pass.o: mail_params.h deliver_pass.o: mail_proto.h deliver_pass.o: msg_stats.h @@ -1401,6 +1485,7 @@ haproxy_srvr.o: ../../include/inet_proto.h haproxy_srvr.o: ../../include/msg.h haproxy_srvr.o: ../../include/myaddrinfo.h haproxy_srvr.o: ../../include/mymalloc.h +haproxy_srvr.o: ../../include/sock_addr.h haproxy_srvr.o: ../../include/split_at.h haproxy_srvr.o: ../../include/stringops.h haproxy_srvr.o: ../../include/sys_defs.h @@ -1448,6 +1533,12 @@ header_token.o: ../../include/vstring.h header_token.o: header_token.c header_token.o: header_token.h header_token.o: lex_822.h +hfrom_format.o: ../../include/msg.h +hfrom_format.o: ../../include/name_code.h +hfrom_format.o: ../../include/sys_defs.h +hfrom_format.o: hfrom_format.c +hfrom_format.o: hfrom_format.h +hfrom_format.o: mail_params.h info_log_addr_form.o: ../../include/check_arg.h info_log_addr_form.o: ../../include/msg.h info_log_addr_form.o: ../../include/name_code.h @@ -1509,6 +1600,24 @@ log_adhoc.o: log_adhoc.h log_adhoc.o: mail_params.h log_adhoc.o: msg_stats.h log_adhoc.o: recipient_list.h +login_sender_match.o: ../../include/argv.h +login_sender_match.o: ../../include/check_arg.h +login_sender_match.o: ../../include/dict.h +login_sender_match.o: ../../include/msg.h +login_sender_match.o: ../../include/myflock.h +login_sender_match.o: ../../include/mymalloc.h +login_sender_match.o: ../../include/stringops.h +login_sender_match.o: ../../include/sys_defs.h +login_sender_match.o: ../../include/vbuf.h +login_sender_match.o: ../../include/vstream.h +login_sender_match.o: ../../include/vstring.h +login_sender_match.o: login_sender_match.c +login_sender_match.o: login_sender_match.h +login_sender_match.o: mail_params.h +login_sender_match.o: maps.h +login_sender_match.o: quote_822_local.h +login_sender_match.o: quote_flags.h +login_sender_match.o: strip_addr.h mail_addr.o: ../../include/check_arg.h mail_addr.o: ../../include/stringops.h mail_addr.o: ../../include/sys_defs.h @@ -1832,6 +1941,8 @@ mail_params.o: ../../include/vbuf.h mail_params.o: ../../include/vstream.h mail_params.o: ../../include/vstring.h mail_params.o: ../../include/vstring_vstream.h +mail_params.o: config_known_tcp_ports.h +mail_params.o: compat_level.h mail_params.o: mail_conf.h mail_params.o: mail_params.c mail_params.o: mail_params.h @@ -2572,6 +2683,18 @@ safe_ultostr.o: ../../include/vbuf.h safe_ultostr.o: ../../include/vstring.h safe_ultostr.o: safe_ultostr.c safe_ultostr.o: safe_ultostr.h +sasl_mech_filter.o: ../../include/argv.h +sasl_mech_filter.o: ../../include/check_arg.h +sasl_mech_filter.o: ../../include/match_list.h +sasl_mech_filter.o: ../../include/msg.h +sasl_mech_filter.o: ../../include/mymalloc.h +sasl_mech_filter.o: ../../include/stringops.h +sasl_mech_filter.o: ../../include/sys_defs.h +sasl_mech_filter.o: ../../include/vbuf.h +sasl_mech_filter.o: ../../include/vstring.h +sasl_mech_filter.o: sasl_mech_filter.c +sasl_mech_filter.o: sasl_mech_filter.h +sasl_mech_filter.o: string_list.h scache.o: ../../include/argv.h scache.o: ../../include/check_arg.h scache.o: ../../include/events.h @@ -2741,6 +2864,25 @@ sys_exits.o: ../../include/vbuf.h sys_exits.o: ../../include/vstring.h sys_exits.o: sys_exits.c sys_exits.o: sys_exits.h +test_main.o: ../../include/argv.h +test_main.o: ../../include/check_arg.h +test_main.o: ../../include/dict.h +test_main.o: ../../include/msg.h +test_main.o: ../../include/msg_vstream.h +test_main.o: ../../include/myflock.h +test_main.o: ../../include/mymalloc.h +test_main.o: ../../include/stringops.h +test_main.o: ../../include/sys_defs.h +test_main.o: ../../include/vbuf.h +test_main.o: ../../include/vstream.h +test_main.o: ../../include/vstring.h +test_main.o: mail_conf.h +test_main.o: mail_dict.h +test_main.o: mail_params.h +test_main.o: mail_task.h +test_main.o: mail_version.h +test_main.o: test_main.c +test_main.o: test_main.h timed_ipc.o: ../../include/check_arg.h timed_ipc.o: ../../include/msg.h timed_ipc.o: ../../include/sys_defs.h diff --git a/external/ibm-public/postfix/dist/src/global/cleanup_strerror.c b/external/ibm-public/postfix/dist/src/global/cleanup_strerror.c index f0447e9e878..f656047c0d7 100644 --- a/external/ibm-public/postfix/dist/src/global/cleanup_strerror.c +++ b/external/ibm-public/postfix/dist/src/global/cleanup_strerror.c @@ -1,4 +1,4 @@ -/* $NetBSD: cleanup_strerror.c,v 1.1.1.1 2009/06/23 10:08:45 tron Exp $ */ +/* $NetBSD: cleanup_strerror.c,v 1.1.1.2 2022/10/08 16:09:07 christos Exp $ */ /*++ /* NAME @@ -40,6 +40,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ @@ -69,6 +74,7 @@ static const CLEANUP_STAT_DETAIL cleanup_stat_map[] = { CLEANUP_STAT_SIZE, 552, "5.3.4", "message file too big", CLEANUP_STAT_CONT, 550, "5.7.1", "message content rejected", CLEANUP_STAT_WRITE, 451, "4.3.0", "queue file write error", + CLEANUP_STAT_NOPERM, 550, "5.7.1", "service denied", }; static CLEANUP_STAT_DETAIL cleanup_stat_success = { diff --git a/external/ibm-public/postfix/dist/src/global/clnt_stream.h b/external/ibm-public/postfix/dist/src/global/clnt_stream.h index a21951413fb..abc1b04d7e1 100644 --- a/external/ibm-public/postfix/dist/src/global/clnt_stream.h +++ b/external/ibm-public/postfix/dist/src/global/clnt_stream.h @@ -1,4 +1,4 @@ -/* $NetBSD: clnt_stream.h,v 1.1.1.1 2009/06/23 10:08:45 tron Exp $ */ +/* $NetBSD: clnt_stream.h,v 1.1.1.2 2022/10/08 16:09:07 christos Exp $ */ #ifndef _CLNT_STREAM_H_INCLUDED_ #define _CLNT_STREAM_H_INCLUDED_ @@ -22,9 +22,12 @@ * External interface. */ typedef struct CLNT_STREAM CLNT_STREAM; +typedef int (*CLNT_STREAM_HANDSHAKE_FN)(VSTREAM *); -extern CLNT_STREAM *clnt_stream_create(const char *, const char *, int, int); +extern CLNT_STREAM *clnt_stream_create(const char *, const char *, int, int, + CLNT_STREAM_HANDSHAKE_FN); extern VSTREAM *clnt_stream_access(CLNT_STREAM *); +extern const char *clnt_stream_path(CLNT_STREAM *); extern void clnt_stream_recover(CLNT_STREAM *); extern void clnt_stream_free(CLNT_STREAM *); @@ -37,6 +40,11 @@ extern void clnt_stream_free(CLNT_STREAM *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/external/ibm-public/postfix/dist/src/global/compat_level.c b/external/ibm-public/postfix/dist/src/global/compat_level.c new file mode 100644 index 00000000000..7b8b0e34555 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/compat_level.c @@ -0,0 +1,463 @@ +/* $NetBSD: compat_level.c,v 1.1.1.1 2022/10/08 16:09:07 christos Exp $ */ + +/*++ +/* NAME +/* compat_level 3 +/* SUMMARY +/* compatibility_level support +/* SYNOPSIS +/* #include <compat_level.h> +/* +/* void compat_level_relop_register(void) +/* +/* long compat_level_from_string( +/* const char *str, +/* void PRINTFLIKE(1, 2) (*msg_fn)(const char *,...)) +/* +/* long compat_level_from_numbers( +/* long major, +/* long minor, +/* long patch, +/* void PRINTFLIKE(1, 2) (*msg_fn)(const char *,...)) +/* +/* const char *compat_level_to_string( +/* long compat_level, +/* void PRINTFLIKE(1, 2) (*msg_fn)(const char *,...)) +/* AUXULIARY FUNCTIONS +/* long compat_level_from_major_minor( +/* long major, +/* long minor, +/* void PRINTFLIKE(1, 2) (*msg_fn)(const char *,...)) +/* +/* long compat_level_from_major( +/* long major, +/* void PRINTFLIKE(1, 2) (*msg_fn)(const char *,...)) +/* DESCRIPTION +/* This module supports compatibility level syntax with +/* "major.minor.patch" but will also accept the shorter forms +/* "major.minor" and "major" (missing members default to zero). +/* Compatibility levels with multiple numbers cannot be compared +/* as strings or as floating-point numbers (for example, "3.10" +/* would be smaller than "3.9"). +/* +/* The major number can range from [0..2047] inclusive (11 +/* bits) or more, while the minor and patch numbers can range +/* from [0..1023] inclusive (10 bits). +/* +/* compat_level_from_string() converts a compatibility level +/* from string form to numerical form for easy comparison. +/* Valid input results in a non-negative result. In case of +/* error, compat_level_from_string() reports the problem with +/* the provided function, and returns -1 if that function does +/* not terminate execution. +/* +/* compat_level_from_numbers() creates an internal-form +/* compatibility level from distinct numbers. Valid input +/* results in a non-negative result. In case of error, +/* compat_level_from_numbers() reports the problem with the +/* provided function, and returns -1 if that function does not +/* terminate execution. +/* +/* The functions compat_level_from_major_minor() and +/* compat_level_from_major() are helpers that default the missing +/* information to zeroes. +/* +/* compat_level_to_string() converts a compatibility level +/* from numerical form to canonical string form. Valid input +/* results in a non-null result. In case of error, +/* compat_level_to_string() reports the problem with the +/* provided function, and returns a null pointer if that +/* function does not terminate execution. +/* +/* compat_level_relop_register() registers a mac_expand() callback +/* that registers operators such as <=level, >level, that compare +/* compatibility levels. This function should be called before +/* loading parameter settings from main.cf. +/* DIAGNOSTICS +/* info, .., panic: bad compatibility_level syntax. +/* BUGS +/* The patch and minor fields range from 0..1023 (10 bits) while +/* the major field ranges from 0..COMPAT_MAJOR_SHIFT47 or more +/* (11 bits or more). +/* +/* This would be a great use case for functions returning +/* StatusOr<compat_level_t> or StatusOr<string>, but is it a bit +/* late for a port to C++. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library. + */ +#include <sys_defs.h> +#include <stdio.h> +#include <stdlib.h> +#include <errno.h> +#include <limits.h> + + /* + * Utility library. + */ +#include <mac_expand.h> +#include <msg.h> +#include <sane_strtol.h> + + /* + * For easy comparison we convert a three-number compatibility level into + * just one number, using different bit ranges for the major version, minor + * version, and patch level. + * + * We use long integers because standard C guarantees that long has at last 32 + * bits instead of int which may have only 16 bits (though it is unlikely + * that Postfix would run on such systems). That gives us 11 or more bits + * for the major version, and 10 bits for minor the version and patchlevel. + * + * Below are all the encoding details in one place. This is easier to verify + * than wading through code. + */ +#define COMPAT_MAJOR_SHIFT \ + (COMPAT_MINOR_SHIFT + COMPAT_MINOR_WIDTH) + +#define COMPAT_MINOR_SHIFT COMPAT_PATCH_WIDTH +#define COMPAT_MINOR_BITS 0x3ff +#define COMPAT_MINOR_WIDTH 10 + +#define COMPAT_PATCH_BITS 0x3ff +#define COMPAT_PATCH_WIDTH 10 + +#define GOOD_MAJOR(m) ((m) >= 0 && (m) <= (LONG_MAX >> COMPAT_MAJOR_SHIFT)) +#define GOOD_MINOR(m) ((m) >= 0 && (m) <= COMPAT_MINOR_BITS) +#define GOOD_PATCH(p) ((p) >= 0 && (p) <= COMPAT_PATCH_BITS) + +#define ENCODE_MAJOR(m) ((m) << COMPAT_MAJOR_SHIFT) +#define ENCODE_MINOR(m) ((m) << COMPAT_MINOR_SHIFT) +#define ENCODE_PATCH(p) (p) + +#define DECODE_MAJOR(l) ((l) >> COMPAT_MAJOR_SHIFT) +#define DECODE_MINOR(l) (((l) >> COMPAT_MINOR_SHIFT) & COMPAT_MINOR_BITS) +#define DECODE_PATCH(l) ((l) & COMPAT_PATCH_BITS) + + /* + * Global library. + */ +#include <compat_level.h> + +/* compat_level_from_string - convert major[.minor] to comparable type */ + +long compat_level_from_string(const char *str, + void PRINTFLIKE(1, 2) (*msg_fn) (const char *,...)) +{ + long major, minor, patch, res = 0; + const char *start; + char *remainder; + + start = str; + major = sane_strtol(start, &remainder, 10); + if (start < remainder && (*remainder == 0 || *remainder == '.') + && errno != ERANGE && GOOD_MAJOR(major)) { + res = ENCODE_MAJOR(major); + if (*remainder == 0) + return res; + start = remainder + 1; + minor = sane_strtol(start, &remainder, 10); + if (start < remainder && (*remainder == 0 || *remainder == '.') + && errno != ERANGE && GOOD_MINOR(minor)) { + res |= ENCODE_MINOR(minor); + if (*remainder == 0) + return (res); + start = remainder + 1; + patch = sane_strtol(start, &remainder, 10); + if (start < remainder && *remainder == 0 && errno != ERANGE + && GOOD_PATCH(patch)) { + return (res | ENCODE_PATCH(patch)); + } + } + } + msg_fn("malformed compatibility level syntax: \"%s\"", str); + return (-1); +} + +/* compat_level_from_numbers - internal form from numbers */ + +long compat_level_from_numbers(long major, long minor, long patch, + void PRINTFLIKE(1, 2) (*msg_fn) (const char *,...)) +{ + const char myname[] = "compat_level_from_numbers"; + + /* + * Sanity checks. + */ + if (!GOOD_MAJOR(major)) { + msg_fn("%s: bad major version: %ld", myname, major); + return (-1); + } + if (!GOOD_MINOR(minor)) { + msg_fn("%s: bad minor version: %ld", myname, minor); + return (-1); + } + if (!GOOD_PATCH(patch)) { + msg_fn("%s: bad patch level: %ld", myname, patch); + return (-1); + } + + /* + * Conversion. + */ + return (ENCODE_MAJOR(major) | ENCODE_MINOR(minor) | ENCODE_PATCH(patch)); +} + +/* compat_level_to_string - pretty-print a compatibility level */ + +const char *compat_level_to_string(long compat_level, + void PRINTFLIKE(1, 2) (*msg_fn) (const char *,...)) +{ + const char myname[] = "compat_level_to_string"; + static VSTRING *buf; + long major; + long minor; + long patch; + + /* + * Sanity check. + */ + if (compat_level < 0) { + msg_fn("%s: bad compatibility level: %ld", myname, compat_level); + return (0); + } + + /* + * Compatibility levels 0..2 have no minor or patch level. + */ + if (buf == 0) + buf = vstring_alloc(10); + major = DECODE_MAJOR(compat_level); + if (!GOOD_MAJOR(major)) { + msg_fn("%s: bad compatibility major level: %ld", myname, compat_level); + return (0); + } + vstring_sprintf(buf, "%ld", major); + if (major > 2) { + + /* + * Expect that major.minor will be common. + */ + minor = DECODE_MINOR(compat_level); + vstring_sprintf_append(buf, ".%ld", minor); + + /* + * Expect that major.minor.patch will be rare. + */ + patch = DECODE_PATCH(compat_level); + if (patch) + vstring_sprintf_append(buf, ".%ld", patch); + } + return (vstring_str(buf)); +} + +/* compat_relop_eval - mac_expand callback */ + +static MAC_EXP_OP_RES compat_relop_eval(const char *left_str, int relop, + const char *rite_str) +{ + const char myname[] = "compat_relop_eval"; + long left_val, rite_val; + + /* + * Negative result means error. + */ + if ((left_val = compat_level_from_string(left_str, msg_warn)) < 0 + || (rite_val = compat_level_from_string(rite_str, msg_warn)) < 0) + return (MAC_EXP_OP_RES_ERROR); + + /* + * Valid result. The difference between non-negative numbers will no + * overflow. + */ + long delta = left_val - rite_val; + + switch (relop) { + case MAC_EXP_OP_TOK_EQ: + return (mac_exp_op_res_bool[delta == 0]); + case MAC_EXP_OP_TOK_NE: + return (mac_exp_op_res_bool[delta != 0]); + case MAC_EXP_OP_TOK_LT: + return (mac_exp_op_res_bool[delta < 0]); + case MAC_EXP_OP_TOK_LE: + return (mac_exp_op_res_bool[delta <= 0]); + case MAC_EXP_OP_TOK_GE: + return (mac_exp_op_res_bool[delta >= 0]); + case MAC_EXP_OP_TOK_GT: + return (mac_exp_op_res_bool[delta > 0]); + default: + msg_panic("%s: unknown operator: %d", + myname, relop); + } +} + +/* compat_level_register - register comparison operators */ + +void compat_level_relop_register(void) +{ + int compat_level_relops[] = { + MAC_EXP_OP_TOK_EQ, MAC_EXP_OP_TOK_NE, + MAC_EXP_OP_TOK_GT, MAC_EXP_OP_TOK_GE, + MAC_EXP_OP_TOK_LT, MAC_EXP_OP_TOK_LE, + 0, + }; + static int register_done; + + if (register_done++ == 0) + mac_expand_add_relop(compat_level_relops, "level", compat_relop_eval); +} + +#ifdef TEST +#include <unistd.h> + +#include <htable.h> +#include <mymalloc.h> +#include <stringops.h> +#include <vstring.h> +#include <vstream.h> +#include <vstring_vstream.h> + +static const char *lookup(const char *name, int unused_mode, void *context) +{ + HTABLE *table = (HTABLE *) context; + + return (htable_find(table, name)); +} + +static void test_expand(void) +{ + VSTRING *buf = vstring_alloc(100); + VSTRING *result = vstring_alloc(100); + char *cp; + char *name; + char *value; + HTABLE *table; + int stat; + + /* + * Add relops that compare string lengths instead of content. + */ + compat_level_relop_register(); + + /* + * Loop over the inputs. + */ + while (!vstream_feof(VSTREAM_IN)) { + + table = htable_create(0); + + /* + * Read a block of definitions, terminated with an empty line. + */ + while (vstring_get_nonl(buf, VSTREAM_IN) != VSTREAM_EOF) { + vstream_printf("<< %s\n", vstring_str(buf)); + vstream_fflush(VSTREAM_OUT); + if (VSTRING_LEN(buf) == 0) + break; + cp = vstring_str(buf); + name = mystrtok(&cp, CHARS_SPACE "="); + value = mystrtok(&cp, CHARS_SPACE "="); + htable_enter(table, name, value ? mystrdup(value) : 0); + } + + /* + * Read a block of patterns, terminated with an empty line or EOF. + */ + while (vstring_get_nonl(buf, VSTREAM_IN) != VSTREAM_EOF) { + vstream_printf("<< %s\n", vstring_str(buf)); + vstream_fflush(VSTREAM_OUT); + if (VSTRING_LEN(buf) == 0) + break; + VSTRING_RESET(result); + stat = mac_expand(result, vstring_str(buf), MAC_EXP_FLAG_NONE, + (char *) 0, lookup, (void *) table); + vstream_printf("stat=%d result=%s\n", stat, vstring_str(result)); + vstream_fflush(VSTREAM_OUT); + } + htable_free(table, myfree); + vstream_printf("\n"); + } + + /* + * Clean up. + */ + vstring_free(buf); + vstring_free(result); +} + +static void test_convert(void) +{ + VSTRING *buf = vstring_alloc(100); + long compat_level; + const char *as_string; + + /* + * Read compatibility level. + */ + while (vstring_get_nonl(buf, VSTREAM_IN) != VSTREAM_EOF) { + if ((compat_level = compat_level_from_string(vstring_str(buf), + msg_warn)) < 0) + continue; + msg_info("%s -> 0x%lx", vstring_str(buf), compat_level); + errno = ERANGE; + if ((as_string = compat_level_to_string(compat_level, + msg_warn)) == 0) + continue; + msg_info("0x%lx->%s", compat_level, as_string); + } + vstring_free(buf); +} + +static NORETURN usage(char **argv) +{ + msg_fatal("usage: %s option\n-c (convert)\n-c (expand)", argv[0]); +} + +int main(int argc, char **argv) +{ + int ch; + int mode = 0; + +#define MODE_EXPAND (1<<0) +#define MODE_CONVERT (1<<1) + + while ((ch = GETOPT(argc, argv, "cx")) > 0) { + switch (ch) { + case 'c': + mode |= MODE_CONVERT; + break; + case 'v': + msg_verbose++; + break; + case 'x': + mode |= MODE_EXPAND; + break; + default: + usage(argv); + } + } + switch (mode) { + case MODE_CONVERT: + test_convert(); + break; + case MODE_EXPAND: + test_expand(); + break; + default: + usage(argv); + } + exit(0); +} + +#endif diff --git a/external/ibm-public/postfix/dist/src/global/compat_level.h b/external/ibm-public/postfix/dist/src/global/compat_level.h new file mode 100644 index 00000000000..0a5a3d80835 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/compat_level.h @@ -0,0 +1,45 @@ +/* $NetBSD: compat_level.h,v 1.1.1.1 2022/10/08 16:09:07 christos Exp $ */ + +#ifndef _COMPAT_LEVEL_H_INCLUDED_ +#define _COMPAT_LEVEL_H_INCLUDED_ + +/*++ +/* NAME +/* compat_level 3h +/* SUMMARY +/* compatibility_level support +/* SYNOPSIS +/* #include <compat_level.h> +/* DESCRIPTION +/* .nf + + /* + * External interface. + */ +extern void compat_level_relop_register(void); +extern long compat_level_from_string(const char *, + void PRINTFLIKE(1, 2) (*) (const char *,...)); +extern long compat_level_from_numbers(long, long, long, + void PRINTFLIKE(1, 2) (*) (const char *,...)); +extern const char *compat_level_to_string(long, + void PRINTFLIKE(1, 2) (*) (const char *,...)); + +#define compat_level_from_major(major, msg_fn) \ + compat_level_from_major_minor((major), 0, (msg_fn)) +#define compat_level_from_major_minor(major, minor, msg_fn) \ + compat_level_from_numbers((major), (minor), 0, (msg_fn)) + +# + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#endif diff --git a/external/ibm-public/postfix/dist/src/global/compat_level_convert.in b/external/ibm-public/postfix/dist/src/global/compat_level_convert.in new file mode 100644 index 00000000000..e7cec78b555 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/compat_level_convert.in @@ -0,0 +1,22 @@ +3.2.1 +3.2.1.0 +3a.2.1 +a3.2.1 +3.a2.1 +3.2a.1 +3.2a.a1 +3.2a.1a +3 +3. +3.2. +3.1.1. +2 +1 +0 +3.1023 +3.1024 +3.2.1023 +3.2.1024 +-3 +3.-2.1 +3.2.-1 diff --git a/external/ibm-public/postfix/dist/src/global/compat_level_convert.ref b/external/ibm-public/postfix/dist/src/global/compat_level_convert.ref new file mode 100644 index 00000000000..17f29dca49c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/compat_level_convert.ref @@ -0,0 +1,29 @@ +unknown: 3.2.1 -> 0x300801 +unknown: 0x300801->3.2.1 +unknown: warning: malformed compatibility level syntax: "3.2.1.0" +unknown: warning: malformed compatibility level syntax: "3a.2.1" +unknown: warning: malformed compatibility level syntax: "a3.2.1" +unknown: warning: malformed compatibility level syntax: "3.a2.1" +unknown: warning: malformed compatibility level syntax: "3.2a.1" +unknown: warning: malformed compatibility level syntax: "3.2a.a1" +unknown: warning: malformed compatibility level syntax: "3.2a.1a" +unknown: 3 -> 0x300000 +unknown: 0x300000->3.0 +unknown: warning: malformed compatibility level syntax: "3." +unknown: warning: malformed compatibility level syntax: "3.2." +unknown: warning: malformed compatibility level syntax: "3.1.1." +unknown: 2 -> 0x200000 +unknown: 0x200000->2 +unknown: 1 -> 0x100000 +unknown: 0x100000->1 +unknown: 0 -> 0x0 +unknown: 0x0->0 +unknown: 3.1023 -> 0x3ffc00 +unknown: 0x3ffc00->3.1023 +unknown: warning: malformed compatibility level syntax: "3.1024" +unknown: 3.2.1023 -> 0x300bff +unknown: 0x300bff->3.2.1023 +unknown: warning: malformed compatibility level syntax: "3.2.1024" +unknown: warning: malformed compatibility level syntax: "-3" +unknown: warning: malformed compatibility level syntax: "3.-2.1" +unknown: warning: malformed compatibility level syntax: "3.2.-1" diff --git a/external/ibm-public/postfix/dist/src/global/compat_level_expand.in b/external/ibm-public/postfix/dist/src/global/compat_level_expand.in new file mode 100644 index 00000000000..0f5208bfa67 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/compat_level_expand.in @@ -0,0 +1,27 @@ +compatibility_level = 3 + +${ {$compatibility_level} ==level {3.0} ? {good} : {bad} } +${ {$compatibility_level} !=level {3.0} ? {bad} : {good} } +${ {$compatibility_level} ==level {3.10} ? {bad} : {good} } +${ {$compatibility_level} !=level {3.10} ? {good} : {bad} } +${ {$compatibility_level} <level {4} ? {good} : {bad} } +${ {$compatibility_level} <=level {4} ? {good} : {bad} } +${ {$compatibility_level} <level {2} ? {bad} : {good} } +${ {$compatibility_level} <=level {2} ? {bad} : {good} } +${ {$compatibility_level} <=level {3.0} ? {good} : {bad} } +${ {$compatibility_level} >level {4} ? {bad} : {good} } +${ {$compatibility_level} >=level {4} ? {bad} : {good} } +${ {$compatibility_level} >level {2} ? {good} : {bad} } +${ {$compatibility_level} >=level {2} ? {good} : {bad} } +${ {$compatibility_level} >=level {3.0} ? {good} : {bad} } +${ {$compatibility_level} >=level {3A} ? {error} : {error} } +${ {$compatibility_level} >=level {3.} ? {error} : {error} } +${ {$compatibility_level} >=level {.1} ? {error} : {error} } +${ {3} > {3.2} ? {bad} : {good} } +${ {3} >level {3.2} ? {bad} : {good} } +${ {3} < {3.2} ? {good} : {bad} } +${ {3} <level {3.2} ? {good} : {bad} } +${ {3.10} > {3.2} ? {bad} : {good} } +${ {3.10} >level {3.2} ? {good} : {bad} } +${ {3.10} < {3.2} ? {good} : {bad} } +${ {3.10} <level {3.2} ? {bad} : {good} } diff --git a/external/ibm-public/postfix/dist/src/global/compat_level_expand.ref b/external/ibm-public/postfix/dist/src/global/compat_level_expand.ref new file mode 100644 index 00000000000..bd1836b2362 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/compat_level_expand.ref @@ -0,0 +1,55 @@ +<< compatibility_level = 3 +<< +<< ${ {$compatibility_level} ==level {3.0} ? {good} : {bad} } +stat=0 result=good +<< ${ {$compatibility_level} !=level {3.0} ? {bad} : {good} } +stat=0 result=good +<< ${ {$compatibility_level} ==level {3.10} ? {bad} : {good} } +stat=0 result=good +<< ${ {$compatibility_level} !=level {3.10} ? {good} : {bad} } +stat=0 result=good +<< ${ {$compatibility_level} <level {4} ? {good} : {bad} } +stat=0 result=good +<< ${ {$compatibility_level} <=level {4} ? {good} : {bad} } +stat=0 result=good +<< ${ {$compatibility_level} <level {2} ? {bad} : {good} } +stat=0 result=good +<< ${ {$compatibility_level} <=level {2} ? {bad} : {good} } +stat=0 result=good +<< ${ {$compatibility_level} <=level {3.0} ? {good} : {bad} } +stat=0 result=good +<< ${ {$compatibility_level} >level {4} ? {bad} : {good} } +stat=0 result=good +<< ${ {$compatibility_level} >=level {4} ? {bad} : {good} } +stat=0 result=good +<< ${ {$compatibility_level} >level {2} ? {good} : {bad} } +stat=0 result=good +<< ${ {$compatibility_level} >=level {2} ? {good} : {bad} } +stat=0 result=good +<< ${ {$compatibility_level} >=level {3.0} ? {good} : {bad} } +stat=0 result=good +<< ${ {$compatibility_level} >=level {3A} ? {error} : {error} } +unknown: warning: malformed compatibility level syntax: "3A" +stat=1 result= +<< ${ {$compatibility_level} >=level {3.} ? {error} : {error} } +unknown: warning: malformed compatibility level syntax: "3." +stat=1 result= +<< ${ {$compatibility_level} >=level {.1} ? {error} : {error} } +unknown: warning: malformed compatibility level syntax: ".1" +stat=1 result= +<< ${ {3} > {3.2} ? {bad} : {good} } +stat=0 result=good +<< ${ {3} >level {3.2} ? {bad} : {good} } +stat=0 result=good +<< ${ {3} < {3.2} ? {good} : {bad} } +stat=0 result=good +<< ${ {3} <level {3.2} ? {good} : {bad} } +stat=0 result=good +<< ${ {3.10} > {3.2} ? {bad} : {good} } +stat=0 result=good +<< ${ {3.10} >level {3.2} ? {good} : {bad} } +stat=0 result=good +<< ${ {3.10} < {3.2} ? {good} : {bad} } +stat=0 result=good +<< ${ {3.10} <level {3.2} ? {bad} : {good} } +stat=0 result=good diff --git a/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.c b/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.c new file mode 100644 index 00000000000..7d993a2fbcb --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.c @@ -0,0 +1,259 @@ +/* $NetBSD: config_known_tcp_ports.c,v 1.1.1.1 2022/10/08 16:09:07 christos Exp $ */ + +/*++ +/* NAME +/* config_known_tcp_ports 3 +/* SUMMARY +/* parse and store known TCP port configuration +/* SYNOPSIS +/* #include <config_known_tcp_ports.h> +/* +/* void config_known_tcp_ports( +/* const char *source, +/* const char *settings); +/* DESCRIPTION +/* config_known_tcp_ports() parses the known TCP port information +/* in the settings argument, and reports any warnings to the standard +/* error stream. The source argument is used to provide warning +/* context. It typically is a configuration parameter name. +/* .SH EXPECTED SYNTAX (ABNF) +/* configuration = empty | name-to-port *("," name-to-port) +/* name-to-port = 1*(name "=") port +/* SH EXAMPLES +/* In the example below, the whitespace is optional. +/* smtp = 25, smtps = submissions = 465, submission = 587 +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library. + */ +#include <sys_defs.h> + + /* + * Utility library. + */ +#include <argv.h> +#include <known_tcp_ports.h> +#include <msg.h> +#include <mymalloc.h> +#include <stringops.h> + + /* + * Application-specific. + */ +#include <config_known_tcp_ports.h> + +/* config_known_tcp_ports - parse configuration and store associations */ + +void config_known_tcp_ports(const char *source, const char *settings) +{ + ARGV *associations; + ARGV *association; + char **cpp; + + clear_known_tcp_ports(); + + /* + * The settings is in the form of associations separated by comma. Split + * it into separate associations. + */ + associations = argv_split(settings, ","); + if (associations->argc == 0) { + argv_free(associations); + return; + } + + /* + * Each association is in the form of "1*(name =) port". We use + * argv_split() to carve this up, then we use mystrtok() to validate the + * individual fragments. But first we prepend and append space so that we + * get sensible results when an association starts or ends in "=". + */ + for (cpp = associations->argv; *cpp != 0; cpp++) { + char *temp = concatenate(" ", *cpp, " ", (char *) 0); + + association = argv_split_at(temp, '='); + myfree(temp); + + if (association->argc == 0) { + /* empty, ignore */ ; + } else if (association->argc == 1) { + msg_warn("%s: in \"%s\" is not in \"name = value\" form", + source, *cpp); + } else { + char *bp; + char *lhs; + char *rhs; + const char *err = 0; + int n; + + bp = association->argv[association->argc - 1]; + if ((rhs = mystrtok(&bp, CHARS_SPACE)) == 0) { + err = "missing port value after \"=\""; + } else if (mystrtok(&bp, CHARS_SPACE) != 0) { + err = "whitespace in port number"; + } else { + for (n = 0; n < association->argc - 1; n++) { + const char *new_err; + + bp = association->argv[n]; + if ((lhs = mystrtok(&bp, CHARS_SPACE)) == 0) { + new_err = "missing service name before \"=\""; + } else if (mystrtok(&bp, CHARS_SPACE) != 0) { + new_err = "whitespace in service name"; + } else { + new_err = add_known_tcp_port(lhs, rhs); + } + if (new_err != 0 && err == 0) + err = new_err; + } + } + if (err != 0) { + msg_warn("%s: in \"%s\": %s", source, *cpp, err); + } + } + argv_free(association); + } + argv_free(associations); +} + +#ifdef TEST + +#include <stdlib.h> +#include <string.h> +#include <msg_vstream.h> + +#define STR(x) vstring_str(x) + + /* TODO(wietse) make this a proper VSTREAM interface */ + +/* vstream_swap - kludge to capture output for testing */ + +static void vstream_swap(VSTREAM *one, VSTREAM *two) +{ + VSTREAM save; + + save = *one; + *one = *two; + *two = save; +} + +struct test_case { + const char *label; /* identifies test case */ + const char *config; /* configuration under test */ + const char *exp_warning; /* expected warning or null */ + const char *exp_export; /* expected export or null */ +}; + +static struct test_case test_cases[] = { + {"good", + /* config */ "smtp = 25, smtps = submissions = 465, lmtp = 24", + /* warning */ "", + /* export */ "lmtp=24 smtp=25 smtps=465 submissions=465" + }, + {"equal-equal", + /* config */ "smtp = 25, smtps == submissions = 465, lmtp = 24", + /* warning */ "config_known_tcp_ports: warning: equal-equal: " + "in \" smtps == submissions = 465\": missing service name before " + "\"=\"\n", + /* export */ "lmtp=24 smtp=25 smtps=465 submissions=465" + }, + {"port test 1", + /* config */ "smtps = submission =", + /* warning */ "config_known_tcp_ports: warning: port test 1: " + "in \"smtps = submission =\": missing port value after \"=\"\n", + /* export */ "" + }, + {"port test 2", + /* config */ "smtps = submission = 4 65", + /* warning */ "config_known_tcp_ports: warning: port test 2: " + "in \"smtps = submission = 4 65\": whitespace in port number\n", + /* export */ "" + }, + {"port test 3", + /* config */ "lmtp = 24, smtps = submission = foo", + /* warning */ "config_known_tcp_ports: warning: port test 3: " + "in \" smtps = submission = foo\": non-numerical service port\n", + /* export */ "lmtp=24" + }, + {"service name test 1", + /* config */ "smtps = sub mission = 465", + /* warning */ "config_known_tcp_ports: warning: service name test 1: " + "in \"smtps = sub mission = 465\": whitespace in service name\n", + /* export */ "smtps=465" + }, + {"service name test 2", + /* config */ "lmtp = 24, smtps = 1234 = submissions = 465", + /* warning */ "config_known_tcp_ports: warning: service name test 2: " + "in \" smtps = 1234 = submissions = 465\": numerical service name\n", + /* export */ "lmtp=24 smtps=465 submissions=465" + }, + 0, +}; + +int main(int argc, char **argv) +{ + VSTRING *export_buf; + struct test_case *tp; + int pass = 0; + int fail = 0; + int test_failed; + const char *export; + VSTRING *msg_buf; + VSTREAM *memory_stream; + +#define STRING_OR_NULL(s) ((s) ? (s) : "(null)") + + msg_vstream_init("config_known_tcp_ports", VSTREAM_ERR); + + export_buf = vstring_alloc(100); + msg_buf = vstring_alloc(100); + for (tp = test_cases; tp->label != 0; tp++) { + test_failed = 0; + if ((memory_stream = vstream_memopen(msg_buf, O_WRONLY)) == 0) + msg_fatal("open memory stream: %m"); + vstream_swap(VSTREAM_ERR, memory_stream); + config_known_tcp_ports(tp->label, tp->config); + vstream_swap(memory_stream, VSTREAM_ERR); + if (vstream_fclose(memory_stream)) + msg_fatal("close memory stream: %m"); + if (strcmp(STR(msg_buf), tp->exp_warning) != 0) { + msg_warn("test case %s: got error: \"%s\", want: \"%s\"", + tp->label, STR(msg_buf), + STRING_OR_NULL(tp->exp_warning)); + test_failed = 1; + } else { + export = export_known_tcp_ports(export_buf); + if (strcmp(export, tp->exp_export) != 0) { + msg_warn("test case %s: got export: \"%s\", want: \"%s\"", + tp->label, export, tp->exp_export); + test_failed = 1; + } + clear_known_tcp_ports(); + VSTRING_RESET(msg_buf); + VSTRING_TERMINATE(msg_buf); + } + if (test_failed) { + msg_info("%s: FAIL", tp->label); + fail++; + } else { + msg_info("%s: PASS", tp->label); + pass++; + } + } + msg_info("PASS=%d FAIL=%d", pass, fail); + vstring_free(msg_buf); + vstring_free(export_buf); + exit(fail != 0); +} + +#endif diff --git a/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.h b/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.h new file mode 100644 index 00000000000..b579db34f40 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.h @@ -0,0 +1,32 @@ +/* $NetBSD: config_known_tcp_ports.h,v 1.1.1.1 2022/10/08 16:09:07 christos Exp $ */ + +#ifndef _CONFIG_KNOWN_TCP_PORTS_H_INCLUDED_ +#define _CONFIG_KNOWN_TCP_PORTS_H_INCLUDED_ + +/*++ +/* NAME +/* config_known_tcp_ports 3h +/* SUMMARY +/* parse and store known TCP port configuration +/* SYNOPSIS +/* #include <config_known_tcp_ports.h> +/* DESCRIPTION +/* .nf + + /* + * External interface. + */ +extern void config_known_tcp_ports(const char *source, const char *settings); + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#endif diff --git a/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.ref b/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.ref new file mode 100644 index 00000000000..5a35677f0c3 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.ref @@ -0,0 +1,8 @@ +config_known_tcp_ports: good: PASS +config_known_tcp_ports: equal-equal: PASS +config_known_tcp_ports: port test 1: PASS +config_known_tcp_ports: port test 2: PASS +config_known_tcp_ports: port test 3: PASS +config_known_tcp_ports: service name test 1: PASS +config_known_tcp_ports: service name test 2: PASS +config_known_tcp_ports: PASS=7 FAIL=0 diff --git a/external/ibm-public/postfix/dist/src/global/delivered_hdr.ref b/external/ibm-public/postfix/dist/src/global/delivered_hdr.ref new file mode 100644 index 00000000000..1e71d578724 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/delivered_hdr.ref @@ -0,0 +1,3 @@ +./delivered_hdr: test case: L >Delivered-To: one<: PASS (expected: MATCH) +./delivered_hdr: test case: N >Delivered-To: two<: PASS (expected: NO MATCH) +./delivered_hdr: test case: N >Delivered-To: three<: PASS (expected: MATCH) diff --git a/external/ibm-public/postfix/dist/src/global/dsb_scan.h b/external/ibm-public/postfix/dist/src/global/dsb_scan.h index 629d6bd2bd8..e4a9f8359d7 100644 --- a/external/ibm-public/postfix/dist/src/global/dsb_scan.h +++ b/external/ibm-public/postfix/dist/src/global/dsb_scan.h @@ -1,4 +1,4 @@ -/* $NetBSD: dsb_scan.h,v 1.1.1.1 2009/06/23 10:08:45 tron Exp $ */ +/* $NetBSD: dsb_scan.h,v 1.1.1.2 2022/10/08 16:09:07 christos Exp $ */ #ifndef _DSB_SCAN_H_INCLUDED_ #define _DSB_SCAN_H_INCLUDED_ @@ -27,7 +27,7 @@ /* * External interface. */ -extern int dsb_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *); +extern int dsb_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); /* LICENSE /* .ad @@ -38,6 +38,11 @@ extern int dsb_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/external/ibm-public/postfix/dist/src/global/dsn_print.h b/external/ibm-public/postfix/dist/src/global/dsn_print.h index 59bc3596397..020116c505c 100644 --- a/external/ibm-public/postfix/dist/src/global/dsn_print.h +++ b/external/ibm-public/postfix/dist/src/global/dsn_print.h @@ -1,4 +1,4 @@ -/* $NetBSD: dsn_print.h,v 1.1.1.1 2009/06/23 10:08:45 tron Exp $ */ +/* $NetBSD: dsn_print.h,v 1.1.1.2 2022/10/08 16:09:07 christos Exp $ */ #ifndef _DSN_PRINT_H_INCLUDED_ #define _DSN_PRINT_H_INCLUDED_ @@ -27,7 +27,7 @@ /* * External interface. */ -extern int dsn_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *); +extern int dsn_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); /* LICENSE /* .ad @@ -38,6 +38,11 @@ extern int dsn_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/external/ibm-public/postfix/dist/src/global/hfrom_format.c b/external/ibm-public/postfix/dist/src/global/hfrom_format.c new file mode 100644 index 00000000000..86e19791683 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/hfrom_format.c @@ -0,0 +1,283 @@ +/* $NetBSD: hfrom_format.c,v 1.1.1.1 2022/10/08 16:09:07 christos Exp $ */ + +/*++ +/* NAME +/* hfrom_format 3 +/* SUMMARY +/* Parse a header_from_format setting +/* SYNOPSIS +/* #include <hfrom_format.h> +/* +/* int hfrom_format_parse( +/* const char *name, +/* const char *value) +/* +/* const char *str_hfrom_format_code(int code) +/* DESCRIPTION +/* hfrom_format_parse() takes a parameter name (used for +/* diagnostics) and value, and maps it to the corresponding +/* code: HFROM_FORMAT_NAME_STD maps to HFROM_FORMAT_CODE_STD, +/* and HFROM_FORMAT_NAME_OBS maps to HFROM_FORMAT_CODE_OBS. +/* +/* str_hfrom_format_code() does the reverse mapping. +/* DIAGNOSTICS +/* All input errors are fatal. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library. + */ +#include <sys_defs.h> + + /* + * Utility library. + */ +#include <name_code.h> +#include <msg.h> + + /* + * Global library. + */ +#include <mail_params.h> + + /* + * Application-specific. + */ +#include <hfrom_format.h> + + /* + * Primitive dependency injection. + */ +#ifdef TEST +extern NORETURN PRINTFLIKE(1, 2) test_msg_fatal(const char *,...); + +#define msg_fatal test_msg_fatal +#endif + + /* + * The name-to-code mapping. + */ +static const NAME_CODE hfrom_format_table[] = { + HFROM_FORMAT_NAME_STD, HFROM_FORMAT_CODE_STD, + HFROM_FORMAT_NAME_OBS, HFROM_FORMAT_CODE_OBS, + 0, -1, +}; + +/* hfrom_format_parse - parse header_from_format setting */ + +int hfrom_format_parse(const char *name, const char *value) +{ + int code; + + if ((code = name_code(hfrom_format_table, NAME_CODE_FLAG_NONE, value)) < 0) + msg_fatal("invalid setting: \"%s = %s\"", name, value); + return (code); +} + +/* str_hfrom_format_code - convert code to string */ + +const char *str_hfrom_format_code(int code) +{ + const char *name; + + if ((name = str_name_code(hfrom_format_table, code)) == 0) + msg_fatal("invalid header format code: %d", code); + return (name); +} + +#ifdef TEST +#include <stdlib.h> +#include <setjmp.h> +#include <string.h> + +#include <vstream.h> +#include <vstring.h> +#include <msg_vstream.h> + +#define STR(x) vstring_str(x) + + /* + * TODO(wietse) make this a proper VSTREAM interface. Instead of temporarily + * swapping streams, we could temporarily swap the stream's write function. + */ + +/* vstream_swap - kludge to capture output for testing */ + +static void vstream_swap(VSTREAM *one, VSTREAM *two) +{ + VSTREAM save; + + save = *one; + *one = *two; + *two = save; +} + +jmp_buf test_fatal_jbuf; + +#undef msg_fatal + +/* test_msg_fatal - does not return, and does not terminate */ + +void test_msg_fatal(const char *fmt,...) +{ + va_list ap; + + va_start(ap, fmt); + vmsg_warn(fmt, ap); + va_end(ap); + longjmp(test_fatal_jbuf, 1); +} + +struct name_test_case { + const char *label; /* identifies test case */ + const char *config; /* configuration under test */ + const char *exp_warning; /* expected warning or empty */ + const int exp_code; /* expected code */ +}; + +static struct name_test_case name_test_cases[] = { + {"hfrom_format_parse good-standard", + /* config */ HFROM_FORMAT_NAME_STD, + /* warning */ "", + /* exp_code */ HFROM_FORMAT_CODE_STD + }, + {"hfrom_format_parse good-obsolete", + /* config */ HFROM_FORMAT_NAME_OBS, + /* warning */ "", + /* exp_code */ HFROM_FORMAT_CODE_OBS + }, + {"hfrom_format_parse bad", + /* config */ "does-not-exist", + /* warning */ "hfrom_format: warning: invalid setting: \"hfrom_format_parse bad = does-not-exist\"\n", + /* code */ 0, + }, + {"hfrom_format_parse empty", + /* config */ "", + /* warning */ "hfrom_format: warning: invalid setting: \"hfrom_format_parse empty = \"\n", + /* code */ 0, + }, + 0, +}; + +struct code_test_case { + const char *label; /* identifies test case */ + int code; /* code under test */ + const char *exp_warning; /* expected warning or empty */ + const char *exp_name; /* expected namme */ +}; + +static struct code_test_case code_test_cases[] = { + {"str_hfrom_format_code good-standard", + /* code */ HFROM_FORMAT_CODE_STD, + /* warning */ "", + /* exp_name */ HFROM_FORMAT_NAME_STD + }, + {"str_hfrom_format_code good-obsolete", + /* code */ HFROM_FORMAT_CODE_OBS, + /* warning */ "", + /* exp_name */ HFROM_FORMAT_NAME_OBS + }, + {"str_hfrom_format_code bad", + /* config */ 12345, + /* warning */ "hfrom_format: warning: invalid header format code: 12345\n", + /* exp_name */ 0 + }, + 0, +}; + +int main(int argc, char **argv) +{ + struct name_test_case *np; + int code; + struct code_test_case *cp; + const char *name; + int pass = 0; + int fail = 0; + int test_failed; + VSTRING *msg_buf; + VSTREAM *memory_stream; + + msg_vstream_init("hfrom_format", VSTREAM_ERR); + msg_buf = vstring_alloc(100); + + for (np = name_test_cases; np->label != 0; np++) { + VSTRING_RESET(msg_buf); + VSTRING_TERMINATE(msg_buf); + test_failed = 0; + if ((memory_stream = vstream_memopen(msg_buf, O_WRONLY)) == 0) + msg_fatal("open memory stream: %m"); + vstream_swap(VSTREAM_ERR, memory_stream); + if (setjmp(test_fatal_jbuf) == 0) + code = hfrom_format_parse(np->label, np->config); + vstream_swap(memory_stream, VSTREAM_ERR); + if (vstream_fclose(memory_stream)) + msg_fatal("close memory stream: %m"); + if (strcmp(STR(msg_buf), np->exp_warning) != 0) { + msg_warn("test case %s: got error: \"%s\", want: \"%s\"", + np->label, STR(msg_buf), np->exp_warning); + test_failed = 1; + } + if (*np->exp_warning == 0) { + if (code != np->exp_code) { + msg_warn("test case %s: got code: \"%d\", want: \"%d\"(%s)", + np->label, code, np->exp_code, + str_hfrom_format_code(np->exp_code)); + test_failed = 1; + } + } + if (test_failed) { + msg_info("%s: FAIL", np->label); + fail++; + } else { + msg_info("%s: PASS", np->label); + pass++; + } + } + + for (cp = code_test_cases; cp->label != 0; cp++) { + VSTRING_RESET(msg_buf); + VSTRING_TERMINATE(msg_buf); + test_failed = 0; + if ((memory_stream = vstream_memopen(msg_buf, O_WRONLY)) == 0) + msg_fatal("open memory stream: %m"); + vstream_swap(VSTREAM_ERR, memory_stream); + if (setjmp(test_fatal_jbuf) == 0) + name = str_hfrom_format_code(cp->code); + vstream_swap(memory_stream, VSTREAM_ERR); + if (vstream_fclose(memory_stream)) + msg_fatal("close memory stream: %m"); + if (strcmp(STR(msg_buf), cp->exp_warning) != 0) { + msg_warn("test case %s: got error: \"%s\", want: \"%s\"", + cp->label, STR(msg_buf), cp->exp_warning); + test_failed = 1; + } else if (*cp->exp_warning == 0) { + if (strcmp(name, cp->exp_name)) { + msg_warn("test case %s: got name: \"%s\", want: \"%s\"", + cp->label, name, cp->exp_name); + test_failed = 1; + } + } + if (test_failed) { + msg_info("%s: FAIL", cp->label); + fail++; + } else { + msg_info("%s: PASS", cp->label); + pass++; + } + } + + msg_info("PASS=%d FAIL=%d", pass, fail); + vstring_free(msg_buf); + exit(fail != 0); +} + +#endif diff --git a/external/ibm-public/postfix/dist/src/global/hfrom_format.h b/external/ibm-public/postfix/dist/src/global/hfrom_format.h new file mode 100644 index 00000000000..bc14b4723fd --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/hfrom_format.h @@ -0,0 +1,36 @@ +/* $NetBSD: hfrom_format.h,v 1.1.1.1 2022/10/08 16:09:07 christos Exp $ */ + +#ifndef _HFROM_FORMAT_INCLUDED_ +#define _HFROM_FORMAT_INCLUDED_ + +/*++ +/* NAME +/* hfrom_format 3h +/* SUMMARY +/* Parse a header_from_format setting +/* SYNOPSIS +/* #include <hfrom_format.h> +/* DESCRIPTION +/* .nf + + /* + * External interface. + */ +#define HFROM_FORMAT_CODE_OBS 0 /* Obsolete */ +#define HFROM_FORMAT_CODE_STD 1 /* Standard */ + +extern int hfrom_format_parse(const char *, const char *); +extern const char *str_hfrom_format_code(int); + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#endif diff --git a/external/ibm-public/postfix/dist/src/global/hfrom_format.ref b/external/ibm-public/postfix/dist/src/global/hfrom_format.ref new file mode 100644 index 00000000000..28ba8708adc --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/hfrom_format.ref @@ -0,0 +1,8 @@ +hfrom_format: hfrom_format_parse good-standard: PASS +hfrom_format: hfrom_format_parse good-obsolete: PASS +hfrom_format: hfrom_format_parse bad: PASS +hfrom_format: hfrom_format_parse empty: PASS +hfrom_format: str_hfrom_format_code good-standard: PASS +hfrom_format: str_hfrom_format_code good-obsolete: PASS +hfrom_format: str_hfrom_format_code bad: PASS +hfrom_format: PASS=7 FAIL=0 diff --git a/external/ibm-public/postfix/dist/src/global/login_sender_match.c b/external/ibm-public/postfix/dist/src/global/login_sender_match.c new file mode 100644 index 00000000000..e1e8bb7dd8c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/login_sender_match.c @@ -0,0 +1,366 @@ +/* $NetBSD: login_sender_match.c,v 1.1.1.1 2022/10/08 16:09:07 christos Exp $ */ + +/*++ +/* NAME +/* login_sender_match 3 +/* SUMMARY +/* match login and sender against (login, sender) patterns +/* SYNOPSIS +/* #include <login_sender.h> +/* +/* typedef LOGIN_SENDER_MATCH LOGIN_SENDER_MATCH; +/* +/* LOGIN_SENDER_MATCH *login_sender_create( +/* const char *title, +/* const char *map_names, +/* const char *ext_delimiters, +/* const char *null_sender, +/* const char *wildcard) +/* +/* void login_sender_free( +/* LOGIN_SENDER_MATCH *lsm) +/* +/* int login_sender_match( +/* LOGIN_SENDER_MATCH *lsm, +/* const char *login_name, +/* const char *sender_addr) +/* DESCRIPTION +/* This module determines if a login name and internal-form +/* sender address match a (login name, external-form sender +/* patterns) table entry. A login name matches if it matches +/* a lookup table key. A sender address matches the corresponding +/* table entry if it matches a sender pattern. A wildcard +/* sender pattern matches any sender address. A sender pattern +/* that starts with '@' matches the '@' and the domain portion +/* of a sender address. Otherwise, the matcher ignores the +/* extension part of a sender address, and requires a +/* case-insensitive match against a sender pattern. +/* +/* login_sender_create() creates a (login name, sender patterns) +/* matcher. +/* +/* login_sender_free() destroys the specified (login name, +/* sender patterns) matcher. +/* +/* login_sender_match() looks up an entry for the \fBlogin_name\fR +/* argument, and determines if the lookup result matches the +/* \fBsender_adddr\fR argument. +/* +/* Arguments: +/* .IP title +/* The name of the configuration parameter that specifies the +/* map_names value, used for error messages. +/* .IP map_names +r* The lookup table(s) with (login name, sender patterns) entries. +/* .IP ext_delimiters +/* The set of address extension delimiters. +/* .IP null_sender +/* If a sender pattern equals the null_sender pattern, then +/* the empty address is matched. +/* .IP wildcard +/* Null pointer, or non-empty string with a wildcard pattern. +/* If a sender pattern equals the wildcard pattern, then any +/* sender address is matched. +/* .IP login_name +/* The login name (for example, UNIX account, or SASL username) +/* that will be used as a search key to locate a list of senders. +/* .IP sender_addr +/* The sender email address (unquoted form) that will be matched +/* against a (login name, sender patterns) table entry. +/* DIAGNOSTICS +/* login_sender_match() returns LSM_STAT_FOUND if a +/* match was found, LOGIN_STAT_NOTFOUND if no match was found, +/* LSM_STAT_RETRY if the table lookup failed, or +/* LSM_STAT_CONFIG in case of a configuration error. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library. + */ +#include <sys_defs.h> +#include <string.h> + + /* + * Utility library. + */ +#include <msg.h> +#include <mymalloc.h> +#include <stringops.h> +#include <vstring.h> + + /* + * Global library. + */ +#include <mail_params.h> +#include <maps.h> +#include <quote_822_local.h> +#include <strip_addr.h> +#include <login_sender_match.h> + + /* + * Private data structure. + */ +struct LOGIN_SENDER_MATCH { + MAPS *maps; + VSTRING *ext_stripped_sender; + char *ext_delimiters; + char *null_sender; + char *wildcard; +}; + + /* + * SLMs. + */ +#define STR(x) vstring_str(x) + +/* login_sender_create - create (login name, sender patterns) matcher */ + +LOGIN_SENDER_MATCH *login_sender_create(const char *title, + const char *map_names, + const char *ext_delimiters, + const char *null_sender, + const char *wildcard) +{ + LOGIN_SENDER_MATCH *lsm = mymalloc(sizeof *lsm); + + lsm->maps = maps_create(title, map_names, DICT_FLAG_LOCK + | DICT_FLAG_FOLD_FIX | DICT_FLAG_UTF8_REQUEST); + lsm->ext_stripped_sender = vstring_alloc(100); + lsm->ext_delimiters = mystrdup(ext_delimiters); + if (null_sender == 0 || *null_sender == 0) + msg_panic("login_sender_create: null or empty null_sender"); + lsm->null_sender = mystrdup(null_sender); + lsm->wildcard = (wildcard && *wildcard) ? mystrdup(wildcard) : 0; + return (lsm); +} + +/* login_sender_free - destroy (login name, sender patterns) matcher */ + +void login_sender_free(LOGIN_SENDER_MATCH *lsm) +{ + maps_free(lsm->maps); + vstring_free(lsm->ext_stripped_sender); + myfree(lsm->ext_delimiters); + myfree(lsm->null_sender); + if (lsm->wildcard) + myfree(lsm->wildcard); + myfree((void *) lsm); +} + +/* strip_externalize_addr - strip address extension and externalize remainder */ + +static VSTRING *strip_externalize_addr(VSTRING *ext_addr, const char *int_addr, + const char *delims) +{ + char *int_stripped_addr; + + if ((int_stripped_addr = strip_addr_internal(int_addr, + /* extension= */ (char **) 0, + delims)) != 0) { + quote_822_local(ext_addr, int_stripped_addr); + myfree(int_stripped_addr); + return (ext_addr); + } else { + return quote_822_local(ext_addr, int_addr); + } +} + +/* login_sender_match - match login and sender against (login, senders) table */ + +int login_sender_match(LOGIN_SENDER_MATCH *lsm, const char *login_name, + const char *sender_addr) +{ + int found_or_error = LSM_STAT_NOTFOUND; + + /* Sender patterns and derived info */ + const char *sender_patterns; + char *saved_sender_patterns; + char *cp; + char *sender_pattern; + + /* Actual sender and derived info */ + const char *ext_stripped_sender = 0; + const char *at_sender_domain; + + /* + * Match the login. + */ + if ((sender_patterns = maps_find(lsm->maps, login_name, + /* flags= */ 0)) != 0) { + + /* + * Match the sender. Don't break a sender pattern between double + * quotes. + */ + cp = saved_sender_patterns = mystrdup(sender_patterns); + while (found_or_error == LSM_STAT_NOTFOUND + && (sender_pattern = mystrtokdq(&cp, CHARS_COMMA_SP)) != 0) { + /* Special pattern: @domain. */ + if (*sender_pattern == '@') { + if ((at_sender_domain = strrchr(sender_addr, '@')) != 0 + && strcasecmp_utf8(sender_pattern, at_sender_domain) == 0) + found_or_error = LSM_STAT_FOUND; + } + /* Special pattern: wildcard. */ + else if (strcasecmp(sender_pattern, lsm->wildcard) == 0) { + found_or_error = LSM_STAT_FOUND; + } + /* Special pattern: empty sender. */ + else if (strcasecmp(sender_pattern, lsm->null_sender) == 0) { + if (*sender_addr == 0) + found_or_error = LSM_STAT_FOUND; + } + /* Literal pattern: match the stripped and externalized sender. */ + else { + if (ext_stripped_sender == 0) + ext_stripped_sender = + STR(strip_externalize_addr(lsm->ext_stripped_sender, + sender_addr, + lsm->ext_delimiters)); + if (strcasecmp_utf8(sender_pattern, ext_stripped_sender) == 0) + found_or_error = LSM_STAT_FOUND; + } + } + myfree(saved_sender_patterns); + } else { + found_or_error = lsm->maps->error; + } + return (found_or_error); +} + +#ifdef TEST + +int main(int argc, char **argv) +{ + struct testcase { + const char *title; + const char *map_names; + const char *ext_delimiters; + const char *null_sender; + const char *wildcard; + const char *login_name; + const char *sender_addr; + int exp_return; + }; + struct testcase testcases[] = { + {"wildcard works", + "inline:{root=*, {foo = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "root", "anything", LSM_STAT_FOUND + }, + {"unknown user", + "inline:{root=*, {foo = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "toor", "anything", LSM_STAT_NOTFOUND + }, + {"bare user", + "inline:{root=*, {foo = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "foo", "foo", LSM_STAT_FOUND + }, + {"user@domain", + "inline:{root=*, {foo = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "foo", "foo@example.com", LSM_STAT_FOUND + }, + {"user+ext@domain", + "inline:{root=*, {foo = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "foo", "foo+bar@example.com", LSM_STAT_FOUND + }, + {"wrong sender", + "inline:{root=*, {foo = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "foo", "bar@example.com", LSM_STAT_NOTFOUND + }, + {"@domain", + "inline:{root=*, {foo = @example.com}, bar=<>}", + "+-", "<>", "*", "foo", "anyone@example.com", LSM_STAT_FOUND + }, + {"wrong @domain", + "inline:{root=*, {foo = @example.com}, bar=<>}", + "+-", "<>", "*", "foo", "anyone@example.org", LSM_STAT_NOTFOUND + }, + {"null sender", + "inline:{root=*, {foo = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "bar", "", LSM_STAT_FOUND + }, + {"wrong null sender", + "inline:{root=*, {foo = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "baz", "", LSM_STAT_NOTFOUND + }, + {"error", + "inline:{root=*}, fail:sorry", + "+-", "<>", "*", "baz", "whatever", LSM_STAT_RETRY + }, + {"no error", + "inline:{root=*}, fail:sorry", + "+-", "<>", "*", "root", "whatever", LSM_STAT_FOUND + }, + {"unknown uid:number", + "inline:{root=*, {uid:12345 = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "uid:54321", "foo", LSM_STAT_NOTFOUND + }, + {"known uid:number", + "inline:{root=*, {uid:12345 = foo,foo@example.com}, bar=<>}", + "+-", "<>", "*", "uid:12345", "foo", LSM_STAT_FOUND + }, + {"unknown \"other last\"", + "inline:{root=*, {foo = \"first last\",\"first last\"@example.com}, bar=<>}", + "+-", "<>", "*", "foo", "other last", LSM_STAT_NOTFOUND + }, + {"bare \"first last\"", + "inline:{root=*, {foo = \"first last\",\"first last\"@example.com}, bar=<>}", + "+-", "<>", "*", "foo", "first last", LSM_STAT_FOUND + }, + {"\"first last\"@domain", + "inline:{root=*, {foo = \"first last\",\"first last\"@example.com}, bar=<>}", + "+-", "<>", "*", "foo", "first last@example.com", LSM_STAT_FOUND + }, + }; + struct testcase *tp; + int act_return; + int pass; + int fail; + LOGIN_SENDER_MATCH *lsm; + + /* + * Fake variable settings. + */ + var_double_bounce_sender = DEF_DOUBLE_BOUNCE; + var_ownreq_special = DEF_OWNREQ_SPECIAL; + +#define NUM_TESTS sizeof(testcases)/sizeof(testcases[0]) + + for (pass = fail = 0, tp = testcases; tp < testcases + NUM_TESTS; tp++) { + msg_info("RUN test case %ld %s", (long) (tp - testcases), tp->title); +#if 0 + msg_info("title=%s", tp->title); + msg_info("map_names=%s", tp->map_names); + msg_info("ext_delimiters=%s", tp->ext_delimiters); + msg_info("null_sender=%s", tp->null_sender); + msg_info("wildcard=%s", tp->wildcard); + msg_info("login_name=%s", tp->login_name); + msg_info("sender_addr=%s", tp->sender_addr); + msg_info("exp_return=%d", tp->exp_return); +#endif + lsm = login_sender_create("test map", tp->map_names, + tp->ext_delimiters, tp->null_sender, + tp->wildcard); + act_return = login_sender_match(lsm, tp->login_name, tp->sender_addr); + if (act_return == tp->exp_return) { + msg_info("PASS test %ld", (long) (tp - testcases)); + pass++; + } else { + msg_info("FAIL test %ld", (long) (tp - testcases)); + fail++; + } + login_sender_free(lsm); + } + return (fail > 0); +} + +#endif /* TEST */ diff --git a/external/ibm-public/postfix/dist/src/global/login_sender_match.h b/external/ibm-public/postfix/dist/src/global/login_sender_match.h new file mode 100644 index 00000000000..0975b77c95c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/login_sender_match.h @@ -0,0 +1,51 @@ +/* $NetBSD: login_sender_match.h,v 1.1.1.1 2022/10/08 16:09:07 christos Exp $ */ + +#ifndef _LOGIN_SENDER_MATCH_H_INCLUDED_ +#define _LOGIN_SENDER_MATCH_H_INCLUDED_ + +/*++ +/* NAME +/* login_sender_match 3h +/* SUMMARY +/* oracle for per-login allowed sender addresses +/* SYNOPSIS +/* #include <login_sender_match.h> +/* DESCRIPTION +/* .nf + + /* + * Utility library. + */ +#include <dict.h> + + /* + * External interface. + */ +typedef struct LOGIN_SENDER_MATCH LOGIN_SENDER_MATCH; + +extern LOGIN_SENDER_MATCH *login_sender_create(const char *title, + const char *map_names, + const char *ext_delimiters, + const char *null_sender, + const char *wildcard); +extern void login_sender_free(LOGIN_SENDER_MATCH *lsm); +extern int login_sender_match(LOGIN_SENDER_MATCH *lsm, const char *login_name, + const char *sender_addr); + +#define LSM_STAT_FOUND (1) +#define LSM_STAT_NOTFOUND (0) +#define LSM_STAT_RETRY (DICT_ERR_RETRY) +#define LSM_STAT_CONFIG (DICT_ERR_CONFIG) + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#endif /* _LOGIN_SENDER_MATCH_H_INCLUDED_ */ diff --git a/external/ibm-public/postfix/dist/src/global/login_sender_match.ref b/external/ibm-public/postfix/dist/src/global/login_sender_match.ref new file mode 100644 index 00000000000..20ea4832f39 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/login_sender_match.ref @@ -0,0 +1,35 @@ +unknown: RUN test case 0 wildcard works +unknown: PASS test 0 +unknown: RUN test case 1 unknown user +unknown: PASS test 1 +unknown: RUN test case 2 bare user +unknown: PASS test 2 +unknown: RUN test case 3 user@domain +unknown: PASS test 3 +unknown: RUN test case 4 user+ext@domain +unknown: PASS test 4 +unknown: RUN test case 5 wrong sender +unknown: PASS test 5 +unknown: RUN test case 6 @domain +unknown: PASS test 6 +unknown: RUN test case 7 wrong @domain +unknown: PASS test 7 +unknown: RUN test case 8 null sender +unknown: PASS test 8 +unknown: RUN test case 9 wrong null sender +unknown: PASS test 9 +unknown: RUN test case 10 error +unknown: warning: fail:sorry lookup error for "baz" +unknown: PASS test 10 +unknown: RUN test case 11 no error +unknown: PASS test 11 +unknown: RUN test case 12 unknown uid:number +unknown: PASS test 12 +unknown: RUN test case 13 known uid:number +unknown: PASS test 13 +unknown: RUN test case 14 unknown "other last" +unknown: PASS test 14 +unknown: RUN test case 15 bare "first last" +unknown: PASS test 15 +unknown: RUN test case 16 "first last"@domain +unknown: PASS test 16 diff --git a/external/ibm-public/postfix/dist/src/global/msg_stats.h b/external/ibm-public/postfix/dist/src/global/msg_stats.h index c9e5e48b66a..fc0d6f9fea6 100644 --- a/external/ibm-public/postfix/dist/src/global/msg_stats.h +++ b/external/ibm-public/postfix/dist/src/global/msg_stats.h @@ -1,4 +1,4 @@ -/* $NetBSD: msg_stats.h,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */ +/* $NetBSD: msg_stats.h,v 1.1.1.2 2022/10/08 16:09:08 christos Exp $ */ #ifndef _MSG_STATS_H_INCLUDED_ #define _MSG_STATS_H_INCLUDED_ @@ -84,8 +84,8 @@ typedef struct { (st) \ ) -extern int msg_stats_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *); -extern int msg_stats_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *); +extern int msg_stats_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); +extern int msg_stats_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, const void *); /* LICENSE /* .ad @@ -96,6 +96,11 @@ extern int msg_stats_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/external/ibm-public/postfix/dist/src/global/namadr_list.in b/external/ibm-public/postfix/dist/src/global/namadr_list.in index 4ee6121b680..45423873764 100644 --- a/external/ibm-public/postfix/dist/src/global/namadr_list.in +++ b/external/ibm-public/postfix/dist/src/global/namadr_list.in @@ -1,10 +1,10 @@ -./namadr_list 168.100.189.0/28 dummy 168.100.189.2 -./namadr_list '!168.100.189.2 168.100.189.0/28' dummy 168.100.189.2 -./namadr_list '!168.100.189.2 168.100.189.0/28' dummy 168.100.189.3 -./namadr_list 168.100.189.0/28 dummy 168.100.189.16 -./namadr_list 168.100.189.0/98 dummy 168.100.189.16 -./namadr_list 168.100.589.0/28 dummy 168.100.189.16 -./namadr_list 168.100.189.0/28 dummy 168.100.989.16 +./namadr_list 168.100.3.0/28 dummy 168.100.3.2 +./namadr_list '!168.100.3.2 168.100.3.0/28' dummy 168.100.3.2 +./namadr_list '!168.100.3.2 168.100.3.0/28' dummy 168.100.3.3 +./namadr_list 168.100.3.0/28 dummy 168.100.3.16 +./namadr_list 168.100.3.0/98 dummy 168.100.3.16 +./namadr_list 168.100.589.0/28 dummy 168.100.3.16 +./namadr_list 168.100.3.0/28 dummy 168.100.989.16 ./namadr_list 2001:240:5c7:0:2d0:b7ff:fe88:2ca7 dummy 2001:240:5c7:0:2d0:b7ff:fe88:2ca7 ./namadr_list '[2001:240:5c7:0:2d0:b7ff:fe88:2ca7]' dummy 2001:240:5c7:0:2d0:b7ff:fe88:2ca7 ./namadr_list '[2001:240:5c7:0:2d0:b7ff:fe88:2ca7]' dummy 2001:240:5c7:0:2d0:b7ff:fe88:2ca8 @@ -13,30 +13,30 @@ ./namadr_list '[2001:240:5c7::]/64' dummy 2001:24:5c7:0:2d0:b7ff:fe88:2ca8 ./namadr_list '[2001:24:5c7:0:2d0:b7ff:fe88:2ca8]' dummy 2001:24:5c7:0:2d0:b7ff:fe88:2ca8 ./namadr_list '[2001:24:5c7:0:2d0:b7ff:fe88:2ca8]' dummy 2001:24:5c7:0:2d0:b7ff:fe88:2ca7 -./namadr_list 168.100.189.2 dummy 168.100.189.2 -./namadr_list 168.100.189.2 dummy 168.100.189.3 -./namadr_list '[168.100.189.2]' dummy 168.100.189.2 -./namadr_list '[168.100.189.2]' dummy 168.100.189.3 +./namadr_list 168.100.3.2 dummy 168.100.3.2 +./namadr_list 168.100.3.2 dummy 168.100.3.3 +./namadr_list '[168.100.3.2]' dummy 168.100.3.2 +./namadr_list '[168.100.3.2]' dummy 168.100.3.3 echo foo !bar baz >junk; mv junk /tmp -./namadr_list !/tmp/junk dummy 168.100.189.3 -./namadr_list !/tmp/junk foo 168.100.189.3 -./namadr_list !/tmp/junk bar 168.100.189.3 -./namadr_list !/tmp/junk baz 168.100.189.3 -./namadr_list /tmp/junk dummy 168.100.189.3 -./namadr_list /tmp/junk foo 168.100.189.3 -./namadr_list /tmp/junk bar 168.100.189.3 -./namadr_list /tmp/junk baz 168.100.189.3 +./namadr_list !/tmp/junk dummy 168.100.3.3 +./namadr_list !/tmp/junk foo 168.100.3.3 +./namadr_list !/tmp/junk bar 168.100.3.3 +./namadr_list !/tmp/junk baz 168.100.3.3 +./namadr_list /tmp/junk dummy 168.100.3.3 +./namadr_list /tmp/junk foo 168.100.3.3 +./namadr_list /tmp/junk bar 168.100.3.3 +./namadr_list /tmp/junk baz 168.100.3.3 rm -f junk ./namadr_list 'be.be' x.x.x 127.0.0.1 ./namadr_list 'be/be' x.x.x 127.0.0.1 ./namadr_list '[be:be]' x.x.x 127.0.0.1 ./namadr_list '[be:be]' x.x.x ::1 -env foo=x ./namadr_list environ:junk foo 168.100.189.3 -env foo=x ./namadr_list environ:junk bar 168.100.189.3 -env foo=x ./namadr_list !environ:junk foo 168.100.189.3 -env foo=x ./namadr_list !environ:junk bar 168.100.189.3 -env foo=x ./namadr_list !!environ:junk foo 168.100.189.3 -env foo=x ./namadr_list !!environ:junk bar 168.100.189.3 -./namadr_list fail:1 bar 168.100.189.3 -./namadr_list !fail:1 bar 168.100.189.3 -./namadr_list /tmp/nosuchfile bar 168.100.189.3 +env foo=x ./namadr_list environ:junk foo 168.100.3.3 +env foo=x ./namadr_list environ:junk bar 168.100.3.3 +env foo=x ./namadr_list !environ:junk foo 168.100.3.3 +env foo=x ./namadr_list !environ:junk bar 168.100.3.3 +env foo=x ./namadr_list !!environ:junk foo 168.100.3.3 +env foo=x ./namadr_list !!environ:junk bar 168.100.3.3 +./namadr_list fail:1 bar 168.100.3.3 +./namadr_list !fail:1 bar 168.100.3.3 +./namadr_list /tmp/nosuchfile bar 168.100.3.3 diff --git a/external/ibm-public/postfix/dist/src/global/namadr_list.ref b/external/ibm-public/postfix/dist/src/global/namadr_list.ref index 7df05be912c..e38b88348d1 100644 --- a/external/ibm-public/postfix/dist/src/global/namadr_list.ref +++ b/external/ibm-public/postfix/dist/src/global/namadr_list.ref @@ -1,11 +1,11 @@ -dummy/168.100.189.2: YES -dummy/168.100.189.2: NO -dummy/168.100.189.3: YES -dummy/168.100.189.16: NO -./namadr_list: warning: command line: bad net/mask pattern: "168.100.189.0/98" -dummy/168.100.189.16: ERROR -./namadr_list: warning: command line: bad net/mask pattern: "168.100.589.0/28" -dummy/168.100.189.16: ERROR +dummy/168.100.3.2: YES +dummy/168.100.3.2: NO +dummy/168.100.3.3: YES +dummy/168.100.3.16: NO +./namadr_list: warning: command line: bad mask length in "168.100.3.0/98" +dummy/168.100.3.16: ERROR +./namadr_list: warning: command line: bad network value in "168.100.589.0/28" +dummy/168.100.3.16: ERROR dummy/168.100.989.16: NO ./namadr_list: error: unsupported dictionary type: 2001 ./namadr_list: warning: 2001:240:5c7:0:2d0:b7ff:fe88:2ca7 is unavailable. unsupported dictionary type: 2001 @@ -19,35 +19,35 @@ dummy/2001:240:5c7:0:2d0:b7ff:fe88:2ca8: YES dummy/2001:24:5c7:0:2d0:b7ff:fe88:2ca8: NO dummy/2001:24:5c7:0:2d0:b7ff:fe88:2ca8: YES dummy/2001:24:5c7:0:2d0:b7ff:fe88:2ca7: NO -dummy/168.100.189.2: YES -dummy/168.100.189.3: NO -dummy/168.100.189.2: YES -dummy/168.100.189.3: NO -dummy/168.100.189.3: NO -foo/168.100.189.3: NO -bar/168.100.189.3: YES -baz/168.100.189.3: NO -dummy/168.100.189.3: NO -foo/168.100.189.3: YES -bar/168.100.189.3: NO -baz/168.100.189.3: YES +dummy/168.100.3.2: YES +dummy/168.100.3.3: NO +dummy/168.100.3.2: YES +dummy/168.100.3.3: NO +dummy/168.100.3.3: NO +foo/168.100.3.3: NO +bar/168.100.3.3: YES +baz/168.100.3.3: NO +dummy/168.100.3.3: NO +foo/168.100.3.3: YES +bar/168.100.3.3: NO +baz/168.100.3.3: YES x.x.x/127.0.0.1: NO -./namadr_list: warning: command line: bad net/mask pattern: "be/be" +./namadr_list: warning: command line: bad mask value in "be/be" x.x.x/127.0.0.1: ERROR x.x.x/127.0.0.1: NO ./namadr_list: warning: command line: bad address pattern: "be:be" x.x.x/::1: ERROR -foo/168.100.189.3: YES -bar/168.100.189.3: NO -foo/168.100.189.3: NO -bar/168.100.189.3: NO -foo/168.100.189.3: YES -bar/168.100.189.3: NO +foo/168.100.3.3: YES +bar/168.100.3.3: NO +foo/168.100.3.3: NO +bar/168.100.3.3: NO +foo/168.100.3.3: YES +bar/168.100.3.3: NO ./namadr_list: warning: command line: fail:1: table lookup problem -bar/168.100.189.3: ERROR +bar/168.100.3.3: ERROR ./namadr_list: warning: command line: fail:1: table lookup problem -bar/168.100.189.3: ERROR +bar/168.100.3.3: ERROR ./namadr_list: error: open file /tmp/nosuchfile: No such file or directory ./namadr_list: warning: non-existent:/tmp/nosuchfile is unavailable. open file /tmp/nosuchfile: No such file or directory ./namadr_list: warning: command line: non-existent:/tmp/nosuchfile: table lookup problem -bar/168.100.189.3: ERROR +bar/168.100.3.3: ERROR diff --git a/external/ibm-public/postfix/dist/src/global/quote_822_local.in b/external/ibm-public/postfix/dist/src/global/quote_822_local.in index 385f4d855ac..fc811bfc3ce 100644 --- a/external/ibm-public/postfix/dist/src/global/quote_822_local.in +++ b/external/ibm-public/postfix/dist/src/global/quote_822_local.in @@ -3,3 +3,4 @@ quote_with_flags 8bitclean|bare_localpart a@b@c@d unquote "a@b@c"@d unquote "a@b@c" unquote "a@b@c"@d@e +quote <> diff --git a/external/ibm-public/postfix/dist/src/global/quote_822_local.ref b/external/ibm-public/postfix/dist/src/global/quote_822_local.ref index ec759175152..3b0fba3c6d4 100644 --- a/external/ibm-public/postfix/dist/src/global/quote_822_local.ref +++ b/external/ibm-public/postfix/dist/src/global/quote_822_local.ref @@ -3,3 +3,4 @@ '"a@b@c"@d' unquoted 'a@b@c@d' '"a@b@c"' unquoted 'a@b@c' '"a@b@c"@d@e' unquoted 'a@b@c@d@e' +'' quoted '""' diff --git a/external/ibm-public/postfix/dist/src/global/rcpt_buf.h b/external/ibm-public/postfix/dist/src/global/rcpt_buf.h index 1ea27a6b428..bbe841c2152 100644 --- a/external/ibm-public/postfix/dist/src/global/rcpt_buf.h +++ b/external/ibm-public/postfix/dist/src/global/rcpt_buf.h @@ -1,4 +1,4 @@ -/* $NetBSD: rcpt_buf.h,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */ +/* $NetBSD: rcpt_buf.h,v 1.1.1.2 2022/10/08 16:09:08 christos Exp $ */ #ifndef _RCPT_BUF_H_INCLUDED_ #define _RCPT_BUF_H_INCLUDED_ @@ -40,7 +40,7 @@ typedef struct { extern RCPT_BUF *rcpb_create(void); extern void rcpb_reset(RCPT_BUF *); extern void rcpb_free(RCPT_BUF *); -extern int rcpb_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *); +extern int rcpb_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); #define RECIPIENT_FROM_RCPT_BUF(buf) \ ((buf)->rcpt.address = vstring_str((buf)->address), \ @@ -59,6 +59,11 @@ extern int rcpb_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/external/ibm-public/postfix/dist/src/global/rcpt_print.h b/external/ibm-public/postfix/dist/src/global/rcpt_print.h index dd93e0655d7..f94803ad7ed 100644 --- a/external/ibm-public/postfix/dist/src/global/rcpt_print.h +++ b/external/ibm-public/postfix/dist/src/global/rcpt_print.h @@ -1,4 +1,4 @@ -/* $NetBSD: rcpt_print.h,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */ +/* $NetBSD: rcpt_print.h,v 1.1.1.2 2022/10/08 16:09:08 christos Exp $ */ #ifndef _RCPT_PRINT_H_INCLUDED_ #define _RCPT_PRINT_H_INCLUDED_ @@ -27,7 +27,7 @@ /* * External interface. */ -extern int rcpt_print(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *); +extern int rcpt_print(ATTR_SCAN_COMMON_FN, VSTREAM *, int, const void *); /* LICENSE /* .ad @@ -38,6 +38,11 @@ extern int rcpt_print(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/external/ibm-public/postfix/dist/src/global/sasl_mech_filter.c b/external/ibm-public/postfix/dist/src/global/sasl_mech_filter.c new file mode 100644 index 00000000000..df5ef3726e2 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/sasl_mech_filter.c @@ -0,0 +1,115 @@ +/* $NetBSD: sasl_mech_filter.c,v 1.1.1.1 2022/10/08 16:09:08 christos Exp $ */ + +/*++ +/* NAME +/* sasl_mech_filter 3 +/* SUMMARY +/* Filter SASL mechanism names +/* SYNOPSIS +/* #include sasl_mech_filter.h +/* +/* const char *sasl_mech_filter( +/* STRING_LIST *filter, +/* const char *words) +/* DESCRIPTION +/* sasl_mech_filter() applies the specified filter to a list +/* of SASL mechanism names. The filter is case-insensitive, +/* but preserves the case of input words. +/* +/* Arguments: +/* .IP filter +/* Null pointer or filter specification. If this is a nulll +/* pointer, no filter will be applied. +/* .IP words +/* List of SASL authentication mechanisms (separated by blanks). +/* If the string is empty, the filter will not be applied. +/* DIAGNOSTICS +/* Fatal errors: memory allocation, table lookup error. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Original author: +/* Till Franke +/* SuSE Rhein/Main AG +/* 65760 Eschborn, Germany +/* +/* Adopted by: +/* Wietse Venema +/* IBM T.J. Watson Research +/* P.O. Box 704 +/* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +/* System library. */ + +#include <sys_defs.h> +#include <string.h> +#ifdef STRCASECMP_IN_STRINGS_H +#include <strings.h> +#endif + +/* Utility library. */ + +#include <msg.h> +#include <mymalloc.h> +#include <stringops.h> + +/* Global library. */ + +#include <sasl_mech_filter.h> + +#ifdef USE_SASL_AUTH + +/* sasl_mech_filter - filter a SASL mechanism list */ + +const char *sasl_mech_filter(STRING_LIST *filter, + const char *words) +{ + const char myname[] = "sasl_mech_filter"; + static VSTRING *buf; + char *mech_list; + char *save_mech; + char *mech; + + /* + * NOOP if there is no filter, or if the mechanism list is empty. + */ + if (filter == 0 || *words == 0) + return (words); + + if (buf == 0) + buf = vstring_alloc(10); + + VSTRING_RESET(buf); + VSTRING_TERMINATE(buf); + + save_mech = mech_list = mystrdup(words); + + while ((mech = mystrtok(&mech_list, " \t")) != 0) { + if (string_list_match(filter, mech)) { + if (VSTRING_LEN(buf) > 0) + VSTRING_ADDCH(buf, ' '); + vstring_strcat(buf, mech); + if (msg_verbose) + msg_info("%s: keep SASL mechanism: '%s'", myname, mech); + } else if (filter->error) { + msg_fatal("%s: SASL mechanism filter failed for: '%s'", + myname, mech); + } else { + if (msg_verbose) + msg_info("%s: drop SASL mechanism: '%s'", myname, mech); + } + } + myfree(save_mech); + + return (vstring_str(buf)); +} + +#endif diff --git a/external/ibm-public/postfix/dist/src/global/sasl_mech_filter.h b/external/ibm-public/postfix/dist/src/global/sasl_mech_filter.h new file mode 100644 index 00000000000..b74a1448fd0 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/sasl_mech_filter.h @@ -0,0 +1,37 @@ +/* $NetBSD: sasl_mech_filter.h,v 1.1.1.1 2022/10/08 16:09:08 christos Exp $ */ + +#ifndef _SASL_MECH_FILTER_H_INCLUDED_ +#define _SASL_MECH_FILTER_H_INCLUDED_ + +/*++ +/* NAME +/* sasl_mech_filter 3h +/* SUMMARY +/* string array utilities +/* SYNOPSIS +/* #include "sasl_mech_filter.h" +/* DESCRIPTION +/* .nf + + /* + * Utility library. + */ +#include <string_list.h> + + /* + * External interface. + */ +extern const char *sasl_mech_filter(STRING_LIST *, const char *); + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#endif diff --git a/external/ibm-public/postfix/dist/src/global/server_acl.in b/external/ibm-public/postfix/dist/src/global/server_acl.in index a12001a1e58..c26251a5c17 100644 --- a/external/ibm-public/postfix/dist/src/global/server_acl.in +++ b/external/ibm-public/postfix/dist/src/global/server_acl.in @@ -1,10 +1,10 @@ -mynetworks=168.100.189.0/27 +mynetworks=168.100.3.0/27 server_acl=permit_mynetworks,reject -address=168.100.189.2 -mynetworks=!168.100.189.2,168.100.189.0/27 -address=168.100.189.2 -address=168.100.189.3 +address=168.100.3.2 +mynetworks=!168.100.3.2,168.100.3.0/27 +address=168.100.3.2 +address=168.100.3.3 mynetworks=fail:1 -address=168.100.189.4 +address=168.100.3.4 server_acl=fail:1,reject -address=168.100.189.2 +address=168.100.3.2 diff --git a/external/ibm-public/postfix/dist/src/global/server_acl.ref b/external/ibm-public/postfix/dist/src/global/server_acl.ref index b70f3c654fb..d3e93631082 100644 --- a/external/ibm-public/postfix/dist/src/global/server_acl.ref +++ b/external/ibm-public/postfix/dist/src/global/server_acl.ref @@ -1,18 +1,18 @@ -> mynetworks=168.100.189.0/27 +> mynetworks=168.100.3.0/27 > server_acl=permit_mynetworks,reject -> address=168.100.189.2 -168.100.189.2: permit -> mynetworks=!168.100.189.2,168.100.189.0/27 -> address=168.100.189.2 -168.100.189.2: reject -> address=168.100.189.3 -168.100.189.3: permit +> address=168.100.3.2 +168.100.3.2: permit +> mynetworks=!168.100.3.2,168.100.3.0/27 +> address=168.100.3.2 +168.100.3.2: reject +> address=168.100.3.3 +168.100.3.3: permit > mynetworks=fail:1 -> address=168.100.189.4 +> address=168.100.3.4 unknown: warning: mynetworks: fail:1: table lookup problem unknown: warning: server_acl: permit_mynetworks: mynetworks lookup error -- ignoring the remainder of this access list -168.100.189.4: error +168.100.3.4: error > server_acl=fail:1,reject -> address=168.100.189.2 +> address=168.100.3.2 unknown: warning: server_acl: fail:1: table lookup error -- ignoring the remainder of this access list -168.100.189.2: error +168.100.3.2: error diff --git a/external/ibm-public/postfix/dist/src/global/test_main.c b/external/ibm-public/postfix/dist/src/global/test_main.c new file mode 100644 index 00000000000..e2210a5c29d --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/test_main.c @@ -0,0 +1,226 @@ +/* $NetBSD: test_main.c,v 1.1.1.1 2022/10/08 16:09:08 christos Exp $ */ + +/*++ +/* NAME +/* test_main 3 +/* SUMMARY +/* test main program +/* SYNOPSIS +/* #include <test_main.h> +/* +/* NORETURN test_main(argc, argv, test_driver, key, value, ...) +/* int argc; +/* char **argv; +/* void (*test_driver)(int argc, char **argv); +/* int key; +/* DESCRIPTION +/* This module implements a test main program for stand-alone +/* module tests. +/* +/* test_main() should be called from a main program. It does +/* generic command-line options processing, and initializes +/* configurable parameters. After calling the test_driver() +/* function, the test_main() function terminates. +/* +/* Arguments: +/* .IP "void (*test_driver)(int argc, char **argv)" +/* A pointer to a function that is called after processing +/* command-line options and initializing configuration parameters. +/* The argc and argv specify the process name and non-option +/* command-line arguments. +/* .PP +/* Optional test_main() arguments are specified as a null-terminated +/* list with macros that have zero or more arguments: +/* .IP "CA_TEST_MAIN_INT_TABLE(CONFIG_INT_TABLE *)" +/* A table with configurable parameters, to be loaded from the +/* global Postfix configuration file. Tables are loaded in the +/* order as specified, and multiple instances of the same type +/* are allowed. +/* .IP "CA_TEST_MAIN_LONG_TABLE(CONFIG_LONG_TABLE *)" +/* A table with configurable parameters, to be loaded from the +/* global Postfix configuration file. Tables are loaded in the +/* order as specified, and multiple instances of the same type +/* are allowed. +/* .IP "CA_TEST_MAIN_STR_TABLE(CONFIG_STR_TABLE *)" +/* A table with configurable parameters, to be loaded from the +/* global Postfix configuration file. Tables are loaded in the +/* order as specified, and multiple instances of the same type +/* are allowed. +/* .IP "CA_TEST_MAIN_BOOL_TABLE(CONFIG_BOOL_TABLE *)" +/* A table with configurable parameters, to be loaded from the +/* global Postfix configuration file. Tables are loaded in the +/* order as specified, and multiple instances of the same type +/* are allowed. +/* .IP "CA_TEST_MAIN_TIME_TABLE(CONFIG_TIME_TABLE *)" +/* A table with configurable parameters, to be loaded from the +/* global Postfix configuration file. Tables are loaded in the +/* order as specified, and multiple instances of the same type +/* are allowed. +/* .IP "CA_TEST_MAIN_RAW_TABLE(CONFIG_RAW_TABLE *)" +/* A table with configurable parameters, to be loaded from the +/* global Postfix configuration file. Tables are loaded in the +/* order as specified, and multiple instances of the same type +/* are allowed. Raw parameters are not subjected to $name +/* evaluation. +/* .IP "CA_TEST_MAIN_NINT_TABLE(CONFIG_NINT_TABLE *)" +/* A table with configurable parameters, to be loaded from the +/* global Postfix configuration file. Tables are loaded in the +/* order as specified, and multiple instances of the same type +/* are allowed. +/* .IP "CA_TEST_MAIN_NBOOL_TABLE(CONFIG_NBOOL_TABLE *)" +/* A table with configurable parameters, to be loaded from the +/* global Postfix configuration file. Tables are loaded in the +/* order as specified, and multiple instances of the same type +/* are allowed. +/* DIAGNOSTICS +/* Problems and transactions are logged stderr. +/* BUGS +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* IBM T.J. Watson Research +/* P.O. Box 704 +/* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library. + */ +#include <sys_defs.h> +#include <stdlib.h> + + /* + * Utility library. + */ +#include <dict.h> +#include <msg.h> +#include <msg_vstream.h> +#include <mymalloc.h> +#include <stringops.h> + + /* + * Global library. + */ +#include <mail_params.h> +#include <mail_conf.h> +#include <mail_dict.h> +#include <mail_task.h> +#include <mail_version.h> + + /* + * Test library. + */ +#include <test_main.h> + +/* test_driver_main - the real main program */ + +NORETURN test_main(int argc, char **argv, TEST_DRIVER_FN test_driver,...) +{ + const char *myname = "test_driver_main"; + va_list ap; + int ch; + int key; + int test_driver_argc; + char **test_driver_argv; + + /* + * Set up logging. + */ + var_procname = mystrdup(basename(argv[0])); + msg_vstream_init(mail_task(var_procname), VSTREAM_ERR); + + /* + * Check the Postfix library version as soon as we enable logging. + */ + MAIL_VERSION_CHECK; + + /* + * Parse JCL. + */ + while ((ch = GETOPT(argc, argv, "c:v")) > 0) { + switch (ch) { + case 'c': + if (setenv(CONF_ENV_PATH, optarg, 1) < 0) + msg_fatal("out of memory"); + break; + case 'v': + msg_verbose++; + break; + default: + msg_fatal("invalid option: %c. Usage: %s [-c config_dir] [-v]", + optopt, argv[0]); + break; + } + } + + /* + * Initialize generic parameters. + */ + set_mail_conf_str(VAR_PROCNAME, var_procname); + set_mail_conf_str(VAR_SERVNAME, var_procname); + mail_conf_read(); + + /* + * Register higher-level dictionaries and initialize the support for + * dynamically-loaded dictionaries. + */ + mail_dict_init(); + + /* + * Application-specific initialization. + */ + va_start(ap, test_driver); + while ((key = va_arg(ap, int)) != 0) { + switch (key) { + case TEST_MAIN_INT_TABLE: + get_mail_conf_int_table(va_arg(ap, CONFIG_INT_TABLE *)); + break; + case TEST_MAIN_LONG_TABLE: + get_mail_conf_long_table(va_arg(ap, CONFIG_LONG_TABLE *)); + break; + case TEST_MAIN_STR_TABLE: + get_mail_conf_str_table(va_arg(ap, CONFIG_STR_TABLE *)); + break; + case TEST_MAIN_BOOL_TABLE: + get_mail_conf_bool_table(va_arg(ap, CONFIG_BOOL_TABLE *)); + break; + case TEST_MAIN_TIME_TABLE: + get_mail_conf_time_table(va_arg(ap, CONFIG_TIME_TABLE *)); + break; + case TEST_MAIN_RAW_TABLE: + get_mail_conf_raw_table(va_arg(ap, CONFIG_RAW_TABLE *)); + break; + case TEST_MAIN_NINT_TABLE: + get_mail_conf_nint_table(va_arg(ap, CONFIG_NINT_TABLE *)); + break; + case TEST_MAIN_NBOOL_TABLE: + get_mail_conf_nbool_table(va_arg(ap, CONFIG_NBOOL_TABLE *)); + break; + default: + msg_panic("%s: unknown argument type: %d", myname, key); + } + } + va_end(ap); + + /* + * Set up call-back info. + */ + test_driver_argv = argv + optind - 1; + if (test_driver_argv != argv) + test_driver_argv[0] = argv[0]; + test_driver_argc = argc - optind + 1; + + /* + * Call the test driver and terminate (if they didn't terminate already). + */ + test_driver(test_driver_argc, test_driver_argv); + exit(0); +} diff --git a/external/ibm-public/postfix/dist/src/global/test_main.h b/external/ibm-public/postfix/dist/src/global/test_main.h new file mode 100644 index 00000000000..a566750310f --- /dev/null +++ b/external/ibm-public/postfix/dist/src/global/test_main.h @@ -0,0 +1,66 @@ +/* $NetBSD: test_main.h,v 1.1.1.1 2022/10/08 16:09:08 christos Exp $ */ + +/*++ +/* NAME +/* test_main 3h +/* SUMMARY +/* test main program +/* SYNOPSIS +/* #include <test_main.h> +/* DESCRIPTION +/* .nf + + /* + * Global library. + */ +#include <mail_conf.h> + + /* + * External interface. Copied from master/mail_server.h, but without + * introducing libmaster dependencies. + */ +#define TEST_MAIN_INT_TABLE 1 +#define TEST_MAIN_STR_TABLE 2 +#define TEST_MAIN_BOOL_TABLE 3 +#define TEST_MAIN_TIME_TABLE 4 +#define TEST_MAIN_RAW_TABLE 5 +#define TEST_MAIN_NINT_TABLE 6 +#define TEST_MAIN_NBOOL_TABLE 7 +#define TEST_MAIN_LONG_TABLE 8 + +#define CA_TEST_MAIN_INT_TABLE(v) TEST_MAIN_INT_TABLE, CHECK_CPTR(TEST_MAIN, CONFIG_INT_TABLE, (v)) +#define CA_TEST_MAIN_STR_TABLE(v) TEST_MAIN_STR_TABLE, CHECK_CPTR(TEST_MAIN, CONFIG_STR_TABLE, (v)) +#define CA_TEST_MAIN_BOOL_TABLE(v) TEST_MAIN_BOOL_TABLE, CHECK_CPTR(TEST_MAIN, CONFIG_BOOL_TABLE, (v)) +#define CA_TEST_MAIN_TIME_TABLE(v) TEST_MAIN_TIME_TABLE, CHECK_CPTR(TEST_MAIN, CONFIG_TIME_TABLE, (v)) +#define CA_TEST_MAIN_RAW_TABLE(v) TEST_MAIN_RAW_TABLE, CHECK_CPTR(TEST_MAIN, CONFIG_RAW_TABLE, (v)) +#define CA_TEST_MAIN_NINT_TABLE(v) TEST_MAIN_NINT_TABLE, CHECK_CPTR(TEST_MAIN, CONFIG_NINT_TABLE, (v)) +#define CA_TEST_MAIN_NBOOL_TABLE(v) TEST_MAIN_NBOOL_TABLE, CHECK_CPTR(TEST_MAIN, CONFIG_NBOOL_TABLE, (v)) +#define CA_TEST_MAIN_LONG_TABLE(v) TEST_MAIN_LONG_TABLE, CHECK_CPTR(TEST_MAIN, CONFIG_LONG_TABLE, (v)) + +CHECK_CPTR_HELPER_DCL(TEST_MAIN, CONFIG_INT_TABLE); +CHECK_CPTR_HELPER_DCL(TEST_MAIN, CONFIG_STR_TABLE); +CHECK_CPTR_HELPER_DCL(TEST_MAIN, CONFIG_BOOL_TABLE); +CHECK_CPTR_HELPER_DCL(TEST_MAIN, CONFIG_TIME_TABLE); +CHECK_CPTR_HELPER_DCL(TEST_MAIN, CONFIG_RAW_TABLE); +CHECK_CPTR_HELPER_DCL(TEST_MAIN, CONFIG_NINT_TABLE); +CHECK_CPTR_HELPER_DCL(TEST_MAIN, CONFIG_NBOOL_TABLE); +CHECK_CPTR_HELPER_DCL(TEST_MAIN, CONFIG_LONG_TABLE); + +typedef void (*TEST_DRIVER_FN) (int, char **); +extern NORETURN test_main(int, char **, TEST_DRIVER_FN,...); + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* IBM T.J. Watson Research +/* P.O. Box 704 +/* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ diff --git a/external/ibm-public/postfix/dist/src/master/Makefile.in b/external/ibm-public/postfix/dist/src/master/Makefile.in index 1dd334d86ee..db67a68eb8e 100644 --- a/external/ibm-public/postfix/dist/src/master/Makefile.in +++ b/external/ibm-public/postfix/dist/src/master/Makefile.in @@ -219,6 +219,7 @@ master_conf.o: master_conf.c master_ent.o: ../../include/argv.h master_ent.o: ../../include/attr.h master_ent.o: ../../include/check_arg.h +master_ent.o: ../../include/compat_level.h master_ent.o: ../../include/host_port.h master_ent.o: ../../include/htable.h master_ent.o: ../../include/inet_addr_host.h diff --git a/external/ibm-public/postfix/dist/src/oqmgr/qmgr_feedback.c b/external/ibm-public/postfix/dist/src/oqmgr/qmgr_feedback.c index 8ad217dcfb2..4bb62247a89 100644 --- a/external/ibm-public/postfix/dist/src/oqmgr/qmgr_feedback.c +++ b/external/ibm-public/postfix/dist/src/oqmgr/qmgr_feedback.c @@ -1,4 +1,4 @@ -/* $NetBSD: qmgr_feedback.c,v 1.1.1.1 2009/06/23 10:08:50 tron Exp $ */ +/* $NetBSD: qmgr_feedback.c,v 1.1.1.2 2022/10/08 16:09:08 christos Exp $ */ /*++ /* NAME @@ -63,6 +63,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ @@ -111,7 +116,7 @@ void qmgr_feedback_init(QMGR_FEEDBACK *fb, double enum_val; char denom_str[30 + 1]; double denom_val; - char slash; + char slash[1 + 1]; char junk; char *fbck_name; char *fbck_val; @@ -137,7 +142,7 @@ void qmgr_feedback_init(QMGR_FEEDBACK *fb, fb->base = -1; /* assume error */ switch (sscanf(fbck_val, "%lf %1[/] %30s%c", - &enum_val, &slash, denom_str, &junk)) { + &enum_val, slash, denom_str, &junk)) { case 1: fb->index = QMGR_FEEDBACK_IDX_NONE; fb->base = enum_val; diff --git a/external/ibm-public/postfix/dist/src/postalias/fail_test.ref b/external/ibm-public/postfix/dist/src/postalias/fail_test.ref index 37ebce6b309..9cb60245255 100644 --- a/external/ibm-public/postfix/dist/src/postalias/fail_test.ref +++ b/external/ibm-public/postfix/dist/src/postalias/fail_test.ref @@ -1,7 +1,7 @@ -postalias: fatal: table fail:aliases: query error: Unknown error: 0 -postalias: fatal: table fail:aliases: query error: Unknown error: 0 -postalias: fatal: table fail:aliases: delete error: Unknown error: 0 -postalias: fatal: table fail:aliases: delete error: Unknown error: 0 -postalias: fatal: table fail:aliases: sequence error: Unknown error: 0 -postalias: fatal: table fail:aliases: write error: Unknown error: 0 -postalias: fatal: table fail:aliases: write error: Unknown error: 0 +postalias: fatal: table fail:aliases: query error: Application error +postalias: fatal: table fail:aliases: query error: Application error +postalias: fatal: table fail:aliases: delete error: Application error +postalias: fatal: table fail:aliases: delete error: Application error +postalias: fatal: table fail:aliases: sequence error: Application error +postalias: fatal: table fail:aliases: write error: Application error +postalias: fatal: table fail:aliases: write error: Application error diff --git a/external/ibm-public/postfix/dist/src/postconf/Makefile.in b/external/ibm-public/postfix/dist/src/postconf/Makefile.in index dc382fe1f7a..60c797a73d4 100644 --- a/external/ibm-public/postfix/dist/src/postconf/Makefile.in +++ b/external/ibm-public/postfix/dist/src/postconf/Makefile.in @@ -9,8 +9,8 @@ OBJS = postconf.o postconf_builtin.o postconf_edit.o postconf_main.o \ postconf_lookup.o postconf_match.o postconf_print.o HDRS = postconf.h TESTSRC = -DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE) -CFLAGS = $(DEBUG) $(OPT) $(DEFS) -DLEGACY_DBMS_SUPPORT +DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE) -DLEGACY_DBMS_SUPPORT +CFLAGS = $(DEBUG) $(OPT) $(DEFS) TESTPROG= MAKES = bool_table.h bool_vars.h int_table.h int_vars.h str_table.h \ str_vars.h time_table.h time_vars.h raw_table.h raw_vars.h \ @@ -28,6 +28,7 @@ LIBS = ../../lib/libxsasl.a \ ../../lib/lib$(LIB_PREFIX)dns$(LIB_SUFFIX) \ ../../lib/lib$(LIB_PREFIX)global$(LIB_SUFFIX) \ ../../lib/lib$(LIB_PREFIX)util$(LIB_SUFFIX) +HTABLE_FIX = NORANDOMIZE=1 .c.o:; $(CC) $(CFLAGS) -c $*.c @@ -94,7 +95,7 @@ test1: $(PROG) test1.ref echo smtpd_restriction_classes = foo bar >> main.cf echo foo = yes >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test1.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test1.tmp 2>&1 diff test1.ref test1.tmp rm -f main.cf master.cf test1.tmp @@ -106,7 +107,7 @@ test2: $(PROG) test2.ref echo restriction_classes = foo bar >> main.cf echo foo = yes >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test2.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test2.tmp 2>&1 diff test2.ref test2.tmp rm -f main.cf master.cf test2.tmp @@ -119,7 +120,7 @@ test3: $(PROG) test3.ref echo 'bar = $$foo' >> main.cf echo 'always_bcc = $$bar' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test3.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test3.tmp 2>&1 diff test3.ref test3.tmp rm -f main.cf master.cf test3.tmp @@ -133,7 +134,7 @@ test4: $(PROG) test4.ref echo smtpd unix - n n - 0 smtpd >> master.cf echo ' -o always_bcc=$$bar' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test4.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test4.tmp 2>&1 diff test4.ref test4.tmp rm -f main.cf master.cf test4.tmp @@ -149,7 +150,7 @@ test4b: $(PROG) test4b.ref echo ' -o foo=xxx -o bar=yyy -o baz=zzz' >> master.cf echo '#smtpd2 unix - n n - 0 smtpd' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test4b.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test4b.tmp 2>&1 diff test4b.ref test4b.tmp rm -f main.cf master.cf test4b.tmp @@ -162,7 +163,7 @@ test5: $(PROG) test5.ref echo smtpd unix - n n - 0 smtpd >> master.cf echo ' -o bar=yes -o always_bcc=$$bar -o' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test5.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test5.tmp 2>&1 diff test5.ref test5.tmp rm -f main.cf master.cf test5.tmp @@ -173,7 +174,7 @@ test6: $(PROG) test6.ref touch main.cf master.cf echo whatevershebrings unix - n n - 0 pipe >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test6.tmp + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test6.tmp diff test6.ref test6.tmp rm -f main.cf master.cf test6.tmp @@ -184,7 +185,7 @@ test7: $(PROG) test7.ref touch main.cf master.cf echo whatevershebrings unix - n n - 0 spawn >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test7.tmp + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test7.tmp diff test7.ref test7.tmp rm -f main.cf master.cf test7.tmp @@ -194,7 +195,7 @@ test8: $(PROG) test8.ref echo whatevershebrings inet - n n - 0 spawn >> master.cf echo whatevershebrings_time_limit=1 >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test8.tmp + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test8.tmp diff test8.ref test8.tmp rm -f main.cf master.cf test8.tmp @@ -204,7 +205,7 @@ test9: $(PROG) test9.ref echo foo inet - n n - 0 spawn >> master.cf echo bar unix - n n - 0 spawn >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M '*'/inet >test9.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M '*'/inet >test9.tmp 2>&1 diff test9.ref test9.tmp rm -f main.cf master.cf test9.tmp @@ -214,7 +215,7 @@ test10: $(PROG) test10.ref echo foo inet - n n - 0 spawn >> master.cf echo bar unix - n n - 0 spawn >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M bar/inet foo/unix >test10.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M bar/inet foo/unix >test10.tmp 2>&1 diff test10.ref test10.tmp rm -f main.cf master.cf test10.tmp @@ -224,7 +225,7 @@ test11: $(PROG) test11.ref echo foo inet - n n - 0 spawn >> master.cf echo bar unix - n n - 0 spawn >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M >test11.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M >test11.tmp 2>&1 diff test11.ref test11.tmp rm -f main.cf master.cf test11.tmp @@ -239,7 +240,7 @@ test12: $(PROG) test12.ref echo foo inet - n n - 0 spawn >> master.cf echo ' -o always_bcc=$$bar -o' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M >test12.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M >test12.tmp 2>&1 diff test12.ref test12.tmp rm -f main.cf master.cf test12.tmp @@ -253,7 +254,7 @@ test13: $(PROG) test13.ref echo foo inet - n n - 0 spawn >> master.cf echo ' -o smtpd_restriction_classes=bar' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test13.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test13.tmp 2>&1 diff test13.ref test13.tmp rm -f main.cf master.cf test13.tmp @@ -266,7 +267,7 @@ test14: $(PROG) test14.ref echo foo inet - n n - 0 spawn >> master.cf echo ' -o bar=yes -o baz=xx' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test14.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test14.tmp 2>&1 diff test14.ref test14.tmp rm -f main.cf master.cf test14.tmp @@ -280,7 +281,7 @@ test15: $(PROG) test15.ref echo foo inet - n n - 0 spawn >> master.cf echo ' -o bar=yes -o always_bcc=$$bar$$baz' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test15.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test15.tmp 2>&1 diff test15.ref test15.tmp rm -f main.cf master.cf test15.tmp @@ -289,14 +290,14 @@ test15: $(PROG) test15.ref test16: $(PROG) test16.ref rm -f main.cf master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test16.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test16.tmp 2>&1 diff test16.ref test16.tmp rm -f main.cf master.cf test16.tmp test17: $(PROG) test17.ref rm -f main.cf master.cf touch -t 197101010000 main.cf - -$(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mc . >test17.tmp 2>&1; exit 0 + -$(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mc . >test17.tmp 2>&1; exit 0 diff test17.ref test17.tmp rm -f main.cf master.cf test17.tmp @@ -308,7 +309,7 @@ test18: $(PROG) test18.ref echo virtual_maps=xxx >> main.cf echo smtpd_client_connection_limit_exceptions=yyy >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test18.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test18.tmp 2>&1 diff test18.ref test18.tmp rm -f main.cf master.cf test18.tmp @@ -320,7 +321,7 @@ test19: $(PROG) test19.ref echo forward_path='$$'aaaa >> main.cf echo default_rbl_reply='$$'bbbb >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test19.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test19.tmp 2>&1 diff test19.ref test19.tmp rm -f main.cf master.cf test19.tmp @@ -332,7 +333,7 @@ test20: $(PROG) test20.ref echo foo inet - n n - 0 spawn >> master.cf echo ' -o always_bcc=$$bar$$baz' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc . >test20.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc . >test20.tmp 2>&1 diff test20.ref test20.tmp rm -f main.cf master.cf test20.tmp @@ -344,7 +345,7 @@ test21: $(PROG) test21.ref echo forward_path = xxxxxxxxxxxxx xxxxxxxxxxxxxx xxxxxxxxxxxx \ xxxxxxxxxxxxx xxxxxxxxxxxxxx >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nfc . >test21.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nfc . >test21.tmp 2>&1 diff test21.ref test21.tmp rm -f main.cf master.cf test21.tmp @@ -355,7 +356,7 @@ test22: $(PROG) test22.ref touch main.cf master.cf echo whatevershebrings unix - n n - 0 smtp >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test22.tmp + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test22.tmp diff test22.ref test22.tmp rm -f main.cf master.cf test22.tmp @@ -369,7 +370,7 @@ test23: $(PROG) test23.ref echo whatevershebrings unix - n n - 0 smtp >> master.cf echo ' -o always_bcc=$$name' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -nC builtin >test23.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -nC builtin >test23.tmp 2>&1 diff test23.ref test23.tmp rm -f main.cf master.cf test23.tmp @@ -381,7 +382,7 @@ test24: $(PROG) test24.ref echo whatevershebrings unix - n n - 0 smtp >> master.cf echo ' -o always_bcc=$$name' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -nC user >test24.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -nC user >test24.tmp 2>&1 diff test24.ref test24.tmp rm -f main.cf master.cf test24.tmp @@ -393,7 +394,7 @@ test25: $(PROG) test25.ref echo whatevershebrings unix - n n - 0 smtp >> master.cf echo ' -o always_bcc=$$name' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -C service 2>&1 | grep whatevershebrings >test25.tmp + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -C service 2>&1 | grep whatevershebrings >test25.tmp diff test25.ref test25.tmp rm -f main.cf master.cf test25.tmp @@ -407,7 +408,7 @@ test26: $(PROG) test26.ref echo whatevershebrings unix - n n - 0 smtp >> master.cf echo ' -o always_bcc=$$name' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . -C all >test26.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . -C all >test26.tmp 2>&1 diff test26.ref test26.tmp rm -f main.cf master.cf test26.tmp @@ -419,7 +420,7 @@ test27: $(PROG) test27.ref echo whatevershebrings unix - n n - 0 smtp >> master.cf echo ' -o always_bcc=$$name' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -C all 2>&1 | grep whatevershebrings >test27.tmp + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -C all 2>&1 | grep whatevershebrings >test27.tmp diff test27.ref test27.tmp rm -f main.cf master.cf test27.tmp @@ -440,7 +441,7 @@ test28: $(PROG) test28.ref echo 'aap_domain = whatever' >> main.cf echo 'aa_domain = whatever' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test28.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test28.tmp 2>&1 diff test28.ref test28.tmp rm -f main.cf master.cf test28.tmp @@ -465,7 +466,7 @@ test29: $(PROG) test29.ref echo 'memcachefoo_domain = bar' >> main.cf echo 'memcachefoo_domainx = bar' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test29.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test29.tmp 2>&1 diff test29.ref test29.tmp rm -f main.cf master.cf test29.tmp @@ -482,7 +483,7 @@ test30: $(PROG) test30.ref echo ' -oheader_checks=$$p3' >> master.cf echo ' -oheaderx_checks=$$p4' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test30.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test30.tmp 2>&1 diff test30.ref test30.tmp rm -f main.cf master.cf test30.tmp @@ -494,7 +495,7 @@ test31: $(PROG) test31.ref echo 'smtpd_helo_restrictions=whatever' >> main.cf echo 'smtpd_sender_restrictions=$$smtpd_helo_restrictions' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc . >test31.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc . >test31.tmp 2>&1 diff test31.ref test31.tmp rm -f main.cf master.cf test31.tmp @@ -505,7 +506,7 @@ test32: $(PROG) test32.ref touch main.cf master.cf echo 'relay_domains=whatever' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . fast_flush_domains >test32.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . fast_flush_domains >test32.tmp 2>&1 diff test32.ref test32.tmp rm -f main.cf master.cf test32.tmp @@ -517,7 +518,7 @@ test33: $(PROG) test33.ref echo 'mydestination=whatever' >> main.cf echo 'always_bcc=$$relay_domains' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . always_bcc >test33.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . always_bcc >test33.tmp 2>&1 diff test33.ref test33.tmp rm -f main.cf master.cf test33.tmp @@ -528,7 +529,7 @@ test34: $(PROG) test34.ref echo 'process_name=xxx' >> main.cf echo 'process_id=yyy' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . mydestination process_name >test34.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . mydestination process_name >test34.tmp 2>&1 diff test34.ref test34.tmp rm -f main.cf master.cf test34.tmp @@ -540,7 +541,7 @@ test35: $(PROG) test35.ref echo ' -o process_name=aaa' >> master.cf echo ' -o process_id=bbb' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . process_name >test35.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . process_name >test35.tmp 2>&1 diff test35.ref test35.tmp rm -f main.cf master.cf test35.tmp @@ -550,7 +551,7 @@ test36: $(PROG) test36.ref echo 'mydestination=$$virtual_mapx' >> main.cf echo 'virtual_alias_maps=$$virtual_maps' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc . >test36.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc . >test36.tmp 2>&1 diff test36.ref test36.tmp rm -f main.cf master.cf test36.tmp @@ -564,7 +565,7 @@ test37: $(PROG) test37.ref echo ' -o always_bcc=$$aaa' >> master.cf echo ' -o aaa=ccc' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfxc . >test37.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfxc . >test37.tmp 2>&1 diff test37.ref test37.tmp rm -f main.cf master.cf test37.tmp @@ -575,7 +576,7 @@ test39: $(PROG) test39.ref echo bar inet - n n - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc . '*'/unix >test39.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc . '*'/unix >test39.tmp 2>&1 diff test39.ref test39.tmp rm -f main.cf master.cf test39.tmp @@ -587,7 +588,7 @@ test40: $(PROG) test40.ref echo ' -vo ccc=$$aaa' >> master.cf echo ' -v -oddd=$$ccc' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfxc . '*'/unix >test40.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfxc . '*'/unix >test40.tmp 2>&1 diff test40.ref test40.tmp rm -f main.cf master.cf test40.tmp @@ -598,11 +599,11 @@ test41: $(PROG) test41.ref echo bar unix - n n - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=yyy bar/unix/aaa=bbb >test41.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test41.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=YYY bar/unix/aaa=BBB >>test41.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test41.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . >>test41.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=yyy bar/unix/aaa=bbb >test41.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test41.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=YYY bar/unix/aaa=BBB >>test41.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test41.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . >>test41.tmp 2>&1 diff test41.ref test41.tmp rm -f main.cf master.cf test41.tmp @@ -613,11 +614,11 @@ test42: $(PROG) test42.ref echo bar unix - n n - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=yyy bar/unix/aaa=bbb >test42.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test42.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . >>test42.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -PXc. bar/unix/xxx bar/unix/aaa >>test42.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test42.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=yyy bar/unix/aaa=bbb >test42.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test42.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . >>test42.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -PXc. bar/unix/xxx bar/unix/aaa >>test42.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test42.tmp 2>&1 diff test42.ref test42.tmp rm -f main.cf master.cf test42.tmp @@ -628,8 +629,8 @@ test43: $(PROG) test43.ref echo bar unix - n n - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Fc . bar/unix/chroot=y bar/unix/command='aa -stuffobb=cc dd' >test43.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test43.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Fc . bar/unix/chroot=y bar/unix/command='aa -stuffobb=cc dd' >test43.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test43.tmp 2>&1 diff test43.ref test43.tmp rm -f main.cf master.cf test43.tmp @@ -640,8 +641,8 @@ test44: $(PROG) test44.ref echo bar unix - n n - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mc . bar/unix='xx inet - n n - 0 aa -stuffobb=cc dd' >test44.tmp 2>&1 - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test44.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mc . bar/unix='xx inet - n n - 0 aa -stuffobb=cc dd' >test44.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test44.tmp 2>&1 diff test44.ref test44.tmp rm -f main.cf master.cf test44.tmp @@ -652,7 +653,7 @@ test45: $(PROG) test45.ref echo bar xxxx - n n - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test45.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test45.tmp 2>&1 || true diff test45.ref test45.tmp rm -f main.cf master.cf test45.tmp @@ -663,7 +664,7 @@ test46: $(PROG) test46.ref echo bar inet X n n - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test46.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test46.tmp 2>&1 || true diff test46.ref test46.tmp rm -f main.cf master.cf test46.tmp @@ -674,7 +675,7 @@ test47: $(PROG) test47.ref echo bar inet - X n - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test47.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test47.tmp 2>&1 || true diff test47.ref test47.tmp rm -f main.cf master.cf test47.tmp @@ -685,7 +686,7 @@ test48: $(PROG) test48.ref echo bar inet - n X - 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test48.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test48.tmp 2>&1 || true diff test48.ref test48.tmp rm -f main.cf master.cf test48.tmp @@ -696,7 +697,7 @@ test49: $(PROG) test49.ref echo bar inet - n n X 0 other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test49.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test49.tmp 2>&1 || true diff test49.ref test49.tmp rm -f main.cf master.cf test49.tmp @@ -707,7 +708,7 @@ test50: $(PROG) test50.ref echo bar inet - n n - X other >> master.cf echo baz unix - n n - 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test50.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test50.tmp 2>&1 || true diff test50.ref test50.tmp rm -f main.cf master.cf test50.tmp @@ -718,7 +719,7 @@ test51: $(PROG) test51.ref echo bar inet - n n X? 0 other >> master.cf echo baz unix - n n 0? 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test51.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test51.tmp 2>&1 || true diff test51.ref test51.tmp rm -f main.cf master.cf test51.tmp @@ -729,8 +730,8 @@ test52: $(PROG) test52.ref echo bar inet - n n 0 0 other >> master.cf echo baz unix - n n 0 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -MXc. bar/inet foo/unix xxx/yyy - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test52.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -MXc. bar/inet foo/unix xxx/yyy + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test52.tmp 2>&1 || true diff test52.ref test52.tmp rm -f main.cf master.cf test52.tmp @@ -741,7 +742,7 @@ test53: $(PROG) test53.ref echo bar inet - n n 0 0 other >> master.cf echo baz unix - n n 0 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet xxx/yyy + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet xxx/yyy diff test53.ref master.cf rm -f main.cf master.cf test53.tmp @@ -752,7 +753,7 @@ test54: $(PROG) test54.ref echo bar inet - n n 0 0 other >> master.cf echo baz unix - n n 0 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet foo/unix + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet foo/unix diff test54.ref master.cf rm -f main.cf master.cf test54.tmp @@ -763,7 +764,7 @@ test55: $(PROG) test55.ref echo bar inet - n n 0 0 other >> master.cf echo baz unix - n n 0 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet baz/unix + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet baz/unix diff test55.ref master.cf rm -f main.cf master.cf test55.tmp @@ -776,7 +777,7 @@ test56: $(PROG) test56.ref echo " -o second" >> master.cf echo baz unix - n n 0 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet xxx/yyy + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet xxx/yyy diff test56.ref master.cf rm -f main.cf master.cf test56.tmp @@ -793,7 +794,7 @@ test57: $(PROG) test57.ref echo 't1 = Postfix 2.11 $${{$${x?bug:x}} == {bug}?in}compatible' >> main.cf echo 't2 = $$t1' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc. >test57.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc. >test57.tmp 2>&1 diff test57.ref test57.tmp rm -f main.cf master.cf test57.tmp @@ -806,7 +807,7 @@ test58: $(PROG) test58.ref echo 'yy_backup = bbb' >> main.cf echo 'yy_bogus = bbb' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./postconf -nc. >test58.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./postconf -nc. >test58.tmp 2>&1 || true diff test58.ref test58.tmp rm -f main.cf master.cf test58.tmp @@ -822,7 +823,7 @@ test59: $(PROG) test59.ref echo " { arg3a arg3b " >> master.cf echo baz unix - n n 0 0 other >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test59.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test59.tmp 2>&1 || true diff test59.ref test59.tmp rm -f main.cf master.cf test59.tmp @@ -832,7 +833,7 @@ test60: $(PROG) test60.ref echo foo unix - n n - 0 other >> master.cf echo ' -o always_bcc=bar' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Fhc. >test60.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Fhc. >test60.tmp 2>&1 || true diff test60.ref test60.tmp rm -f main.cf master.cf test60.tmp @@ -842,7 +843,7 @@ test61: $(PROG) test61.ref echo foo unix - n n - 0 other >> master.cf echo ' -o always_bcc=bar' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Phc. >test61.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Phc. >test61.tmp 2>&1 || true diff test61.ref test61.tmp rm -f main.cf master.cf test61.tmp @@ -852,7 +853,7 @@ test62: $(PROG) test62.ref echo foo unix - n n - 0 other >> master.cf echo ' -o always_bcc=bar' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -FHc. >test62.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -FHc. >test62.tmp 2>&1 || true diff test62.ref test62.tmp rm -f main.cf master.cf test62.tmp @@ -862,7 +863,7 @@ test63: $(PROG) test63.ref echo foo unix - n n - 0 other >> master.cf echo ' -o always_bcc=bar' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -PHc. >test63.tmp 2>&1 || true + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -PHc. >test63.tmp 2>&1 || true diff test63.ref test63.tmp rm -f main.cf master.cf test63.tmp @@ -873,7 +874,7 @@ test64: $(PROG) test64.ref touch main.cf master.cf echo 'relayhost = relay-from-main.cf' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. relayhost >test64.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. relayhost >test64.tmp 2>&1 diff test64.ref test64.tmp rm -f main.cf master.cf test64.tmp @@ -884,7 +885,7 @@ test65: $(PROG) test65.ref touch main.cf master.cf echo 'relayhost = relay-from-main.cf' >> main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. -o relayhost=relay-from-cmd-line relayhost >test65.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. -o relayhost=relay-from-cmd-line relayhost >test65.tmp 2>&1 diff test65.ref test65.tmp rm -f main.cf master.cf test65.tmp @@ -900,7 +901,7 @@ test66: $(PROG) test66.ref echo " " memcache:`pwd`/test66.cf >> main.cf echo junk = junk >> test66.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. 2>test66.tmp >/dev/null + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. 2>test66.tmp >/dev/null sed "s;PWD;`pwd`;" test66.ref | diff - test66.tmp rm -f main.cf master.cf test66.tmp test66.cf @@ -916,7 +917,7 @@ test67: $(PROG) test67.ref echo ' -o test2_process_name=$$process_name' >> master.cf echo ' -o test2_service_name=$$service_name' >> master.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xMfc. >test67.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xMfc. >test67.tmp 2>&1 diff test67.ref test67.tmp rm -f main.cf master.cf test67.tmp @@ -931,7 +932,7 @@ test68: $(PROG) test68.ref echo " " memcache:`pwd`/test68.cf >> main.cf echo junk = junk >> test68.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. 2>test68.tmp >/dev/null + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. 2>test68.tmp >/dev/null sed "s;PWD;`pwd`;" test68.ref | diff - test68.tmp rm -f main.cf master.cf test68.tmp test68.cf @@ -945,7 +946,7 @@ test69: $(PROG) test69.ref echo ' -o body_checks=$$ldap/test69.cf' >> master.cf echo junk = junk >> test69.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test69.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test69.tmp 2>&1 sed "s;PWD;`pwd`;" test69.ref | diff - test69.tmp rm -f main.cf master.cf test69.tmp test69.cf @@ -961,7 +962,7 @@ test70: $(PROG) test70.ref echo "used_server_host = 127.0.0.1" >>main.cf echo "unused_server_host = 127.0.0.1" >>main.cf touch -t 197101010000 main.cf - $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test70.tmp 2>&1 + $(HTABLE_FIX) $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test70.tmp 2>&1 diff test70.ref test70.tmp rm -f main.cf master.cf test70.tmp test70.cf @@ -995,6 +996,7 @@ depend: $(MAKES) # do not edit below this line - it is generated by 'make depend' postconf.o: ../../include/argv.h postconf.o: ../../include/check_arg.h +postconf.o: ../../include/compat_level.h postconf.o: ../../include/dict.h postconf.o: ../../include/htable.h postconf.o: ../../include/mail_conf.h diff --git a/external/ibm-public/postfix/dist/src/postconf/extract.awk b/external/ibm-public/postfix/dist/src/postconf/extract.awk index 13b1f916696..809020d4bd2 100644 --- a/external/ibm-public/postfix/dist/src/postconf/extract.awk +++ b/external/ibm-public/postfix/dist/src/postconf/extract.awk @@ -18,9 +18,12 @@ # have a more modern implementation that is XPG4-compatible, but it # is too much bother to find out where each system keeps these. +{ owned_by_library = (FILENAME ~ /\/(global|tls)\//) } + /^(static| )*(const +)?CONFIG_INT_TABLE .*\{/,/\};/ { if ($1 ~ /VAR/) { - int_vars["int " substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + int_vars["int " substr($3,2,length($3)-2) ";"] = 1 if (++itab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { int_table[$0] = 1 } @@ -28,7 +31,8 @@ } /^(static| )*(const +)?CONFIG_STR_TABLE .*\{/,/\};/ { if ($1 ~ /^VAR/) { - str_vars["char *" substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + str_vars["char *" substr($3,2,length($3)-2) ";"] = 1 if (++stab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { str_table[$0] = 1 } @@ -36,7 +40,8 @@ } /^(static| )*(const +)?CONFIG_STR_FN_TABLE .*\{/,/\};/ { if ($1 ~ /^VAR/) { - str_fn_vars["char *" substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + str_fn_vars["char *" substr($3,2,length($3)-2) ";"] = 1 $2 = "pcf_" $2 if (++stab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { str_fn_table[$0] = 1 @@ -45,7 +50,8 @@ } /^(static| )*(const +)?CONFIG_RAW_TABLE .*\{/,/\};/ { if ($1 ~ /^VAR/) { - raw_vars["char *" substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + raw_vars["char *" substr($3,2,length($3)-2) ";"] = 1 if (++rtab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { raw_table[$0] = 1 } @@ -53,7 +59,8 @@ } /^(static| )*(const +)?CONFIG_BOOL_TABLE .*\{/,/\};/ { if ($1 ~ /^VAR/) { - bool_vars["int " substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + bool_vars["int " substr($3,2,length($3)-2) ";"] = 1 if (++btab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { bool_table[$0] = 1 } @@ -61,7 +68,8 @@ } /^(static| )*(const +)?CONFIG_TIME_TABLE .*\{/,/\};/ { if ($1 ~ /^VAR/) { - time_vars["int " substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + time_vars["int " substr($3,2,length($3)-2) ";"] = 1 if (++ttab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { time_table[$0] = 1 } @@ -69,7 +77,8 @@ } /^(static| )*(const +)?CONFIG_NINT_TABLE .*\{/,/\};/ { if ($1 ~ /VAR/) { - nint_vars["int " substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + nint_vars["int " substr($3,2,length($3)-2) ";"] = 1 if (++itab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { nint_table[$0] = 1 } @@ -77,7 +86,8 @@ } /^(static| )*(const +)?CONFIG_NBOOL_TABLE .*\{/,/\};/ { if ($1 ~ /^VAR/) { - nbool_vars["int " substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + nbool_vars["int " substr($3,2,length($3)-2) ";"] = 1 if (++btab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { nbool_table[$0] = 1 } @@ -85,7 +95,8 @@ } /^(static| )*(const +)?CONFIG_LONG_TABLE .*\{/,/\};/ { if ($1 ~ /VAR/) { - long_vars["long " substr($3,2,length($3)-2) ";"] = 1 + if (!owned_by_library) + long_vars["long " substr($3,2,length($3)-2) ";"] = 1 if (++itab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) { long_table[$0] = 1 } diff --git a/external/ibm-public/postfix/dist/src/postconf/install_vars.h b/external/ibm-public/postfix/dist/src/postconf/install_vars.h index 6bfb758f50b..6ceaa5f1b75 100644 --- a/external/ibm-public/postfix/dist/src/postconf/install_vars.h +++ b/external/ibm-public/postfix/dist/src/postconf/install_vars.h @@ -1,4 +1,3 @@ -/* $NetBSD: install_vars.h,v 1.1.1.2 2013/01/02 18:59:03 tron Exp $ */ +/* $NetBSD: install_vars.h,v 1.1.1.3 2022/10/08 16:09:09 christos Exp $ */ -char *var_config_dir; char *var_debug_command; diff --git a/external/ibm-public/postfix/dist/src/postconf/test28.ref b/external/ibm-public/postfix/dist/src/postconf/test28.ref index cb117b009ee..4e9373463f0 100644 --- a/external/ibm-public/postfix/dist/src/postconf/test28.ref +++ b/external/ibm-public/postfix/dist/src/postconf/test28.ref @@ -6,5 +6,5 @@ hh_domain = whatever yy = aap zz = $yy ./postconf: warning: ./main.cf: unused parameter: foo_domain=bar -./postconf: warning: ./main.cf: unused parameter: aa_domain=whatever ./postconf: warning: ./main.cf: unused parameter: xx=proxy:ldap:foo +./postconf: warning: ./main.cf: unused parameter: aa_domain=whatever diff --git a/external/ibm-public/postfix/dist/src/postconf/test29.ref b/external/ibm-public/postfix/dist/src/postconf/test29.ref index d44e38dcbc3..646890aaa1c 100644 --- a/external/ibm-public/postfix/dist/src/postconf/test29.ref +++ b/external/ibm-public/postfix/dist/src/postconf/test29.ref @@ -1,16 +1,16 @@ config_directory = . -./postconf: warning: ./main.cf: unused parameter: sqlitexx=proxy:sqlite:sqlitefoo -./postconf: warning: ./main.cf: unused parameter: pgsqlxx=proxy:pgsql:pgsqlfoo -./postconf: warning: ./main.cf: unused parameter: ldapfoo_domain=bar -./postconf: warning: ./main.cf: unused parameter: memcachefoo_domainx=bar -./postconf: warning: ./main.cf: unused parameter: sqlitefoo_domainx=bar +./postconf: warning: ./main.cf: unused parameter: pgsqlfoo_domain=bar ./postconf: warning: ./main.cf: unused parameter: sqlitefoo_domain=bar -./postconf: warning: ./main.cf: unused parameter: memcachexx=proxy:memcache:memcachefoo -./postconf: warning: ./main.cf: unused parameter: mysqlxx=proxy:mysql:mysqlfoo ./postconf: warning: ./main.cf: unused parameter: ldapxx=proxy:ldap:ldapfoo -./postconf: warning: ./main.cf: unused parameter: ldapfoo_domainx=bar +./postconf: warning: ./main.cf: unused parameter: sqlitexx=proxy:sqlite:sqlitefoo +./postconf: warning: ./main.cf: unused parameter: mysqlfoo_domain=bar +./postconf: warning: ./main.cf: unused parameter: sqlitefoo_domainx=bar ./postconf: warning: ./main.cf: unused parameter: memcachefoo_domain=bar ./postconf: warning: ./main.cf: unused parameter: pgsqlfoo_domainx=bar +./postconf: warning: ./main.cf: unused parameter: ldapfoo_domainx=bar +./postconf: warning: ./main.cf: unused parameter: ldapfoo_domain=bar +./postconf: warning: ./main.cf: unused parameter: memcachexx=proxy:memcache:memcachefoo +./postconf: warning: ./main.cf: unused parameter: memcachefoo_domainx=bar ./postconf: warning: ./main.cf: unused parameter: mysqlfoo_domainx=bar -./postconf: warning: ./main.cf: unused parameter: mysqlfoo_domain=bar -./postconf: warning: ./main.cf: unused parameter: pgsqlfoo_domain=bar +./postconf: warning: ./main.cf: unused parameter: mysqlxx=proxy:mysql:mysqlfoo +./postconf: warning: ./main.cf: unused parameter: pgsqlxx=proxy:pgsql:pgsqlfoo diff --git a/external/ibm-public/postfix/dist/src/postconf/test34.ref b/external/ibm-public/postfix/dist/src/postconf/test34.ref index e7712932f32..2c9d6bd55d1 100644 --- a/external/ibm-public/postfix/dist/src/postconf/test34.ref +++ b/external/ibm-public/postfix/dist/src/postconf/test34.ref @@ -1,4 +1,4 @@ -./postconf: warning: ./main.cf: read-only parameter assignment: process_id=yyy ./postconf: warning: ./main.cf: read-only parameter assignment: process_name=xxx +./postconf: warning: ./main.cf: read-only parameter assignment: process_id=yyy mydestination = whatever process_name = postconf diff --git a/external/ibm-public/postfix/dist/src/postconf/test35.ref b/external/ibm-public/postfix/dist/src/postconf/test35.ref index dc27f397b10..601648f7b22 100644 --- a/external/ibm-public/postfix/dist/src/postconf/test35.ref +++ b/external/ibm-public/postfix/dist/src/postconf/test35.ref @@ -1,3 +1,3 @@ -./postconf: warning: ./master.cf: read-only parameter assignment: process_id=bbb ./postconf: warning: ./master.cf: read-only parameter assignment: process_name=aaa +./postconf: warning: ./master.cf: read-only parameter assignment: process_id=bbb process_name = postconf diff --git a/external/ibm-public/postfix/dist/src/postconf/test58.ref b/external/ibm-public/postfix/dist/src/postconf/test58.ref index 1e74c4a2e2f..ac24a4d31b3 100644 --- a/external/ibm-public/postfix/dist/src/postconf/test58.ref +++ b/external/ibm-public/postfix/dist/src/postconf/test58.ref @@ -4,5 +4,5 @@ config_directory = . mydestination = foo bar pipemap:{ldap:xxx, memcache:yy}x randmap:{xx xxx_domain = foo yy_backup = bbb -./postconf: warning: ./main.cf: unused parameter: yy_bogus=bbb ./postconf: warning: ./main.cf: unused parameter: xxx_bogus=foo +./postconf: warning: ./main.cf: unused parameter: yy_bogus=bbb diff --git a/external/ibm-public/postfix/dist/src/postconf/test59.ref b/external/ibm-public/postfix/dist/src/postconf/test59.ref index 3a7e57f6aa9..c5cb3f6a082 100644 --- a/external/ibm-public/postfix/dist/src/postconf/test59.ref +++ b/external/ibm-public/postfix/dist/src/postconf/test59.ref @@ -6,5 +6,5 @@ bar inet - n n 0 0 other -o {name2=value2a value2b} arg1a arg1b {arg2a arg2b} {arg3a arg3b} baz unix - n n 0 0 other -./postconf: warning: ./master.cf: unused parameter: name1=value1 ./postconf: warning: ./master.cf: unused parameter: name2=value2a value2b +./postconf: warning: ./master.cf: unused parameter: name1=value1 diff --git a/external/ibm-public/postfix/dist/src/postconf/test67.ref b/external/ibm-public/postfix/dist/src/postconf/test67.ref index 03def6f4600..2014e99253b 100644 --- a/external/ibm-public/postfix/dist/src/postconf/test67.ref +++ b/external/ibm-public/postfix/dist/src/postconf/test67.ref @@ -4,7 +4,7 @@ smtp inet n - n - - smtpd smtp unix n - n - - smtp -o test2_process_name=smtp -o test2_service_name=smtp -./postconf: warning: ./master.cf: unused parameter: test1_process_name=$process_name ./postconf: warning: ./master.cf: unused parameter: test1_service_name=$service_name -./postconf: warning: ./master.cf: unused parameter: test2_process_name=$process_name +./postconf: warning: ./master.cf: unused parameter: test1_process_name=$process_name ./postconf: warning: ./master.cf: unused parameter: test2_service_name=$service_name +./postconf: warning: ./master.cf: unused parameter: test2_process_name=$process_name diff --git a/external/ibm-public/postfix/dist/src/postdrop/Makefile.in b/external/ibm-public/postfix/dist/src/postdrop/Makefile.in index 6ae3f7a9f7b..cd60a943daf 100644 --- a/external/ibm-public/postfix/dist/src/postdrop/Makefile.in +++ b/external/ibm-public/postfix/dist/src/postdrop/Makefile.in @@ -63,8 +63,10 @@ postdrop.o: ../../include/attr.h postdrop.o: ../../include/check_arg.h postdrop.o: ../../include/clean_env.h postdrop.o: ../../include/cleanup_user.h +postdrop.o: ../../include/dict.h postdrop.o: ../../include/htable.h postdrop.o: ../../include/iostuff.h +postdrop.o: ../../include/login_sender_match.h postdrop.o: ../../include/mail_conf.h postdrop.o: ../../include/mail_dict.h postdrop.o: ../../include/mail_params.h @@ -77,7 +79,9 @@ postdrop.o: ../../include/mail_version.h postdrop.o: ../../include/maillog_client.h postdrop.o: ../../include/msg.h postdrop.o: ../../include/msg_vstream.h +postdrop.o: ../../include/myflock.h postdrop.o: ../../include/mymalloc.h +postdrop.o: ../../include/mypwd.h postdrop.o: ../../include/nvtable.h postdrop.o: ../../include/rec_attr_map.h postdrop.o: ../../include/rec_type.h diff --git a/external/ibm-public/postfix/dist/src/postfix/Makefile.in b/external/ibm-public/postfix/dist/src/postfix/Makefile.in index 56ff96b0b15..dc3bf430964 100644 --- a/external/ibm-public/postfix/dist/src/postfix/Makefile.in +++ b/external/ibm-public/postfix/dist/src/postfix/Makefile.in @@ -65,6 +65,7 @@ depend: $(MAKES) postfix.o: ../../include/argv.h postfix.o: ../../include/check_arg.h postfix.o: ../../include/clean_env.h +postfix.o: ../../include/compat_level.h postfix.o: ../../include/mail_conf.h postfix.o: ../../include/mail_params.h postfix.o: ../../include/mail_parm_split.h diff --git a/external/ibm-public/postfix/dist/src/postlog/Makefile.in b/external/ibm-public/postfix/dist/src/postlog/Makefile.in index 84ee53e4b60..297eae20c95 100644 --- a/external/ibm-public/postfix/dist/src/postlog/Makefile.in +++ b/external/ibm-public/postfix/dist/src/postlog/Makefile.in @@ -74,6 +74,7 @@ postlog.o: ../../include/maillog_client.h postlog.o: ../../include/msg.h postlog.o: ../../include/msg_output.h postlog.o: ../../include/msg_vstream.h +postlog.o: ../../include/stringops.h postlog.o: ../../include/sys_defs.h postlog.o: ../../include/vbuf.h postlog.o: ../../include/vstream.h diff --git a/external/ibm-public/postfix/dist/src/postlogd/Makefile.in b/external/ibm-public/postfix/dist/src/postlogd/Makefile.in index bdf7d050f84..21fad76dd85 100644 --- a/external/ibm-public/postfix/dist/src/postlogd/Makefile.in +++ b/external/ibm-public/postfix/dist/src/postlogd/Makefile.in @@ -61,14 +61,19 @@ depend: $(MAKES) # do not edit below this line - it is generated by 'make depend' postlogd.o: ../../include/check_arg.h +postlogd.o: ../../include/htable.h postlogd.o: ../../include/logwriter.h postlogd.o: ../../include/mail_conf.h postlogd.o: ../../include/mail_params.h postlogd.o: ../../include/mail_server.h +postlogd.o: ../../include/mail_task.h postlogd.o: ../../include/mail_version.h +postlogd.o: ../../include/maillog_client.h postlogd.o: ../../include/msg.h postlogd.o: ../../include/msg_logger.h +postlogd.o: ../../include/stringops.h postlogd.o: ../../include/sys_defs.h postlogd.o: ../../include/vbuf.h postlogd.o: ../../include/vstream.h +postlogd.o: ../../include/vstring.h postlogd.o: postlogd.c diff --git a/external/ibm-public/postfix/dist/src/postmap/Makefile.in b/external/ibm-public/postfix/dist/src/postmap/Makefile.in index 3667bb65b42..dc5369d9b06 100644 --- a/external/ibm-public/postfix/dist/src/postmap/Makefile.in +++ b/external/ibm-public/postfix/dist/src/postmap/Makefile.in @@ -26,40 +26,39 @@ update: ../../bin/$(PROG) ../../bin/$(PROG): $(PROG) cp $(PROG) ../../bin -tests: test1 test2 fail_test quote_test file_test +tests: test1 test2 fail_test quote_test file_test lmdb_abb_test \ + lmdb_bulk_test lmdb_incr_test root_tests: test1: $(PROG) map.in map-abc1.ref map-ghi1.ref map-uABC1.ref - $(SHLIB_ENV) ./$(PROG) map.in + $(SHLIB_ENV) $(VALGRIND) ./$(PROG) map.in for key in abc ghi; \ do \ - $(SHLIB_ENV) ./$(PROG) -q $${key} map.in | diff map-$${key}1.ref -; \ + $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -q $${key} map.in | diff map-$${key}1.ref -; \ done - $(SHLIB_ENV) ./$(PROG) -f map.in + $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -f map.in for key in ABC; \ do \ - $(SHLIB_ENV) ./$(PROG) -fq $${key} map.in | diff map-u$${key}1.ref -; \ + $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -fq $${key} map.in | diff map-u$${key}1.ref -; \ done rm -f map.in.db test2: $(PROG) map.in map-abc2.ref map-ghi2.ref map-uABC2.ref - $(SHLIB_ENV) ./$(PROG) map.in + $(SHLIB_ENV) $(VALGRIND) ./$(PROG) map.in for key in abc ghi; \ do \ - echo $${key} | $(SHLIB_ENV) ./$(PROG) -q - map.in | diff map-$${key}2.ref -; \ + echo $${key} | $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -q - map.in | diff map-$${key}2.ref -; \ done - $(SHLIB_ENV) ./$(PROG) -f map.in + $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -f map.in for key in ABC; \ do \ - echo $${key} | $(SHLIB_ENV) ./$(PROG) -fq - map.in | diff map-u$${key}2.ref -; \ + echo $${key} | $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -fq - map.in | diff map-u$${key}2.ref -; \ done rm -f map.in.db fail_test: $(PROG) aliases fail_test.in fail_test.ref - -($(SHLIB_ENV) sh fail_test.in || exit 0) 2>&1 | \ - sed -e 's/No error:/Unknown error:/' \ - -e 's/Success/Unknown error: 0/' > fail_test.tmp + -($(SHLIB_ENV) sh fail_test.in || exit 0) >fail_test.tmp 2>&1 diff fail_test.ref fail_test.tmp rm -f fail_test.tmp @@ -75,6 +74,35 @@ file_test: $(PROG) file_test.in file_test.ref diff file_test.ref file_test.tmp rm -f file_test.tmp file_test_map.* postmap-file-1 postmap-file-2 +lmdb_abb_test: $(PROG) lmdb_abb lmdb_abb.ref + rm -f lmdb_abb.lmdb + ($(SHLIB_ENV) $(VALGRIND) ./postmap lmdb:lmdb_abb; \ + $(SHLIB_ENV) $(VALGRIND) ./postmap -s lmdb:lmdb_abb | sort) >lmdb_abb.tmp 2>&1 + diff lmdb_abb.ref lmdb_abb.tmp + rm -f lmdb_abb.tmp lmdb_abb.lmdb + +lmdb_bulk_test: $(PROG) + rm -f lmdb_retry.lmdb main.cf + tr A-Z a-z < /usr/share/dict/words| \ + sed -e 's/.*/& &/' -e 10000q| LANG=C sort -u >lmdb_retry + echo lmdb_map_size=10240 >main.cf + ($(SHLIB_ENV) $(VALGRIND) ./postmap -c . lmdb:lmdb_retry; \ + $(SHLIB_ENV) $(VALGRIND) ./postmap -s lmdb:lmdb_retry | \ + LANG=C sort > lmdb_retry.tmp) + cmp lmdb_retry lmdb_retry.tmp + rm -f lmdb_retry lmdb_retry.tmp lmdb_retry.lmdb main.cf + +lmdb_incr_test: $(PROG) + rm -f lmdb_retry.lmdb main.cf + tr A-Z a-z < /usr/share/dict/words| \ + sed -e 's/.*/& &/' -e 1000q| LANG=C sort -u >lmdb_retry + echo lmdb_map_size=10240 >main.cf + ($(SHLIB_ENV) $(VALGRIND) ./postmap -ic . lmdb:lmdb_retry <lmdb_retry; \ + $(SHLIB_ENV) $(VALGRIND) ./postmap -s lmdb:lmdb_retry | \ + LANG=C sort > lmdb_retry.tmp) + cmp lmdb_retry lmdb_retry.tmp + rm -f lmdb_retry lmdb_retry.tmp lmdb_retry.lmdb main.cf + printfck: $(OBJS) $(PROG) rm -rf printfck mkdir printfck diff --git a/external/ibm-public/postfix/dist/src/postmap/fail_test.ref b/external/ibm-public/postfix/dist/src/postmap/fail_test.ref index eb3e5967ceb..54c6f330b43 100644 --- a/external/ibm-public/postfix/dist/src/postmap/fail_test.ref +++ b/external/ibm-public/postfix/dist/src/postmap/fail_test.ref @@ -1,8 +1,8 @@ -postmap: fatal: table fail:aliases: query error: Unknown error: 0 -postmap: fatal: table fail:aliases: query error: Unknown error: 0 -postmap: fatal: table fail:aliases: query error: Unknown error: 0 -postmap: fatal: table fail:aliases: delete error: Unknown error: 0 -postmap: fatal: table fail:aliases: delete error: Unknown error: 0 -postmap: fatal: table fail:aliases: sequence error: Unknown error: 0 -postmap: fatal: table fail:aliases: write error: Unknown error: 0 -postmap: fatal: table fail:aliases: write error: Unknown error: 0 +postmap: fatal: table fail:aliases: query error: Application error +postmap: fatal: table fail:aliases: query error: Application error +postmap: fatal: table fail:aliases: query error: Application error +postmap: fatal: table fail:aliases: delete error: Application error +postmap: fatal: table fail:aliases: delete error: Application error +postmap: fatal: table fail:aliases: sequence error: Application error +postmap: fatal: table fail:aliases: write error: Application error +postmap: fatal: table fail:aliases: write error: Application error diff --git a/external/ibm-public/postfix/dist/src/postmap/lmdb_abb b/external/ibm-public/postfix/dist/src/postmap/lmdb_abb new file mode 100644 index 00000000000..7ea8d0381a4 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/postmap/lmdb_abb @@ -0,0 +1,3 @@ +a 1 +b 2 +b 3 diff --git a/external/ibm-public/postfix/dist/src/postmap/lmdb_abb.ref b/external/ibm-public/postfix/dist/src/postmap/lmdb_abb.ref new file mode 100644 index 00000000000..ea66c71a442 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/postmap/lmdb_abb.ref @@ -0,0 +1,3 @@ +postmap: warning: lmdb:lmdb_abb: duplicate entry: "b" +a 1 +b 2 diff --git a/external/ibm-public/postfix/dist/src/postscreen/Makefile.in b/external/ibm-public/postfix/dist/src/postscreen/Makefile.in index 82798ed734d..8ed86922988 100644 --- a/external/ibm-public/postfix/dist/src/postscreen/Makefile.in +++ b/external/ibm-public/postfix/dist/src/postscreen/Makefile.in @@ -417,6 +417,7 @@ postscreen_tests.o: ../../include/msg.h postscreen_tests.o: ../../include/myaddrinfo.h postscreen_tests.o: ../../include/myflock.h postscreen_tests.o: ../../include/name_code.h +postscreen_tests.o: ../../include/sane_strtol.h postscreen_tests.o: ../../include/server_acl.h postscreen_tests.o: ../../include/string_list.h postscreen_tests.o: ../../include/sys_defs.h diff --git a/external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in b/external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in index 8855002f2cf..d246303f2fe 100644 --- a/external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in +++ b/external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in @@ -74,6 +74,7 @@ posttls-finger.o: ../../include/host_port.h posttls-finger.o: ../../include/htable.h posttls-finger.o: ../../include/inet_proto.h posttls-finger.o: ../../include/iostuff.h +posttls-finger.o: ../../include/known_tcp_ports.h posttls-finger.o: ../../include/mail_conf.h posttls-finger.o: ../../include/mail_params.h posttls-finger.o: ../../include/mail_parm_split.h diff --git a/external/ibm-public/postfix/dist/src/proxymap/Makefile.in b/external/ibm-public/postfix/dist/src/proxymap/Makefile.in index bac724748fc..925f98ffa29 100644 --- a/external/ibm-public/postfix/dist/src/proxymap/Makefile.in +++ b/external/ibm-public/postfix/dist/src/proxymap/Makefile.in @@ -63,7 +63,9 @@ proxymap.o: ../../include/argv.h proxymap.o: ../../include/attr.h proxymap.o: ../../include/check_arg.h proxymap.o: ../../include/dict.h +proxymap.o: ../../include/dict_pipe.h proxymap.o: ../../include/dict_proxy.h +proxymap.o: ../../include/dict_union.h proxymap.o: ../../include/htable.h proxymap.o: ../../include/iostuff.h proxymap.o: ../../include/mail_conf.h diff --git a/external/ibm-public/postfix/dist/src/qmgr/qmgr_feedback.c b/external/ibm-public/postfix/dist/src/qmgr/qmgr_feedback.c index 33351071a65..3270c9e8bcb 100644 --- a/external/ibm-public/postfix/dist/src/qmgr/qmgr_feedback.c +++ b/external/ibm-public/postfix/dist/src/qmgr/qmgr_feedback.c @@ -1,4 +1,4 @@ -/* $NetBSD: qmgr_feedback.c,v 1.1.1.1 2009/06/23 10:08:52 tron Exp $ */ +/* $NetBSD: qmgr_feedback.c,v 1.1.1.2 2022/10/08 16:09:10 christos Exp $ */ /*++ /* NAME @@ -63,6 +63,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ @@ -111,7 +116,7 @@ void qmgr_feedback_init(QMGR_FEEDBACK *fb, double enum_val; char denom_str[30 + 1]; double denom_val; - char slash; + char slash[1 + 1]; char junk; char *fbck_name; char *fbck_val; @@ -137,7 +142,7 @@ void qmgr_feedback_init(QMGR_FEEDBACK *fb, fb->base = -1; /* assume error */ switch (sscanf(fbck_val, "%lf %1[/] %30s%c", - &enum_val, &slash, denom_str, &junk)) { + &enum_val, slash, denom_str, &junk)) { case 1: fb->index = QMGR_FEEDBACK_IDX_NONE; fb->base = enum_val; diff --git a/external/ibm-public/postfix/dist/src/smtp/Makefile.in b/external/ibm-public/postfix/dist/src/smtp/Makefile.in index 140192f89ae..65f41982f64 100644 --- a/external/ibm-public/postfix/dist/src/smtp/Makefile.in +++ b/external/ibm-public/postfix/dist/src/smtp/Makefile.in @@ -93,14 +93,17 @@ smtp.o: ../../include/byte_mask.h smtp.o: ../../include/check_arg.h smtp.o: ../../include/debug_peer.h smtp.o: ../../include/deliver_request.h +smtp.o: ../../include/delivered_hdr.h smtp.o: ../../include/dict.h smtp.o: ../../include/dns.h smtp.o: ../../include/dsn.h smtp.o: ../../include/dsn_buf.h smtp.o: ../../include/ext_prop.h smtp.o: ../../include/flush_clnt.h +smtp.o: ../../include/fold_addr.h smtp.o: ../../include/header_body_checks.h smtp.o: ../../include/header_opts.h +smtp.o: ../../include/hfrom_format.h smtp.o: ../../include/htable.h smtp.o: ../../include/iostuff.h smtp.o: ../../include/mail_conf.h @@ -192,6 +195,7 @@ smtp_chat.o: ../../include/dsn_buf.h smtp_chat.o: ../../include/dsn_util.h smtp_chat.o: ../../include/header_body_checks.h smtp_chat.o: ../../include/header_opts.h +smtp_chat.o: ../../include/hfrom_format.h smtp_chat.o: ../../include/htable.h smtp_chat.o: ../../include/int_filt.h smtp_chat.o: ../../include/iostuff.h @@ -245,6 +249,7 @@ smtp_connect.o: ../../include/htable.h smtp_connect.o: ../../include/inet_addr_list.h smtp_connect.o: ../../include/inet_proto.h smtp_connect.o: ../../include/iostuff.h +smtp_connect.o: ../../include/known_tcp_ports.h smtp_connect.o: ../../include/mail_addr.h smtp_connect.o: ../../include/mail_error.h smtp_connect.o: ../../include/mail_params.h @@ -656,6 +661,7 @@ smtp_sasl_proto.o: ../../include/name_mask.h smtp_sasl_proto.o: ../../include/nvtable.h smtp_sasl_proto.o: ../../include/recipient_list.h smtp_sasl_proto.o: ../../include/resolve_clnt.h +smtp_sasl_proto.o: ../../include/sasl_mech_filter.h smtp_sasl_proto.o: ../../include/scache.h smtp_sasl_proto.o: ../../include/sock_addr.h smtp_sasl_proto.o: ../../include/string_list.h @@ -713,6 +719,7 @@ smtp_session.o: smtp_session.c smtp_state.o: ../../include/argv.h smtp_state.o: ../../include/attr.h smtp_state.o: ../../include/check_arg.h +smtp_state.o: ../../include/debug_peer.h smtp_state.o: ../../include/deliver_request.h smtp_state.o: ../../include/dict.h smtp_state.o: ../../include/dns.h diff --git a/external/ibm-public/postfix/dist/src/smtpd/Makefile.in b/external/ibm-public/postfix/dist/src/smtpd/Makefile.in index 009f5bd1725..8c4132a30bc 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/Makefile.in +++ b/external/ibm-public/postfix/dist/src/smtpd/Makefile.in @@ -146,7 +146,7 @@ smtpd_check_dsn_test: smtpd_check smtpd_check_dsn.in smtpd_check_dsn.ref smtpd_c diff smtpd_check_dsn.ref smtpd_check.tmp rm -f smtpd_check.tmp smtpd_check_access.* -# This requires that 168,100.189.7 is a local or virtual interface. +# This requires that 168.100.3.7 is a local or virtual interface. smtpd_check_backup_test: smtpd_check smtpd_check_backup.in smtpd_check_backup.ref $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_check_backup.in >smtpd_check.tmp 2>&1 @@ -193,6 +193,7 @@ smtpd.o: ../../include/dsn_mask.h smtpd.o: ../../include/ehlo_mask.h smtpd.o: ../../include/events.h smtpd.o: ../../include/flush_clnt.h +smtpd.o: ../../include/hfrom_format.h smtpd.o: ../../include/htable.h smtpd.o: ../../include/inet_proto.h smtpd.o: ../../include/info_log_addr_form.h @@ -268,6 +269,7 @@ smtpd_chat.o: ../../include/check_arg.h smtpd_chat.o: ../../include/cleanup_user.h smtpd_chat.o: ../../include/dict.h smtpd_chat.o: ../../include/dns.h +smtpd_chat.o: ../../include/hfrom_format.h smtpd_chat.o: ../../include/htable.h smtpd_chat.o: ../../include/int_filt.h smtpd_chat.o: ../../include/iostuff.h @@ -562,6 +564,7 @@ smtpd_sasl_glue.o: ../../include/dns.h smtpd_sasl_glue.o: ../../include/htable.h smtpd_sasl_glue.o: ../../include/mail_params.h smtpd_sasl_glue.o: ../../include/mail_stream.h +smtpd_sasl_glue.o: ../../include/match_list.h smtpd_sasl_glue.o: ../../include/milter.h smtpd_sasl_glue.o: ../../include/msg.h smtpd_sasl_glue.o: ../../include/myaddrinfo.h @@ -569,7 +572,9 @@ smtpd_sasl_glue.o: ../../include/mymalloc.h smtpd_sasl_glue.o: ../../include/name_code.h smtpd_sasl_glue.o: ../../include/name_mask.h smtpd_sasl_glue.o: ../../include/nvtable.h +smtpd_sasl_glue.o: ../../include/sasl_mech_filter.h smtpd_sasl_glue.o: ../../include/sock_addr.h +smtpd_sasl_glue.o: ../../include/string_list.h smtpd_sasl_glue.o: ../../include/stringops.h smtpd_sasl_glue.o: ../../include/sys_defs.h smtpd_sasl_glue.o: ../../include/tls.h diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.in index 45d1d4fa5f0..daed26cfb84 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.in @@ -2,7 +2,7 @@ # Initialize # smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 relay_domains porcupine.org smtpd_null_access_lookup_key <> # diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.ref index 110e7a57b86..4b7f6e9321e 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.ref @@ -3,7 +3,7 @@ >>> # >>> smtpd_delay_reject 0 OK ->>> mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> mynetworks 127.0.0.0/8,168.100.3.0/28 OK >>> relay_domains porcupine.org OK diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in index e89537dc010..10b5f017500 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in @@ -2,7 +2,7 @@ # Initialize # smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 local_recipient_maps inline:{foo_canon=whatever,bar_canon=whatever} mydestination example.com myorigin example.com diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref index 768a4c47694..3bf610cadf6 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref @@ -3,7 +3,7 @@ >>> # >>> smtpd_delay_reject 0 OK ->>> mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> mynetworks 127.0.0.0/8,168.100.3.0/28 OK >>> local_recipient_maps inline:{foo_canon=whatever,bar_canon=whatever} OK diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in index 980c7f82a8f..efeba5b8cd9 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in @@ -4,7 +4,7 @@ #! ../bin/postmap smtpd_check_access #msg_verbose 1 smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 relay_domains porcupine.org maps_rbl_domains dnsbltest.porcupine.org # @@ -12,7 +12,7 @@ maps_rbl_domains dnsbltest.porcupine.org # client_restrictions permit_mynetworks,reject_unknown_client,hash:./smtpd_check_access client unknown 131.155.210.17 -client unknown 168.100.189.13 +client unknown 168.100.3.13 client random.bad.domain 123.123.123.123 client friend.bad.domain 123.123.123.123 client bad.domain 123.123.123.123 @@ -46,7 +46,7 @@ helo 123.123.123.123 sender_restrictions permit_mynetworks,reject_unknown_client client unknown 131.155.210.17 mail foo@ibm.com -client unknown 168.100.189.13 +client unknown 168.100.3.13 mail foo@ibm.com client foo 123.123.123.123 mail foo@ibm.com @@ -68,13 +68,13 @@ mail foo@friend.bad.domain recipient_restrictions permit_mynetworks,reject_unknown_client,check_relay_domains client unknown 131.155.210.17 rcpt foo@ibm.com -client unknown 168.100.189.13 +client unknown 168.100.3.13 rcpt foo@ibm.com client foo 123.123.123.123 rcpt foo@ibm.com rcpt foo@porcupine.org recipient_restrictions check_relay_domains -client foo.porcupine.org 168.100.189.13 +client foo.porcupine.org 168.100.3.13 rcpt foo@ibm.com rcpt foo@porcupine.org client foo 123.123.123.123 @@ -91,7 +91,7 @@ mail foo@friend.bad.domain # RBL # client_restrictions reject_maps_rbl -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 client foo 127.0.0.2 # # Hybrids @@ -117,7 +117,7 @@ rcpt foo@porcupine.org # MX backup # #mydestination spike.porcupine.org,localhost.porcupine.org -#inet_interfaces 168.100.189.2,127.0.0.1 +#inet_interfaces 168.100.3.2,127.0.0.1 #recipient_restrictions permit_mx_backup,reject #rcpt wietse@wzv.win.tue.nl #rcpt wietse@trouble.org diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in2 b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in2 index 064cb41b852..804fde10a7c 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in2 +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in2 @@ -4,7 +4,7 @@ #! ../bin/postmap smtpd_check_access #msg_verbose 1 smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 relay_domains porcupine.org maps_rbl_domains dnsbltest.porcupine.org # @@ -12,7 +12,7 @@ maps_rbl_domains dnsbltest.porcupine.org # client_restrictions permit_mynetworks,reject_unknown_client,check_client_access,hash:./smtpd_check_access client unknown 131.155.210.17 -client unknown 168.100.189.13 +client unknown 168.100.3.13 client random.bad.domain 123.123.123.123 client friend.bad.domain 123.123.123.123 client bad.domain 123.123.123.123 @@ -38,7 +38,7 @@ helo friend.bad.domain sender_restrictions permit_mynetworks,reject_unknown_client client unknown 131.155.210.17 mail foo@ibm.com -client unknown 168.100.189.13 +client unknown 168.100.3.13 mail foo@ibm.com client foo 123.123.123.123 mail foo@ibm.com @@ -60,13 +60,13 @@ mail foo@friend.bad.domain recipient_restrictions permit_mynetworks,reject_unknown_client,check_relay_domains client unknown 131.155.210.17 rcpt foo@ibm.com -client unknown 168.100.189.13 +client unknown 168.100.3.13 rcpt foo@ibm.com client foo 123.123.123.123 rcpt foo@ibm.com rcpt foo@porcupine.org recipient_restrictions check_relay_domains -client foo.porcupine.org 168.100.189.13 +client foo.porcupine.org 168.100.3.13 rcpt foo@ibm.com rcpt foo@porcupine.org client foo 123.123.123.123 @@ -83,7 +83,7 @@ mail foo@friend.bad.domain # RBL # client_restrictions reject_maps_rbl -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 client foo 127.0.0.2 # # unknown sender/recipient domain diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in3 b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in3 index 52279f10a65..808f56255eb 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in3 +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in3 @@ -1,6 +1,6 @@ #msg_verbose 1 smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 relay_domains porcupine.org local_recipient_maps unix:passwd.byname client unknown 131.155.210.17 diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref index 1a8090f3241..8051f01e987 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref @@ -5,7 +5,7 @@ >>> #msg_verbose 1 >>> smtpd_delay_reject 0 OK ->>> mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> mynetworks 127.0.0.0/8,168.100.3.0/28 OK >>> relay_domains porcupine.org OK @@ -19,7 +19,7 @@ OK >>> client unknown 131.155.210.17 ./smtpd_check: <queue id>: reject: CONNECT from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; proto=SMTP 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] ->>> client unknown 168.100.189.13 +>>> client unknown 168.100.3.13 OK >>> client random.bad.domain 123.123.123.123 ./smtpd_check: <queue id>: reject: CONNECT from random.bad.domain[123.123.123.123]: 554 5.7.1 <random.bad.domain[123.123.123.123]>: Client host rejected: match bad.domain; proto=SMTP @@ -94,7 +94,7 @@ OK >>> mail foo@ibm.com ./smtpd_check: <queue id>: reject: MAIL from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; from=<foo@ibm.com> proto=SMTP helo=<123.123.123.123> 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] ->>> client unknown 168.100.189.13 +>>> client unknown 168.100.3.13 OK >>> mail foo@ibm.com OK @@ -143,7 +143,7 @@ OK >>> rcpt foo@ibm.com ./smtpd_check: <queue id>: reject: RCPT from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; from=<foo@friend.bad.domain> to=<foo@ibm.com> proto=SMTP helo=<123.123.123.123> 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] ->>> client unknown 168.100.189.13 +>>> client unknown 168.100.3.13 OK >>> rcpt foo@ibm.com OK @@ -157,7 +157,7 @@ OK OK >>> recipient_restrictions check_relay_domains OK ->>> client foo.porcupine.org 168.100.189.13 +>>> client foo.porcupine.org 168.100.3.13 OK >>> rcpt foo@ibm.com OK @@ -193,7 +193,7 @@ OK >>> # >>> client_restrictions reject_maps_rbl OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 ./smtpd_check: warning: support for restriction "reject_maps_rbl" will be removed from Postfix; use "reject_rbl_client domain-name" instead OK >>> client foo 127.0.0.2 @@ -245,7 +245,7 @@ OK >>> # MX backup >>> # >>> #mydestination spike.porcupine.org,localhost.porcupine.org ->>> #inet_interfaces 168.100.189.2,127.0.0.1 +>>> #inet_interfaces 168.100.3.2,127.0.0.1 >>> #recipient_restrictions permit_mx_backup,reject >>> #rcpt wietse@wzv.win.tue.nl >>> #rcpt wietse@trouble.org diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref2 b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref2 index 9322457e373..e22f9e3797d 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref2 +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref2 @@ -5,7 +5,7 @@ >>> #msg_verbose 1 >>> smtpd_delay_reject 0 OK ->>> mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> mynetworks 127.0.0.0/8,168.100.3.0/28 OK >>> relay_domains porcupine.org OK @@ -19,7 +19,7 @@ OK >>> client unknown 131.155.210.17 ./smtpd_check: <queue id>: reject: CONNECT from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; proto=SMTP 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] ->>> client unknown 168.100.189.13 +>>> client unknown 168.100.3.13 OK >>> client random.bad.domain 123.123.123.123 ./smtpd_check: <queue id>: reject: CONNECT from random.bad.domain[123.123.123.123]: 554 5.7.1 <random.bad.domain[123.123.123.123]>: Client host rejected: match bad.domain; proto=SMTP @@ -74,7 +74,7 @@ OK >>> mail foo@ibm.com ./smtpd_check: <queue id>: reject: MAIL from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; from=<foo@ibm.com> proto=SMTP helo=<friend.bad.domain> 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] ->>> client unknown 168.100.189.13 +>>> client unknown 168.100.3.13 OK >>> mail foo@ibm.com OK @@ -123,7 +123,7 @@ OK >>> rcpt foo@ibm.com ./smtpd_check: <queue id>: reject: RCPT from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; from=<foo@friend.bad.domain> to=<foo@ibm.com> proto=SMTP helo=<friend.bad.domain> 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] ->>> client unknown 168.100.189.13 +>>> client unknown 168.100.3.13 OK >>> rcpt foo@ibm.com OK @@ -137,7 +137,7 @@ OK OK >>> recipient_restrictions check_relay_domains OK ->>> client foo.porcupine.org 168.100.189.13 +>>> client foo.porcupine.org 168.100.3.13 OK >>> rcpt foo@ibm.com OK @@ -173,7 +173,7 @@ OK >>> # >>> client_restrictions reject_maps_rbl OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 ./smtpd_check: warning: support for restriction "reject_maps_rbl" will be removed from Postfix; use "reject_rbl_client domain-name" instead OK >>> client foo 127.0.0.2 diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.in index c4f44bb3d7c..7fb9242d5da 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.in @@ -4,17 +4,17 @@ #! ../bin/postmap smtpd_check_access #msg_verbose 1 smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 # # MX backup # mydestination wzv.porcupine.org,localhost.porcupine.org -inet_interfaces 168.100.189.7,127.0.0.1 +inet_interfaces 168.100.3.7,127.0.0.1 recipient_restrictions permit_mx_backup,reject rcpt wietse@wzv.porcupine.org rcpt wietse@backup.porcupine.org rcpt wietse@porcupine.org -permit_mx_backup_networks 168.100.189.5 +permit_mx_backup_networks 168.100.3.5 rcpt wietse@backup.porcupine.org -permit_mx_backup_networks 168.100.189.4 +permit_mx_backup_networks 168.100.3.4 rcpt wietse@backup.porcupine.org diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.ref index 9f20b9017ea..8f4a0f2799e 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.ref @@ -5,14 +5,14 @@ >>> #msg_verbose 1 >>> smtpd_delay_reject 0 OK ->>> mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> mynetworks 127.0.0.0/8,168.100.3.0/28 OK >>> # >>> # MX backup >>> # >>> mydestination wzv.porcupine.org,localhost.porcupine.org OK ->>> inet_interfaces 168.100.189.7,127.0.0.1 +>>> inet_interfaces 168.100.3.7,127.0.0.1 OK >>> recipient_restrictions permit_mx_backup,reject OK @@ -23,12 +23,12 @@ OK >>> rcpt wietse@porcupine.org ./smtpd_check: <queue id>: reject: RCPT from localhost[127.0.0.1]: 554 5.7.1 <wietse@porcupine.org>: Recipient address rejected: Access denied; to=<wietse@porcupine.org> proto=SMTP 554 5.7.1 <wietse@porcupine.org>: Recipient address rejected: Access denied ->>> permit_mx_backup_networks 168.100.189.5 +>>> permit_mx_backup_networks 168.100.3.5 OK >>> rcpt wietse@backup.porcupine.org ./smtpd_check: <queue id>: reject: RCPT from localhost[127.0.0.1]: 554 5.7.1 <wietse@backup.porcupine.org>: Recipient address rejected: Access denied; to=<wietse@backup.porcupine.org> proto=SMTP 554 5.7.1 <wietse@backup.porcupine.org>: Recipient address rejected: Access denied ->>> permit_mx_backup_networks 168.100.189.4 +>>> permit_mx_backup_networks 168.100.3.4 OK >>> rcpt wietse@backup.porcupine.org OK diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.in index 459bd5d9ed9..cf174e88f1a 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.in @@ -4,7 +4,7 @@ #! ../bin/postmap smtpd_check_access #msg_verbose 1 smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 # # Test the client restrictions. # diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.ref index 87b1bb9e90c..168676d873c 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.ref @@ -5,7 +5,7 @@ >>> #msg_verbose 1 >>> smtpd_delay_reject 0 OK ->>> mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> mynetworks 127.0.0.0/8,168.100.3.0/28 OK >>> # >>> # Test the client restrictions. diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_dns_filter.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_dns_filter.ref index 92c91020364..ce1710f17d7 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_dns_filter.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_dns_filter.ref @@ -30,11 +30,11 @@ OK >>> mail user@spike.porcupine.org OK >>> helo spike.porcupine.org -./smtpd_check: ignoring DNS RR: spike.porcupine.org. TTL IN A 168.100.189.2 +./smtpd_check: ignoring DNS RR: spike.porcupine.org. TTL IN A 168.100.3.2 OK >>> # EXPECT OK + "all A records dropped" warning + no delayed reject. >>> helo fist.porcupine.org -./smtpd_check: ignoring DNS RR: fist.porcupine.org. TTL IN A 168.100.189.4 +./smtpd_check: ignoring DNS RR: fist.porcupine.org. TTL IN A 168.100.3.4 ./smtpd_check: warning: fist.porcupine.org: address or MX lookup error: DNS reply filter drops all results OK >>> mail user@spike.porcupine.org @@ -96,11 +96,11 @@ OK OK >>> # EXPECT OK (host has AAAA record). >>> mail user@spike.porcupine.org -./smtpd_check: ignoring DNS RR: spike.porcupine.org. TTL IN A 168.100.189.2 +./smtpd_check: ignoring DNS RR: spike.porcupine.org. TTL IN A 168.100.3.2 OK >>> # EXPECT OK + "all A records dropped" warning. >>> mail user@fist.porcupine.org -./smtpd_check: ignoring DNS RR: fist.porcupine.org. TTL IN A 168.100.189.4 +./smtpd_check: ignoring DNS RR: fist.porcupine.org. TTL IN A 168.100.3.4 ./smtpd_check: warning: fist.porcupine.org: MX or address lookup error: DNS reply filter drops all results OK >>> smtpd_dns_reply_filter regexp:../dns/error.reg diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.in index 6546e023ecb..db25474436b 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.in @@ -3,7 +3,7 @@ # #msg_verbose 1 smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 mydestination porcupine.org relay_domains porcupine.org helo foobar @@ -12,15 +12,15 @@ helo foobar # DNSWL (by IP address) # -# Whitelist overrides reject. +# Allowlist overrides reject. client_restrictions permit_dnswl_client,wild.porcupine.org,reject -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 -# Whitelist does not fire - reject. +# Allowlist does not fire - reject. client_restrictions permit_dnswl_client,porcupine.org,reject -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 -# Whitelist does not override reject_unauth_destination. +# Allowlist does not override reject_unauth_destination. client_restrictions permit recipient_restrictions permit_dnswl_client,wild.porcupine.org,reject_unauth_destination # Unauthorized destination - reject. @@ -32,24 +32,24 @@ rcpt wietse@porcupine.org # RHSWL (by domain name) # -# Whitelist overrides reject. +# Allowlist overrides reject. client_restrictions permit_rhswl_client,dnswl.porcupine.org,reject -# Non-whitelisted client name - reject. -client spike.porcupine.org 168.100.189.2 -# Whitelisted client name - accept. -client example.tld 168.100.189.2 +# Non-allowlisted client name - reject. +client spike.porcupine.org 168.100.3.2 +# Allowlisted client name - accept. +client example.tld 168.100.3.2 -# Whitelist does not override reject_unauth_destination. +# Allowlist does not override reject_unauth_destination. client_restrictions permit recipient_restrictions permit_rhswl_client,dnswl.porcupine.org,reject_unauth_destination -# Non-whitelisted client name. -client spike.porcupine.org 168.100.189.2 +# Non-allowlisted client name. +client spike.porcupine.org 168.100.3.2 # Unauthorized destination - reject. rcpt rname@rdomain # Authorized destination - accept. rcpt wietse@porcupine.org -# Whitelisted client name. -client example.tld 168.100.189.2 +# Allowlisted client name. +client example.tld 168.100.3.2 # Unauthorized destination - reject. rcpt rname@rdomain # Authorized destination - accept. diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.ref index 7c23459c49b..dacda6ccfb9 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.ref @@ -4,7 +4,7 @@ >>> #msg_verbose 1 >>> smtpd_delay_reject 0 OK ->>> mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> mynetworks 127.0.0.0/8,168.100.3.0/28 OK >>> mydestination porcupine.org OK @@ -17,27 +17,27 @@ OK >>> # DNSWL (by IP address) >>> # >>> ->>> # Whitelist overrides reject. +>>> # Allowlist overrides reject. >>> client_restrictions permit_dnswl_client,wild.porcupine.org,reject OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> ->>> # Whitelist does not fire - reject. +>>> # Allowlist does not fire - reject. >>> client_restrictions permit_dnswl_client,porcupine.org,reject OK ->>> client spike.porcupine.org 168.100.189.2 -./smtpd_check: <queue id>: reject: CONNECT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <spike.porcupine.org[168.100.189.2]>: Client host rejected: Access denied; proto=SMTP helo=<foobar> -554 5.7.1 <spike.porcupine.org[168.100.189.2]>: Client host rejected: Access denied +>>> client spike.porcupine.org 168.100.3.2 +./smtpd_check: <queue id>: reject: CONNECT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <spike.porcupine.org[168.100.3.2]>: Client host rejected: Access denied; proto=SMTP helo=<foobar> +554 5.7.1 <spike.porcupine.org[168.100.3.2]>: Client host rejected: Access denied >>> ->>> # Whitelist does not override reject_unauth_destination. +>>> # Allowlist does not override reject_unauth_destination. >>> client_restrictions permit OK >>> recipient_restrictions permit_dnswl_client,wild.porcupine.org,reject_unauth_destination OK >>> # Unauthorized destination - reject. >>> rcpt rname@rdomain -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <rname@rdomain>: Relay access denied; to=<rname@rdomain> proto=SMTP helo=<foobar> +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <rname@rdomain>: Relay access denied; to=<rname@rdomain> proto=SMTP helo=<foobar> 554 5.7.1 <rname@rdomain>: Relay access denied >>> # Authorized destination - accept. >>> rcpt wietse@porcupine.org @@ -47,48 +47,48 @@ OK >>> # RHSWL (by domain name) >>> # >>> ->>> # Whitelist overrides reject. +>>> # Allowlist overrides reject. >>> client_restrictions permit_rhswl_client,dnswl.porcupine.org,reject OK ->>> # Non-whitelisted client name - reject. ->>> client spike.porcupine.org 168.100.189.2 -./smtpd_check: <queue id>: reject: CONNECT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <spike.porcupine.org[168.100.189.2]>: Client host rejected: Access denied; proto=SMTP helo=<foobar> -554 5.7.1 <spike.porcupine.org[168.100.189.2]>: Client host rejected: Access denied ->>> # Whitelisted client name - accept. ->>> client example.tld 168.100.189.2 +>>> # Non-allowlisted client name - reject. +>>> client spike.porcupine.org 168.100.3.2 +./smtpd_check: <queue id>: reject: CONNECT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <spike.porcupine.org[168.100.3.2]>: Client host rejected: Access denied; proto=SMTP helo=<foobar> +554 5.7.1 <spike.porcupine.org[168.100.3.2]>: Client host rejected: Access denied +>>> # Allowlisted client name - accept. +>>> client example.tld 168.100.3.2 OK >>> ->>> # Whitelist does not override reject_unauth_destination. +>>> # Allowlist does not override reject_unauth_destination. >>> client_restrictions permit OK >>> recipient_restrictions permit_rhswl_client,dnswl.porcupine.org,reject_unauth_destination OK ->>> # Non-whitelisted client name. ->>> client spike.porcupine.org 168.100.189.2 +>>> # Non-allowlisted client name. +>>> client spike.porcupine.org 168.100.3.2 OK >>> # Unauthorized destination - reject. >>> rcpt rname@rdomain -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <rname@rdomain>: Relay access denied; to=<rname@rdomain> proto=SMTP helo=<foobar> +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <rname@rdomain>: Relay access denied; to=<rname@rdomain> proto=SMTP helo=<foobar> 554 5.7.1 <rname@rdomain>: Relay access denied >>> # Authorized destination - accept. >>> rcpt wietse@porcupine.org OK ->>> # Whitelisted client name. ->>> client example.tld 168.100.189.2 +>>> # Allowlisted client name. +>>> client example.tld 168.100.3.2 OK >>> # Unauthorized destination - reject. >>> rcpt rname@rdomain -./smtpd_check: <queue id>: reject: RCPT from example.tld[168.100.189.2]: 554 5.7.1 <rname@rdomain>: Relay access denied; to=<rname@rdomain> proto=SMTP helo=<foobar> +./smtpd_check: <queue id>: reject: RCPT from example.tld[168.100.3.2]: 554 5.7.1 <rname@rdomain>: Relay access denied; to=<rname@rdomain> proto=SMTP helo=<foobar> 554 5.7.1 <rname@rdomain>: Relay access denied >>> # Authorized destination - accept. >>> rcpt wietse@porcupine.org OK >>> # Numeric TLD - dunno. >>> rcpt wietse@12345 -./smtpd_check: <queue id>: reject: RCPT from example.tld[168.100.189.2]: 554 5.7.1 <wietse@12345>: Relay access denied; to=<wietse@12345> proto=SMTP helo=<foobar> +./smtpd_check: <queue id>: reject: RCPT from example.tld[168.100.3.2]: 554 5.7.1 <wietse@12345>: Relay access denied; to=<wietse@12345> proto=SMTP helo=<foobar> 554 5.7.1 <wietse@12345>: Relay access denied >>> rcpt wietse@12345.porcupine.org OK >>> rcpt wietse@porcupine.12345 -./smtpd_check: <queue id>: reject: RCPT from example.tld[168.100.189.2]: 554 5.7.1 <wietse@porcupine.12345>: Relay access denied; to=<wietse@porcupine.12345> proto=SMTP helo=<foobar> +./smtpd_check: <queue id>: reject: RCPT from example.tld[168.100.3.2]: 554 5.7.1 <wietse@porcupine.12345>: Relay access denied; to=<wietse@porcupine.12345> proto=SMTP helo=<foobar> 554 5.7.1 <wietse@porcupine.12345>: Relay access denied diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.in index c894b874a26..a7fb3e2a6ae 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.in @@ -40,7 +40,7 @@ rcpt reject@dunno.domain # # Test mynetworks. # -mynetworks 168.100.189.1/27 +mynetworks 168.100.3.1/27 # # Expect REJECT (server configuration error) # diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref index 7df38e1f0da..d375522dab0 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref @@ -63,13 +63,13 @@ OK >>> # >>> # Test mynetworks. >>> # ->>> mynetworks 168.100.189.1/27 +>>> mynetworks 168.100.3.1/27 OK >>> # >>> # Expect REJECT (server configuration error) >>> # >>> rcpt reject@dunno.domain -./smtpd_check: warning: mynetworks: non-null host address bits in "168.100.189.1/27", perhaps you should use "168.100.189.0/27" instead +./smtpd_check: warning: mynetworks: non-null host address bits in "168.100.3.1/27", perhaps you should use "168.100.3.0/27" instead ./smtpd_check: <queue id>: reject: RCPT from foo.dunno.com[131.155.210.17]: 451 4.3.0 <reject@dunno.domain>: Temporary lookup failure; from=<reject@dunno.domain> to=<reject@dunno.domain> proto=SMTP helo=<foobar> 451 4.3.0 <reject@dunno.domain>: Temporary lookup failure >>> # diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.in index 584acf397f3..8370404b44a 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.in @@ -4,7 +4,7 @@ #! ../bin/postmap smtpd_check_access #msg_verbose 1 smtpd_delay_reject 0 -mynetworks 127.0.0.0/8,168.100.189.0/28 +mynetworks 127.0.0.0/8,168.100.3.0/28 relay_domains porcupine.org maps_rbl_domains dnsbltest.porcupine.org rbl_reply_maps hash:smtpd_check_access @@ -14,13 +14,13 @@ helo foobar # mail sname@sdomain recipient_restrictions reject_maps_rbl -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 rcpt rname@rdomain client foo 127.0.0.2 rcpt rname@rdomain # recipient_restrictions reject_rbl_client,dnsbltest.porcupine.org -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 rcpt rname@rdomain client foo 127.0.0.2 rcpt rname@rdomain @@ -33,7 +33,7 @@ rcpt rname@rdomain # RHSBL sender domain name # recipient_restrictions reject_rhsbl_sender,rhsbl.porcupine.org -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 mail sname@example.tld rcpt rname@rdomain mail sname@sdomain @@ -49,7 +49,7 @@ rcpt rname@rdomain # RHSBL recipient domain name # recipient_restrictions reject_rhsbl_recipient,rhsbl.porcupine.org -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 mail sname@sdomain rcpt rname@rdomain rcpt rname@example.tld diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.ref index 6d7e9fc8d84..22c027e76d9 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.ref @@ -5,7 +5,7 @@ >>> #msg_verbose 1 >>> smtpd_delay_reject 0 OK ->>> mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> mynetworks 127.0.0.0/8,168.100.3.0/28 OK >>> relay_domains porcupine.org OK @@ -22,7 +22,7 @@ OK OK >>> recipient_restrictions reject_maps_rbl OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> rcpt rname@rdomain ./smtpd_check: warning: support for restriction "reject_maps_rbl" will be removed from Postfix; use "reject_rbl_client domain-name" instead @@ -35,7 +35,7 @@ OK >>> # >>> recipient_restrictions reject_rbl_client,dnsbltest.porcupine.org OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> rcpt rname@rdomain OK @@ -60,13 +60,13 @@ OK >>> # >>> recipient_restrictions reject_rhsbl_sender,rhsbl.porcupine.org OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> mail sname@example.tld OK >>> rcpt rname@rdomain -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 client=spike.porcupine.org[168.100.189.2] client_address=168.100.189.2 client_name=spike.porcupine.org helo_name=foobar sender=sname@example.tld sender_name=sname sender_domain=example.tld recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=sname@example.tld rbl_class=Sender address; from=<sname@example.tld> to=<rname@rdomain> proto=SMTP helo=<foobar> -554 5.7.1 client=spike.porcupine.org[168.100.189.2] client_address=168.100.189.2 client_name=spike.porcupine.org helo_name=foobar sender=sname@example.tld sender_name=sname sender_domain=example.tld recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=sname@example.tld rbl_class=Sender address +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 client=spike.porcupine.org[168.100.3.2] client_address=168.100.3.2 client_name=spike.porcupine.org helo_name=foobar sender=sname@example.tld sender_name=sname sender_domain=example.tld recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=sname@example.tld rbl_class=Sender address; from=<sname@example.tld> to=<rname@rdomain> proto=SMTP helo=<foobar> +554 5.7.1 client=spike.porcupine.org[168.100.3.2] client_address=168.100.3.2 client_name=spike.porcupine.org helo_name=foobar sender=sname@example.tld sender_name=sname sender_domain=example.tld recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=sname@example.tld rbl_class=Sender address >>> mail sname@sdomain OK >>> rcpt rname@rdomain @@ -88,15 +88,15 @@ OK >>> # >>> recipient_restrictions reject_rhsbl_recipient,rhsbl.porcupine.org OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> mail sname@sdomain OK >>> rcpt rname@rdomain OK >>> rcpt rname@example.tld -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 client=spike.porcupine.org[168.100.189.2] client_address=168.100.189.2 client_name=spike.porcupine.org helo_name=foobar sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@example.tld recipient_name=rname recipient_domain=example.tld rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=rname@example.tld rbl_class=Recipient address; from=<sname@sdomain> to=<rname@example.tld> proto=SMTP helo=<foobar> -554 5.7.1 client=spike.porcupine.org[168.100.189.2] client_address=168.100.189.2 client_name=spike.porcupine.org helo_name=foobar sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@example.tld recipient_name=rname recipient_domain=example.tld rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=rname@example.tld rbl_class=Recipient address +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 client=spike.porcupine.org[168.100.3.2] client_address=168.100.3.2 client_name=spike.porcupine.org helo_name=foobar sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@example.tld recipient_name=rname recipient_domain=example.tld rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=rname@example.tld rbl_class=Recipient address; from=<sname@sdomain> to=<rname@example.tld> proto=SMTP helo=<foobar> +554 5.7.1 client=spike.porcupine.org[168.100.3.2] client_address=168.100.3.2 client_name=spike.porcupine.org helo_name=foobar sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@example.tld recipient_name=rname recipient_domain=example.tld rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=rname@example.tld rbl_class=Recipient address >>> # >>> # RHSBL helo domain name >>> # @@ -107,5 +107,5 @@ OK >>> mail sname@sdomain OK >>> rcpt rname@rdomain -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 client=spike.porcupine.org[168.100.189.2] client_address=168.100.189.2 client_name=spike.porcupine.org helo_name=example.tld sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=example.tld rbl_class=Helo command; from=<sname@sdomain> to=<rname@rdomain> proto=SMTP helo=<example.tld> -554 5.7.1 client=spike.porcupine.org[168.100.189.2] client_address=168.100.189.2 client_name=spike.porcupine.org helo_name=example.tld sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=example.tld rbl_class=Helo command +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 client=spike.porcupine.org[168.100.3.2] client_address=168.100.3.2 client_name=spike.porcupine.org helo_name=example.tld sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=example.tld rbl_class=Helo command; from=<sname@sdomain> to=<rname@rdomain> proto=SMTP helo=<example.tld> +554 5.7.1 client=spike.porcupine.org[168.100.3.2] client_address=168.100.3.2 client_name=spike.porcupine.org helo_name=example.tld sender=sname@sdomain sender_name=sname sender_domain=sdomain recipient=rname@rdomain recipient_name=rname recipient_domain=rdomain rbl_code=554 rbl_domain=rhsbl.porcupine.org rbl_txt=RHSBL test rbl_what=example.tld rbl_class=Helo command diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.in index 9db8276324a..58eede33a13 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.in @@ -4,7 +4,7 @@ #! ../bin/postmap smtpd_check_access #msg_verbose 1 #smtpd_delay_reject 0 -#mynetworks 127.0.0.0/8,168.100.189.0/28 +#mynetworks 127.0.0.0/8,168.100.3.0/28 #relay_domains porcupine.org #maps_rbl_domains dnsbltest.porcupine.org #rbl_reply_maps hash:smtpd_check_access @@ -14,7 +14,7 @@ # smtpd_delay_reject 0 helo_restrictions reject_unknown_helo_hostname -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 mail sname@sdomain rcpt rname@rdomain helo nxdomain.porcupine.org @@ -25,7 +25,7 @@ helo spike.porcupine.org # smtpd_delay_reject 0 sender_restrictions reject_unknown_sender_domain -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 helo spike.porcupine.org rcpt rname@rdomain mail sname@nxdomain.porcupine.org @@ -38,7 +38,7 @@ smtpd_delay_reject 0 sender_restrictions permit recipient_restrictions reject_unknown_recipient_domain relay_restrictions reject_unauth_destination -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 helo spike.porcupine.org mail sname@sdomain relay_domains nxdomain.porcupine.org @@ -52,7 +52,7 @@ rcpt rname@spike.porcupine.org # smtpd_delay_reject 0 sender_restrictions check_sender_mx_access,hash:smtpd_check_access -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 mail sname@nxdomain.porcupine.org mail sname@nullmx.porcupine.org mail sname@spike.porcupine.org diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.ref index 4cc258e3b41..410c0c0a0ec 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.ref @@ -4,7 +4,7 @@ >>> #! ../bin/postmap smtpd_check_access >>> #msg_verbose 1 >>> #smtpd_delay_reject 0 ->>> #mynetworks 127.0.0.0/8,168.100.189.0/28 +>>> #mynetworks 127.0.0.0/8,168.100.3.0/28 >>> #relay_domains porcupine.org >>> #maps_rbl_domains dnsbltest.porcupine.org >>> #rbl_reply_maps hash:smtpd_check_access @@ -16,14 +16,14 @@ OK >>> helo_restrictions reject_unknown_helo_hostname OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> mail sname@sdomain OK >>> rcpt rname@rdomain OK >>> helo nxdomain.porcupine.org -./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.189.2]: 450 4.7.1 <nxdomain.porcupine.org>: Helo command rejected: Host not found; from=<sname@sdomain> proto=SMTP helo=<nxdomain.porcupine.org> +./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.3.2]: 450 4.7.1 <nxdomain.porcupine.org>: Helo command rejected: Host not found; from=<sname@sdomain> proto=SMTP helo=<nxdomain.porcupine.org> 450 4.7.1 <nxdomain.porcupine.org>: Helo command rejected: Host not found >>> helo nullmx.porcupine.org OK @@ -36,17 +36,17 @@ OK OK >>> sender_restrictions reject_unknown_sender_domain OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> helo spike.porcupine.org OK >>> rcpt rname@rdomain OK >>> mail sname@nxdomain.porcupine.org -./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.189.2]: 450 4.1.8 <sname@nxdomain.porcupine.org>: Sender address rejected: Domain not found; from=<sname@nxdomain.porcupine.org> proto=SMTP helo=<spike.porcupine.org> +./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.3.2]: 450 4.1.8 <sname@nxdomain.porcupine.org>: Sender address rejected: Domain not found; from=<sname@nxdomain.porcupine.org> proto=SMTP helo=<spike.porcupine.org> 450 4.1.8 <sname@nxdomain.porcupine.org>: Sender address rejected: Domain not found >>> mail sname@nullmx.porcupine.org -./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.189.2]: 550 5.7.27 <sname@nullmx.porcupine.org>: Sender address rejected: Domain nullmx.porcupine.org does not accept mail (nullMX); from=<sname@nullmx.porcupine.org> proto=SMTP helo=<spike.porcupine.org> +./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.3.2]: 550 5.7.27 <sname@nullmx.porcupine.org>: Sender address rejected: Domain nullmx.porcupine.org does not accept mail (nullMX); from=<sname@nullmx.porcupine.org> proto=SMTP helo=<spike.porcupine.org> 550 5.7.27 <sname@nullmx.porcupine.org>: Sender address rejected: Domain nullmx.porcupine.org does not accept mail (nullMX) >>> mail sname@spike.porcupine.org OK @@ -61,7 +61,7 @@ OK OK >>> relay_restrictions reject_unauth_destination OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> helo spike.porcupine.org OK @@ -70,12 +70,12 @@ OK >>> relay_domains nxdomain.porcupine.org OK >>> rcpt rname@nxdomain.porcupine.org -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 450 4.1.2 <rname@nxdomain.porcupine.org>: Recipient address rejected: Domain not found; from=<sname@sdomain> to=<rname@nxdomain.porcupine.org> proto=SMTP helo=<spike.porcupine.org> +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 450 4.1.2 <rname@nxdomain.porcupine.org>: Recipient address rejected: Domain not found; from=<sname@sdomain> to=<rname@nxdomain.porcupine.org> proto=SMTP helo=<spike.porcupine.org> 450 4.1.2 <rname@nxdomain.porcupine.org>: Recipient address rejected: Domain not found >>> relay_domains nullmx.porcupine.org OK >>> rcpt rname@nullmx.porcupine.org -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 556 5.1.10 <rname@nullmx.porcupine.org>: Recipient address rejected: Domain nullmx.porcupine.org does not accept mail (nullMX); from=<sname@sdomain> to=<rname@nullmx.porcupine.org> proto=SMTP helo=<spike.porcupine.org> +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 556 5.1.10 <rname@nullmx.porcupine.org>: Recipient address rejected: Domain nullmx.porcupine.org does not accept mail (nullMX); from=<sname@sdomain> to=<rname@nullmx.porcupine.org> proto=SMTP helo=<spike.porcupine.org> 556 5.1.10 <rname@nullmx.porcupine.org>: Recipient address rejected: Domain nullmx.porcupine.org does not accept mail (nullMX) >>> relay_domains spike.porcupine.org OK @@ -88,7 +88,7 @@ OK OK >>> sender_restrictions check_sender_mx_access,hash:smtpd_check_access OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> mail sname@nxdomain.porcupine.org ./smtpd_check: warning: Unable to look up MX host nxdomain.porcupine.org for Sender address sname@nxdomain.porcupine.org: hostname nor servname provided, or not known @@ -96,5 +96,5 @@ OK >>> mail sname@nullmx.porcupine.org OK >>> mail sname@spike.porcupine.org -./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <sname@spike.porcupine.org>: Sender address rejected: ns or mx server spike.porcupine.org; from=<sname@spike.porcupine.org> proto=SMTP helo=<spike.porcupine.org> +./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <sname@spike.porcupine.org>: Sender address rejected: ns or mx server spike.porcupine.org; from=<sname@spike.porcupine.org> proto=SMTP helo=<spike.porcupine.org> 554 5.7.1 <sname@spike.porcupine.org>: Sender address rejected: ns or mx server spike.porcupine.org diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in index 325e9da59fb..691b8c6825a 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in @@ -5,52 +5,52 @@ #msg_verbose 1 smtpd_delay_reject 0 relay_domains porcupine.org -client spike.porcupine.org 168.100.189.2 +client spike.porcupine.org 168.100.3.2 # # Check MX access # -helo_restrictions check_helo_mx_access,inline:{168.100.189.2=reject} +helo_restrictions check_helo_mx_access,inline:{168.100.3.2=reject} helo www.porcupine.org helo example.tld helo foo@postfix.org -sender_restrictions check_sender_mx_access,inline:{168.100.189.2=reject} +sender_restrictions check_sender_mx_access,inline:{168.100.3.2=reject} mail foo@www.porcupine.org mail example.tld mail foo@postfix.org -recipient_restrictions check_recipient_mx_access,inline:{168.100.189.2=reject} +recipient_restrictions check_recipient_mx_access,inline:{168.100.3.2=reject} rcpt foo@www.porcupine.org rcpt foo@example.tld rcpt foo@postfix.org # # Check NS access # -helo_restrictions check_helo_ns_access,inline:{168.100.1.2=reject} +helo_restrictions check_helo_ns_access,inline:{168.100.3.75=reject} helo www.porcupine.org helo example.tld helo foo@postfix.org -sender_restrictions check_sender_ns_access,inline:{168.100.1.2=reject} +sender_restrictions check_sender_ns_access,inline:{168.100.3.75=reject} mail foo@www.porcupine.org mail example.tld mail foo@postfix.org -recipient_restrictions check_recipient_ns_access,inline:{168.100.1.2=reject} +recipient_restrictions check_recipient_ns_access,inline:{168.100.3.75=reject} rcpt foo@www.porcupine.org rcpt foo@example.tld rcpt foo@postfix.org # # Check A access # -helo_restrictions check_helo_a_access,inline:{168.100.189.2=reject} +helo_restrictions check_helo_a_access,inline:{168.100.3.2=reject} helo spike.porcupine.org helo www.porcupine.org -client_restrictions check_client_a_access,inline:{168.100.189.2=reject} +client_restrictions check_client_a_access,inline:{168.100.3.2=reject} client spike.porcupine.org 1.2.3.4 client www.porcupine.org 1.2.3.4 -reverse_client_restrictions check_reverse_client_a_access,inline:{168.100.189.2=reject} +reverse_client_restrictions check_reverse_client_a_access,inline:{168.100.3.2=reject} client spike.porcupine.org 1.2.3.4 client www.porcupine.org 1.2.3.4 -sender_restrictions check_sender_a_access,inline:{168.100.189.2=reject} +sender_restrictions check_sender_a_access,inline:{168.100.3.2=reject} mail foo@spike.porcupine.org mail foo@www.porcupine.org -recipient_restrictions check_recipient_a_access,inline:{168.100.189.2=reject} +recipient_restrictions check_recipient_a_access,inline:{168.100.3.2=reject} rcpt foo@spike.porcupine.org rcpt foo@www.porcupine.org diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref index 563befe8a39..b396a57b6f3 100644 --- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref +++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref @@ -7,35 +7,35 @@ OK >>> relay_domains porcupine.org OK ->>> client spike.porcupine.org 168.100.189.2 +>>> client spike.porcupine.org 168.100.3.2 OK >>> # >>> # Check MX access >>> # ->>> helo_restrictions check_helo_mx_access,inline:{168.100.189.2=reject} +>>> helo_restrictions check_helo_mx_access,inline:{168.100.3.2=reject} OK >>> helo www.porcupine.org -./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <www.porcupine.org>: Helo command rejected: Access denied; proto=SMTP helo=<www.porcupine.org> +./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <www.porcupine.org>: Helo command rejected: Access denied; proto=SMTP helo=<www.porcupine.org> 554 5.7.1 <www.porcupine.org>: Helo command rejected: Access denied >>> helo example.tld ./smtpd_check: warning: Unable to look up MX host example.tld for Helo command example.tld: hostname nor servname provided, or not known OK >>> helo foo@postfix.org OK ->>> sender_restrictions check_sender_mx_access,inline:{168.100.189.2=reject} +>>> sender_restrictions check_sender_mx_access,inline:{168.100.3.2=reject} OK >>> mail foo@www.porcupine.org -./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@www.porcupine.org>: Sender address rejected: Access denied; from=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org> +./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <foo@www.porcupine.org>: Sender address rejected: Access denied; from=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org> 554 5.7.1 <foo@www.porcupine.org>: Sender address rejected: Access denied >>> mail example.tld ./smtpd_check: warning: Unable to look up MX host example.tld for Sender address example.tld: hostname nor servname provided, or not known OK >>> mail foo@postfix.org OK ->>> recipient_restrictions check_recipient_mx_access,inline:{168.100.189.2=reject} +>>> recipient_restrictions check_recipient_mx_access,inline:{168.100.3.2=reject} OK >>> rcpt foo@www.porcupine.org -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@www.porcupine.org>: Recipient address rejected: Access denied; from=<foo@postfix.org> to=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org> +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <foo@www.porcupine.org>: Recipient address rejected: Access denied; from=<foo@postfix.org> to=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org> 554 5.7.1 <foo@www.porcupine.org>: Recipient address rejected: Access denied >>> rcpt foo@example.tld ./smtpd_check: warning: Unable to look up MX host example.tld for Recipient address foo@example.tld: hostname nor servname provided, or not known @@ -45,71 +45,71 @@ OK >>> # >>> # Check NS access >>> # ->>> helo_restrictions check_helo_ns_access,inline:{168.100.1.2=reject} +>>> helo_restrictions check_helo_ns_access,inline:{168.100.3.75=reject} OK >>> helo www.porcupine.org -./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <www.porcupine.org>: Helo command rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<www.porcupine.org> +./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <www.porcupine.org>: Helo command rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<www.porcupine.org> 554 5.7.1 <www.porcupine.org>: Helo command rejected: Access denied >>> helo example.tld ./smtpd_check: warning: Unable to look up NS host for example.tld: Host not found OK >>> helo foo@postfix.org -./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@postfix.org>: Helo command rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org> +./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <foo@postfix.org>: Helo command rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org> 554 5.7.1 <foo@postfix.org>: Helo command rejected: Access denied ->>> sender_restrictions check_sender_ns_access,inline:{168.100.1.2=reject} +>>> sender_restrictions check_sender_ns_access,inline:{168.100.3.75=reject} OK >>> mail foo@www.porcupine.org -./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@www.porcupine.org>: Sender address rejected: Access denied; from=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org> +./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <foo@www.porcupine.org>: Sender address rejected: Access denied; from=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org> 554 5.7.1 <foo@www.porcupine.org>: Sender address rejected: Access denied >>> mail example.tld ./smtpd_check: warning: Unable to look up NS host for example.tld: Host not found OK >>> mail foo@postfix.org -./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@postfix.org>: Sender address rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org> +./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <foo@postfix.org>: Sender address rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org> 554 5.7.1 <foo@postfix.org>: Sender address rejected: Access denied ->>> recipient_restrictions check_recipient_ns_access,inline:{168.100.1.2=reject} +>>> recipient_restrictions check_recipient_ns_access,inline:{168.100.3.75=reject} OK >>> rcpt foo@www.porcupine.org -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@www.porcupine.org>: Recipient address rejected: Access denied; from=<foo@postfix.org> to=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org> +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <foo@www.porcupine.org>: Recipient address rejected: Access denied; from=<foo@postfix.org> to=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org> 554 5.7.1 <foo@www.porcupine.org>: Recipient address rejected: Access denied >>> rcpt foo@example.tld ./smtpd_check: warning: Unable to look up NS host for foo@example.tld: Host not found OK >>> rcpt foo@postfix.org -./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@postfix.org>: Recipient address rejected: Access denied; from=<foo@postfix.org> to=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org> +./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <foo@postfix.org>: Recipient address rejected: Access denied; from=<foo@postfix.org> to=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org> 554 5.7.1 <foo@postfix.org>: Recipient address rejected: Access denied >>> # >>> # Check A access >>> # ->>> helo_restrictions check_helo_a_access,inline:{168.100.189.2=reject} +>>> helo_restrictions check_helo_a_access,inline:{168.100.3.2=reject} OK >>> helo spike.porcupine.org -./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <spike.porcupine.org>: Helo command rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<spike.porcupine.org> +./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.3.2]: 554 5.7.1 <spike.porcupine.org>: Helo command rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<spike.porcupine.org> 554 5.7.1 <spike.porcupine.org>: Helo command rejected: Access denied >>> helo www.porcupine.org OK ->>> client_restrictions check_client_a_access,inline:{168.100.189.2=reject} +>>> client_restrictions check_client_a_access,inline:{168.100.3.2=reject} OK >>> client spike.porcupine.org 1.2.3.4 ./smtpd_check: <queue id>: reject: CONNECT from spike.porcupine.org[1.2.3.4]: 554 5.7.1 <spike.porcupine.org[1.2.3.4]>: Client host rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<www.porcupine.org> 554 5.7.1 <spike.porcupine.org[1.2.3.4]>: Client host rejected: Access denied >>> client www.porcupine.org 1.2.3.4 OK ->>> reverse_client_restrictions check_reverse_client_a_access,inline:{168.100.189.2=reject} +>>> reverse_client_restrictions check_reverse_client_a_access,inline:{168.100.3.2=reject} bad command >>> client spike.porcupine.org 1.2.3.4 ./smtpd_check: <queue id>: reject: CONNECT from spike.porcupine.org[1.2.3.4]: 554 5.7.1 <spike.porcupine.org[1.2.3.4]>: Client host rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<www.porcupine.org> 554 5.7.1 <spike.porcupine.org[1.2.3.4]>: Client host rejected: Access denied >>> client www.porcupine.org 1.2.3.4 OK ->>> sender_restrictions check_sender_a_access,inline:{168.100.189.2=reject} +>>> sender_restrictions check_sender_a_access,inline:{168.100.3.2=reject} OK >>> mail foo@spike.porcupine.org ./smtpd_check: <queue id>: reject: MAIL from www.porcupine.org[1.2.3.4]: 554 5.7.1 <foo@spike.porcupine.org>: Sender address rejected: Access denied; from=<foo@spike.porcupine.org> proto=SMTP helo=<www.porcupine.org> 554 5.7.1 <foo@spike.porcupine.org>: Sender address rejected: Access denied >>> mail foo@www.porcupine.org OK ->>> recipient_restrictions check_recipient_a_access,inline:{168.100.189.2=reject} +>>> recipient_restrictions check_recipient_a_access,inline:{168.100.3.2=reject} OK >>> rcpt foo@spike.porcupine.org ./smtpd_check: <queue id>: reject: RCPT from www.porcupine.org[1.2.3.4]: 554 5.7.1 <foo@spike.porcupine.org>: Recipient address rejected: Access denied; from=<foo@www.porcupine.org> to=<foo@spike.porcupine.org> proto=SMTP helo=<www.porcupine.org> diff --git a/external/ibm-public/postfix/dist/src/spawn/Makefile.in b/external/ibm-public/postfix/dist/src/spawn/Makefile.in index 5097697d524..74c6d6d18da 100644 --- a/external/ibm-public/postfix/dist/src/spawn/Makefile.in +++ b/external/ibm-public/postfix/dist/src/spawn/Makefile.in @@ -62,6 +62,7 @@ depend: $(MAKES) spawn.o: ../../include/argv.h spawn.o: ../../include/check_arg.h spawn.o: ../../include/dict.h +spawn.o: ../../include/htable.h spawn.o: ../../include/mail_conf.h spawn.o: ../../include/mail_params.h spawn.o: ../../include/mail_parm_split.h diff --git a/external/ibm-public/postfix/dist/src/tls/Makefile.in b/external/ibm-public/postfix/dist/src/tls/Makefile.in index fec7d4542ec..948afab9f56 100644 --- a/external/ibm-public/postfix/dist/src/tls/Makefile.in +++ b/external/ibm-public/postfix/dist/src/tls/Makefile.in @@ -1,7 +1,7 @@ SHELL = /bin/sh SRCS = tls_prng_dev.c tls_prng_egd.c tls_prng_file.c tls_fprint.c \ tls_prng_exch.c tls_stream.c tls_bio_ops.c tls_misc.c tls_dh.c \ - tls_rsa.c tls_verify.c tls_dane.c tls_certkey.c tls_session.c \ + tls_verify.c tls_dane.c tls_certkey.c tls_session.c \ tls_client.c tls_server.c tls_scache.c tls_mgr.c tls_seed.c \ tls_level.c \ tls_proxy_clnt.c tls_proxy_context_print.c tls_proxy_context_scan.c \ @@ -12,7 +12,7 @@ SRCS = tls_prng_dev.c tls_prng_egd.c tls_prng_file.c tls_fprint.c \ tls_proxy_client_misc.c OBJS = tls_prng_dev.o tls_prng_egd.o tls_prng_file.o tls_fprint.o \ tls_prng_exch.o tls_stream.o tls_bio_ops.o tls_misc.o tls_dh.o \ - tls_rsa.o tls_verify.o tls_dane.o tls_certkey.o tls_session.o \ + tls_verify.o tls_dane.o tls_certkey.o tls_session.o \ tls_client.o tls_server.o tls_scache.o tls_mgr.o tls_seed.o \ tls_level.o \ tls_proxy_clnt.o tls_proxy_context_print.o tls_proxy_context_scan.o \ @@ -25,7 +25,7 @@ DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE) CFLAGS = $(DEBUG) $(OPT) $(DEFS) INCL = LIB = lib$(LIB_PREFIX)tls$(LIB_SUFFIX) -TESTPROG= tls_dh tls_mgr tls_rsa tls_dane tls_certkey +TESTPROG= tls_dh tls_mgr tls_dane tls_certkey LIBS = ../../lib/lib$(LIB_PREFIX)dns$(LIB_SUFFIX) \ ../../lib/lib$(LIB_PREFIX)global$(LIB_SUFFIX) \ @@ -121,11 +121,6 @@ tls_mgr: $(LIB) $(LIBS) $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) mv junk $@.o -tls_rsa: $(LIB) $(LIBS) - mv $@.o junk - $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) - mv junk $@.o - tls_dane: $(LIB) $(LIBS) mv $@.o junk $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) @@ -206,6 +201,7 @@ tls_dane.o: ../../include/dns.h tls_dane.o: ../../include/events.h tls_dane.o: ../../include/hex_code.h tls_dane.o: ../../include/mail_params.h +tls_dane.o: ../../include/midna_domain.h tls_dane.o: ../../include/msg.h tls_dane.o: ../../include/myaddrinfo.h tls_dane.o: ../../include/mymalloc.h @@ -499,19 +495,6 @@ tls_proxy_server_scan.o: ../../include/vstring.h tls_proxy_server_scan.o: tls.h tls_proxy_server_scan.o: tls_proxy.h tls_proxy_server_scan.o: tls_proxy_server_scan.c -tls_rsa.o: ../../include/argv.h -tls_rsa.o: ../../include/check_arg.h -tls_rsa.o: ../../include/dns.h -tls_rsa.o: ../../include/msg.h -tls_rsa.o: ../../include/myaddrinfo.h -tls_rsa.o: ../../include/name_code.h -tls_rsa.o: ../../include/name_mask.h -tls_rsa.o: ../../include/sock_addr.h -tls_rsa.o: ../../include/sys_defs.h -tls_rsa.o: ../../include/vbuf.h -tls_rsa.o: ../../include/vstream.h -tls_rsa.o: ../../include/vstring.h -tls_rsa.o: tls.h tls_rsa.o: tls_rsa.c tls_scache.o: ../../include/argv.h tls_scache.o: ../../include/check_arg.h diff --git a/external/ibm-public/postfix/dist/src/util/Makefile.in b/external/ibm-public/postfix/dist/src/util/Makefile.in index 6c23678ab4f..c59cdf98615 100644 --- a/external/ibm-public/postfix/dist/src/util/Makefile.in +++ b/external/ibm-public/postfix/dist/src/util/Makefile.in @@ -17,7 +17,7 @@ SRCS = alldig.c allprint.c argv.c argv_split.c attr_clnt.c attr_print0.c \ msg_output.c msg_syslog.c msg_vstream.c mvect.c myaddrinfo.c myflock.c \ mymalloc.c myrand.c mystrtok.c name_code.c name_mask.c netstring.c \ neuter.c non_blocking.c nvtable.c open_as.c open_limit.c open_lock.c \ - peekfd.c percentm.c posix_signals.c printable.c rand_sleep.c \ + peekfd.c posix_signals.c printable.c rand_sleep.c \ readlline.c ring.c safe_getenv.c safe_open.c \ sane_accept.c sane_connect.c sane_link.c sane_rename.c \ sane_socketpair.c sane_time.c scan_dir.c set_eugid.c set_ugid.c \ @@ -42,7 +42,8 @@ SRCS = alldig.c allprint.c argv.c argv_split.c attr_clnt.c attr_print0.c \ extpar.c dict_inline.c casefold.c dict_utf8.c strcasecmp_utf8.c \ split_qnameval.c argv_attr_print.c argv_attr_scan.c dict_file.c \ msg_logger.c logwriter.c unix_dgram_connect.c unix_dgram_listen.c \ - byte_mask.c + byte_mask.c known_tcp_ports.c argv_split_at.c dict_stream.c \ + sane_strtol.c hash_fnv.c ldseed.c OBJS = alldig.o allprint.o argv.o argv_split.o attr_clnt.o attr_print0.o \ attr_print64.o attr_print_plain.o attr_scan0.o attr_scan64.o \ attr_scan_plain.o auto_clnt.o base64_code.o basename.o binhash.o \ @@ -62,7 +63,7 @@ OBJS = alldig.o allprint.o argv.o argv_split.o attr_clnt.o attr_print0.o \ msg_output.o msg_syslog.o msg_vstream.o mvect.o myaddrinfo.o myflock.o \ mymalloc.o myrand.o mystrtok.o name_code.o name_mask.o netstring.o \ neuter.o non_blocking.o nvtable.o open_as.o open_limit.o open_lock.o \ - peekfd.o percentm.o posix_signals.o printable.o rand_sleep.o \ + peekfd.o posix_signals.o printable.o rand_sleep.o \ readlline.o ring.o safe_getenv.o safe_open.o \ sane_accept.o sane_connect.o sane_link.o sane_rename.o \ sane_socketpair.o sane_time.o scan_dir.o set_eugid.o set_ugid.o \ @@ -86,7 +87,8 @@ OBJS = alldig.o allprint.o argv.o argv_split.o attr_clnt.o attr_print0.o \ extpar.o dict_inline.o casefold.o dict_utf8.o strcasecmp_utf8.o \ split_qnameval.o argv_attr_print.o argv_attr_scan.o dict_file.o \ msg_logger.o logwriter.o unix_dgram_connect.o unix_dgram_listen.o \ - byte_mask.o + byte_mask.o known_tcp_ports.o argv_split_at.o dict_stream.o \ + sane_strtol.o hash_fnv.o ldseed.o # MAP_OBJ is for maps that may be dynamically loaded with dynamicmaps.cf. # When hard-linking these, makedefs sets NON_PLUGIN_MAP_OBJ=$(MAP_OBJ), # otherwise it sets the PLUGIN_* macros. @@ -104,7 +106,7 @@ HDRS = argv.h attr.h attr_clnt.h auto_clnt.h base64_code.h binhash.h \ mac_parse.h make_dirs.h mask_addr.h match_list.h msg.h \ msg_output.h msg_syslog.h msg_vstream.h mvect.h myaddrinfo.h myflock.h \ mymalloc.h myrand.h name_code.h name_mask.h netstring.h nvtable.h \ - open_as.h open_lock.h percentm.h posix_signals.h readlline.h ring.h \ + open_as.h open_lock.h posix_signals.h readlline.h ring.h \ safe.h safe_open.h sane_accept.h sane_connect.h sane_fsops.h \ load_lib.h \ sane_socketpair.h sane_time.h scan_dir.h set_eugid.h set_ugid.h \ @@ -116,7 +118,8 @@ HDRS = argv.h attr.h attr_clnt.h auto_clnt.h base64_code.h binhash.h \ dict_fail.h warn_stat.h dict_sockmap.h line_number.h timecmp.h \ slmdb.h compat_va_copy.h dict_pipe.h dict_random.h \ valid_utf8_hostname.h midna_domain.h dict_union.h dict_inline.h \ - check_arg.h argv_attr.h msg_logger.h logwriter.h byte_mask.h + check_arg.h argv_attr.h msg_logger.h logwriter.h byte_mask.h \ + known_tcp_ports.h sane_strtol.h hash_fnv.h ldseed.h TESTSRC = fifo_open.c fifo_rdwr_bug.c fifo_rdonly_bug.c select_bug.c \ stream_test.c dup2_pass_on_exec.c DEFS = -I. -D$(SYSTYPE) @@ -136,9 +139,10 @@ TESTPROG= dict_open dup2_pass_on_exec events exec_command fifo_open \ myaddrinfo myaddrinfo4 inet_proto sane_basename format_tv \ valid_utf8_string ip_match base32_code msg_rate_delay netstring \ vstream timecmp dict_cache midna_domain casefold strcasecmp_utf8 \ - vbuf_print split_qnameval vstream msg_logger byte_mask + vbuf_print split_qnameval vstream msg_logger byte_mask \ + known_tcp_ports dict_stream find_inet binhash PLUGIN_MAP_SO = $(LIB_PREFIX)pcre$(LIB_SUFFIX) - +HTABLE_FIX = NORANDOMIZE=1 LIB_DIR = ../../lib INC_DIR = ../../include @@ -423,6 +427,11 @@ htable: $(LIB) $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS) mv junk $@.o +binhash: $(LIB) + mv $@.o junk + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS) + mv junk $@.o + unix_recv_fd: $(LIB) mv $@.o junk $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS) @@ -468,6 +477,11 @@ sane_basename: $(LIB) $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS) mv junk $@.o +find_inet: $(LIB) + mv $@.o junk + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS) + mv junk $@.o + stream_test: stream_test.c $(LIB) $(CC) $(CFLAGS) -o $@ $@.c $(LIB) $(SYSLIBS) @@ -547,19 +561,34 @@ split_qnameval: $(LIB) $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS) mv junk $@.o +known_tcp_ports: $(LIB) + mv $@.o junk + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS) + mv junk $@.o + +dict_stream: $(LIB) + mv $@.o junk + $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS) + mv junk $@.o + tests: all valid_hostname_test mac_expand_test dict_test unescape_test \ hex_quote_test ctable_test inet_addr_list_test base64_code_test \ - attr_scan64_test attr_scan0_test dict_pcre_test host_port_test \ + attr_scan64_test attr_scan0_test dict_pcre_tests host_port_test \ dict_cidr_test attr_scan_plain_test htable_test hex_code_test \ myaddrinfo_test format_tv_test ip_match_test name_mask_tests \ base32_code_test dict_thash_test surrogate_test timecmp_test \ dict_static_test dict_inline_test midna_domain_test casefold_test \ dict_utf8_test strcasecmp_utf8_test vbuf_print_test dict_regexp_test \ dict_union_test dict_pipe_test miss_endif_cidr_test \ - miss_endif_pcre_test miss_endif_regexp_test split_qnameval_test \ - vstring_test vstream_test dict_pcre_file_test dict_regexp_file_test \ - dict_cidr_file_test dict_static_file_test dict_random_test \ - dict_random_file_test dict_inline_file_test byte_mask_tests + miss_endif_regexp_test split_qnameval_test vstring_test \ + vstream_test dict_regexp_file_test dict_cidr_file_test \ + dict_static_file_test dict_random_test dict_random_file_test \ + dict_inline_file_test byte_mask_tests mystrtok_test \ + known_tcp_ports_test dict_stream_test dict_inline_regexp_test \ + dict_inline_cidr_test binhash_test + +dict_pcre_tests: dict_pcre_test miss_endif_pcre_test dict_pcre_file_test \ + dict_inline_pcre_test root_tests: @@ -607,12 +636,12 @@ base64_code_test: base64_code $(SHLIB_ENV) ${VALGRIND} ./base64_code attr_scan64_test: attr_print64 attr_scan64 attr_scan64.ref - ($(SHLIB_ENV) ${VALGRIND} ./attr_print64 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan64)) >attr_scan64.tmp 2>&1 3>&1 + ($(HTABLE_FIX) $(SHLIB_ENV) ${VALGRIND} ./attr_print64 2>&3 | (sleep 1; $(HTABLE_FIX) $(SHLIB_ENV) ./attr_scan64)) >attr_scan64.tmp 2>&1 3>&1 diff attr_scan64.ref attr_scan64.tmp rm -f attr_scan64.tmp attr_scan0_test: attr_print0 attr_scan0 attr_scan0.ref - ($(SHLIB_ENV) ${VALGRIND} ./attr_print0 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan0)) >attr_scan0.tmp 2>&1 3>&1 + ($(HTABLE_FIX) $(SHLIB_ENV) ${VALGRIND} ./attr_print0 2>&3 | (sleep 1; $(HTABLE_FIX) $(SHLIB_ENV) ./attr_scan0)) >attr_scan0.tmp 2>&1 3>&1 diff attr_scan0.ref attr_scan0.tmp rm -f attr_scan0.tmp @@ -627,7 +656,9 @@ dict_test: dict_open testdb dict_test.in dict_test.ref rm -f testdb.db testdb.dir testdb.pag dict_test.tmp dict_pcre_test: dict_open dict_pcre.in dict_pcre.map dict_pcre.ref - $(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:dict_pcre.map read <dict_pcre.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre.tmp + $(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:dict_pcre.map read \ + <dict_pcre.in 2>&1 | sed -e 's/uid=[0-9][0-9][0-9]*/uid=USER/' \ + -e 's/missing )/missing closing parenthesis/' >dict_pcre.tmp diff dict_pcre.ref dict_pcre.tmp rm -f dict_pcre.tmp @@ -698,13 +729,16 @@ host_port_test: host_port host_port.in host_port.ref rm -f host_port.tmp attr_scan_plain_test: attr_print_plain attr_scan_plain attr_scan_plain.ref - ($(SHLIB_ENV) ${VALGRIND} ./attr_print_plain 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan_plain)) >attr_scan_plain.tmp 2>&1 3>&1 + ($(HTABLE_FIX) $(SHLIB_ENV) ${VALGRIND} ./attr_print_plain 2>&3 | (sleep 1; $(HTABLE_FIX) $(SHLIB_ENV) ./attr_scan_plain)) >attr_scan_plain.tmp 2>&1 3>&1 diff attr_scan_plain.ref attr_scan_plain.tmp rm -f attr_scan_plain.tmp htable_test: htable /usr/share/dict/words $(SHLIB_ENV) ${VALGRIND} ./htable < /usr/share/dict/words +binhash_test: binhash /usr/share/dict/words + $(SHLIB_ENV) ${VALGRIND} ./binhash < /usr/share/dict/words + hex_code_test: hex_code $(SHLIB_ENV) ${VALGRIND} ./hex_code @@ -712,7 +746,7 @@ timecmp_test: timecmp $(SHLIB_ENV) ${VALGRIND} ./timecmp myaddrinfo_test: myaddrinfo myaddrinfo.ref myaddrinfo.ref2 - $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo all belly.porcupine.org 168.100.189.2 >myaddrinfo.tmp 2>&1 + $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo all belly.porcupine.org 168.100.3.2 >myaddrinfo.tmp 2>&1 diff myaddrinfo.ref myaddrinfo.tmp rm -f myaddrinfo.tmp $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo all null.porcupine.org 10.0.0.0 >myaddrinfo.tmp 2>&1 @@ -720,7 +754,7 @@ myaddrinfo_test: myaddrinfo myaddrinfo.ref myaddrinfo.ref2 rm -f myaddrinfo.tmp myaddrinfo4_test: myaddrinfo4 myaddrinfo4.ref myaddrinfo4.ref2 - $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo4 all belly.porcupine.org 168.100.189.2 >myaddrinfo4.tmp 2>&1 + $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo4 all belly.porcupine.org 168.100.3.2 >myaddrinfo4.tmp 2>&1 diff myaddrinfo4.ref myaddrinfo4.tmp $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo4 all null.porcupine.org 10.0.0.0 >myaddrinfo4.tmp 2>&1 diff myaddrinfo4.ref2 myaddrinfo4.tmp @@ -817,9 +851,9 @@ base32_code_test: base32_code $(SHLIB_ENV) ${VALGRIND} ./base32_code dict_thash_test: ../postmap/postmap dict_thash.map dict_thash.in dict_thash.ref - $(SHLIB_ENV) ../postmap/postmap -fs texthash:dict_thash.map 2>&1 | \ + $(SHLIB_ENV) ${VALGRIND} ../postmap/postmap -fs texthash:dict_thash.map 2>&1 | \ LANG=C sort | diff dict_thash.map - - $(SHLIB_ENV) ../postmap/postmap -fs texthash:dict_thash.in >dict_thash.tmp 2>&1 + NORANDOMIZE=1 $(SHLIB_ENV) ${VALGRIND} ../postmap/postmap -fs texthash:dict_thash.in >dict_thash.tmp 2>&1 diff dict_thash.ref dict_thash.tmp rm -f dict_thash.tmp @@ -938,25 +972,67 @@ vbuf_print_test: vbuf_print vbuf_print_test.in vbuf_print_test.ref rm -f vbuf_print_test.tmp dict_union_test: dict_open dict_union_test.in dict_union_test.ref - $(SHLIB_ENV) sh -x dict_union_test.in >dict_union_test.tmp 2>&1 + $(SHLIB_ENV) ${VALGRIND} sh -x dict_union_test.in >dict_union_test.tmp 2>&1 diff dict_union_test.ref dict_union_test.tmp rm -f dict_union_test.tmp dict_pipe_test: dict_open dict_pipe_test.in dict_pipe_test.ref - $(SHLIB_ENV) sh -x dict_pipe_test.in >dict_pipe_test.tmp 2>&1 + $(SHLIB_ENV) ${VALGRIND} sh -x dict_pipe_test.in >dict_pipe_test.tmp 2>&1 diff dict_pipe_test.ref dict_pipe_test.tmp rm -f dict_pipe_test.tmp vstring_test: dict_open vstring vstring_test.ref - $(SHLIB_ENV) ./vstring one two three >vstring_test.tmp 2>&1 + $(SHLIB_ENV) ${VALGRIND} ./vstring one two three >vstring_test.tmp 2>&1 diff vstring_test.ref vstring_test.tmp rm -f vstring_test.tmp -vstream_test: dict_open vstream vstream_test.in vstream_test.ref - $(SHLIB_ENV) ./vstream <vstream_test.in >vstream_test.tmp 2>&1 +vstream_test: vstream vstream_test.in vstream_test.ref + $(SHLIB_ENV) ${VALGRIND} ./vstream <vstream_test.in >vstream_test.tmp 2>&1 diff vstream_test.ref vstream_test.tmp rm -f vstream_test.tmp +mystrtok_test: mystrtok mystrtok.ref + $(SHLIB_ENV) ${VALGRIND} ./mystrtok >mystrtok.tmp 2>&1 + diff mystrtok.ref mystrtok.tmp + rm -f mystrtok.tmp + +known_tcp_ports_test: known_tcp_ports known_tcp_ports.ref + $(SHLIB_ENV) ${VALGRIND} ./known_tcp_ports >known_tcp_ports.tmp 2>&1 + diff known_tcp_ports.ref known_tcp_ports.tmp + rm -f known_tcp_ports.tmp + +dict_stream_test: dict_stream dict_stream.ref + $(SHLIB_ENV) ${VALGRIND} ./dict_stream >dict_stream.tmp 2>&1 + diff dict_stream.ref dict_stream.tmp + rm -f dict_stream.tmp + +dict_inline_pcre_test: dict_open dict_inline_pcre.ref + (echo get foo; echo get bar) | \ + $(SHLIB_ENV) ${VALGRIND} ./dict_open 'pcre:{{/foo/ got foo}}' \ + read 2>&1 | grep -v uid= >dict_inline_pcre.tmp + diff dict_inline_pcre.ref dict_inline_pcre.tmp + rm -f dict_inline_pcre.tmp + +dict_inline_regexp_test: dict_open dict_inline_regexp.ref + (echo get foo; echo get bar) | \ + $(SHLIB_ENV) ${VALGRIND} ./dict_open 'regexp:{{/foo/ got foo}}' \ + read 2>&1 | grep -v uid= >dict_inline_regexp.tmp + diff dict_inline_regexp.ref dict_inline_regexp.tmp + rm -f dict_inline_regexp.tmp + +dict_inline_cidr_test: dict_open dict_inline_cidr.ref + (echo get 1.2.3.4; echo get 4.3.2.1) | \ + $(SHLIB_ENV) ${VALGRIND} ./dict_open \ + 'cidr:{{1.2.3.4 got 1.2.3.4}}' \ + read 2>&1 | grep -v uid= >dict_inline_cidr.tmp + diff dict_inline_cidr.ref dict_inline_cidr.tmp + rm -f dict_inline_cidr.tmp + +find_inet_test: find_inet find_inet.ref + $(SHLIB_ENV) ${VALGRIND} ./find_inet >find_inet.tmp 2>&1 + diff find_inet.ref find_inet.tmp + rm -f find_inet.tmp + depend: $(MAKES) (sed '1,/^# do not edit/!d' Makefile.in; \ set -e; for i in [a-z][a-z0-9]*.c; do \ @@ -1031,6 +1107,16 @@ argv_split.o: stringops.h argv_split.o: sys_defs.h argv_split.o: vbuf.h argv_split.o: vstring.h +argv_split_at.o: argv.h +argv_split_at.o: argv_split_at.c +argv_split_at.o: check_arg.h +argv_split_at.o: msg.h +argv_split_at.o: mymalloc.h +argv_split_at.o: split_at.h +argv_split_at.o: stringops.h +argv_split_at.o: sys_defs.h +argv_split_at.o: vbuf.h +argv_split_at.o: vstring.h argv_splitq.o: argv.h argv_splitq.o: argv_splitq.c argv_splitq.o: check_arg.h @@ -1099,6 +1185,7 @@ attr_scan0.o: htable.h attr_scan0.o: msg.h attr_scan0.o: mymalloc.h attr_scan0.o: nvtable.h +attr_scan0.o: stringops.h attr_scan0.o: sys_defs.h attr_scan0.o: vbuf.h attr_scan0.o: vstream.h @@ -1112,6 +1199,7 @@ attr_scan64.o: htable.h attr_scan64.o: msg.h attr_scan64.o: mymalloc.h attr_scan64.o: nvtable.h +attr_scan64.o: stringops.h attr_scan64.o: sys_defs.h attr_scan64.o: vbuf.h attr_scan64.o: vstream.h @@ -1124,6 +1212,7 @@ attr_scan_plain.o: htable.h attr_scan_plain.o: msg.h attr_scan_plain.o: mymalloc.h attr_scan_plain.o: nvtable.h +attr_scan_plain.o: stringops.h attr_scan_plain.o: sys_defs.h attr_scan_plain.o: vbuf.h attr_scan_plain.o: vstream.h @@ -1170,6 +1259,7 @@ basename.o: vbuf.h basename.o: vstring.h binhash.o: binhash.c binhash.o: binhash.h +binhash.o: hash_fnv.h binhash.o: msg.h binhash.o: mymalloc.h binhash.o: sys_defs.h @@ -1593,6 +1683,18 @@ dict_static.o: sys_defs.h dict_static.o: vbuf.h dict_static.o: vstream.h dict_static.o: vstring.h +dict_stream.o: argv.h +dict_stream.o: check_arg.h +dict_stream.o: dict.h +dict_stream.o: dict_stream.c +dict_stream.o: msg.h +dict_stream.o: myflock.h +dict_stream.o: mymalloc.h +dict_stream.o: stringops.h +dict_stream.o: sys_defs.h +dict_stream.o: vbuf.h +dict_stream.o: vstream.h +dict_stream.o: vstring.h dict_surrogate.o: argv.h dict_surrogate.o: check_arg.h dict_surrogate.o: compat_va_copy.h @@ -1647,6 +1749,7 @@ dict_thash.o: htable.h dict_thash.o: iostuff.h dict_thash.o: msg.h dict_thash.o: myflock.h +dict_thash.o: mymalloc.h dict_thash.o: readlline.h dict_thash.o: stringops.h dict_thash.o: sys_defs.h @@ -1744,7 +1847,6 @@ exec_command.o: msg.h exec_command.o: sys_defs.h extpar.o: check_arg.h extpar.o: extpar.c -extpar.o: msg.h extpar.o: stringops.h extpar.o: sys_defs.h extpar.o: vbuf.h @@ -1778,6 +1880,7 @@ file_limit.o: sys_defs.h find_inet.o: check_arg.h find_inet.o: find_inet.c find_inet.o: find_inet.h +find_inet.o: known_tcp_ports.h find_inet.o: msg.h find_inet.o: stringops.h find_inet.o: sys_defs.h @@ -1813,6 +1916,11 @@ get_hostname.o: msg.h get_hostname.o: mymalloc.h get_hostname.o: sys_defs.h get_hostname.o: valid_hostname.h +hash_fnv.o: hash_fnv.c +hash_fnv.o: hash_fnv.h +hash_fnv.o: ldseed.h +hash_fnv.o: msg.h +hash_fnv.o: sys_defs.h hex_code.o: check_arg.h hex_code.o: hex_code.c hex_code.o: hex_code.h @@ -1839,6 +1947,7 @@ host_port.o: valid_hostname.h host_port.o: valid_utf8_hostname.h host_port.o: vbuf.h host_port.o: vstring.h +htable.o: hash_fnv.h htable.o: htable.c htable.o: htable.h htable.o: msg.h @@ -1930,6 +2039,20 @@ ip_match.o: vstring.h killme_after.o: killme_after.c killme_after.o: killme_after.h killme_after.o: sys_defs.h +known_tcp_ports.o: check_arg.h +known_tcp_ports.o: htable.h +known_tcp_ports.o: known_tcp_ports.c +known_tcp_ports.o: known_tcp_ports.h +known_tcp_ports.o: mymalloc.h +known_tcp_ports.o: stringops.h +known_tcp_ports.o: sys_defs.h +known_tcp_ports.o: vbuf.h +known_tcp_ports.o: vstring.h +ldseed.o: iostuff.h +ldseed.o: ldseed.c +ldseed.o: ldseed.h +ldseed.o: msg.h +ldseed.o: sys_defs.h line_number.o: check_arg.h line_number.o: line_number.c line_number.o: line_number.h @@ -1949,6 +2072,8 @@ load_file.o: vbuf.h load_file.o: vstream.h load_file.o: warn_stat.h load_lib.o: load_lib.c +load_lib.o: load_lib.h +load_lib.o: msg.h load_lib.o: sys_defs.h logwriter.o: check_arg.h logwriter.o: iostuff.h @@ -1974,12 +2099,14 @@ lstat_as.o: set_eugid.h lstat_as.o: sys_defs.h lstat_as.o: warn_stat.h mac_expand.o: check_arg.h +mac_expand.o: htable.h mac_expand.o: mac_expand.c mac_expand.o: mac_expand.h mac_expand.o: mac_parse.h mac_expand.o: msg.h mac_expand.o: mymalloc.h mac_expand.o: name_code.h +mac_expand.o: sane_strtol.h mac_expand.o: stringops.h mac_expand.o: sys_defs.h mac_expand.o: vbuf.h @@ -2070,7 +2197,6 @@ msg_output.o: msg_output.c msg_output.o: msg_output.h msg_output.o: msg_vstream.h msg_output.o: mymalloc.h -msg_output.o: percentm.h msg_output.o: stringops.h msg_output.o: sys_defs.h msg_output.o: vbuf.h @@ -2108,6 +2234,7 @@ mvect.o: mymalloc.h mvect.o: sys_defs.h myaddrinfo.o: check_arg.h myaddrinfo.o: inet_proto.h +myaddrinfo.o: known_tcp_ports.h myaddrinfo.o: msg.h myaddrinfo.o: myaddrinfo.c myaddrinfo.o: myaddrinfo.h @@ -2220,12 +2347,6 @@ pass_trigger.o: trigger.h peekfd.o: iostuff.h peekfd.o: peekfd.c peekfd.o: sys_defs.h -percentm.o: check_arg.h -percentm.o: percentm.c -percentm.o: percentm.h -percentm.o: sys_defs.h -percentm.o: vbuf.h -percentm.o: vstring.h poll_fd.o: iostuff.h poll_fd.o: msg.h poll_fd.o: poll_fd.c @@ -2307,6 +2428,9 @@ sane_socketpair.o: msg.h sane_socketpair.o: sane_socketpair.c sane_socketpair.o: sane_socketpair.h sane_socketpair.o: sys_defs.h +sane_strtol.o: sane_strtol.c +sane_strtol.o: sane_strtol.h +sane_strtol.o: sys_defs.h sane_time.o: msg.h sane_time.o: sane_time.c sane_time.o: sane_time.h diff --git a/external/ibm-public/postfix/dist/src/util/alldig.c b/external/ibm-public/postfix/dist/src/util/alldig.c index 04b2be51fb1..e047bdf0398 100644 --- a/external/ibm-public/postfix/dist/src/util/alldig.c +++ b/external/ibm-public/postfix/dist/src/util/alldig.c @@ -1,4 +1,4 @@ -/* $NetBSD: alldig.c,v 1.1.1.1 2009/06/23 10:08:58 tron Exp $ */ +/* $NetBSD: alldig.c,v 1.1.1.2 2022/10/08 16:09:11 christos Exp $ */ /*++ /* NAME @@ -10,8 +10,14 @@ /* /* int alldig(string) /* const char *string; +/* +/* int allalnum(string) +/* const char *string; /* DESCRIPTION /* alldig() determines if its argument is an all-numerical string. +/* +/* allalnum() determines if its argument is an all-alphanumerical +/* string. /* SEE ALSO /* An alldig() routine appears in Brian W. Kernighan, P.J. Plauger: /* "Software Tools", Addison-Wesley 1976. @@ -24,6 +30,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ @@ -48,3 +59,17 @@ int alldig(const char *string) return (0); return (1); } + +/* allalnum - return true if string is all alphanum */ + +int allalnum(const char *string) +{ + const char *cp; + + if (*string == 0) + return (0); + for (cp = string; *cp != 0; cp++) + if (!ISALNUM(*cp)) + return (0); + return (1); +} diff --git a/external/ibm-public/postfix/dist/src/util/argv_split_at.c b/external/ibm-public/postfix/dist/src/util/argv_split_at.c new file mode 100644 index 00000000000..a817e4e0390 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/argv_split_at.c @@ -0,0 +1,126 @@ +/* $NetBSD: argv_split_at.c,v 1.1.1.1 2022/10/08 16:09:11 christos Exp $ */ + +/*++ +/* NAME +/* argv_split_at 3 +/* SUMMARY +/* string array utilities +/* SYNOPSIS +/* #include <argv.h> +/* +/* ARGV *argv_split_at(string, sep) +/* const char *string; +/* int sep; +/* +/* ARGV *argv_split_at_count(string, sep, count) +/* const char *string; +/* int sep; +/* ssize_t count; +/* +/* ARGV *argv_split_at_append(argv, string, sep) +/* ARGV *argv; +/* const char *string; +/* int sep; +/* DESCRIPTION +/* argv_split_at() splits \fIstring\fR into fields using a +/* single separator specified in \fIsep\fR. The result is a +/* null-terminated string array. +/* +/* argv_split_at_count() is like argv_split_at() but stops +/* splitting input after at most \fIcount\fR -1 times and +/* leaves the remainder, if any, in the last array element. +/* It is an error to specify a count < 1. +/* +/* argv_split_at_append() performs the same operation as +/* argv_split_at(), but appends the result to an existing +/* string array. +/* SEE ALSO +/* split_at(), trivial string splitter. +/* DIAGNOSTICS +/* Fatal errors: memory allocation problem. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* IBM T.J. Watson Research +/* P.O. Box 704 +/* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +/* System libraries. */ + +#include <sys_defs.h> +#include <string.h> + +/* Application-specific. */ + +#include <mymalloc.h> +#include <stringops.h> +#include <argv.h> +#include <msg.h> +#include <split_at.h> + +/* argv_split_at - split string into field array */ + +ARGV *argv_split_at(const char *string, int sep) +{ + ARGV *argvp = argv_alloc(1); + char *saved_string = mystrdup(string); + char *bp = saved_string; + char *arg; + + while ((arg = split_at(bp, sep)) != 0) { + argv_add(argvp, bp, (char *) 0); + bp = arg; + } + argv_add(argvp, bp, (char *) 0); + argv_terminate(argvp); + myfree(saved_string); + return (argvp); +} + +/* argv_split_at_count - split string into field array */ + +ARGV *argv_split_at_count(const char *string, int sep, ssize_t count) +{ + ARGV *argvp = argv_alloc(1); + char *saved_string = mystrdup(string); + char *bp = saved_string; + char *arg; + + if (count < 1) + msg_panic("argv_split_at_count: bad count: %ld", (long) count); + while (count-- > 1 && (arg = split_at(bp, sep)) != 0) { + argv_add(argvp, bp, (char *) 0); + bp = arg; + } + argv_add(argvp, bp, (char *) 0); + argv_terminate(argvp); + myfree(saved_string); + return (argvp); +} + +/* argv_split_at_append - split string into field array, append to array */ + +ARGV *argv_split_at_append(ARGV *argvp, const char *string, int sep) +{ + char *saved_string = mystrdup(string); + char *bp = saved_string; + char *arg; + + while ((arg = split_at(bp, sep)) != 0) { + argv_add(argvp, bp, (char *) 0); + bp = arg; + } + argv_add(argvp, bp, (char *) 0); + argv_terminate(argvp); + myfree(saved_string); + return (argvp); +} diff --git a/external/ibm-public/postfix/dist/src/util/attr_scan0.ref b/external/ibm-public/postfix/dist/src/util/attr_scan0.ref index 125faeb5965..9055d795da5 100644 --- a/external/ibm-public/postfix/dist/src/util/attr_scan0.ref +++ b/external/ibm-public/postfix/dist/src/util/attr_scan0.ref @@ -1,14 +1,20 @@ +./attr_print0: send attr protocol = test ./attr_print0: send attr number = 4711 ./attr_print0: send attr long_number = 1234 ./attr_print0: send attr string = whoopee ./attr_print0: send attr data = [data 7 bytes] -./attr_print0: send attr name foo-name value foo-value ./attr_print0: send attr name bar-name value bar-value +./attr_print0: send attr name foo-name value foo-value ./attr_print0: send attr long_number = 4321 +./attr_print0: send attr protocol = test ./attr_print0: send attr number = 4711 ./attr_print0: send attr long_number = 1234 ./attr_print0: send attr string = whoopee ./attr_print0: send attr data = [data 7 bytes] +./attr_print0: send attr protocol = not-test +./attr_scan0: unknown_stream: wanted attribute: protocol +./attr_scan0: input attribute name: protocol +./attr_scan0: input attribute value: test ./attr_scan0: unknown_stream: wanted attribute: number ./attr_scan0: input attribute name: number ./attr_scan0: input attribute value: 4711 @@ -24,18 +30,21 @@ ./attr_scan0: unknown_stream: wanted attribute: (any attribute name or list terminator) ./attr_scan0: input attribute name: { ./attr_scan0: unknown_stream: wanted attribute: (any attribute name or '}') -./attr_scan0: input attribute name: foo-name -./attr_scan0: input attribute value: foo-value -./attr_scan0: unknown_stream: wanted attribute: (any attribute name or '}') ./attr_scan0: input attribute name: bar-name ./attr_scan0: input attribute value: bar-value ./attr_scan0: unknown_stream: wanted attribute: (any attribute name or '}') +./attr_scan0: input attribute name: foo-name +./attr_scan0: input attribute value: foo-value +./attr_scan0: unknown_stream: wanted attribute: (any attribute name or '}') ./attr_scan0: input attribute name: } ./attr_scan0: unknown_stream: wanted attribute: long_number ./attr_scan0: input attribute name: long_number ./attr_scan0: input attribute value: 4321 ./attr_scan0: unknown_stream: wanted attribute: (list terminator) ./attr_scan0: input attribute name: (end) +./attr_scan0: unknown_stream: wanted attribute: protocol +./attr_scan0: input attribute name: protocol +./attr_scan0: input attribute value: test ./attr_scan0: unknown_stream: wanted attribute: number ./attr_scan0: input attribute name: number ./attr_scan0: input attribute value: 4711 @@ -50,16 +59,21 @@ ./attr_scan0: input attribute value: d2hvb3BlZQ== ./attr_scan0: unknown_stream: wanted attribute: (list terminator) ./attr_scan0: input attribute name: (end) +./attr_scan0: unknown_stream: wanted attribute: protocol +./attr_scan0: input attribute name: protocol +./attr_scan0: input attribute value: not-test +./attr_scan0: warning: unexpected protocol not-test from unknown_stream (expected: test) number 4711 long_number 1234 string whoopee data whoopee -(hash) foo-name foo-value (hash) bar-name bar-value +(hash) foo-name foo-value long_number 4321 number 4711 long_number 1234 string whoopee data whoopee -(hash) foo-name foo-value (hash) bar-name bar-value +(hash) foo-name foo-value +return: -1 diff --git a/external/ibm-public/postfix/dist/src/util/attr_scan64.ref b/external/ibm-public/postfix/dist/src/util/attr_scan64.ref index 2fe353f802e..ccf27f12e3f 100644 --- a/external/ibm-public/postfix/dist/src/util/attr_scan64.ref +++ b/external/ibm-public/postfix/dist/src/util/attr_scan64.ref @@ -1,14 +1,20 @@ +./attr_print64: send attr protocol = test ./attr_print64: send attr number = 4711 ./attr_print64: send attr long_number = 1234 ./attr_print64: send attr string = whoopee ./attr_print64: send attr data = [data 7 bytes] -./attr_print64: send attr name foo-name value foo-value ./attr_print64: send attr name bar-name value bar-value +./attr_print64: send attr name foo-name value foo-value ./attr_print64: send attr long_number = 4321 +./attr_print64: send attr protocol = test ./attr_print64: send attr number = 4711 ./attr_print64: send attr long_number = 1234 ./attr_print64: send attr string = whoopee ./attr_print64: send attr data = [data 7 bytes] +./attr_print64: send attr protocol = not-test +./attr_scan64: unknown_stream: wanted attribute: protocol +./attr_scan64: input attribute name: protocol +./attr_scan64: input attribute value: test ./attr_scan64: unknown_stream: wanted attribute: number ./attr_scan64: input attribute name: number ./attr_scan64: input attribute value: 4711 @@ -24,18 +30,21 @@ ./attr_scan64: unknown_stream: wanted attribute: (any attribute name or list terminator) ./attr_scan64: input attribute name: { ./attr_scan64: unknown_stream: wanted attribute: (any attribute name or '}') -./attr_scan64: input attribute name: foo-name -./attr_scan64: input attribute value: foo-value -./attr_scan64: unknown_stream: wanted attribute: (any attribute name or '}') ./attr_scan64: input attribute name: bar-name ./attr_scan64: input attribute value: bar-value ./attr_scan64: unknown_stream: wanted attribute: (any attribute name or '}') +./attr_scan64: input attribute name: foo-name +./attr_scan64: input attribute value: foo-value +./attr_scan64: unknown_stream: wanted attribute: (any attribute name or '}') ./attr_scan64: input attribute name: } ./attr_scan64: unknown_stream: wanted attribute: long_number ./attr_scan64: input attribute name: long_number ./attr_scan64: input attribute value: 4321 ./attr_scan64: unknown_stream: wanted attribute: (list terminator) ./attr_scan64: input attribute name: (end) +./attr_scan64: unknown_stream: wanted attribute: protocol +./attr_scan64: input attribute name: protocol +./attr_scan64: input attribute value: test ./attr_scan64: unknown_stream: wanted attribute: number ./attr_scan64: input attribute name: number ./attr_scan64: input attribute value: 4711 @@ -50,16 +59,21 @@ ./attr_scan64: input attribute value: whoopee ./attr_scan64: unknown_stream: wanted attribute: (list terminator) ./attr_scan64: input attribute name: (end) +./attr_scan64: unknown_stream: wanted attribute: protocol +./attr_scan64: input attribute name: protocol +./attr_scan64: input attribute value: not-test +./attr_scan64: warning: unexpected protocol not-test from unknown_stream (expected: test) number 4711 long_number 1234 string whoopee data whoopee -(hash) foo-name foo-value (hash) bar-name bar-value +(hash) foo-name foo-value long_number 4321 number 4711 long_number 1234 string whoopee data whoopee -(hash) foo-name foo-value (hash) bar-name bar-value +(hash) foo-name foo-value +return: -1 diff --git a/external/ibm-public/postfix/dist/src/util/attr_scan_plain.ref b/external/ibm-public/postfix/dist/src/util/attr_scan_plain.ref index 6e962c81fd1..1c0f35809fb 100644 --- a/external/ibm-public/postfix/dist/src/util/attr_scan_plain.ref +++ b/external/ibm-public/postfix/dist/src/util/attr_scan_plain.ref @@ -1,14 +1,20 @@ +./attr_print_plain: send attr protocol = test ./attr_print_plain: send attr number = 4711 ./attr_print_plain: send attr long_number = 1234 ./attr_print_plain: send attr string = whoopee ./attr_print_plain: send attr data = [data 7 bytes] -./attr_print_plain: send attr name foo-name value foo-value ./attr_print_plain: send attr name bar-name value bar-value +./attr_print_plain: send attr name foo-name value foo-value ./attr_print_plain: send attr long_number = 4321 +./attr_print_plain: send attr protocol = test ./attr_print_plain: send attr number = 4711 ./attr_print_plain: send attr long_number = 1234 ./attr_print_plain: send attr string = whoopee ./attr_print_plain: send attr data = [data 7 bytes] +./attr_print_plain: send attr protocol = not-test +./attr_scan_plain: unknown_stream: wanted attribute: protocol +./attr_scan_plain: input attribute name: protocol +./attr_scan_plain: input attribute value: test ./attr_scan_plain: unknown_stream: wanted attribute: number ./attr_scan_plain: input attribute name: number ./attr_scan_plain: input attribute value: 4711 @@ -24,18 +30,21 @@ ./attr_scan_plain: unknown_stream: wanted attribute: (any attribute name or list terminator) ./attr_scan_plain: input attribute name: { ./attr_scan_plain: unknown_stream: wanted attribute: (any attribute name or '}') -./attr_scan_plain: input attribute name: foo-name -./attr_scan_plain: input attribute value: foo-value -./attr_scan_plain: unknown_stream: wanted attribute: (any attribute name or '}') ./attr_scan_plain: input attribute name: bar-name ./attr_scan_plain: input attribute value: bar-value ./attr_scan_plain: unknown_stream: wanted attribute: (any attribute name or '}') +./attr_scan_plain: input attribute name: foo-name +./attr_scan_plain: input attribute value: foo-value +./attr_scan_plain: unknown_stream: wanted attribute: (any attribute name or '}') ./attr_scan_plain: input attribute name: } ./attr_scan_plain: unknown_stream: wanted attribute: long_number ./attr_scan_plain: input attribute name: long_number ./attr_scan_plain: input attribute value: 4321 ./attr_scan_plain: unknown_stream: wanted attribute: (list terminator) ./attr_scan_plain: input attribute name: (end) +./attr_scan_plain: unknown_stream: wanted attribute: protocol +./attr_scan_plain: input attribute name: protocol +./attr_scan_plain: input attribute value: test ./attr_scan_plain: unknown_stream: wanted attribute: number ./attr_scan_plain: input attribute name: number ./attr_scan_plain: input attribute value: 4711 @@ -50,16 +59,21 @@ ./attr_scan_plain: input attribute value: d2hvb3BlZQ== ./attr_scan_plain: unknown_stream: wanted attribute: (list terminator) ./attr_scan_plain: input attribute name: (end) +./attr_scan_plain: unknown_stream: wanted attribute: protocol +./attr_scan_plain: input attribute name: protocol +./attr_scan_plain: input attribute value: not-test +./attr_scan_plain: warning: unexpected protocol not-test from unknown_stream (expected: test) number 4711 long_number 1234 string whoopee data whoopee -(hash) foo-name foo-value (hash) bar-name bar-value +(hash) foo-name foo-value long_number 4321 number 4711 long_number 1234 string whoopee data whoopee -(hash) foo-name foo-value (hash) bar-name bar-value +(hash) foo-name foo-value +return: -1 diff --git a/external/ibm-public/postfix/dist/src/util/auto_clnt.h b/external/ibm-public/postfix/dist/src/util/auto_clnt.h index d061e86b9be..a6d267bf577 100644 --- a/external/ibm-public/postfix/dist/src/util/auto_clnt.h +++ b/external/ibm-public/postfix/dist/src/util/auto_clnt.h @@ -1,4 +1,4 @@ -/* $NetBSD: auto_clnt.h,v 1.1.1.1 2009/06/23 10:08:59 tron Exp $ */ +/* $NetBSD: auto_clnt.h,v 1.1.1.2 2022/10/08 16:09:11 christos Exp $ */ #ifndef _AUTO_CLNT_H_INCLUDED_ #define _AUTO_CLNT_H_INCLUDED_ @@ -22,12 +22,17 @@ * External interface. */ typedef struct AUTO_CLNT AUTO_CLNT; +typedef int (*AUTO_CLNT_HANDSHAKE_FN) (VSTREAM *); extern AUTO_CLNT *auto_clnt_create(const char *, int, int, int); extern VSTREAM *auto_clnt_access(AUTO_CLNT *); extern void auto_clnt_recover(AUTO_CLNT *); extern const char *auto_clnt_name(AUTO_CLNT *); extern void auto_clnt_free(AUTO_CLNT *); +extern void auto_clnt_control(AUTO_CLNT *, int,...); + +#define AUTO_CLNT_CTL_END 0 +#define AUTO_CLNT_CTL_HANDSHAKE 1 /* handshake before first request */ /* LICENSE /* .ad @@ -38,6 +43,11 @@ extern void auto_clnt_free(AUTO_CLNT *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/external/ibm-public/postfix/dist/src/util/dict_cidr.ref b/external/ibm-public/postfix/dist/src/util/dict_cidr.ref index a83de6b0c5e..305e3fd303f 100644 --- a/external/ibm-public/postfix/dist/src/util/dict_cidr.ref +++ b/external/ibm-public/postfix/dist/src/util/dict_cidr.ref @@ -1,13 +1,13 @@ ./dict_open: warning: cidr map dict_cidr.map, line 5: non-null host address bits in "172.16.1.3/21", perhaps you should use "172.16.0.0/21" instead: skipping this rule -./dict_open: warning: cidr map dict_cidr.map, line 6: bad net/mask pattern: "172.16.1.3/33": skipping this rule -./dict_open: warning: cidr map dict_cidr.map, line 7: bad net/mask pattern: "172.999.0.0/21": skipping this rule +./dict_open: warning: cidr map dict_cidr.map, line 6: bad mask length in "172.16.1.3/33": skipping this rule +./dict_open: warning: cidr map dict_cidr.map, line 7: bad network value in "172.999.0.0/21": skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 8: bad address pattern: "172.16.1.999": skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 9: no lookup result: skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 38: non-null host address bits in "1.0.0.0/0", perhaps you should use "0.0.0.0/0" instead: skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 40: non-null host address bits in "1::/0", perhaps you should use "::/0" instead: skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 42: missing ']' character after "[1234": skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 43: garbage after "[1234]": skipping this rule -./dict_open: warning: cidr map dict_cidr.map, line 44: bad net/mask pattern: "172.16.1.3/3x": skipping this rule +./dict_open: warning: cidr map dict_cidr.map, line 44: bad mask value in "172.16.1.3/3x": skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 45: ENDIF without IF: skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 46: ENDIF without IF: skipping this rule ./dict_open: warning: cidr map dict_cidr.map, line 49: no address pattern: skipping this rule diff --git a/external/ibm-public/postfix/dist/src/util/dict_fail.c b/external/ibm-public/postfix/dist/src/util/dict_fail.c index c6f6a7f39b2..d6d2506bba0 100644 --- a/external/ibm-public/postfix/dist/src/util/dict_fail.c +++ b/external/ibm-public/postfix/dist/src/util/dict_fail.c @@ -1,4 +1,4 @@ -/* $NetBSD: dict_fail.c,v 1.1.1.1 2013/01/02 18:59:12 tron Exp $ */ +/* $NetBSD: dict_fail.c,v 1.1.1.2 2022/10/08 16:09:11 christos Exp $ */ /*++ /* NAME @@ -31,6 +31,7 @@ /* System library. */ #include <sys_defs.h> +#include <errno.h> /* Utility library. */ @@ -53,6 +54,7 @@ static int dict_fail_sequence(DICT *dict, int unused_func, { DICT_FAIL *dp = (DICT_FAIL *) dict; + errno = 0; DICT_ERR_VAL_RETURN(dict, dp->dict_errno, DICT_STAT_ERROR); } @@ -63,6 +65,7 @@ static int dict_fail_update(DICT *dict, const char *unused_name, { DICT_FAIL *dp = (DICT_FAIL *) dict; + errno = 0; DICT_ERR_VAL_RETURN(dict, dp->dict_errno, DICT_STAT_ERROR); } @@ -72,6 +75,7 @@ static const char *dict_fail_lookup(DICT *dict, const char *unused_name) { DICT_FAIL *dp = (DICT_FAIL *) dict; + errno = 0; DICT_ERR_VAL_RETURN(dict, dp->dict_errno, (char *) 0); } @@ -81,6 +85,7 @@ static int dict_fail_delete(DICT *dict, const char *unused_name) { DICT_FAIL *dp = (DICT_FAIL *) dict; + errno = 0; DICT_ERR_VAL_RETURN(dict, dp->dict_errno, DICT_STAT_ERROR); } diff --git a/external/ibm-public/postfix/dist/src/util/dict_inline_cidr.ref b/external/ibm-public/postfix/dist/src/util/dict_inline_cidr.ref new file mode 100644 index 00000000000..56c00c56fa9 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/dict_inline_cidr.ref @@ -0,0 +1,4 @@ +> get 1.2.3.4 +1.2.3.4=got 1.2.3.4 +> get 4.3.2.1 +4.3.2.1: not found diff --git a/external/ibm-public/postfix/dist/src/util/dict_inline_pcre.ref b/external/ibm-public/postfix/dist/src/util/dict_inline_pcre.ref new file mode 100644 index 00000000000..0c381f1aab3 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/dict_inline_pcre.ref @@ -0,0 +1,4 @@ +> get foo +foo=got foo +> get bar +bar: not found diff --git a/external/ibm-public/postfix/dist/src/util/dict_inline_regexp.ref b/external/ibm-public/postfix/dist/src/util/dict_inline_regexp.ref new file mode 100644 index 00000000000..0c381f1aab3 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/dict_inline_regexp.ref @@ -0,0 +1,4 @@ +> get foo +foo=got foo +> get bar +bar: not found diff --git a/external/ibm-public/postfix/dist/src/util/dict_pcre.map b/external/ibm-public/postfix/dist/src/util/dict_pcre.map index 7a6cefb6f84..23c976a0ad3 100644 --- a/external/ibm-public/postfix/dist/src/util/dict_pcre.map +++ b/external/ibm-public/postfix/dist/src/util/dict_pcre.map @@ -25,3 +25,4 @@ endif endif if /./ if /./ +/(/ unused diff --git a/external/ibm-public/postfix/dist/src/util/dict_pcre.ref b/external/ibm-public/postfix/dist/src/util/dict_pcre.ref index 23eef8e01fd..9b14678b5b6 100644 --- a/external/ibm-public/postfix/dist/src/util/dict_pcre.ref +++ b/external/ibm-public/postfix/dist/src/util/dict_pcre.ref @@ -8,6 +8,7 @@ ./dict_open: warning: pcre map dict_pcre.map, line 22: no regexp: skipping this rule ./dict_open: warning: pcre map dict_pcre.map, line 24: ignoring ENDIF without matching IF ./dict_open: warning: pcre map dict_pcre.map, line 25: ignoring ENDIF without matching IF +./dict_open: warning: pcre map dict_pcre.map, line 28: error in regex at offset 1: missing closing parenthesis ./dict_open: warning: pcre map dict_pcre.map, line 27: IF has no matching ENDIF ./dict_open: warning: pcre map dict_pcre.map, line 26: IF has no matching ENDIF owner=untrusted (uid=USER) diff --git a/external/ibm-public/postfix/dist/src/util/dict_stream.c b/external/ibm-public/postfix/dist/src/util/dict_stream.c new file mode 100644 index 00000000000..b45f27a4e1c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/dict_stream.c @@ -0,0 +1,276 @@ +/* $NetBSD: dict_stream.c,v 1.1.1.1 2022/10/08 16:09:11 christos Exp $ */ + +/*++ +/* NAME +/* dict_stream 3 +/* SUMMARY +/* +/* SYNOPSIS +/* #include <dict.h> +/* +/* VSTREAM *dict_stream_open( +/* const char *dict_type, +/* const char *mapname, +/* int open_flags, +/* int dict_flags, +/* struct stat * st, +/* VSTRING **why) +/* DESCRIPTION +/* dict_stream_open() opens a dictionary, which can be specified +/* as a file name, or as inline text enclosed with {}. If successful, +/* dict_stream_open() returns a non-null VSTREAM pointer. Otherwise, +/* it returns an error text through the why argument, allocating +/* storage for the error text if the why argument points to a +/* null pointer. +/* +/* When the dictionary file is specified inline, dict_stream_open() +/* removes the outer {} from the mapname value, and removes leading +/* or trailing comma or whitespace from the result. It then expects +/* to find zero or more rules enclosed in {}, separated by comma +/* and/or whitespace. dict_stream() writes each rule as one text +/* line to an in-memory stream, without its enclosing {} and without +/* leading or trailing whitespace. The result value is a VSTREAM +/* pointer for the in-memory stream that can be read as a regular +/* file. +/* .sp +/* inline-file = "{" 0*(0*wsp-comma rule-spec) 0*wsp-comma "}" +/* .sp +/* rule-spec = "{" 0*wsp rule-text 0*wsp "}" +/* .sp +/* rule-text = any text containing zero or more balanced {} +/* .sp +/* wsp-comma = wsp | "," +/* .sp +/* wsp = whitespace +/* +/* Arguments: +/* .IP dict_type +/* .IP open_flags +/* .IP dict_flags +/* The same as with dict_open(3). +/* .IP mapname +/* Pathname of a file with dictionary content, or inline dictionary +/* content as specified above. +/* .IP st +/* File metadata with the file owner, or fake metadata with the +/* real UID and GID of the dict_stream_open() caller. This is +/* used for "taint" tracking (zero=trusted, non-zero=untrusted). +/* IP why +/* Pointer to pointer to error message storage. dict_stream_open() +/* updates this storage when reporting an error, and allocates +/* memory if why points to a null pointer. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library. + */ +#include <sys_defs.h> + + /* + * Utility library. + */ +#include <dict.h> +#include <msg.h> +#include <mymalloc.h> +#include <stringops.h> +#include <vstring.h> + +#define STR(x) vstring_str(x) +#define LEN(x) VSTRING_LEN(x) + +/* dict_inline_to_multiline - convert inline map spec to multiline text */ + +static char *dict_inline_to_multiline(VSTRING *vp, const char *mapname) +{ + char *saved_name = mystrdup(mapname); + char *bp = saved_name; + char *cp; + char *err = 0; + + VSTRING_RESET(vp); + /* Strip the {} from the map "name". */ + err = extpar(&bp, CHARS_BRACE, EXTPAR_FLAG_NONE); + /* Extract zero or more rules inside {}. */ + while (err == 0 && (cp = mystrtokq(&bp, CHARS_COMMA_SP, CHARS_BRACE)) != 0) + if ((err = extpar(&cp, CHARS_BRACE, EXTPAR_FLAG_STRIP)) == 0) + /* Write rule to in-memory file. */ + vstring_sprintf_append(vp, "%s\n", cp); + VSTRING_TERMINATE(vp); + myfree(saved_name); + return (err); +} + +/* dict_stream_open - open inline configuration or configuration file */ + +VSTREAM *dict_stream_open(const char *dict_type, const char *mapname, + int open_flags, int dict_flags, + struct stat * st, VSTRING **why) +{ + VSTRING *inline_buf = 0; + VSTREAM *map_fp; + char *err = 0; + +#define RETURN_0_WITH_REASON(...) do { \ + if (*why == 0) \ + *why = vstring_alloc(100); \ + vstring_sprintf(*why, __VA_ARGS__); \ + if (inline_buf != 0) \ + vstring_free(inline_buf); \ + if (err != 0) \ + myfree(err); \ + return (0); \ + } while (0) + + if (mapname[0] == CHARS_BRACE[0]) { + inline_buf = vstring_alloc(100); + if ((err = dict_inline_to_multiline(inline_buf, mapname)) != 0) + RETURN_0_WITH_REASON("%s map: %s", dict_type, err); + map_fp = vstream_memopen(inline_buf, O_RDONLY); + vstream_control(map_fp, VSTREAM_CTL_OWN_VSTRING, VSTREAM_CTL_END); + st->st_uid = getuid(); /* geteuid()? */ + st->st_gid = getgid(); /* getegid()? */ + return (map_fp); + } else { + if ((map_fp = vstream_fopen(mapname, open_flags, 0)) == 0) + RETURN_0_WITH_REASON("open %s: %m", mapname); + if (fstat(vstream_fileno(map_fp), st) < 0) + msg_fatal("fstat %s: %m", mapname); + return (map_fp); + } +} + +#ifdef TEST + +#include <string.h> + +int main(int argc, char **argv) +{ + struct testcase { + const char *title; + const char *mapname; /* starts with brace */ + const char *expect_err; /* null or message */ + const char *expect_cont; /* null or content */ + }; + +#define EXP_NOERR 0 +#define EXP_NOCONT 0 + +#define STRING_OR(s, text_if_null) ((s) ? (s) : (text_if_null)) +#define DICT_TYPE_TEST "test" + + const char rule_spec_error[] = DICT_TYPE_TEST " map: " + "syntax error after '}' in \"{blah blah}x\""; + const char inline_config_error[] = DICT_TYPE_TEST " map: " + "syntax error after '}' in \"{{foo bar}, {blah blah}}x\""; + struct testcase testcases[] = { + {"normal", + "{{foo bar}, {blah blah}}", EXP_NOERR, "foo bar\nblah blah\n" + }, + {"trims leading/trailing wsp around rule-text", + "{{ foo bar }, { blah blah }}", EXP_NOERR, "foo bar\nblah blah\n" + }, + {"trims leading/trailing comma-wsp around rule-spec", + "{, ,{foo bar}, {blah blah}, ,}", EXP_NOERR, "foo bar\nblah blah\n" + }, + {"empty inline-file", + "{, }", EXP_NOERR, "" + }, + {"propagates extpar error for inline-file", + "{{foo bar}, {blah blah}}x", inline_config_error, EXP_NOCONT + }, + {"propagates extpar error for rule-spec", + "{{foo bar}, {blah blah}x}", rule_spec_error, EXP_NOCONT + }, + 0, + }; + struct testcase *tp; + VSTRING *act_err = 0; + VSTRING *act_cont = vstring_alloc(100); + VSTREAM *fp; + struct stat st; + ssize_t exp_len; + ssize_t act_len; + int pass; + int fail; + + for (pass = fail = 0, tp = testcases; tp->title; tp++) { + int test_passed = 0; + + msg_info("RUN test case %ld %s", (long) (tp - testcases), tp->title); + +#if 0 + msg_info("title=%s", tp->title); + msg_info("mapname=%s", tp->mapname); + msg_info("expect_err=%s", STRING_OR_NULL(tp->expect_err)); + msg_info("expect_cont=%s", STRINGOR_NULL(tp->expect_cont)); +#endif + + if (act_err) + VSTRING_RESET(act_err); + fp = dict_stream_open(DICT_TYPE_TEST, tp->mapname, O_RDONLY, + 0, &st, &act_err); + if (fp) { + if (tp->expect_err) { + msg_warn("test case %s: got stream, expected error", tp->title); + } else if (!tp->expect_err && act_err && LEN(act_err) > 0) { + msg_warn("test case %s: got error '%s', expected noerror", + tp->title, STR(act_err)); + } else if (!tp->expect_cont) { + msg_warn("test case %s: got stream, expected nostream", + tp->title); + } else { + exp_len = strlen(tp->expect_cont); + if ((act_len = vstream_fread_buf(fp, act_cont, 2 * exp_len)) < 0) { + msg_warn("test case %s: content read error", tp->title); + } else { + VSTRING_TERMINATE(act_cont); + if (strcmp(tp->expect_cont, STR(act_cont)) != 0) { + msg_warn("test case %s: got content '%s', expected '%s'", + tp->title, STR(act_cont), tp->expect_cont); + } else { + test_passed = 1; + } + } + } + } else { + if (!tp->expect_err) { + msg_warn("test case %s: got nostream, expected noerror", + tp->title); + } else if (tp->expect_cont) { + msg_warn("test case %s: got nostream, expected stream", + tp->title); + } else if (strcmp(STR(act_err), tp->expect_err) != 0) { + msg_warn("test case %s: got error '%s', expected '%s'", + tp->title, STR(act_err), tp->expect_err); + } else { + test_passed = 1; + } + + } + if (test_passed) { + msg_info("PASS test %ld", (long) (tp - testcases)); + pass++; + } else { + msg_info("FAIL test %ld", (long) (tp - testcases)); + fail++; + } + if (fp) + vstream_fclose(fp); + } + if (act_err) + vstring_free(act_err); + vstring_free(act_cont); + msg_info("PASS=%d FAIL=%d", pass, fail); + return (fail > 0); +} + +#endif /* TEST */ diff --git a/external/ibm-public/postfix/dist/src/util/dict_stream.ref b/external/ibm-public/postfix/dist/src/util/dict_stream.ref new file mode 100644 index 00000000000..87c30e59b44 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/dict_stream.ref @@ -0,0 +1,13 @@ +unknown: RUN test case 0 normal +unknown: PASS test 0 +unknown: RUN test case 1 trims leading/trailing wsp around rule-text +unknown: PASS test 1 +unknown: RUN test case 2 trims leading/trailing comma-wsp around rule-spec +unknown: PASS test 2 +unknown: RUN test case 3 empty inline-file +unknown: PASS test 3 +unknown: RUN test case 4 propagates extpar error for inline-file +unknown: PASS test 4 +unknown: RUN test case 5 propagates extpar error for rule-spec +unknown: PASS test 5 +unknown: PASS=6 FAIL=0 diff --git a/external/ibm-public/postfix/dist/src/util/dup2_pass_on_exec.c b/external/ibm-public/postfix/dist/src/util/dup2_pass_on_exec.c index 366ce954b81..9da520e3d7f 100644 --- a/external/ibm-public/postfix/dist/src/util/dup2_pass_on_exec.c +++ b/external/ibm-public/postfix/dist/src/util/dup2_pass_on_exec.c @@ -1,10 +1,10 @@ -/* $NetBSD: dup2_pass_on_exec.c,v 1.1.1.1 2009/06/23 10:08:59 tron Exp $ */ +/* $NetBSD: dup2_pass_on_exec.c,v 1.1.1.2 2022/10/08 16:09:11 christos Exp $ */ /*++ /* NAME /* dup2_pass_on_exec 1 /* SUMMARY -/* dup2 close-on-exec behaviour test program +/* dup2 close-on-exec behavior test program /* SYNOPSIS /* dup2_pass_on_exec /* DESCRIPTION diff --git a/external/ibm-public/postfix/dist/src/util/find_inet.ref b/external/ibm-public/postfix/dist/src/util/find_inet.ref new file mode 100644 index 00000000000..a6f9cac280e --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/find_inet.ref @@ -0,0 +1,5 @@ +find_inet: good-symbolic: PASS +find_inet: good-numeric: PASS +find_inet: bad-symbolic: PASS +find_inet: bad-numeric: PASS +find_inet: PASS=4 FAIL=0 diff --git a/external/ibm-public/postfix/dist/src/util/gccw.c b/external/ibm-public/postfix/dist/src/util/gccw.c index 073f388a244..3663f1f89c4 100644 --- a/external/ibm-public/postfix/dist/src/util/gccw.c +++ b/external/ibm-public/postfix/dist/src/util/gccw.c @@ -1,7 +1,7 @@ -/* $NetBSD: gccw.c,v 1.1.1.1 2009/06/23 10:08:59 tron Exp $ */ +/* $NetBSD: gccw.c,v 1.1.1.2 2022/10/08 16:09:11 christos Exp $ */ /* - * This is is a regression test for all the things that gcc is meant to warn + * This is a regression test for all the things that gcc is meant to warn * about. * * gcc version 3 breaks several tests: diff --git a/external/ibm-public/postfix/dist/src/util/hash_fnv.c b/external/ibm-public/postfix/dist/src/util/hash_fnv.c new file mode 100644 index 00000000000..a387b99e38d --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/hash_fnv.c @@ -0,0 +1,109 @@ +/* $NetBSD: hash_fnv.c,v 1.1.1.1 2022/10/08 16:09:11 christos Exp $ */ + +/*++ +/* NAME +/* hash_fnv 3 +/* SUMMARY +/* Fowler/Noll/Vo hash function +/* SYNOPSIS +/* #include <hash_fnv.h> +/* +/* HASH_FNV_T hash_fnv( +/* const void *src, +/* size_t len) +/* DESCRIPTION +/* hash_fnv() implements a modified FNV type 1a hash function. +/* +/* To thwart collision attacks, the hash function is seeded +/* once from /dev/urandom, and if that is unavailable, from +/* wallclock time, monotonic system clocks, and the process +/* ID. To disable seeding (typically, for regression tests), +/* specify the NORANDOMIZE environment variable; the value +/* does not matter. +/* +/* This function implements a workaround for a "sticky state" +/* problem with FNV hash functions: when an input produces a +/* zero intermediate hash state, and the next input byte is +/* zero, then the operations "hash ^= 0" and "hash *= FNV_prime" +/* would not change the hash value. To avoid this, hash_fnv() +/* adds 1 to each input byte. Compile with -DSTRICT_FNV1A to +/* get the standard behavior. +/* +/* The default HASH_FNV_T result type is uint64_t. When compiled +/* with -DUSE_FNV_32BIT, the result type is uint32_t. On ancient +/* systems without <stdint.h>, define HASH_FNV_T on the compiler +/* command line as an unsigned 32-bit or 64-bit integer type, +/* and specify -DUSE_FNV_32BIT when HASH_FNV_T is a 32-bit type. +/* SEE ALSO +/* http://www.isthe.com/chongo/tech/comp/fnv/index.html +/* https://softwareengineering.stackexchange.com/questions/49550/ +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library + */ +#include <sys_defs.h> +#include <stdlib.h> +#include <unistd.h> + + /* + * Utility library. + */ +#include <msg.h> +#include <ldseed.h> +#include <hash_fnv.h> + + /* + * Application-specific. + */ +#ifdef USE_FNV_32BIT +#define FNV_prime 0x01000193UL +#define FNV_offset_basis 0x811c9dc5UL +#else +#define FNV_prime 0x00000100000001B3ULL +#define FNV_offset_basis 0xcbf29ce484222325ULL +#endif + +/* hash_fnv - modified FNV 1a hash */ + +HASH_FNV_T hash_fnv(const void *src, size_t len) +{ + static HASH_FNV_T basis = FNV_offset_basis; + static int randomize = 1; + HASH_FNV_T hash; + + /* + * Initialize. + */ + if (randomize) { + if (!getenv("NORANDOMIZE")) { + HASH_FNV_T seed; + + ldseed(&seed, sizeof(seed)); + basis ^= seed; + } + randomize = 0; + } + +#ifdef STRICT_FNV1A +#define FNV_NEXT_BYTE(s) ((HASH_FNV_T) * (const unsigned char *) s++) +#else +#define FNV_NEXT_BYTE(s) (1 + (HASH_FNV_T) * (const unsigned char *) s++) +#endif + + hash = basis; + while (len-- > 0) { + hash ^= FNV_NEXT_BYTE(src); + hash *= FNV_prime; + } + return (hash); +} diff --git a/external/ibm-public/postfix/dist/src/util/hash_fnv.h b/external/ibm-public/postfix/dist/src/util/hash_fnv.h new file mode 100644 index 00000000000..4266594a6d7 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/hash_fnv.h @@ -0,0 +1,41 @@ +/* $NetBSD: hash_fnv.h,v 1.1.1.1 2022/10/08 16:09:12 christos Exp $ */ + +#ifndef _HASH_FNV_H_INCLUDED_ +#define _HASH_FNV_H_INCLUDED_ + +/*++ +/* NAME +/* hash_fnv 3h +/* SUMMARY +/* Fowler/Noll/Vo hash function +/* SYNOPSIS +/* #include <hash_fnv.h> +/* DESCRIPTION +/* .nf + + /* + * External interface. + */ +#ifndef HASH_FNV_T +#include <stdint.h> +#ifdef USE_FNV_32BIT +#define HASH_FNV_T uint32_t +#else /* USE_FNV_32BIT */ +#define HASH_FNV_T uint64_t +#endif /* USE_FNV_32BIT */ +#endif /* HASH_FNV_T */ + +extern HASH_FNV_T hash_fnv(const void *, size_t); + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#endif diff --git a/external/ibm-public/postfix/dist/src/util/inet_addr_list.in b/external/ibm-public/postfix/dist/src/util/inet_addr_list.in index 742281fae14..5c72a1bc2a4 100644 --- a/external/ibm-public/postfix/dist/src/util/inet_addr_list.in +++ b/external/ibm-public/postfix/dist/src/util/inet_addr_list.in @@ -1,9 +1,9 @@ -168.100.189.2 -168.100.189.2 -168.100.189.1 -168.100.189.3 -168.100.189.3 -168.100.189.3 -168.100.189.4 -168.100.189.1 -168.100.189.4 +168.100.3.2 +168.100.3.2 +168.100.3.1 +168.100.3.3 +168.100.3.3 +168.100.3.3 +168.100.3.4 +168.100.3.1 +168.100.3.4 diff --git a/external/ibm-public/postfix/dist/src/util/inet_addr_list.ref b/external/ibm-public/postfix/dist/src/util/inet_addr_list.ref index 0a8a56e1ad9..9fbf48e399c 100644 --- a/external/ibm-public/postfix/dist/src/util/inet_addr_list.ref +++ b/external/ibm-public/postfix/dist/src/util/inet_addr_list.ref @@ -1,15 +1,15 @@ unknown: list before sort/uniq -unknown: 168.100.189.2 -unknown: 168.100.189.2 -unknown: 168.100.189.1 -unknown: 168.100.189.3 -unknown: 168.100.189.3 -unknown: 168.100.189.3 -unknown: 168.100.189.4 -unknown: 168.100.189.1 -unknown: 168.100.189.4 +unknown: 168.100.3.2 +unknown: 168.100.3.2 +unknown: 168.100.3.1 +unknown: 168.100.3.3 +unknown: 168.100.3.3 +unknown: 168.100.3.3 +unknown: 168.100.3.4 +unknown: 168.100.3.1 +unknown: 168.100.3.4 unknown: list after sort/uniq -unknown: 168.100.189.1 -unknown: 168.100.189.2 -unknown: 168.100.189.3 -unknown: 168.100.189.4 +unknown: 168.100.3.1 +unknown: 168.100.3.2 +unknown: 168.100.3.3 +unknown: 168.100.3.4 diff --git a/external/ibm-public/postfix/dist/src/util/inet_connect.c b/external/ibm-public/postfix/dist/src/util/inet_connect.c index ffa031c4aee..399e9357a15 100644 --- a/external/ibm-public/postfix/dist/src/util/inet_connect.c +++ b/external/ibm-public/postfix/dist/src/util/inet_connect.c @@ -1,4 +1,4 @@ -/* $NetBSD: inet_connect.c,v 1.1.1.1 2009/06/23 10:09:00 tron Exp $ */ +/* $NetBSD: inet_connect.c,v 1.1.1.2 2022/10/08 16:09:11 christos Exp $ */ /*++ /* NAME @@ -47,6 +47,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System interfaces. */ @@ -87,7 +92,7 @@ int inet_connect(const char *addr, int block_mode, int timeout) int aierr; int sock; MAI_HOSTADDR_STR hostaddr; - INET_PROTO_INFO *proto_info; + const INET_PROTO_INFO *proto_info; int found; /* @@ -98,10 +103,13 @@ int inet_connect(const char *addr, int block_mode, int timeout) if ((parse_err = host_port(buf, &host, "localhost", &port, (char *) 0)) != 0) msg_fatal("%s: %s", addr, parse_err); if ((aierr = hostname_to_sockaddr(host, port, SOCK_STREAM, &res0)) != 0) - msg_fatal("host/service %s/%s not found: %s", - host, port, MAI_STRERROR(aierr)); + msg_warn("host or service %s not found: %s", + addr, MAI_STRERROR(aierr)); myfree(buf); - + if (aierr) { + errno = EADDRNOTAVAIL; /* for up-stream "%m" */ + return (-1); + } proto_info = inet_proto_info(); for (sock = -1, found = 0, res = res0; res != 0; res = res->ai_next) { diff --git a/external/ibm-public/postfix/dist/src/util/inet_proto.h b/external/ibm-public/postfix/dist/src/util/inet_proto.h index 7482ed571c6..db21642e99d 100644 --- a/external/ibm-public/postfix/dist/src/util/inet_proto.h +++ b/external/ibm-public/postfix/dist/src/util/inet_proto.h @@ -1,4 +1,4 @@ -/* $NetBSD: inet_proto.h,v 1.1.1.1 2009/06/23 10:09:00 tron Exp $ */ +/* $NetBSD: inet_proto.h,v 1.1.1.2 2022/10/08 16:09:11 christos Exp $ */ #ifndef _INET_PROTO_INFO_H_INCLUDED_ #define _INET_PROTO_INFO_H_INCLUDED_ @@ -29,10 +29,10 @@ typedef struct { * of a global variable. */ #define inet_proto_info() \ - (inet_proto_table ? inet_proto_table : \ + (inet_proto_table ? (const INET_PROTO_INFO*) inet_proto_table : \ inet_proto_init("default protocol setting", DEF_INET_PROTOCOLS)) -extern INET_PROTO_INFO *inet_proto_init(const char *, const char *); +extern const INET_PROTO_INFO *inet_proto_init(const char *, const char *); extern INET_PROTO_INFO *inet_proto_table; #define INET_PROTO_NAME_IPV6 "ipv6" @@ -48,6 +48,11 @@ extern INET_PROTO_INFO *inet_proto_table; /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/external/ibm-public/postfix/dist/src/util/known_tcp_ports.c b/external/ibm-public/postfix/dist/src/util/known_tcp_ports.c new file mode 100644 index 00000000000..b0f56c33c13 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/known_tcp_ports.c @@ -0,0 +1,255 @@ +/* $NetBSD: known_tcp_ports.c,v 1.1.1.1 2022/10/08 16:09:12 christos Exp $ */ + +/*++ +/* NAME +/* known_tcp_ports 3 +/* SUMMARY +/* reduce dependency on the services(5) database +/* SYNOPSIS +/* #include <known_tcp_ports.h> +/* +/* const char *add_known_tcp_port( +/* const char *name) +/* const char *port) +/* +/* const char *filter_known_tcp_port( +/* const char *name_or_port) +/* +/* void clear_known_tcp_ports(void) +/* AUXILIARY FUNCTIONS +/* char *export_known_tcp_ports( +/* VSTRING *result) +/* DESCRIPTION +/* This module reduces dependency on the services(5) database. +/* +/* add_known_tcp_port() associates a symbolic name with a numerical +/* port. The function returns a pointer to error text if the +/* arguments are malformed or if the symbolic name already has +/* an association. +/* +/* filter_known_tcp_port() returns the argument if it does not +/* specify a symbolic name, or if the argument specifies a symbolic +/* name that is not associated with a numerical port. Otherwise, +/* it returns the associated numerical port. +/* +/* clear_known_tcp_ports() destroys all name-number associations. +/* string. +/* +/* export_known_tcp_ports() overwrites a VSTRING with all known +/* name=port associations, sorted by service name, and separated +/* by whitespace. The result is pointer to the VSTRING payload. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library + */ +#include <sys_defs.h> +#include <stdlib.h> +#include <string.h> + + /* + * Utility library + */ +#include <htable.h> +#include <mymalloc.h> +#include <stringops.h> + + /* + * Application-specific. + */ +#include <known_tcp_ports.h> + +#define STR(x) vstring_str(x) + +static HTABLE *known_tcp_ports; + +/* add_known_tcp_port - associate symbolic name with numerical port */ + +const char *add_known_tcp_port(const char *name, const char *port) +{ + if (alldig(name)) + return ("numerical service name"); + if (!alldig(port)) + return ("non-numerical service port"); + if (known_tcp_ports == 0) + known_tcp_ports = htable_create(10); + if (htable_locate(known_tcp_ports, name) != 0) + return ("duplicate service name"); + (void) htable_enter(known_tcp_ports, name, mystrdup(port)); + return (0); +} + +/* filter_known_tcp_port - replace argument if associated with known port */ + +const char *filter_known_tcp_port(const char *name_or_port) +{ + HTABLE_INFO *ht; + + if (name_or_port == 0 || known_tcp_ports == 0 || alldig(name_or_port)) { + return (name_or_port); + } else if ((ht = htable_locate(known_tcp_ports, name_or_port)) != 0) { + return (ht->value); + } else { + return (name_or_port); + } +} + +/* clear_known_tcp_ports - destroy all name-port associations */ + +void clear_known_tcp_ports(void) +{ + htable_free(known_tcp_ports, myfree); + known_tcp_ports = 0; +} + +/* compare_ht_keys - compare table keys */ + +static int compare_ht_keys(const void *a, const void *b) +{ + HTABLE_INFO **ap = (HTABLE_INFO **) a; + HTABLE_INFO **bp = (HTABLE_INFO **) b; + + return (strcmp((const char *) ap[0]->key, (const char *) bp[0]->key)); +} + +/* export_known_tcp_ports - sorted dump */ + +char *export_known_tcp_ports(VSTRING *out) +{ + HTABLE_INFO **list; + HTABLE_INFO **ht; + + VSTRING_RESET(out); + if (known_tcp_ports) { + list = htable_list(known_tcp_ports); + qsort((void *) list, known_tcp_ports->used, sizeof(*list), + compare_ht_keys); + for (ht = list; *ht; ht++) + vstring_sprintf_append(out, "%s%s=%s", ht > list ? " " : "", + ht[0]->key, (const char *) ht[0]->value); + myfree((void *) list); + } + VSTRING_TERMINATE(out); + return (STR(out)); +} + +#ifdef TEST + +#include <msg.h> + +struct association { + const char *lhs; /* service name */ + const char *rhs; /* service port */ +}; + +struct probe { + const char *query; /* query */ + const char *exp_reply; /* expected reply */ +}; + +struct test_case { + const char *label; /* identifies test case */ + struct association associations[10]; + const char *exp_err; /* expected error */ + const char *exp_export; /* expected export output */ + struct probe probes[10]; +}; + +struct test_case test_cases[] = { + {"good", + /* association */ {{"smtp", "25"}, {"lmtp", "24"}, 0}, + /* error */ 0, + /* export */ "lmtp=24 smtp=25", + /* probe */ {{"smtp", "25"}, {"1", "1"}, {"x", "x"}, {"lmtp", "24"}, 0} + }, + {"duplicate lhs", + /* association */ {{"smtp", "25"}, {"smtp", "100"}, 0}, + /* error */ "duplicate service name" + }, + {"numerical lhs", + /* association */ {{"100", "100"}, 0}, + /* error */ "numerical service name" + }, + {"symbolic rhs", + /* association */ {{"smtp", "lmtp"}, 0}, + /* error */ "non-numerical service port" + }, + {"uninitialized", + /* association */ {0}, + /* error */ 0, + /* export */ "", + /* probe */ {{"smtp", "smtp"}, {"1", "1"}, {"x", "x"}, 0} + }, + 0, +}; + +int main(int argc, char **argv) +{ + VSTRING *export_buf; + struct test_case *tp; + struct association *ap; + struct probe *pp; + int pass = 0; + int fail = 0; + const char *err; + int test_failed; + const char *reply; + const char *export; + +#define STRING_OR_NULL(s) ((s) ? (s) : "(null)") + + export_buf = vstring_alloc(100); + for (tp = test_cases; tp->label != 0; tp++) { + test_failed = 0; + for (err = 0, ap = tp->associations; err == 0 && ap->lhs != 0; ap++) + err = add_known_tcp_port(ap->lhs, ap->rhs); + if (!err != !tp->exp_err) { + msg_warn("test case %s: got error: \"%s\", want: \"%s\"", + tp->label, STRING_OR_NULL(err), STRING_OR_NULL(tp->exp_err)); + test_failed = 1; + } else if (err != 0) { + if (strcmp(err, tp->exp_err) != 0) { + msg_warn("test case %s: got err: \"%s\", want: \"%s\"", + tp->label, err, tp->exp_err); + test_failed = 1; + } + } else { + export = export_known_tcp_ports(export_buf); + if (strcmp(export, tp->exp_export) != 0) { + msg_warn("test case %s: got export: \"%s\", want: \"%s\"", + tp->label, export, tp->exp_export); + test_failed = 1; + } + for (pp = tp->probes; test_failed == 0 && pp->query != 0; pp++) { + reply = filter_known_tcp_port(pp->query); + if (strcmp(reply, pp->exp_reply) != 0) { + msg_warn("test case %s: got reply: \"%s\", want: \"%s\"", + tp->label, reply, pp->exp_reply); + test_failed = 1; + } + } + } + clear_known_tcp_ports(); + if (test_failed) { + msg_info("%s: FAIL", tp->label); + fail++; + } else { + msg_info("%s: PASS", tp->label); + pass++; + } + } + msg_info("PASS=%d FAIL=%d", pass, fail); + vstring_free(export_buf); + exit(fail != 0); +} + +#endif diff --git a/external/ibm-public/postfix/dist/src/util/known_tcp_ports.h b/external/ibm-public/postfix/dist/src/util/known_tcp_ports.h new file mode 100644 index 00000000000..50926f56706 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/known_tcp_ports.h @@ -0,0 +1,40 @@ +/* $NetBSD: known_tcp_ports.h,v 1.1.1.1 2022/10/08 16:09:12 christos Exp $ */ + +#ifndef _KNOWN_TCP_PORTS_H_INCLUDED_ +#define _KNOWN_TCP_PORTS_H_INCLUDED_ + +/*++ +/* NAME +/* known_tcp_port 3h +/* SUMMARY +/* reduce dependency on the services(5) database +/* SYNOPSIS +/* #include <known_tcp_ports.h> +/* DESCRIPTION +/* .nf + + /* + * Utility library. + */ +#include <vstring.h> + + /* + * External interface. + */ +extern const char *add_known_tcp_port(const char *name, const char *port); +extern const char *filter_known_tcp_port(const char *name_or_port); +extern void clear_known_tcp_ports(void); +extern char *export_known_tcp_ports(VSTRING *out); + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#endif diff --git a/external/ibm-public/postfix/dist/src/util/known_tcp_ports.ref b/external/ibm-public/postfix/dist/src/util/known_tcp_ports.ref new file mode 100644 index 00000000000..adcf1820854 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/known_tcp_ports.ref @@ -0,0 +1,6 @@ +unknown: good: PASS +unknown: duplicate lhs: PASS +unknown: numerical lhs: PASS +unknown: symbolic rhs: PASS +unknown: uninitialized: PASS +unknown: PASS=5 FAIL=0 diff --git a/external/ibm-public/postfix/dist/src/util/ldseed.c b/external/ibm-public/postfix/dist/src/util/ldseed.c new file mode 100644 index 00000000000..b287452b88f --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/ldseed.c @@ -0,0 +1,140 @@ +/* $NetBSD: ldseed.c,v 1.1.1.1 2022/10/08 16:09:12 christos Exp $ */ + +/*++ +/* NAME +/* ldseed 3 +/* SUMMARY +/* seed for non-cryptographic applications +/* SYNOPSIS +/* #include <ldseed.h> +/* +/* void ldseed( +/* void *dst, +/* size_t len) +/* DESCRIPTION +/* ldseed() preferably extracts pseudo-random bits from +/* /dev/urandom, a non-blocking device that is available on +/* modern systems. +/* +/* On systems where /dev/urandom is unavailable or does not +/* immediately return the requested amount of randomness, +/* ldseed() falls back to a combination of wallclock time, +/* the time since boot, and the process ID. +/* BUGS +/* With Linux "the O_NONBLOCK flag has no effect when opening +/* /dev/urandom", but reads "can incur an appreciable delay +/* when requesting large amounts of data". Apparently, "large" +/* means more than 256 bytes. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library + */ +#include <sys_defs.h> +#include <string.h> +#include <sys/time.h> +#include <time.h> +#include <stdlib.h> +#include <fcntl.h> +#include <unistd.h> +#include <limits.h> /* CHAR_BIT */ + + /* + * Utility library. + */ +#include <iostuff.h> +#include <msg.h> +#include <ldseed.h> + + /* + * Different systems have different names for non-wallclock time. + */ +#ifdef CLOCK_UPTIME +#define NON_WALLTIME_CLOCK CLOCK_UPTIME +#elif defined(CLOCK_BOOTTIME) +#define NON_WALLTIME_CLOCK CLOCK_BOOTTIME +#elif defined(CLOCK_MONOTONIC) +#define NON_WALLTIME_CLOCK CLOCK_MONOTONIC +#elif defined(CLOCK_HIGHRES) +#define NON_WALLTIME_CLOCK CLOCK_HIGHRES +#endif + +/* ldseed - best-effort, low-dependency seed */ + +void ldseed(void *dst, size_t len) +{ + int count; + int fd; + int n; + time_t fallback = 0; + + /* + * Medium-quality seed. + */ + if ((fd = open("/dev/urandom", O_RDONLY)) > 0) { + non_blocking(fd, NON_BLOCKING); + count = read(fd, dst, len); + (void) close(fd); + if (count == len) + return; + } + + /* + * Low-quality seed. Based on 1) the time since boot (good when an + * attacker knows the program start time but not the system boot time), + * and 2) absolute time (good when an attacker does not know the program + * start time). Assumes a system with better than microsecond resolution, + * and a network stack that does not leak the time since boot, for + * example, through TCP or ICMP timestamps. With those caveats, this seed + * is good for 20-30 bits of randomness. + */ +#ifdef NON_WALLTIME_CLOCK + { + struct timespec ts; + + if (clock_gettime(NON_WALLTIME_CLOCK, &ts) != 0) + msg_fatal("clock_gettime() failed: %m"); + fallback += ts.tv_sec ^ ts.tv_nsec; + } +#elif defined(USE_GETHRTIME) + fallback += gethrtime(); +#endif + +#ifdef CLOCK_REALTIME + { + struct timespec ts; + + if (clock_gettime(CLOCK_REALTIME, &ts) != 0) + msg_fatal("clock_gettime() failed: %m"); + fallback += ts.tv_sec ^ ts.tv_nsec; + } +#else + { + struct timeval tv; + + if (GETTIMEOFDAY(&tv) != 0) + msg_fatal("gettimeofday() failed: %m"); + fallback += tv.tv_sec + tv.tv_usec; + } +#endif + fallback += getpid(); + + /* + * Copy the least significant bytes first, because those are the most + * volatile. + */ + for (n = 0; n < sizeof(fallback) && n < len; n++) { + *(char *) dst++ ^= (fallback & 0xff); + fallback >>= CHAR_BIT; + } + return; +} diff --git a/external/ibm-public/postfix/dist/src/util/ldseed.h b/external/ibm-public/postfix/dist/src/util/ldseed.h new file mode 100644 index 00000000000..51221fd003c --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/ldseed.h @@ -0,0 +1,32 @@ +/* $NetBSD: ldseed.h,v 1.1.1.1 2022/10/08 16:09:11 christos Exp $ */ + +#ifndef _LDSEED_H_INCLUDED_ +#define _LDSEED_H_INCLUDED_ + +/*++ +/* NAME +/* ldseed 3h +/* SUMMARY +/* seed for non-cryptographic applications +/* SYNOPSIS +/* #include <ldseed.h> +/* DESCRIPTION +/* .nf + + /* + * External interface. + */ +extern void ldseed(void *, size_t); + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + +#endif diff --git a/external/ibm-public/postfix/dist/src/util/mac_expand.in b/external/ibm-public/postfix/dist/src/util/mac_expand.in index dbc583c0f80..1d619065410 100644 --- a/external/ibm-public/postfix/dist/src/util/mac_expand.in +++ b/external/ibm-public/postfix/dist/src/util/mac_expand.in @@ -85,3 +85,21 @@ ${{a} < {b}} ${{a} <= {b}} ${{a} >= {b}} ${{a} > {b}} + +name1 = foo + +${{$name1} >=blah {bar}} +${{aaa} == {bbb}} +${{aaa} ==length {bbb}} +${{aaa} <=length {bbb}} +${{aaa} >=length {bbb}} +${{aaa} != {bbb}} +${{aaa} !=length {bbb}} +${{aaa} > {bb}} +${{aaa} >length {bb}} +${{aaa} >= {bb}} +${{aaa} >=length {bb}} +${{aaa} < {bb}} +${{aaa} <length {bb}} +${{aaa} <= {bb}} +${{aaa} <=length {bb}} diff --git a/external/ibm-public/postfix/dist/src/util/mac_expand.ref b/external/ibm-public/postfix/dist/src/util/mac_expand.ref index 9ffcb410fa4..854c4f91f35 100644 --- a/external/ibm-public/postfix/dist/src/util/mac_expand.ref +++ b/external/ibm-public/postfix/dist/src/util/mac_expand.ref @@ -185,3 +185,38 @@ stat=0 result=true stat=0 result= << ${{a} > {b}} stat=0 result= +<< + +<< name1 = foo +<< +<< ${{$name1} >=blah {bar}} +unknown: warning: bad operator suffix at: "...>=>>>blah" +stat=1 result= +<< ${{aaa} == {bbb}} +stat=0 result= +<< ${{aaa} ==length {bbb}} +stat=0 result=true +<< ${{aaa} <=length {bbb}} +stat=0 result=true +<< ${{aaa} >=length {bbb}} +stat=0 result=true +<< ${{aaa} != {bbb}} +stat=0 result=true +<< ${{aaa} !=length {bbb}} +stat=0 result= +<< ${{aaa} > {bb}} +stat=0 result= +<< ${{aaa} >length {bb}} +stat=0 result=true +<< ${{aaa} >= {bb}} +stat=0 result= +<< ${{aaa} >=length {bb}} +stat=0 result=true +<< ${{aaa} < {bb}} +stat=0 result=true +<< ${{aaa} <length {bb}} +stat=0 result= +<< ${{aaa} <= {bb}} +stat=0 result=true +<< ${{aaa} <=length {bb}} +stat=0 result= diff --git a/external/ibm-public/postfix/dist/src/util/myaddrinfo.ref b/external/ibm-public/postfix/dist/src/util/myaddrinfo.ref index 360228a10b6..7dccdb0bf77 100644 --- a/external/ibm-public/postfix/dist/src/util/myaddrinfo.ref +++ b/external/ibm-public/postfix/dist/src/util/myaddrinfo.ref @@ -1,8 +1,8 @@ ./myaddrinfo: === hostname belly.porcupine.org === -./myaddrinfo: belly.porcupine.org -> family=2 sock=1 proto=6 168.100.189.6 -./myaddrinfo: 168.100.189.6 -> belly.porcupine.org +./myaddrinfo: belly.porcupine.org -> family=2 sock=1 proto=6 168.100.3.6 +./myaddrinfo: 168.100.3.6 -> belly.porcupine.org ./myaddrinfo: belly.porcupine.org -> family=28 sock=1 proto=6 2604:8d00:189::6 ./myaddrinfo: 2604:8d00:189::6 -> belly.porcupine.org -./myaddrinfo: === host address 168.100.189.2 === -./myaddrinfo: 168.100.189.2 -> family=2 sock=1 proto=6 168.100.189.2 -./myaddrinfo: 168.100.189.2 -> spike.porcupine.org +./myaddrinfo: === host address 168.100.3.2 === +./myaddrinfo: 168.100.3.2 -> family=2 sock=1 proto=6 168.100.3.2 +./myaddrinfo: 168.100.3.2 -> spike.porcupine.org diff --git a/external/ibm-public/postfix/dist/src/util/myaddrinfo4.ref b/external/ibm-public/postfix/dist/src/util/myaddrinfo4.ref index 37d07c2f6ce..33c12842257 100644 --- a/external/ibm-public/postfix/dist/src/util/myaddrinfo4.ref +++ b/external/ibm-public/postfix/dist/src/util/myaddrinfo4.ref @@ -1,6 +1,6 @@ ./myaddrinfo4: === hostname belly.porcupine.org === -./myaddrinfo4: belly.porcupine.org -> family=2 sock=1 proto=6 168.100.189.6 -./myaddrinfo4: 168.100.189.6 -> belly.porcupine.org -./myaddrinfo4: === host address 168.100.189.2 === -./myaddrinfo4: 168.100.189.2 -> family=2 sock=1 proto=6 168.100.189.2 -./myaddrinfo4: 168.100.189.2 -> spike.porcupine.org +./myaddrinfo4: belly.porcupine.org -> family=2 sock=1 proto=6 168.100.3.6 +./myaddrinfo4: 168.100.3.6 -> belly.porcupine.org +./myaddrinfo4: === host address 168.100.3.2 === +./myaddrinfo4: 168.100.3.2 -> family=2 sock=1 proto=6 168.100.3.2 +./myaddrinfo4: 168.100.3.2 -> spike.porcupine.org diff --git a/external/ibm-public/postfix/dist/src/util/mystrtok.ref b/external/ibm-public/postfix/dist/src/util/mystrtok.ref new file mode 100644 index 00000000000..4f920f994d6 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/mystrtok.ref @@ -0,0 +1,30 @@ +unknown: RUN test case 0 mystrtok >< +unknown: PASS test 0 +unknown: RUN test case 1 mystrtok > foo < +unknown: PASS test 1 +unknown: RUN test case 2 mystrtok > foo bar < +unknown: PASS test 2 +unknown: RUN test case 3 mystrtokq >< +unknown: PASS test 3 +unknown: RUN test case 4 mystrtokq >foo bar< +unknown: PASS test 4 +unknown: RUN test case 5 mystrtokq >{ bar } < +unknown: PASS test 5 +unknown: RUN test case 6 mystrtokq >foo { bar } baz< +unknown: PASS test 6 +unknown: RUN test case 7 mystrtokq >foo{ bar } baz< +unknown: PASS test 7 +unknown: RUN test case 8 mystrtokq >foo { bar }baz< +unknown: PASS test 8 +unknown: RUN test case 9 mystrtokdq >< +unknown: PASS test 9 +unknown: RUN test case 10 mystrtokdq > foo < +unknown: PASS test 10 +unknown: RUN test case 11 mystrtokdq > foo bar < +unknown: PASS test 11 +unknown: RUN test case 12 mystrtokdq > foo\ bar < +unknown: PASS test 12 +unknown: RUN test case 13 mystrtokdq > foo \" bar< +unknown: PASS test 13 +unknown: RUN test case 14 mystrtokdq > foo " bar baz" < +unknown: PASS test 14 diff --git a/external/ibm-public/postfix/dist/src/util/sane_link.c b/external/ibm-public/postfix/dist/src/util/sane_link.c index 80c0f7e2025..255a27709b7 100644 --- a/external/ibm-public/postfix/dist/src/util/sane_link.c +++ b/external/ibm-public/postfix/dist/src/util/sane_link.c @@ -1,4 +1,4 @@ -/* $NetBSD: sane_link.c,v 1.1.1.2 2013/01/02 18:59:14 tron Exp $ */ +/* $NetBSD: sane_link.c,v 1.1.1.3 2022/10/08 16:09:12 christos Exp $ */ /*++ /* NAME @@ -54,7 +54,7 @@ int sane_link(const char *from, const char *to) return (0); /* - * Woops. Save errno, and see if the error is an NFS artefact. If it is, + * Woops. Save errno, and see if the error is an NFS artifact. If it is, * pretend the error never happened. */ saved_errno = errno; diff --git a/external/ibm-public/postfix/dist/src/util/sane_rename.c b/external/ibm-public/postfix/dist/src/util/sane_rename.c index 14446c7ef57..cd7ed069832 100644 --- a/external/ibm-public/postfix/dist/src/util/sane_rename.c +++ b/external/ibm-public/postfix/dist/src/util/sane_rename.c @@ -1,4 +1,4 @@ -/* $NetBSD: sane_rename.c,v 1.1.1.2 2013/01/02 18:59:14 tron Exp $ */ +/* $NetBSD: sane_rename.c,v 1.1.1.3 2022/10/08 16:09:12 christos Exp $ */ /*++ /* NAME @@ -53,7 +53,7 @@ int sane_rename(const char *from, const char *to) return (0); /* - * Woops. Save errno, and see if the error is an NFS artefact. If it is, + * Woops. Save errno, and see if the error is an NFS artifact. If it is, * pretend the error never happened. */ saved_errno = errno; diff --git a/external/ibm-public/postfix/dist/src/util/sane_strtol.c b/external/ibm-public/postfix/dist/src/util/sane_strtol.c new file mode 100644 index 00000000000..f755b8d5575 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/sane_strtol.c @@ -0,0 +1,61 @@ +/* $NetBSD: sane_strtol.c,v 1.1.1.1 2022/10/08 16:09:12 christos Exp $ */ + +/*++ +/* NAME +/* sane_strtol 3 +/* SUMMARY +/* strtol() with mandatory errno reset +/* SYNOPSIS +/* #include <sane_strtol.h> +/* +/* long sane_strtol( +/* const char *start, +/* char **restrict end, +/* int base) +/* +/* unsigned long sane_strtoul( +/* const char *start, +/* char **restrict end, +/* int base) +/* DESCRIPTION +/* These functions are wrappers around the strtol() and strtoul() +/* standard library functions that reset errno first, so that a +/* prior ERANGE error won't cause false errors. +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ + + /* + * System library. + */ +#include <sys_defs.h> +#include <stdlib.h> +#include <errno.h> + + /* + * Utility library. + */ +#include <sane_strtol.h> + +/* sane_strtol - strtol() with mandatory initialization */ + +long sane_strtol(const char *start, char **end, int base) +{ + errno = 0; + return (strtol(start, end, base)); +} + +/* sane_strtoul - strtoul() with mandatory initialization */ + +unsigned long sane_strtoul(const char *start, char **end, int base) +{ + errno = 0; + return (strtoul(start, end, base)); +} diff --git a/external/ibm-public/postfix/dist/src/util/sane_strtol.h b/external/ibm-public/postfix/dist/src/util/sane_strtol.h new file mode 100644 index 00000000000..31e760c0030 --- /dev/null +++ b/external/ibm-public/postfix/dist/src/util/sane_strtol.h @@ -0,0 +1,28 @@ +/* $NetBSD: sane_strtol.h,v 1.1.1.1 2022/10/08 16:09:12 christos Exp $ */ + +/*++ +/* NAME +/* sane_strtol 3h +/* SUMMARY +/* strtol() with mandatory errno reset +/* SYNOPSIS +/* #include <sane_strtol.h> +/* DESCRIPTION +/* .nf + + /* + * External API. + */ +extern long sane_strtol(const char *start, char **end, int); +extern unsigned long sane_strtoul(const char *start, char **end, int); + +/* LICENSE +/* .ad +/* .fi +/* The Secure Mailer license must be distributed with this software. +/* AUTHOR(S) +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA +/*--*/ diff --git a/external/ibm-public/postfix/dist/src/util/unix_pass_fd_fix.c b/external/ibm-public/postfix/dist/src/util/unix_pass_fd_fix.c index 2058c7203d5..2a54ec952e3 100644 --- a/external/ibm-public/postfix/dist/src/util/unix_pass_fd_fix.c +++ b/external/ibm-public/postfix/dist/src/util/unix_pass_fd_fix.c @@ -1,4 +1,4 @@ -/* $NetBSD: unix_pass_fd_fix.c,v 1.1.1.1 2010/06/17 18:07:15 tron Exp $ */ +/* $NetBSD: unix_pass_fd_fix.c,v 1.1.1.2 2022/10/08 16:09:12 christos Exp $ */ /*++ /* NAME @@ -15,7 +15,7 @@ /* for sending or receiving file descriptors over UNIX-domain /* sockets. /* -/* set_unix_pass_fd_fix() takes a list of workarouds in external +/* set_unix_pass_fd_fix() takes a list of workarounds in external /* form, and stores their internal representation. The result /* is used by unix_send_fd() and unix_recv_fd(). /* diff --git a/external/ibm-public/postfix/dist/src/util/vstream_test.ref b/external/ibm-public/postfix/dist/src/util/vstream_test.ref index cf03053aee7..eaa9952ba9d 100644 --- a/external/ibm-public/postfix/dist/src/util/vstream_test.ref +++ b/external/ibm-public/postfix/dist/src/util/vstream_test.ref @@ -1,8 +1,41 @@ +buffer size test: copy text with 1 buffer size, ignore requests to shrink abcdef +actual read/write buffer sizes: 1/1 + +buffer size test: copy text with 2 buffer size, ignore requests to shrink ghijkl +actual read/write buffer sizes: 2/2 + +buffer size test: copy text with 1 buffer size, ignore requests to shrink mnopqr +actual read/write buffer sizes: 2/2 + +formatting test: print a number 1234567890 -final memory stream write offset: 12 -buffer size: 12, content: hallo world -reading memory stream: hallo world -final memory stream read offset: 12 + +memory stream test prep: prefill the VSTRING +VSTRING content length: 8/8, content: 01234567 + +memory stream test: open the VSTRING for writing, overwrite, close +initial memory VSTREAM write offset: 0/8 +final memory VSTREAM write offset: 5/8 +VSTRING content length: 5/8, content: hallo + +memory stream test: open the VSTRING for append, write multiple, then overwrite 1 +initial memory VSTREAM write offset: 5/8 +final memory VSTREAM write offset: 11/16 +VSTRING content length: 11/16, content: hallo world + +replace second character and close +VSTRING content length: 11/16, content: hello world + +memory stream test: open VSTRING for reading, then read +initial memory VSTREAM read offset: 0/11 +reading memory VSTREAM: hello world +final memory VSTREAM read offset: 11/11 +seeking to offset 12 should work: PASS +VSTREAM_GETC should return VSTREAM_EOF +PASS +final memory VSTREAM read offset: 12/11 +VSTRING content length: 11/16, content: hello world + |
