summaryrefslogtreecommitdiff
path: root/external/ibm-public
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2020-03-18 18:59:26 +0000
committerchristos <christos@NetBSD.org>2020-03-18 18:59:26 +0000
commite09e275d5c939fe7af6818b3b9bc7362671d4791 (patch)
tree8174d79943e9abc3e10d9a4856eafcb349e487f8 /external/ibm-public
parent5b0bcf219d0405082c815de62998b3d1d4f74b83 (diff)
This is the Postfix 3.5 (stable) release.
The stable Postfix release is called postfix-3.5.x where 3=major release number, 5=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called postfix-3.6-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 3.3 or earlier, read RELEASE_NOTES-3.4 before proceeding. License change --------------- This software is distributed with a dual license: in addition to the historical IBM Public License 1.0, it is now also distributed with the more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. Major changes - multiple relayhost in SMTP ------------------------------------------ [Feature 20200111] the Postfix SMTP and LMTP client support a list of nexthop destinations separated by comma or whitespace. These destinations will be tried in the specified order. The list form can be specified in relayhost, transport_maps, default_transport, and sender_dependent_default_transport_maps. Examples: /etc/postfix/main.cf: relayhost = foo.example, bar.example default_transport = smtp:foo.example, bar.example. NOTE: this is an SMTP and LMTP client feature. It does not work for other Postfix delivery agents. Major changes - certificate access ---------------------------------- [Feature 20190517] Search order support for check_ccert_access. Search order support for other tables is in design (canonical_maps, virtual_alias_maps, transport_maps, etc.). The following check_ccert_access setting uses the built-in search order: it first looks up the client certificate fingerprint, then the client certificate public-key fingerprint, and it stops when a decision is made. /etc/postfix/main.cf: smtpd_mumble_restrictions = ... check_ccert_access hash:/etc/postfix/ccert-access ... The following setting, with explicit search order, produces the exact same result: /etc/postfix/main.cf: smtpd_mumble_restrictions = ... check_ccert_access { hash:/etc/postfix/ccert-access { search_order = cert_fingerprint, pubkey_fingerprint } } ... Support is planned for other certificate features. Major changes - dovecot usability --------------------------------- [Feature 20190615] The SMTP+LMTP delivery agent can now prepend Delivered-To, X-Original-To and Return-Path headers, just like the pipe(8) and local(8) delivery agents. This uses the "flags=DORX" command-line flags in master.cf. See the smtp(8) manpage for details. This obsoletes the "lmtp_assume_final = yes" setting, and replaces it with "flags=...X...", for consistency with the pipe(8) delivery agent. Major changes - forced expiration --------------------------------- [Feature 20200202] Support to force-expire email messages. This introduces new postsuper(1) command-line options to request expiration, and additional information in mailq(1) or postqueue(1) output. The forced-to-expire status is stored in a queue file attribute. An expired message is returned to the sender when the queue manager attempts to deliver that message (note that Postfix will never deliver messages in the hold queue). The postsuper(1) -e and -f options both set the forced-to-expire queue file attribute. The difference is that -f will also release a message if it is in the hold queue. With -e, such a message would not be returned to the sender until it is released with -f or -H. In the mailq(1) or postqueue(1) -p output, a forced-to-expire message is indicated with # after the queue file name. In postqueue(1) JSON output, there is a new per-message field "forced_expire" (with value true or false) that shows the forced-to-expire status. Major changes - haproxy2 protocol --------------------------------- [Feature 20200112] Support for the haproxy v2 protocol. The Postfix implementation supports TCP over IPv4 and IPv6, as well as non-proxied connections; the latter are typically used for heartbeat tests. The haproxy v2 protocol introduces no additional Postfix configuration. The Postfix smtpd(8) and postscreen(8) daemons accept both v1 and v2 protocol versions. Major changes - logging ----------------------- [Incompat 20191109] Postfix daemon processes now log the from= and to= addresses in external (quoted) form in non-debug logging (info, warning, etc.). This means that when an address localpart contains spaces or other special characters, the localpart will be quoted, for example: from=<"name with spaces"@example.com> Older Postfix versions would log the internal (unquoted) form: from=<name with spaces@example.com> The external and internal forms are identical for the vast majority of email addresses that contain no spaces or other special characters in the localpart. Specify "info_log_address_format = internal" for backwards compatibility. The logging in external form is consistent with the address form that Postfix 3.2 and later prefer for table lookups. It is therefore the more useful form for non-debug logging. Major changes - IP address normalization ---------------------------------------- [Incompat 20190427] Postfix now normalizes IP addresses received with XCLIENT, XFORWARD, or with the HaProxy protocol, for consistency with direct connections to Postfix. This may change the appearance of logging, and the way that check_client_access will match subnets of an IPv6 address. This is the Postfix 3.4 (stable) release. The stable Postfix release is called postfix-3.4.x where 3=major release number, 4=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called postfix-3.5-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 3.2 or earlier, read RELEASE_NOTES-3.3 before proceeding. License change --------------- This software is distributed with a dual license: in addition to the historical IBM Public License 1.0, it is now also distributed with the more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. Summary of changes ------------------ Incompatible changes, bdat support, containers, database support, logging, safety, tls connection pooling, tls support, usability, Incompatible changes -------------------- [Incompat 20180826] The Postfix SMTP server announces CHUNKING (BDAT command) by default. In the unlikely case that this breaks some important remote SMTP client, disable the feature as follows: /etc/postfix/main.cf: # The logging alternative: smtpd_discard_ehlo_keywords = chunking # The non-logging alternative: smtpd_discard_ehlo_keywords = chunking, silent_discard See BDAT_README for more. [Incompat 20190126] This introduces a new master.cf service 'postlog' with type 'unix-dgram' that is used by the new postlogd(8) daemon. Before backing out to an older Postfix version, edit the master.cf file and remove the postlog entry. [Incompat 20190106] Postfix 3.4 drops support for OpenSSL 1.0.1 (end-of-life was December 31, 2016) and all earlier releases. [Incompat 20180701] To avoid performance loss under load, the tlsproxy(8) daemon now requires a zero process limit in master.cf (this setting is provided with the default master.cf file). By default, a tlsproxy(8) process will retire after several hours. To set the tlsproxy process limit to zero: # postconf -F tlsproxy/unix/process_limit=0 # postfix reload Major changes - bdat support -------------------- [Feature 20180826] Postfix SMTP server support for RFC 3030 CHUNKING (the BDAT command) without BINARYMIME, in both smtpd(8) and postscreen(8). This has no effect on Milters, smtpd_mumble_restrictions, and smtpd_proxy_filter. See BDAT_README for more. Major changes - containers -------------------------- [Feature 20190126] Support for logging to file or stdout, instead of using syslog. - Logging to file solves a usability problem for MacOS, and eliminates multiple problems with systemd-based systems. - Logging to stdout is useful when Postfix runs in a container, as it eliminates a syslogd dependency. See MAILLOG_README for configuration examples and logfile rotation. [Feature 20180422] Better handling of undocumented(!) Linux behavior whether or not signals are delivered to a PID=1 process. Major changes - database support -------------------------------- [Feature 20181105] Support for (key, list of filenames) in map source text. - Currently, this feature is used only by tls_server_sni_maps. - When a map is created from source with "postmap -F maptype:mapname", the command processes each key as usual and processes each value as a list of filenames, concatenates the content of those files (with one newline character in-between files), and stores an entry with (key, base64-encoded result). - When a map is queried with "postmap -F -q ...", the command base64-decodes each value. It reports an error when a value is not in base64 form. This "postmap -F -q ..." behavior also works when querying the memory-resident map types cidr:, inline:, pcre:, randmap:, regexp:, and static:. Postfix reads the files specified as table values, stores base64-encoded content, and base64-decodes content upon table lookup. Internally, Postfix will turn on this behavior for lookups (not updates) when a map is opened with the DICT_FLAG_RHS_IS_FILE flag. Major changes - logging ----------------------- [Feature 20190126] Support for logging to file or stdout, instead of using syslog. - Logging to file solves a usability problem for MacOS, and eliminates multiple problems with systemd-based systems. - Logging to stdout is useful when Postfix runs in a container, as it eliminates a syslogd dependency. See MAILLOG_README for configuration examples and logfile rotation. Major changes - safety ---------------------- [Feature 20180623] Automatic retirement: dnsblog(8) and tlsproxy(8) process will now voluntarily retire after after max_idle*max_use, or some sane limit if either limit is disabled. Without this, a process could stay busy for days or more. Major changes - tls connection pooling -------------------------------------- [Feature 20180617] Postfix SMTP client support for multiple deliveries per TLS-encrypted connection. This is primarily to improve mail delivery performance for destinations that throttle clients when they don't combine deliveries. This feature is enabled with "smtp_tls_connection_reuse=yes" in main.cf, or with "tls_connection_reuse=yes" in smtp_tls_policy_maps. It supports all Postfix TLS security levels including dane and dane-only. The implementation of TLS connection reuse relies on the same scache(8) service as used for delivering plaintext SMTP mail, the same tlsproxy(8) daemon as used by the postscreen(8) service for inbound connections, and relies on the same hints from the qmgr(8) daemon. It reuses the configuration parameters described in CONNECTION_CACHE_README. The Postfix SMTP client now logs whether an SMTP-over-TLS connection is newly established ("TLS connection established") or whether the connection is reused ("TLS connection reused"). The following illustrates how TLS connections are reused: Initial plaintext SMTP handshake: smtp(8) -> remote SMTP server Reused SMTP/TLS connection, or new SMTP/TLS connection: smtp(8) -> tlsproxy(8) -> remote SMTP server Cached SMTP/TLS connection: scache(8) -> tlsproxy(8) -> remote SMTP server Major changes - tls support --------------------------- [Feature 20190106] SNI support in the Postfix SMTP server, the Postfix SMTP client, and in the tlsproxy(8) daemon (both server and client roles). See the postconf(5) documentation for the new tls_server_sni_maps and smtp_tls_servername parameters. [Feature 20190106] Support for files that contain multiple (key, certificate, trust chain) instances. This was required to implement server-side SNI table lookups, but it also eliminates the need for separate cert/key files for RSA, DSA, Elliptic Curve, and so on. The file format is documented in the TLS_README sections "Server-side certificate and private key configuration" and "Client-side certificate and private key configuration", and in the postconf(5) documentation for the parameters smtp_tls_chain_files, smtpd_tls_chain_files, tlsproxy_client_chain_files, and tlsproxy_tls_chain_files. Note: the command "postfix tls" does not yet support the new consolidated certificate chain format. If you switch to the new format, you'll need to manage your keys and certificates directly, rather than via postfix-tls(1). Major changes - usability ------------------------- [Feature 20180812] Support for smtpd_reject_footer_maps (as well as the postscreen variant postscreen_reject_footer_maps) for more informative reject messages. This is indexed with the Postfix SMTP server response text, and overrides the footer specified with smtpd_reject_footer. One will want to use a pcre: or regexp: map with this. This is the Postfix 3.3 (stable) release. The stable Postfix release is called postfix-3.3.x where 3=major release number, 3=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called postfix-3.4-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 3.1 or earlier, read RELEASE_NOTES-3.2 before proceeding. License change --------------- This software is distributed with a dual license: in addition to the historical IBM Public License 1.0, it is now also distributed with the more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. Major changes - compatibility safety net ---------------------------------------- [20180106] With compatibility_level < 1, the Postfix SMTP server now warns for mail that would be blocked by the Postfix 2.10 smtpd_relay_restrictions feature, without blocking that mail. This extends the compatibility safety net for sites that upgrade from earlier Postfix versions (questions on the postfix-users list show there is a steady trickle). See COMPATIBILITY_README for details. Major changes - configuration ----------------------------- [20170617] The postconf command now warns about unknown parameter names in a Postfix database configuration file. As with other unknown parameter names, these warnings can help to find typos early. [20180113] New read-only service_name parameter that contains the master.cf service name of a Postfix daemon process (it that is empty in a non-daemon process). This can make Postfix SMTP server logging logging distinct by setting the syslog_name in master.cf with "-o syslog_name=postfix/$service_name" for the "submission" and "smtps" services, and can make Postfix SMTP client distinct by setting "-o syslog_name=postfix/$service_name" for the "relay" service. Major changes - container support --------------------------------- [20171218] Preliminary support to run Postfix in the foreground, with "postfix start-fg". This requires that Postfix multi-instance support is disabled. To receive Postfix syslog information on the container's host, mount the host's /dev/log socket inside the container (example: "docker run -v /dev/log:/dev/log ..."), and specify a distinct Postfix "syslog_name" prefix that identifies the logging from the Postfix instance. Postfix does not log systemd events. Major changes - database support --------------------------------- [20170617] The postconf command warns about unknown parameter names in a Postfix database configuration file. [20171227] The pgsql_table(5) hosts parameter now supports the postgresql:// URI syntax. Contributed by Magosányi Árpád. Major changes - header format ----------------------------- [20180010] This release changes the format of 'full name' information in Postfix-generated From: headers, when a local program such as /bin/mail submits a message without From: header. Postfix-generated From: headers with 'full name' information are now formatted as "From: name <address>" by default. Specify "header_from_format = obsolete" to get the earlier form "From: address (name)". See the postconf(5) manpage for more details. Major changes - invisible changes --------------------------------- [20170617] Additional paranoia in the VSTRING implementation: a null byte after the end of vstring buffers (this is a safety net so that C-style string operations won't scribble past the end); earlier detection of bad length and precision format string specifiers (these are the result of programming error, as Postfix format strings cannot be specified externally). Major changes - milter support ------------------------------ [20171223] Milter applications can now send RET and ENVID parameters in SMFIR_CHGFROM (change envelope sender) requests. Major changes - mixed IPv6/IPv4 support --------------------------------------- [20170505] Workaround for mail delivery problems when 1) both Postfix IPv6 and IPv4 support are enabled, 2) some destination announces more primary IPv6 MX addresses than primary IPv4 MX addresses, 3) the destination is unreachable over IPv6, and 4) Postfix runs into the smtp_mx_address_limit before it can try to deliver over IPv4. When both Postfix IPv6 and IPv4 support are enabled, the Postfix SMTP client will now relax MX preferences so that it can schedule similar numbers of IPv4 and IPv6 destination addresses. This ensures that an IPv6 connectivity problem will not prevent mail from being delivered over IPv4 (and vice versa). Specify "smtp_balance_inet_protocols = no" to disable this workaround. Major changes - xclient ----------------------- [20171218] The Postfix SMTP server now allows the XCLIENT command before STARTTLS when TLS is required. This is useful for servers that run behind a reverse proxy server such as nginx. This is the Postfix 3.2 (stable) release. The stable Postfix release is called postfix-3.2.x where 3=major release number, 2=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called postfix-3.3-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 3.0 or earlier, read RELEASE_NOTES-3.1 before proceeding. Invisible changes ----------------- In addition to the visible changes described below, there is an ongoing overhaul of low-level code. With each change come updated tests to ensure that future changes will not 'break' compatibility with past behavior. Major changes - address mapping ------------------------------- [Feature 20170128] Postfix 3.2 fixes the handling of address extensions with email addresses that contain spaces. For example, the virtual_alias_maps, canonical_maps, and smtp_generic_maps features now correctly propagate an address extension from "aa bb+ext"@example.com to "cc dd+ext"@other.example, instead of producing broken output. Major changes - header/body_checks ---------------------------------- [Feature 20161008] "PASS" and "STRIP" actions in header/body_checks. "STRIP" is similar to "IGNORE" but also logs the action, and "PASS" disables header, body, and Milter inspection for the remainder of the message content. Contributed by Hobbit. Major changes - log analysis ---------------------------- [Feature 20160330] The collate.pl script by Viktor Dukhovni for grouping Postfix logfile records into "sessions" based on queue ID and process ID information. It's in the auxiliary/collate directory of the Postfix source tree. Major changes - maps support ---------------------------- [Feature 20160527] Postfix 3.2 cidr tables support if/endif and negation (by prepending ! to a pattern), just like regexp and pcre tables. The primarily purpose is to improve readability of complex tables. See the cidr_table(5) manpage for syntax details. [Incompat 20160925] In the Postfix MySQL database client, the default option_group value has changed to "client", to enable reading of "client" option group settings in the MySQL options file. This fixes a "not found" problem with Postfix queries that contain UTF8-encoded non-ASCII text. Specify an empty option_group value (option_group =) to get backwards-compatible behavior. [Feature 20161217] Stored-procedure support for MySQL databases. Contributed by John Fawcett. See mysql_table(5) for instructions. [Feature 20170128] The postmap command, and the inline: and texthash: maps now support spaces in left-hand field of the lookup table "source text". Use double quotes (") around a left-hand field that contains spaces, and use backslash (\) to protect embedded quotes in a left-hand field. There is no change in the processing of the right-hand field. Major changes - milter support ------------------------------ [Feature 20160611] The Postfix SMTP server local IP address and port are available in the policy delegation protocol (attribute names: server_address, server_port), in the Milter protocol (macro names: {daemon_addr}, {daemon_port}), and in the XCLIENT protocol (attribute names: DESTADDR, DESTPORT). [Feature 20161024] smtpd_milter_maps support for per-client Milter configuration that overrides smtpd_milters, and that has the same syntax. A lookup result of "DISABLE" turns off Milter support. See MILTER_README.html for details. Major changes - policy delegation --------------------------------- [Feature 20160611] The Postfix SMTP server local IP address and port are available in the policy delegation protocol (attribute names: server_address, server_port), in the Milter protocol (macro names: {daemon_addr}, {daemon_port}), and in the XCLIENT protocol (attribute names: DESTADDR, DESTPORT). Major changes - postqueue ------------------------- [Incompat 20170129] The postqueue command no longer forces all message arrival times to be reported in UTC. To get the old behavior, set TZ=UTC in main.cf:import_environment (this override is not recommended, as it affects all Postfix utities and daemons). Major changes - safety ---------------------- [Incompat 20161227] For safety reasons, the sendmail -C option must specify an authorized directory: the default configuration directory, a directory that is listed in the default main.cf file with alternate_config_directories or multi_instance_directories, or the command must be invoked with root privileges (UID 0 and EUID 0). This mitigates a recurring problem with the PHP mail() function. Major changes - sasl -------------------- [Feature 20160625] The Postfix SMTP server now passes remote client and local server network address and port information to the Cyrus SASL library. Build with ``make makefiles "CCARGS=$CCARGS -DNO_IP_CYRUS_SASL_AUTH"'' for backwards compatibility. Major changes - smtputf8 ------------------------ [Feature 20161103] Postfix 3.2 disables the 'transitional' compatibility between the IDNA2003 and IDNA2008 standards for internationalized domain names (domain names beyond the limits of US-ASCII). This change makes Postfix behavior consistent with contemporary web browsers. It affects the handling of some corner cases such as German sz and Greek zeta. See http://unicode.org/cldr/utility/idna.jsp for more examples. Specify "enable_idna2003_compatibility = yes" to restore historical behavior (but keep in mind that the rest of the world may not make that same choice). Major changes - tls ------------------- [Feature 20160828] Fixes for deprecated OpenSSL 1.1.0 API features, so that Postfix will build without depending on backwards-compatibility support. [Incompat 20161204] Postfix 3.2 removes tentative features that were implemented before the DANE spec was finalized: - Support for certificate usage PKIX-EE(1), - The ability to disable digest agility (Postfix now behaves as if "tls_dane_digest_agility = on"), and - The ability to disable support for "TLSA 2 [01] [12]" records that specify the digest of a trust anchor (Postfix now behaves as if "tls_dane_trust_anchor_digest_enable = yes). [Feature 20161217] Postfix 3.2 enables elliptic curve negotiation with OpenSSL >= 1.0.2. This changes the default smtpd_tls_eecdh_grade setting to "auto", and introduces a new parameter tls_eecdh_auto_curves with the names of curves that may be negotiated. The default tls_eecdh_auto_curves setting is determined at compile time, and depends on the Postfix and OpenSSL versions. At runtime, Postfix will skip curve names that aren't supported by the OpenSSL library. Major changes - xclient ----------------------- [Feature 20160611] The Postfix SMTP server local IP address and port are available in the policy delegation protocol (attribute names: server_address, server_port), in the Milter protocol (macro names: {daemon_addr}, {daemon_port}), and in the XCLIENT protocol (attribute names: DESTADDR, DESTPORT).
Diffstat (limited to 'external/ibm-public')
-rw-r--r--external/ibm-public/postfix/dist/AAAREADME12
-rw-r--r--external/ibm-public/postfix/dist/HISTORY2402
-rw-r--r--external/ibm-public/postfix/dist/INSTALL222
-rw-r--r--external/ibm-public/postfix/dist/LICENSE287
-rw-r--r--external/ibm-public/postfix/dist/Makefile2
-rw-r--r--external/ibm-public/postfix/dist/Makefile.in14
-rw-r--r--external/ibm-public/postfix/dist/Makefile.init2
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/AAAREADME3
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README2
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README11
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/BDAT_README124
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README91
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README29
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/DATABASE_README15
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/DEBUG_README12
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README167
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/MAILLOG_README113
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/MILTER_README38
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/MYSQL_README2
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README38
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES253
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/SASL_README14
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README24
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README49
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README44
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/STRESS_README22
-rw-r--r--external/ibm-public/postfix/dist/README_FILES/XCLIENT_README26
-rw-r--r--external/ibm-public/postfix/dist/RELEASE_NOTES253
-rw-r--r--external/ibm-public/postfix/dist/RELEASE_NOTES-3.1186
-rw-r--r--external/ibm-public/postfix/dist/RELEASE_NOTES-3.2180
-rw-r--r--external/ibm-public/postfix/dist/RELEASE_NOTES-3.3124
-rw-r--r--external/ibm-public/postfix/dist/RELEASE_NOTES-3.4208
-rw-r--r--external/ibm-public/postfix/dist/TLS_LICENSE2
-rw-r--r--external/ibm-public/postfix/dist/conf/LICENSE287
-rw-r--r--external/ibm-public/postfix/dist/conf/TLS_LICENSE2
-rw-r--r--external/ibm-public/postfix/dist/conf/access283
-rw-r--r--external/ibm-public/postfix/dist/conf/aliases90
-rw-r--r--external/ibm-public/postfix/dist/conf/canonical166
-rw-r--r--external/ibm-public/postfix/dist/conf/generic89
-rw-r--r--external/ibm-public/postfix/dist/conf/header_checks143
-rw-r--r--external/ibm-public/postfix/dist/conf/transport60
-rw-r--r--external/ibm-public/postfix/dist/conf/virtual113
-rw-r--r--external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html2
-rw-r--r--external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html9
-rw-r--r--external/ibm-public/postfix/dist/html/BDAT_README.html178
-rw-r--r--external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html103
-rw-r--r--external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html18
-rw-r--r--external/ibm-public/postfix/dist/html/DATABASE_README.html12
-rw-r--r--external/ibm-public/postfix/dist/html/DEBUG_README.html17
-rw-r--r--external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html185
-rw-r--r--external/ibm-public/postfix/dist/html/MAILLOG_README.html183
-rw-r--r--external/ibm-public/postfix/dist/html/MILTER_README.html50
-rw-r--r--external/ibm-public/postfix/dist/html/MYSQL_README.html2
-rw-r--r--external/ibm-public/postfix/dist/html/Makefile.in12
-rw-r--r--external/ibm-public/postfix/dist/html/POSTSCREEN_README.html27
-rw-r--r--external/ibm-public/postfix/dist/html/SASL_README.html16
-rw-r--r--external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html26
-rw-r--r--external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html47
-rw-r--r--external/ibm-public/postfix/dist/html/SMTPUTF8_README.html42
-rw-r--r--external/ibm-public/postfix/dist/html/STRESS_README.html18
-rw-r--r--external/ibm-public/postfix/dist/html/XCLIENT_README.html33
-rw-r--r--external/ibm-public/postfix/dist/html/access.5.html178
-rw-r--r--external/ibm-public/postfix/dist/html/aliases.5.html121
-rw-r--r--external/ibm-public/postfix/dist/html/anvil.8.html12
-rw-r--r--external/ibm-public/postfix/dist/html/bounce.8.html15
-rw-r--r--external/ibm-public/postfix/dist/html/canonical.5.html126
-rw-r--r--external/ibm-public/postfix/dist/html/cidr_table.5.html69
-rw-r--r--external/ibm-public/postfix/dist/html/cleanup.8.html32
-rw-r--r--external/ibm-public/postfix/dist/html/defer.8.html15
-rw-r--r--external/ibm-public/postfix/dist/html/discard.8.html13
-rw-r--r--external/ibm-public/postfix/dist/html/dnsblog.8.html26
-rw-r--r--external/ibm-public/postfix/dist/html/error.8.html13
-rw-r--r--external/ibm-public/postfix/dist/html/flush.8.html13
-rw-r--r--external/ibm-public/postfix/dist/html/generic.5.html69
-rw-r--r--external/ibm-public/postfix/dist/html/header_checks.5.html111
-rw-r--r--external/ibm-public/postfix/dist/html/index.html6
-rw-r--r--external/ibm-public/postfix/dist/html/ldap_table.5.html43
-rw-r--r--external/ibm-public/postfix/dist/html/lmtp.8.html358
-rw-r--r--external/ibm-public/postfix/dist/html/local.8.html137
-rw-r--r--external/ibm-public/postfix/dist/html/mailq.1.html118
-rw-r--r--external/ibm-public/postfix/dist/html/makedefs.1.html213
-rw-r--r--external/ibm-public/postfix/dist/html/master.5.html109
-rw-r--r--external/ibm-public/postfix/dist/html/master.8.html38
-rw-r--r--external/ibm-public/postfix/dist/html/mysql_table.5.html143
-rw-r--r--external/ibm-public/postfix/dist/html/newaliases.1.html118
-rw-r--r--external/ibm-public/postfix/dist/html/oqmgr.8.html117
-rw-r--r--external/ibm-public/postfix/dist/html/pgsql_table.5.html68
-rw-r--r--external/ibm-public/postfix/dist/html/pickup.8.html19
-rw-r--r--external/ibm-public/postfix/dist/html/pipe.8.html66
-rw-r--r--external/ibm-public/postfix/dist/html/postalias.1.html21
-rw-r--r--external/ibm-public/postfix/dist/html/postcat.1.html5
-rw-r--r--external/ibm-public/postfix/dist/html/postconf.1.html180
-rw-r--r--external/ibm-public/postfix/dist/html/postdrop.1.html28
-rw-r--r--external/ibm-public/postfix/dist/html/postfix-manuals.html2
-rw-r--r--external/ibm-public/postfix/dist/html/postfix.1.html104
-rw-r--r--external/ibm-public/postfix/dist/html/postkick.1.html5
-rw-r--r--external/ibm-public/postfix/dist/html/postlock.1.html7
-rw-r--r--external/ibm-public/postfix/dist/html/postlog.1.html35
-rw-r--r--external/ibm-public/postfix/dist/html/postlogd.8.html92
-rw-r--r--external/ibm-public/postfix/dist/html/postmap.1.html120
-rw-r--r--external/ibm-public/postfix/dist/html/postmulti.1.html47
-rw-r--r--external/ibm-public/postfix/dist/html/postqueue.1.html75
-rw-r--r--external/ibm-public/postfix/dist/html/postscreen.8.html77
-rw-r--r--external/ibm-public/postfix/dist/html/postsuper.1.html149
-rw-r--r--external/ibm-public/postfix/dist/html/posttls-finger.1.html38
-rw-r--r--external/ibm-public/postfix/dist/html/proxymap.8.html7
-rw-r--r--external/ibm-public/postfix/dist/html/qmgr.8.html153
-rw-r--r--external/ibm-public/postfix/dist/html/qmqpd.8.html22
-rw-r--r--external/ibm-public/postfix/dist/html/scache.8.html13
-rw-r--r--external/ibm-public/postfix/dist/html/sendmail.1.html118
-rw-r--r--external/ibm-public/postfix/dist/html/showq.8.html13
-rw-r--r--external/ibm-public/postfix/dist/html/smtp.8.html358
-rw-r--r--external/ibm-public/postfix/dist/html/smtpd.8.html236
-rw-r--r--external/ibm-public/postfix/dist/html/socketmap_table.5.html4
-rw-r--r--external/ibm-public/postfix/dist/html/spawn.8.html36
-rw-r--r--external/ibm-public/postfix/dist/html/sqlite_table.5.html150
-rw-r--r--external/ibm-public/postfix/dist/html/tcp_table.5.html24
-rw-r--r--external/ibm-public/postfix/dist/html/tlsmgr.8.html13
-rw-r--r--external/ibm-public/postfix/dist/html/tlsproxy.8.html281
-rw-r--r--external/ibm-public/postfix/dist/html/trace.8.html15
-rw-r--r--external/ibm-public/postfix/dist/html/transport.5.html43
-rw-r--r--external/ibm-public/postfix/dist/html/trivial-rewrite.8.html15
-rw-r--r--external/ibm-public/postfix/dist/html/verify.8.html22
-rw-r--r--external/ibm-public/postfix/dist/html/virtual.5.html94
-rw-r--r--external/ibm-public/postfix/dist/html/virtual.8.html44
-rw-r--r--external/ibm-public/postfix/dist/man/Makefile.in55
-rw-r--r--external/ibm-public/postfix/dist/man/man1/makedefs.1191
-rw-r--r--external/ibm-public/postfix/dist/man/man8/postlogd.8104
-rwxr-xr-xexternal/ibm-public/postfix/dist/mantools/ccformat4
-rwxr-xr-xexternal/ibm-public/postfix/dist/mantools/fixman8
-rwxr-xr-xexternal/ibm-public/postfix/dist/mantools/make-relnotes14
-rwxr-xr-xexternal/ibm-public/postfix/dist/mantools/missing-proxy-read-maps56
-rwxr-xr-xexternal/ibm-public/postfix/dist/mantools/postlink56
-rwxr-xr-xexternal/ibm-public/postfix/dist/mantools/spelldiff23
-rw-r--r--external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html2
-rw-r--r--external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html9
-rw-r--r--external/ibm-public/postfix/dist/proto/BDAT_README.html178
-rw-r--r--external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html103
-rw-r--r--external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html18
-rw-r--r--external/ibm-public/postfix/dist/proto/DATABASE_README.html12
-rw-r--r--external/ibm-public/postfix/dist/proto/DEBUG_README.html17
-rw-r--r--external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html185
-rw-r--r--external/ibm-public/postfix/dist/proto/MAILLOG_README.html183
-rw-r--r--external/ibm-public/postfix/dist/proto/MILTER_README.html50
-rw-r--r--external/ibm-public/postfix/dist/proto/MYSQL_README.html2
-rw-r--r--external/ibm-public/postfix/dist/proto/Makefile.in16
-rw-r--r--external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html27
-rw-r--r--external/ibm-public/postfix/dist/proto/SASL_README.html16
-rw-r--r--external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html26
-rw-r--r--external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html47
-rw-r--r--external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html42
-rw-r--r--external/ibm-public/postfix/dist/proto/STRESS_README.html18
-rw-r--r--external/ibm-public/postfix/dist/proto/XCLIENT_README.html33
-rw-r--r--external/ibm-public/postfix/dist/proto/access45
-rw-r--r--external/ibm-public/postfix/dist/proto/aliases67
-rw-r--r--external/ibm-public/postfix/dist/proto/canonical123
-rw-r--r--external/ibm-public/postfix/dist/proto/cidr_table88
-rw-r--r--external/ibm-public/postfix/dist/proto/generic8
-rw-r--r--external/ibm-public/postfix/dist/proto/header_checks21
-rw-r--r--external/ibm-public/postfix/dist/proto/ldap_table48
-rw-r--r--external/ibm-public/postfix/dist/proto/master25
-rw-r--r--external/ibm-public/postfix/dist/proto/mysql_table119
-rw-r--r--external/ibm-public/postfix/dist/proto/pgsql_table84
-rw-r--r--external/ibm-public/postfix/dist/proto/postconf.html.prolog23
-rw-r--r--external/ibm-public/postfix/dist/proto/postconf.man.prolog24
-rw-r--r--external/ibm-public/postfix/dist/proto/socketmap_table2
-rw-r--r--external/ibm-public/postfix/dist/proto/sqlite_table42
-rw-r--r--external/ibm-public/postfix/dist/proto/stop6
-rw-r--r--external/ibm-public/postfix/dist/proto/tcp_table30
-rw-r--r--external/ibm-public/postfix/dist/proto/transport42
-rw-r--r--external/ibm-public/postfix/dist/proto/virtual75
-rw-r--r--external/ibm-public/postfix/dist/src/anvil/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/bounce/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/Makefile.in58
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_body_edit.c9
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13e10
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13f10
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13g11
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13h8
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13i9
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13c6
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13d6
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13e30
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13f32
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13g34
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13h29
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13i33
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/test-queue-file13ebin0 -> 573 bytes
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/test-queue-file13fbin0 -> 573 bytes
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/test-queue-file13gbin0 -> 573 bytes
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/test-queue-file13hbin0 -> 573 bytes
-rw-r--r--external/ibm-public/postfix/dist/src/cleanup/test-queue-file13ibin0 -> 573 bytes
-rw-r--r--external/ibm-public/postfix/dist/src/discard/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/dns/Makefile.in23
-rw-r--r--external/ibm-public/postfix/dist/src/dns/dns_str_resflags.c130
-rw-r--r--external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_ncache.ref7
-rw-r--r--external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_plain.ref7
-rw-r--r--external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.2_bind_plain.ref9
-rw-r--r--external/ibm-public/postfix/dist/src/dns/error.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/dns/mxonly_test.ref6
-rw-r--r--external/ibm-public/postfix/dist/src/dns/no-a.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/dns/no-aaaa.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/dns/no-mx.ref8
-rw-r--r--external/ibm-public/postfix/dist/src/dns/nullmx_test.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/dns/nxdomain_test.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/dnsblog/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/error/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/flush/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/fsstone/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/global/Makefile.in310
-rw-r--r--external/ibm-public/postfix/dist/src/global/been_here.h3
-rw-r--r--external/ibm-public/postfix/dist/src/global/haproxy_srvr.c791
-rw-r--r--external/ibm-public/postfix/dist/src/global/haproxy_srvr.h13
-rw-r--r--external/ibm-public/postfix/dist/src/global/header_body_checks_strip.ref41
-rw-r--r--external/ibm-public/postfix/dist/src/global/info_log_addr_form.c126
-rw-r--r--external/ibm-public/postfix/dist/src/global/info_log_addr_form.h33
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_crunch.h21
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_crunch.in51
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_crunch.ref22
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_find.h51
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_find.in77
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_find.ref63
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_form.c67
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_form.h38
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_map.h15
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_addr_map.ref26
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_conf_long.c19
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_conf_nint.c19
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_copy.c12
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_error.c4
-rw-r--r--external/ibm-public/postfix/dist/src/global/mail_task.c35
-rw-r--r--external/ibm-public/postfix/dist/src/global/maillog_client.c300
-rw-r--r--external/ibm-public/postfix/dist/src/global/maillog_client.h35
-rw-r--r--external/ibm-public/postfix/dist/src/global/map_search.c398
-rw-r--r--external/ibm-public/postfix/dist/src/global/map_search.h73
-rw-r--r--external/ibm-public/postfix/dist/src/global/map_search.ref29
-rw-r--r--external/ibm-public/postfix/dist/src/global/maps.h3
-rw-r--r--external/ibm-public/postfix/dist/src/global/memcache_proto.c12
-rw-r--r--external/ibm-public/postfix/dist/src/global/mkmap_db.c4
-rw-r--r--external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.c261
-rw-r--r--external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.h32
-rw-r--r--external/ibm-public/postfix/dist/src/global/off_cvt.c34
-rw-r--r--external/ibm-public/postfix/dist/src/global/off_cvt.in9
-rw-r--r--external/ibm-public/postfix/dist/src/global/off_cvt.ref5
-rw-r--r--external/ibm-public/postfix/dist/src/global/opened.c12
-rw-r--r--external/ibm-public/postfix/dist/src/global/quote_822_local.c98
-rw-r--r--external/ibm-public/postfix/dist/src/global/quote_822_local.h9
-rw-r--r--external/ibm-public/postfix/dist/src/global/quote_822_local.in5
-rw-r--r--external/ibm-public/postfix/dist/src/global/quote_822_local.ref5
-rw-r--r--external/ibm-public/postfix/dist/src/global/quote_flags.c91
-rw-r--r--external/ibm-public/postfix/dist/src/global/quote_flags.h18
-rw-r--r--external/ibm-public/postfix/dist/src/global/reject_deliver_request.c107
-rw-r--r--external/ibm-public/postfix/dist/src/global/resolve_clnt.h12
-rw-r--r--external/ibm-public/postfix/dist/src/global/smtp_stream.h10
-rw-r--r--external/ibm-public/postfix/dist/src/global/split_addr.h13
-rw-r--r--external/ibm-public/postfix/dist/src/global/strip_addr.h11
-rw-r--r--external/ibm-public/postfix/dist/src/global/strip_addr.ref2
-rw-r--r--external/ibm-public/postfix/dist/src/local/Makefile.in3
-rw-r--r--external/ibm-public/postfix/dist/src/master/Makefile.in57
-rw-r--r--external/ibm-public/postfix/dist/src/master/dgram_server.c667
-rw-r--r--external/ibm-public/postfix/dist/src/master/master.h11
-rw-r--r--external/ibm-public/postfix/dist/src/master/master_conf.c13
-rw-r--r--external/ibm-public/postfix/dist/src/master/master_listen.c18
-rw-r--r--external/ibm-public/postfix/dist/src/master/master_proto.h8
-rw-r--r--external/ibm-public/postfix/dist/src/milter/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/oqmgr/Makefile.in3
-rw-r--r--external/ibm-public/postfix/dist/src/oqmgr/qmgr_error.c4
-rw-r--r--external/ibm-public/postfix/dist/src/pickup/Makefile.in3
-rw-r--r--external/ibm-public/postfix/dist/src/pipe/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/postalias/Makefile.in26
-rw-r--r--external/ibm-public/postfix/dist/src/postalias/fail_test.in14
-rw-r--r--external/ibm-public/postfix/dist/src/postcat/Makefile.in5
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/Makefile.in286
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/extract_cfg.sh92
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test28.ref6
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test29.ref10
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test40.ref1
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test41.ref6
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test42.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test43.ref1
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test44.ref1
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test59.ref2
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test64.ref1
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test65.ref1
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test66.ref5
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test67.ref10
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test68.ref5
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test69.ref2
-rw-r--r--external/ibm-public/postfix/dist/src/postconf/test70.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/postdrop/Makefile.in4
-rw-r--r--external/ibm-public/postfix/dist/src/postfix/Makefile.in4
-rw-r--r--external/ibm-public/postfix/dist/src/postkick/Makefile.in5
-rw-r--r--external/ibm-public/postfix/dist/src/postlock/Makefile.in4
-rw-r--r--external/ibm-public/postfix/dist/src/postlog/Makefile.in7
-rw-r--r--external/ibm-public/postfix/dist/src/postlogd/Makefile.in74
-rw-r--r--external/ibm-public/postfix/dist/src/postlogd/postlogd.c269
-rw-r--r--external/ibm-public/postfix/dist/src/postmap/Makefile.in43
-rw-r--r--external/ibm-public/postfix/dist/src/postmap/fail_test.in16
-rw-r--r--external/ibm-public/postfix/dist/src/postmap/file_test.in17
-rw-r--r--external/ibm-public/postfix/dist/src/postmap/file_test.ref14
-rw-r--r--external/ibm-public/postfix/dist/src/postmap/quote_test.in8
-rw-r--r--external/ibm-public/postfix/dist/src/postmap/quote_test.ref7
-rw-r--r--external/ibm-public/postfix/dist/src/postmulti/Makefile.in4
-rw-r--r--external/ibm-public/postfix/dist/src/postqueue/Makefile.in4
-rw-r--r--external/ibm-public/postfix/dist/src/postscreen/Makefile.in3
-rw-r--r--external/ibm-public/postfix/dist/src/postscreen/postscreen_haproxy.h7
-rw-r--r--external/ibm-public/postfix/dist/src/postsuper/Makefile.in8
-rw-r--r--external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in9
-rw-r--r--external/ibm-public/postfix/dist/src/proxymap/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/qmgr/Makefile.in3
-rw-r--r--external/ibm-public/postfix/dist/src/qmgr/qmgr_error.c4
-rw-r--r--external/ibm-public/postfix/dist/src/qmqpd/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/scache/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/sendmail/Makefile.in7
-rw-r--r--external/ibm-public/postfix/dist/src/showq/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/smtp/Makefile.in87
-rw-r--r--external/ibm-public/postfix/dist/src/smtp/smtp_map11.in33
-rw-r--r--external/ibm-public/postfix/dist/src/smtp/smtp_map11.ref89
-rw-r--r--external/ibm-public/postfix/dist/src/smtp/smtp_misc.c102
-rw-r--r--external/ibm-public/postfix/dist/src/smtpd/Makefile.in64
-rw-r--r--external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in35
-rw-r--r--external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref57
-rw-r--r--external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref12
-rw-r--r--external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in6
-rw-r--r--external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref21
-rw-r--r--external/ibm-public/postfix/dist/src/smtpd/smtpd_state.c24
-rw-r--r--external/ibm-public/postfix/dist/src/smtpstone/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/spawn/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/tls/Makefile.in236
-rw-r--r--external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem64
-rw-r--r--external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem.ref2
-rw-r--r--external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem36
-rw-r--r--external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem.ref2
-rw-r--r--external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem36
-rw-r--r--external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem.ref2
-rw-r--r--external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem64
-rw-r--r--external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem.ref2
-rw-r--r--external/ibm-public/postfix/dist/src/tls/ecca-cert.pem10
-rw-r--r--external/ibm-public/postfix/dist/src/tls/ecca-pkey.pem5
-rw-r--r--external/ibm-public/postfix/dist/src/tls/ecee-cert.pem11
-rw-r--r--external/ibm-public/postfix/dist/src/tls/ecee-pkey.pem5
-rw-r--r--external/ibm-public/postfix/dist/src/tls/ecroot-cert.pem10
-rw-r--r--external/ibm-public/postfix/dist/src/tls/ecroot-pkey.pem5
-rw-r--r--external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem45
-rw-r--r--external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem.ref12
-rw-r--r--external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem45
-rw-r--r--external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem.ref12
-rw-r--r--external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem45
-rw-r--r--external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem.ref12
-rw-r--r--external/ibm-public/postfix/dist/src/tls/goodchains.pem121
-rw-r--r--external/ibm-public/postfix/dist/src/tls/goodchains.pem.ref24
-rw-r--r--external/ibm-public/postfix/dist/src/tls/mkcert.sh264
-rw-r--r--external/ibm-public/postfix/dist/src/tls/rsaca-cert.pem19
-rw-r--r--external/ibm-public/postfix/dist/src/tls/rsaca-pkey.pem28
-rw-r--r--external/ibm-public/postfix/dist/src/tls/rsaee-cert.pem20
-rw-r--r--external/ibm-public/postfix/dist/src/tls/rsaee-pkey.pem28
-rw-r--r--external/ibm-public/postfix/dist/src/tls/rsaroot-cert.pem18
-rw-r--r--external/ibm-public/postfix/dist/src/tls/rsaroot-pkey.pem28
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_proxy.h248
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_proxy_client_misc.c192
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_proxy_client_print.c396
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_proxy_client_scan.c683
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_proxy_context_print.c114
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_proxy_context_scan.c190
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_proxy_server_print.c145
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_proxy_server_scan.c247
-rw-r--r--external/ibm-public/postfix/dist/src/tls/tls_session.c36
-rw-r--r--external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem51
-rw-r--r--external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem.ref13
-rw-r--r--external/ibm-public/postfix/dist/src/tlsmgr/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/tlsproxy/Makefile.in8
-rw-r--r--external/ibm-public/postfix/dist/src/tlsproxy/tlsproxy.h19
-rw-r--r--external/ibm-public/postfix/dist/src/trivial-rewrite/Makefile.in19
-rw-r--r--external/ibm-public/postfix/dist/src/trivial-rewrite/transport.in45
-rw-r--r--external/ibm-public/postfix/dist/src/trivial-rewrite/transport.ref22
-rw-r--r--external/ibm-public/postfix/dist/src/util/Makefile.in417
-rw-r--r--external/ibm-public/postfix/dist/src/util/argv_attr.h45
-rw-r--r--external/ibm-public/postfix/dist/src/util/argv_attr_print.c75
-rw-r--r--external/ibm-public/postfix/dist/src/util/argv_attr_scan.c95
-rw-r--r--external/ibm-public/postfix/dist/src/util/byte_mask.c308
-rw-r--r--external/ibm-public/postfix/dist/src/util/byte_mask.h66
-rw-r--r--external/ibm-public/postfix/dist/src/util/byte_mask.in7
-rw-r--r--external/ibm-public/postfix/dist/src/util/byte_mask.ref014
-rw-r--r--external/ibm-public/postfix/dist/src/util/byte_mask.ref122
-rw-r--r--external/ibm-public/postfix/dist/src/util/byte_mask.ref210
-rw-r--r--external/ibm-public/postfix/dist/src/util/cidr_match.h22
-rw-r--r--external/ibm-public/postfix/dist/src/util/clean_env.c43
-rw-r--r--external/ibm-public/postfix/dist/src/util/clean_env.h8
-rw-r--r--external/ibm-public/postfix/dist/src/util/connect.h8
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_cidr.in12
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_cidr.map40
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_cidr.ref40
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_cidr_file.in3
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_cidr_file.map3
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_cidr_file.ref8
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_file.c233
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_inline_file.ref12
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_pcre.in1
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_pcre.map5
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_pcre.ref8
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_pcre_file.in4
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_pcre_file.map6
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_pcre_file.ref12
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_pipe_test.in9
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_pipe_test.ref14
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_random.ref20
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_random_file.ref10
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_regexp.map5
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_regexp.ref7
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_regexp_file.in3
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_regexp_file.map3
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_regexp_file.ref8
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_static_file.ref10
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_thash.in5
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_thash.map32
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_thash.ref6
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_union_test.in7
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_union_test.ref10
-rw-r--r--external/ibm-public/postfix/dist/src/util/dict_utf8_test.in4
-rw-r--r--external/ibm-public/postfix/dist/src/util/hex_quote.c11
-rw-r--r--external/ibm-public/postfix/dist/src/util/killme_after.c15
-rw-r--r--external/ibm-public/postfix/dist/src/util/logwriter.c126
-rw-r--r--external/ibm-public/postfix/dist/src/util/logwriter.h40
-rw-r--r--external/ibm-public/postfix/dist/src/util/mac_expand.in7
-rw-r--r--external/ibm-public/postfix/dist/src/util/mac_expand.ref28
-rw-r--r--external/ibm-public/postfix/dist/src/util/midna_domain_test.ref24
-rw-r--r--external/ibm-public/postfix/dist/src/util/miss_endif_cidr.map1
-rw-r--r--external/ibm-public/postfix/dist/src/util/miss_endif_cidr.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/util/miss_endif_pcre.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/util/miss_endif_re.map1
-rw-r--r--external/ibm-public/postfix/dist/src/util/miss_endif_regexp.ref4
-rw-r--r--external/ibm-public/postfix/dist/src/util/msg_logger.c373
-rw-r--r--external/ibm-public/postfix/dist/src/util/msg_logger.h64
-rw-r--r--external/ibm-public/postfix/dist/src/util/msg_syslog.c60
-rw-r--r--external/ibm-public/postfix/dist/src/util/split_qnameval.c170
-rw-r--r--external/ibm-public/postfix/dist/src/util/unix_dgram_connect.c93
-rw-r--r--external/ibm-public/postfix/dist/src/util/unix_dgram_listen.c95
-rw-r--r--external/ibm-public/postfix/dist/src/util/unsafe.c37
-rw-r--r--external/ibm-public/postfix/dist/src/util/vbuf_print_test.in33
-rw-r--r--external/ibm-public/postfix/dist/src/util/vbuf_print_test.ref27
-rw-r--r--external/ibm-public/postfix/dist/src/util/vstream_test.in3
-rw-r--r--external/ibm-public/postfix/dist/src/util/vstream_test.ref8
-rw-r--r--external/ibm-public/postfix/dist/src/util/vstring_test.ref6
-rw-r--r--external/ibm-public/postfix/dist/src/util/vstring_vstream.c127
-rw-r--r--external/ibm-public/postfix/dist/src/verify/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/virtual/Makefile.in4
-rw-r--r--external/ibm-public/postfix/dist/src/xsasl/Makefile.in2
-rw-r--r--external/ibm-public/postfix/dist/src/xsasl/xsasl_server.c15
448 files changed, 23255 insertions, 4283 deletions
diff --git a/external/ibm-public/postfix/dist/AAAREADME b/external/ibm-public/postfix/dist/AAAREADME
index e20091c8798..7b7a4b69699 100644
--- a/external/ibm-public/postfix/dist/AAAREADME
+++ b/external/ibm-public/postfix/dist/AAAREADME
@@ -61,13 +61,16 @@ Safford, Douglas Schales, and Leendert van Doorn. I also appreciate
the support by Charles Palmer under whose leadership I began this
project, and who had the privilege to name the software, twice.
+Postcards
+=========
+
If you wish to express your appreciation for the Postfix software,
you are welcome to send a postcard to:
Wietse Venema
- IBM T.J Watson Research Center
- P.O. Box 704,
- Yorktown Heights, NY 10598
+ Google
+ 111 8th Avenue, 4th floor
+ New York, NY 10011
USA
Roadmap of the Postfix source distribution
@@ -146,6 +149,7 @@ Postfix daemons:
src/oqmgr/ Old queue manager
src/pickup/ Local pickup
src/pipe/ Pipe delivery
+ src/postlogd/ Syslog alternative, logs to file or stdout
src/postscreen/ Zombie blocker
src/proxymap/ Table lookup proxy agent
src/qmgr/ Queue manager
@@ -156,7 +160,7 @@ Postfix daemons:
src/smtpd/ SMTP server
src/spawn/ Run non-Postfix server
src/tlsmgr/ TLS session keys and random pool
- src/tlsproxy/ TLS proxy for postscreen
+ src/tlsproxy/ TLS proxy for postscreen and outbound connection reuse
src/trivial-rewrite/ Address rewriting and resolving
src/verify/ address verification service
src/virtual/ virtual mailbox-only delivery agent
diff --git a/external/ibm-public/postfix/dist/HISTORY b/external/ibm-public/postfix/dist/HISTORY
index 5a52f1c2ba1..f41ef305f9b 100644
--- a/external/ibm-public/postfix/dist/HISTORY
+++ b/external/ibm-public/postfix/dist/HISTORY
@@ -12281,7 +12281,7 @@ Apologies for any names omitted.
20060606
Safety: mail receiving daemons (smtpd, qmqpd) now pass
- actual client name/addres/helo attributes in addition to
+ actual client name/address/helo attributes in addition to
the attributes used for logging (xforward). This prevents
Milter applications from treating qmqpd mail as if it
originated locally, and prevents incorrect Milter decisions
@@ -13424,7 +13424,7 @@ Apologies for any names omitted.
20070414
- Cleanup: expire cached results from addres rewriting, address
+ Cleanup: expire cached results from address rewriting, address
resolution, and from transport map lookups. Results expire
after 30 seconds; short enough that it doesn't freak out
people who run the same test repeatedly, and long enough
@@ -17692,7 +17692,7 @@ Apologies for any names omitted.
20120330
- Workaround: specify "\c" at the start of an smtp_reject_footer
+ Workaround: specify "\c" at the start of an smtpd_reject_footer
template to suppress the line break between the reply text
and the footer text. Files: global/smtp_reply_footer.c,
proto/postconf.proto.
@@ -18499,7 +18499,7 @@ Apologies for any names omitted.
endpoint label; better reuse of SASL-authenticated connections
over UNIX-domains sockets, however unlikely these may be;
a first step towards refinement of connection cache lookup
- by IP addres for plaintext or SASL-unauthenticated connections.
+ by IP address for plaintext or SASL-unauthenticated connections.
Files: smtp/smtp.h smtp/smtp_connect.c, smtp/smtp_reuse.c,
smtp/smtp_key.c, smtp/smtp_tls_sess.s.
@@ -20360,7 +20360,7 @@ Apologies for any names omitted.
value was specified, i.e. print the entire string. This was
not harmful, it just looked weird. File: util/vbuf_print.c.
-20120917
+20140917
Feature: RFC 7372 enhanced status code for unknown SMTP
client hostnames. File: smtpd/smtpd_check.c
@@ -22140,14 +22140,14 @@ Apologies for any names omitted.
Portability: added a tls_random_source default setting for
MacOS X. Viktor Dukhovni. File: util/sys_defs.h.
-20150118
+20160118
Bitrot: OpenSSL 1.1.0-dev (aka the "master" branch) has new
security levels ranging from 0 to 5. Level "0" is backwards
compatible, and other levels are increasingly restrictive.
Viktor Dukhovni. Files: tls/tls_server.c, tls/tls_client.c.
-20161205
+20160205
Portability: Postfix TLS support uses /dev/urandom if
available and no system-specific setting exists in sys_defs.h.
@@ -22187,13 +22187,33 @@ Apologies for any names omitted.
context to clarify that this "no match" condition is for
smtpd_log_access_permit_actions. File: smtpd/smtpd_check.c.
+20160224
+
+ Cleanup: un-break some DNS unit tests by replacing non-portable
+ numerical flags with portable symbolic names in the verbose
+ command output. Files: dns/dns_str_resflags.c, dns/dns_lookup.c,
+ dns/Makefile.in, many *.ref files.
+
+20160227
+
+ Cleanup: remember multiple BCC actions in access maps.
+ Files: smtpd/smtpd.h, smtpd/smtpd.c, smtpd/smtpd_check.c,
+ smtpd/smtpd_state.c, proto/access.
+
20160228
- Documentation: typos in postfix-tls-script(1) manpage.
+ Documentation: STRESS_README. File: proto/STRESS_README.html.
-20160327
+20160229
+
+ Documentation: postmulti manpage. File: postmulti/postmulti.c.
- Documentation: line wrapping in postconf(1) manpage.
+20160305
+
+ Future-proofing: detect integer overflow before it happens.
+ After-the-fact detection relies on assumptions about
+ undefined behavior that are invalidated by compilers. Files:
+ util/mymalloc.c, util/vstring.c.
20160310
@@ -22204,6 +22224,75 @@ Apologies for any names omitted.
cleanup/cleanup_addr.c, cleanup/cleanup_milter.c,
cleanup/cleanup.h, regression tests.
+20160314
+
+ Future-proofing: revised off_t integer conversion (detect off_t
+ overflow before it happens). After-the-fact detection relies
+ on assumptions about undefined behavior that are invalidated by
+ compilers. Files: global/off_cvt.c.
+
+ Cleanup: include <sys/types.h> once, instead of making it
+ system-dependent. File: util/sys_defs.h.
+
+ Cleanup: make sorting in "make depend" locale-independent.
+ Files: */Makefile.in.
+
+ Cleanup: postmulti manpage. File: postmulti/postmulti.c.
+
+20160319
+
+ Future-proofing: revised format-string width or precision integer
+ conversion (detect integer overflow before it happens), plus
+ some tests to ensure that format-string widths and precisions
+ are parsed correctly, and that output buffers are sized
+ correctly. Files: util/vbuf_print.c, util/vbuf_print_test.in,
+ util/vbuf_print_test.ref.
+
+20160320
+
+ Testing: exact-size VSTRING allocation. Files: util/vstring.[hc].
+
+ Cleanup: switch to snprintf() for redundancy, keeping
+ existing code in place to censor unnecessary format-string
+ features. Specify "make makefiles CCARGS=-DNO_SNPRINTF" for
+ ancient systems. File: vbuf_print.c, makedefs, util/sys_defs.h,
+ proto/INSTALL.html.
+
+20160324
+
+ Future-proofing: revised netstring length integer conversion
+ (detect integer overflow before it happens). File:
+ util/netstring.c.
+
+ Cleanup: report unsupported usage of '%ls' and '%lc' in
+ format strings. File: util/vbuf_print.c.
+
+20160326
+
+ Future-proofing: regression test for global/off_cvt.c.
+ Files: global/off_cvt.in, global/off_cvt.ref.
+
+20160327
+
+ Cleanup: postconf(1) manpage. File: postconf/postconf.c.
+
+ Cleanup: un-broke regression tests. Files: dns/mxonly_test.ref,
+ dns/no-mx.ref, smtpd/smtpd_server.ref, smtpd/smtpd_server.in.
+
+ Added Postfix version information to the "postconf -m" manpage
+ section. File: postconf/postconf.c.
+
+20160330
+
+ The collate.pl script by Viktor Dukhovni for grouping Postfix
+ logfile records into "sessions" based on queue ID and process
+ ID information. Files: auxiliary/collate/*.
+
+20160407
+
+ Treat SASL_FAIL and SASL_NOMEM as temporary errors.
+ Markus Benning. File: xsasl/xsasl_cyrus_server.c.
+
20160410
Bugfix (introduced: Postfix 2.6): the "bad filetype"
@@ -22215,9 +22304,81 @@ Apologies for any names omitted.
20160515
- Portability: OpenBSD 6.0. Files: makedefs, util/sys_defs.h.
+ Portability: OpenBSD 6.0. Files: makedefs, util/sys_defs.h,
+ dns/dns_str_resflags.c.
-20160619
+20160521
+
+ Bugfix (introduced: Postfix beta): the never-used function
+ mvect_free() attempted to free memory that it has not
+ allocated. File: util/mvect.c.
+
+ Cleanup: existing if/endif support for pcre and regexp
+ tables, in preparation for new if/endif support for cidr
+ tables. Files: util/dict_regexp.c, util/dict_pcre.c.
+
+20160526
+
+ Feature: cidr tables now support if/endif and negation (by
+ prepending "!" to a pattern), just like regexp and pcre
+ tables. The primarily purpose is to improve readability of
+ complex tables. Files: util/cidr_match.[hc], util/dict_cidr.c,
+ proto/cidr_table.
+
+ Cleanup: make regexp: and pcre: parser warning messages more
+ similar. Files: dict_regexp.c, dict_pcre.c.
+
+20160601
+
+ Cleanup: moved parsing of '!' operators from cidr_match.c
+ to dict_cidr.c. Files: util/cidr_match.[hc], util/dict_cidr.c,
+ util/match_ops.c.
+
+20160604
+
+ Cleanup: made parsing of '!' operators in regexp and pcre
+ tables consistent with cidr tables. Files: util/dict_regexp.c,
+ util/dict_pcre.c.
+
+20160605
+
+ Cleanup: integer wrap-around detection in the MySQL and
+ PostgreSQL clients. This is totally non-critical because
+ Postfix strings are size-limited by design. Files:
+ global/dict_mysqql.c, global/dict_pgsql.c.
+
+20160607
+
+ Documentation: dnsblog.
+
+20160609
+
+ Documentation: postsuper(1) manpage text for multiple -[dhH]
+ options. File: postsuper/postsuper.c.
+
+20160611
+
+ Cleanup: Postfix SMTP server local IP address and port
+ attributes in the policy delegation protocol (attribute
+ names: server_address, server_port), in the Milter protocol
+ (macro names: {daemon_addr}, {daemon_port}) and in the
+ XCLIENT protocol (attribute names: DESTADDR, DESTPORT).
+ Files: proto/MILTER_README.html, proto/SMTPD_POLICY_README.html,
+ cleanup/cleanup.h, cleanup/cleanup_milter.c, global/mail_proto.h,
+ milter/milter.h, smtpd/smtpd.c, smtpd/smtpd.h, smtpd/smtpd_check.c,
+ smtpd/smtpd_haproxy.c, smtpd/smtpd_milter.c, smtpd/smtpd_peer.c.
+
+20160612
+
+ Bugfix (introduced: 20090211): missing server address
+ conversion for non-proxy, non-postscreen connections. File:
+ smtpd/smtpd_peer.c.
+
+ Bugfix (introduced: 20160611) missing server port conversion
+ for non-proxy, non-postscreen connections, because there was
+ no server address conversion. File: smtpd/smtpd_peer.c.
+
+20160618
Bugfix (introduced: 20091121): with the introduction of
sender_dependent_default_transport_maps, the SMTP daemon
@@ -22227,21 +22388,58 @@ Apologies for any names omitted.
global/resolve_clnt.h, smtpd/smtpd_check.c, smtpd/smtpd_check.h,
smtpd/smtpd_milter.c, smtpd/smtpd_resolve.c, smtpd/smtpd_resolve.h.
+20160619
+
+ Refinements to the 20160618 fix. For more consistent results
+ with sender address validation, use the recipient address
+ (if available) as the sender-dependent address resolver
+ context. For better caching, pass sender context with all
+ attempts to resolve an email address. File: smtpd/smtpd.c,
+ smtpd/smtpd_check.c, smtpd/smtpd_milter.c.
+
+20160625
+
+ Cleanup: the Postfix SMTP server now passes network address
+ and port information to the Cyrus SASL library. Build with
+ ``make makefiles "CCARGS=$CCARGS -DNO_IP_CYRUS_SASL_AUTH"''
+ for backwards compatibility. Files: makedefs,
+ smtpd/smtpd_sasl_glue.c, xsasl/xsasl.h, xsasl/xsasl_cyrus_server.c,
+ xsasl/xsasl_server.c.
+
+ Cleanup: dnsblog manpage. File: dnsblog/dnsblog.c.
+
20160717
Bugfix (introduced: Postfix 1.1): the virtual(8) delivery
agent discarded the error result from vstream_fseek().
- File: virtual/mailbox.c.
-20160730
+20160728
Bugfix (introduced: 20090614): with concurrent connections
from the same client IP address, and after-220 tests enabled,
postscreen could overwrite the cached "all tests completed"
result of one connection that completed the after-220 tests,
with the "some tests not completed" result of a concurrent
- connection where the client hung up later, without completing
- the after-220 tests.
+ connection where the client hung up before completing the
+ after-220 tests. Files: postscreen_misc.c, postscreen_state.c,
+ postscreen.h, postscreen_tests.c, postscreen.c, postscreen_smtpd.c,
+ postscreen_early.c.
+
+20160730
+
+ Cleanup: don't try to optimize away postscreen cache updates.
+ File: postscreen_misc.c.
+
+ Cleanup: removed compatibility crutches that emulated a
+ historical data organization from four years ago. Files:
+ postscreen/postscreen.[hc], postscreen/postscreen_early.c,
+ postscreen/postscreen_smtpd.c, postscreen/postscreen_tests.c.
+
+20160808
+
+ Cleanup: preserve the new file mtimes when installing Postfix.
+ Ondřej Lysoněk. File: postfix-install.
+ REVERTED 20160828.
20160819
@@ -22260,10 +22458,18 @@ Apologies for any names omitted.
20160828
Bitrot: fixes for incompatible OpenSSL 1.1.0 API changes.
- Viktor Dukhovni. Files: posttls-finger/posttls-finger.c,
+ Viktor Dukhovni. Files: posttls-finger/posttls-finger.c,
tls/tls.h, tls/tls_dane.c, tls/tls_verify.c, tls/tls_server.c,
tls/tls_client.c.
+ Cleanup: disable reuse of ECDH ephemeral keys. Viktor
+ Dukhovni. File: tls/tls_misc.h.
+
+20160908
+
+ Documentation: add a pointer to hosts(5) and services(5)
+ for symbolic host and port syntax. File: proto/master.
+
20160911
Bugfix (introduced: Postfix 3.0): the SMTP daemon did not
@@ -22271,19 +22477,89 @@ Apologies for any names omitted.
a client that exceeds request or concurrency rates. File:
smtpd/smtpd.c.
+20160912
+
+ Feature: preserve the new file mtimes when installing
+ Postfix. Ondřej Lysoněk. Wietse made this conditional on
+ the presence of a new -keep-new-mtime flag. File: postfix-install.
+ [this flag was renamed to "-keep-build-mtime" on 20161126]
+
20160917
Bugfix (introduced: Postfix 3.0): the unionmap did not
propagate table lookup errors. Based on patch by Roel van
Meer. Files: util/dict_union.c, util/dict_union_test.*.
+ Cleanup: added unit test for pipemap. Files: util/dict_pipe.c,
+ util/dict_pipe_test.*.
+
+ Documentation: added a note about the order of search
+ patterns and table lookup order. Files: proto/canonical,
+ proto/generic, proto/virtual.
+
+ Documentation: bitrot in postsuper(1) example. Different
+ groff versions produce different results; some systems no
+ longer support historical "tail -number" command syntax.
+ Fix by Geert Stappers. File: postsuper/postsuper.c.
+
+20160918
+
+ Logging: the Postfix SMTP server logs the sasl_username
+ after rejected SMTP commands. As before, the SMTP server
+ does not forward SASL login information to other Postfix
+ subsystems, and it does not receive SASL login information
+ in XFORWARD commands. File/smtpd/smtpd.c.
+
20160925
- Workaround (problem introduced: Postfix 2.11): to avoid
- false "not found" errors with MySQL map queries that contain
- UTF8-encoded text, specify "option_group = client" in Postfix
- MySQL configuration files. This will be the default setting
- with Postfix 3.2 and later.
+ Bugfix (introduced: Postfix 2.11): changed the default MySQL
+ option_group value to "client" to enable the reading of
+ "client" option group settings in the MySQL option file.
+ This fixes false "not found" errors with Postfix queries
+ that contain UTF8-encoded text. Fix by John Fawcett.
+ Specify an empty option_group value to get backwards-compatible
+ behavior. Files: global/dict_mysql.c, proto/mysql_table.
+
+20161007
+
+ Bitrot: API for the ersatz inet_ntop() function, when
+ compiling with -DNO_IPV6 (which exists only for debugging).
+ Files: util/sys_defs.h, util/sys_compat.c.
+
+20161008
+
+ Feature: smtp_tcp_port, similar to the existing lmtp_tcp_port.
+ Files: mantools/postlink, proto/postconf.proto,
+ global/mail_params.h, smtp/smtp.c, smtp/smtp_connect.c,
+ smtp/smtp_params.c.
+
+ Feature: "PASS" and "STRIP" actions in header/body_checks.
+ "STRIP" is similar to "IGNORE" but also logs the action,
+ and "PASS" disables header, body, and Milter inspection for
+ the remainder of the message content. Contributed by Hobbit.
+ Files: cleanup/cleanup_message.c, global/header_body_checks.c.
+
+20161024
+
+ Feature: smtpd_milter_maps, per-client Milter configuration
+ that overrides smtpd_milters, and that has the same syntax.
+ Files: mantools/postlink, proto/MILTER_README.html,
+ proto/postconf.proto, global/mail_params.h, smtpd/smtpd.c,
+ smtpd/smtpd.h, smtpd/smtpd_sasl_proto.c, smtpd/smtpd_state.c.
+
+20161103
+
+ Cleanup: error reporting for IDNA (non-ASCII domain name)
+ conversion errors. File: util/midna_domain.c.
+
+ Cleanup: non-transitional conversion of UTF8 to/from ASCII
+ domain name labels used in DNS queries. This disables
+ 'transitional' compatibility between IDNA2003 and IDNA2008,
+ and affects some corner cases such as German sz and Greek
+ zeta. Specify "enable_idna2003_compatibility = yes" to
+ restore historical behavior. Files: util/midna_domain.[hc],
+ mantools/postlink, global/mail_params.[hc], proto/postconf.proto,
+ proto/SMTPUTF8_README.html.
20161105
@@ -22291,18 +22567,91 @@ Apologies for any names omitted.
not count a successful rename operation after error recovery.
Problem reported by Markus Schönhaber. File: postsuper/postsuper.c.
+ Cleanup: error reporting for IDNA (non-ASCII domain name)
+ conversion errors, and enable_idna2003_compatibility
+ configuration. File: util/midna_domain.c.
+
+20161106
+
+ Documentation: specify the minimum ICU library version (4.6).
+ File: proto/SMTPUTF8_README.html.
+
+20161109
+
+ Portability: force LC_ALL=C in dict_utf8 test. This should
+ probably be in every shell script.
+
+20161120
+
+ Documentation: clarified the syntax of $name and ${name...}
+ in parameter values, and some wordsmithing. Files:
+ proto/postconf.html.prolog, proto/postconf.man.prolog.
+
+20161123
+
+ Documentation: clarified reject_non_fqdn_{sender,recipient}.
+ The syntax check applies only for domains that are actually
+ specified, not for missing domains. File: proto/postconf.proto.
+
+20161126
+
+ Cleanup: the postfix-install option "-keep-new-mtime" was
+ renamed to "-keep-build-mtime". File: postfix-install.
+
+ Feature: "make makefiles POSTFIX_INSTALL_OPTS=-keep-build-mtime"
+ to set the installed file mtimes to their build time instead
+ of their installation time. Based on code by Ondřej Lysoněk.
+ Wietse added a guard to prevent POSTFIX_INSTALL_OPTS from
+ passing arbitrary options. Files: makedefs, Makefile.in,
+ proto/INSTALL.html.
+
+20161201
+
+ Documentation: add 'smtpd_tls_auth_only=yes' to the master.cf
+ submission service example. File: conf/master.cf.
+
+20161202
+
+ Documentation: typos in postconf(1) manpage. File:
+ postconf/postconf.c.
+
20161204
+ Cleanup: properly report numerical conversion errors in
+ ${{number} relational-operator ${number}}, and wordsmithing.
+ File: util/mac_expand.c.
+
+ Updated auxiliary/collate/collate.pl with Viktor's suggestion
+ in <98D25E24-EAB1-42BB-82FD-794F5DDD4E7F@dukhovni.org> for
+ better tracking of message flows.
+
+ Cleanup: remove tentative features that were implemented
+ before the DANE spec was finalized: support for certificate
+ usage PKIX-EE(1), the ability to disable digest agility
+ (Postfix now behaves as if "tls_dane_digest_agility = on"),
+ and the ability to disable support for "TLSA 2 [01] [12]"
+ records that specify the digest of a trust anchor (Postfix
+ now behaves as if "tls_dane_trust_anchor_digest_enable =
+ yes). Viktor Dukhovni. Files: mantools/postlink,
+ proto/postconf.proto, proto/TLS_README.html, tls/tls.h,
+ tls/tls_dane.c, smtp/smtp.c.
+
Bugfix (introduced: Postfix 3.1): cut-and-paste error in
the "postfix tls deploy-server-cert" command, causing the
wrong certfile and keyfile to be used. Viktor Dukhovni.
File: conf/postfix-tls-script.
Robustness: create a new keyfile when "postfix tls
- new-server-cert" is invoked and main.cf specifies a
+ new-server-cert" is invoked, and main.cf specifies a
non-existent keyfile. Viktor Dukhovni. File:
conf/postfix-tls-script.
+20161205
+
+ Cleanup: log the sender address when rejecting a too large
+ message size in a "MAIL FROM:<sender> SIZE=nnn" command.
+ File: smtpd/smtpd.c.
+
20161206
Bugfix (introduced: Postfix 3.0): when receiving a MAIL
@@ -22310,10 +22659,2015 @@ Apologies for any names omitted.
SMTPUTF8 support before processing smtpd_sender_restrictions.
Problem reported by Viktor Dukhovni. File: smtpd/smtpd.c.
+ Bugfix (introduced: Postfix 3.0): when receiving a
+ VRFY...SMTPUTF8 command, enable SMTPUTF8 support while
+ processing smtpd_recipient_restrictions. File: smtpd/smtpd.c.
+
20161220
Bugfix (introduced: Postfix 2.1.0): the Postfix SMTP daemon
did not query sender_canonical_maps when rejecting unknown
senders with "smtpd_reject_unlisted_recipient = yes" or
with reject_unlisted_sender. Stephen R. van den Berg (Mr.
- procmail). Files: smtpd/smtpd.c, smtpd/smtpd_check.c.
+ procmail). Files: smtpd/smtpd.c, smtpd/smtpd_check.c.
+
+20161217
+
+ Enable elliptic curve negotiation with OpenSSL >= 1.0.2.
+ This changes the default smtpd_tls_eecdh_grade setting to
+ "auto", and introduces a new parameter tls_eecdh_auto_curves
+ with the names of curves that may be negotiated. The default
+ tls_eecdh_auto_curves setting is determined at compile time,
+ and depends on the Postfix and OpenSSL versions. At runtime,
+ Postfix will skip curve names that aren't supported by the
+ OpenSSL library. Viktor Dukhovni. Files: mantools/postlink,
+ proto/FORWARD_SECRECY_README.html, proto/TLS_README.html,
+ proto/postconf.proto, global/mail_params.h, smtpd/smtpd.c,
+ tls/tls.h, tls/tls_client.c, tls/tls_dh.c, tls/tls_misc.c,
+ tls/tls_server.c.
+
+ Feature: stored-procedure support for MySQL databases.
+ John Fawcett. Files: global/dict_mysql.c, proto/mysql_table.
+
+20161223
+
+ Bugfix (introduced: Postfix 3.2 snapshots): the makedefs
+ script produced a garbled CCARGS setting when no suitable
+ ICU library was found. File: makedefs.
+
+20161225
+
+ Cleanup: simplified handling of unsupported curve names in
+ the tls_eecdh_auto_curves parameter value. File: tls/tls_dh.c.
+
+ Cleanup: simplified code structure in the MySQL client
+ support for stored procedures. File: global/dict_mysql.c.
+
+20161226
+
+ Cleanup: more MySQL client code simplification, better error
+ messages, new per-database "require_result_set" parameter
+ (default: yes) which can be set to "no" to avoid the need
+ for dummy SELECT statements in stored procedures. Files:
+ global/dict_mysql.c, proto/mysql_table, postconf/postconf_dbms.c.
+
+ Portability: SSL_CTX_set_ecdh_auto() is part of the deprecated
+ OpenSSL API, so it must be used under #ifdef. Viktor Dukhovni.
+ File: src/tls/tls_dh.c.
+
+20161227
+
+ Safety: the sendmail -C option must specify an authorized
+ configuration directory: the default configuration directory,
+ a directory that is listed in the default main.cf file with
+ alternate_config_directories or multi_instance_directories,
+ or the command must be invoked with root priveleges. This
+ mitigates a problem with the PHP mail() function. Files:
+ global/mail_conf.[hc], sendmail/sendmail.c.
+
+20161228
+
+ Documentation: moved the "BACKWARDS COMPATIBILITY" sections
+ to the end of ldap_table, mysql_table, pgsql_table, and
+ sqlite_table, renamed to "OBSOLETE MAIN.CF PARAMETERS".
+
+20161231
+
+ Bugfix (introduced: 20160521): segfault (null pointer) in
+ cidr, pcre, and regexp table when an input does not match
+ an ENDIF-less IF operator. Found during code maintenance.
+ File: util/cidr_map.c, util/dict_regexp.c, util/dict_pcre.c.
+
+20170101
+
+ Portability; SunOS5 builds broke after moving the sys/types.h
+ include statement to the top of sys_defs.h.
+
+ Portability: declaration after code is GNU dialect. File:
+ util/vbuf_print.c.
+
+ Portability: compatibility macros for SSLv23_client_method()
+ etc. deprecation. Files: tls/tls.h, tls/tls_client.c,
+ tls/tls_dane.c, tls_server.c.
+
+201606-20170108
+
+ Cleanup: handling of address extensions with email addresses
+ that contain spaces. The virtual_alias_maps, canonical_maps,
+ and smtp_generic_maps features now correctly propagate an
+ address extension from "aa bb+ext"@example.com to "cc
+ dd+ext"@other.example, instead of producing broken output.
+
+ Files updated to support conversion between unquoted and
+ quoted address forms, as required for addresses that contain
+ spaces: global/mail_addr_map.*, global/mail_addr_find.* and
+ global/mail_addr_crunch.*.
+
+ Files updated to enable these address conversions to correctly
+ propagate address extensions: cleanup/cleanup_map11.c
+ (canonical_maps), cleanup/cleanup_map1n.c (virtual_alias_maps),
+ and smtp/smtp_generic.c (smtp_generic_maps).
+
+ Files updated to rename functions to better reflect their
+ input and output forms: global/split_addr.*, global/strip_addr.*.
+
+ Files updated to support quoted lookup keys: util/dict_inline.c,
+ util/dict_thash.c, postmap/postmap.c.
+
+ Files updated to invoke a backwards-compatible mail_addr_find()
+ version that disables quoted/unquoted address conversions:
+ smtp/smtp/smtp_sasl_glue.c (smtp_sasl_password_maps),
+ smtpd/smtpd_check.c (SMTP server address validation),
+ cleanup/cleanup_addr.c (sender_bcc_maps and recipient_bcc_maps),
+ virtual/mailbox.c (user-related table lookups),
+ trivial-rewrite/transport.c (transport_maps),
+ trivial-rewrite/resolve.c (sender_dependent_mumble_maps,
+ relocated_maps). These features may be migrated later to
+ enable quoted-form address lookup keys, for consistency
+ with other Postfix features.
+
+20170109
+
+ Cleanup: reduce the number of modified files relative to
+ the last regular release, to make a back-port more feasible.
+ This renames the new mail_addr_find() to mail_addr_find_opt(),
+ and renames the backwards_compatibility mail_addr_find_noconv()
+ to its old name mail_addr_find(). Added backwards-compatible
+ aliases {split,strip}_addr() for {split,strip}_addr_local().
+ To ensure correctness these edits were done mechanically,
+ and verified mechanically.
+
+20170111
+
+ Documentation: when (smtp|lmtp)_delivery_status_filter is
+ applied. File: proto/postconf.proto.
+
+20170114
+
+ Cleanup: careful handling of local-parts that contain '@',
+ as they are converted into quoted form. Files:
+ global/mail_addr_find.*, global/quote_822_local.*,
+ global/quote_flags.*.
+
+ Cleanup: added unit tests for malformed inputs. Files:
+ util/dict_thash{in,ref}.
+
+ Cleanup: minimize the patch size of the quoting fixes, and
+ a preliminary back-port to Postfix 3.1.4.
+
+20170115
+
+ Cleanup: enable "externalized" address lookup by default,
+ with legacy-style "internalized" lookup for backwards
+ compatibility, for sender_bcc_maps, recipient_bcc_maps,
+ smtp_sasl_passwd_maps, smtpd_sender_login_maps, relocated_maps,
+ sender_dependent_mumble_maps, virtual_{mailbox,uid,gid}_maps.
+ File: global/mail_addr_find.c.
+
+ Cleanup: enable "externalized" address lookup by default,
+ with legacy-style "internalized" lookup for backwards
+ compatibility, for transport_maps. Files: global/mail_addr_find.*,
+ trivial-rewrite/transport.*.
+
+ Cleanup: mail_addr_find_() now has a configurable strategy
+ for full and partial address lookup, so that it may also
+ be used for localpart lookup in access maps.
+
+20170116:
+
+ Cleanup: parent domain matching is now implemented in the
+ mail_addr_find() engine. Simplified the transport_maps
+ lookup to just one mail_addr_find_() call. Files:
+ global/mail_addr_find.*, trivial-rewrite/transport.*.
+
+ Cleanup: enabled "externalized" address lookup by default,
+ with legacy-style "internalized" lookup for backwards
+ compatibility, for check_sender_access and check_recipient_access.
+ This now uses 'user@' lookup support in the mail_addr_find()
+ engine. File: global/mail_addr_find.*, smtpd/smtpd_check.c.
+
+20170122
+
+ Cleanup: separated the database query form from the address
+ form that is input to mail_addr_find_() or mail_addr_map*(),
+ in attempt to make code more obviously correct. Files:
+ global/mail_addr_find.c, global/mail_addr_map.c.
+
+ Abandoned an experiment that used internal-form queries for
+ all maps, because it would be very difficult to test. The
+ tests inputs would have to compensate for multiple levels
+ of unquoting by postmap, C compilers, or shell interpreters.
+
+ Cleanup: moved the backwards-compatibility lookup strategy
+ (try the external address form first, then the internal
+ address form if it is different) inside the loop that
+ iterates over full and partial address forms. File:
+ global/mail_addr_find.c.
+
+20170125
+
+ Cleanup: mail_addr_find test scripting. Eliminate main.cf
+ dependencies, and allow all tests to run in one process.
+ Files: global/mail_addr_find.*
+
+20170127
+
+ Cleanup: mail_addr_find and mail_addr_form named constants.
+ Files: global/mail_addr_form.h, mail_addr_find.h, and
+ dependents.
+
+20170128
+
+ Cleanup: smtp_generic_maps implementation. Reduced the
+ number of internal<->external form address conversions,
+ added more rigorous tests, and eliminated the main.cf and
+ trivial-rewrite dependencies. Files: smtp_map11.*.
+
+20170129
+
+ Cleanup: bogus UTC timezone setting for postqueue/mailq
+ command output, and other environment settings for root and
+ non-root users in set-gid programs. File: postqueue/postqueue.c
+ (enforce import_environment name=value overrides for root
+ users), util/msg_syslog_init.c (don't override non-existent
+ TZ settings with UTC), util/unsafe.c (exclude uid==0, euid==0
+ super-user from privilege escalation concerns).
+
+20170131
+
+ Cleanup: more complete VALGRIND coverage for test build targets
+ and scripts. Files: postalias/fail_test.in, postmap/fail_test.in,
+ postmap/quote_test.in, util/dict_pipe_test.in,
+ util/dict_union_test.in, util/dict_utf8_test.in.
+
+
+20170201
+
+ Portability: unsetenv() for ancient platforms. File:
+ makedefs, util/sys_compat.c.
+
+20170205
+
+ Cleanup: security checks for config_directory overrides.
+ File: global/mail_conf.c.
+
+ Cleanup: enforce import_environment name=value settings in
+ command-line utilities, for consistency with Postfix daemons (but
+ without removing environment variables). This is not enforced
+ in the postconf command which must be able to process main.cf
+ files with incomplete settings. Files: postalias/postalias.c,
+ postcat/postcat.c, postkick/postkick.c, postlock/postlock.c,
+ postlog/postlog.c, postmap/postmap.c, postsuper/postsuper.c,
+ posttls-finger/posttls-finger.c, sendmail/sendmail.c,
+ util/clean_env.[hc].
+
+20170206
+
+ Bugfix (introduced: Postfix 3.0): check_mumble_a_access
+ did not handle [ipaddress], unlike check_mumble_mx_access.
+ When check_mumble_a_access was introduced, some condition
+ was not updated. Reported by James (postfix_tracker). File:
+ smtpd/smtpd_check.c.
+
+20170207
+
+ Cleanup: rephrased paranoia precondition. File: global/mail_conf.c.
+
+20170211
+
+ Cleanup: rephrased paranoia precondition. File: util/unsafe.c.
+
+20170218
+
+ Cleanup: typofixes from klemens. The only change in compiled
+ code is in one identical mysql error message that also
+ appears in the pgsql client. Files: about 50.
+
+20170221
+
+ Compatibility fix (introduced: Postfix 3.1): some Milter
+ applications do not recognize macros sent as {name} when macros
+ have single-character names. Postfix now sends such macros
+ without {} as it has done historically. Viktor Dukhovni. File:
+ milter/milter.c.
+
+20170228
+
+ Documentation: re-word scary warnings at the top of SASL_README
+ and TLS_README.
+
+20170402
+
+ Bugfix (introduced: Postfix 3.2): restore the SMTP server
+ receive override options at the end of an SMTP session,
+ after the options may have been modified by an smtpd_milter_maps
+ setting of "DISABLE". Problem report by Christian Rößner,
+ root cause analysis by Viktor Dukhovni. File: smtpd/smtpd.c.
+
+20170430
+
+ Safety net: append a null byte to vstring buffers, so that
+ C-style string operations won't scribble past the end. File:
+ vstring.[hc].
+
+20170505
+
+ Workaround for a current problem where some destination
+ announces primarily IPv6 MX addresses, the smtp_address_limit
+ eliminates most or all IPv4 addresses, and the destination
+ is not reachable over IPv6. This workaround is enabled with
+ "smtp_balance_mx_inet_protocols = yes", which is the default.
+ Files: smtp/smtp.c, smtp/smtp_params.c, smtp/smtp_addr.c,
+ global/mail_params.h, proto/postconf.proto.
+
+20170506
+
+ A last-minute cosmetic fix had introduced a bug in
+ smtp/smtp_addr.c.
+
+20170512
+
+ Bugfix (introduced: Postfix 2.0): the MIME nesting level
+ counter was not initialized (i.e. left at the memory fill
+ pattern 0xffffffff which equals -1). This broke unit tests
+ with a different memory allocator. Changing the value to
+ zero would break backwards compatibility (reject mail that
+ was previously not rejected). Files: global/mime_state.c.
+
+20170531
+
+ Bugfix (introduced: Postfix 3.2): after the table lookup
+ overhaul, the check_sender_access and check_recipient_access
+ features ignored the parent_domain_matches_subdomains
+ setting. Reported by Henrik Larsson. File: smtpd/smtpd_check.c.
+
+ Workaround (introduced: Postfix 3.2): mail_addr_find() logs
+ a warning that it does not support both parent-domain and
+ dot-parent-domain style lookups in the same call. File:
+ global/mail_addr_find.c
+
+20170610
+
+ Workaround (introduced: Postfix 3.0 20140718): prevent MIME
+ downgrade of Postfix-generated message/delivery-status.
+ It's supposed to be 7bit, therefore quoted-printable encoding
+ is not expected. Problem reported by Griff. File:
+ bounce/bounce_notify_util.c.
+
+ Documentation: indicate that the transport_mumble parameters
+ are implemented by the queue manager, not by delivery agents.
+ Files: mantools/postlink, local/local.c, pipe/pipe.c,
+ *qmgr/qmgr.c, smtp/smtp.c, virtual/virtual.c.
+
+20170611
+
+ Security: Berkeley DB 2 and later try to read settings from
+ a file DB_CONFIG in the current directory. This undocumented
+ feature may introduce undisclosed vulnerabilities resulting
+ in privilege escalation with Postfix set-gid programs
+ (postdrop, postqueue) before they chdir to the Postfix queue
+ directory, and with the postmap and postalias commands
+ depending on whether the user's current directory is writable
+ by other users. This fix does not change Postfix behavior
+ for Berkeley DB < 3, but reduces file create performance
+ for Berkeley DB 3 .. 4.6. File: util/dict_db.c.
+
+20170617
+
+ Cleanup: the postconf command warns about unknown parameter
+ names in a database configuration file, specified as an
+ absolute pathname (for example, ldap:/path/to/file). This
+ code was mostly written in January 2017, and it still is a
+ partial implementation. Files: postconf/postconf_dbms.c,
+ postconf/Makefile.in, postconf/test66.ref.
+
+20170618
+
+ Cleanup: added missing "defined(__GLIBC__)" guards for
+ GLIBC version tests. File: util/sys_defs.h.
+
+20170620
+
+ Bugfix (introduced: Postfix 3.2) extension propagation was
+ broken with "recipient_delimiter = .". This change reverts
+ a change that was trying to be too clever. Files:
+ global/mail_adr_crunch.c, global/mail_addr_crunch.ref.
+
+20170704
+
+ Typos (introduced: Postfix 2.10): in comments about
+ IPv4-in-IPv6 addresses, replace :ffff::1.2.3.4 with the
+ correct form ::ffff:1.2.3.4. Incorrect or misleading comments
+ are worse than no comments. Files: smtpd/smtpd_haproxy.c,
+ postscreen/postscreen_haproxy.c.
+
+20170721
+
+ Bitrot: updated postconf LDAP database configuration check with
+ SASL and TLS-related parameters. Reported by Ralf Hildebrandt.
+ File: postconf/postconf_dbms.c.
+
+20170722
+
+ Cleanup: don't log the 'delay_dotcrlf' workaround for CISCO
+ PIX bugs before the smtp_pix_workaround_threshold_time has
+ passed. Reported by Ralf Hildebrandt. File: smtp/smtp_proto.c.
+
+20170727
+
+ Cleanup: the postconf command now uses mechanically-generated
+ lists of DBMS parameter names. This eliminates false positives
+ with mysql databases. Files: postconf/Makefile.in,
+ postconf/extract_cfg.sh, postconf/postconf_dbms.c.
+
+ Cleanup: removed `#if 0/#endif' dead code from dict_ldap.c,
+ to avoid spurious output from the extract_cfg.sh parameter name
+ extraction tool.
+
+20170728
+
+ Documentation: added warnings that "enable_original_recipient
+ = no" prevents Postfix <= 3.2 from saving the address
+ verification result under the original probe destination
+ address, if it is changed by aliasing or canonical mapping.
+ Files: proto/ADDRESS_VERIFICATION_README.html,
+ proto/postconf.proto.
+
+ Cleanup: don't store an empty address in the verify cache
+ (this could happen with "enable_original_recipient = no").
+ File: global/verify.c.
+
+20170729
+
+ Cleanup: the setting "enable_original_recipient = no" no
+ longer breaks address verification for aliased addresses.
+ This does not change the behavior of the X-Original-To
+ header and of recipient deduplication. The fix is to always
+ store the original recipient in queue files. Some other
+ changes were needed to move ownership of the var_enable_orcpt
+ parameter from the cleanup daemon to the global library.
+ Files: cleanup/cleanup_init.c, cleanup/cleanup_milter.c,
+ cleanup_out_recipient.c, global/mail_params.c, global/mail_copy.c,
+ proto/postconf.proto proto/ADDRESS_VERIFICATION_README.html,
+ local/local.c, virtual/virtual.c, pipe/pipe.c.
+
+20170730
+
+ Bugfix (introduced: yesterday): revert global/verify.c code
+ to always store the verify result under the original address,
+ and to conditionally store it under the rewritten address.
+ File: global/verify.c.
+
+20170827
+
+ Safety: in vstream_buf_space(), add a sanity check to reject
+ negative request sizes, instead of letting the program fail
+ later. File: util/vstream.c
+
+ Bugfix: in tests that enable the VSTRING_FLAG_EXACT flag,
+ vstring_buf_put_ready() could fail to extend the buffer,
+ causing infinite recursion in VBUF_PUT(). File: util/vstring.c.
+
+20170830
+
+ Bugfix: in vbuf_print(), save the parser-produced format
+ string before calling msg_panic(), so that the panic message
+ will not display its own format string. File: util/vbuf_print.c.
+
+20170831
+
+ Undefined behavior (introduced Postfix 1.0): after subtracting
+ a larger unsigned integer from a smaller one, do not assign
+ the result to a signed integer. File: postqueue/showq_compat.c.
+
+20170910
+
+ Safety: restore sanity checks for dynamically-specified
+ width and precision in format strings (%*, %.*, and %*.*).
+ These checks were lost with the Postfix 3.2 rewrite of
+ the vbuf_print formatter. File: vbuf_print.c.
+
+ Bugfix (introduced: postfix-alpha): improve the 'fatal:
+ invalid option' message to show the optopt value instead of
+ the getopt() result. Files: master/*server.c.
+
+20170923
+
+ Bugfix (introduced: Postfix 3.2): panic in the postqueue
+ command after output write error while listing the queue.
+ This change restores a write error check that was lost with
+ the Postfix 3.2 rewrite of the vbuf_print formatter.
+ Problem reported by Andreas Schulze. File: util/vbuf_print.c.
+
+20170924
+
+ Cleanup: terminate early after output write error. Files:
+ showq/show_compat.c, showq/show_json.c.
+
+20171009
+
+ Bugfix (introduced: Postfix 3.1): DANE support. Postfix
+ builds with OpenSSL 1.0.0 or 1.0.1 failed to send email to
+ some sites with "TLSA 2 X X" records associated with an
+ intermediate CA certificate. Problem report and initial
+ fix by Erwan Legrand. File: src/tls/tls_dane.c.
+
+20171024
+
+ Bugfix (introduced: Postfix 3.0) missing dynamicmaps support
+ in the Postfix sendmail command broke authorized_submit_users
+ with a dynamically-loaded map type. File: sendmail/sendmail.c.
+
+20171116
+
+ Bugfix (introduced: Postfix 2.1): don't log warnings
+ that some restriction returns OK, when the access map
+ DISCARD feature is in effect. File: smtpd/smtpd_check.c.
+
+20171209
+
+ Documentation: the effects of owner_request_special and
+ reset_owner_alias on alias expansion. Files: proto/aliases,
+ proto/postconf.proto.
+
+20171215
+
+ Bugfix (introduced: 20170611): the DB_CONFIG bugfix broke
+ Berkeley DB configurations with a relative pathname. File:
+ util/dict_db.c.
+
+20171218
+
+ Workaround: reportedly, some res_query(3) implementation
+ can return -1 with h_errno==0. Instead of terminating with
+ a panic, the Postfix DNS client now logs a warning and sets
+ h_errno to TRY_AGAIN. File: dns/dns_lookup.c.
+
+ Cleanup: allow XCLIENT before STARTTLS, when TLS is required.
+ File: smtpd/smtpd.c.
+
+20171219
+
+ Feature: preliminary support to run Postfix in the foreground.
+ This requires that multi-instance support is disabled.
+ Files: conf/postfix-script, postfix/postfix.c.
+
+20171223
+
+ Feature: Milters can now send RET and ENVID arguments in
+ SMFIR_CHGFROM requests. Files: cleanup/Makefile.in,
+ cleanup/cleanup.h, cleanup/cleanup_envelope.c,
+ cleanup/cleanup_milter.c, cleanup/cleanup_milter.in13h,
+ cleanup/cleanup_milter.in13i, cleanup/cleanup_milter.ref13c,
+ cleanup/cleanup_milter.ref13d, cleanup/cleanup_milter.ref13f,
+ cleanup/cleanup_milter.ref13g, cleanup/cleanup_milter.ref13h,
+ cleanup/cleanup_milter.ref13i, cleanup/cleanup_state.c,
+ cleanup/test-queue-file13h, cleanup/test-queue-file13i,
+ oqmgr/qmgr_message.c, qmgr/qmgr_message.c.
+
+20171226
+
+ Documentation patches by Sven Neuhaus. Files:
+ proto/FORWARD_SECRECY_README.html, proto/MILTER_README.html,
+ proto/SMTPD_ACCESS_README.html.
+
+20171227
+
+ Feature: postgresql:// URI support by Magosányi Árpád.
+ Files: global/dict_pgsql.c, proto/pgsql_table.
+
+ Cleanup: added employer attributions for non-trivial changes
+ after Wietse changed employers.
+
+20180106
+
+ Compatibility: with compatibility_level < 1, the SMTP server
+ now warns for mail that would be blocked by the Postfix
+ 2.10 smtpd_relay_restrictions feature. This extends the
+ safety net for sites that upgrade from earlier Postfix
+ versions (questions on the postfix-users list show a steady
+ trickle). Files: proto/COMPATIBILITY_README.html,
+ global/mail_params[hc], smtpd/smtpd_check.c.
+
+ Cleanup: reset compatibility_level warnings after 'postfix
+ reload'. This is relevant primarily for the master daemon.
+ File: global/mail_params.c.
+
+ Cleanup: missing mailbox seek-to-end error check in the
+ local(8) delivery agent. File: local/mailbox.c.
+
+ Cleanup: incorrect mailbox seek-to-end error message in the
+ virtual(8) delivery agent. File: virtual/mailbox.c.
+
+20180107
+
+ Cleanup: Postfix-generated From: headers with 'full name'
+ information are now formatted as "From: name <address>" by
+ default. Specify "header_from_format = obsolete" for the
+ earlier form "From: address (name)". Files: proto/postconf.proto,
+ cleanup/cleanup.h, cleanup_init.c, cleanup_message.c,
+ mail_params.h.
+
+20180113
+
+ Bugfix: "postconf -M" commands did not warn about unused
+ name=value settings in master.cf. File: postconf/postconf.c.
+
+ Bugfix: "postconf -xM" now expands $process_name using the
+ daemon file name in master.cf, instead of the "postconf"
+ command process name. Files: postconf/postconf.h,
+ postconf/postconf_lookup.c, postconf/postconf_master.c.
+
+ Feature: read-only service_name parameter that contains the
+ master.cf service name. This allows, for example, setting
+ the syslog_name with "-o syslog_name=postfix/$service_name"
+ for the "submission" and "smtps" services. Files:
+ proto/postconf.proto global/mail_params.h, global/mail_params.c,
+ master/single_server.c, master/multi_server.c,
+ master/trigger_server.c, master/event_server.c,
+ postconf/postconf_master.c, postconf/postconf_builtin.c,
+ and daemon manpages.
+
+20180114
+
+ Paranoia: censor the postqueue process name, similar to the
+ set-gid postdrop program. File: postqueue/postqueue.c.
+
+ Cleanup: the new "service_name" parameter is applicable
+ only to Postfix daemons configured in master.cf; hyperlink
+ the parameter name in documentation. Files: proto/postconf.proto,
+ mantools/postlink, daemon manpages.
+
+ Cleanup: allow whitespace between $[{(], parameter name,
+ and [:?)}]. This allows making complex expressions more
+ readable with line breaks. File: util/mac_expand.c.
+
+ Cleanup: don't initialize the service_name parameter with
+ the process_name value. Files: postconf/postconf.[hc],
+ postconf/postconf_builtin.c.
+
+20180121
+
+ Bugfix (introduced: 20180106): too many arguments for format
+ string. File: local/mailbox.c.
+
+20180128
+
+ Documentation: the tcp_table(5) manpage now documents the
+ absence of substring lookups. File: proto/tcp_table.
+
+20180203
+
+ Licence: in addition to the historical IBM Public License
+ 1.0, this software is now also distributed with the more
+ recent Eclipse Public License 2.0. Recipients can choose
+ to take the software under the license of their choice.
+ Those who are more comfortable with the IPL can continue
+ with that license. File: LICENSE.
+
+20180217
+
+ Cleanup: added 22 missing *_maps parameters to the default
+ proxy_read_maps setting. Files: global/mail_params.h,
+ mantools/missing-proxy-read-maps.
+
+20180218
+
+ Cleanup: back-ported the missing-proxy-read-maps script to
+ older Postfix releases, and added error checks. Undid some
+ of the 20180217 changes in mail_params.h that are no longer
+ needed.
+
+ Bugfix (introduced: 20120117): postconf should scan only
+ built-in or service-defined parameters for ldap, *sql, etc.
+ database names. Problem reported by Christian Rößner. Files:
+ postconf/postconf_user.c.
+
+20180224
+
+ Workaround: postconf build did not abort if the m4 command
+ is not installed (on a system that does have the make command,
+ the awk command, the perl command, and the C compiler?!).
+ File: postconf/extract_cfg.sh.
+
+20180303
+
+ Portability: slight differences between MySQL and MariaDB.
+ Olli Hauer. File: global/dict_mysql.c.
+
+20180306
+
+ Bugfix (introduced: 19990302): when luser_relay specifies
+ a non-existent local address, the luser_relay feature becomes
+ a black hole. Reported by Jørgen Thomsen. File: local/unknown.c.
+
+ Portability: FreeBSD 11 is supported. Files: makedefs,
+ util/sys_defs.h.
+
+20180403
+
+ Containers: "postfix start-fg" will now attempt to run the
+ master daemon as PID 1, and "postfix stop" will use a
+ stronger signal if the master does not stop. Files:
+ conf/postfix-script, master/master.c, master/master_sig.c,
+ postfix/postfix.c.
+
+20180404
+
+ Containers: "postfix start-fg" running as PID=1 will now
+ properly terminate after "postfix stop". With assistance
+ from Andreas Schulze and Eray Aslan. Files: master/master.c,
+ master/master.h, master/master_sig.c.
+
+20180421
+
+ Documentation: in the protocol description mention early
+ on that a policy server must not close the connection unless
+ there is an error. File: proto/SMTPD_POLICY_README.html.
+
+20180422
+
+ Undocumented: when running in PID=1 mode on Linux, a signal
+ won't be delivered unless the process specifies a handler.
+ Conveniently, _exit() can be used directly as a signal
+ handler. This changes the wait status that a parent would
+ see, but in the case of PID=1 mode on Linux, no-one would
+ care. Viktor Dukhovni. File: util/killme_after.c.
+
+ Bugfix (introduced: Postfix 2.8): missing tls_server_start()
+ error propagation in tlsproxy(8) resulting in segfault after
+ TLS handshake error. Found during code maintenance. File:
+ tlsproxy/tlsproxy.c.
+
+ Connection reuse for TLS-encrypted SMTP sessions. This is
+ work-in-progress, #ifdef USE_TLSPROXY, to avoid contamination
+ of existing code.
+
+ The idea is to have smtp(8) talk plaintext while tlsproxy(8)
+ converts between local plaintext and remote ciphertext.
+ Then, smtp(8) can save plaintext connections to the cache,
+ and scache(8) holds the handles to the tlsproxy(8) processes.
+
+ This preliminary implementation does not yet support proxying
+ of DANE attributes from smtp(8) to tlsproxy(8). tlsproxy(8)
+ does not have permissions to read private key files that
+ smtp(8) can read. And the name of a connection cache entry
+ does not yet depend on whether the cached connection uses
+ TLS, nor does it depend on DANE information.
+
+ Files: global/mail_proto.h, postscreen/postscreen_starttls.c,
+ posttls-finger/posttls-finger.c, smtp/smtp.c, smtp/smtp.h,
+ smtp/smtp_params.c, smtp/smtp_proto.c, smtp/smtp_session.c,
+ smtpd/smtpd.c, tls/tls.h, tls/tls_client.c, tls/tls_proxy.h,
+ tls/tls_proxy_client_init_print.c,
+ tls/tls_proxy_client_init_scan.c,
+ tls/tls_proxy_client_start_print.c,
+ tls/tls_proxy_client_start_scan.c, tls/tls_proxy_clnt.c,
+ tls/tls_proxy_context_print.c, tls/tls_proxy_context_scan.c,
+ tls/tls_proxy_server_init_print.c,
+ tls/tls_proxy_server_init_scan.c,
+ tls/tls_proxy_server_start_print.c,
+ tls/tls_proxy_server_start_scan.c, tlsproxy/tlsproxy.c,
+ tlsproxy/tlsproxy.h, tlsproxy/tlsproxy_state.c, util/argv_attr.h,
+ util/argv_attr_print.c, util/argv_attr_scan.c.
+
+20180425
+
+ Cleanup: dnsblog proccesses now retire voluntarily after
+ max_use*max_idle seconds. Files: master/mail_server.h,
+ master/single_server.c, dnsblog/dnsblog.c.
+
+20180429
+
+ Documentation: smtpd_relay_restrictions was incorrectly
+ listed before smtpd_recipient_restrictions. File:
+ proto/SMTPD_ACCESS_README.html.
+
+20180509
+
+ Bugfix (introduced: 20170617): postconf(1) command segfault
+ if unable to open a Postfix database configuration file due
+ to a file permission error. Report by Andreas Hasenack, fix
+ by Viktor Dukhovni. File: postconf/postconf_dbms.c.
+
+20180519
+
+ Documentation: updated descriptions of PID 1 mode in manpages
+ and source-code comments. Files: postfix/postfix.c,
+ master/master.c, master/master_sig.c, util/killme_after.c.
+
+ Documentation: document non-iterative lookup behavior
+ in postmap(1) and postalias(1) manpages. Files: postmap/postmap.c,
+ postalias/postalias.c.
+
+ Cleanup: the init-mode change should not forbid the combined
+ use of -D, -d and -w. File: master/master.c.
+
+20180520
+
+ Documentation: add backscatter remediation to the virtual(5)
+ and canonical(5) manpages. Files: proto/virtual, proto/canonical.
+
+ Bugfix (introduced: 20180425): broken implementation of
+ voluntary dnsblog retirement after max_use*max_idle seconds.
+ File: master/single_server.c.
+
+20180531
+
+ Documentation: bash syntax to eliminate or view default
+ settings in "postconf -n" output. File: postconf/postconf.c.
+ Contributed by various postfix-users list members.
+
+20180603
+
+ TLS reuse: serializer/deserializer support for TLS_DANE and
+ related data structures. Files: tls/tls_proxy_client_print.c,
+ tls/tls_proxy_client_scan.c, tls/tls_proxy.h, util/argv_attr.h,
+ util/argv_attr_print.c, util/argv_attr_scan.c.
+
+ TLS reuse: posttls-finger -X test flag for quick tests.
+ File: posttls-finger/posttls-finger.c.
+
+ TLS reuse: smtp_use_tlsproxy boolean parameter. This is a
+ preliminary implementation that should support override via
+ smtp_tls_policy_maps. Files: smtp.c, smtp_connect.c,
+ smtp_params.c, smtp_proto.c, smtp_session.c.
+
+ TLS reuse: the SMTP client now includes the requested TLS
+ security level in the scache(8) key.
+
+ TLS reuse: address-based reuse is allowed only for TLS
+ levels that require no certificate checks. Perhaps it still
+ makes sense to save such sessions for reuse by less sensitive
+ deliveries. Files: smtp/smtp.h smtp/smtp_reuse.c.
+
+20180604
+
+ TLS reuse: smtp_tls_connection_reuse boolean parameter, and
+ corresponding override with "connection_reuse" boolean
+ attribute in smtp_policy_maps. Files: global/mail_params.h,
+ smtp.c, smtp.h, smtp_params.c, smtp_proto.c, smtp_session.c,
+ smtp_tls_policy.c. proto/postconf.proto. mantools/postlink.
+
+20180605
+
+ TLS reuse: updated TLS_README and CONNECTION_CACHE_README,
+ added comments in tlsproxy.c to explain why it works.
+
+20180617
+
+ Bugfix (introduced: Postfix 2.11): minor memory leak when
+ minting issuer certs. This affects a tiny minority of use
+ cases. Fix by Viktor Dukhovni, based on a fix by Juan
+ Altmayer Pizzorno for Viktor's ssl_dane library.
+
+ Cleanup: support for longer timeouts after the TLS handshake,
+ so that the tlsproxy server won't time out too soon, while
+ the SMTP client waits for the end-of-data response. This
+ tlxproxy timeout is a redundant safety feature for the case
+ that the SMTP client does not enforce the SMTP-level time
+ limit. Files: tls/tls_proxy.h, tls/tls_proxy_clnt.c,
+ tlsproxy/tlsproxy.c, posttls-finger/posttls-finger.c,
+ postcreen/postscreen_starttls.c, smtp/smtp_proto.c.
+
+ Cleanup: earlier purging of unexpected plaintext. Files:
+ posttls-finger/posttls-finger.c, smtp/smtp_proto.c.
+
+ Release: first production snapshot with multiple outbound
+ deliveries per TLS-encrypted connection.
+
+20180618
+
+ Quick tlsproxy workaround: after the remote TLS peer shuts
+ down TLS, allow unsent inbound plaintext to trickle out
+ before tearing down the proxied connection. This addresses
+ a sporadic "lost connection after end-of-data" error in the
+ Postfix SMTP client, and addresses a sporadic "lost connection
+ after sending QUIT" error with "posttls-finger -X". File:
+ tlsproxy/tlsproxy.c.
+
+20180619
+
+ Segfault: don't lookup the TLS security level for nexthop-based
+ connection cache storage keys. The combination of (service,
+ nexthop, etc.) should be stable enough over the time range
+ of interest, and the policy is still enforced on an individual
+ connection to an MX host, before that connection is stored
+ under a nexthop- or host-based storage key. Files:
+ smtp/smtp_connect.c, smtp/smtp.h.
+
+20180620
+
+ TLS connection reuse: save and restore the TLS level for a
+ reused connection, so that the reused connection will be
+ saved under a key that matches the connection's original
+ TLS level. This was not a problem for destinations that
+ require certificate verification, because we currently reuse
+ connections that require certificate checks only if they
+ are looked up by their nexthop destination. File:
+ smtp/smtp_session.c.
+
+ TLS connection reuse: with TLS level > encrypt, prohibit
+ sharing of the same connection endpoint under different
+ nexthops, by making the nexthop part of the endpoint-based
+ connection cache lookup key. File: smtp/smtp.h.
+
+20180623
+
+ TLS connection reuse: replaced random logic with TLS_MUST_MATCH()
+ when deciding under what conditions an authenticated
+ connection may be reused. Files: smtp/smtp_proto.c,
+ smtp/smtp.h.
+
+ TLS connection reuse: a tlsproxy(8) process will retire
+ after max_idle*max_use, or some sane constant if either is
+ set to zero. Files: master/event_server.c, tlsproxy/tlsproxy.c.
+
+ Documentation: automatic retirement. File: master/single_server.c.
+
+ Documentation: the connection caching limitation for SMTP
+ over TLS is now obsolete. File: proto/CONNECTION_CACHE_README.html.
+
+20180701
+
+ Incompatibility: the tlsproxy(8) daemon now requires a zero
+ process limit in master.cf (this setting is provided with
+ the default master.cf file). See RELEASE_NOTES for how to
+ change the tlsproxy process limit. File: tlsproxy/tlsproxy.c.
+
+20180707
+
+ Bugfix (introduced: Postfix 3.0): with smtputf8_enable=yes,
+ table lookups could casefold the search string when searching
+ a lookup table that does not use fixed-string keys (regexp,
+ pcre, tcp, etc.). Historically, Postfix would not case-fold
+ the search string with such tables. File: util/dict_utf8.c.
+
+ Cleanup: removed unimplemented VSTRING support to enforce
+ a buffer size limit (by returning an error of sorts). In
+ practice, the limit was enforced in smtp_get(). Also made
+ the VSTRING inplementation more VSTREAM-compatible. Files:
+ util/vstring.[hc], posttls-finger/posttls-finger.c,
+ smtpstone/smtp-source.c.
+
+ Cleanup: unused variable. File: postqueue/postqueue.c.
+
+ Feature: VSTREAM support to "open" a VSTRING for read, write
+ or append mode, enabling the reuse of existing stream-based
+ code to serialize/deserialize Postfix data structures to/from
+ memory. File: vstream.[hc].
+
+ Cleanup: "make manpages" now generates a makedefs(1) manpage
+ for publication on the web. Also cleaned up some makedefs(1)
+ content. Files: man/Makefile.in, man/man1/makedefs.1,
+ html/Makefile.in, html/makedefs.1.html.
+
+20180708
+
+ Cleanup: VSTREAM support to "open" a VSTRING: added
+ vstream_ftell() support; documented what changes are needed
+ before this can support vstream_fseek(), without breaking a
+ VSTRING during vstream_fflush(); added a simple 'allow'
+ filter for vstream_control() requests; added a unit test.
+ File: util/vstream.c.
+
+20180812
+
+ Feature: smtpd_reject_footer_maps (as well as the postscreen
+ variant postscreen_reject_footer_maps). This is indexed
+ with the SMTP server response text, and overrides the footer
+ specified with smtpd_reject_footer. Files: global/mail_params.h,
+ mantools/postlink, postscreen/postscreen.c,
+ postscreen/postscreen_send.c, postscreen/postscreen_smtpd.c,
+ proto/postconf.proto, smtpd/smtpd.c, smtpd/smtpd_chat.c.
+
+ Minor wordsmithing. File: makedefs.
+
+20180823
+
+ Bugfix (introduced: 20180812): postscreen_send.c did not
+ build without warnings. Viktor Dukhovni.
+
+20180824
+
+ Cleanup: with SMTPUTF8 turned off, the MySQL and PgSQL maps
+ accept only well-formed UTF-8 queries, and return NOT FOUND
+ otherwise. This was in introduced in Postfix 3.0 for LDAP
+ and SQLite, with no complaints coming forth. Files:
+ global/dict_mysql.c, global/dict_pgsql.c.
+
+20180805-20180825 Chunking support
+
+ Cleanup: vbuf_get() now sets the EOF flag, so that reading
+ from a VSTRING stream works as expected. File: util/vbuf.c.
+
+ Cleanup: added an append-mode flag to functions that read
+ a VSTRING from a stream. The historical APIs are preserved
+ in the form of aliases. Files: util/vstring_vstream.[hc],
+ global/smtp_stream.[hc].
+
+ SMTP server support for CHUNKING (BDAT) per RFC 3030. The
+ SMTP server is the only program that knows the difference
+ between mail received with BDAT or DATA. Both use the same
+ smtpd_data_restrictions and smtpd_end_of_data_restrictions,
+ both send one Milter DATA event per mail transaction, and
+ both send one DATA command ending in <CR><LF>.<CR><LF>
+ to an smtpd_proxy_filter. Files: global/ehlo_mask.h,
+ global/smtp_stream.c, global/smtp_stream.c, global/smtp_stream.h,
+ postscreen/postscreen_smtpd.c, smtpd/smtpd.c, smtpd/smtpd.h,
+ smtpd/smtpd_chat.c, smtpd/smtpd_chat.h, smtpd/smtpd_state.c.
+
+ Cleanup: the postscreen(8) daemon now hangs up after receiving
+ the DATA command. Justification: it should never receive DATA
+ from a legitimate client, because 1) postscreen(8) rejects all
+ recipients, and 2) postscreen(8) does not announce PIPELINING.
+ This makes postscreen(8) DATA and BDAT behavior more
+ consistent. File: postscreen/postscreen_smtpd.c.
+
+ BDAT final touches: report accurate BDAT byte counts after
+ timeout or lost connection; send DATA instead of BDAT in
+ policy delegation protocol. Files: smtpd/smtpd.[hc],
+ smtpd/smtpd_check.c.
+
+ BDAT final touches: if the BDAT EHLO announcement is disabled,
+ then smtpd(8) and postscreen(8) will not accept BDAT commands.
+ Files: smtpd/smtpd.c, postscreen/postscreen_smtpd.c.
+
+20180826
+
+ Cleanup: with GSSAPI, the Postfix SMTP client's initial
+ SASL response may be as large as 12288 bytes. When the "AUTH
+ <method> <initial-response>" command would exceed the SMTP
+ command length of 512 bytes, send the initial response
+ during the SASL dialog. Viktor Dukhovni. File:
+ smtp/smtp_sasl_glue.c.
+
+ Cleanup: prepare the Postfix SMTP server needs to receive
+ SASL responses that exceed the line_length_limit value.
+ This introduces a new parameter smtpd_sasl_response_limit
+ (default: 12288). Viktor Dukhovni. Files: mantools/postlink,
+ proto/postconf.proto, global/mail_params.h, smtpd/smtpd.c,
+ smtpd/smtpd_chat.c, smtpd/smtpd_chat.h, smtpd/smtpd_sasl_glue.c.
+
+20180827
+
+ Miscellaneous documentation updates, and a correction in
+ the byte count for sending a large SASL initial response.
+
+20181014
+
+ Cleanup: figured out why vstring_get() did not return
+ VSTREAM_EOF in APPEND mode. File: util/vstring_vstream.c.
+
+20180903
+
+ Bugfix (introduced: 20180825): postscreen falsely claimed
+ that the remote SMTP client was pipelining after sending
+ BDAT. Found by Ralf Hildebrandt. File:
+ postscreen/postscreen_smtpd.c.
+
+20180904
+
+ Bugfix (introduced: 20180812): parameter name error
+ (postscreen_reject_footer should have been
+ postscreen_reject_footer_maps). Noel Jones (finder) and
+ Viktor Dukhovni (fixer).
+
+20181104
+
+ Multiple 'bit rot' fixes for OpenSSL API changes, including
+ support to disable TLSv1.3, to avoid issuing multiple session
+ tickets, and to allow OpenSSL >= 1.1.0 run-time micro version
+ bumps without complaining about library version mismatches.
+ Viktor Dukhovni. Files: proto/postconf.proto,
+ proto/TLS_README.html, tls/tls.h, tls/tls_dane.c,
+ tls/tls_server.c, tls/tls_misc.c
+
+20181105
+
+ Feature: "postmap -F" reads a source file with (key, filename)
+ entries, and creates database records with (key, base64-encoded
+ filecontent). This feature will be used for SNI lookup
+ table support, where each key will be a domainname, and
+ each value will contain a sequence of (private key, certificate
+ hierarchy) for that domainname. The same 'value is filename'
+ behavior is implemented in cidr:, inline:, pcre:, randmap:,
+ regexp:, and static: maps if the application sets the flag
+ DICT_FLAG_RHS_IS_FILE. In the forseeable future, this will
+ be used for specific TLS features. Files: postmap/postmap.c,
+ util/dict.c, util/dict.h, util/dict_cidr.c, util/dict_file.c,
+ util/dict_inline.c, util/dict_pcre.c, util/dict_random.c,
+ util/dict_regexp.c, util/dict_static.c.
+
+20181106
+
+ Bugfix (introduced: 3.0): smtpd_discard_ehlo_keywords could
+ not disable "SMTPUTF8". because the lookup table was using
+ "EHLO_MASK_SMTPUTF8" instead. File: global/ehlo_mask.c.
+
+ Documentation: the postmap(1) manpage no longer refers to
+ compatibility with Sendmail's makemap command. File:
+ postmap/postmap.c.
+
+ Cleanup: don't use ssize_t for boolean result. File:
+ global/smtp_stream.c.
+
+ Cleanup: memory leak caused by missing dbenv->close() call
+ after failing to open a Berkeley DB table. File: util/dict_db.c.
+
+20181112
+
+ Improved logging of TLS 1.3 summary information, and improved
+ reporting of the same info in Received: message headers.
+ Viktor Dukhovni. Files: proto/FORWARD_SECRECY_README.html,
+ smtpd/smtpd.c, tls/tls.h, tls/tls_client.c, tls/tls_misc.c,
+ tls/tls_proxy.h, tls/tls_proxy_context_print.c,
+ tls/tls_proxy_context_scan.c, tls/tls_server.c.
+
+20181116
+
+ Library function to log TLS 1.3 summary information, and
+ some wordsmithing of TLS context member names. Viktor
+ Dukhovni. Files: tls/tls.h, tls/tls_misc.c, tls/tls_proxy.h,
+ tls/tls_proxy_context_print.c, tls/tls_proxy_context_scan.c,
+ tls/tls_client.c, tls/tls_server.c, smtpd/smtpd.c,
+ posttls-finger/posttls-finger.c.
+
+ Cleanup: vstream_memopen() flags handling. File:
+ util/vstream.c.
+
+ Cleanup: the SMTP client now uses 'attr_print_plain'
+ serialization and 'attr_scan_plain' deserialization for
+ connection cache lookup keys, which now contain a serialized
+ version of the TLS context. File: smtp/smtp_session.c.
+
+20181117
+
+ The Postfix SMTP client now logs whether an SMTP-over-TLS
+ connection is newly established ("TLS connection established")
+ or whether the connection is reused ("TLS connection reused").
+ Files: smtp/smtp.h, smtp/smtp_proto.c, smtp/smtp_session.c.
+
+ (20181117-nonprod) Unified summary logging in the SMTP
+ client, SMTP server, and posttls-finger. Viktor Dukhovni.
+ Files: tls/tls.h, tls/tls_misc.c, tls/tls_proxy.h,
+ tls/tls_proxy_context_print.c, tls/tls_proxy_context_scan.c,
+ tls/tls_client.c, src/tls/tls_server.c, smtpd/smtpd.c,
+ posttls-finger/posttls-finger.c.
+
+ (20181117-nonprod) Improved logging of TLS 1.3 summary
+ information. On the server side this also affects the TLS
+ information optionally recorded in "Received" headers.
+ Viktor Dukhovni. Files: smtpd/smtpd.c, tls/tls.h,
+ tls/tls_client.c, tls/tls_misc.c, tls/tls_proxy.h,
+ tls/tls_proxy_context_print.c, tls/tls_proxy_context_scan.c,
+ tls/tls_server.c.
+
+ (20181117-nonprod) FORWARD_SECRECY examples with TLS 1.3
+ logging. Viktor Dukhovni. File: proto/FORWARD_SECRECY_README.html.
+
+20181118
+
+ Cleanup, no behavior change: updated comments concerning
+ connection reuse, and updated some identifiers to reflect
+ current reality. Files: smtp_reuse.c, smtp_key.c, smtp_proto.c,
+ smtp_tls_policy.c, smtp.h, smtp_connect.c.
+
+20181119
+
+ Bitrot: makedefs will use "pkg-config" to locate ICU build
+ information, falling back to "icu-config" if "pkg-config"
+ is not found. File: makedefs.
+
+20181122
+
+ Cleanup: tlsproxy loads the same TLS client configuration
+ at pre-jail time as the Postfix SMTP client, so that secret
+ keys can remain read-only for root. This is sufficient for
+ MTAs that have a fixed TLS client identity. tlsproxy will
+ log a warning if it is requested to assume a different TLS
+ client identity, and will log suggestions for a workaround.
+ The long-term solution is to stop loading certs/keys from
+ files, and to use the same approach as planned for server-side
+ SNI support: open a cert/key map at pre-jail time, and read
+ cert/key information on-the-fly at post-jail time. Files:
+ proto/postconf.proto, mantools/postlink, global/mail_params.h,
+ tlsproxy/tlsproxy.c.
+
+20181123
+
+ Cleanup: tlsproxy now logs better instructions when a
+ tls_client_init request specifies an unexpected client
+ identity, and the test for that condition is now moved to
+ the right place. File: tlsproxy/tlsproxy.c.
+
+20181124
+
+ Documentation: clarified the behavior of whitespace within
+ "{}". Files: proto/DATABASE_README.html, proto/postconf.proto,
+ pipe/pipe.c, postconf/postconf.c,
+
+20181125
+
+ Cleanup: dict_file_to_xxx() takes a list of file names
+ separated by CHARS_COMMA_SP. Shoe-horned into the existing
+ API, make it nicer when there is time. File: util/dict_file.c.
+
+20181127
+
+ Cleanup: encapsulated clumsy 'read into VSTRING' code with
+ easier-to-use vstream_fread_buf() and vstream_fread_app()
+ primitives. Files: global/memcache_proto.c, global/record.c,
+ global/smtp_stream.c, global/smtp_stream.h, global/uxtext.c,
+ global/xtext.c, milter/milter8.c, util/dict_file.c,
+ util/hex_quote.c, util/netstring.c, util/vstream.c,
+ util/vstream.h. Verified with "make tests".
+
+ Cleanup: simplified the smtp_fread() API (introduced for
+ BDAT support), and changed the name to smtp_fread_buf().
+ Files: global/smtp_stream.c, smtpd/smtpd.c. Verified with
+ ~megabyte BDAT commands.
+
+ Cleanup: simplified a tlsproxy-internal API. File:
+ tlsproxy/tlsproxy.c.
+
+20181128
+
+ Initial support for key/certificate chain files that will
+ replace the proliferation of separate parameters for
+ RSA/DSA/ECC/etc. key and certificate files. Viktor
+ Dukhovni.
+
+20181201
+
+ Cleanup: replaced the remaining unsafe VSTRING_AT_OFFSET()
+ calls with safe vstring_set_payload_size() calls, in code
+ that directly writes into VSTRING. Files: tls/tls_session.c,
+ tlsmgr/tlsmgr.c, util/casefold.c, util/vstring.c, util/vstring.h,
+ xsasl/xsasl_cyrus_client.c.
+
+ Cleanup: postscreen_command_time_limit did not need to be
+ a 'raw' parameter. This makes "postconf -x" behavior more
+ consistent. Files: global/mail_params.h, postscreen/postscreen.c.
+
+ Documentation: added text that the following parameter
+ values are not subject to Postfix parameter $name expansion:
+ default_rbl_reply, command_execution_directory, luser_relay,
+ smtpd_reject_footer. These have their own documented $name
+ substitution mechanism. File: proto/postconf.proto.
+
+20181202
+
+ Bugfix: posttls-finger reported an error for UNIX-domain
+ connections, even if they did not fail. Found by Coverity.
+ File: posttls-finger/posttls-finger.c.
+
+20181208
+
+ Documentation: add even more redundancy to the rate-delay
+ description. File: proto/postconf.proto.
+
+20181210
+
+ Cleanup: code deduplication. File: util/dict_file.c.
+
+20181226
+
+ Cleanup: code deduplication and better encapsulation with
+ PSC_DEL_CLIENT_STATE() and PSC_DEL_SERVER_STATE() macros.
+ Files: postscreen/postscreen.h, postscreen/postscreen_state.c.
+
+ Documentation: POSTSCREEN_README did not describe the
+ postscreen_post_queue_limit, and attributed the wrong reject
+ message to the postscreen_pre_queue_limit. Problem reported
+ by Michael Orlitzky. File: proto/POSTSCREEN_README.html.
+
+ (20181226-nonprod) Compatibility: removed support for OpenSSL
+ 1.0.1 (not supported since December 31, 2016) and earlier
+ releases. This eliminated a large number of #ifdefs with
+ bitrot workarounds. Viktor Dukhovni. Files: global/mail_params.h,
+ posttls-finger/posttls-finger.c, tls/tls.h, tls/tls_certkey.c,
+ tls/tls_client.c, tls/tls_dane.c, tls/tls_dh.c, tls/tls_misc.c,
+ tls/tls_proxy_client_scan.c, tls/tls_rsa.c, tls/tls_server.c,
+ tls/tls_session.c.
+
+ (20181226-nonprod) Use the OpenSSL 1.0.2 and later API for
+ setting ECDHE curves. Viktor Dukhovni. Files: tls/tls.h,
+ tls/tls_client.c, tls/tls_dh.c.
+
+ (20181226-nonprod) Documentation update for TLS support.
+ Viktor Dukhovni. Files: mantools/postlink, proto/TLS_README.html,
+ proto/postconf.proto, src/sendmail/sendmail.c, src/smtpd/smtpd.c.
+
+20181229
+
+ Explicit maps_file_find() and dict_file_lookup() methods
+ that decode base64 content. Decoding content is not built
+ into the dict->lookup() method, because that would complicate
+ the implementation of map nesting (inline, thash), map
+ composition (pipemap, unionmap), and map proxying. For
+ consistency, decoding base64 file content is also not built
+ into the maps_find() method. Files: util/dict.h.
+ util/dict_file.c, global/maps.[hc], postmap/postmap.c.
+
+20190106
+
+ Documentation: documented the SRC_RHS_IS_FILE flag in
+ dict_open.c, and updated the -F description in the postmap
+ manpage. Files: util/dict_open.c, postmap/postmap.c.
+
+ (20190106-nonprod) Feature: support for files that combine
+ multiple (key, certificate, trust chain) instances in one
+ file, to avoid separate files for RSA, DSA, Elliptic Curve,
+ and so on. Viktor Dukhovni. Files: .indent.pro,
+ global/mail_params.h, posttls-finger/posttls-finger.c,
+ smtp/lmtp_params.c, smtp/smtp.c, smtp/smtp_params.c,
+ smtp/smtp_proto.c, smtpd/smtpd.c, tls/tls.h, tls/tls_certkey.c,
+ tls/tls_client.c, tls/tls_proxy.h, tls/tls_proxy_client_print.c,
+ tls/tls_proxy_client_scan.c, tls/tls_proxy_server_print.c,
+ tls/tls_proxy_server_scan.c, tls/tls_server.c, tlsproxy/tlsproxy.c.
+
+ (20190106-nonprod) Create a second, no-key no-cert, SSL_CTX
+ for use with SNI. Viktor Dukhovni. Files: src/tls/tls.h,
+ src/tls/tls_client.c, src/tls/tls_misc.c, src/tls/tls_server.c.
+
+ (20190106-nonprod) Server-side SNI support. Viktor Dukhovni.
+ Files: src/global/mail_params.h, src/smtp/smtp.c,
+ src/smtpd/smtpd.c, src/tls/tls.h, src/tls/tls_certkey.c,
+ src/tls/tls_misc.c, src/tlsproxy/tlsproxy.c,
+
+ (20190106-nonprod) Configurable client-side SNI signal.
+ Viktor Dukhovni. Files: global/mail_params.h,
+ posttls-finger/posttls-finger.c, smtp/lmtp_params.c,
+ smtp/smtp.c, smtp/smtp.h, smtp/smtp_params.c, smtp/smtp_proto.c,
+ smtp/smtp_tls_policy.c, tls/tls.h, tls/tls_client.c,
+ tls/tls_proxy.h, tls/tls_proxy_client_print.c,
+ tls/tls_proxy_client_scan.c.
+
+20190121
+
+ Logging: support for internal logging file, without using
+ syslog (it uses the new postlogd daemon instead). This
+ solves a usability problem for MacOS, may help getting
+ around systemd, and solves 99% of the problem for logging
+ to stdout in a container (hopefully we have 100% soon).
+ Enable by setting, for example, "maillog_file =
+ /var/log/postfix.log"). This works fine for daemons, and
+ with some limitations for non-daemon programs. See
+ RELEASE_NOTES for more details. Files: conf/master.cf,
+ conf/post-install, conf/postfix-files, conf/postfix-script,
+ mantools/postlink, proto/master, proto/postconf.proto,
+ global/mail_params.c, global/mail_params.h, global/mail_proto.h,
+ global/maillog_client.c, global/maillog_client.h,
+ master/dgram_server.c, master/event_server.c, master/mail_server.h,
+ master/master.c, master/master.h, master/master_ent.c,
+ master/master_listen.c, master/master_proto.h,
+ master/master_wakeup.c, master/multi_server.c,
+ master/single_server.c, master/trigger_server.c,
+ postalias/postalias.c, postconf/postconf_master.c,
+ postdrop/postdrop.c, postfix/postfix.c, postkick/postkick.c,
+ postlog/postlog.c, postlogd/postlogd.c, postmap/postmap.c,
+ postmulti/postmulti.c, postqueue/postqueue.c,
+ postsuper/postsuper.c, sendmail/sendmail.c, util/connect.h,
+ util/listen.h, util/logwriter.c, util/logwriter.h,
+ util/msg_logger.c, util/msg_logger.h, util/msg_output.c,
+ util/msg_output.h, util/unix_dgram_connect.c,
+ util/unix_dgram_listen.c.
+
+ Cleanup: cert/key/chain loading, plus unit tests to exercise
+ non-error and error cases. Viktor Dukhovni. Files: tls/*.pem,
+ tls*.pem.ref, tls/tls_certkey.c.
+
+20190126
+
+ Safety: Postfix programs will log to either syslog or postlog
+ but not both; and postlogd forwards postlog logging to
+ syslog, when a configuration change removes the maillog_file
+ pathname, but some programs still use the old configuration.
+ Files: util/msg_syslog.[hc], util/msg_logger.c,
+ global/maillog_client.c, postlogd/postlogd.c,
+
+ Bugfix (introduced: Postfix 20110109, Postfix 2.10): watchdog
+ pipe file descriptor leak. This pipe provides one source
+ of liveness, data from this pipe is discarded, and therefore
+ this does not enable privilege escalation or DOS. File:
+ util/watchdog.c.
+
+ Feature: stdout logging support; requires "postfix start-fg"
+ and "maillog_file = /dev/stdout". Files: master/master.c,
+ conf/postfix-script.
+
+20190127
+
+ Safety: when maillog_file is specified, 'postfix check' now
+ requires that the postlog service is enabled in master.cf.
+ Otherwise 'postfix start' etc. will log a fatal error. File:
+ conf/postfix-script.
+
+ Documentation: added policy_context example. File:
+ proto/SMTPD_POLICY_README.html.
+
+20190128
+
+ Testing: run libtls tests under Valgrind. File tls/Makefile.in.
+
+20190129
+
+ Safety: require that $maillog_file matches one of the
+ pathname prefixes specified in $maillog_file_prefixes. The
+ maillog file is created by root, and the prefixes limit the
+ damage from a single configuration error. Files:
+ global/mail_params.[hc], global/maillog_client.c.
+
+20191201
+
+ Feature: "postfix logrotate" command with configurable
+ compression program and datestamp filename suffix. File:
+ conf/postfix-script.
+
+20190202
+
+ Cleanup: log a warning when the client sends a malformed
+ SNI; log an info message when the client sends a valid SNI
+ that does not match the SNI lookup tables; update the
+ FORWARD_SECRECY_README logging examples. Viktor Dukhovni.
+ Files: proto/FORWARD_SECRECY_README.html, tls/tls.h,
+ tls/tls_client.c, tls/tls_misc.c.
+
+20190208
+
+ Debugging: the master(8) daemon now logs a warning if a
+ master.cf entry is defined multiple times. File:
+ src/master/master_conf.c.
+
+20190209
+
+ Debugging: tlsproxy(8) now logs more details about unexpected
+ configuration differences between the Postfix SMTP client
+ and the tlsproxy(8) daemon.
+
+20190210
+
+ Documentation: Postfix 3.4.0 RELEASE NOTES.
+
+ Documentation: added BDAT_README.
+
+ Documentation: global TLS settings. Files: mantools/postlink,
+ smtp/smtp.c, tlsproxy/tlsproxy.c.
+
+20190211
+
+ Cleanup: removed obsolete parameters: tls_dane_digest_agility,
+ tls_dane_trust_anchor_digest_enable; removed openssl_path
+ parameter from configuration difference checks in tlsproxy.
+ Files: global/mail_params.h, tls/tls_misc.c,
+ tls/tls_proxy_client_misc.c, tls/tls_proxy_client_print.c,
+ tls/tls_proxy_client_scan.c, tls/tls_proxy.h.
+
+20190212
+
+ Cleanup: missing #ifdef USE_TLS. Files: smtp/smtp_session.c,
+ posttls-finger/posttls-finger.c.
+
+20190217
+
+ Cleanup: when the master daemon runs with PID=1 (init mode),
+ reap orhpan processes from non-Postfix code running in the
+ same container, instead of terminating with a panic. File:
+ master/master_spawn.c.
+
+20190218
+
+ Bugfix: tlsproxy did not enable DANE-style PKI because
+ libtls seems to have to accreted multiple init functions
+ instead of reusing the tls_client_init() and tls_client_start()
+ API. And some functions that do initialization don't even
+ have init in their name! Problem report by Andreas Schulze.
+ Viktor Dukhovni. Files: tls/tls_misc.c, tlsproxy/tlsproxy.c.
+
+ Workaround: Postfix libtls makes DANE-specific changes to
+ the shared SSL_CTX. To avoid false sharing, tlsproxy needs
+ to label the SSL_CTX cache with DANE bits until we can
+ remove the code that modifies SSL_CTX. File: tlsproxy/tlsproxy.c.
+
+ Cleanup: Postfix libtls changed the shared SSL_CTX to
+ override ciphers. instead of changing the SSL handle. To
+ avoid false sharing in tlsproxy, the changes are now made
+ to the SSL handle. Viktor Dukhovni. Files: tls/tls.h,
+ tls/tls_client.c, tls/tls_misc.c, tls/tls_server.c.
+
+20190219
+
+ Bugfix: in the Postfix SMTP client, TLS wrappermode was not
+ tested in tlsproxy mode. It needed some setup for buffering
+ and timeouts. Problem report by Andreas Schulze. File:
+ smtp/smtp_proto.c.
+
+20190226
+
+ Documentation: postconf(1) and DATABASE_README were out of
+ sync. Added a note that this should be deduplicated. File:
+ proto/DATABASE_README.html.
+
+20190227
+
+ Documentation: strict_smtputf8 in SMTPUTF8_README.
+
+20190304
+
+ Bugfix: a reversed test broke TLS configurations that specify
+ the same filename for a private key and certificate. Reported
+ by Mike Kazantsev. Fix by Viktor Dukhovni. Wietse fixed the
+ test. Files: tls/tls_certkey.c, tls/Makefile.in.
+
+20190310
+
+ Bitrot: LINUX5s support, after some sanity checks with a
+ rawhide prerelease version. Files: makedefs, util/sys_defs.h.
+
+ Bugfix (introduced: 20181226): broken DANE trust anchor
+ file support, caused by left-over debris from the 20181226
+ TLS library overhaul. By intrigeri. File: tls/tls_dane.c.
+
+ Bugfix (introduced: Postfix-1.0.1): null pointer read, while
+ logging a warning after reading a corrupted bounce log file.
+ File: global/bounce_log.c.
+
+ Bugfix (introduced: Postfix-2.9.0): null pointer read, while
+ logging a warning after a postscreen_command_filter read
+ error. File: postscreen/postscreen_smtpd.c.
+
+20190312
+
+ Bugfix (introduced: Postfix 2.2): reject_multi_recipient_bounce
+ has been producing false rejects starting with the Postfix
+ 2.2 smtpd_end_of_data_restrictons, and for the same reasons,
+ did the same with the Postfix 3.4 BDAT command. The latter
+ was reported by Andreas Schulze. File: smtpd/smtpd_check.c.
+
+20190319
+
+ With message_size_limit=0 (which is NOT DOCUMENTED), BDAT
+ chunks were always too large. Reported by Thorben Thuermer.
+ fix by Viktor Dukhovni. File: src/smtpd/smtpd.c.
+
+20190328
+
+ Bugfix (introduced: Postfix 3.0): LMTP connections over
+ UNIX-domain sockets were cached but not reused, due to a
+ cache lookup key mismatch. Therefore, idle cached connections
+ could exhaust LMTP server resources, resulting in two-second
+ pauses between email deliveries. This problem was investigated
+ by Juliana Rodrigueiro. File: smtp/smtp_connect.c.
+
+20190331
+
+ Documentation: tlsext_padding is not a tls_ssl_options
+ feature. File: proto/postconf.proto.
+
+20190401
+
+ Portability: to avoid a compile-time error on Solaris, added
+ "#undef sun" to util/unix_dgram_connect.c.
+
+20190403
+
+ Bugfix (introduced: Postfix 2.3): a censoring filter broke
+ multiline Milter responses for header/body events. Problem
+ report by Andreas Thienemann. Files: util/printable.c,
+ util/stringops.h, smtpd/smtpd.c.
+
+ Bugfix (introduced: Postfix 3.3): "smtp_mx_address_limit = 0"
+ no longer meant 'unlimited'. Problem report by Luc Pardon.
+ File: smtp/smtp_addr.c.
+
+20190427
+
+ Cleanup: normalize the IP address string forms received with
+ XCLIENT, XFORWARD, and HaProxy, for consistency with address
+ information for direct connections to Postfix, and add unit
+ tests. This casefolds and removes redundant nulls from the
+ string representation of an IPv6 address, normalizes the
+ "IPv6:" address prefix of RFC 2821 IPv6 address forms, and
+ converts IPv4 address octets with leading zeros (octal form)
+ into decimal form. Files: global/haproxy.c,
+ global/normalize_mailhost_addr.[hc], smtpd/smtpd.c.
+
+ Incompatibility: this may change the appearance of logging,
+ and the way that check_client_access will match subnets of
+ an IPv6 address.
+
+20190428
+
+ Cleanup: replace "(whatever *) 0" with meaningfully-named
+ constants. Sheesh. File: smtpd/smtpd.c.
+
+ Documentation: BASIC_CONFIGURATION_README example default
+ setting was not updated after Postfix 3.0 change. File:
+ proto/BASIC_CONFIGURATION_README.html
+
+20190505
+
+ Workaround: uClibc has no res_send. Log a warning if this
+ code path would be used, and ignore dns_ncache_ttl_fix_enable.
+ Files: util/sys_defs.h, dns/dns_lookup.c, TODO: makedefs
+ and INSTALL documentation.
+
+20190516
+
+ Initial search order support for check_ccert_access. The
+ default behavior is backwards-compatible. This is work in
+ progress; see the RELEASE_NOTES for examples. Files:
+ global/map_search.[hc], smtpd/smtpd_check.c.
+
+20190517
+
+ Bugfix: postconf mis-parsed text starting with "{" such as
+ "check_ccert_access { inline:{a=b} { search_order=c,d } }".
+ Fixed by adding another level of recursion. File:
+ postconf/postconf_dbms.c.
+
+20190525
+
+ Infrastructure: reject_deliver_request() to reject an entire
+ delivery request and bounce or defer all its recipients.
+ File: global/reject_deliver_request.c.
+
+20190609
+
+ Infrastructure: byte_mask() to convert "flags=mumble" into
+ a byte mask. This is similar to name_mask(). Files:
+ util/byte_mask.[hc] and tests.
+
+20190615
+
+ Dovecot usability: SMTP/LMTP client support for 'D', 'O',
+ 'R', 'X' flags similar to the pipe(8) daemon, to produce
+ Delivered-To, X-Original-To, and Return-Path headers, and
+ to indicate final delivery. Files: smtp/smtp.c, smtp/smtp.h,
+ smtp/smtp_misc.c, smtp/smtp_proto.c, smtp/smtp_rcpt.c.
+
+ Workaround for implementations that hang Postfix while
+ shutting down a TLS session, until Postfix times out. With
+ "tls_fast_shutdown_enable = yes" (the default), Postfix no
+ longer waits for the TLS peer to respond to a TLS 'close'
+ request. This is recommended with TLSv1.0 and later. Files:
+ global/mail_params.h, tls/tls_session.c, and documentation.
+
+20190618
+
+ Documentation: corrected comments about the code change to
+ not wait for the TLS peer's response after sending a TLS
+ 'close' notification. Viktor Dukhovni. Files: HISTORY,
+ RELEASE_NOTES, proto/postconf.proto smtp/smtp.c smtpd/smtpd.c
+ tlsproxy/tlsproxy.c
+
+20190621
+
+ Workaround: don't reuse an SMTP connection after an SMTP
+ protocol error. This limits the impact of, for example,
+ pipelining synchronization errors. File: smtp/smtp_trouble.c.
+
+ Bugfix (introduced: Postfix 3.0): the code to reset Postfix
+ SMTP server command counts was not called after a HaProxy
+ handshake failure, causing stale numbers to be reported.
+ The command counts are now reset in the function that reports
+ the counts. Problem report by Joseph Ward. File: smtpd/smtpd.c.
+
+20190719
+
+ Bitrot: OpenBSD stopped having /dev/arandom 8 years ago.
+ Brad Smith. File: util/sys_defs.h.
+
+20190723
+
+ Bugfix: the documentation said tls_fast_shutdown_enable,
+ but the code said tls_fast_shutdown. Viktor Dukhovni. Changed
+ the code because no-one is expected to override the default.
+ File: global/mail_params.h.
+
+20190724
+
+ Cleanup: proxymap(8) support for table search order syntax.
+ File: proxymap/proxymap.c.
+
+ Safety: vstring_set_payload_size() now checks that the
+ payload has not overwritten the safety terminator at the
+ end of the VSTRING buffer. File: util/vstring.c.
+
+20190813
+
+ Documentation: access(5) map network address pattern syntax.
+ File: proto/access.
+
+20190820
+
+ Workaround for poor TCP loopback performance on LINUX, where
+ getsockopt(..., TCP_MAXSEG, ..) reports a TCP maximal segment
+ size that is 1/2 to 1/3 of the MTU. For example, with kernel
+ 5.1.16-300.fc30.x86_64 the TCP client and server announce
+ an mss of 65495 in the TCP handshake, but getsockopt()
+ returns 32741 (less than half). As a matter of principle,
+ Postfix won't turn on client-side TCP_NODELAY because that
+ hides application performance bugs, and because that still
+ suffers from server-side delayed ACKs. Instead, Postfix
+ avoids sending "small" writes back-to-back, by choosing a
+ VSTREAM buffer size that is a multiple of the reported MSS.
+ This workaround bumps the multiplier from 2x to 4x. File:
+ util/vstream_tweak.c.
+
+20190825
+
+ Bugfix (introduced: 20051222): the Dovecot client could
+ segfault (null pointer read) or cause an SMTP server assertion
+ to fail when talking to a fake Dovecot server. The client
+ now logs a proper error instead. Problem reported by Tim
+ Düsterhus. File: xsasl/xsasl_dovecot_server.c.
+
+20190908
+
+ Documentation: updated postconf(5) description of the
+ tls_server_sni_maps configuration parameter. Viktor Dukhovni.
+ File: proto/postconf.proto.
+
+20190914
+
+ Bugfix (introduced: Postfix 3.4): don't whitewash OpenSSL
+ error results after a plaintext output error. The code could
+ loop, and with some OpenSSL error results could flood the
+ log with error messages (see below for a specific case).
+ Problem reported by Andreas Schulze. File: tlsproxy/tlsproxy.c.
+
+ Bitrot: don't invoke SSL_shutdown() when the SSL engine
+ thinks it is processing a TLS handshake. The commit at
+ https://github.com/openssl/openssl/commit/64193c8218540499984cd63cda41f3cd491f3f59
+ changed the error status, incompatibly, from SSL_ERROR_NONE
+ into SSL_ERROR_SSL. File: tlsproxy/tlsproxxy.c.
+
+20190918
+
+ Cleanup: the nbbio(3) library now accepts a sequence of
+ nbbio_enable_read() calls or a sequence of nbbio_enable_write()
+ calls. This allows tlsproxy(8) to reset an I/O timer after
+ each event without having to make an nbbio_disable_readwrite()
+ call. Files: util/nbbio.c, tlsproxy/tlsproxy.c.
+
+20191013
+
+ Cleanup: code pattern ENFORCING_SIZE_LIMIT() for more
+ consistent enforcement of the 'no size limit' case (it now
+ requires "> 0" where previous code used "!= 0" or "> 0").
+ More relevant, this explicit pattern will help finding code
+ that does not implement the 'no size limit' case with
+ var_message_limit, etc. Files: cleanup/cleanup_init.c,
+ local/local.c, postdrop/postdrop.c, postscreen/postscreen_smtpd.c,
+ sendmail/sendmail.c, smtpd/smtpd.c, smtpd/smtpd_check.c,
+ util/netstring.c, util/sys_defs.h, virtual/virtual.c.
+
+ Cleanup; with message_size_limit>0, local(8) and virtual(8)
+ mailbox size limit checks would produce a misleading error
+ message when the mailbox size was unlimited. Files:
+ local/local.c, virtual/virtual.c.
+
+ Cleanup: queue_minfree changed from 'int' to 'long'. File:
+ global/mail_params.h, src/smtpd/smtpd.c.
+
+ Attribution: updated AUTHOR in file headers. Files:
+ global/bounce_log.c, global/deliver_request.h, smtp/smtp_chat.c,
+ smtp/smtp_rcpt.c, tls/tls_certkey.c, util/nbbio.c,
+ util/vstream_tweak.c.
+
+20191014
+
+ Bugfix (introduced: Postfix 2.8): don't gratuitously enable
+ all after-220 tests when only one such test is enabled.
+ This made selective tests impossible with 'good' clients.
+ File: postscreen/postscreen_smtpd.c.
+
+ Bugfix: the 20180903 postscreen fix for a misleading
+ "PIPELINING after BDAT" warning looked at the wrong variable.
+ The warning now says "BDAT without valid RCPT", and the
+ error is no longer treated as a command PIPELINING error
+ (but sending BDAT is still a client error, because postscreen
+ rejects all RCPT commands and does not announce PIPELINING
+ support). File: postscreen/postscreen_smtpd.c.
+
+20190922
+
+ Documentation: replaced the link to "Suite B" cryptography
+ with a link to web.archive.org. File: proto/postconf.proto.
+
+20191109
+
+ Cleanup: Postfix daemon processes now log the from= and to=
+ addresses in external (quoted) form in non-debug logging
+ (info, warning, etc.). This is consistent with the address
+ form that Postfix 3.2 and later prefer for table lookups.
+ It is therefore the more useful form for non-debug logging.
+ Files: cleanup/cleanup.c, cleanup/cleanup_message.c,
+ cleanup/cleanup_milter.c, global/info_log_addr_form.c,
+ global/info_log_addr_form.h, global/log_adhoc.c,
+ global/mail_params.c, global/mail_params.h, global/opened.c,
+ local/local.c, oqmgr/qmgr.c, oqmgr/qmgr_active.c,
+ pickup/pickup.c, pipe/pipe.c, postscreen/postscreen.c,
+ postscreen/postscreen_smtpd.c, proto/postconf.proto,
+ qmgr/qmgr.c, qmgr/qmgr_active.c, smtp/smtp.c, smtpd/smtpd.c,
+ smtpd/smtpd_check.c, virtual/virtual.c.
+
+ Usability: the parser for key/certificate chain files
+ rejected inputs that contain an EC PARAMETERS object. While
+ this is technically correct (the documentation says what
+ types are allowed) this is surprising behavior because the
+ legacy cert/key parameters will accept such inputs. For
+ now, the parser skips object types that it does not know
+ about usability, and logs a warning because ignoring inputs
+ is not kosher. Viktor and Wietse. File: tls/tls_certkey.c.
+
+20191201
+
+ Compatibility: added '_' to the milter_connect_macros default
+ value. Reportedly some software produces an ugly warning
+ message if Postfix does not send the macro, and there is
+ no harm in sending it. File: global/mail_params.h.
+
+20191214
+
+ Bugfix (introduced: Postfix 3.1): support for
+ smtp_dns_resolver_options was broken while adding support
+ for negative DNS response caching in postscreen. Postfix
+ was inadvertently changed to call res_query() instead of
+ res_search(). Reported by Jaroslav Skarvada. File:
+ dns/dns_lookup.c.
+
+ Bugfix: sanitize server responses before storing them in
+ the verify database, to avoid Postfix warnings about malformed
+ UTF8. File: verify/verify.c.
+
+20191215
+
+ Future proofing: the Postfix DNS library logs a warning if
+ the DNS_REQ_FLAG_NCACHE_TTL dns_lookup flag is set and the
+ RES_DNSRCH or RES_DEFNAMES resolver flags are set, and
+ disables those resolver flags. File: dns/dns_lookup.c.
+
+20191230
+
+ Documentation: added the 'X' flag (final delivery) to the
+ pipe-based final delivery examples in the default master.cf
+ file. File: conf/master.cf
+
+20201005
+
+ Workaround: postlog clients open the socket before entering
+ the chroot jail and before dropping privileges. This is needed
+ on MacOS and would not hurt otherwise. Files: util/msg_logger.[hc],
+ global/maillog_client.c.
+
+20200108
+
+ UI cleanup: SMTP (and LMTP) client support for a list of
+ nexthop destinations separated by comma or whitespace. These
+ will be tried in the specified order. The list form can be
+ specified in relayhost, transport_maps, default_transport,
+ and sender_dependent_default_transport_maps. Examples:
+ "relayhost = foo.example, bar.example", and "default_transport
+ = smtp:foo.example, bar.example". Files: smtp/smtp.c,
+ smtp/smtp_connect.c, trivial-rewrite/resolve.c, proto/transport,
+ proto/postconf.proto, global/mail_params.c.
+
+20200112
+
+ [initially released as part of postfix-20200101-nonprod]
+ Refactored the haproxy infrastructure in preparation for
+ haproxy version 2 support. This is necessary because version
+ 2 introduces a dependency of the reader on the parser.
+ Additionally, version 2 introduces support for non-proxied
+ connections (used by health checks). Files: global/haproxy_srvr.c,
+ smtpd/smtpd_peer.c, smtpd/smtpd_haproxy.c, smtpd/smtpd.h,
+ postscreen/postscreen.h, postscreen/postscreen_endpt.c,
+ postscreen/postscreen_haproxy.c, postscreen/postscreen_haproxy.h,
+ global/haproxy_srvr.h. Initial release 3.5-20200101-nonprod.
+
+ [initially released as part of postfix-20200105-nonprod]
+ Support for the haproxy v2 protocol. The haproxy v2 protocol
+ support is limited to TCP over IPv4 and TCP over IPv6. It
+ also supports non-proxied connections (typically used for
+ heartbeat tests). File: global/haproxy_srvr.c.
+
+ [initially released as part of postfix-20200105-nonprod]
+ Cleanup: after haproxy handshake error, the Postfix SMTP
+ daemon now logs the proxy connection information instead
+ of unknown/unknown, and replies with "421 4.3.0 $myhostname
+ Server local error" instead of just hanging up. Error
+ details are logged to the maillog file. File: smtpd/smtpd.c.
+
+ Cleanup: miscellaneous comments, constants, error checks,
+ no normal behavior change. Files: global/haproxy_srvr.c,
+ postscreen/postscreen_haproxy.c.
+
+20200126
+
+ Cleanup: missing 'extern' declarations in some header files.
+ Eray Aslan. Files: global/mail_params.h, postconf/postconf.h,
+ smtpd/smtpd_expand.h, trivial-rewrite/trivial-rewrite.h
+
+ Typos: Viktor Dukhovni. File: HISTORY.
+
+ Documentation: haproxy2 support. File: proto/postconf.proto.
+
+20200120
+
+ [initially released as part of postfix-20200125-nonprod]
+ Feature: forced message expiration. The "postsuper -e"
+ option sets an 'expired' bit on one or more messages selected
+ by their message ID. The queue manager returns a message
+ as undeliverable when it moves the message to the active
+ queue. Messages in the hold queue stay in that queue.
+
+ If a force-expired message was deferred, then it is returned
+ with the reason for the delay. Otherwise, the message is
+ returned with "message is administratively expired". Design
+ by Wietse; Viktor suggested using the group execute permission
+ bit. Files: global/mail_queue.h, *qmgr/qmgr.h, *qmgr/qmgr_active.c,
+ *qmgr/qmgr_message.c, postsuper/Makefile.in, postsuper/postsuper.c.
+
+20200125
+
+ [initially released as part of postfix-20200125-nonprod]
+ Added support for "postsuper -f" to expire and optionally
+ release a message. Restructured the postsuper command so
+ that it will execute actions in the order of the -[defhr]
+ flags, instead of using an invisible fixed internal order.
+ The -e and -f options are idempotent (just like -h and -H).
+ Adjusted the summary at the end to make this more clear.
+ File: postsuper/postsuper.c.
+
+20200126
+
+ [initially released as part of postfix-20200126-nonprod]
+ Updated the mailq/postqueue commands to make forced message
+ expiration status available. In ASCII ouput this is indicated
+ with "#" appended to the queue file name, and in JSON output
+ this is indicated with the boolean "force_expired" attribute.
+ Files: showq/showq.c, postqueue/showq_compat.c,
+ postqueue/showq_json.c.
+
+ [initially released as part of postfix-20200126-nonprod]
+ Cleanup: minor tweaks to comments and code.
+
+ Safety: give maildrop queue files more time (week instead
+ of day) to reach completion, in case a message is submitted
+ by a really long-running program. File: postsuper/postsuper.c.
+
+ Cleanup: postsuper manpage indentation, word abbreviation.
+ Files: mantools/postlink, postsuper/postsuper.c.
+
+20200202
+
+ Cleanup: nags about strcpy()/sprintf() from naive checkers.
+ Files: global/mail_conf_int.c, global/mail_conf_long.c,
+ global/mail_conf_nint.c, global/mail_conf_time.c,
+ global/maillog_client.c, util/mymalloc.c.
+
+ Documentation: rephrased the postconf(5) manual page entry
+ for milter_default_action. File: proto/postconf.proto.
+
+ Bugfix (introduced: Postfix 2.5): Milter SMTP connect event
+ macros were evaluated before the Postfix-to-Milter connection
+ had been negotiated. Problem reported by David Bürgin.
+ Files: milter/milter.h, milter/milter.c, milter/milter8.c
+
+20200308
+
+ Cleanup: spellchecks, attributions. Files: HISTORY,
+ auxiliary/name-addr-test/gethostbyaddr.c,
+ auxiliary/name-addr-test/getnameinfo.c, proto/postconf.proto,
+ global/haproxy_srvr.c, global/mail_version.h, global/map_search.c,
+ global/map_search.h, postsuper/postsuper.c, smtp/smtp.c,
+ smtp/smtp_misc.c, smtpd/smtpd.c, smtpd/smtpd_check.c,
+ smtpd/smtpd_expand.h, tls/tls_client.c, tls/tls_server.c,
+ tlsproxy/tlsproxy.c, trivial-rewrite/trivial-rewrite.h,
+ util/byte_mask.c, util/vstream_tweak.c.
+
+ Cleanup: bitrot in tests. File: cleanup/cleanup_milter.c.
+
+ Cleanup: harmless memory leak in postconf. File:
+ postconf/postconf_master.c.
+
+ Bugfix (introduced: Postfix 2.3): panic with Postfix
+ multi-Milter configuration during MAIL FROM. Milter client
+ state was not properly reset after one of the Milters failed.
+ Reported by WeiYu Wu.
+
+20200312
+
+ Usability: the Postfix SMTP server now logs a warning when
+ a configuration requests access control by client certificate,
+ but "smtpd_tls_ask_clientcert = no". Files: proto/postconf.proto,
+ smtpd/smtpd_check.c.
+
+20200316
+
+ Removed the issuer_cn and subject_cn matches from
+ check_ccert_access. Files: smtpd/smtpd_check.c,
+ proto/postconf.proto.
diff --git a/external/ibm-public/postfix/dist/INSTALL b/external/ibm-public/postfix/dist/INSTALL
index 776cee39ca0..10e69408c8b 100644
--- a/external/ibm-public/postfix/dist/INSTALL
+++ b/external/ibm-public/postfix/dist/INSTALL
@@ -357,7 +357,7 @@ inconsistent results with different versions of the make(1) command.
postfix-files will automatically include files under the directory postfix-
files.d. Thanks to this, you can install or deinstall a database plugin
package without having to edit postfix-files or dynamicmaps.cf. Instead,
- you give that plugin its own configuration files dynamicmaps.cf.d and
+ you give that plugin its own configuration files under dynamicmaps.cf.d and
postfix-files.d, and you add or remove those configuration files along with
the database plugin dynamically-linked object.
@@ -516,110 +516,122 @@ The general method to override Postfix compile-time features is as follows:
The following is an extensive list of names and values.
_____________________________________________________________________________
-|Name/Value |Description |
-|______________________________|______________________________________________|
-| |Specifies one or more non-default object |
-| |libraries. Postfix 3.0 and later specify some |
-| |of their database library dependencies with |
-|AUXLIBS="object_library..." |AUXLIBS_CDB, AUXLIBS_LDAP, AUXLIBS_LMDB, |
-| |AUXLIBS_MYSQL, AUXLIBS_PCRE, AUXLIBS_PGSQL, |
-| |AUXLIBS_SDBM, and AUXLIBS_SQLITE, |
-| |respectively. |
-|______________________________|______________________________________________|
-|CC=compiler_command |Specifies a non-default compiler. On many |
-| |systems, the default is gcc. |
-|______________________________|______________________________________________|
-| |Specifies non-default compiler arguments, for |
-|CCARGS="compiler_arguments..."|example, a non-default include directory. The |
-| |following directives turn off Postfix features|
-| |at compile time: |
-|______________________________|______________________________________________|
-|| |Do not build with Berkeley DB support. By |
-|| |default, Berkeley DB support is compiled in on|
-||-DNO_DB |platforms that are known to support this |
-|| |feature. If you override this, then you |
-|| |probably should also override DEF_DB_TYPE as |
-|| |described in section 4.6. |
-||_____________________________|______________________________________________|
-||-DNO_DNSSEC |Do not build with DNSSEC support, even if the |
-|| |resolver library appears to support it. |
-||_____________________________|______________________________________________|
-|| |Do not build with Solaris /dev/poll support. |
-||-DNO_DEVPOLL |By default, /dev/poll support is compiled in |
-|| |on Solaris versions that are known to support |
-|| |this feature. |
-||_____________________________|______________________________________________|
-|| |Do not build with Linux EPOLL support. By |
-||-DNO_EPOLL |default, EPOLL support is compiled in on |
-|| |platforms that are known to support this |
-|| |feature. |
-||_____________________________|______________________________________________|
-|| |Do not build with EAI (SMTPUTF8) support. By |
-||-DNO_EAI |default, EAI support is compiled in when the |
-|| |"icuuc" library and header files are found. |
-||_____________________________|______________________________________________|
-|| |Do not require support for C99 "inline" |
-||-DNO_INLINE |functions. Instead, implement argument |
-|| |typechecks for non-printf/scanf-like functions|
-|| |with ternary operators and unreachable code. |
-||_____________________________|______________________________________________|
-|| |Do not build with IPv6 support. By default, |
-|| |IPv6 support is compiled in on platforms that |
-||-DNO_IPV6 |are known to have IPv6 support. Note: this |
-|| |directive is for debugging and testing only. |
-|| |It is not guaranteed to work on all platforms.|
-||_____________________________|______________________________________________|
-|| |Do not build with FreeBSD / NetBSD / OpenBSD /|
-||-DNO_KQUEUE |MacOSX KQUEUE support. By default, KQUEUE |
-|| |support is compiled in on platforms that are |
-|| |known to support it. |
-||_____________________________|______________________________________________|
-|| |Do not build with NIS or NISPLUS support. NIS |
-||-DNO_NIS |is not available on some recent Linux |
-|| |distributions. |
-||_____________________________|______________________________________________|
-|| |Do not build with NISPLUS support. NISPLUS is |
-||-DNO_NISPLUS |not available on some recent Solaris |
-|| |distributions. |
-||_____________________________|______________________________________________|
-|| |Do not build with PCRE support. By default, |
-||-DNO_PCRE |PCRE support is compiled in when the pcre- |
-|| |config utility is installed. |
-||_____________________________|______________________________________________|
-|| |Disable support for POSIX getpwnam_r/ |
-||-DNO_POSIX_GETPW_R |getpwuid_r. By default Postfix uses these |
-|| |where they are known to be available. |
-||_____________________________|______________________________________________|
-|| |Use setjmp()/longjmp() instead of sigsetjmp()/|
-||-DNO_SIGSETJMP |siglongjmp(). By default, Postfix uses |
-|| |sigsetjmp()/siglongjmp() when they are known |
-|| |to be available. |
-||_____________________________|______________________________________________|
-| |Specifies a non-default compiler debugging |
-|DEBUG=debug_level |level. The default is "-g". Specify DEBUG= to |
-| |turn off debugging. |
-|______________________________|______________________________________________|
-| |Specifies a non-default optimization level. |
-|OPT=optimization_level |The default is "-O". Specify OPT= to turn off |
-| |optimization. |
-|______________________________|______________________________________________|
-| |Specifies non-default compiler options for |
-|SHLIB_CFLAGS=flags |building Postfix dynamically-linked libraries |
-| |and database plugins. The typical default is |
-| |"-fPIC". |
-|______________________________|______________________________________________|
-| |Specifies a non-default runpath for Postfix |
-|SHLIB_RPATH=rpath |dynamically-linked libraries. The typical |
-| |default is "'-Wl,-rpath,${SHLIB_DIR}'". |
-|______________________________|______________________________________________|
-| |Specifies a non-default suffix for Postfix |
-|SHLIB_SUFFIX=suffix |dynamically-linked libraries and database |
-| |plugins. The typical default is ".so". |
-|______________________________|______________________________________________|
-| |Specifies non-default compiler warning options|
-|WARN="warning_flags..." |for use when "make" is invoked in a source |
-| |subdirectory only. |
-|______________________________|______________________________________________|
+|Name/Value |Description |
+|_______________________________|_____________________________________________|
+| |Specifies one or more non-default object |
+| |libraries. Postfix 3.0 and later specify some|
+| |of their database library dependencies with |
+|AUXLIBS="object_library..." |AUXLIBS_CDB, AUXLIBS_LDAP, AUXLIBS_LMDB, |
+| |AUXLIBS_MYSQL, AUXLIBS_PCRE, AUXLIBS_PGSQL, |
+| |AUXLIBS_SDBM, and AUXLIBS_SQLITE, |
+| |respectively. |
+|_______________________________|_____________________________________________|
+|CC=compiler_command |Specifies a non-default compiler. On many |
+| |systems, the default is gcc. |
+|_______________________________|_____________________________________________|
+| |Specifies non-default compiler arguments, for|
+|CCARGS="compiler_arguments..." |example, a non-default include directory. The|
+| |following directives turn off Postfix |
+| |features at compile time: |
+|_______________________________|_____________________________________________|
+|| |Do not build with Berkeley DB support. By |
+|| |default, Berkeley DB support is compiled in |
+||-DNO_DB |on platforms that are known to support this |
+|| |feature. If you override this, then you |
+|| |probably should also override DEF_DB_TYPE as |
+|| |described in section 4.6. |
+||______________________________|_____________________________________________|
+||-DNO_DNSSEC |Do not build with DNSSEC support, even if the|
+|| |resolver library appears to support it. |
+||______________________________|_____________________________________________|
+|| |Do not build with Solaris /dev/poll support. |
+||-DNO_DEVPOLL |By default, /dev/poll support is compiled in |
+|| |on Solaris versions that are known to support|
+|| |this feature. |
+||______________________________|_____________________________________________|
+|| |Do not build with Linux EPOLL support. By |
+||-DNO_EPOLL |default, EPOLL support is compiled in on |
+|| |platforms that are known to support this |
+|| |feature. |
+||______________________________|_____________________________________________|
+|| |Do not build with EAI (SMTPUTF8) support. By |
+||-DNO_EAI |default, EAI support is compiled in when the |
+|| |"icuuc" library and header files are found. |
+||______________________________|_____________________________________________|
+|| |Do not require support for C99 "inline" |
+|| |functions. Instead, implement argument |
+||-DNO_INLINE |typechecks for non-printf/scanf-like |
+|| |functions with ternary operators and |
+|| |unreachable code. |
+||______________________________|_____________________________________________|
+|| |Do not build with IPv6 support. By default, |
+|| |IPv6 support is compiled in on platforms that|
+|| |are known to have IPv6 support. Note: this |
+||-DNO_IPV6 |directive is for debugging And testing only. |
+|| |It is not guaranteed to work on all |
+|| |platforms. If you don't want IPv6 support, |
+|| |set "inet_protocols = ipv4" in main.cf. |
+||______________________________|_____________________________________________|
+|| |Do not build with FreeBSD / NetBSD / OpenBSD |
+||-DNO_KQUEUE |/ MacOSX KQUEUE support. By default, KQUEUE |
+|| |support is compiled in on platforms that are |
+|| |known to support it. |
+||______________________________|_____________________________________________|
+|| |Do not build with NIS or NISPLUS support. NIS|
+||-DNO_NIS |is not available on some recent Linux |
+|| |distributions. |
+||______________________________|_____________________________________________|
+|| |Do not build with NISPLUS support. NISPLUS is|
+||-DNO_NISPLUS |not available on some recent Solaris |
+|| |distributions. |
+||______________________________|_____________________________________________|
+|| |Do not build with PCRE support. By default, |
+||-DNO_PCRE |PCRE support is compiled in when the pcre- |
+|| |config utility is installed. |
+||______________________________|_____________________________________________|
+|| |Disable support for POSIX getpwnam_r/ |
+||-DNO_POSIX_GETPW_R |getpwuid_r. By default Postfix uses these |
+|| |where they are known to be available. |
+||______________________________|_____________________________________________|
+|| |Use setjmp()/longjmp() instead of sigsetjmp |
+||-DNO_SIGSETJMP |()/siglongjmp(). By default, Postfix uses |
+|| |sigsetjmp()/siglongjmp() when they are known |
+|| |to be available. |
+||______________________________|_____________________________________________|
+|| |Use sprintf() instead of snprintf(). By |
+||-DNO_SNPRINTF |default, Postfix uses snprintf() except on |
+|| |ancient systems. |
+||______________________________|_____________________________________________|
+| |Specifies a non-default compiler debugging |
+|DEBUG=debug_level |level. The default is "-g". Specify DEBUG= to|
+| |turn off debugging. |
+|_______________________________|_____________________________________________|
+| |Specifies a non-default optimization level. |
+|OPT=optimization_level |The default is "-O". Specify OPT= to turn off|
+| |optimization. |
+|_______________________________|_____________________________________________|
+| |Specifies options for the postfix-install |
+|POSTFIX_INSTALL_OPTS=-option...|command, separated by whitespace. Currently, |
+| |the only supported option is "-keep-build- |
+| |mtime". |
+|_______________________________|_____________________________________________|
+| |Specifies non-default compiler options for |
+|SHLIB_CFLAGS=flags |building Postfix dynamically-linked libraries|
+| |and database plugins. The typical default is |
+| |"-fPIC". |
+|_______________________________|_____________________________________________|
+| |Specifies a non-default runpath for Postfix |
+|SHLIB_RPATH=rpath |dynamically-linked libraries. The typical |
+| |default is "'-Wl,-rpath,${SHLIB_DIR}'". |
+|_______________________________|_____________________________________________|
+| |Specifies a non-default suffix for Postfix |
+|SHLIB_SUFFIX=suffix |dynamically-linked libraries and database |
+| |plugins. The typical default is ".so". |
+|_______________________________|_____________________________________________|
+| |Specifies non-default compiler warning |
+|WARN="warning_flags..." |options for use when "make" is invoked in a |
+| |source subdirectory only. |
+|_______________________________|_____________________________________________|
4.8 - Support for thousands of processes
diff --git a/external/ibm-public/postfix/dist/LICENSE b/external/ibm-public/postfix/dist/LICENSE
index 45b98347aea..58ea8f1c268 100644
--- a/external/ibm-public/postfix/dist/LICENSE
+++ b/external/ibm-public/postfix/dist/LICENSE
@@ -1,3 +1,290 @@
+LICENSE - SECURE MAILER
+
+This software is dual-licensed under both the Eclipse Public License
+version 2.0 and the IBM Public License version 1.0, for those who
+are more comfortable continuing with that license. Recipients can
+choose to take the software under the license of their choice.
+
+The remainder of this text contains a copy of each license.
+
+Eclipse Public License - v 2.0
+
+ THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE
+ PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION
+ OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+ a) in the case of the initial Contributor, the initial content
+ Distributed under this Agreement, and
+
+ b) in the case of each subsequent Contributor:
+ i) changes to the Program, and
+ ii) additions to the Program;
+ where such changes and/or additions to the Program originate from
+ and are Distributed by that particular Contributor. A Contribution
+ "originates" from a Contributor if it was added to the Program by
+ such Contributor itself or anyone acting on such Contributor's behalf.
+ Contributions do not include changes or additions to the Program that
+ are not Modified Works.
+
+"Contributor" means any person or entity that Distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which
+are necessarily infringed by the use or sale of its Contribution alone
+or when combined with the Program.
+
+"Program" means the Contributions Distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement
+or any Secondary License (as applicable), including Contributors.
+
+"Derivative Works" shall mean any work, whether in Source Code or other
+form, that is based on (or derived from) the Program and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship.
+
+"Modified Works" shall mean any work in Source Code or other form that
+results from an addition to, deletion from, or modification of the
+contents of the Program, including, for purposes of clarity any new file
+in Source Code form that contains any contents of the Program. Modified
+Works shall not include works that contain only declarations,
+interfaces, types, classes, structures, or files of the Program solely
+in each case in order to link to, bind by name, or subclass the Program
+or Modified Works thereof.
+
+"Distribute" means the acts of a) distributing or b) making available
+in any manner that enables the transfer of a copy.
+
+"Source Code" means the form of a Program preferred for making
+modifications, including but not limited to software source code,
+documentation source, and configuration files.
+
+"Secondary License" means either the GNU General Public License,
+Version 2.0, or any later versions of that license, including any
+exceptions or additional permissions as identified by the initial
+Contributor.
+
+2. GRANT OF RIGHTS
+
+ a) Subject to the terms of this Agreement, each Contributor hereby
+ grants Recipient a non-exclusive, worldwide, royalty-free copyright
+ license to reproduce, prepare Derivative Works of, publicly display,
+ publicly perform, Distribute and sublicense the Contribution of such
+ Contributor, if any, and such Derivative Works.
+
+ b) Subject to the terms of this Agreement, each Contributor hereby
+ grants Recipient a non-exclusive, worldwide, royalty-free patent
+ license under Licensed Patents to make, use, sell, offer to sell,
+ import and otherwise transfer the Contribution of such Contributor,
+ if any, in Source Code or other form. This patent license shall
+ apply to the combination of the Contribution and the Program if, at
+ the time the Contribution is added by the Contributor, such addition
+ of the Contribution causes such combination to be covered by the
+ Licensed Patents. The patent license shall not apply to any other
+ combinations which include the Contribution. No hardware per se is
+ licensed hereunder.
+
+ c) Recipient understands that although each Contributor grants the
+ licenses to its Contributions set forth herein, no assurances are
+ provided by any Contributor that the Program does not infringe the
+ patent or other intellectual property rights of any other entity.
+ Each Contributor disclaims any liability to Recipient for claims
+ brought by any other entity based on infringement of intellectual
+ property rights or otherwise. As a condition to exercising the
+ rights and licenses granted hereunder, each Recipient hereby
+ assumes sole responsibility to secure any other intellectual
+ property rights needed, if any. For example, if a third party
+ patent license is required to allow Recipient to Distribute the
+ Program, it is Recipient's responsibility to acquire that license
+ before distributing the Program.
+
+ d) Each Contributor represents that to its knowledge it has
+ sufficient copyright rights in its Contribution, if any, to grant
+ the copyright license set forth in this Agreement.
+
+ e) Notwithstanding the terms of any Secondary License, no
+ Contributor makes additional grants to any Recipient (other than
+ those set forth in this Agreement) as a result of such Recipient's
+ receipt of the Program under the terms of a Secondary License
+ (if permitted under the terms of Section 3).
+
+3. REQUIREMENTS
+
+3.1 If a Contributor Distributes the Program in any form, then:
+
+ a) the Program must also be made available as Source Code, in
+ accordance with section 3.2, and the Contributor must accompany
+ the Program with a statement that the Source Code for the Program
+ is available under this Agreement, and informs Recipients how to
+ obtain it in a reasonable manner on or through a medium customarily
+ used for software exchange; and
+
+ b) the Contributor may Distribute the Program under a license
+ different than this Agreement, provided that such license:
+ i) effectively disclaims on behalf of all other Contributors all
+ warranties and conditions, express and implied, including
+ warranties or conditions of title and non-infringement, and
+ implied warranties or conditions of merchantability and fitness
+ for a particular purpose;
+
+ ii) effectively excludes on behalf of all other Contributors all
+ liability for damages, including direct, indirect, special,
+ incidental and consequential damages, such as lost profits;
+
+ iii) does not attempt to limit or alter the recipients' rights
+ in the Source Code under section 3.2; and
+
+ iv) requires any subsequent distribution of the Program by any
+ party to be under a license that satisfies the requirements
+ of this section 3.
+
+3.2 When the Program is Distributed as Source Code:
+
+ a) it must be made available under this Agreement, or if the
+ Program (i) is combined with other material in a separate file or
+ files made available under a Secondary License, and (ii) the initial
+ Contributor attached to the Source Code the notice described in
+ Exhibit A of this Agreement, then the Program may be made available
+ under the terms of such Secondary Licenses, and
+
+ b) a copy of this Agreement must be included with each copy of
+ the Program.
+
+3.3 Contributors may not remove or alter any copyright, patent,
+trademark, attribution notices, disclaimers of warranty, or limitations
+of liability ("notices") contained within the Program from any copy of
+the Program which they Distribute, provided that Contributors may add
+their own appropriate notices.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities
+with respect to end users, business partners and the like. While this
+license is intended to facilitate the commercial use of the Program,
+the Contributor who includes the Program in a commercial product
+offering should do so in a manner which does not create potential
+liability for other Contributors. Therefore, if a Contributor includes
+the Program in a commercial product offering, such Contributor
+("Commercial Contributor") hereby agrees to defend and indemnify every
+other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits
+and other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such
+Commercial Contributor in connection with its distribution of the Program
+in a commercial product offering. The obligations in this section do not
+apply to any claims or Losses relating to any actual or alleged
+intellectual property infringement. In order to qualify, an Indemnified
+Contributor must: a) promptly notify the Commercial Contributor in
+writing of such claim, and b) allow the Commercial Contributor to control,
+and cooperate with the Commercial Contributor in, the defense and any
+related settlement negotiations. The Indemnified Contributor may
+participate in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial
+product offering, Product X. That Contributor is then a Commercial
+Contributor. If that Commercial Contributor then makes performance
+claims, or offers warranties related to Product X, those performance
+claims and warranties are such Commercial Contributor's responsibility
+alone. Under this section, the Commercial Contributor would have to
+defend claims against the other Contributors related to those performance
+claims and warranties, and if a court requires any other Contributor to
+pay any damages as a result, the Commercial Contributor must pay
+those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, THE PROGRAM IS PROVIDED ON AN "AS IS"
+BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF
+TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR
+PURPOSE. Each Recipient is solely responsible for determining the
+appropriateness of using and distributing the Program and assumes all
+risks associated with its exercise of rights under this Agreement,
+including but not limited to the risks and costs of program errors,
+compliance with applicable laws, damage to or loss of data, programs
+or equipment, and unavailability or interruption of operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, NEITHER RECIPIENT NOR ANY CONTRIBUTORS
+SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST
+PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of
+the remainder of the terms of this Agreement, and without further
+action by the parties hereto, such provision shall be reformed to the
+minimum extent necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity
+(including a cross-claim or counterclaim in a lawsuit) alleging that the
+Program itself (excluding combinations of the Program with other software
+or hardware) infringes such Recipient's patent(s), then such Recipient's
+rights granted under Section 2(b) shall terminate as of the date such
+litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it
+fails to comply with any of the material terms or conditions of this
+Agreement and does not cure such failure in a reasonable period of
+time after becoming aware of such noncompliance. If all Recipient's
+rights under this Agreement terminate, Recipient agrees to cease use
+and distribution of the Program as soon as reasonably practicable.
+However, Recipient's obligations under this Agreement and any licenses
+granted by Recipient relating to the Program shall continue and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement,
+but in order to avoid inconsistency the Agreement is copyrighted and
+may only be modified in the following manner. The Agreement Steward
+reserves the right to publish new versions (including revisions) of
+this Agreement from time to time. No one other than the Agreement
+Steward has the right to modify this Agreement. The Eclipse Foundation
+is the initial Agreement Steward. The Eclipse Foundation may assign the
+responsibility to serve as the Agreement Steward to a suitable separate
+entity. Each new version of the Agreement will be given a distinguishing
+version number. The Program (including Contributions) may always be
+Distributed subject to the version of the Agreement under which it was
+received. In addition, after a new version of the Agreement is published,
+Contributor may elect to Distribute the Program (including its
+Contributions) under the new version.
+
+Except as expressly stated in Sections 2(a) and 2(b) above, Recipient
+receives no rights or licenses to the intellectual property of any
+Contributor under this Agreement, whether expressly, by implication,
+estoppel or otherwise. All rights in the Program not expressly granted
+under this Agreement are reserved. Nothing in this Agreement is intended
+to be enforceable by any entity that is not a Contributor or Recipient.
+No third-party beneficiary rights are created under this Agreement.
+
+Exhibit A - Form of Secondary Licenses Notice
+
+"This Source Code may also be made available under the following
+Secondary Licenses when the conditions for such availability set forth
+in the Eclipse Public License, v. 2.0 are satisfied: {name license(s),
+version(s), and exceptions or additional permissions here}."
+
+ Simply including a copy of this Agreement, including this Exhibit A
+ is not sufficient to license the Source Code under Secondary Licenses.
+
+ If it is not possible or desirable to put the notice in a particular
+ file, then You may include the notice in a location (such as a LICENSE
+ file in a relevant directory) where a recipient would be likely to
+ look for such a notice.
+
+ You may add additional accurate notices of copyright ownership.
+
IBM PUBLIC LICENSE VERSION 1.0 - SECURE MAILER
THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS IBM PUBLIC
diff --git a/external/ibm-public/postfix/dist/Makefile b/external/ibm-public/postfix/dist/Makefile
index bf0bad87855..0e79e472c81 100644
--- a/external/ibm-public/postfix/dist/Makefile
+++ b/external/ibm-public/postfix/dist/Makefile
@@ -1,7 +1,7 @@
# Usage:
# make makefiles [name=value]...
#
-# See makedefs for a descripton of available options.
+# See makedefs for a description of available options.
# Examples:
#
# make makefiles
diff --git a/external/ibm-public/postfix/dist/Makefile.in b/external/ibm-public/postfix/dist/Makefile.in
index 6d9d9b43361..f70bd1444ee 100644
--- a/external/ibm-public/postfix/dist/Makefile.in
+++ b/external/ibm-public/postfix/dist/Makefile.in
@@ -1,3 +1,5 @@
+# To test with valgrind:
+# make -i tests VALGRIND="valgrind --tool=memcheck --log-file=/some/where.%p"
SHELL = /bin/sh
WARN = -Wmissing-prototypes -Wformat -Wno-comment
OPTS = 'WARN=$(WARN)'
@@ -10,7 +12,7 @@ DIRS = src/util src/global src/dns src/tls src/xsasl src/master src/milter \
src/postsuper src/qmqpd src/spawn src/flush src/verify \
src/virtual src/proxymap src/anvil src/scache src/discard src/tlsmgr \
src/postmulti src/postscreen src/dnsblog src/tlsproxy \
- src/posttls-finger
+ src/posttls-finger src/postlogd
MANDIRS = proto man html
LIBEXEC = libexec/post-install libexec/postfix-script libexec/postfix-wrapper \
libexec/postmulti-script libexec/postfix-tls-script
@@ -122,23 +124,23 @@ printfck: update
install: update
SHLIB_ENV_VAR= SHLIB_ENV_VAL= \
$(SHLIB_ENV) shlib_directory=$(SHLIB_DIR_OVERRIDE) $(SHELL) \
- postfix-install
+ postfix-install $(POSTFIX_INSTALL_OPTS)
package: update
SHLIB_ENV_VAR= SHLIB_ENV_VAL= \
$(SHLIB_ENV) shlib_directory=$(SHLIB_DIR_OVERRIDE) $(SHELL) \
- postfix-install -package
+ postfix-install -package $(POSTFIX_INSTALL_OPTS)
upgrade: update
SHLIB_ENV_VAR= SHLIB_ENV_VAL= \
$(SHLIB_ENV) shlib_directory=$(SHLIB_DIR_OVERRIDE) $(SHELL) \
- postfix-install -non-interactive
+ postfix-install -non-interactive $(POSTFIX_INSTALL_OPTS)
non-interactive-package: update
SHLIB_ENV_VAR= SHLIB_ENV_VAL= \
$(SHLIB_ENV) shlib_directory=$(SHLIB_DIR_OVERRIDE) $(SHELL) \
- postfix-install -non-interactive -package
+ postfix-install -non-interactive -package $(POSTFIX_INSTALL_OPTS)
depend clean:
set -e; for i in $(DIRS); do \
@@ -153,7 +155,7 @@ depend_update:
tidy: clean
rm -f Makefile */Makefile src/*/Makefile
- cp Makefile.init Makefile
+ cp -p Makefile.init Makefile
rm -f README_FILES/RELEASE_NOTES
ln -s ../RELEASE_NOTES README_FILES
rm -f bin/[!CRS]* lib/[!CRS]* include/[!CRS]* libexec/[!CRS]* \
diff --git a/external/ibm-public/postfix/dist/Makefile.init b/external/ibm-public/postfix/dist/Makefile.init
index bf0bad87855..0e79e472c81 100644
--- a/external/ibm-public/postfix/dist/Makefile.init
+++ b/external/ibm-public/postfix/dist/Makefile.init
@@ -1,7 +1,7 @@
# Usage:
# make makefiles [name=value]...
#
-# See makedefs for a descripton of available options.
+# See makedefs for a description of available options.
# Examples:
#
# make makefiles
diff --git a/external/ibm-public/postfix/dist/README_FILES/AAAREADME b/external/ibm-public/postfix/dist/README_FILES/AAAREADME
index d4e10f07068..9afa3b7d26e 100644
--- a/external/ibm-public/postfix/dist/README_FILES/AAAREADME
+++ b/external/ibm-public/postfix/dist/README_FILES/AAAREADME
@@ -12,8 +12,8 @@ GGeenneerraall ccoonnffiigguurraattiioonn
* TLS_README: TLS Encryption and authentication
* FORWARD_SECRECY_README: TLS Forward Secrecy
* IPV6_README: IP Version 6 Support
- * IPV6_README: IP Version 6 Support
* SMTPUTF8_README: SMTPUTF8 Support
+ * MAILLOG_README: Postfix logging to file or stdout
* COMPATIBILITY_README: Backwards-Compatibility Safety Net
* INSTALL: Installation from source code
@@ -78,6 +78,7 @@ OOtthheerr ttooppiiccss
* ADDRESS_CLASS_README: Address Classes
* CONNECTION_CACHE_README: Connection cache howto
* DSN_README: Postfix DSN support
+ * BDAT_README: Postfix BDAT (CHUNKING) support
* PACKAGE_README: Guidelines for Package Builders
* SCHEDULER_README: Queue Scheduler
* XCLIENT_README: XCLIENT Command
diff --git a/external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README b/external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README
index e1fcdee46bd..a0ccc204001 100644
--- a/external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README
+++ b/external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README
@@ -698,7 +698,7 @@ is used for deliveries to commands or files in "root"-owned aliases.
LLooccaall ppeerr--uusseerr ..ffoorrwwaarrdd ffiilleess
-With delivery via the local(8) deliver agent, users can control their own mail
+With delivery via the local(8) delivery agent, users can control their own mail
delivery by specifying destinations in a file called .forward in their home
directories. The syntax of these files is the same as with the local aliases(5)
file, except that the left-hand side of the alias (lookup key and colon) are
diff --git a/external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README b/external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README
index e8624ec922e..cfd8851107b 100644
--- a/external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README
+++ b/external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README
@@ -172,16 +172,17 @@ Postfix can also be configured to relay mail from "mobile" clients that send
mail from outside an authorized network block. This is explained in the
SASL_README and TLS_README documents.
-IMPORTANT: If your machine is connected to a wide area network then your
-default mynetworks setting may be too friendly.
+IMPORTANT: If your machine is connected to a wide area network then the
+"mynetworks_style = host" setting may be too friendly.
Examples (specify only one of the following):
/etc/postfix/main.cf:
- mynetworks_style = subnet (default: authorize subnetworks)
- mynetworks_style = host (safe: authorize local machine only)
- mynetworks = 127.0.0.0/8 (safe: authorize local machine only)
+ mynetworks_style = subnet (not safe on a wide area network)
+ mynetworks_style = host (authorize local machine only)
+ mynetworks = 127.0.0.0/8 (authorize local machine only)
mynetworks = 127.0.0.0/8 168.100.189.2/32 (authorize local machine)
+ mynetworks = 127.0.0.0/8 168.100.189.2/28 (authorize local networks)
You can specify the trusted networks in the main.cf file, or you can let
Postfix do the work for you. The default is to let Postfix do the work. The
diff --git a/external/ibm-public/postfix/dist/README_FILES/BDAT_README b/external/ibm-public/postfix/dist/README_FILES/BDAT_README
new file mode 100644
index 00000000000..2dc1df35ce6
--- /dev/null
+++ b/external/ibm-public/postfix/dist/README_FILES/BDAT_README
@@ -0,0 +1,124 @@
+PPoossttffiixx BBDDAATT ((CCHHUUNNKKIINNGG)) ssuuppppoorrtt
+
+-------------------------------------------------------------------------------
+
+OOvveerrvviieeww
+
+Postfix SMTP server supports RFC 3030 CHUNKING (the BDAT command) without
+BINARYMIME, in both smtpd(8) and postscreen(8). It is enabled by default.
+
+Topics covered in this document:
+
+ * Disabling BDAT support
+ * Impact on existing configurations
+ * Example SMTP session
+ * Benefits of CHUNKING (BDAT) support without BINARYMIME
+ * Downsides of CHUNKING (BDAT) support
+
+DDiissaabblliinngg BBDDAATT ssuuppppoorrtt
+
+BDAT support is enabled by default. To disable BDAT support globally:
+
+ /etc/postfix/main.cf:
+ # The logging alternative:
+ smtpd_discard_ehlo_keywords = chunking
+ # The non-logging alternative:
+ smtpd_discard_ehlo_keywords = chunking, silent_discard
+
+Specify '-o smtpd_discard_ehlo_keywords=' in master.cf for the submission and
+smtps services, if you have clients that benefit from CHUNKING support.
+
+IImmppaacctt oonn eexxiissttiinngg ccoonnffiigguurraattiioonnss
+
+ * There are no changes for smtpd_mumble_restrictions, smtpd_proxy_filter,
+ smtpd_milters, or for postscreen settings, except for the above mentioned
+ option to suppress the SMTP server's CHUNKING service announcement.
+
+ * There are no changes in the Postfix queue file content, no changes for
+ down-stream SMTP servers or after-queue content filters, and no changes in
+ the envelope or message content that Milters will receive.
+
+EExxaammppllee SSMMTTPP sseessssiioonn
+
+The main differences are that the Postfix SMTP server announces "CHUNKING"
+support in the EHLO response, and that instead of sending one DATA request, the
+remote SMTP client may send one or more BDAT requests. In the example below,
+"S:" indicates server responses, and "C:" indicates client requests (bold
+font).
+
+ S: 220 server.example.com
+ C: EEHHLLOO cclliieenntt..eexxaammppllee..ccoomm
+ S: 250-server.example.com
+ S: 250-PIPELINING
+ S: 250-SIZE 153600000
+ S: 250-VRFY
+ S: 250-ETRN
+ S: 250-STARTTLS
+ S: 250-AUTH PLAIN LOGIN
+ S: 250-ENHANCEDSTATUSCODES
+ S: 250-8BITMIME
+ S: 250-DSN
+ S: 250-SMTPUTF8
+ S: 250 CHUNKING
+ C: MMAAIILL FFRROOMM::<<sseennddeerr@@eexxaammppllee..ccoomm>>
+ S: 250 2.1.0 Ok
+ C: RRCCPPTT TTOO::<<rreecciippiieenntt@@eexxaammppllee..ccoomm>>
+ S: 250 2.1.5 Ok
+ C: BBDDAATT 1100000000
+ C: ....ffoolllloowweedd bbyy 1100000000 bbyytteess......
+ S: 250 2.0.0 Ok: 10000 bytes
+ C: BBDDAATT 112233
+ C: ....ffoolllloowweedd bbyy 112233 bbyytteess......
+ S: 250 2.0.0 Ok: 123 bytes
+ C: BBDDAATT 00 LLAASSTT
+ S: 250 2.0.0 Ok: 10123 bytes queued as 41yYhh41qmznjbD
+ C: QQUUIITT
+ S: 221 2.0.0 Bye
+
+Internally in Postfix, there is no difference between mail that was received
+with BDAT or with DATA. Postfix smtpd_mumble_restrictions, policy delegation
+queries, smtpd_proxy_filter and Milters all behave as if Postfix received (MAIL
++ RCPT + DATA + end-of-data). However, Postfix will log BDAT-related failures
+as "xxx after BDAT" to avoid complicating troubleshooting (xxx = 'lost
+connection' or 'timeout'), and will log a warning when a client sends a
+malformed BDAT command.
+
+BBeenneeffiittss ooff CCHHUUNNKKIINNGG ((BBDDAATT)) ssuuppppoorrtt wwiitthhoouutt BBIINNAARRYYMMIIMMEE
+
+Support for CHUNKING (BDAT) was added to improve interoperability with some
+clients, a benefit that would reportedly exist even without Postfix support for
+BINARYMIME. Since June 2018, Wietse's mail server has received BDAT commands
+from a variety of systems.
+
+Postfix does not support BINARYMIME at this time because:
+
+ * BINARYMIME support would require moderately invasive changes to Postfix, to
+ support email content that is not line-oriented. With BINARYMIME, the
+ Content-Length: message header specifies the length of content that may or
+ may not have line boundaries. Without BINARYMIME support, email RFCs
+ require that binary content is base64-encoded, and formatted as lines of
+ text.
+
+ * For delivery to non-BINARYMIME systems including UNIX mbox, the available
+ options are to convert binary content into 8bit text, one of the 7bit forms
+ (base64 or quoted-printable), or to return email as undeliverable. Any
+ conversion would obviously break digital signatures, so conversion would
+ have to happen before signing.
+
+DDoowwnnssiiddeess ooff CCHHUUNNKKIINNGG ((BBDDAATT)) ssuuppppoorrtt
+
+The RFC 3030 authors did not specify any limitations on how clients may
+pipeline commands (i.e. send commands without waiting for a server response).
+If a server announces PIPELINING support, like Postfix does, then a remote SMTP
+client can pipeline all commands following EHLO, for example, MAIL/RCPT/BDAT/
+BDAT/MAIL/RCPT/BDAT, without ever having to wait for a server response. This
+means that with BDAT, the Postfix SMTP server cannot distinguish between a
+well-behaved client and a spambot, based on their command pipelining behavior.
+If you require "reject_unauth_pipelining" to block spambots, then turn off
+Postfix's CHUNKING announcement as described above.
+
+In RFC 4468, the authors write that a client may pipeline commands, and that
+after sending BURL LAST or BDAT LAST, a client must wait for the server's
+response. But as this text does not appear in RFC 3030 which defines BDAT, is
+it a useless restriction that Postfix will not enforce.
+
diff --git a/external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README b/external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README
index 83d300cf438..20674ff6c82 100644
--- a/external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README
+++ b/external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README
@@ -33,6 +33,9 @@ The following messages may be logged:
* Using backwards-compatible default setting chroot=y
+ * Using backwards-compatible default setting smtpd_relay_restrictions =
+ (empty)
+
* Using backwards-compatible default setting mynetworks_style=subnet
* Using backwards-compatible default setting relay_domains=$mydestination
@@ -49,10 +52,14 @@ described at the end of this document.
UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg aappppeenndd__ddoott__mmyyddoommaaiinn==yyeess
-The append_dot_mydomain default value has changed from "yes" to "no". As long
-as the append_dot_mydomain parameter is left at its implicit default value, and
-the backwards-compatible default setting is turned on, Postfix may log one of
-the following messages:
+The append_dot_mydomain default value has changed from "yes" to "no". This
+could result in unexpected non-delivery of email after Postfix is updated from
+an older version. The backwards-compatibility safety net is designed to prevent
+such surprises.
+
+As long as the append_dot_mydomain parameter is left at its implicit default
+value, and the compatibility_level setting is less than 1, Postfix may log one
+of the following messages:
* Messages about missing "localhost" in mydestination or other address class:
@@ -81,10 +88,16 @@ the following messages:
UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg cchhrroooott==yy
-The master.cf chroot default value has changed from "y" (yes) to "n" (no). As
-long as a master.cf chroot field is left at its implicit default value, and the
-backwards-compatible default setting is turned on, Postfix may log the
-following message while it reads the master.cf file:
+The master.cf chroot default value has changed from "y" (yes) to "n" (no). The
+new default avoids the need for copies of system files under the Postfix queue
+directory. However, sites with strict security requirements may want to keep
+the chroot feature enabled after updating Postfix from an older version. The
+backwards-compatibility safety net is designed allow the administrator to
+choose if they want to keep the old behavior.
+
+As long as a master.cf chroot field is left at its implicit default value, and
+the compatibility_level setting is less than 1, Postfix may log the following
+message while it reads the master.cf file:
postfix/master[27664]: /etc/postfix/master.cf: line 72: using
backwards-compatible default setting chroot=y
@@ -96,13 +109,45 @@ example, to update the chroot setting for the "smtp inet" service:
# ppoossttccoonnff --FF ssmmttpp//iinneett//cchhrroooott==yy
# ppoossttffiixx rreellooaadd
+UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg ssmmttppdd__rreellaayy__rreessttrriiccttiioonnss == ((eemmppttyy))
+
+The smtpd_relay_restrictions feature was introduced with Postfix version 2.10,
+as a safety mechanism for configuration errors in smtpd_recipient_restrictions
+that could make Postfix an open relay.
+
+The smtpd_relay_restrictions implicit default setting forbids mail to remote
+destinations from clients that don't match permit_mynetworks or
+permit_sasl_authenticated. This could result in unexpected 'Relay access
+denied' errors after Postfix is updated from an older Postfix version. The
+backwards-compatibility safety net is designed to prevent such surprises.
+
+When the compatibility_level less than 1, and the smtpd_relay_restrictions
+parameter is left at its implicit default setting, Postfix may log the
+following message:
+
+ postfix/smtpd[38463]: using backwards-compatible default setting
+ "smtpd_relay_restrictions = (empty)" to avoid "Relay access
+ denied" error for recipient "user@example.com" from client
+ "host.example.net[10.0.0.2]"
+
+If this request should not be blocked, then the system administrator should
+make the backwards-compatible setting "smtpd_relay_restrictions=" (i.e. empty)
+permanent in main.cf:
+
+ # ppoossttccoonnff ssmmttppdd__rreellaayy__rreessttrriiccttiioonnss==
+ # ppoossttffiixx rreellooaadd
+
UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg mmyynneettwwoorrkkss__ssttyyllee==ssuubbnneett
The mynetworks_style default value has changed from "subnet" to "host". This
-parameter is used to implement the "permit_mynetworks" feature. As long as the
-mynetworks and mynetworks_style parameters are left at their implicit default
-values, and the backwards-compatible default setting is turned on, the Postfix
-SMTP server may log one of the following messages:
+parameter is used to implement the "permit_mynetworks" feature. The change
+could in unexpected 'access denied' errors after Postfix is updated from an
+older version. The backwards-compatibility safety net is designed to prevent
+such surprises.
+
+As long as the mynetworks and mynetworks_style parameters are left at their
+implicit default values, and the compatibility_level setting is less than 2,
+the Postfix SMTP server may log one of the following messages:
postfix/smtpd[17375]: using backwards-compatible default setting
mynetworks_style=subnet to permit request from client
@@ -122,9 +167,13 @@ permanent in main.cf:
UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee ddeeffaauulltt sseettttiinngg rreellaayy__ddoommaaiinnss==$$mmyyddeessttiinnaattiioonn
The relay_domains default value has changed from "$mydestination" to the empty
-value. As long as the relay_domains parameter is left at its implicit default
-value, and the backwards-compatible default setting is turned on, Postfix may
-log one of the following messages.
+value. This could result in unexpected 'Relay access denied' errors or ETRN
+errors after Postfix is updated from an older version. The backwards-
+compatibility safety net is designed to prevent such surprises.
+
+As long as the relay_domains parameter is left at its implicit default value,
+and the compatibility_level setting is less than 2, Postfix may log one of the
+following messages.
* Messages about accepting mail for a remote domain:
@@ -163,14 +212,14 @@ UUssiinngg bbaacckkwwaarrddss--ccoommppaattiibbllee dd
The smtputf8_enable default value has changed from "no" to "yes. With the new
"yes" setting, the Postfix SMTP server rejects non-ASCII addresses from clients
-that don't request SMTPUTF8 support. With the old "no" setting, Postfix will
-accept such addresses, even if such addresses are not permitted by traditional
-SMTP standards.
+that don't request SMTPUTF8 support, after Postfix is updated from an older
+version. The backwards-compatibility safety net is designed to prevent such
+surprises.
As long as the smtputf8_enable parameter is left at its implicit default value,
-and the backwards-compatible default setting is turned on, Postfix logs a
-warning each time an SMTP command uses a non-ASCII address localpart without
-requesting SMTPUTF8 support:
+and the compatibility_level setting is less than 1, Postfix logs a warning each
+time an SMTP command uses a non-ASCII address localpart without requesting
+SMTPUTF8 support:
postfix/smtpd[27560]: using backwards-compatible default setting
smtputf8_enable=no to accept non-ASCII sender address
diff --git a/external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README b/external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README
index 5067f7aea2c..bd2fd03084e 100644
--- a/external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README
+++ b/external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README
@@ -7,6 +7,9 @@ IInnttrroodduuccttiioonn
This document describes the Postfix connection cache implementation, which is
available with Postfix version 2.2 and later.
+See Client-side TLS connection reuse for how this connection cache is used to
+implement multiple deliveries per TLS-encrypted connection.
+
Topics covered in this document:
* What SMTP connection caching can do for you
@@ -64,14 +67,14 @@ to access this cache.
/-- smtp(8) --> Internet
- qmgr(8) |
- |
- \-- | smtp(8) --> Internet
- |
- ^
- |
+ qmgr(8)
+ |
+ \-- | smtp(8) --> Internet
+ |
+ ^
+ |
- scache(8)
+ scache(8)
When SMTP connection caching is enabled (see next section), the smtp(8) client
does not disconnect after a mail transaction, but gives the connection to the
@@ -156,7 +159,6 @@ mechanisms:
MTAs, the slowest inbound MTA will attract most connections from Postfix to
that destination).
- .
Postfix 2.3 logs the use count of multiply-used connections, as shown in
the following example:
@@ -174,12 +176,11 @@ CCoonnnneeccttiioonn ccaacchhee lliimmiittaattiioonnss
Postfix SMTP connection caching conflicts with certain applications:
- * The Postfix shared connection cache cannot be used with TLS, because saved
- TLS session information can be used only when a new connection is created
- (this limitation does not exist in connection caching implementations that
- reuse a connection only in the process that creates it). For this reason,
- the Postfix smtp(8) client always closes the connection after completing an
- attempt to deliver mail over TLS.
+ * With Postfix versions < 3.4, the Postfix shared connection cache cannot be
+ used with TLS, because an open TLS connection can be reused only in the
+ process that creates it. For this reason, the Postfix smtp(8) client
+ historically always closed the connection after completing an attempt to
+ deliver mail over TLS.
* Postfix connection caching currently does not support multiple SASL
accounts per mail server. Specifically, Postfix connection caching assumes
diff --git a/external/ibm-public/postfix/dist/README_FILES/DATABASE_README b/external/ibm-public/postfix/dist/README_FILES/DATABASE_README
index 7526e0bc1c9..99e10a7555c 100644
--- a/external/ibm-public/postfix/dist/README_FILES/DATABASE_README
+++ b/external/ibm-public/postfix/dist/README_FILES/DATABASE_README
@@ -215,9 +215,11 @@ To find out what database types your Postfix system supports, use the "ppooss
iinnlliinnee (read-only)
A non-shared, in-memory lookup table. Example: "inline:{ key=value,
{ key = text with whitespace or comma }}". Key-value pairs are
- separated by whitespace or comma; whitespace after "{" and before "}"
- is ignored. Inline tables eliminate the need to create a database file
- for just a few fixed elements. See also the static: map type.
+ separated by whitespace or comma; with a key-value pair inside "{}",
+ whitespace is ignored after the opening "{", around the "=" between key
+ and value, and before the closing "}". Inline tables eliminate the need
+ to create a database file for just a few fixed elements. See also the
+ static: map type.
iinntteerrnnaall
A non-shared, in-memory hash table. Its content are lost when a process
terminates.
@@ -267,7 +269,8 @@ To find out what database types your Postfix system supports, use the "ppooss
{result1. ..., resultn}". Each table query returns a random choice from
the specified results. The first and last characters of the "randmap:
" table name must be "{" and "}". Within these, individual maps are
- separated with comma or whitespace.
+ separated with comma or whitespace. To give a specific result more
+ weight, specify it multiple times.
rreeggeexxpp (read-only)
A lookup table based on regular expressions. The file format is
described in regexp_table(5). The lookup table name as used in "regexp:
@@ -289,8 +292,8 @@ To find out what database types your Postfix system supports, use the "ppooss
A table that always returns its name as the lookup result. For example,
"static:foobar" always returns the string "foobar" as lookup result.
Specify "static:{ text with whitespace }" when the result contains
- whitespace; this form ignores whitespace after "{" and before "}". See
- also the inline: map type.
+ whitespace; this form ignores whitespace after the opening "{" and
+ before the closing "}". See also the inline: map type.
ttccpp
TCP/IP client. The protocol is described in tcp_table(5). The lookup
table name is "tcp:host:port" where "host" specifies a symbolic
diff --git a/external/ibm-public/postfix/dist/README_FILES/DEBUG_README b/external/ibm-public/postfix/dist/README_FILES/DEBUG_README
index 589036fa017..a277d96636a 100644
--- a/external/ibm-public/postfix/dist/README_FILES/DEBUG_README
+++ b/external/ibm-public/postfix/dist/README_FILES/DEBUG_README
@@ -33,9 +33,15 @@ follows:
LLooookk ffoorr oobbvviioouuss ssiiggnnss ooff ttrroouubbllee
-Postfix logs all failed and successful deliveries to a logfile. The file is
-usually called /var/log/maillog or /var/log/mail; the exact pathname is defined
-in the /etc/syslog.conf file.
+Postfix logs all failed and successful deliveries to a logfile.
+
+ * When Postfix uses syslog logging (the default), the file is usually called
+ /var/log/maillog, /var/log/mail, or something similar; the exact pathname
+ is configured in a file called /etc/syslog.conf, /etc/rsyslog.conf, or
+ something similar.
+
+ * When Postfix uses its own logging system (see MAILLOG_README), the location
+ of the logfile is configured with the Postfix maillog_file parameter.
When Postfix does not receive or deliver mail, the first order of business is
to look for errors that prevent Postfix from working properly:
diff --git a/external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README b/external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README
index fb40e4d5809..0d3fb12c720 100644
--- a/external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README
+++ b/external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README
@@ -14,7 +14,7 @@ is easily subverted by a state-funded adversary.
OOvveerrvviieeww
Postfix supports forward secrecy of TLS network communication since version
-2.2. This support was adopted from Lutz Jnicke's "Postfix TLS patch" for
+2.2. This support was adopted from Lutz Ja"nicke's "Postfix TLS patch" for
earlier Postfix versions. This document will focus on TLS Forward Secrecy in
the Postfix SMTP client and server. See TLS_README for a general description of
Postfix TLS support.
@@ -160,27 +160,29 @@ forward secrecy just works.
Note: With Postfix 2.6 and 2.7, enable EECDH by setting the main.cf
parameter smtpd_tls_eecdh_grade to "strong".
-The elliptic curve situation is evolving, with new curves being introduced to
-augment or replace the NIST curves tarnished by the Snowden revelations.
-Fortunately, TLS clients advertise the list of supported curves to the server
-so that servers can in principle choose newer stronger curves when mutually
-supported. The OpenSSL code for making this possible is not yet released as of
-late 2013 (it is available only in OpenSSL development snapshots).
+The elliptic curve standards are evolving, with new curves introduced in RFC
+8031 to augment or replace the NIST curves tarnished by the Snowden
+revelations. Fortunately, TLS clients advertise their list of supported curves
+to the server so that servers can choose newer stronger curves when mutually
+supported. OpenSSL 1.0.2 released in January 2015 was the first release to
+implement negotiation of supported curves in TLS servers. In older OpenSSL
+releases, the server is limited to selecting a single widely supported curve.
-At some point Postfix will need to adjust to the new API for setting the
-elliptic-curve options. Fortunately, when EECDH support was added to Postfix,
-it introduced a layer of indirection:
+With Postfix prior to 3.2 or OpenSSL prior to 1.0.2, only a single server-side
+curve can be configured, by specifying a suitable EECDH "grade":
smtpd_tls_eecdh_grade = strong | ultra
- tls_eecdh_strong_curve = prime256v1
- tls_eecdh_ultra_curve = secp384r1
-
-When it becomes possible in OpenSSL to support a "menu" of curves, we will
-likely extend "tls_eecdh_strong_curve" to be an ordered list of curves and
-likewise with the "ultra" version, where the two might now overlap, and differ
-mostly in the preference order. As a result most existing configurations will
-then support more curves at the desired security level without any changes to
-main.cf.
+ # Underlying curves, best not changed:
+ # tls_eecdh_strong_curve = prime256v1
+ # tls_eecdh_ultra_curve = secp384r1
+
+Postfix >= 3.2 supports the curve negotiation API of OpenSSL >= 1.0.2. When
+using this software combination, the default setting of "smtpd_tls_eecdh_grade"
+changes to "auto", which selects a curve that is supported by both the server
+and client. The list of candidate curves can be configured via
+"tls_eecdh_auto_curves", which can be used to configure a prioritized list of
+supported curves (most preferred first) on both the server and client. The
+default list is suitable for most users.
FFoorrwwaarrdd SSeeccrreeccyy iinn tthhee PPoossttffiixx SSMMTTPP CClliieenntt
@@ -193,6 +195,12 @@ Linux). If the remote SMTP server supports cipher suites with forward secrecy
between the server and client will resist decryption even if the server's long-
term authentication keys are later compromised.
+Postfix >= 3.2 supports the curve negotiation API of OpenSSL >= 1.0.2. The list
+of candidate curves can be changed via the "tls_eecdh_auto_curves"
+configuration parameter, which can be used to select a prioritized list of
+supported curves (most preferred first) on both the Postfix SMTP server and
+SMTP client. The default list is suitable for most users.
+
The default Postfix SMTP client cipher lists are correctly ordered to prefer
EECDH and EDH cipher suites ahead of similar cipher suites that don't implement
forward secrecy. Administrators are strongly discouraged from changing the
@@ -209,7 +217,13 @@ GGeettttiinngg ssttaarrtteedd,, qquuiicckk aanndd ddiir
EEEECCDDHH CClliieenntt ssuuppppoorrtt ((PPoossttffiixx >>== 22..22 wwiitthh OOppeennSSSSLL >>== 11..00..00))
-This works "out of the box" without additional configuration.
+This works "out of the box" with no need for additional configuration.
+
+Postfix >= 3.2 supports the curve negotiation API of OpenSSL >= 1.0.2. The list
+of candidate curves can be changed via the "tls_eecdh_auto_curves"
+configuration parameter, which can be used to select a prioritized list of
+supported curves (most preferred first) on both the Postfix SMTP server and
+SMTP client. The default list is suitable for most users.
EEEECCDDHH SSeerrvveerr ssuuppppoorrtt ((PPoossttffiixx >>== 22..66 wwiitthh OOppeennSSSSLL >>== 11..00..00))
@@ -219,7 +233,8 @@ curve support may be disabled by the vendor, as in some versions of RedHat
Linux.
/etc/postfix/main.cf:
- # Postfix 2.6 or 2.7 only. This is default with Postfix 2.8 and later.
+ # Postfix 2.6 & 2.7 only. EECDH is on by default with Postfix >= 2.8.
+ # The default grade is "auto" with Postfix >= 3.2.
smtpd_tls_eecdh_grade = strong
EEDDHH CClliieenntt ssuuppppoorrtt ((PPoossttffiixx >>== 22..22,, aallll ssuuppppoorrtteedd OOppeennSSSSLL vveerrssiioonnss))
@@ -279,7 +294,8 @@ verification status.
* With "smtp_tls_loglevel = 1" and "smtpd_tls_loglevel = 1", the Postfix SMTP
client and server will log TLS connection information to the maillog file.
- The general logfile format is:
+ The general logfile format is shown below. With TLS 1.3 there may be
+ additional properties logged after the cipher name and bits.
postfix/smtp[process-id]: Untrusted TLS connection established
to host.example.com[192.168.0.2]:25: TLSv1 with cipher cipher-name
@@ -292,7 +308,8 @@ verification status.
* With "smtpd_tls_received_header = yes", the Postfix SMTP server will record
TLS connection information in the Received: header in the form of comments
(text inside parentheses). The general format depends on the
- smtpd_tls_ask_ccert setting:
+ smtpd_tls_ask_ccert setting. With TLS 1.3 there may be additional
+ properties logged after the cipher name and bits.
Received: from host.example.com (host.example.com [192.168.0.2])
(using TLSv1 with cipher cipher-name
@@ -305,6 +322,47 @@ verification status.
(actual-key-size/raw-key-size bits))
(No client certificate requested)
+ TLS 1.3 examples. Some of the new attributes may not appear when not
+ applicable or not available in older versions of the OpenSSL library.
+
+ Received: from localhost (localhost [127.0.0.1])
+ (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256
+ bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits)
+ server-digest SHA256)
+ (No client certificate requested)
+
+ Received: from localhost (localhost [127.0.0.1])
+ (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256
+ bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits)
+ server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256)
+ (Client CN "example.org", Issuer "example.org" (not verified))
+
+ o The "key-exchange" attribute records the type of "Diffie-Hellman" group
+ used for key agreement. Possible values include "DHE", "ECDHE",
+ "X25519" and "X448". With "DHE", the bit size of the prime will be
+ reported in parentheses after the algorithm name, with "ECDHE", the
+ curve name.
+
+ o The "server-signature" attribute shows the public key signature
+ algorithm used by the server. With "RSA-PSS", the bit size of the
+ modulus will be reported in parentheses. With "ECDSA", the curve name.
+ If, for example, the server has both an RSA and an ECDSA private key
+ and certificate, it will be possible to track which one was used for a
+ given connection.
+
+ o The new "server-digest" attribute records the digest algorithm used by
+ the server to prepare handshake messages for signing. The Ed25519 and
+ Ed448 signature algorithms do not make use of such a digest, so no
+ "server-digest" will be shown for these signature algorithms.
+
+ o When a client certificate is requested with "smtpd_tls_ask_ccert" and
+ the client uses a TLS client-certificate, the "client-signature" and
+ "client-digest" attributes will record the corresponding properties of
+ the client's TLS handshake signature.
+
The next sections will explain what cipher-name, key-size, and peer
verification status information to expect.
@@ -346,6 +404,65 @@ The actual key length and raw algorithm key length are generally the same with
non-export ciphers, but may they differ for the legacy export ciphers where the
actual key is artificially shortened.
+Starting with TLS 1.3 the cipher name no longer contains enough information to
+determine which forward-secrecy scheme was employed, but TLS 1.3 aallwwaayyss uses
+forward-secrecy. On the client side, up-to-date Postfix releases log additional
+information for TLS 1.3 connections, reporting the signature and key exchange
+algorithms. Two examples below (the long single line messages are folded across
+multiple lines for readability):
+
+ postfix/smtp[process-id]:
+ Untrusted TLS connection established to 127.0.0.1[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest
+ SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+
+ postfix/smtp[process-id]:
+ Untrusted TLS connection established to 127.0.0.1[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest
+ SHA256
+
+In the above connections, the "key-exchange" value records the "Diffie-Hellman"
+algorithm used for key agreement. The "server-signature" value records the
+public key algorithm used by the server to sign the key exchange. The "server-
+digest" value records any hash algorithm used to prepare the data for signing.
+With "ED25519" and "ED448", no separate hash algorithm is used.
+
+Examples of Postfix SMTP server logging:
+
+ postfix/smtpd[process-id]:
+ Untrusted TLS connection established from localhost[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest
+ SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+
+ postfix/smtpd[process-id]:
+ Anonymous TLS connection established from localhost[127.0.0.1]:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ server-signature RSA-PSS (2048 bits) server-digest SHA256
+
+ postfix/smtpd[process-id]:
+ Anonymous TLS connection established from localhost[127.0.0.1]:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ server-signature ED25519
+
+Note that Postfix >= 3.4 server logging may also include a "to sni-name"
+element to record the use of an alternate server certificate chain for the
+connection in question. This happens when the client uses the TLS SNI
+extension, and the server selects a non-default certificate chain based on the
+client's SNI value:
+
+ postfix/smtpd[process-id]:
+ Untrusted TLS connection established from client.example[192.0.2.1]
+ to server.example: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256
+ bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest
+ SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+
WWhhaatt ddoo ""AAnnoonnyymmoouuss"",, ""UUnnttrruusstteedd"",, eettcc.. iinn PPoossttffiixx llooggggiinngg mmeeaann??
The verification levels below are subject to man-in-the-middle attacks to
@@ -421,8 +538,8 @@ peer certificate with expected public-key or certificate fingerprint)
CCrreeddiittss
- * TLS support for Postfix was originally developed by Lutz Jnicke at Cottbus
- Technical University.
+ * TLS support for Postfix was originally developed by Lutz Ja"nicke at
+ Cottbus Technical University.
* Wietse Venema adopted and restructured the code and documentation.
* Viktor Dukhovni implemented support for many subsequent TLS features,
including EECDH, and authored the initial version of this document.
diff --git a/external/ibm-public/postfix/dist/README_FILES/MAILLOG_README b/external/ibm-public/postfix/dist/README_FILES/MAILLOG_README
new file mode 100644
index 00000000000..11407598407
--- /dev/null
+++ b/external/ibm-public/postfix/dist/README_FILES/MAILLOG_README
@@ -0,0 +1,113 @@
+PPoossttffiixx llooggggiinngg ttoo ffiillee oorr ssttddoouutt
+
+-------------------------------------------------------------------------------
+
+OOvveerrvviieeww
+
+Postfix supports it own logging system as an alternative to syslog (which
+remains the default). This is available with Postfix version 3.4 or later.
+
+Topics covered in this document:
+
+ * Configuring logging to file
+ * Configuring logging to stdout
+ * Rotating logs
+ * Limitations
+
+CCoonnffiigguurriinngg llooggggiinngg ttoo ffiillee
+
+Logging to file solves a usability problem for MacOS, and eliminates multiple
+problems for systemd-based systems.
+
+ 1. Add the following line to master.cf if not already present (note: there
+ must be no whitespace at the start of the line):
+
+ postlog unix-dgram n - n - 1 postlogd
+
+ Note: the service type "uunniixx--ddggrraamm" was introduced with Postfix 3.4. Remove
+ the above line before backing out to an older Postfix version.
+
+ 2. Configure Postfix to write logging, to, for example, /var/log/postfix.log.
+ See also the "Logfile rotation" section below for logfile management.
+
+ # postfix stop
+ # postconf maillog_file=/var/log/postfix.log
+ # postfix start
+
+ By default, the logfile name must start with "/var" or "/dev/stdout" (the
+ list of allowed prefixes is configured with the maillog_file_prefixes
+ parameter). This safety mechanism limits the damage from a single
+ configuration mistake.
+
+CCoonnffiigguurriinngg llooggggiinngg ttoo ssttddoouutt
+
+Logging to stdout is useful when Postfix runs in a container, as it eliminates
+a syslogd dependency.
+
+ 1. Add the following line to master.cf if not already present (note: there
+ must be no whitespace at the start of the line):
+
+ postlog unix-dgram n - n - 1 postlogd
+
+ Note: the service type "uunniixx--ddggrraamm" was introduced with Postfix 3.4. Remove
+ the above line before backing out to an older Postfix version.
+
+ 2. Configure main.cf with "maillog_file = /dev/stdout".
+
+ 3. Start Postfix with "ppoossttffiixx ssttaarrtt--ffgg".
+
+RRoottaattiinngg llooggss
+
+The command "ppoossttffiixx llooggrroottaattee" may be run by hand or by a cronjob. It logs all
+errors, and reports errors to stderr if run from a terminal. This command
+implements the following steps:
+
+ * Rename the current logfile by appending a suffix that contains the date and
+ time. This suffix is configured with the maillog_file_rotate_suffix
+ parameter (default: %Y%M%d-%H%M%S).
+
+ * Reload Postfix so that postlogd(8) immediately closes the old logfile.
+
+ * After a brief pause, compress the old logfile. The compression program is
+ configured with the maillog_file_compressor parameter (default: gzip).
+
+Notes:
+
+ * This command will not rotate a logfile with pathname under the /dev
+ directory, such as /dev/stdout.
+
+ * This command does not (yet) remove old logfiles.
+
+LLiimmiittaattiioonnss
+
+Background:
+
+ * Postfix consists of a number of daemon programs that run in the background,
+ as well as non-daemon programs for local mail submission or Postfix
+ management.
+
+ * Logging to Postfix logfile or stdout requires the Postfix postlogd(8)
+ service. This ensures that simultaneous logging from different programs
+ will not get mixed up.
+
+ * All Postfix programs can log to syslog, but not all programs have
+ sufficient privileges to use the Postfix logging service, and many non-
+ daemon programs must not log to stdout as that would corrupt their output.
+
+Limitations:
+
+ * Non-daemon Postfix programs will log errors to syslogd(8) before they have
+ processed command-line options and main.cf parameters.
+
+ * If Postfix is down, the non-daemon programs postfix(1), postsuper(1),
+ postmulti(1), and postlog(1), will log directly to $maillog_file. These
+ programs expect to run with root privileges, for example during Postfix
+ start-up, reload, or shutdown.
+
+ * Other non-daemon Postfix programs will never write directly to
+ $maillog_file (also, logging to stdout would interfere with the operation
+ of some of these programs). These programs can log to postlogd(8) if they
+ are run by the super-user, or if their executable file has set-gid
+ permission. Do not set this permission on programs other than postdrop(1)
+ and postqueue(1).
+
diff --git a/external/ibm-public/postfix/dist/README_FILES/MILTER_README b/external/ibm-public/postfix/dist/README_FILES/MILTER_README
index 730aa5b0050..6cdea837dda 100644
--- a/external/ibm-public/postfix/dist/README_FILES/MILTER_README
+++ b/external/ibm-public/postfix/dist/README_FILES/MILTER_README
@@ -127,6 +127,7 @@ Information in this section:
* Milter protocol version
* Milter protocol timeouts
* Different settings for different Milter applications
+ * Different settings for different SMTP clients
* Sendmail macro emulation
* What macros will Postfix send to Milters?
@@ -171,6 +172,9 @@ The general syntax for listening sockets is as follows:
NOTE: Postfix syntax differs from Milter syntax which has the form
iinneett::port@@host.
+For advanced configuration see "Different settings for different SMTP clients"
+and "Different settings for different Milter applications".
+
NNoonn--SSMMTTPP MMiilltteerr aapppplliiccaattiioonnss
The non-SMTP Milter applications handle mail that arrives via the Postfix
@@ -349,6 +353,26 @@ separated by space or comma. There is one difference: yyoouu mmuusstt ee
sseettttiinngg iinn ppaarreenntthheesseess,, aass iinn ""{{ nnaammee == vvaalluuee }}"",, iiff yyoouu wwaanntt ttoo hhaavvee ssppaaccee oorr
ccoommmmaa wwiitthhiinn aa vvaalluuee oorr aarroouunndd ""=="".
+DDiiffffeerreenntt sseettttiinnggss ffoorr ddiiffffeerreenntt SSMMTTPP cclliieennttss
+
+The smtpd_milter_maps feature supports different Milter settings for different
+client IP addresses. Lookup results override the the global smtpd_milters
+setting, and have the same syntax. For example, to disable Milter settings for
+local address ranges:
+
+/etc/postfix/main.cf:
+ smtpd_milter_maps = cidr:/etc/postfix/smtpd_milter_map
+ smtpd_milters = inet:host:port, { inet:host:port, ... }, ...
+
+/etc/postfix/smtpd_milter_map:
+ # Disable Milters for local clients.
+ 127.0.0.0/8 DISABLE
+ 192.168.0.0/16 DISABLE
+ ::/64 DISABLE
+ 2001:db8::/32 DISABLE
+
+This feature is available with Postfix 3.2 and later.
+
SSeennddmmaaiill mmaaccrroo eemmuullaattiioonn
Postfix emulates a limited number of Sendmail macros, as shown in the table.
@@ -375,7 +399,7 @@ Sendmail. See the workarounds section below for solutions.
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
|{auth_type} |MAIL, DATA, EOH, EOM |SASL login method |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
- |{client_addr} |Always |Client IP address |
+ |{client_addr} |Always |Remote client IP address |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
| | |Connection concurrency for|
| | |this client (zero if the |
@@ -383,13 +407,13 @@ Sendmail. See the workarounds section below for solutions.
| | |all smtpd_client_* |
| | |limits). |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
- | | |Client hostname |
+ | | |Remote client hostname |
| | |When address -> name |
|{client_name} |Always |lookup or name -> address |
| | |verification fails: |
| | |"unknown" |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
- |{client_port} |Always (Postfix >=2.5) |Client TCP port |
+ |{client_port} |Always (Postfix >=2.5) |Remote client TCP port |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
| | |Client name from address -|
|{client_ptr} |CONNECT, HELO, MAIL, DATA|> name lookup |
@@ -408,9 +432,13 @@ Sendmail. See the workarounds section below for solutions.
|{cipher} |HELO, MAIL, DATA, EOH, |TLS cipher |
| |EOM | |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
+ |{daemon_addr} |Always (Postfix >=3.2) |Local server IP address |
+ |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
|{daemon_name} |Always |value of |
| | |milter_macro_daemon_name |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
+ |{daemon_port} |Always (Postfix >=3.2) |Local server TCP port |
+ |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
|{mail_addr} |MAIL |Sender address |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
|{mail_host} |MAIL (Postfix >= 2.6, |Sender next-hop |
@@ -499,8 +527,8 @@ WWoorrkkaarroouunnddss
-o smtp_generic_maps=
* Some Milter applications use the "{if_addr}" macro to recognize local mail;
- this macro does not exist in Postfix. Workaround: use the "{client_addr}"
- macro instead.
+ this macro does not exist in Postfix. Workaround: use the "{daemon_addr}"
+ (Postfix >= 3.2) or "{client_addr}" macro instead.
* Some Milter applications log a warning that looks like this:
diff --git a/external/ibm-public/postfix/dist/README_FILES/MYSQL_README b/external/ibm-public/postfix/dist/README_FILES/MYSQL_README
index ccba2f7f31f..b8304c2212d 100644
--- a/external/ibm-public/postfix/dist/README_FILES/MYSQL_README
+++ b/external/ibm-public/postfix/dist/README_FILES/MYSQL_README
@@ -95,7 +95,7 @@ where_field = alias
additional_conditions = AND status = 'paid'
# This is necessary to make UTF8 queries work for Postfix 2.11 .. 3.1,
-# and is the default setting as of Postfix 3.2,
+# and is the default setting as of Postfix 3.2.
option_group = client
AAddddiittiioonnaall nnootteess
diff --git a/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README b/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README
index e8d56621dfc..78da5dd88a6 100644
--- a/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README
+++ b/external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README
@@ -67,11 +67,11 @@ get worse before things improve, if ever. Without a tool like postscreen(8)
that keeps the zombies away, Postfix would be spending most of its resources
not receiving email.
-The main challenge for postscreen(8) is to make an is-it-a-zombie decision
-based on a single measurement. This is necessary because many zombies try to
-fly under the radar and avoid spamming the same site repeatedly. Once
-postscreen(8) decides that a client is not-a-zombie, it whitelists the client
-temporarily to avoid further delays for legitimate mail.
+The main challenge for postscreen(8) is to make an is-a-zombie decision based
+on a single measurement. This is necessary because many zombies try to fly
+under the radar and avoid spamming the same site repeatedly. Once postscreen(8)
+decides that a client is not-a-zombie, it whitelists the client temporarily to
+avoid further delays for legitimate mail.
Zombies have challenges too: they have only a limited amount of time to deliver
spam before their IP address becomes blacklisted. To speed up spam deliveries,
@@ -82,14 +82,14 @@ continue sending mail even when the server tells them to go away.
postscreen(8) uses a variety of measurements to recognize zombies. First,
postscreen(8) determines if the remote SMTP client IP address is blacklisted.
Second, postscreen(8) looks for protocol compromises that are made to speed up
-delivery. These are good indicators for making is-it-a-zombie decisions based
-on single measurements.
+delivery. These are good indicators for making is-a-zombie decisions based on
+single measurements.
postscreen(8) does not inspect message content. Message content can vary from
one delivery to the next, especially with clients that (also) send legitimate
-email. Content is not a good indicator for making is-it-a-zombie decisions
-based on single measurements, and that is the problem that postscreen(8) is
-focused on.
+email. Content is not a good indicator for making is-a-zombie decisions based
+on single measurements, and that is the problem that postscreen(8) is focused
+on.
GGeenneerraall ooppeerraattiioonn
@@ -508,15 +508,21 @@ limit, as specified with the line_length_limit parameter. The session is
terminated immediately. The "aafftteerr command" portion is logged with Postfix 2.10
and later.
-When an SMTP client makes too many connections at the same time, or when all
-postscreen(8) ports are busy, postscreen(8) rejects the connection with a 421
-status code and logs:
+When an SMTP client makes too many connections at the same time, postscreen(8)
+rejects the connection with a 421 status code and logs:
NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: ttoooo mmaannyy ccoonnnneeccttiioonnss
+
+The postscreen_client_connection_count_limit parameter controls this limit.
+
+When an SMTP client connects after postscreen(8) has reached a connection count
+limit, postscreen(8) rejects the connection with a 421 status code and logs:
+
+ NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: aallll ssccrreeeenniinngg ppoorrttss bbuussyy
NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: aallll sseerrvveerr ppoorrttss bbuussyy
-The postscreen_client_connection_count_limit and postscreen_pre_queue_limit
-parameters control these limits.
+The postscreen_pre_queue_limit and postscreen_post_queue_limit parameters
+control these limits.
WWhheenn aallll tteessttss ssuucccceeeedd
@@ -767,7 +773,7 @@ By default, the temporary whitelist is not shared between multiple postscreen
* A non-persistent memcache: temporary whitelist can be shared between
postscreen(8) daemons on the same host or different hosts. Disable cache
cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8)
- daemons because memcache: does not implement this (but see example 4 below
+ daemons because memcache: has no first-next API (but see example 4 below
for memcache: with persistent backup). This requires Postfix 2.9 or later.
# Example 1: non-persistent memcache: whitelist.
diff --git a/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES b/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES
index cc6d7c0d847..d3c41b83bae 100644
--- a/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES
+++ b/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES
@@ -1,194 +1,157 @@
-This is the Postfix 3.1 (stable) release.
+This is the Postfix 3.5 (stable) release.
-The stable Postfix release is called postfix-3.1.x where 3=major
-release number, 1=minor release number, x=patchlevel. The stable
+The stable Postfix release is called postfix-3.5.x where 3=major
+release number, 5=minor release number, x=patchlevel. The stable
release never changes except for patches that address bugs or
emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called
-postfix-3.2-yyyymmdd where yyyymmdd is the release date (yyyy=year,
+postfix-3.6-yyyymmdd where yyyymmdd is the release date (yyyy=year,
mm=month, dd=day). Patches are never issued for snapshot releases;
instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd)
specifies the release date of a stable release or snapshot release.
-If you upgrade from Postfix 2.11 or earlier, read RELEASE_NOTES-3.0
+If you upgrade from Postfix 3.3 or earlier, read RELEASE_NOTES-3.4
before proceeding.
-Workaround - UTF8 support in Postfix MySQL queries
---------------------------------------------------
+License change
+---------------
-Someone reported false "not found" errors with MySQL map queries
-that contain UTF8-encoded text. To avoid such errors, specify
-"option_group = client" in Postfix MySQL configuration files. This
-will be the default setting with Postfix 3.2 and later.
+This software is distributed with a dual license: in addition to the
+historical IBM Public License 1.0, it is now also distributed with the
+more recent Eclipse Public License 2.0. Recipients can choose to take
+the software under the license of their choice. Those who are more
+comfortable with the IPL can continue with that license.
-Major changes - address verification safety
--------------------------------------------
+Major changes - multiple relayhost in SMTP
+------------------------------------------
-[Feature 20151227] The new address_verify_pending_request_limit
-parameter introduces a safety limit for the number of address
-verification probes in the active queue. The default limit is 1/4
-of the active queue maximum size. The queue manager enforces the
-limit by tempfailing probe messages that exceed the limit. This
-design avoids dependencies on global counters that get out of sync
-after a process or system crash.
+[Feature 20200111] the Postfix SMTP and LMTP client support a list
+of nexthop destinations separated by comma or whitespace. These
+destinations will be tried in the specified order.
-Tempfailing verify requests is not as bad as one might think. The
-Postfix verify cache proactively updates active addresses weeks
-before they expire. The address_verify_pending_request_limit affects
-only unknown addresses, and inactive addresses that have expired
-from the address verify cache (by default, after 31 days).
+The list form can be specified in relayhost, transport_maps,
+default_transport, and sender_dependent_default_transport_maps.
-Major changes - json support
-----------------------------
-
-[Feature 20151129] Machine-readable, JSON-formatted queue listing
-with "postqueue -j" (no "mailq" equivalent). The output is a stream
-of JSON objects, one per queue file. To simplify parsing, each
-JSON object is formatted as one text line followed by one newline
-character. See the postqueue(1) manpage for a detailed description
-of the output format.
-
-Major changes - milter support
-------------------------------
-
-[Feature 20150523] The milter_macro_defaults feature provides an
-optional list of macro name=value pairs. These specify default
-values for Milter macros when no value is available from the SMTP
-session context.
-
-For example, with "milter_macro_defaults = auth_type=TLS", the
-Postfix SMTP server will send an auth_type of "TLS" to a Milter,
-unless the remote client authenticates with SASL.
+Examples:
+/etc/postfix/main.cf:
+ relayhost = foo.example, bar.example
+ default_transport = smtp:foo.example, bar.example.
-This feature was originally implemented for a submission service
-that may authenticate clients with a TLS certificate, without having
-to make changes to the code that implements TLS support.
+NOTE: this is an SMTP and LMTP client feature. It does not work for
+other Postfix delivery agents.
-Major changes - output rate control
------------------------------------
+Major changes - certificate access
+----------------------------------
-[Feature 20150710] Destination-independent delivery rate delay
+[Feature 20190517] Search order support for check_ccert_access.
+Search order support for other tables is in design (canonical_maps,
+virtual_alias_maps, transport_maps, etc.).
-Support to enforce a destination-independent delay between email
-deliveries. The following example inserts 20 seconds of delay
-between all deliveries with the SMTP transport, limiting the delivery
-rate to at most three messages per minute.
+The following check_ccert_access setting uses the built-in search
+order: it first looks up the client certificate fingerprint, then
+the client certificate public-key fingerprint, and it stops when a
+decision is made.
/etc/postfix/main.cf:
- smtp_transport_rate_delay = 20s
-
-For details, see the description of default_transport_rate_delay
-and transport_transport_rate_delay in the postconf(5) manpage.
+ smtpd_mumble_restrictions =
+ ...
+ check_ccert_access hash:/etc/postfix/ccert-access
+ ...
-Major changes - postscreen dnsbl
---------------------------------
-
-[Feature 20150710] postscreen support for the TTL of DNSBL and DNSWL
-lookup results
+The following setting, with explicit search order, produces the
+exact same result:
-Historically, the default setting "postscreen_dnsbl_ttl = 1h" assumes
-that a "not found" result from a DNSBL server will be valid for one
-hour. This may have been adequate five years ago when postscreen
-was first implemented, but nowadays, that one hour can result in
-missed opportunities to block new spambots.
+/etc/postfix/main.cf:
+ smtpd_mumble_restrictions =
+ ...
+ check_ccert_access {
+ hash:/etc/postfix/ccert-access {
+ search_order = cert_fingerprint, pubkey_fingerprint } }
+ ...
-To address this, postscreen now respects the TTL of DNSBL "not
-found" replies, as well as the TTL of DNSWL replies (both "found"
-and "not found"). The TTL for a "not found" reply is determined
-according to RFC 2308 (the TTL of an SOA record in the reply).
+Support is planned for other certificate features.
-Support for DNSBL or DNSWL reply TTL values is controlled by two
-configuration parameters:
+Major changes - dovecot usability
+---------------------------------
-postscreen_dnsbl_min_ttl (default: 60 seconds).
+[Feature 20190615] The SMTP+LMTP delivery agent can now prepend
+Delivered-To, X-Original-To and Return-Path headers, just like the
+pipe(8) and local(8) delivery agents.
- This parameter specifies a minimum for the amount of time that
- a DNSBL or DNSWL result will be cached in the postscreen_cache_map.
- This prevents an excessive number of postscreen cache updates
- when a DNSBL or DNSWL server specifies a very small reply TTL.
+This uses the "flags=DORX" command-line flags in master.cf. See the
+smtp(8) manpage for details.
-postscreen_dnsbl_max_ttl (default: $postscreen_dnsbl_ttl or 1 hour)
+This obsoletes the "lmtp_assume_final = yes" setting, and replaces
+it with "flags=...X...", for consistency with the pipe(8) delivery
+agent.
- This parameter specifies a maximum for the amount of time that
- a DNSBL or DNSWL result will be cached in the postscreen_cache_map.
- This prevents cache pollution when a DNSBL or DNSWL server
- specifies a very large reply TTL.
+Major changes - forced expiration
+---------------------------------
-The postscreen_dnsbl_ttl parameter is now obsolete, and has become
-the default value for the new postscreen_dnsbl_max_ttl parameter.
+[Feature 20200202] Support to force-expire email messages. This
+introduces new postsuper(1) command-line options to request expiration,
+and additional information in mailq(1) or postqueue(1) output.
-Major changes - sasl auth safety
---------------------------------
+The forced-to-expire status is stored in a queue file attribute.
+An expired message is returned to the sender when the queue manager
+attempts to deliver that message (note that Postfix will never
+deliver messages in the hold queue).
-[Feature 20151031] New "smtpd_client_auth_rate_limit" feature, to
-enforce an optional rate limit on AUTH commands per SMTP client IP
-address. Similar to other smtpd_client_*_rate_limit features, this
-enforces a limit on the number of requests per $anvil_rate_time_unit.
+The postsuper(1) -e and -f options both set the forced-to-expire
+queue file attribute. The difference is that -f will also release
+a message if it is in the hold queue. With -e, such a message would
+not be returned to the sender until it is released with -f or -H.
-Major changes - smtpd policy
-----------------------------
+In the mailq(1) or postqueue(1) -p output, a forced-to-expire message
+is indicated with # after the queue file name. In postqueue(1) JSON
+output, there is a new per-message field "forced_expire" (with value
+true or false) that shows the forced-to-expire status.
-[Feature 20150913] New SMTPD policy service attribute "policy_context",
-with a corresponding "smtpd_policy_service_policy_context" configuration
-parameter. Originally, this was implemented to share the same SMTPD
-policy service endpoint among multiple check_policy_service clients.
+Major changes - haproxy2 protocol
+---------------------------------
-Major changes - tls
--------------------
+[Feature 20200112] Support for the haproxy v2 protocol. The Postfix
+implementation supports TCP over IPv4 and IPv6, as well as non-proxied
+connections; the latter are typically used for heartbeat tests.
-[Feature 20160207] A new "postfix tls" command to quickly enable
-opportunistic TLS in the Postfix SMTP client or server, and to
-manage SMTP server keys and certificates, including certificate
-signing requests and TLSA DNS records for DANE. See the postfix-tls(1)
-manpage for a detailed description.
+The haproxy v2 protocol introduces no additional Postfix configuration.
+The Postfix smtpd(8) and postscreen(8) daemons accept both v1 and
+v2 protocol versions.
-[Feature 20160103] The Postfix SMTP client by default enables DANE
-policies when an MX host has a (DNSSEC) secure TLSA DNS record,
-even if the MX DNS record was obtained with insecure lookups. The
-existence of a secure TLSA record implies that the host wants to
-talk TLS and not plaintext. For details see the
-smtp_tls_dane_insecure_mx_policy configuration parameter.
+Major changes - logging
+-----------------------
-[Incompat 20150721] As of the middle of 2015, all supported Postfix
-releases no longer enable "export" grade ciphers for opportunistic
-TLS, and no longer use the deprecated SSLv2 and SSLv3 protocols for
-mandatory or opportunistic TLS.
+[Incompat 20191109] Postfix daemon processes now log the from= and
+to= addresses in external (quoted) form in non-debug logging (info,
+warning, etc.). This means that when an address localpart contains
+spaces or other special characters, the localpart will be quoted,
+for example:
-These changes are very unlikely to cause problems with server-to-server
-communication over the Internet, but they may result in interoperability
-problems with ancient client or server implementations on internal
-networks. To address this problem, you can revert the changes with:
+ from=<"name with spaces"@example.com>
-Postfix SMTP client settings:
+Older Postfix versions would log the internal (unquoted) form:
- lmtp_tls_ciphers = export
- smtp_tls_ciphers = export
- lmtp_tls_protocols = !SSLv2
- smtp_tls_protocols = !SSLv2
- lmtp_tls_mandatory_protocols = !SSLv2
- smtp_tls_mandatory_protocols = !SSLv2
+ from=<name with spaces@example.com>
-Postfix SMTP server settings:
+The external and internal forms are identical for the vast majority
+of email addresses that contain no spaces or other special characters
+in the localpart.
- smtpd_tls_ciphers = export
- smtpd_tls_protocols =
- smtpd_tls_mandatory_protocols = !SSLv2
+Specify "info_log_address_format = internal" for backwards
+compatibility.
-These settings, if put in main.cf, affect all Postfix SMTP client
-or server communication, which may be undesirable. To be more
-selective, use "-o name=value" parameter overrides on specific
-services in master.cf. Execute the command "postfix reload" to make
-the changes effective.
+The logging in external form is consistent with the address form
+that Postfix 3.2 and later prefer for table lookups. It is therefore
+the more useful form for non-debug logging.
-[Incompat 20150719] The default Diffie-Hellman non-export prime was
-updated from 1024 to 2048 bits, because SMTP clients are starting
-to reject TLS handshakes with primes smaller than 2048 bits.
-
-Historically, this prime size is not negotiable, and each site needs
-to determine which prime size works best for the majority of its
-clients. See FORWARD_SECRECY_README for some hints in the quick-start
-section.
+Major changes - IP address normalization
+----------------------------------------
+[Incompat 20190427] Postfix now normalizes IP addresses received
+with XCLIENT, XFORWARD, or with the HaProxy protocol, for consistency
+with direct connections to Postfix. This may change the appearance
+of logging, and the way that check_client_access will match subnets
+of an IPv6 address.
diff --git a/external/ibm-public/postfix/dist/README_FILES/SASL_README b/external/ibm-public/postfix/dist/README_FILES/SASL_README
index c4b22a2e681..0c42480382f 100644
--- a/external/ibm-public/postfix/dist/README_FILES/SASL_README
+++ b/external/ibm-public/postfix/dist/README_FILES/SASL_README
@@ -2,14 +2,6 @@ PPoossttffiixx SSAASSLL HHoowwttoo
-------------------------------------------------------------------------------
-WWaarrnniinngg
-
-People who go to the trouble of installing Postfix may have the expectation
-that Postfix is more secure than some other mailers. The Cyrus SASL library
-contains a lot of code. With this, Postfix becomes as secure as other mail
-systems that use the Cyrus SASL library. Dovecot provides an alternative that
-may be worth considering.
-
HHooww PPoossttffiixx uusseess SSAASSLL aauutthheennttiiccaattiioonn
SMTP servers need to decide whether an SMTP client is authorized to send mail
@@ -30,6 +22,12 @@ configuration files will belong to Postfix, while other configuration files
belong to the specific SASL implementation that Postfix will use. This document
covers both the Postfix and non-Postfix configuration.
+NOTE: People who go to the trouble of installing Postfix may have the
+expectation that Postfix is more secure than some other mailers. The Cyrus SASL
+library contains a lot of code. With this, Postfix becomes as secure as other
+mail systems that use the Cyrus SASL library. Dovecot provides an alternative
+that may be worth considering.
+
You can read more about the following topics:
* Configuring SASL authentication in the Postfix SMTP server
diff --git a/external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README b/external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README
index 2e7a92d3446..230204a7fbf 100644
--- a/external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README
+++ b/external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README
@@ -131,12 +131,6 @@ Examples of simple restriction lists are:
# Don't accept mail from domains that don't exist.
smtpd_sender_restrictions = reject_unknown_sender_domain
- # Relay control (Postfix 2.10 and later): local clients and
- # authenticated clients may specify any destination domain.
- smtpd_relay_restrictions = permit_mynetworks,
- permit_sasl_authenticated,
- reject_unauth_destination
-
# Spam control: exclude local clients and authenticated clients
# from DNSBL lookups.
smtpd_recipient_restrictions = permit_mynetworks,
@@ -150,6 +144,12 @@ Examples of simple restriction lists are:
reject_rhsbl_helo dbl.spamhaus.org,
reject_rhsbl_sender dbl.spamhaus.org
+ # Relay control (Postfix 2.10 and later): local clients and
+ # authenticated clients may specify any destination domain.
+ smtpd_relay_restrictions = permit_mynetworks,
+ permit_sasl_authenticated,
+ reject_unauth_destination
+
# Block clients that speak too early.
smtpd_data_restrictions = reject_unauth_pipelining
@@ -186,21 +186,21 @@ and in the effect of a REJECT or DEFER result.
| | | |information|
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ |
| | |Required if | |
- | |>= 2.10|smtpd_recipient_restrictions| |
+ | |>= 2.10|smtpd_relay_restrictions | |
| | |does not enforce relay |Reject RCPT|
- |smtpd_relay_restrictions | |policy |TO |
+ |smtpd_recipient_restrictions | |policy |TO |
| |_ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |information|
| | | | |
- | |< 2.10 |Not available | |
+ | |< 2.10 |Required | |
| | | | |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ |
| | |Required if | |
- | |>= 2.10|smtpd_relay_restrictions | |
+ | |>= 2.10|smtpd_recipient_restrictions| |
| | |does not enforce relay |Reject RCPT|
- |smtpd_recipient_restrictions | |policy |TO |
+ |smtpd_relay_restrictions | |policy |TO |
| |_ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |information|
| | | | |
- | |< 2.10 |Required | |
+ | |< 2.10 |Not available | |
| | | | |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ |
|smtpd_data_restrictions |>= 2.0 |Optional |Reject DATA|
diff --git a/external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README b/external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README
index 51c1df2c479..0c96c760ae1 100644
--- a/external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README
+++ b/external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README
@@ -13,8 +13,8 @@ implemented with only a dozen lines of Perl, as is shown at the end of this
document. A complete example can be found in the Postfix source code, in the
directory examples/smtpd-policy.
-Another example of policy delegation is the SPF policy server at http://
-www.openspf.org/Software.
+Another example of policy delegation is the SPF policy server at https://
+web.archive.org/web/20190221142057/http://www.openspf.org/Software.
Policy delegation is now the preferred method for adding policies to Postfix.
It's much easier to develop a new feature in few lines of Perl, Python, Ruby,
@@ -36,10 +36,14 @@ This document covers the following topics:
PPrroottooccooll ddeessccrriippttiioonn
-The Postfix policy delegation protocol is really simple. The client request is
-a sequence of name=value attributes separated by newline, and is terminated by
-an empty line. The server reply is one name=value attribute and it, too, is
-terminated by an empty line.
+The Postfix policy delegation protocol is really simple. The client sends a
+request and the server sends a response. Unless there was an error, the server
+must not close the connection, so that the same connection can be used multiple
+times.
+
+The client request is a sequence of name=value attributes separated by newline,
+and is terminated by an empty line. The server reply is one name=value
+attribute and it, too, is terminated by an empty line.
Here is an example of all the attributes that the Postfix SMTP server sends in
a delegated SMTPD access policy request:
@@ -78,6 +82,9 @@ a delegated SMTPD access policy request:
client_port=1234
PPoossttffiixx vveerrssiioonn 33..11 aanndd llaatteerr::
policy_context=submission
+ PPoossttffiixx vveerrssiioonn 33..22 aanndd llaatteerr::
+ server_address=10.3.2.1
+ server_port=54321
[empty line]
Notes:
@@ -97,14 +104,21 @@ Notes:
* The "recipient" attribute is available in the "RCPT TO" stage. It is also
available in the "DATA" and "END-OF-MESSAGE" stages if Postfix accepted
- only one recipient for the current message.
+ only one recipient for the current message. The DATA protocol state also
+ applies to email that is received with BDAT commands (Postfix 3.4 and
+ later).
* The "recipient_count" attribute (Postfix 2.3 and later) is non-zero only in
the "DATA" and "END-OF-MESSAGE" stages. It specifies the number of
- recipients that Postfix accepted for the current message.
+ recipients that Postfix accepted for the current message. The DATA protocol
+ state also applies to email that is received with BDAT commands (Postfix
+ 3.4 and later).
+
+ * The remote client or local server IP address is an IPv4 dotted quad in the
+ form 1.2.3.4 or it is an IPv6 address in the form 1:2:3::4:5:6.
- * The client address is an IPv4 dotted quad in the form 1.2.3.4 or it is an
- IPv6 address in the form 1:2:3::4:5:6.
+ * The remote client or local server port is a decimal number in the range 0-
+ 65535.
* For a discussion of the differences between reverse and verified
client_name information, see the reject_unknown_client_hostname discussion
@@ -122,8 +136,8 @@ Notes:
* The "size" attribute value specifies the message size that the client
specified in the MAIL FROM command (zero if none was specified). With
- Postfix 2.2 and later, it specifies the actual message size when the client
- sends the END-OF-DATA command.
+ Postfix 2.2 and later, it specifies the actual message size after the
+ client sends the END-OF-MESSAGE.
* The "sasl_*" attributes (Postfix 2.2 and later) specify information about
how the client was authenticated via SASL. These attributes are empty in
@@ -156,7 +170,9 @@ The following is specific to SMTPD delegated policy requests:
* Protocol states are CONNECT, EHLO, HELO, MAIL, RCPT, DATA, END-OF-MESSAGE,
VRFY or ETRN; these are the SMTP protocol states where the Postfix SMTP
- server makes an OK/REJECT/HOLD/etc. decision.
+ server makes an OK/REJECT/HOLD/etc. decision. The DATA protocol state also
+ applies to email that is received with BDAT commands (Postfix 3.4 and
+ later).
The policy server replies with any action that is allowed in a Postfix SMTPD
access(5) table. Example:
@@ -308,11 +324,12 @@ timeout, and with "DUNNO" as default action when the service is unvailable. The
"DUNNO" action causes Postfix to ignore the result.
1 /etc/postfix/main.cf:
- 2 smtpd_recipient_restrictions =
+ 2 mua_recipient_restrictions =
3 ...
4 reject_unauth_destination
5 check_policy_service { inet:host:port,
- 6 timeout=10s, default_action=DUNNO }
+ 6 timeout=10s, default_action=DUNNO
+ 7 policy_context=submission }
8 ...
Instead of a server endpoint, we now have a list enclosed in {}.
@@ -320,7 +337,7 @@ Instead of a server endpoint, we now have a list enclosed in {}.
* Line 5: The first item in the list is the server endpoint. This supports
the exact same "inet" and "unix" syntax as described earlier.
- * Line 6: The remainder of the list contains per-client settings. These
+ * Line 6-7: The remainder of the list contains per-client settings. These
settings override global main.cf parameters, and have the same name as
those parameters, without the "smtpd_policy_service_" prefix.
diff --git a/external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README b/external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README
index 68fb6c26fb2..5496a3b0d38 100644
--- a/external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README
+++ b/external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README
@@ -18,13 +18,14 @@ Topics covered in this document:
* SMTPUTF8 autodetection
* Limitations of the current implementation
* Compatibility with pre-SMTPUTF8 environments
+ * Compatibility with IDNA2003
* Credits
BBuuiillddiinngg PPoossttffiixx wwiitthh//wwiitthhoouutt SSMMTTPPUUTTFF88 ssuuppppoorrtt
-Postfix will build with SMTPUTF8 support if the ICU library and header files
-are installed on the system. The package name varies with the OS distribution
-(and version). The table shows package names for a number of platforms at the
+Postfix will build with SMTPUTF8 support if the ICU version >= 46 library and
+header files are installed on the system. The package name varies with the OS
+distribution. The table shows package names for a number of platforms at the
time this text was written.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
@@ -60,6 +61,10 @@ main.cf:
# ppoossttccoonnff ""ssmmttppuuttff88__eennaabbllee == yyeess""
# ppoossttffiixx rreellooaadd
+(With Postfix <= 3.1, you may also need to specify "ooppttiioonn__ggrroouupp == cclliieenntt" in
+Postfix MySQL client files, to enable UTF8 support in MySQL queries. This
+setting is the default as of Postfix 3.2.)
+
With SMTPUTF8 support enabled, Postfix changes behavior with respect to earlier
Postfix releases:
@@ -248,12 +253,33 @@ localparts (and in headers) as before. The vast majority of email software is
perfectly capable of handling such email, even if pre-SMTPUTF8 standards do not
support such practice.
-However, when you specify "smtputf8_enable = yes", Postfix requires that non-
-ASCII address information is encoded in UTF-8 and will reject other encodings
-such as ISO-8859. It is not practical for Postfix to support multiple encodings
-at the same time. There is no problem with RFC 2047 encodings such as "=?ISO-
-8859-1?Q?text?=", because those use only characters from the ASCII
-characterset.
+RReejjeeccttiinngg nnoonn--UUTTFF88 aaddddrreesssseess
+
+With "smtputf8_enable = yes", Postfix requires that non-ASCII address
+information is encoded in UTF-8 and will reject other encodings such as ISO-
+8859. It is not practical for Postfix to support multiple encodings at the same
+time. There is no problem with RFC 2047 encodings such as "=?ISO-8859-
+1?Q?text?=", because those use only characters from the ASCII characterset.
+
+RReejjeeccttiinngg nnoonn--AASSCCIIII aaddddrreesssseess iinn nnoonn--SSMMTTPPUUTTFF88 ttrraannssaaccttiioonnss
+
+Setting "strict_smtputf8 = yes" in addition to "smtputf8_enable = yes" will
+enable stricter enforcement of the SMTPUTF8 protocol. Specifically, the Postfix
+SMTP server will not only reject non-UTF8 sender or recipient addresses, it
+will in addition accept UTF-8 sender or recipient addresses only when the
+client requests an SMTPUTF8 mail transaction.
+
+CCoommppaattiibbiilliittyy wwiitthh IIDDNNAA22000033
+
+Postfix >= 3.2 by default disables the 'transitional' compatibility between
+IDNA2003 and IDNA2008, when converting UTF-8 domain names to/from the ASCII
+form that is used in DNS lookups. This makes Postfix behavior consistent with
+current versions of the Firefox and Chrome web browsers. Specify
+"enable_idna2003_compatibility = yes" to get the historical behavior.
+
+This affects the conversion of domain names that contain for example the German
+sz (ß) and the Greek zeta (ς). See http://unicode.org/cldr/utility/idna.jsp
+for more examples.
CCrreeddiittss
diff --git a/external/ibm-public/postfix/dist/README_FILES/STRESS_README b/external/ibm-public/postfix/dist/README_FILES/STRESS_README
index ea535aaa604..bae6ad172a1 100644
--- a/external/ibm-public/postfix/dist/README_FILES/STRESS_README
+++ b/external/ibm-public/postfix/dist/README_FILES/STRESS_README
@@ -88,8 +88,8 @@ the command line (i.e. with an empty parameter value):
83326 ?? S 0:00.28 smtpd -n smtp -t inet -u -c -o stress=
-Services that have local access only never have "-o stress" parameters on the
-command line. This includes services internal to Postfix such as the queue
+You won't see "-o stress" command-line parameters with services that have local
+clients only. These include services internal to Postfix such as the queue
manager, and services that listen on a loopback interface only, such as after-
filter SMTP services.
@@ -108,6 +108,9 @@ later.
Postfix versions before 3.0 use the older form ${stress?x}${stress:y} instead
of the newer form ${stress?{x}:{y}}.
+The syntax of ${name?{value}:{value}}, ${name?value} and ${name:value} is
+explained at the beginning of the postconf(5) manual page.
+
Translation:
* Line 1: under conditions of stress, use an smtpd_timeout value of 10
@@ -121,9 +124,9 @@ Translation:
temporarily.
* Line 2: under conditions of stress, use an smtpd_hard_error_limit of 1
- instead of the default 20. This helps by disconnecting clients after a
- single error, giving other clients a chance to connect. However, this may
- cause significant delays with legitimate mail, such as a mailing list that
+ instead of the default 20. This disconnects clients after a single error,
+ giving other clients a chance to connect. However, this may cause
+ significant delays with legitimate mail, such as a mailing list that
contains a few no-longer-active user names that didn't bother to
unsubscribe. No mail should be lost, as long as this measure is used only
temporarily.
@@ -149,9 +152,6 @@ Translation:
$unverified_sender_tempfail_action. No mail should be lost, as long as this
measure is used only temporarily.
-The syntax of ${name?{value}:{value}}, ${name?value} and ${name:value} is
-explained at the beginning of the postconf(5) manual page.
-
NOTE: Please keep in mind that the stress-adaptive feature is a fairly
desperate measure to keep ssoommee legitimate mail flowing under overload
conditions. If a site is reaching the SMTP server process limit when there
@@ -309,9 +309,9 @@ More information about automatic stress-adaptive behavior is in section
TTeemmppoorraarryy mmeeaassuurreess ffoorr oollddeerr PPoossttffiixx rreelleeaasseess
-See the next section, "Automatic stress-adaptive behavior", if you are running
-Postfix version 2.5 or later, or if you have applied the source code patch for
-stress-adaptive behavior from the mirrors listed at http://www.postfix.org/
+See the section "Automatic stress-adaptive behavior" if you are running Postfix
+version 2.5 or later, or if you have applied the source code patch for stress-
+adaptive behavior from the mirrors listed at http://www.postfix.org/
download.html.
The following measures can be applied temporarily during overload. They still
diff --git a/external/ibm-public/postfix/dist/README_FILES/XCLIENT_README b/external/ibm-public/postfix/dist/README_FILES/XCLIENT_README
index ecee27b5ed9..89b11bff6d8 100644
--- a/external/ibm-public/postfix/dist/README_FILES/XCLIENT_README
+++ b/external/ibm-public/postfix/dist/README_FILES/XCLIENT_README
@@ -50,26 +50,36 @@ are in fact case insensitive.
xclient-command = XCLIENT 1*( SP attribute-name"="attribute-value )
- attribute-name = ( NAME | ADDR | PORT | PROTO | HELO | LOGIN )
+ attribute-name = ( NAME | ADDR | PORT | PROTO | HELO | LOGIN | DESTADDR |
+ DESTPORT )
attribute-value = xtext
* Attribute values are xtext encoded as per RFC 1891.
- * The NAME attribute specifies an SMTP client hostname (not an SMTP client
- address), [UNAVAILABLE] when client hostname lookup failed due to a
+ * The NAME attribute specifies a remote SMTP client hostname (not an SMTP
+ client address), [UNAVAILABLE] when client hostname lookup failed due to a
permanent error, or [TEMPUNAVAIL] when the lookup error condition was
transient.
- * The ADDR attribute specifies an SMTP client numerical IPv4 network address,
- an IPv6 address prefixed with IPV6:, or [UNAVAILABLE] when the address
- information is unavailable. Address information is not enclosed with [].
+ * The ADDR attribute specifies a remote SMTP client numerical IPv4 network
+ address, an IPv6 address prefixed with IPV6:, or [UNAVAILABLE] when the
+ address information is unavailable. Address information is not enclosed
+ with [].
- * The PORT attribute specifies the SMTP client TCP port number as a decimal
- number, or [UNAVAILABLE] when the information is unavailable.
+ * The PORT attribute specifies a remote SMTP client TCP port number as a
+ decimal number, or [UNAVAILABLE] when the information is unavailable.
* The PROTO attribute specifies either SMTP or ESMTP.
+ * The DESTADDR attribute specifies a local SMTP server numerical IPv4 network
+ address, an IPv6 address prefixed with IPV6:, or [UNAVAILABLE] when the
+ address information is unavailable. Address information is not enclosed
+ with [].
+
+ * The DESTPORT attribute specifies a local SMTP server TCP port number as a
+ decimal number, or [UNAVAILABLE] when the information is unavailable.
+
* The HELO attribute specifies an SMTP HELO parameter value, or the value
[UNAVAILABLE] when the information is unavailable.
diff --git a/external/ibm-public/postfix/dist/RELEASE_NOTES b/external/ibm-public/postfix/dist/RELEASE_NOTES
index cc6d7c0d847..d3c41b83bae 100644
--- a/external/ibm-public/postfix/dist/RELEASE_NOTES
+++ b/external/ibm-public/postfix/dist/RELEASE_NOTES
@@ -1,194 +1,157 @@
-This is the Postfix 3.1 (stable) release.
+This is the Postfix 3.5 (stable) release.
-The stable Postfix release is called postfix-3.1.x where 3=major
-release number, 1=minor release number, x=patchlevel. The stable
+The stable Postfix release is called postfix-3.5.x where 3=major
+release number, 5=minor release number, x=patchlevel. The stable
release never changes except for patches that address bugs or
emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called
-postfix-3.2-yyyymmdd where yyyymmdd is the release date (yyyy=year,
+postfix-3.6-yyyymmdd where yyyymmdd is the release date (yyyy=year,
mm=month, dd=day). Patches are never issued for snapshot releases;
instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd)
specifies the release date of a stable release or snapshot release.
-If you upgrade from Postfix 2.11 or earlier, read RELEASE_NOTES-3.0
+If you upgrade from Postfix 3.3 or earlier, read RELEASE_NOTES-3.4
before proceeding.
-Workaround - UTF8 support in Postfix MySQL queries
---------------------------------------------------
+License change
+---------------
-Someone reported false "not found" errors with MySQL map queries
-that contain UTF8-encoded text. To avoid such errors, specify
-"option_group = client" in Postfix MySQL configuration files. This
-will be the default setting with Postfix 3.2 and later.
+This software is distributed with a dual license: in addition to the
+historical IBM Public License 1.0, it is now also distributed with the
+more recent Eclipse Public License 2.0. Recipients can choose to take
+the software under the license of their choice. Those who are more
+comfortable with the IPL can continue with that license.
-Major changes - address verification safety
--------------------------------------------
+Major changes - multiple relayhost in SMTP
+------------------------------------------
-[Feature 20151227] The new address_verify_pending_request_limit
-parameter introduces a safety limit for the number of address
-verification probes in the active queue. The default limit is 1/4
-of the active queue maximum size. The queue manager enforces the
-limit by tempfailing probe messages that exceed the limit. This
-design avoids dependencies on global counters that get out of sync
-after a process or system crash.
+[Feature 20200111] the Postfix SMTP and LMTP client support a list
+of nexthop destinations separated by comma or whitespace. These
+destinations will be tried in the specified order.
-Tempfailing verify requests is not as bad as one might think. The
-Postfix verify cache proactively updates active addresses weeks
-before they expire. The address_verify_pending_request_limit affects
-only unknown addresses, and inactive addresses that have expired
-from the address verify cache (by default, after 31 days).
+The list form can be specified in relayhost, transport_maps,
+default_transport, and sender_dependent_default_transport_maps.
-Major changes - json support
-----------------------------
-
-[Feature 20151129] Machine-readable, JSON-formatted queue listing
-with "postqueue -j" (no "mailq" equivalent). The output is a stream
-of JSON objects, one per queue file. To simplify parsing, each
-JSON object is formatted as one text line followed by one newline
-character. See the postqueue(1) manpage for a detailed description
-of the output format.
-
-Major changes - milter support
-------------------------------
-
-[Feature 20150523] The milter_macro_defaults feature provides an
-optional list of macro name=value pairs. These specify default
-values for Milter macros when no value is available from the SMTP
-session context.
-
-For example, with "milter_macro_defaults = auth_type=TLS", the
-Postfix SMTP server will send an auth_type of "TLS" to a Milter,
-unless the remote client authenticates with SASL.
+Examples:
+/etc/postfix/main.cf:
+ relayhost = foo.example, bar.example
+ default_transport = smtp:foo.example, bar.example.
-This feature was originally implemented for a submission service
-that may authenticate clients with a TLS certificate, without having
-to make changes to the code that implements TLS support.
+NOTE: this is an SMTP and LMTP client feature. It does not work for
+other Postfix delivery agents.
-Major changes - output rate control
------------------------------------
+Major changes - certificate access
+----------------------------------
-[Feature 20150710] Destination-independent delivery rate delay
+[Feature 20190517] Search order support for check_ccert_access.
+Search order support for other tables is in design (canonical_maps,
+virtual_alias_maps, transport_maps, etc.).
-Support to enforce a destination-independent delay between email
-deliveries. The following example inserts 20 seconds of delay
-between all deliveries with the SMTP transport, limiting the delivery
-rate to at most three messages per minute.
+The following check_ccert_access setting uses the built-in search
+order: it first looks up the client certificate fingerprint, then
+the client certificate public-key fingerprint, and it stops when a
+decision is made.
/etc/postfix/main.cf:
- smtp_transport_rate_delay = 20s
-
-For details, see the description of default_transport_rate_delay
-and transport_transport_rate_delay in the postconf(5) manpage.
+ smtpd_mumble_restrictions =
+ ...
+ check_ccert_access hash:/etc/postfix/ccert-access
+ ...
-Major changes - postscreen dnsbl
---------------------------------
-
-[Feature 20150710] postscreen support for the TTL of DNSBL and DNSWL
-lookup results
+The following setting, with explicit search order, produces the
+exact same result:
-Historically, the default setting "postscreen_dnsbl_ttl = 1h" assumes
-that a "not found" result from a DNSBL server will be valid for one
-hour. This may have been adequate five years ago when postscreen
-was first implemented, but nowadays, that one hour can result in
-missed opportunities to block new spambots.
+/etc/postfix/main.cf:
+ smtpd_mumble_restrictions =
+ ...
+ check_ccert_access {
+ hash:/etc/postfix/ccert-access {
+ search_order = cert_fingerprint, pubkey_fingerprint } }
+ ...
-To address this, postscreen now respects the TTL of DNSBL "not
-found" replies, as well as the TTL of DNSWL replies (both "found"
-and "not found"). The TTL for a "not found" reply is determined
-according to RFC 2308 (the TTL of an SOA record in the reply).
+Support is planned for other certificate features.
-Support for DNSBL or DNSWL reply TTL values is controlled by two
-configuration parameters:
+Major changes - dovecot usability
+---------------------------------
-postscreen_dnsbl_min_ttl (default: 60 seconds).
+[Feature 20190615] The SMTP+LMTP delivery agent can now prepend
+Delivered-To, X-Original-To and Return-Path headers, just like the
+pipe(8) and local(8) delivery agents.
- This parameter specifies a minimum for the amount of time that
- a DNSBL or DNSWL result will be cached in the postscreen_cache_map.
- This prevents an excessive number of postscreen cache updates
- when a DNSBL or DNSWL server specifies a very small reply TTL.
+This uses the "flags=DORX" command-line flags in master.cf. See the
+smtp(8) manpage for details.
-postscreen_dnsbl_max_ttl (default: $postscreen_dnsbl_ttl or 1 hour)
+This obsoletes the "lmtp_assume_final = yes" setting, and replaces
+it with "flags=...X...", for consistency with the pipe(8) delivery
+agent.
- This parameter specifies a maximum for the amount of time that
- a DNSBL or DNSWL result will be cached in the postscreen_cache_map.
- This prevents cache pollution when a DNSBL or DNSWL server
- specifies a very large reply TTL.
+Major changes - forced expiration
+---------------------------------
-The postscreen_dnsbl_ttl parameter is now obsolete, and has become
-the default value for the new postscreen_dnsbl_max_ttl parameter.
+[Feature 20200202] Support to force-expire email messages. This
+introduces new postsuper(1) command-line options to request expiration,
+and additional information in mailq(1) or postqueue(1) output.
-Major changes - sasl auth safety
---------------------------------
+The forced-to-expire status is stored in a queue file attribute.
+An expired message is returned to the sender when the queue manager
+attempts to deliver that message (note that Postfix will never
+deliver messages in the hold queue).
-[Feature 20151031] New "smtpd_client_auth_rate_limit" feature, to
-enforce an optional rate limit on AUTH commands per SMTP client IP
-address. Similar to other smtpd_client_*_rate_limit features, this
-enforces a limit on the number of requests per $anvil_rate_time_unit.
+The postsuper(1) -e and -f options both set the forced-to-expire
+queue file attribute. The difference is that -f will also release
+a message if it is in the hold queue. With -e, such a message would
+not be returned to the sender until it is released with -f or -H.
-Major changes - smtpd policy
-----------------------------
+In the mailq(1) or postqueue(1) -p output, a forced-to-expire message
+is indicated with # after the queue file name. In postqueue(1) JSON
+output, there is a new per-message field "forced_expire" (with value
+true or false) that shows the forced-to-expire status.
-[Feature 20150913] New SMTPD policy service attribute "policy_context",
-with a corresponding "smtpd_policy_service_policy_context" configuration
-parameter. Originally, this was implemented to share the same SMTPD
-policy service endpoint among multiple check_policy_service clients.
+Major changes - haproxy2 protocol
+---------------------------------
-Major changes - tls
--------------------
+[Feature 20200112] Support for the haproxy v2 protocol. The Postfix
+implementation supports TCP over IPv4 and IPv6, as well as non-proxied
+connections; the latter are typically used for heartbeat tests.
-[Feature 20160207] A new "postfix tls" command to quickly enable
-opportunistic TLS in the Postfix SMTP client or server, and to
-manage SMTP server keys and certificates, including certificate
-signing requests and TLSA DNS records for DANE. See the postfix-tls(1)
-manpage for a detailed description.
+The haproxy v2 protocol introduces no additional Postfix configuration.
+The Postfix smtpd(8) and postscreen(8) daemons accept both v1 and
+v2 protocol versions.
-[Feature 20160103] The Postfix SMTP client by default enables DANE
-policies when an MX host has a (DNSSEC) secure TLSA DNS record,
-even if the MX DNS record was obtained with insecure lookups. The
-existence of a secure TLSA record implies that the host wants to
-talk TLS and not plaintext. For details see the
-smtp_tls_dane_insecure_mx_policy configuration parameter.
+Major changes - logging
+-----------------------
-[Incompat 20150721] As of the middle of 2015, all supported Postfix
-releases no longer enable "export" grade ciphers for opportunistic
-TLS, and no longer use the deprecated SSLv2 and SSLv3 protocols for
-mandatory or opportunistic TLS.
+[Incompat 20191109] Postfix daemon processes now log the from= and
+to= addresses in external (quoted) form in non-debug logging (info,
+warning, etc.). This means that when an address localpart contains
+spaces or other special characters, the localpart will be quoted,
+for example:
-These changes are very unlikely to cause problems with server-to-server
-communication over the Internet, but they may result in interoperability
-problems with ancient client or server implementations on internal
-networks. To address this problem, you can revert the changes with:
+ from=<"name with spaces"@example.com>
-Postfix SMTP client settings:
+Older Postfix versions would log the internal (unquoted) form:
- lmtp_tls_ciphers = export
- smtp_tls_ciphers = export
- lmtp_tls_protocols = !SSLv2
- smtp_tls_protocols = !SSLv2
- lmtp_tls_mandatory_protocols = !SSLv2
- smtp_tls_mandatory_protocols = !SSLv2
+ from=<name with spaces@example.com>
-Postfix SMTP server settings:
+The external and internal forms are identical for the vast majority
+of email addresses that contain no spaces or other special characters
+in the localpart.
- smtpd_tls_ciphers = export
- smtpd_tls_protocols =
- smtpd_tls_mandatory_protocols = !SSLv2
+Specify "info_log_address_format = internal" for backwards
+compatibility.
-These settings, if put in main.cf, affect all Postfix SMTP client
-or server communication, which may be undesirable. To be more
-selective, use "-o name=value" parameter overrides on specific
-services in master.cf. Execute the command "postfix reload" to make
-the changes effective.
+The logging in external form is consistent with the address form
+that Postfix 3.2 and later prefer for table lookups. It is therefore
+the more useful form for non-debug logging.
-[Incompat 20150719] The default Diffie-Hellman non-export prime was
-updated from 1024 to 2048 bits, because SMTP clients are starting
-to reject TLS handshakes with primes smaller than 2048 bits.
-
-Historically, this prime size is not negotiable, and each site needs
-to determine which prime size works best for the majority of its
-clients. See FORWARD_SECRECY_README for some hints in the quick-start
-section.
+Major changes - IP address normalization
+----------------------------------------
+[Incompat 20190427] Postfix now normalizes IP addresses received
+with XCLIENT, XFORWARD, or with the HaProxy protocol, for consistency
+with direct connections to Postfix. This may change the appearance
+of logging, and the way that check_client_access will match subnets
+of an IPv6 address.
diff --git a/external/ibm-public/postfix/dist/RELEASE_NOTES-3.1 b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.1
new file mode 100644
index 00000000000..aa2fbf25719
--- /dev/null
+++ b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.1
@@ -0,0 +1,186 @@
+This is the Postfix 3.1 (stable) release.
+
+The stable Postfix release is called postfix-3.1.x where 3=major
+release number, 1=minor release number, x=patchlevel. The stable
+release never changes except for patches that address bugs or
+emergencies. Patches change the patchlevel and the release date.
+
+New features are developed in snapshot releases. These are called
+postfix-3.2-yyyymmdd where yyyymmdd is the release date (yyyy=year,
+mm=month, dd=day). Patches are never issued for snapshot releases;
+instead, a new snapshot is released.
+
+The mail_release_date configuration parameter (format: yyyymmdd)
+specifies the release date of a stable release or snapshot release.
+
+If you upgrade from Postfix 2.11 or earlier, read RELEASE_NOTES-3.0
+before proceeding.
+
+Major changes - address verification safety
+-------------------------------------------
+
+[Feature 20151227] The new address_verify_pending_request_limit
+parameter introduces a safety limit for the number of address
+verification probes in the active queue. The default limit is 1/4
+of the active queue maximum size. The queue manager enforces the
+limit by tempfailing probe messages that exceed the limit. This
+design avoids dependencies on global counters that get out of sync
+after a process or system crash.
+
+Tempfailing verify requests is not as bad as one might think. The
+Postfix verify cache proactively updates active addresses weeks
+before they expire. The address_verify_pending_request_limit affects
+only unknown addresses, and inactive addresses that have expired
+from the address verify cache (by default, after 31 days).
+
+Major changes - json support
+----------------------------
+
+[Feature 20151129] Machine-readable, JSON-formatted queue listing
+with "postqueue -j" (no "mailq" equivalent). The output is a stream
+of JSON objects, one per queue file. To simplify parsing, each
+JSON object is formatted as one text line followed by one newline
+character. See the postqueue(1) manpage for a detailed description
+of the output format.
+
+Major changes - milter support
+------------------------------
+
+[Feature 20150523] The milter_macro_defaults feature provides an
+optional list of macro name=value pairs. These specify default
+values for Milter macros when no value is available from the SMTP
+session context.
+
+For example, with "milter_macro_defaults = auth_type=TLS", the
+Postfix SMTP server will send an auth_type of "TLS" to a Milter,
+unless the remote client authenticates with SASL.
+
+This feature was originally implemented for a submission service
+that may authenticate clients with a TLS certificate, without having
+to make changes to the code that implements TLS support.
+
+Major changes - output rate control
+-----------------------------------
+
+[Feature 20150710] Destination-independent delivery rate delay
+
+Support to enforce a destination-independent delay between email
+deliveries. The following example inserts 20 seconds of delay
+between all deliveries with the SMTP transport, limiting the delivery
+rate to at most three messages per minute.
+
+/etc/postfix/main.cf:
+ smtp_transport_rate_delay = 20s
+
+For details, see the description of default_transport_rate_delay
+and transport_transport_rate_delay in the postconf(5) manpage.
+
+Major changes - postscreen dnsbl
+--------------------------------
+
+[Feature 20150710] postscreen support for the TTL of DNSBL and DNSWL
+lookup results
+
+Historically, the default setting "postscreen_dnsbl_ttl = 1h" assumes
+that a "not found" result from a DNSBL server will be valid for one
+hour. This may have been adequate five years ago when postscreen
+was first implemented, but nowadays, that one hour can result in
+missed opportunities to block new spambots.
+
+To address this, postscreen now respects the TTL of DNSBL "not
+found" replies, as well as the TTL of DNSWL replies (both "found"
+and "not found"). The TTL for a "not found" reply is determined
+according to RFC 2308 (the TTL of an SOA record in the reply).
+
+Support for DNSBL or DNSWL reply TTL values is controlled by two
+configuration parameters:
+
+postscreen_dnsbl_min_ttl (default: 60 seconds).
+
+ This parameter specifies a minimum for the amount of time that
+ a DNSBL or DNSWL result will be cached in the postscreen_cache_map.
+ This prevents an excessive number of postscreen cache updates
+ when a DNSBL or DNSWL server specifies a very small reply TTL.
+
+postscreen_dnsbl_max_ttl (default: $postscreen_dnsbl_ttl or 1 hour)
+
+ This parameter specifies a maximum for the amount of time that
+ a DNSBL or DNSWL result will be cached in the postscreen_cache_map.
+ This prevents cache pollution when a DNSBL or DNSWL server
+ specifies a very large reply TTL.
+
+The postscreen_dnsbl_ttl parameter is now obsolete, and has become
+the default value for the new postscreen_dnsbl_max_ttl parameter.
+
+Major changes - sasl auth safety
+--------------------------------
+
+[Feature 20151031] New "smtpd_client_auth_rate_limit" feature, to
+enforce an optional rate limit on AUTH commands per SMTP client IP
+address. Similar to other smtpd_client_*_rate_limit features, this
+enforces a limit on the number of requests per $anvil_rate_time_unit.
+
+Major changes - smtpd policy
+----------------------------
+
+[Feature 20150913] New SMTPD policy service attribute "policy_context",
+with a corresponding "smtpd_policy_service_policy_context" configuration
+parameter. Originally, this was implemented to share the same SMTPD
+policy service endpoint among multiple check_policy_service clients.
+
+Major changes - tls
+-------------------
+
+[Feature 20160207] A new "postfix tls" command to quickly enable
+opportunistic TLS in the Postfix SMTP client or server, and to
+manage SMTP server keys and certificates, including certificate
+signing requests and TLSA DNS records for DANE. See the postfix-tls(1)
+manpage for a detailed description.
+
+[Feature 20160103] The Postfix SMTP client by default enables DANE
+policies when an MX host has a (DNSSEC) secure TLSA DNS record,
+even if the MX DNS record was obtained with insecure lookups. The
+existence of a secure TLSA record implies that the host wants to
+talk TLS and not plaintext. For details see the
+smtp_tls_dane_insecure_mx_policy configuration parameter.
+
+[Incompat 20150721] As of the middle of 2015, all supported Postfix
+releases no longer enable "export" grade ciphers for opportunistic
+TLS, and no longer use the deprecated SSLv2 and SSLv3 protocols for
+mandatory or opportunistic TLS.
+
+These changes are very unlikely to cause problems with server-to-server
+communication over the Internet, but they may result in interoperability
+problems with ancient client or server implementations on internal
+networks. To address this problem, you can revert the changes with:
+
+Postfix SMTP client settings:
+
+ lmtp_tls_ciphers = export
+ smtp_tls_ciphers = export
+ lmtp_tls_protocols = !SSLv2
+ smtp_tls_protocols = !SSLv2
+ lmtp_tls_mandatory_protocols = !SSLv2
+ smtp_tls_mandatory_protocols = !SSLv2
+
+Postfix SMTP server settings:
+
+ smtpd_tls_ciphers = export
+ smtpd_tls_protocols =
+ smtpd_tls_mandatory_protocols = !SSLv2
+
+These settings, if put in main.cf, affect all Postfix SMTP client
+or server communication, which may be undesirable. To be more
+selective, use "-o name=value" parameter overrides on specific
+services in master.cf. Execute the command "postfix reload" to make
+the changes effective.
+
+[Incompat 20150719] The default Diffie-Hellman non-export prime was
+updated from 1024 to 2048 bits, because SMTP clients are starting
+to reject TLS handshakes with primes smaller than 2048 bits.
+
+Historically, this prime size is not negotiable, and each site needs
+to determine which prime size works best for the majority of its
+clients. See FORWARD_SECRECY_README for some hints in the quick-start
+section.
+
diff --git a/external/ibm-public/postfix/dist/RELEASE_NOTES-3.2 b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.2
new file mode 100644
index 00000000000..876d4b7a362
--- /dev/null
+++ b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.2
@@ -0,0 +1,180 @@
+This is the Postfix 3.2 (stable) release.
+
+The stable Postfix release is called postfix-3.2.x where 3=major
+release number, 2=minor release number, x=patchlevel. The stable
+release never changes except for patches that address bugs or
+emergencies. Patches change the patchlevel and the release date.
+
+New features are developed in snapshot releases. These are called
+postfix-3.3-yyyymmdd where yyyymmdd is the release date (yyyy=year,
+mm=month, dd=day). Patches are never issued for snapshot releases;
+instead, a new snapshot is released.
+
+The mail_release_date configuration parameter (format: yyyymmdd)
+specifies the release date of a stable release or snapshot release.
+
+If you upgrade from Postfix 3.0 or earlier, read RELEASE_NOTES-3.1
+before proceeding.
+
+Invisible changes
+-----------------
+
+In addition to the visible changes described below, there is an
+ongoing overhaul of low-level code. With each change come updated
+tests to ensure that future changes will not 'break' compatibility
+with past behavior.
+
+Major changes - address mapping
+-------------------------------
+
+[Feature 20170128] Postfix 3.2 fixes the handling of address
+extensions with email addresses that contain spaces. For example,
+the virtual_alias_maps, canonical_maps, and smtp_generic_maps
+features now correctly propagate an address extension from "aa
+bb+ext"@example.com to "cc dd+ext"@other.example, instead of
+producing broken output.
+
+Major changes - header/body_checks
+----------------------------------
+
+[Feature 20161008] "PASS" and "STRIP" actions in header/body_checks.
+"STRIP" is similar to "IGNORE" but also logs the action, and "PASS"
+disables header, body, and Milter inspection for the remainder of
+the message content. Contributed by Hobbit.
+
+Major changes - log analysis
+----------------------------
+
+[Feature 20160330] The collate.pl script by Viktor Dukhovni for
+grouping Postfix logfile records into "sessions" based on queue ID
+and process ID information. It's in the auxiliary/collate directory
+of the Postfix source tree.
+
+Major changes - maps support
+----------------------------
+
+[Feature 20160527] Postfix 3.2 cidr tables support if/endif and
+negation (by prepending ! to a pattern), just like regexp and pcre
+tables. The primarily purpose is to improve readability of complex
+tables. See the cidr_table(5) manpage for syntax details.
+
+[Incompat 20160925] In the Postfix MySQL database client, the default
+option_group value has changed to "client", to enable reading of
+"client" option group settings in the MySQL options file. This fixes
+a "not found" problem with Postfix queries that contain UTF8-encoded
+non-ASCII text. Specify an empty option_group value (option_group
+=) to get backwards-compatible behavior.
+
+[Feature 20161217] Stored-procedure support for MySQL databases.
+Contributed by John Fawcett. See mysql_table(5) for instructions.
+
+[Feature 20170128] The postmap command, and the inline: and texthash:
+maps now support spaces in left-hand field of the lookup table
+"source text". Use double quotes (") around a left-hand field that
+contains spaces, and use backslash (\) to protect embedded quotes
+in a left-hand field. There is no change in the processing of the
+right-hand field.
+
+Major changes - milter support
+------------------------------
+
+[Feature 20160611] The Postfix SMTP server local IP address and
+port are available in the policy delegation protocol (attribute
+names: server_address, server_port), in the Milter protocol (macro
+names: {daemon_addr}, {daemon_port}), and in the XCLIENT protocol
+(attribute names: DESTADDR, DESTPORT).
+
+[Feature 20161024] smtpd_milter_maps support for per-client Milter
+configuration that overrides smtpd_milters, and that has the same
+syntax. A lookup result of "DISABLE" turns off Milter support. See
+MILTER_README.html for details.
+
+Major changes - policy delegation
+---------------------------------
+
+[Feature 20160611] The Postfix SMTP server local IP address and
+port are available in the policy delegation protocol (attribute
+names: server_address, server_port), in the Milter protocol (macro
+names: {daemon_addr}, {daemon_port}), and in the XCLIENT protocol
+(attribute names: DESTADDR, DESTPORT).
+
+Major changes - postqueue
+-------------------------
+
+[Incompat 20170129] The postqueue command no longer forces all
+message arrival times to be reported in UTC. To get the old behavior,
+set TZ=UTC in main.cf:import_environment (this override is not
+recommended, as it affects all Postfix utities and daemons).
+
+Major changes - safety
+----------------------
+
+[Incompat 20161227] For safety reasons, the sendmail -C option must
+specify an authorized directory: the default configuration directory,
+a directory that is listed in the default main.cf file with
+alternate_config_directories or multi_instance_directories, or the
+command must be invoked with root privileges (UID 0 and EUID 0).
+This mitigates a recurring problem with the PHP mail() function.
+
+Major changes - sasl
+--------------------
+
+[Feature 20160625] The Postfix SMTP server now passes remote client
+and local server network address and port information to the Cyrus
+SASL library. Build with ``make makefiles "CCARGS=$CCARGS
+-DNO_IP_CYRUS_SASL_AUTH"'' for backwards compatibility.
+
+Major changes - smtputf8
+------------------------
+
+[Feature 20161103] Postfix 3.2 disables the 'transitional' compatibility
+between the IDNA2003 and IDNA2008 standards for internationalized
+domain names (domain names beyond the limits of US-ASCII).
+
+This change makes Postfix behavior consistent with contemporary web
+browsers. It affects the handling of some corner cases such as
+German sz and Greek zeta. See http://unicode.org/cldr/utility/idna.jsp
+for more examples.
+
+Specify "enable_idna2003_compatibility = yes" to restore historical
+behavior (but keep in mind that the rest of the world may not make
+that same choice).
+
+Major changes - tls
+-------------------
+
+[Feature 20160828] Fixes for deprecated OpenSSL 1.1.0 API features,
+so that Postfix will build without depending on backwards-compatibility
+support.
+
+[Incompat 20161204] Postfix 3.2 removes tentative features that
+were implemented before the DANE spec was finalized:
+
+- Support for certificate usage PKIX-EE(1),
+
+- The ability to disable digest agility (Postfix now behaves as if
+ "tls_dane_digest_agility = on"), and
+
+- The ability to disable support for "TLSA 2 [01] [12]" records
+ that specify the digest of a trust anchor (Postfix now behaves
+ as if "tls_dane_trust_anchor_digest_enable = yes).
+
+[Feature 20161217] Postfix 3.2 enables elliptic curve negotiation
+with OpenSSL >= 1.0.2. This changes the default smtpd_tls_eecdh_grade
+setting to "auto", and introduces a new parameter tls_eecdh_auto_curves
+with the names of curves that may be negotiated.
+
+The default tls_eecdh_auto_curves setting is determined at compile
+time, and depends on the Postfix and OpenSSL versions. At runtime,
+Postfix will skip curve names that aren't supported by the OpenSSL
+library.
+
+Major changes - xclient
+-----------------------
+
+[Feature 20160611] The Postfix SMTP server local IP address and
+port are available in the policy delegation protocol (attribute
+names: server_address, server_port), in the Milter protocol (macro
+names: {daemon_addr}, {daemon_port}), and in the XCLIENT protocol
+(attribute names: DESTADDR, DESTPORT).
+
diff --git a/external/ibm-public/postfix/dist/RELEASE_NOTES-3.3 b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.3
new file mode 100644
index 00000000000..e3762d8d4fb
--- /dev/null
+++ b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.3
@@ -0,0 +1,124 @@
+This is the Postfix 3.3 (stable) release.
+
+The stable Postfix release is called postfix-3.3.x where 3=major
+release number, 3=minor release number, x=patchlevel. The stable
+release never changes except for patches that address bugs or
+emergencies. Patches change the patchlevel and the release date.
+
+New features are developed in snapshot releases. These are called
+postfix-3.4-yyyymmdd where yyyymmdd is the release date (yyyy=year,
+mm=month, dd=day). Patches are never issued for snapshot releases;
+instead, a new snapshot is released.
+
+The mail_release_date configuration parameter (format: yyyymmdd)
+specifies the release date of a stable release or snapshot release.
+
+If you upgrade from Postfix 3.1 or earlier, read RELEASE_NOTES-3.2
+before proceeding.
+
+License change
+---------------
+
+This software is distributed with a dual license: in addition to the
+historical IBM Public License 1.0, it is now also distributed with the
+more recent Eclipse Public License 2.0. Recipients can choose to take
+the software under the license of their choice. Those who are more
+comfortable with the IPL can continue with that license.
+
+Major changes - compatibility safety net
+----------------------------------------
+
+[20180106] With compatibility_level < 1, the Postfix SMTP server
+now warns for mail that would be blocked by the Postfix 2.10
+smtpd_relay_restrictions feature, without blocking that mail. This
+extends the compatibility safety net for sites that upgrade from
+earlier Postfix versions (questions on the postfix-users list show
+there is a steady trickle). See COMPATIBILITY_README for details.
+
+Major changes - configuration
+-----------------------------
+
+[20170617] The postconf command now warns about unknown parameter
+names in a Postfix database configuration file. As with other unknown
+parameter names, these warnings can help to find typos early.
+
+[20180113] New read-only service_name parameter that contains the
+master.cf service name of a Postfix daemon process (it that is empty
+in a non-daemon process). This can make Postfix SMTP server logging
+logging distinct by setting the syslog_name in master.cf with "-o
+syslog_name=postfix/$service_name" for the "submission" and "smtps"
+services, and can make Postfix SMTP client distinct by setting "-o
+syslog_name=postfix/$service_name" for the "relay" service.
+
+Major changes - container support
+---------------------------------
+
+[20171218] Preliminary support to run Postfix in the foreground,
+with "postfix start-fg". This requires that Postfix multi-instance
+support is disabled. To receive Postfix syslog information on the
+container's host, mount the host's /dev/log socket inside the
+container (example: "docker run -v /dev/log:/dev/log ..."), and
+specify a distinct Postfix "syslog_name" prefix that identifies the
+logging from the Postfix instance. Postfix does not log systemd
+events.
+
+Major changes - database support
+---------------------------------
+
+[20170617] The postconf command warns about unknown parameter names
+in a Postfix database configuration file.
+
+[20171227] The pgsql_table(5) hosts parameter now supports the
+postgresql:// URI syntax. Contributed by Magosányi Árpád.
+
+Major changes - header format
+-----------------------------
+
+[20180010] This release changes the format of 'full name' information
+in Postfix-generated From: headers, when a local program such as
+/bin/mail submits a message without From: header.
+
+Postfix-generated From: headers with 'full name' information are
+now formatted as "From: name <address>" by default. Specify
+"header_from_format = obsolete" to get the earlier form "From:
+address (name)". See the postconf(5) manpage for more details.
+
+Major changes - invisible changes
+---------------------------------
+
+[20170617] Additional paranoia in the VSTRING implementation: a
+null byte after the end of vstring buffers (this is a safety net
+so that C-style string operations won't scribble past the end);
+earlier detection of bad length and precision format string specifiers
+(these are the result of programming error, as Postfix format strings
+cannot be specified externally).
+
+Major changes - milter support
+------------------------------
+
+[20171223] Milter applications can now send RET and ENVID parameters
+in SMFIR_CHGFROM (change envelope sender) requests.
+
+Major changes - mixed IPv6/IPv4 support
+---------------------------------------
+
+[20170505] Workaround for mail delivery problems when 1) both Postfix
+IPv6 and IPv4 support are enabled, 2) some destination announces
+more primary IPv6 MX addresses than primary IPv4 MX addresses, 3)
+the destination is unreachable over IPv6, and 4) Postfix runs into
+the smtp_mx_address_limit before it can try to deliver over IPv4.
+
+When both Postfix IPv6 and IPv4 support are enabled, the Postfix
+SMTP client will now relax MX preferences so that it can schedule
+similar numbers of IPv4 and IPv6 destination addresses. This ensures
+that an IPv6 connectivity problem will not prevent mail from being
+delivered over IPv4 (and vice versa). Specify "smtp_balance_inet_protocols
+= no" to disable this workaround.
+
+Major changes - xclient
+-----------------------
+
+[20171218] The Postfix SMTP server now allows the XCLIENT command
+before STARTTLS when TLS is required. This is useful for servers
+that run behind a reverse proxy server such as nginx.
+
diff --git a/external/ibm-public/postfix/dist/RELEASE_NOTES-3.4 b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.4
new file mode 100644
index 00000000000..6794f1d3c64
--- /dev/null
+++ b/external/ibm-public/postfix/dist/RELEASE_NOTES-3.4
@@ -0,0 +1,208 @@
+This is the Postfix 3.4 (stable) release.
+
+The stable Postfix release is called postfix-3.4.x where 3=major
+release number, 4=minor release number, x=patchlevel. The stable
+release never changes except for patches that address bugs or
+emergencies. Patches change the patchlevel and the release date.
+
+New features are developed in snapshot releases. These are called
+postfix-3.5-yyyymmdd where yyyymmdd is the release date (yyyy=year,
+mm=month, dd=day). Patches are never issued for snapshot releases;
+instead, a new snapshot is released.
+
+The mail_release_date configuration parameter (format: yyyymmdd)
+specifies the release date of a stable release or snapshot release.
+
+If you upgrade from Postfix 3.2 or earlier, read RELEASE_NOTES-3.3
+before proceeding.
+
+License change
+---------------
+
+This software is distributed with a dual license: in addition to the
+historical IBM Public License 1.0, it is now also distributed with the
+more recent Eclipse Public License 2.0. Recipients can choose to take
+the software under the license of their choice. Those who are more
+comfortable with the IPL can continue with that license.
+
+Summary of changes
+------------------
+
+Incompatible changes, bdat support, containers, database support,
+logging, safety, tls connection pooling, tls support, usability,
+
+Incompatible changes
+--------------------
+
+[Incompat 20180826] The Postfix SMTP server announces CHUNKING (BDAT
+command) by default. In the unlikely case that this breaks some
+important remote SMTP client, disable the feature as follows:
+
+/etc/postfix/main.cf:
+ # The logging alternative:
+ smtpd_discard_ehlo_keywords = chunking
+ # The non-logging alternative:
+ smtpd_discard_ehlo_keywords = chunking, silent_discard
+
+See BDAT_README for more.
+
+[Incompat 20190126] This introduces a new master.cf service 'postlog'
+with type 'unix-dgram' that is used by the new postlogd(8) daemon.
+Before backing out to an older Postfix version, edit the master.cf
+file and remove the postlog entry.
+
+[Incompat 20190106] Postfix 3.4 drops support for OpenSSL 1.0.1
+(end-of-life was December 31, 2016) and all earlier releases.
+
+[Incompat 20180701] To avoid performance loss under load, the
+tlsproxy(8) daemon now requires a zero process limit in master.cf
+(this setting is provided with the default master.cf file). By
+default, a tlsproxy(8) process will retire after several hours.
+
+To set the tlsproxy process limit to zero:
+
+# postconf -F tlsproxy/unix/process_limit=0
+# postfix reload
+
+Major changes - bdat support
+--------------------
+
+[Feature 20180826] Postfix SMTP server support for RFC 3030 CHUNKING
+(the BDAT command) without BINARYMIME, in both smtpd(8) and
+postscreen(8). This has no effect on Milters, smtpd_mumble_restrictions,
+and smtpd_proxy_filter. See BDAT_README for more.
+
+Major changes - containers
+--------------------------
+
+[Feature 20190126] Support for logging to file or stdout, instead
+of using syslog.
+
+- Logging to file solves a usability problem for MacOS, and
+ eliminates multiple problems with systemd-based systems.
+
+- Logging to stdout is useful when Postfix runs in a container, as
+ it eliminates a syslogd dependency.
+
+See MAILLOG_README for configuration examples and logfile rotation.
+
+[Feature 20180422] Better handling of undocumented(!) Linux behavior
+whether or not signals are delivered to a PID=1 process.
+
+Major changes - database support
+--------------------------------
+
+[Feature 20181105] Support for (key, list of filenames) in map
+source text.
+
+- Currently, this feature is used only by tls_server_sni_maps.
+
+- When a map is created from source with "postmap -F maptype:mapname",
+ the command processes each key as usual and processes each value
+ as a list of filenames, concatenates the content of those files
+ (with one newline character in-between files), and stores an entry
+ with (key, base64-encoded result).
+
+- When a map is queried with "postmap -F -q ...", the command
+ base64-decodes each value. It reports an error when a value is
+ not in base64 form.
+
+ This "postmap -F -q ..." behavior also works when querying the
+ memory-resident map types cidr:, inline:, pcre:, randmap:, regexp:,
+ and static:. Postfix reads the files specified as table values,
+ stores base64-encoded content, and base64-decodes content upon
+ table lookup.
+
+ Internally, Postfix will turn on this behavior for lookups (not
+ updates) when a map is opened with the DICT_FLAG_RHS_IS_FILE flag.
+
+Major changes - logging
+-----------------------
+
+[Feature 20190126] Support for logging to file or stdout, instead
+of using syslog.
+
+- Logging to file solves a usability problem for MacOS, and
+ eliminates multiple problems with systemd-based systems.
+
+- Logging to stdout is useful when Postfix runs in a container, as
+ it eliminates a syslogd dependency.
+
+See MAILLOG_README for configuration examples and logfile rotation.
+
+Major changes - safety
+----------------------
+
+[Feature 20180623] Automatic retirement: dnsblog(8) and tlsproxy(8) process
+will now voluntarily retire after after max_idle*max_use, or some
+sane limit if either limit is disabled. Without this, a process
+could stay busy for days or more.
+
+Major changes - tls connection pooling
+--------------------------------------
+
+[Feature 20180617] Postfix SMTP client support for multiple deliveries
+per TLS-encrypted connection. This is primarily to improve mail
+delivery performance for destinations that throttle clients when
+they don't combine deliveries.
+
+This feature is enabled with "smtp_tls_connection_reuse=yes" in
+main.cf, or with "tls_connection_reuse=yes" in smtp_tls_policy_maps.
+It supports all Postfix TLS security levels including dane and
+dane-only.
+
+The implementation of TLS connection reuse relies on the same
+scache(8) service as used for delivering plaintext SMTP mail, the
+same tlsproxy(8) daemon as used by the postscreen(8) service for
+inbound connections, and relies on the same hints from the qmgr(8)
+daemon. It reuses the configuration parameters described in
+CONNECTION_CACHE_README.
+
+The Postfix SMTP client now logs whether an SMTP-over-TLS connection
+is newly established ("TLS connection established") or whether the
+connection is reused ("TLS connection reused").
+
+The following illustrates how TLS connections are reused:
+
+ Initial plaintext SMTP handshake:
+ smtp(8) -> remote SMTP server
+
+ Reused SMTP/TLS connection, or new SMTP/TLS connection:
+ smtp(8) -> tlsproxy(8) -> remote SMTP server
+
+ Cached SMTP/TLS connection:
+ scache(8) -> tlsproxy(8) -> remote SMTP server
+
+Major changes - tls support
+---------------------------
+
+[Feature 20190106] SNI support in the Postfix SMTP server, the
+Postfix SMTP client, and in the tlsproxy(8) daemon (both server and
+client roles). See the postconf(5) documentation for the new
+tls_server_sni_maps and smtp_tls_servername parameters.
+
+[Feature 20190106] Support for files that contain multiple (key,
+certificate, trust chain) instances. This was required to implement
+server-side SNI table lookups, but it also eliminates the need for
+separate cert/key files for RSA, DSA, Elliptic Curve, and so on.
+The file format is documented in the TLS_README sections "Server-side
+certificate and private key configuration" and "Client-side certificate
+and private key configuration", and in the postconf(5) documentation
+for the parameters smtp_tls_chain_files, smtpd_tls_chain_files,
+tlsproxy_client_chain_files, and tlsproxy_tls_chain_files.
+
+Note: the command "postfix tls" does not yet support the new
+consolidated certificate chain format. If you switch to the new
+format, you'll need to manage your keys and certificates directly,
+rather than via postfix-tls(1).
+
+Major changes - usability
+-------------------------
+
+[Feature 20180812] Support for smtpd_reject_footer_maps (as well
+as the postscreen variant postscreen_reject_footer_maps) for more
+informative reject messages. This is indexed with the Postfix SMTP
+server response text, and overrides the footer specified with
+smtpd_reject_footer. One will want to use a pcre: or regexp: map
+with this.
+
diff --git a/external/ibm-public/postfix/dist/TLS_LICENSE b/external/ibm-public/postfix/dist/TLS_LICENSE
index c588674c372..3d54be27180 100644
--- a/external/ibm-public/postfix/dist/TLS_LICENSE
+++ b/external/ibm-public/postfix/dist/TLS_LICENSE
@@ -30,7 +30,7 @@ Disclaimer:
ILLEGAL IN SOME PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE
TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL
TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR
- OTHER PEOPLE YOU ARE STRONGLY ADVICED TO PAY CLOSE ATTENTION TO ANY
+ OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY
EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHOR OF
PFIXTLS IS NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE
CAREFULLY YOURSELF, IT IS YOUR RESPONSIBILITY.
diff --git a/external/ibm-public/postfix/dist/conf/LICENSE b/external/ibm-public/postfix/dist/conf/LICENSE
index 45b98347aea..58ea8f1c268 100644
--- a/external/ibm-public/postfix/dist/conf/LICENSE
+++ b/external/ibm-public/postfix/dist/conf/LICENSE
@@ -1,3 +1,290 @@
+LICENSE - SECURE MAILER
+
+This software is dual-licensed under both the Eclipse Public License
+version 2.0 and the IBM Public License version 1.0, for those who
+are more comfortable continuing with that license. Recipients can
+choose to take the software under the license of their choice.
+
+The remainder of this text contains a copy of each license.
+
+Eclipse Public License - v 2.0
+
+ THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE
+ PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION
+ OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+ a) in the case of the initial Contributor, the initial content
+ Distributed under this Agreement, and
+
+ b) in the case of each subsequent Contributor:
+ i) changes to the Program, and
+ ii) additions to the Program;
+ where such changes and/or additions to the Program originate from
+ and are Distributed by that particular Contributor. A Contribution
+ "originates" from a Contributor if it was added to the Program by
+ such Contributor itself or anyone acting on such Contributor's behalf.
+ Contributions do not include changes or additions to the Program that
+ are not Modified Works.
+
+"Contributor" means any person or entity that Distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which
+are necessarily infringed by the use or sale of its Contribution alone
+or when combined with the Program.
+
+"Program" means the Contributions Distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement
+or any Secondary License (as applicable), including Contributors.
+
+"Derivative Works" shall mean any work, whether in Source Code or other
+form, that is based on (or derived from) the Program and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship.
+
+"Modified Works" shall mean any work in Source Code or other form that
+results from an addition to, deletion from, or modification of the
+contents of the Program, including, for purposes of clarity any new file
+in Source Code form that contains any contents of the Program. Modified
+Works shall not include works that contain only declarations,
+interfaces, types, classes, structures, or files of the Program solely
+in each case in order to link to, bind by name, or subclass the Program
+or Modified Works thereof.
+
+"Distribute" means the acts of a) distributing or b) making available
+in any manner that enables the transfer of a copy.
+
+"Source Code" means the form of a Program preferred for making
+modifications, including but not limited to software source code,
+documentation source, and configuration files.
+
+"Secondary License" means either the GNU General Public License,
+Version 2.0, or any later versions of that license, including any
+exceptions or additional permissions as identified by the initial
+Contributor.
+
+2. GRANT OF RIGHTS
+
+ a) Subject to the terms of this Agreement, each Contributor hereby
+ grants Recipient a non-exclusive, worldwide, royalty-free copyright
+ license to reproduce, prepare Derivative Works of, publicly display,
+ publicly perform, Distribute and sublicense the Contribution of such
+ Contributor, if any, and such Derivative Works.
+
+ b) Subject to the terms of this Agreement, each Contributor hereby
+ grants Recipient a non-exclusive, worldwide, royalty-free patent
+ license under Licensed Patents to make, use, sell, offer to sell,
+ import and otherwise transfer the Contribution of such Contributor,
+ if any, in Source Code or other form. This patent license shall
+ apply to the combination of the Contribution and the Program if, at
+ the time the Contribution is added by the Contributor, such addition
+ of the Contribution causes such combination to be covered by the
+ Licensed Patents. The patent license shall not apply to any other
+ combinations which include the Contribution. No hardware per se is
+ licensed hereunder.
+
+ c) Recipient understands that although each Contributor grants the
+ licenses to its Contributions set forth herein, no assurances are
+ provided by any Contributor that the Program does not infringe the
+ patent or other intellectual property rights of any other entity.
+ Each Contributor disclaims any liability to Recipient for claims
+ brought by any other entity based on infringement of intellectual
+ property rights or otherwise. As a condition to exercising the
+ rights and licenses granted hereunder, each Recipient hereby
+ assumes sole responsibility to secure any other intellectual
+ property rights needed, if any. For example, if a third party
+ patent license is required to allow Recipient to Distribute the
+ Program, it is Recipient's responsibility to acquire that license
+ before distributing the Program.
+
+ d) Each Contributor represents that to its knowledge it has
+ sufficient copyright rights in its Contribution, if any, to grant
+ the copyright license set forth in this Agreement.
+
+ e) Notwithstanding the terms of any Secondary License, no
+ Contributor makes additional grants to any Recipient (other than
+ those set forth in this Agreement) as a result of such Recipient's
+ receipt of the Program under the terms of a Secondary License
+ (if permitted under the terms of Section 3).
+
+3. REQUIREMENTS
+
+3.1 If a Contributor Distributes the Program in any form, then:
+
+ a) the Program must also be made available as Source Code, in
+ accordance with section 3.2, and the Contributor must accompany
+ the Program with a statement that the Source Code for the Program
+ is available under this Agreement, and informs Recipients how to
+ obtain it in a reasonable manner on or through a medium customarily
+ used for software exchange; and
+
+ b) the Contributor may Distribute the Program under a license
+ different than this Agreement, provided that such license:
+ i) effectively disclaims on behalf of all other Contributors all
+ warranties and conditions, express and implied, including
+ warranties or conditions of title and non-infringement, and
+ implied warranties or conditions of merchantability and fitness
+ for a particular purpose;
+
+ ii) effectively excludes on behalf of all other Contributors all
+ liability for damages, including direct, indirect, special,
+ incidental and consequential damages, such as lost profits;
+
+ iii) does not attempt to limit or alter the recipients' rights
+ in the Source Code under section 3.2; and
+
+ iv) requires any subsequent distribution of the Program by any
+ party to be under a license that satisfies the requirements
+ of this section 3.
+
+3.2 When the Program is Distributed as Source Code:
+
+ a) it must be made available under this Agreement, or if the
+ Program (i) is combined with other material in a separate file or
+ files made available under a Secondary License, and (ii) the initial
+ Contributor attached to the Source Code the notice described in
+ Exhibit A of this Agreement, then the Program may be made available
+ under the terms of such Secondary Licenses, and
+
+ b) a copy of this Agreement must be included with each copy of
+ the Program.
+
+3.3 Contributors may not remove or alter any copyright, patent,
+trademark, attribution notices, disclaimers of warranty, or limitations
+of liability ("notices") contained within the Program from any copy of
+the Program which they Distribute, provided that Contributors may add
+their own appropriate notices.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities
+with respect to end users, business partners and the like. While this
+license is intended to facilitate the commercial use of the Program,
+the Contributor who includes the Program in a commercial product
+offering should do so in a manner which does not create potential
+liability for other Contributors. Therefore, if a Contributor includes
+the Program in a commercial product offering, such Contributor
+("Commercial Contributor") hereby agrees to defend and indemnify every
+other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits
+and other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such
+Commercial Contributor in connection with its distribution of the Program
+in a commercial product offering. The obligations in this section do not
+apply to any claims or Losses relating to any actual or alleged
+intellectual property infringement. In order to qualify, an Indemnified
+Contributor must: a) promptly notify the Commercial Contributor in
+writing of such claim, and b) allow the Commercial Contributor to control,
+and cooperate with the Commercial Contributor in, the defense and any
+related settlement negotiations. The Indemnified Contributor may
+participate in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial
+product offering, Product X. That Contributor is then a Commercial
+Contributor. If that Commercial Contributor then makes performance
+claims, or offers warranties related to Product X, those performance
+claims and warranties are such Commercial Contributor's responsibility
+alone. Under this section, the Commercial Contributor would have to
+defend claims against the other Contributors related to those performance
+claims and warranties, and if a court requires any other Contributor to
+pay any damages as a result, the Commercial Contributor must pay
+those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, THE PROGRAM IS PROVIDED ON AN "AS IS"
+BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF
+TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR
+PURPOSE. Each Recipient is solely responsible for determining the
+appropriateness of using and distributing the Program and assumes all
+risks associated with its exercise of rights under this Agreement,
+including but not limited to the risks and costs of program errors,
+compliance with applicable laws, damage to or loss of data, programs
+or equipment, and unavailability or interruption of operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, NEITHER RECIPIENT NOR ANY CONTRIBUTORS
+SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST
+PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of
+the remainder of the terms of this Agreement, and without further
+action by the parties hereto, such provision shall be reformed to the
+minimum extent necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity
+(including a cross-claim or counterclaim in a lawsuit) alleging that the
+Program itself (excluding combinations of the Program with other software
+or hardware) infringes such Recipient's patent(s), then such Recipient's
+rights granted under Section 2(b) shall terminate as of the date such
+litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it
+fails to comply with any of the material terms or conditions of this
+Agreement and does not cure such failure in a reasonable period of
+time after becoming aware of such noncompliance. If all Recipient's
+rights under this Agreement terminate, Recipient agrees to cease use
+and distribution of the Program as soon as reasonably practicable.
+However, Recipient's obligations under this Agreement and any licenses
+granted by Recipient relating to the Program shall continue and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement,
+but in order to avoid inconsistency the Agreement is copyrighted and
+may only be modified in the following manner. The Agreement Steward
+reserves the right to publish new versions (including revisions) of
+this Agreement from time to time. No one other than the Agreement
+Steward has the right to modify this Agreement. The Eclipse Foundation
+is the initial Agreement Steward. The Eclipse Foundation may assign the
+responsibility to serve as the Agreement Steward to a suitable separate
+entity. Each new version of the Agreement will be given a distinguishing
+version number. The Program (including Contributions) may always be
+Distributed subject to the version of the Agreement under which it was
+received. In addition, after a new version of the Agreement is published,
+Contributor may elect to Distribute the Program (including its
+Contributions) under the new version.
+
+Except as expressly stated in Sections 2(a) and 2(b) above, Recipient
+receives no rights or licenses to the intellectual property of any
+Contributor under this Agreement, whether expressly, by implication,
+estoppel or otherwise. All rights in the Program not expressly granted
+under this Agreement are reserved. Nothing in this Agreement is intended
+to be enforceable by any entity that is not a Contributor or Recipient.
+No third-party beneficiary rights are created under this Agreement.
+
+Exhibit A - Form of Secondary Licenses Notice
+
+"This Source Code may also be made available under the following
+Secondary Licenses when the conditions for such availability set forth
+in the Eclipse Public License, v. 2.0 are satisfied: {name license(s),
+version(s), and exceptions or additional permissions here}."
+
+ Simply including a copy of this Agreement, including this Exhibit A
+ is not sufficient to license the Source Code under Secondary Licenses.
+
+ If it is not possible or desirable to put the notice in a particular
+ file, then You may include the notice in a location (such as a LICENSE
+ file in a relevant directory) where a recipient would be likely to
+ look for such a notice.
+
+ You may add additional accurate notices of copyright ownership.
+
IBM PUBLIC LICENSE VERSION 1.0 - SECURE MAILER
THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS IBM PUBLIC
diff --git a/external/ibm-public/postfix/dist/conf/TLS_LICENSE b/external/ibm-public/postfix/dist/conf/TLS_LICENSE
index c588674c372..3d54be27180 100644
--- a/external/ibm-public/postfix/dist/conf/TLS_LICENSE
+++ b/external/ibm-public/postfix/dist/conf/TLS_LICENSE
@@ -30,7 +30,7 @@ Disclaimer:
ILLEGAL IN SOME PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE
TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL
TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR
- OTHER PEOPLE YOU ARE STRONGLY ADVICED TO PAY CLOSE ATTENTION TO ANY
+ OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY
EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHOR OF
PFIXTLS IS NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE
CAREFULLY YOURSELF, IT IS YOUR RESPONSIBILITY.
diff --git a/external/ibm-public/postfix/dist/conf/access b/external/ibm-public/postfix/dist/conf/access
index 3bc3dd3ed3a..257339bfb07 100644
--- a/external/ibm-public/postfix/dist/conf/access
+++ b/external/ibm-public/postfix/dist/conf/access
@@ -122,21 +122,17 @@
#
# net.work
#
-# net Matches the specified IPv4 host address or subnet-
-# work. An IPv4 host address is a sequence of four
-# decimal octets separated by ".".
-#
-# Subnetworks are matched by repeatedly truncating
-# the last ".octet" from the remote IPv4 host address
-# string until a match is found in the access table,
+# net Matches a remote IPv4 host address or network
+# address range. Specify one to four decimal octets
+# separated by ".". Do not specify "[]" , "/", lead-
+# ing zeros, or hexadecimal forms.
+#
+# Network ranges are matched by repeatedly truncating
+# the last ".octet" from a remote IPv4 host address
+# string, until a match is found in the access table,
# or until further truncation is not possible.
#
-# NOTE 1: The access map lookup key must be in canon-
-# ical form: do not specify unnecessary null charac-
-# ters, and do not enclose network address informa-
-# tion with "[]" characters.
-#
-# NOTE 2: use the cidr lookup table type to specify
+# NOTE: use the cidr lookup table type to specify
# network/netmask patterns. See cidr_table(5) for
# details.
#
@@ -146,25 +142,20 @@
#
# net:work
#
-# net Matches the specified IPv6 host address or subnet-
-# work. An IPv6 host address is a sequence of three
-# to eight hexadecimal octet pairs separated by ":".
-#
-# Subnetworks are matched by repeatedly truncating
-# the last ":octetpair" from the remote IPv6 host
-# address string until a match is found in the access
-# table, or until further truncation is not possible.
+# net Matches a remote IPv6 host address or network
+# address range. Specify three to eight hexadecimal
+# octet pairs separated by ":", using the compressed
+# form "::" for a sequence of zero-valued octet
+# pairs. Do not specify "[]", "/", leading zeros, or
+# non-compressed forms.
#
-# NOTE 1: the truncation and comparison are done with
-# the string representation of the IPv6 host address.
-# Thus, not all the ":" subnetworks will be tried.
+# A network range is matched by repeatedly truncating
+# the last ":octetpair" from the compressed-form
+# remote IPv6 host address string, until a match is
+# found in the access table, or until further trunca-
+# tion is not possible.
#
-# NOTE 2: The access map lookup key must be in canon-
-# ical form: do not specify unnecessary null charac-
-# ters, and do not enclose network address informa-
-# tion with "[]" characters.
-#
-# NOTE 3: use the cidr lookup table type to specify
+# NOTE: use the cidr lookup table type to specify
# network/netmask patterns. See cidr_table(5) for
# details.
#
@@ -175,64 +166,64 @@
#
# all-numerical
# An all-numerical result is treated as OK. This for-
-# mat is generated by address-based relay authoriza-
+# mat is generated by address-based relay authoriza-
# tion schemes such as pop-before-smtp.
#
# For other accept actions, see "OTHER ACTIONS" below.
#
# REJECT ACTIONS
-# Postfix version 2.3 and later support enhanced status
-# codes as defined in RFC 3463. When no code is specified
-# at the beginning of the text below, Postfix inserts a
-# default enhanced status code of "5.7.1" in the case of
-# reject actions, and "4.7.1" in the case of defer actions.
+# Postfix version 2.3 and later support enhanced status
+# codes as defined in RFC 3463. When no code is specified
+# at the beginning of the text below, Postfix inserts a
+# default enhanced status code of "5.7.1" in the case of
+# reject actions, and "4.7.1" in the case of defer actions.
# See "ENHANCED STATUS CODES" below.
#
# 4NN text
#
# 5NN text
-# Reject the address etc. that matches the pattern,
+# Reject the address etc. that matches the pattern,
# and respond with the numerical three-digit code and
-# text. 4NN means "try again later", while 5NN means
+# text. 4NN means "try again later", while 5NN means
# "do not try again".
#
-# The following responses have special meaning for
+# The following responses have special meaning for
# the Postfix SMTP server:
#
# 421 text (Postfix 2.3 and later)
#
# 521 text (Postfix 2.6 and later)
-# After responding with the numerical
-# three-digit code and text, disconnect imme-
+# After responding with the numerical
+# three-digit code and text, disconnect imme-
# diately from the SMTP client. This frees up
-# SMTP server resources so that they can be
+# SMTP server resources so that they can be
# made available to another SMTP client.
#
# Note: The "521" response should be used only
-# with botnets and other malware where inter-
+# with botnets and other malware where inter-
# operability is of no concern. The "send 521
-# and disconnect" behavior is NOT defined in
+# and disconnect" behavior is NOT defined in
# the SMTP standard.
#
# REJECT optional text...
-# Reject the address etc. that matches the pattern.
-# Reply with "$access_map_reject_code optional
-# text..." when the optional text is specified, oth-
+# Reject the address etc. that matches the pattern.
+# Reply with "$access_map_reject_code optional
+# text..." when the optional text is specified, oth-
# erwise reply with a generic error response message.
#
# DEFER optional text...
-# Reject the address etc. that matches the pattern.
-# Reply with "$access_map_defer_code optional
-# text..." when the optional text is specified, oth-
+# Reject the address etc. that matches the pattern.
+# Reply with "$access_map_defer_code optional
+# text..." when the optional text is specified, oth-
# erwise reply with a generic error response message.
#
# This feature is available in Postfix 2.6 and later.
#
# DEFER_IF_REJECT optional text...
-# Defer the request if some later restriction would
-# result in a REJECT action. Reply with
-# "$access_map_defer_code 4.7.1 optional text..."
-# when the optional text is specified, otherwise
+# Defer the request if some later restriction would
+# result in a REJECT action. Reply with
+# "$access_map_defer_code 4.7.1 optional text..."
+# when the optional text is specified, otherwise
# reply with a generic error response message.
#
# Prior to Postfix 2.6, the SMTP reply code is 450.
@@ -240,10 +231,10 @@
# This feature is available in Postfix 2.1 and later.
#
# DEFER_IF_PERMIT optional text...
-# Defer the request if some later restriction would
-# result in a an explicit or implicit PERMIT action.
-# Reply with "$access_map_defer_code 4.7.1 optional
-# text..." when the optional text is specified, oth-
+# Defer the request if some later restriction would
+# result in a an explicit or implicit PERMIT action.
+# Reply with "$access_map_defer_code 4.7.1 optional
+# text..." when the optional text is specified, oth-
# erwise reply with a generic error response message.
#
# Prior to Postfix 2.6, the SMTP reply code is 450.
@@ -258,195 +249,195 @@
# reject_unauth_destination, and so on).
#
# BCC user@domain
-# Send one copy of the message to the specified
+# Send one copy of the message to the specified
# recipient.
#
-# If multiple BCC actions are specified within the
-# same SMTP MAIL transaction, only the last action
-# will be used.
+# If multiple BCC actions are specified within the
+# same SMTP MAIL transaction, with Postfix 3.0 only
+# the last action will be used.
#
# This feature is available in Postfix 3.0 and later.
#
# DISCARD optional text...
-# Claim successful delivery and silently discard the
-# message. Log the optional text if specified, oth-
+# Claim successful delivery and silently discard the
+# message. Log the optional text if specified, oth-
# erwise log a generic message.
#
-# Note: this action currently affects all recipients
-# of the message. To discard only one recipient
-# without discarding the entire message, use the
+# Note: this action currently affects all recipients
+# of the message. To discard only one recipient
+# without discarding the entire message, use the
# transport(5) table to direct mail to the discard(8)
# service.
#
# This feature is available in Postfix 2.0 and later.
#
-# DUNNO Pretend that the lookup key was not found. This
-# prevents Postfix from trying substrings of the
-# lookup key (such as a subdomain name, or a network
+# DUNNO Pretend that the lookup key was not found. This
+# prevents Postfix from trying substrings of the
+# lookup key (such as a subdomain name, or a network
# address subnetwork).
#
# This feature is available in Postfix 2.0 and later.
#
# FILTER transport:destination
-# After the message is queued, send the entire mes-
+# After the message is queued, send the entire mes-
# sage through the specified external content filter.
-# The transport name specifies the first field of a
-# mail delivery agent definition in master.cf; the
-# syntax of the next-hop destination is described in
+# The transport name specifies the first field of a
+# mail delivery agent definition in master.cf; the
+# syntax of the next-hop destination is described in
# the manual page of the corresponding delivery
-# agent. More information about external content
+# agent. More information about external content
# filters is in the Postfix FILTER_README file.
#
-# Note 1: do not use $number regular expression sub-
-# stitutions for transport or destination unless you
+# Note 1: do not use $number regular expression sub-
+# stitutions for transport or destination unless you
# know that the information has a trusted origin.
#
-# Note 2: this action overrides the main.cf con-
-# tent_filter setting, and affects all recipients of
-# the message. In the case that multiple FILTER
+# Note 2: this action overrides the main.cf con-
+# tent_filter setting, and affects all recipients of
+# the message. In the case that multiple FILTER
# actions fire, only the last one is executed.
#
-# Note 3: the purpose of the FILTER command is to
-# override message routing. To override the recipi-
-# ent's transport but not the next-hop destination,
-# specify an empty filter destination (Postfix 2.7
+# Note 3: the purpose of the FILTER command is to
+# override message routing. To override the recipi-
+# ent's transport but not the next-hop destination,
+# specify an empty filter destination (Postfix 2.7
# and later), or specify a transport:destination that
-# delivers through a different Postfix instance
-# (Postfix 2.6 and earlier). Other options are using
-# the recipient-dependent transport_maps or the sen-
+# delivers through a different Postfix instance
+# (Postfix 2.6 and earlier). Other options are using
+# the recipient-dependent transport_maps or the sen-
# der-dependent sender_dependent_default_transport-
# _maps features.
#
# This feature is available in Postfix 2.0 and later.
#
# HOLD optional text...
-# Place the message on the hold queue, where it will
-# sit until someone either deletes it or releases it
-# for delivery. Log the optional text if specified,
+# Place the message on the hold queue, where it will
+# sit until someone either deletes it or releases it
+# for delivery. Log the optional text if specified,
# otherwise log a generic message.
#
-# Mail that is placed on hold can be examined with
-# the postcat(1) command, and can be destroyed or
+# Mail that is placed on hold can be examined with
+# the postcat(1) command, and can be destroyed or
# released with the postsuper(1) command.
#
-# Note: use "postsuper -r" to release mail that was
-# kept on hold for a significant fraction of $maxi-
+# Note: use "postsuper -r" to release mail that was
+# kept on hold for a significant fraction of $maxi-
# mal_queue_lifetime or $bounce_queue_lifetime, or
-# longer. Use "postsuper -H" only for mail that will
+# longer. Use "postsuper -H" only for mail that will
# not expire within a few delivery attempts.
#
-# Note: this action currently affects all recipients
+# Note: this action currently affects all recipients
# of the message.
#
# This feature is available in Postfix 2.0 and later.
#
# PREPEND headername: headervalue
-# Prepend the specified message header to the mes-
-# sage. When more than one PREPEND action executes,
-# the first prepended header appears before the sec-
+# Prepend the specified message header to the mes-
+# sage. When more than one PREPEND action executes,
+# the first prepended header appears before the sec-
# ond etc. prepended header.
#
-# Note: this action must execute before the message
-# content is received; it cannot execute in the con-
+# Note: this action must execute before the message
+# content is received; it cannot execute in the con-
# text of smtpd_end_of_data_restrictions.
#
# This feature is available in Postfix 2.1 and later.
#
# REDIRECT user@domain
-# After the message is queued, send the message to
+# After the message is queued, send the message to
# the specified address instead of the intended
# recipient(s). When multiple REDIRECT actions fire,
# only the last one takes effect.
#
-# Note: this action overrides the FILTER action, and
-# currently overrides all recipients of the message.
+# Note: this action overrides the FILTER action, and
+# currently overrides all recipients of the message.
#
# This feature is available in Postfix 2.1 and later.
#
# INFO optional text...
# Log an informational record with the optional text,
-# together with client information and if available,
-# with helo, sender, recipient and protocol informa-
+# together with client information and if available,
+# with helo, sender, recipient and protocol informa-
# tion.
#
# This feature is available in Postfix 3.0 and later.
#
# WARN optional text...
# Log a warning with the optional text, together with
-# client information and if available, with helo,
+# client information and if available, with helo,
# sender, recipient and protocol information.
#
# This feature is available in Postfix 2.1 and later.
#
# ENHANCED STATUS CODES
-# Postfix version 2.3 and later support enhanced status
-# codes as defined in RFC 3463. When an enhanced status
-# code is specified in an access table, it is subject to
-# modification. The following transformations are needed
-# when the same access table is used for client, helo,
-# sender, or recipient access restrictions; they happen
+# Postfix version 2.3 and later support enhanced status
+# codes as defined in RFC 3463. When an enhanced status
+# code is specified in an access table, it is subject to
+# modification. The following transformations are needed
+# when the same access table is used for client, helo,
+# sender, or recipient access restrictions; they happen
# regardless of whether Postfix replies to a MAIL FROM, RCPT
# TO or other SMTP command.
#
-# o When a sender address matches a REJECT action, the
-# Postfix SMTP server will transform a recipient DSN
-# status (e.g., 4.1.1-4.1.6) into the corresponding
+# o When a sender address matches a REJECT action, the
+# Postfix SMTP server will transform a recipient DSN
+# status (e.g., 4.1.1-4.1.6) into the corresponding
# sender DSN status, and vice versa.
#
-# o When non-address information matches a REJECT
-# action (such as the HELO command argument or the
-# client hostname/address), the Postfix SMTP server
-# will transform a sender or recipient DSN status
-# into a generic non-address DSN status (e.g.,
+# o When non-address information matches a REJECT
+# action (such as the HELO command argument or the
+# client hostname/address), the Postfix SMTP server
+# will transform a sender or recipient DSN status
+# into a generic non-address DSN status (e.g.,
# 4.0.0).
#
# REGULAR EXPRESSION TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# the table is given in the form of regular expressions. For
-# a description of regular expression lookup table syntax,
+# a description of regular expression lookup table syntax,
# see regexp_table(5) or pcre_table(5).
#
-# Each pattern is a regular expression that is applied to
+# Each pattern is a regular expression that is applied to
# the entire string being looked up. Depending on the appli-
-# cation, that string is an entire client hostname, an
+# cation, that string is an entire client hostname, an
# entire client IP address, or an entire mail address. Thus,
# no parent domain or parent network search is done,
-# user@domain mail addresses are not broken up into their
+# user@domain mail addresses are not broken up into their
# user@ and domain constituent parts, nor is user+foo broken
# up into user and foo.
#
-# Patterns are applied in the order as specified in the ta-
-# ble, until a pattern is found that matches the search
+# Patterns are applied in the order as specified in the ta-
+# ble, until a pattern is found that matches the search
# string.
#
-# Actions are the same as with indexed file lookups, with
-# the additional feature that parenthesized substrings from
+# Actions are the same as with indexed file lookups, with
+# the additional feature that parenthesized substrings from
# the pattern can be interpolated as $1, $2 and so on.
#
# TCP-BASED TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# lookups are directed to a TCP-based server. For a descrip-
# tion of the TCP client/server lookup protocol, see tcp_ta-
# ble(5). This feature is not available up to and including
# Postfix version 2.4.
#
-# Each lookup operation uses the entire query string once.
-# Depending on the application, that string is an entire
+# Each lookup operation uses the entire query string once.
+# Depending on the application, that string is an entire
# client hostname, an entire client IP address, or an entire
-# mail address. Thus, no parent domain or parent network
-# search is done, user@domain mail addresses are not broken
-# up into their user@ and domain constituent parts, nor is
+# mail address. Thus, no parent domain or parent network
+# search is done, user@domain mail addresses are not broken
+# up into their user@ and domain constituent parts, nor is
# user+foo broken up into user and foo.
#
# Actions are the same as with indexed file lookups.
#
# EXAMPLE
-# The following example uses an indexed file, so that the
-# order of table entries does not matter. The example per-
-# mits access by the client at address 1.2.3.4 but rejects
-# all other clients in 1.2.3.0/24. Instead of hash lookup
-# tables, some systems use dbm. Use the command "postconf
-# -m" to find out what lookup tables Postfix supports on
+# The following example uses an indexed file, so that the
+# order of table entries does not matter. The example per-
+# mits access by the client at address 1.2.3.4 but rejects
+# all other clients in 1.2.3.0/24. Instead of hash lookup
+# tables, some systems use dbm. Use the command "postconf
+# -m" to find out what lookup tables Postfix supports on
# your system.
#
# /etc/postfix/main.cf:
@@ -457,11 +448,11 @@
# 1.2.3 REJECT
# 1.2.3.4 OK
#
-# Execute the command "postmap /etc/postfix/access" after
+# Execute the command "postmap /etc/postfix/access" after
# editing the file.
#
# BUGS
-# The table format does not understand quoting conventions.
+# The table format does not understand quoting conventions.
#
# SEE ALSO
# postmap(1), Postfix lookup table manager
@@ -470,13 +461,13 @@
# transport(5), transport:nexthop syntax
#
# README FILES
-# Use "postconf readme_directory" or "postconf html_direc-
+# Use "postconf readme_directory" or "postconf html_direc-
# tory" to locate this information.
# SMTPD_ACCESS_README, built-in SMTP server access control
# DATABASE_README, Postfix lookup table overview
#
# LICENSE
-# The Secure Mailer license must be distributed with this
+# The Secure Mailer license must be distributed with this
# software.
#
# AUTHOR(S)
diff --git a/external/ibm-public/postfix/dist/conf/aliases b/external/ibm-public/postfix/dist/conf/aliases
index c8f7579508a..941551e9d7a 100644
--- a/external/ibm-public/postfix/dist/conf/aliases
+++ b/external/ibm-public/postfix/dist/conf/aliases
@@ -91,13 +91,15 @@ decode: root
# lowercase, in order to make database lookups case insensi-
# tive.
#
-# In addition, when an alias exists for owner-name, delivery
-# diagnostics are directed to that address, instead of to
-# the originator of the message. This is typically used to
-# direct delivery errors to the maintainer of a mailing
-# list, who is in a better position to deal with mailing
-# list delivery problems than the originator of the undeliv-
-# ered mail.
+# In addition, when an alias exists for owner-name, this
+# will override the envelope sender address, so that deliv-
+# ery diagnostics are directed to owner-name, instead of the
+# originator of the message (for details, see
+# owner_request_special, expand_owner_alias and
+# reset_owner_alias). This is typically used to direct
+# delivery errors to the maintainer of a mailing list, who
+# is in a better position to deal with mailing list delivery
+# problems than the originator of the undelivered mail.
#
# The value contains one or more of the following:
#
@@ -184,51 +186,51 @@ decode: root
# The text below provides only a parameter summary. See
# postconf(5) for more details including examples.
#
-# alias_database
-# List of alias databases that are updated by the
-# newaliases(1) command.
+# alias_database (see 'postconf -d' output)
+# The alias databases for local(8) delivery that are
+# updated with "newaliases" or with "sendmail -bi".
#
-# alias_maps
-# List of alias databases queried by the local(8)
-# delivery agent.
+# alias_maps (see 'postconf -d' output)
+# The alias databases that are used for local(8)
+# delivery.
#
-# allow_mail_to_commands
-# Restrict the usage of mail delivery to external
-# command.
+# allow_mail_to_commands (alias, forward)
+# Restrict local(8) mail delivery to external com-
+# mands.
#
-# allow_mail_to_files
-# Restrict the usage of mail delivery to external
-# file.
+# allow_mail_to_files (alias, forward)
+# Restrict local(8) mail delivery to external files.
#
-# expand_owner_alias
-# When delivering to an alias that has an owner- com-
-# panion alias, set the envelope sender address to
-# the right-hand side of the owner alias, instead
-# using of the left-hand side address.
+# expand_owner_alias (no)
+# When delivering to an alias "aliasname" that has an
+# "owner-aliasname" companion alias, set the envelope
+# sender address to the expansion of the
+# "owner-aliasname" alias.
#
-# propagate_unmatched_extensions
-# A list of address rewriting or forwarding mecha-
-# nisms that propagate an address extension from the
-# original address to the result. Specify zero or
-# more of canonical, virtual, alias, forward,
-# include, or generic.
+# propagate_unmatched_extensions (canonical, virtual)
+# What address lookup tables copy an address exten-
+# sion from the lookup key to the lookup result.
#
-# owner_request_special
-# Give special treatment to owner-listname and list-
-# name-request addresses.
+# owner_request_special (yes)
+# Enable special treatment for owner-listname entries
+# in the aliases(5) file, and don't split owner-list-
+# name and listname-request address localparts when
+# the recipient_delimiter is set to "-".
#
-# recipient_delimiter
-# Delimiter that separates recipients from address
-# extensions.
+# recipient_delimiter (empty)
+# The set of characters that can separate a user name
+# from its extension (example: user+foo), or a .for-
+# ward file name from its extension (example: .for-
+# ward+foo).
#
# Available in Postfix version 2.3 and later:
#
-# frozen_delivered_to
-# Update the local(8) delivery agent's Delivered-To:
-# address (see prepend_delivered_header) only once,
-# at the start of a delivery; do not update the
-# Delivered-To: address while expanding aliases or
-# .forward files.
+# frozen_delivered_to (yes)
+# Update the local(8) delivery agent's idea of the
+# Delivered-To: address (see prepend_deliv-
+# ered_header) only once, at the start of a delivery
+# attempt; do not update the Delivered-To: address
+# while expanding aliases or .forward files.
#
# STANDARDS
# RFC 822 (ARPA Internet Text Messages)
@@ -240,12 +242,12 @@ decode: root
# postconf(5), configuration parameters
#
# README FILES
-# Use "postconf readme_directory" or "postconf html_direc-
+# Use "postconf readme_directory" or "postconf html_direc-
# tory" to locate this information.
# DATABASE_README, Postfix lookup table overview
#
# LICENSE
-# The Secure Mailer license must be distributed with this
+# The Secure Mailer license must be distributed with this
# software.
#
# AUTHOR(S)
diff --git a/external/ibm-public/postfix/dist/conf/canonical b/external/ibm-public/postfix/dist/conf/canonical
index f4bb72f0131..9881f4ef8bf 100644
--- a/external/ibm-public/postfix/dist/conf/canonical
+++ b/external/ibm-public/postfix/dist/conf/canonical
@@ -82,40 +82,61 @@
#
# TABLE SEARCH ORDER
# With lookups from indexed files such as DB or DBM, or from
-# networked tables such as NIS, LDAP or SQL, patterns are
-# tried in the order as listed below:
+# networked tables such as NIS, LDAP or SQL, each
+# user@domain query produces a sequence of query patterns as
+# described below.
+#
+# Each query pattern is sent to each specified lookup table
+# before trying the next query pattern, until a match is
+# found.
#
# user@domain address
-# Replace user@domain by address. This form has the
+# Replace user@domain by address. This form has the
# highest precedence.
#
-# This is useful to clean up addresses produced by
-# legacy mail systems. It can also be used to pro-
-# duce Firstname.Lastname style addresses, but see
+# This is useful to clean up addresses produced by
+# legacy mail systems. It can also be used to pro-
+# duce Firstname.Lastname style addresses, but see
# below for a simpler solution.
#
# user address
-# Replace user@site by address when site is equal to
-# $myorigin, when site is listed in $mydestination,
-# or when it is listed in $inet_interfaces or
+# Replace user@site by address when site is equal to
+# $myorigin, when site is listed in $mydestination,
+# or when it is listed in $inet_interfaces or
# $proxy_interfaces.
#
-# This form is useful for replacing login names by
+# This form is useful for replacing login names by
# Firstname.Lastname.
#
# @domain address
# Replace other addresses in domain by address. This
# form has the lowest precedence.
#
-# Note: @domain is a wild-card. When this form is
-# applied to recipient addresses, the Postfix SMTP
-# server accepts mail for any recipient in domain,
-# regardless of whether that recipient exists. This
+# Note: @domain is a wild-card. When this form is
+# applied to recipient addresses, the Postfix SMTP
+# server accepts mail for any recipient in domain,
+# regardless of whether that recipient exists. This
# may turn your mail system into a backscatter
# source: Postfix first accepts mail for non-existent
-# recipients and then tries to return that mail as
+# recipients and then tries to return that mail as
# "undeliverable" to the often forged sender address.
#
+# To avoid backscatter with mail for a wild-card
+# domain, replace the wild-card mapping with explicit
+# 1:1 mappings, or add a reject_unverified_recipient
+# restriction for that domain:
+#
+# smtpd_recipient_restrictions =
+# ...
+# reject_unauth_destination
+# check_recipient_access
+# inline:{example.com=reject_unverified_recipient}
+# unverified_recipient_reject_code = 550
+#
+# In the above example, Postfix may contact a remote
+# server if the recipient is rewritten to a remote
+# address.
+#
# RESULT ADDRESS REWRITING
# The lookup result is subject to address rewriting:
#
@@ -180,74 +201,77 @@
# The text below provides only a parameter summary. See
# postconf(5) for more details including examples.
#
-# canonical_classes
-# What addresses are subject to canonical address
-# mapping.
+# canonical_classes (envelope_sender, envelope_recipient,
+# header_sender, header_recipient)
+# What addresses are subject to canonical_maps
+# address mapping.
#
-# canonical_maps
-# List of canonical mapping tables.
+# canonical_maps (empty)
+# Optional address mapping lookup tables for message
+# headers and envelopes.
#
-# recipient_canonical_maps
-# Address mapping lookup table for envelope and
-# header recipient addresses.
+# recipient_canonical_maps (empty)
+# Optional address mapping lookup tables for envelope
+# and header recipient addresses.
#
-# sender_canonical_maps
-# Address mapping lookup table for envelope and
-# header sender addresses.
+# sender_canonical_maps (empty)
+# Optional address mapping lookup tables for envelope
+# and header sender addresses.
#
-# propagate_unmatched_extensions
-# A list of address rewriting or forwarding mecha-
-# nisms that propagate an address extension from the
-# original address to the result. Specify zero or
-# more of canonical, virtual, alias, forward,
-# include, or generic.
+# propagate_unmatched_extensions (canonical, virtual)
+# What address lookup tables copy an address exten-
+# sion from the lookup key to the lookup result.
#
# Other parameters of interest:
#
-# inet_interfaces
-# The network interface addresses that this system
-# receives mail on. You need to stop and start Post-
-# fix when this parameter changes.
+# inet_interfaces (all)
+# The network interface addresses that this mail sys-
+# tem receives mail on.
#
-# local_header_rewrite_clients
+# local_header_rewrite_clients (permit_inet_interfaces)
# Rewrite message header addresses in mail from these
-# clients and update incomplete addresses with the
+# clients and update incomplete addresses with the
# domain name in $myorigin or $mydomain; either don't
-# rewrite message headers from other clients at all,
-# or rewrite message headers and update incomplete
-# addresses with the domain specified in the
+# rewrite message headers from other clients at all,
+# or rewrite message headers and update incomplete
+# addresses with the domain specified in the
# remote_header_rewrite_domain parameter.
#
-# proxy_interfaces
-# Other interfaces that this machine receives mail on
-# by way of a proxy agent or network address transla-
-# tor.
-#
-# masquerade_classes
-# List of address classes subject to masquerading:
-# zero or more of envelope_sender, envelope_recipi-
-# ent, header_sender, header_recipient.
-#
-# masquerade_domains
-# List of domains that hide their subdomain struc-
-# ture.
-#
-# masquerade_exceptions
-# List of user names that are not subject to address
-# masquerading.
-#
-# mydestination
-# List of domains that this mail system considers
-# local.
-#
-# myorigin
-# The domain that is appended to locally-posted mail.
-#
-# owner_request_special
-# Give special treatment to owner-xxx and xxx-request
-# addresses.
-#
-# remote_header_rewrite_domain
+# proxy_interfaces (empty)
+# The network interface addresses that this mail sys-
+# tem receives mail on by way of a proxy or network
+# address translation unit.
+#
+# masquerade_classes (envelope_sender, header_sender,
+# header_recipient)
+# What addresses are subject to address masquerading.
+#
+# masquerade_domains (empty)
+# Optional list of domains whose subdomain structure
+# will be stripped off in email addresses.
+#
+# masquerade_exceptions (empty)
+# Optional list of user names that are not subjected
+# to address masquerading, even when their address
+# matches $masquerade_domains.
+#
+# mydestination ($myhostname, localhost.$mydomain, local-
+# host)
+# The list of domains that are delivered via the
+# $local_transport mail delivery transport.
+#
+# myorigin ($myhostname)
+# The domain name that locally-posted mail appears to
+# come from, and that locally posted mail is deliv-
+# ered to.
+#
+# owner_request_special (yes)
+# Enable special treatment for owner-listname entries
+# in the aliases(5) file, and don't split owner-list-
+# name and listname-request address localparts when
+# the recipient_delimiter is set to "-".
+#
+# remote_header_rewrite_domain (empty)
# Don't rewrite message headers from remote clients
# at all when this parameter is empty; otherwise, re-
# write message headers and append the specified
diff --git a/external/ibm-public/postfix/dist/conf/generic b/external/ibm-public/postfix/dist/conf/generic
index 7b8ccde6131..9d293683a64 100644
--- a/external/ibm-public/postfix/dist/conf/generic
+++ b/external/ibm-public/postfix/dist/conf/generic
@@ -72,17 +72,22 @@
#
# TABLE SEARCH ORDER
# With lookups from indexed files such as DB or DBM, or from
-# networked tables such as NIS, LDAP or SQL, patterns are
-# tried in the order as listed below:
+# networked tables such as NIS, LDAP or SQL, each
+# user@domain query produces a sequence of query patterns as
+# described below.
+#
+# Each query pattern is sent to each specified lookup table
+# before trying the next query pattern, until a match is
+# found.
#
# user@domain address
-# Replace user@domain by address. This form has the
+# Replace user@domain by address. This form has the
# highest precedence.
#
# user address
-# Replace user@site by address when site is equal to
-# $myorigin, when site is listed in $mydestination,
-# or when it is listed in $inet_interfaces or
+# Replace user@site by address when site is equal to
+# $myorigin, when site is listed in $mydestination,
+# or when it is listed in $inet_interfaces or
# $proxy_interfaces.
#
# @domain address
@@ -92,10 +97,10 @@
# RESULT ADDRESS REWRITING
# The lookup result is subject to address rewriting:
#
-# o When the result has the form @otherdomain, the
+# o When the result has the form @otherdomain, the
# result becomes the same user in otherdomain.
#
-# o When "append_at_myorigin=yes", append "@$myorigin"
+# o When "append_at_myorigin=yes", append "@$myorigin"
# to addresses without "@domain".
#
# o When "append_dot_mydomain=yes", append ".$mydomain"
@@ -103,55 +108,55 @@
#
# ADDRESS EXTENSION
# When a mail address localpart contains the optional recip-
-# ient delimiter (e.g., user+foo@domain), the lookup order
+# ient delimiter (e.g., user+foo@domain), the lookup order
# becomes: user+foo@domain, user@domain, user+foo, user, and
# @domain.
#
-# The propagate_unmatched_extensions parameter controls
-# whether an unmatched address extension (+foo) is propa-
+# The propagate_unmatched_extensions parameter controls
+# whether an unmatched address extension (+foo) is propa-
# gated to the result of table lookup.
#
# REGULAR EXPRESSION TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# the table is given in the form of regular expressions. For
-# a description of regular expression lookup table syntax,
+# a description of regular expression lookup table syntax,
# see regexp_table(5) or pcre_table(5).
#
-# Each pattern is a regular expression that is applied to
+# Each pattern is a regular expression that is applied to
# the entire address being looked up. Thus, user@domain mail
-# addresses are not broken up into their user and @domain
+# addresses are not broken up into their user and @domain
# constituent parts, nor is user+foo broken up into user and
# foo.
#
-# Patterns are applied in the order as specified in the ta-
-# ble, until a pattern is found that matches the search
+# Patterns are applied in the order as specified in the ta-
+# ble, until a pattern is found that matches the search
# string.
#
-# Results are the same as with indexed file lookups, with
-# the additional feature that parenthesized substrings from
+# Results are the same as with indexed file lookups, with
+# the additional feature that parenthesized substrings from
# the pattern can be interpolated as $1, $2 and so on.
#
# TCP-BASED TABLES
-# This section describes how the table lookups change when
+# This section describes how the table lookups change when
# lookups are directed to a TCP-based server. For a descrip-
# tion of the TCP client/server lookup protocol, see tcp_ta-
# ble(5). This feature is not available up to and including
# Postfix version 2.4.
#
# Each lookup operation uses the entire address once. Thus,
-# user@domain mail addresses are not broken up into their
+# user@domain mail addresses are not broken up into their
# user and @domain constituent parts, nor is user+foo broken
# up into user and foo.
#
# Results are the same as with indexed file lookups.
#
# EXAMPLE
-# The following shows a generic mapping with an indexed
-# file. When mail is sent to a remote host via SMTP, this
-# replaces his@localdomain.local by his ISP mail address,
-# replaces her@localdomain.local by her ISP mail address,
-# and replaces other local addresses by his ISP account,
-# with an address extension of +local (this example assumes
+# The following shows a generic mapping with an indexed
+# file. When mail is sent to a remote host via SMTP, this
+# replaces his@localdomain.local by his ISP mail address,
+# replaces her@localdomain.local by her ISP mail address,
+# and replaces other local addresses by his ISP account,
+# with an address extension of +local (this example assumes
# that the ISP supports "+" style address extensions).
#
# /etc/postfix/main.cf:
@@ -162,35 +167,35 @@
# her@localdomain.local heraccount@herisp.example
# @localdomain.local hisaccount+local@hisisp.example
#
-# Execute the command "postmap /etc/postfix/generic" when-
-# ever the table is changed. Instead of hash, some systems
-# use dbm database files. To find out what tables your sys-
+# Execute the command "postmap /etc/postfix/generic" when-
+# ever the table is changed. Instead of hash, some systems
+# use dbm database files. To find out what tables your sys-
# tem supports use the command "postconf -m".
#
# BUGS
-# The table format does not understand quoting conventions.
+# The table format does not understand quoting conventions.
#
# CONFIGURATION PARAMETERS
-# The following main.cf parameters are especially relevant.
-# The text below provides only a parameter summary. See
+# The following main.cf parameters are especially relevant.
+# The text below provides only a parameter summary. See
# postconf(5) for more details including examples.
#
# smtp_generic_maps
# Address mapping lookup table for envelope and
-# header sender and recipient addresses while deliv-
+# header sender and recipient addresses while deliv-
# ering mail via SMTP.
#
# propagate_unmatched_extensions
-# A list of address rewriting or forwarding mecha-
-# nisms that propagate an address extension from the
-# original address to the result. Specify zero or
-# more of canonical, virtual, alias, forward,
+# A list of address rewriting or forwarding mecha-
+# nisms that propagate an address extension from the
+# original address to the result. Specify zero or
+# more of canonical, virtual, alias, forward,
# include, or generic.
#
# Other parameters of interest:
#
# inet_interfaces
-# The network interface addresses that this system
+# The network interface addresses that this system
# receives mail on. You need to stop and start Post-
# fix when this parameter changes.
#
@@ -200,7 +205,7 @@
# tor.
#
# mydestination
-# List of domains that this mail system considers
+# List of domains that this mail system considers
# local.
#
# myorigin
@@ -216,14 +221,14 @@
# smtp(8), Postfix SMTP client
#
# README FILES
-# Use "postconf readme_directory" or "postconf html_direc-
+# Use "postconf readme_directory" or "postconf html_direc-
# tory" to locate this information.
# ADDRESS_REWRITING_README, address rewriting guide
# DATABASE_README, Postfix lookup table overview
# STANDARD_CONFIGURATION_README, configuration examples
#
# LICENSE
-# The Secure Mailer license must be distributed with this
+# The Secure Mailer license must be distributed with this
# software.
#
# HISTORY
diff --git a/external/ibm-public/postfix/dist/conf/header_checks b/external/ibm-public/postfix/dist/conf/header_checks
index d5984370f4b..bcd96a97a0b 100644
--- a/external/ibm-public/postfix/dist/conf/header_checks
+++ b/external/ibm-public/postfix/dist/conf/header_checks
@@ -287,37 +287,52 @@
# checks.
#
# IGNORE Delete the current line from the input, and inspect
-# the next input line.
+# the next input line. See STRIP for an alternative
+# that logs the action.
#
# INFO optional text...
# Log an "info:" record with the optional text... (or
-# log a generic text), and inspect the next input
-# line. This action is useful for routine logging or
+# log a generic text), and inspect the next input
+# line. This action is useful for routine logging or
# for debugging.
#
# This feature is available in Postfix 2.8 and later.
#
+# PASS optional text...
+# Log a "pass:" record with the optional text... (or
+# log a generic text), and turn off header, body, and
+# Milter inspection for the remainder of this mes-
+# sage.
+#
+# Note: this feature relies on trust in information
+# that is easy to forge.
+#
+# This feature is available in Postfix 3.2 and later.
+#
+# This feature is not supported with smtp header/body
+# checks.
+#
# PREPEND text...
-# Prepend one line with the specified text, and
+# Prepend one line with the specified text, and
# inspect the next input line.
#
# Notes:
#
-# o The prepended text is output on a separate
+# o The prepended text is output on a separate
# line, immediately before the input that
# triggered the PREPEND action.
#
# o The prepended text is not considered part of
-# the input stream: it is not subject to
+# the input stream: it is not subject to
# header/body checks or address rewriting, and
# it does not affect the way that Postfix adds
# missing message headers.
#
# o When prepending text before a message header
-# line, the prepended text must begin with a
+# line, the prepended text must begin with a
# valid message header label.
#
-# o This action cannot be used to prepend
+# o This action cannot be used to prepend
# multi-line text.
#
# This feature is available in Postfix 2.1 and later.
@@ -326,14 +341,14 @@
# ter_header_checks.
#
# REDIRECT user@domain
-# Write a message redirection request to the queue
-# file, and inspect the next input line. After the
+# Write a message redirection request to the queue
+# file, and inspect the next input line. After the
# message is queued, it will be sent to the specified
# address instead of the intended recipient(s).
#
-# Note: this action overrides the FILTER action, and
-# affects all recipients of the message. If multiple
-# REDIRECT actions fire, only the last one is exe-
+# Note: this action overrides the FILTER action, and
+# affects all recipients of the message. If multiple
+# REDIRECT actions fire, only the last one is exe-
# cuted.
#
# This feature is available in Postfix 2.1 and later.
@@ -342,34 +357,34 @@
# checks.
#
# REPLACE text...
-# Replace the current line with the specified text,
+# Replace the current line with the specified text,
# and inspect the next input line.
#
# This feature is available in Postfix 2.2 and later.
-# The description below applies to Postfix 2.2.2 and
+# The description below applies to Postfix 2.2.2 and
# later.
#
# Notes:
#
-# o When replacing a message header line, the
-# replacement text must begin with a valid
+# o When replacing a message header line, the
+# replacement text must begin with a valid
# header label.
#
-# o The replaced text remains part of the input
-# stream. Unlike the result from the PREPEND
-# action, a replaced message header may be
-# subject to address rewriting and may affect
-# the way that Postfix adds missing message
+# o The replaced text remains part of the input
+# stream. Unlike the result from the PREPEND
+# action, a replaced message header may be
+# subject to address rewriting and may affect
+# the way that Postfix adds missing message
# headers.
#
# REJECT optional text...
-# Reject the entire message. Do not inspect the
-# remainder of the input message. Reply with
-# optional text... when the optional text is speci-
+# Reject the entire message. Do not inspect the
+# remainder of the input message. Reply with
+# optional text... when the optional text is speci-
# fied, otherwise reply with a generic error message.
#
-# Note: this action disables further header or
-# body_checks inspection of the current message and
+# Note: this action disables further header or
+# body_checks inspection of the current message and
# affects all recipients.
#
# Postfix version 2.3 and later support enhanced sta-
@@ -380,39 +395,47 @@
# This feature is not supported with smtp header/body
# checks.
#
+# STRIP optional text...
+# Log a "strip:" record with the optional text... (or
+# log a generic text), delete the input line from the
+# input, and inspect the next input line. See IGNORE
+# for a silent alternative.
+#
+# This feature is available in Postfix 3.2 and later.
+#
# WARN optional text...
-# Log a "warning:" record with the optional text...
+# Log a "warning:" record with the optional text...
# (or log a generic text), and inspect the next input
-# line. This action is useful for debugging and for
-# testing a pattern before applying more drastic
+# line. This action is useful for debugging and for
+# testing a pattern before applying more drastic
# actions.
#
# BUGS
# Empty lines never match, because some map types mis-behave
-# when given a zero-length search string. This limitation
-# may be removed for regular expression tables in a future
+# when given a zero-length search string. This limitation
+# may be removed for regular expression tables in a future
# release.
#
-# Many people overlook the main limitations of header and
+# Many people overlook the main limitations of header and
# body_checks rules.
#
-# o These rules operate on one logical message header
+# o These rules operate on one logical message header
# or one body line at a time. A decision made for one
# line is not carried over to the next line.
#
-# o If text in the message body is encoded (RFC 2045)
+# o If text in the message body is encoded (RFC 2045)
# then the rules need to be specified for the encoded
# form.
#
-# o Likewise, when message headers are encoded (RFC
-# 2047) then the rules need to be specified for the
+# o Likewise, when message headers are encoded (RFC
+# 2047) then the rules need to be specified for the
# encoded form.
#
-# Message headers added by the cleanup(8) daemon itself are
+# Message headers added by the cleanup(8) daemon itself are
# excluded from inspection. Examples of such message headers
# are From:, To:, Message-ID:, Date:.
#
-# Message headers deleted by the cleanup(8) daemon will be
+# Message headers deleted by the cleanup(8) daemon will be
# examined before they are deleted. Examples are: Bcc:, Con-
# tent-Length:, Return-Path:.
#
@@ -420,11 +443,11 @@
# body_checks
# Lookup tables with content filter rules for message
# body lines. These filters see one physical line at
-# a time, in chunks of at most $line_length_limit
+# a time, in chunks of at most $line_length_limit
# bytes.
#
# body_checks_size_limit
-# The amount of content per message body segment
+# The amount of content per message body segment
# (attachment) that is subjected to $body_checks fil-
# tering.
#
@@ -434,35 +457,35 @@
#
# nested_header_checks (default: $header_checks)
# Lookup tables with content filter rules for message
-# header lines: respectively, these are applied to
-# the initial message headers (not including MIME
-# headers), to the MIME headers anywhere in the mes-
-# sage, and to the initial headers of attached mes-
+# header lines: respectively, these are applied to
+# the initial message headers (not including MIME
+# headers), to the MIME headers anywhere in the mes-
+# sage, and to the initial headers of attached mes-
# sages.
#
-# Note: these filters see one logical message header
-# at a time, even when a message header spans multi-
-# ple lines. Message headers that are longer than
+# Note: these filters see one logical message header
+# at a time, even when a message header spans multi-
+# ple lines. Message headers that are longer than
# $header_size_limit characters are truncated.
#
# disable_mime_input_processing
-# While receiving mail, give no special treatment to
-# MIME related message headers; all text after the
+# While receiving mail, give no special treatment to
+# MIME related message headers; all text after the
# initial message headers is considered to be part of
-# the message body. This means that header_checks is
-# applied to all the initial message headers, and
+# the message body. This means that header_checks is
+# applied to all the initial message headers, and
# that body_checks is applied to the remainder of the
# message.
#
-# Note: when used in this manner, body_checks will
-# process a multi-line message header one line at a
+# Note: when used in this manner, body_checks will
+# process a multi-line message header one line at a
# time.
#
# EXAMPLES
-# Header pattern to block attachments with bad file name
-# extensions. For convenience, the PCRE /x flag is speci-
-# fied, so that there is no need to collapse the pattern
-# into a single line of text. The purpose of the
+# Header pattern to block attachments with bad file name
+# extensions. For convenience, the PCRE /x flag is speci-
+# fied, so that there is no need to collapse the pattern
+# into a single line of text. The purpose of the
# [[:xdigit:]] sub-expressions is to recognize Windows CLSID
# strings.
#
@@ -501,7 +524,7 @@
# RFC 2047, message header encoding for non-ASCII text
#
# README FILES
-# Use "postconf readme_directory" or "postconf html_direc-
+# Use "postconf readme_directory" or "postconf html_direc-
# tory" to locate this information.
# DATABASE_README, Postfix lookup table overview
# CONTENT_INSPECTION_README, Postfix content inspection overview
@@ -509,7 +532,7 @@
# BACKSCATTER_README, blocking returned forged mail
#
# LICENSE
-# The Secure Mailer license must be distributed with this
+# The Secure Mailer license must be distributed with this
# software.
#
# AUTHOR(S)
diff --git a/external/ibm-public/postfix/dist/conf/transport b/external/ibm-public/postfix/dist/conf/transport
index 0213a6e66e1..d1b32686b39 100644
--- a/external/ibm-public/postfix/dist/conf/transport
+++ b/external/ibm-public/postfix/dist/conf/transport
@@ -144,14 +144,20 @@
# transport (the first name of a mail delivery service entry
# in the Postfix master.cf file).
#
-# The interpretation of the nexthop field is transport
-# dependent. In the case of SMTP, specify a service on a
-# non-default port as host:service, and disable MX (mail
-# exchanger) DNS lookups with [host] or [host]:port. The []
-# form is required when you specify an IP address instead of
-# a hostname.
-#
-# A null transport and null nexthop result means "do not
+# The nexthop field usually specifies one recipient domain
+# or hostname. In the case of the Postfix SMTP/LMTP client,
+# the nexthop field may contain a list of nexthop destina-
+# tions separated by comma or whitespace (Postfix 3.5 and
+# later).
+#
+# The syntax of a nexthop destination is transport depen-
+# dent. With SMTP, specify a service on a non-default port
+# as host:service, and disable MX (mail exchanger) DNS
+# lookups with [host] or [host]:port. The [] form is
+# required when you specify an IP address instead of a host-
+# name.
+#
+# A null transport and null nexthop field means "do not
# change": use the delivery transport and nexthop informa-
# tion that would be used when the entire transport table
# did not exist.
@@ -200,8 +206,8 @@
# prevents mail routing loops when your machine is primary
# MX host for example.com.
#
-# In the case of delivery via SMTP, one may specify host-
-# name:service instead of just a host:
+# In the case of delivery via SMTP or LMTP, one may specify
+# host:service instead of just a host:
#
# example.com smtp:bar.example:2025
#
@@ -210,6 +216,14 @@
# be used. Specify [] around the hostname if MX lookups must
# be disabled.
#
+# Deliveries via SMTP or LMTP support multiple destinations
+# (Postfix >= 3.5):
+#
+# example.com smtp:bar.example, foo.example
+#
+# This tries to deliver to bar.example before trying to
+# deliver to foo.example.
+#
# The error mailer can be used to bounce mail:
#
# .example.com error:mail for *.example.com is not deliverable
@@ -256,17 +270,21 @@
# The text below provides only a parameter summary. See
# postconf(5) for more details including examples.
#
-# empty_address_recipient
-# The address that is looked up instead of the null
-# sender address.
+# empty_address_recipient (MAILER-DAEMON)
+# The recipient of mail addressed to the null
+# address.
#
-# parent_domain_matches_subdomains
-# List of Postfix features that use domain.tld pat-
-# terns to match sub.domain.tld (as opposed to
-# requiring .domain.tld patterns).
+# parent_domain_matches_subdomains (see 'postconf -d' out-
+# put)
+# A list of Postfix features where the pattern "exam-
+# ple.com" also matches subdomains of example.com,
+# instead of requiring an explicit ".example.com"
+# pattern.
#
-# transport_maps
-# List of transport lookup tables.
+# transport_maps (empty)
+# Optional lookup tables with mappings from recipient
+# address to (message delivery transport, next-hop
+# destination).
#
# SEE ALSO
# trivial-rewrite(8), rewrite and resolve addresses
@@ -275,14 +293,14 @@
# postmap(1), Postfix lookup table manager
#
# README FILES
-# Use "postconf readme_directory" or "postconf html_direc-
+# Use "postconf readme_directory" or "postconf html_direc-
# tory" to locate this information.
# ADDRESS_REWRITING_README, address rewriting guide
# DATABASE_README, Postfix lookup table overview
# FILTER_README, external content filter
#
# LICENSE
-# The Secure Mailer license must be distributed with this
+# The Secure Mailer license must be distributed with this
# software.
#
# AUTHOR(S)
diff --git a/external/ibm-public/postfix/dist/conf/virtual b/external/ibm-public/postfix/dist/conf/virtual
index a2d3c774cd2..da9cd655cf5 100644
--- a/external/ibm-public/postfix/dist/conf/virtual
+++ b/external/ibm-public/postfix/dist/conf/virtual
@@ -81,21 +81,26 @@
#
# TABLE SEARCH ORDER
# With lookups from indexed files such as DB or DBM, or from
-# networked tables such as NIS, LDAP or SQL, patterns are
-# tried in the order as listed below:
+# networked tables such as NIS, LDAP or SQL, each
+# user@domain query produces a sequence of query patterns as
+# described below.
+#
+# Each query pattern is sent to each specified lookup table
+# before trying the next query pattern, until a match is
+# found.
#
# user@domain address, address, ...
-# Redirect mail for user@domain to address. This
+# Redirect mail for user@domain to address. This
# form has the highest precedence.
#
# user address, address, ...
# Redirect mail for user@site to address when site is
-# equal to $myorigin, when site is listed in $mydes-
-# tination, or when it is listed in $inet_interfaces
+# equal to $myorigin, when site is listed in $mydes-
+# tination, or when it is listed in $inet_interfaces
# or $proxy_interfaces.
#
-# This functionality overlaps with functionality of
-# the local aliases(5) database. The difference is
+# This functionality overlaps with functionality of
+# the local aliases(5) database. The difference is
# that virtual(5) mapping can be applied to non-local
# addresses.
#
@@ -103,15 +108,31 @@
# Redirect mail for other users in domain to address.
# This form has the lowest precedence.
#
-# Note: @domain is a wild-card. With this form, the
-# Postfix SMTP server accepts mail for any recipient
-# in domain, regardless of whether that recipient
-# exists. This may turn your mail system into a
-# backscatter source: Postfix first accepts mail for
-# non-existent recipients and then tries to return
-# that mail as "undeliverable" to the often forged
+# Note: @domain is a wild-card. With this form, the
+# Postfix SMTP server accepts mail for any recipient
+# in domain, regardless of whether that recipient
+# exists. This may turn your mail system into a
+# backscatter source: Postfix first accepts mail for
+# non-existent recipients and then tries to return
+# that mail as "undeliverable" to the often forged
# sender address.
#
+# To avoid backscatter with mail for a wild-card
+# domain, replace the wild-card mapping with explicit
+# 1:1 mappings, or add a reject_unverified_recipient
+# restriction for that domain:
+#
+# smtpd_recipient_restrictions =
+# ...
+# reject_unauth_destination
+# check_recipient_access
+# inline:{example.com=reject_unverified_recipient}
+# unverified_recipient_reject_code = 550
+#
+# In the above example, Postfix may contact a remote
+# server if the recipient is aliased to a remote
+# address.
+#
# RESULT ADDRESS REWRITING
# The lookup result is subject to address rewriting:
#
@@ -230,43 +251,47 @@
# details and for default values. Use the "postfix reload"
# command after a configuration change.
#
-# virtual_alias_maps
-# List of virtual aliasing tables.
+# virtual_alias_maps ($virtual_maps)
+# Optional lookup tables that alias specific mail
+# addresses or domains to other local or remote
+# address.
#
-# virtual_alias_domains
-# List of virtual alias domains. This uses the same
-# syntax as the mydestination parameter.
+# virtual_alias_domains ($virtual_alias_maps)
+# Postfix is final destination for the specified list
+# of virtual alias domains, that is, domains for
+# which all addresses are aliased to addresses in
+# other local or remote domains.
#
-# propagate_unmatched_extensions
-# A list of address rewriting or forwarding mecha-
-# nisms that propagate an address extension from the
-# original address to the result. Specify zero or
-# more of canonical, virtual, alias, forward,
-# include, or generic.
+# propagate_unmatched_extensions (canonical, virtual)
+# What address lookup tables copy an address exten-
+# sion from the lookup key to the lookup result.
#
# Other parameters of interest:
#
-# inet_interfaces
-# The network interface addresses that this system
-# receives mail on. You need to stop and start Post-
-# fix when this parameter changes.
+# inet_interfaces (all)
+# The network interface addresses that this mail sys-
+# tem receives mail on.
#
-# mydestination
-# List of domains that this mail system considers
-# local.
+# mydestination ($myhostname, localhost.$mydomain, local-
+# host)
+# The list of domains that are delivered via the
+# $local_transport mail delivery transport.
#
-# myorigin
-# The domain that is appended to any address that
-# does not have a domain.
+# myorigin ($myhostname)
+# The domain name that locally-posted mail appears to
+# come from, and that locally posted mail is deliv-
+# ered to.
#
-# owner_request_special
-# Give special treatment to owner-xxx and xxx-request
-# addresses.
+# owner_request_special (yes)
+# Enable special treatment for owner-listname entries
+# in the aliases(5) file, and don't split owner-list-
+# name and listname-request address localparts when
+# the recipient_delimiter is set to "-".
#
-# proxy_interfaces
-# Other interfaces that this machine receives mail on
-# by way of a proxy agent or network address transla-
-# tor.
+# proxy_interfaces (empty)
+# The network interface addresses that this mail sys-
+# tem receives mail on by way of a proxy or network
+# address translation unit.
#
# SEE ALSO
# cleanup(8), canonicalize and enqueue mail
@@ -275,14 +300,14 @@
# canonical(5), canonical address mapping
#
# README FILES
-# Use "postconf readme_directory" or "postconf html_direc-
+# Use "postconf readme_directory" or "postconf html_direc-
# tory" to locate this information.
# ADDRESS_REWRITING_README, address rewriting guide
# DATABASE_README, Postfix lookup table overview
# VIRTUAL_README, domain hosting guide
#
# LICENSE
-# The Secure Mailer license must be distributed with this
+# The Secure Mailer license must be distributed with this
# software.
#
# AUTHOR(S)
diff --git a/external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html b/external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html
index 158b38d887f..3c76edbe226 100644
--- a/external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html
+++ b/external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html
@@ -1052,7 +1052,7 @@ deliveries to commands or files in "root"-owned aliases. </p>
<h3> <a name="forward"> Local per-user .forward files </a> </h3>
-<p> With delivery via the <a href="local.8.html">local(8)</a> deliver agent, users can control
+<p> With delivery via the <a href="local.8.html">local(8)</a> delivery agent, users can control
their own mail delivery by specifying destinations in a file called
.forward in their home directories. The syntax of these files is
the same as with the local <a href="aliases.5.html">aliases(5)</a> file, except that the left-hand
diff --git a/external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html b/external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html
index 79525d1bb49..8d760c0975b 100644
--- a/external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html
+++ b/external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html
@@ -264,17 +264,18 @@ clients that send mail from outside an authorized network block.
This is explained in the <a href="SASL_README.html">SASL_README</a> and <a href="TLS_README.html">TLS_README</a> documents. </p>
<p> IMPORTANT: If your machine is connected to a wide area network
-then your default <a href="postconf.5.html#mynetworks">mynetworks</a> setting may be too friendly. </p>
+then the "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host" setting may be too friendly. </p>
<p> Examples (specify only one of the following): </p>
<blockquote>
<pre>
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
- <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet (default: authorize subnetworks)
- <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host (safe: authorize local machine only)
- <a href="postconf.5.html#mynetworks">mynetworks</a> = 127.0.0.0/8 (safe: authorize local machine only)
+ <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet (not safe on a wide area network)
+ <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host (authorize local machine only)
+ <a href="postconf.5.html#mynetworks">mynetworks</a> = 127.0.0.0/8 (authorize local machine only)
<a href="postconf.5.html#mynetworks">mynetworks</a> = 127.0.0.0/8 168.100.189.2/32 (authorize local machine)
+ <a href="postconf.5.html#mynetworks">mynetworks</a> = 127.0.0.0/8 168.100.189.2/28 (authorize local networks)
</pre>
</blockquote>
diff --git a/external/ibm-public/postfix/dist/html/BDAT_README.html b/external/ibm-public/postfix/dist/html/BDAT_README.html
new file mode 100644
index 00000000000..b8feeeb144e
--- /dev/null
+++ b/external/ibm-public/postfix/dist/html/BDAT_README.html
@@ -0,0 +1,178 @@
+<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
+ "http://www.w3.org/TR/html4/loose.dtd">
+
+<html>
+
+<head>
+
+<title>Postfix BDAT (CHUNKING) support</title>
+
+<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
+
+</head>
+
+<body>
+
+<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix
+BDAT (CHUNKING) support</h1>
+
+<hr>
+
+<h2>Overview </h2>
+
+<p> Postfix SMTP server supports <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> CHUNKING (the BDAT command)
+without BINARYMIME, in both <a href="smtpd.8.html">smtpd(8)</a> and <a href="postscreen.8.html">postscreen(8)</a>. It is enabled
+by default. </p>
+
+<p> Topics covered in this document: </p>
+
+<ul>
+
+<li><a href="#disable"> Disabling BDAT support</a>
+
+<li><a href="#impact"> Impact on existing configurations</a>
+
+<li><a href="#example"> Example SMTP session</a>
+
+<li> <a href="#benefits">Benefits of CHUNKING (BDAT) support without BINARYMIME</a>
+
+<li> <a href="#downsides">Downsides of CHUNKING (BDAT) support</a>
+
+</ul>
+
+<h2> <a name="disable"> Disabling BDAT support </a> </h2>
+
+<p> BDAT support is enabled by default. To disable BDAT support
+globally: </p>
+
+<blockquote>
+<pre>
+/etc/postfix/<a href="postconf.5.html">main.cf</a>:
+ # The logging alternative:
+ <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> = chunking
+ # The non-logging alternative:
+ <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> = chunking, silent_discard
+</pre>
+</blockquote>
+
+<p> Specify '-o <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>=' in <a href="master.5.html">master.cf</a>
+for the submission and smtps services, if you have clients
+that benefit from CHUNKING support. </p>
+
+<h2> <a name="impact"> Impact on existing configurations </a> </h2>
+
+<ul>
+
+<li> <p> There are no changes for smtpd_mumble_restrictions,
+<a href="postconf.5.html#smtpd_proxy_filter">smtpd_proxy_filter</a>, <a href="postconf.5.html#smtpd_milters">smtpd_milters</a>, or for postscreen settings,
+except for the above mentioned option to suppress the SMTP server's
+CHUNKING service announcement. </p>
+
+<li> <p> There are no changes in the Postfix queue file content,
+no changes for down-stream SMTP servers or after-queue content
+filters, and no changes in the envelope or message content that
+Milters will receive. </p>
+
+</ul>
+
+<h2> <a name="example"> Example SMTP session</a> </h2>
+
+<p> The main differences are that the Postfix SMTP server announces
+"CHUNKING" support in the EHLO response, and that instead of sending
+one DATA request, the remote SMTP client may send one or more BDAT
+requests. In the example below, "S:" indicates server responses,
+and "C:" indicates client requests (bold font). </p>
+
+<blockquote>
+<pre>
+ S: 220 server.example.com
+ C: <b>EHLO client.example.com</b>
+ S: 250-server.example.com
+ S: 250-PIPELINING
+ S: 250-SIZE 153600000
+ S: 250-VRFY
+ S: 250-ETRN
+ S: 250-STARTTLS
+ S: 250-AUTH PLAIN LOGIN
+ S: 250-ENHANCEDSTATUSCODES
+ S: 250-8BITMIME
+ S: 250-DSN
+ S: 250-SMTPUTF8
+ S: 250 CHUNKING
+ C: <b>MAIL FROM:&lt;sender@example.com&gt;</b>
+ S: 250 2.1.0 Ok
+ C: <b>RCPT TO:&lt;recipient@example.com&gt;</b>
+ S: 250 2.1.5 Ok
+ C: <b>BDAT 10000</b>
+ C: <b>..followed by 10000 bytes...</b>
+ S: 250 2.0.0 Ok: 10000 bytes
+ C: <b>BDAT 123</b>
+ C: <b>..followed by 123 bytes...</b>
+ S: 250 2.0.0 Ok: 123 bytes
+ C: <b>BDAT 0 LAST</b>
+ S: 250 2.0.0 Ok: 10123 bytes queued as 41yYhh41qmznjbD
+ C: <b>QUIT</b>
+ S: 221 2.0.0 Bye
+</pre>
+</blockquote>
+
+<p> Internally in Postfix, there is no difference between mail that
+was received with BDAT or with DATA. Postfix smtpd_mumble_restrictions,
+policy delegation queries, <a href="postconf.5.html#smtpd_proxy_filter">smtpd_proxy_filter</a> and Milters all behave
+as if Postfix received (MAIL + RCPT + DATA + end-of-data). However,
+Postfix will log BDAT-related failures as "xxx after BDAT" to avoid
+complicating troubleshooting (xxx = 'lost connection' or 'timeout'),
+and will log a warning when a client sends a malformed BDAT command.
+</p>
+
+<h2> <a name="benefits">Benefits of CHUNKING (BDAT) support without
+BINARYMIME</a> </h2>
+
+<p> Support for CHUNKING (BDAT) was added to improve interoperability
+with some clients, a benefit that would reportedly exist even without
+Postfix support for BINARYMIME. Since June 2018, Wietse's mail
+server has received BDAT commands from a variety of systems. </p>
+
+<p> Postfix does not support BINARYMIME at this time because: </p>
+
+<ul>
+
+<li> <p> BINARYMIME support would require moderately invasive
+changes to Postfix, to support email content that is not line-oriented.
+With BINARYMIME, the Content-Length: message header specifies the
+length of content that may or may not have line boundaries. Without
+BINARYMIME support, email RFCs require that binary content is
+base64-encoded, and formatted as lines of text. </p>
+
+<li> <p> For delivery to non-BINARYMIME systems including UNIX mbox,
+the available options are to convert binary content into 8bit text,
+one of the 7bit forms (base64 or quoted-printable), or to return
+email as undeliverable. Any conversion would obviously break digital
+signatures, so conversion would have to happen before signing. </p>
+
+</ul>
+
+<h2> <a name="downsides">Downsides of CHUNKING (BDAT) support</a>
+</h2>
+
+<p> The <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> authors did not specify any limitations on how
+clients may pipeline commands (i.e. send commands without waiting
+for a server response). If a server announces PIPELINING support,
+like Postfix does, then a remote SMTP client can pipeline all
+commands following EHLO, for example, MAIL/RCPT/BDAT/BDAT/MAIL/RCPT/BDAT,
+without ever having to wait for a server response. This means that
+with BDAT, the Postfix SMTP server cannot distinguish between a
+well-behaved client and a spambot, based on their command pipelining
+behavior. If you require "<a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>" to block spambots,
+then turn off Postfix's CHUNKING announcement as described above.
+</p>
+
+<p> In <a href="http://tools.ietf.org/html/rfc4468">RFC 4468</a>, the authors write that a client may pipeline
+commands, and that after sending BURL LAST or BDAT LAST, a client
+must wait for the server's response. But as this text does not
+appear in <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> which defines BDAT, is it a useless restriction
+that Postfix will not enforce. </p>
+
+</body>
+
+</html>
diff --git a/external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html b/external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html
index 5772eb9a88a..d527e1981a3 100644
--- a/external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html
+++ b/external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html
@@ -48,7 +48,7 @@ continuity of service. Based on this logging the system administrator
can decide if any backwards-compatible settings need to be made
permanent in main.cf or master.cf, before <a href="#turnoff">turning
off the backwards-compatibility safety net</a> as described at the
-end of this document. </p>
+end of this document. </p>
<p> The following messages may be logged: </p>
@@ -60,6 +60,9 @@ default setting append_dot_mydomain=yes </a> </p>
<li> <p> <a href="#chroot"> Using backwards-compatible default setting
chroot=y</a> </p>
+<li><p> <a href="#relay_restrictions"> Using backwards-compatible
+default setting smtpd_relay_restrictions = (empty)</a> </p>
+
<li> <p> <a href="#mynetworks_style"> Using backwards-compatible
default setting mynetworks_style=subnet </a> </p>
@@ -79,15 +82,19 @@ sections that follow. </p>
<p> When no more backwards-compatible settings need to be made
permanent, the system administrator should <a href="#turnoff">turn
off the backwards-compatibility safety net</a> as described at the
-end of this document. </p>
+end of this document. </p>
<h2> <a name="append_dot_mydomain"> Using backwards-compatible default
setting append_dot_mydomain=yes</a> </h2>
<p> The <a href="postconf.5.html#append_dot_mydomain">append_dot_mydomain</a> default value has changed from "yes"
-to "no". As long as the <a href="postconf.5.html#append_dot_mydomain">append_dot_mydomain</a> parameter is left at
-its implicit default value, and the backwards-compatible default
-setting is turned on, Postfix may log one of the following messages:</p>
+to "no". This could result in unexpected non-delivery of email after
+Postfix is updated from an older version. The backwards-compatibility
+safety net is designed to prevent such surprises. </p>
+
+<p> As long as the <a href="postconf.5.html#append_dot_mydomain">append_dot_mydomain</a> parameter is left at
+its implicit default value, and the <a href="postconf.5.html#compatibility_level">compatibility_level</a> setting is
+less than 1, Postfix may log one of the following messages:</p>
<ul>
@@ -136,9 +143,16 @@ in <a href="postconf.5.html">main.cf</a>: </p>
setting chroot=y</a> </h2>
<p> The <a href="master.5.html">master.cf</a> chroot default value has changed from "y" (yes)
-to "n" (no). As long as a <a href="master.5.html">master.cf</a> chroot field is left at its
-implicit default value, and the backwards-compatible default setting
-is turned on, Postfix may log the following message while it
+to "n" (no). The new default avoids the need for copies of system
+files under the Postfix queue directory. However, sites with strict
+security requirements may want to keep the chroot feature enabled
+after updating Postfix from an older version. The backwards-compatibility
+safety net is designed allow the administrator to choose if they
+want to keep the old behavior. </p>
+
+<p> As long as a <a href="master.5.html">master.cf</a> chroot field is left at its
+implicit default value, and the <a href="postconf.5.html#compatibility_level">compatibility_level</a> setting
+is less than 1, Postfix may log the following message while it
reads the <a href="master.5.html">master.cf</a> file: </p>
<blockquote>
@@ -160,15 +174,58 @@ setting for the "smtp inet" service: </p>
</pre>
</blockquote>
+<h2> <a name="relay_restrictions"> Using backwards-compatible default
+setting smtpd_relay_restrictions = (empty)</a> </h2>
+
+<p> The <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> feature was introduced with Postfix
+version 2.10, as a safety mechanism for configuration errors in
+<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> that could make Postfix an open relay.
+</p>
+
+<p> The <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> implicit default setting forbids
+mail to remote destinations from clients that don't match
+<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a> or <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>. This could result
+in unexpected 'Relay access denied' errors after Postfix is updated
+from an older Postfix version. The backwards-compatibility safety
+net is designed to prevent such surprises. </p>
+
+<p> When the <a href="postconf.5.html#compatibility_level">compatibility_level</a> less than 1, and the
+<a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> parameter is left at its implicit default
+setting, Postfix may log the following message: </p>
+
+<blockquote>
+<pre>
+postfix/smtpd[38463]: using backwards-compatible default setting
+ "<a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> = (empty)" to avoid "Relay access
+ denied" error for recipient "user@example.com" from client
+ "host.example.net[10.0.0.2]"
+</pre>
+</blockquote>
+
+<p> If this request should not be blocked, then the system
+administrator should make the backwards-compatible setting
+"<a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>=" (i.e. empty) permanent in <a href="postconf.5.html">main.cf</a>:
+
+<blockquote>
+<pre>
+# <b>postconf <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>=</b>
+# <b>postfix reload</b>
+</pre>
+</blockquote>
+
<h2> <a name="mynetworks_style"> Using backwards-compatible default
setting mynetworks_style=subnet</a> </h2>
<p> The <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> default value has changed from "subnet"
to "host". This parameter is used to implement the "<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>"
-feature. As long as the <a href="postconf.5.html#mynetworks">mynetworks</a> and <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> parameters
-are left at their implicit default values, and the backwards-compatible
-default setting is turned on, the Postfix SMTP server may log one
-of the following messages: </p>
+feature. The change could in unexpected 'access denied' errors after
+Postfix is updated from an older version. The backwards-compatibility
+safety net is designed to prevent such surprises. </p>
+
+<p> As long as the <a href="postconf.5.html#mynetworks">mynetworks</a> and <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> parameters are
+left at their implicit default values, and the <a href="postconf.5.html#compatibility_level">compatibility_level</a>
+setting is less than 2, the Postfix SMTP server may log one of the
+following messages: </p>
<blockquote>
<pre>
@@ -201,10 +258,14 @@ administrator should make the backwards-compatible setting
setting relay_domains=$mydestination </a> </h2>
<p> The <a href="postconf.5.html#relay_domains">relay_domains</a> default value has changed from "$<a href="postconf.5.html#mydestination">mydestination</a>"
-to the empty value. As long as the <a href="postconf.5.html#relay_domains">relay_domains</a> parameter is left
-at its implicit default value, and the backwards-compatible default
-setting is turned on, Postfix may log one of the following messages.
-</p>
+to the empty value. This could result in unexpected 'Relay access
+denied' errors or ETRN errors after Postfix is updated from an older
+version. The backwards-compatibility safety net is designed to
+prevent such surprises. </p>
+
+<p> As long as the <a href="postconf.5.html#relay_domains">relay_domains</a> parameter is left at its implicit
+default value, and the <a href="postconf.5.html#compatibility_level">compatibility_level</a> setting is less than 2,
+Postfix may log one of the following messages. </p>
<ul>
@@ -268,13 +329,13 @@ setting smtputf8_enable=no</a> </h2>
<p> The <a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> default value has changed from "no" to "yes.
With the new "yes" setting, the Postfix SMTP server rejects non-ASCII
-addresses from clients that don't request SMTPUTF8 support. With
-the old "no" setting, Postfix will accept such addresses, even if
-such addresses are not permitted by traditional SMTP standards. </p>
+addresses from clients that don't request SMTPUTF8 support, after
+Postfix is updated from an older version. The backwards-compatibility
+safety net is designed to prevent such surprises. </p>
<p> As long as the <a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> parameter is left at its implicit
-default value, and the backwards-compatible default setting is
-turned on, Postfix logs a warning each time an SMTP command uses a
+default value, and the <a href="postconf.5.html#compatibility_level">compatibility_level</a> setting is
+less than 1, Postfix logs a warning each time an SMTP command uses a
non-ASCII address localpart without requesting SMTPUTF8 support: </p>
<blockquote>
diff --git a/external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html b/external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html
index b0201dc93ab..c2bf8b6faad 100644
--- a/external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html
+++ b/external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html
@@ -22,6 +22,10 @@
<p> This document describes the Postfix connection cache implementation,
which is available with Postfix version 2.2 and later. </p>
+<p> See <a href="TLS_README.html#client_tls_reuse">Client-side TLS
+connection reuse</a> for how this connection cache is used to
+implement multiple deliveries per TLS-encrypted connection. </p>
+
<p> Topics covered in this document: </p>
<ul>
@@ -232,7 +236,7 @@ the <a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_r
times a connection may be reused, but this feature is unsafe as it
introduces a "fatal attractor" failure mode (when a destination has
multiple inbound MTAs, the slowest inbound MTA will attract most
-connections from Postfix to that destination). </p>.
+connections from Postfix to that destination). </p>
<p> Postfix 2.3 logs the use count of multiply-used connections,
as shown in the following example: </p>
@@ -260,13 +264,11 @@ This prevents mis-delivery of mail. </p>
<ul>
-<li> <p> The Postfix shared connection cache cannot be used with
-TLS, because saved TLS session information can be used only when a
-new connection is created (this limitation does not exist in
-connection caching implementations that reuse a connection only in
-the process that creates it). For this reason, the Postfix <a href="smtp.8.html">smtp(8)</a>
-client always closes the connection after completing an attempt to
-deliver mail over TLS. </p>
+<li> <p> With Postfix versions &lt; 3.4, the Postfix shared connection
+cache cannot be used with TLS, because an open TLS connection can
+be reused only in the process that creates it. For this reason,
+the Postfix <a href="smtp.8.html">smtp(8)</a> client historically always closed the connection
+after completing an attempt to deliver mail over TLS.</p>
<li> <p> Postfix connection caching currently does not support
multiple SASL accounts per mail server. Specifically, Postfix
diff --git a/external/ibm-public/postfix/dist/html/DATABASE_README.html b/external/ibm-public/postfix/dist/html/DATABASE_README.html
index 2d134cd44d5..fedb86230da 100644
--- a/external/ibm-public/postfix/dist/html/DATABASE_README.html
+++ b/external/ibm-public/postfix/dist/html/DATABASE_README.html
@@ -317,8 +317,10 @@ name as used in "<a href="DATABASE_README.html#types">hash</a>:table" is the dat
<dd> A non-shared, in-memory lookup table. Example: "<a href="DATABASE_README.html#types">inline</a>:{
<i>key=value</i>, { <i>key = text with whitespace or comma</i> }}".
-Key-value pairs are separated by whitespace or comma; whitespace
-after "{" and before "}" is ignored. Inline tables eliminate the
+Key-value pairs are separated by whitespace or comma; with a key-value
+pair inside "{}", whitespace is ignored after the opening "{",
+around the "=" between key and value, and before the closing "}".
+Inline tables eliminate the
need to create a database file for just a few fixed elements. See
also the <a href="DATABASE_README.html#types">static</a>: map type. </dd>
@@ -401,7 +403,8 @@ databases. The lookup table name syntax is "<a href="proxymap.8.html">proxy</a>:
Each table query returns a random choice from the specified results.
The first and last characters of the "<a href="DATABASE_README.html#types">randmap</a>:" table name must be
"{" and "}". Within these, individual maps are separated with comma
-or whitespace. </dd>
+or whitespace. To give a specific result more weight, specify it
+multiple times. </dd>
<dt> <b>regexp</b> (read-only) </dt>
@@ -436,7 +439,8 @@ server. See <a href="socketmap_table.5.html">socketmap_table(5)</a> for details.
For example, "<a href="DATABASE_README.html#types">static</a>:foobar" always returns the string "foobar" as
lookup result. Specify "<a href="DATABASE_README.html#types">static</a>:{ <i>text with whitespace</i> }"
when the result contains whitespace; this form ignores whitespace
-after "{" and before "}". See also the <a href="DATABASE_README.html#types">inline</a>: map type. </dd>
+after the opening "{" and before the closing "}". See also the
+<a href="DATABASE_README.html#types">inline</a>: map type. </dd>
<dt> <b>tcp</b> </dt>
diff --git a/external/ibm-public/postfix/dist/html/DEBUG_README.html b/external/ibm-public/postfix/dist/html/DEBUG_README.html
index 30a06285a98..f0dea38d0a0 100644
--- a/external/ibm-public/postfix/dist/html/DEBUG_README.html
+++ b/external/ibm-public/postfix/dist/html/DEBUG_README.html
@@ -71,9 +71,20 @@ debugger</a>
<h2><a name="logging">Look for obvious signs of trouble</a></h2>
-<p> Postfix logs all failed and successful deliveries to a logfile.
-The file is usually called /var/log/maillog or /var/log/mail; the
-exact pathname is defined in the /etc/syslog.conf file. </p>
+<p> Postfix logs all failed and successful deliveries to a logfile. </p>
+
+<ul>
+
+<li> <p> When Postfix uses syslog logging (the default), the file
+is usually called /var/log/maillog, /var/log/mail, or something
+similar; the exact pathname is configured in a file called
+/etc/syslog.conf, /etc/rsyslog.conf, or something similar. </p>
+
+<li> <p> When Postfix uses its own logging system (see <a href="MAILLOG_README.html">MAILLOG_README</a>),
+the location of the logfile is configured with the Postfix <a href="postconf.5.html#maillog_file">maillog_file</a>
+parameter. </p>
+
+</ul>
<p> When Postfix does not receive or deliver mail, the first order
of business is to look for errors that prevent Postfix from working
diff --git a/external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html b/external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html
index a7c2f24e290..3bdb047f3fd 100644
--- a/external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html
+++ b/external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html
@@ -226,33 +226,36 @@ implements the P-256 curve, forward secrecy just works. </p>
setting the <a href="postconf.5.html">main.cf</a> parameter <a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> to "strong".
</p> </blockquote>
-<p> The elliptic curve situation is evolving, with new curves being
-introduced to augment or replace the NIST curves tarnished by the
-Snowden revelations. Fortunately, TLS clients advertise the list
-of supported curves to the server so that servers can in principle
-choose newer stronger curves when mutually supported. The OpenSSL
-code for making this possible is not yet released as of late 2013
-(it is available only in OpenSSL development snapshots). </p>
-
-<p> At some point Postfix will need to adjust to the new API for
-setting the elliptic-curve options. Fortunately, when EECDH support
-was added to Postfix, it introduced a layer of indirection: </p>
+<p> The elliptic curve standards are evolving, with new curves
+introduced in <a href="http://tools.ietf.org/html/rfc8031">RFC 8031</a> to augment or replace the NIST curves tarnished
+by the Snowden revelations. Fortunately, TLS clients advertise
+their list of supported curves to the server so that servers can
+choose newer stronger curves when mutually supported. OpenSSL 1.0.2
+released in January 2015 was the first release to implement negotiation
+of supported curves in TLS servers. In older OpenSSL releases, the
+server is limited to selecting a single widely supported curve. </p>
+
+<p> With Postfix prior to 3.2 or OpenSSL prior to 1.0.2, only a
+single server-side curve can be configured, by specifying a suitable
+EECDH "grade": </p>
<blockquote>
<pre>
<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong | ultra
- <a href="postconf.5.html#tls_eecdh_strong_curve">tls_eecdh_strong_curve</a> = prime256v1
- <a href="postconf.5.html#tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a> = secp384r1
+ # Underlying curves, best not changed:
+ # <a href="postconf.5.html#tls_eecdh_strong_curve">tls_eecdh_strong_curve</a> = prime256v1
+ # <a href="postconf.5.html#tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a> = secp384r1
</pre>
</blockquote>
-<p> When it becomes possible in OpenSSL to support a "menu" of
-curves, we will likely extend "<a href="postconf.5.html#tls_eecdh_strong_curve">tls_eecdh_strong_curve</a>" to be an
-ordered list of curves and likewise with the "ultra" version, where
-the two might now overlap, and differ mostly in the preference
-order. As a result most existing configurations will then support
-more curves at the desired security level without any changes to
-<a href="postconf.5.html">main.cf</a>. </p>
+<p> Postfix &ge; 3.2 supports the curve negotiation API of OpenSSL
+&ge; 1.0.2. When using this software combination, the default setting
+of "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>" changes to "auto", which selects a curve
+that is supported by both the server and client. The list of
+candidate curves can be configured via "<a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a>",
+which can be used to configure a prioritized list of supported
+curves (most preferred first) on both the server and client.
+The default list is suitable for most users. </p>
<h2> <a name="client_fs">Forward Secrecy in the Postfix SMTP Client</a> </h2>
@@ -267,6 +270,13 @@ traffic between the server and client will resist decryption even
if the server's long-term authentication keys are <i>later</i>
compromised. </p>
+<p> Postfix &ge; 3.2 supports the curve negotiation API of OpenSSL
+&ge; 1.0.2. The list of candidate curves can be changed via the
+"<a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a>" configuration parameter, which can be used
+to select a prioritized list of supported curves (most preferred
+first) on both the Postfix SMTP server and SMTP client. The default
+list is suitable for most users. </p>
+
<p> The default Postfix SMTP client cipher lists are correctly
ordered to prefer EECDH and EDH cipher suites ahead of similar
cipher suites that don't implement forward secrecy. Administrators
@@ -285,7 +295,15 @@ table. </p>
<h3> EECDH Client support (Postfix &ge; 2.2 with OpenSSL &ge; 1.0.0) </h3>
-<p> This works "out of the box" without additional configuration. </p>
+<p> This works "out of the box" with no need for additional
+configuration. </p>
+
+<p> Postfix &ge; 3.2 supports the curve negotiation API of OpenSSL
+&ge; 1.0.2. The list of candidate curves can be changed via the
+"<a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a>" configuration parameter, which can be used
+to select a prioritized list of supported curves (most preferred
+first) on both the Postfix SMTP server and SMTP client. The default
+list is suitable for most users. </p>
<h3> EECDH Server support (Postfix &ge; 2.6 with OpenSSL &ge; 1.0.0) </h3>
@@ -297,7 +315,8 @@ by the vendor, as in some versions of RedHat Linux. </p>
<blockquote>
<pre>
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
- # Postfix 2.6 or 2.7 only. This is default with Postfix 2.8 and later.
+ # Postfix 2.6 &amp; 2.7 only. EECDH is on by default with Postfix &ge; 2.8.
+ # The default grade is "auto" with Postfix &ge; 3.2.
<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong
</pre>
</blockquote>
@@ -322,9 +341,9 @@ few seconds to a few minutes): </p>
<pre>
# cd /etc/postfix
# umask 022
-# openssl dhparam -out dh512.tmp 512 && mv dh512.tmp dh512.pem
-# openssl dhparam -out dh1024.tmp 1024 && mv dh1024.tmp dh1024.pem
-# openssl dhparam -out dh2048.tmp 2048 && mv dh2048.tmp dh2048.pem
+# openssl dhparam -out dh512.tmp 512 &amp;&amp; mv dh512.tmp dh512.pem
+# openssl dhparam -out dh1024.tmp 1024 &amp;&amp; mv dh1024.tmp dh1024.pem
+# openssl dhparam -out dh2048.tmp 2048 &amp;&amp; mv dh2048.tmp dh2048.pem
# chmod 644 dh512.pem dh1024.pem dh2048.pem
</pre>
</blockquote>
@@ -378,7 +397,9 @@ peer certificate or public-key verification status. </p>
<li> <p> With "<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> = 1" and "<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> = 1",
the Postfix SMTP client and server will log TLS connection information
-to the maillog file. The general logfile format is: </p>
+to the maillog file. The general logfile format is shown below.
+With TLS 1.3 there may be additional properties logged after the
+cipher name and bits. </p>
<blockquote>
<pre>
@@ -395,7 +416,8 @@ from host.example.com[192.168.0.2]: TLSv1 with cipher <i>cipher-name</i>
<li> <p> With "<a href="postconf.5.html#smtpd_tls_received_header">smtpd_tls_received_header</a> = yes", the Postfix SMTP
server will record TLS connection information in the Received:
header in the form of comments (text inside parentheses). The general
-format depends on the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> setting:
+format depends on the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> setting. With TLS 1.3 there
+may be additional properties logged after the cipher name and bits. </p>
<blockquote>
<pre>
@@ -411,6 +433,46 @@ Received: from host.example.com (host.example.com [192.168.0.2])
</pre>
</blockquote>
+<p> TLS 1.3 examples. Some of the new attributes may not appear when not
+applicable or not available in older versions of the OpenSSL library. </p>
+
+<blockquote>
+<pre>
+Received: from localhost (localhost [127.0.0.1])
+ (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
+ (No client certificate requested)
+
+Received: from localhost (localhost [127.0.0.1])
+ (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256)
+ (Client CN "example.org", Issuer "example.org" (not verified))
+</pre>
+</blockquote>
+
+<ul>
+<li> <p> The "key-exchange" attribute records the type of "Diffie-Hellman"
+group used for key agreement. Possible values include "DHE", "ECDHE", "X25519"
+and "X448". With "DHE", the bit size of the prime will be reported in
+parentheses after the algorithm name, with "ECDHE", the curve name. </p>
+
+<li> <p> The "server-signature" attribute shows the public key signature
+algorithm used by the server. With "RSA-PSS", the bit size of the modulus will
+be reported in parentheses. With "ECDSA", the curve name. If, for example,
+the server has both an RSA and an ECDSA private key and certificate, it will be
+possible to track which one was used for a given connection. </p>
+
+<li> <p> The new "server-digest" attribute records the digest algorithm used by
+the server to prepare handshake messages for signing. The Ed25519 and Ed448
+signature algorithms do not make use of such a digest, so no "server-digest"
+will be shown for these signature algorithms. </p>
+
+<li> <p> When a client certificate is requested with "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>" and
+the client uses a TLS client-certificate, the "client-signature" and
+"client-digest" attributes will record the corresponding properties of the
+client's TLS handshake signature. </p> </ul>
+
</ul>
<p> The next sections will explain what <i>cipher-name</i>,
@@ -462,6 +524,75 @@ are generally the same with non-export ciphers, but may they
differ for the legacy export ciphers where the actual key
is artificially shortened. </p>
+<p> Starting with TLS 1.3 the cipher name no longer contains enough
+information to determine which forward-secrecy scheme was employed,
+but TLS 1.3 <b>always</b> uses forward-secrecy. On the client side,
+up-to-date Postfix releases log additional information for TLS 1.3
+connections, reporting the signature and key exchange algorithms.
+Two examples below (the long single line messages are folded across
+multiple lines for readability): </p>
+
+<blockquote>
+<pre>
+postfix/smtp[<i>process-id</i>]:
+ Untrusted TLS connection established to 127.0.0.1[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+
+postfix/smtp[<i>process-id</i>]:
+ Untrusted TLS connection established to 127.0.0.1[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256
+</pre>
+</blockquote>
+
+<p> In the above connections, the "key-exchange" value records the
+"Diffie-Hellman" algorithm used for key agreement. The "server-signature" value
+records the public key algorithm used by the server to sign the key exchange.
+The "server-digest" value records any hash algorithm used to prepare the data
+for signing. With "ED25519" and "ED448", no separate hash algorithm is used.
+</p>
+
+<p> Examples of Postfix SMTP server logging: </p>
+
+<blockquote>
+<pre>
+postfix/smtpd[<i>process-id</i>]:
+ Untrusted TLS connection established from localhost[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+
+postfix/smtpd[<i>process-id</i>]:
+ Anonymous TLS connection established from localhost[127.0.0.1]:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ server-signature RSA-PSS (2048 bits) server-digest SHA256
+
+postfix/smtpd[<i>process-id</i>]:
+ Anonymous TLS connection established from localhost[127.0.0.1]:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ server-signature ED25519
+</pre>
+</blockquote>
+
+<p> Note that Postfix &ge; 3.4 server logging may also include a
+"to <i>sni-name</i>" element to record the use of an alternate
+server certificate chain for the connection in question. This happens
+when the client uses the TLS SNI extension, and the server selects
+a non-default certificate chain based on the client's SNI value:
+</p>
+
+<blockquote>
+<pre>
+postfix/smtpd[<i>process-id</i>]:
+ Untrusted TLS connection established from client.example[192.0.2.1]
+ to server.example: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+</pre>
+</blockquote>
+
<h2><a name="status"> What do "Anonymous", "Untrusted", etc. in
Postfix logging mean? </a> </h2>
diff --git a/external/ibm-public/postfix/dist/html/MAILLOG_README.html b/external/ibm-public/postfix/dist/html/MAILLOG_README.html
new file mode 100644
index 00000000000..0b9f250b33b
--- /dev/null
+++ b/external/ibm-public/postfix/dist/html/MAILLOG_README.html
@@ -0,0 +1,183 @@
+<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
+ "http://www.w3.org/TR/html4/loose.dtd">
+
+<html>
+
+<head>
+
+<title>Postfix logging to file or stdout</title>
+
+<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
+
+</head>
+
+<body>
+
+<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix
+logging to file or stdout</h1>
+
+<hr>
+
+<h2>Overview </h2>
+
+<p> Postfix supports it own logging system as an alternative to
+syslog (which remains the default). This is available with Postfix
+version 3.4 or later. </p>
+
+<p> Topics covered in this document: </p>
+
+<ul>
+
+<li><a href="#log-to-file">Configuring logging to file</a>
+
+<li><a href="#log-to-stdout">Configuring logging to stdout</a>
+
+<li><a href="#logrotate">Rotating logs </a>
+
+<li><a href="#limitations">Limitations</a>
+
+</ul>
+
+<h2> <a name="log-to-file"> Configuring logging to file </a> </h2>
+
+<p> Logging to file solves a usability problem for MacOS, and
+eliminates multiple problems for systemd-based systems. </p>
+
+<ol>
+
+<li> <p> Add the following line to <a href="master.5.html">master.cf</a> if not already present
+(note: there must be no whitespace at the start of the line): </p>
+
+<blockquote>
+<pre>
+postlog unix-dgram n - n - 1 postlogd
+</pre>
+</blockquote>
+
+<p> Note: the service type "<b>unix-dgram</b>" was introduced with
+Postfix 3.4. Remove the above line before backing out to an older
+Postfix version. </p>
+
+<li> <p> Configure Postfix to write logging, to, for example,
+/var/log/postfix.log. See also the "<a href="#logrotate">Logfile
+rotation</a>" section below for logfile management. </p>
+
+<blockquote>
+<pre>
+# postfix stop
+# postconf <a href="postconf.5.html#maillog_file">maillog_file</a>=/var/log/postfix.log
+# postfix start
+</pre>
+</blockquote>
+
+<p> By default, the logfile name must start with "/var" or "/dev/stdout"
+(the list of allowed prefixes is configured with the <a href="postconf.5.html#maillog_file_prefixes">maillog_file_prefixes</a>
+parameter). This safety mechanism limits the damage from a single
+configuration mistake. </p>
+
+</ol>
+
+<h2> <a name="log-to-stdout"> Configuring logging to stdout </a> </h2>
+
+<p> Logging to stdout is useful when Postfix runs in a container,
+as it eliminates a syslogd dependency. </p>
+
+<ol>
+
+<li> <p> Add the following line to <a href="master.5.html">master.cf</a> if not already present (note:
+there must be no whitespace at the start of the line): </p>
+
+<blockquote>
+<pre>
+postlog unix-dgram n - n - 1 postlogd
+</pre>
+</blockquote>
+
+<p> Note: the service type "<b>unix-dgram</b>" was introduced with
+Postfix 3.4. Remove the above line before backing out to an older
+Postfix version. </p>
+
+<li> <p> Configure <a href="postconf.5.html">main.cf</a> with "<a href="postconf.5.html#maillog_file">maillog_file</a> = /dev/stdout". </p>
+
+<li> <p> Start Postfix with "<b>postfix start-fg</b>". </p>
+
+</ol>
+
+<h2> <a name="logrotate"> Rotating logs </a> </h2>
+
+<p> The command "<b>postfix logrotate</b>" may be run by hand or
+by a cronjob. It logs all errors, and reports errors to stderr if
+run from a terminal. This command implements the following steps:
+</p>
+
+<ul>
+
+<li> <p> Rename the current logfile by appending a suffix that
+contains the date and time. This suffix is configured with the
+<a href="postconf.5.html#maillog_file_rotate_suffix">maillog_file_rotate_suffix</a> parameter (default: %Y%M%d-%H%M%S). </p>
+
+<li> <p> Reload Postfix so that <a href="postlogd.8.html">postlogd(8)</a> immediately closes the
+old logfile. </p>
+
+<li> <p> After a brief pause, compress the old logfile. The compression
+program is configured with the <a href="postconf.5.html#maillog_file_compressor">maillog_file_compressor</a> parameter
+(default: gzip). </p>
+
+</ul>
+
+<p> Notes: </p>
+
+<ul>
+
+<li> <p> This command will not rotate a logfile with pathname under
+the /dev directory, such as /dev/stdout. </p>
+
+<li> <p> This command does not (yet) remove old logfiles. </p>
+
+</ul>
+
+<h2> <a name="limitations">Limitations</a> </h2>
+
+<p> Background: </p>
+
+<ul>
+
+<li> <p> Postfix consists of a number of daemon programs that run
+in the background, as well as non-daemon programs for local mail
+submission or Postfix management.
+
+<li> <p> Logging to Postfix logfile or stdout requires the Postfix
+<a href="postlogd.8.html">postlogd(8)</a> service. This ensures that simultaneous logging from
+different programs will not get mixed up. </p>
+
+<li> <p> All Postfix programs can log to syslog, but not all programs
+have sufficient privileges to use the Postfix logging service, and
+many non-daemon programs must not log to stdout as that would corrupt
+their output. </p>
+
+</ul>
+
+<p> Limitations: </p>
+
+<ul>
+
+<li> <p> Non-daemon Postfix programs will log errors to syslogd(8)
+before they have processed command-line options and <a href="postconf.5.html">main.cf</a> parameters.
+
+<li> <p> If Postfix is down, the non-daemon programs <a href="postfix.1.html">postfix(1)</a>,
+<a href="postsuper.1.html">postsuper(1)</a>, <a href="postmulti.1.html">postmulti(1)</a>, and <a href="postlog.1.html">postlog(1)</a>, will log directly to
+$<a href="postconf.5.html#maillog_file">maillog_file</a>. These programs expect to run with root privileges,
+for example during Postfix start-up, reload, or shutdown.
+
+<li> <p> Other non-daemon Postfix programs will never write directly
+to $<a href="postconf.5.html#maillog_file">maillog_file</a> (also, logging to stdout would interfere with the
+operation of some of these programs). These programs can log to
+<a href="postlogd.8.html">postlogd(8)</a> if they are run by the super-user, or if their executable
+file has set-gid permission. Do not set this permission on programs
+other than <a href="postdrop.1.html">postdrop(1)</a> and <a href="postqueue.1.html">postqueue(1)</a>.
+
+</ul>
+
+</body>
+
+</html>
diff --git a/external/ibm-public/postfix/dist/html/MILTER_README.html b/external/ibm-public/postfix/dist/html/MILTER_README.html
index 7494e592b62..537ebbe8c44 100644
--- a/external/ibm-public/postfix/dist/html/MILTER_README.html
+++ b/external/ibm-public/postfix/dist/html/MILTER_README.html
@@ -259,6 +259,9 @@ support per-Milter timeouts, per-Milter error handling, etc. </p>
<li><a href="#per-milter">Different settings for different Milter
applications </a>
+<li><a href="#per-client">Different settings for different SMTP
+clients </a>
+
<li><a href="#macros">Sendmail macro emulation</a>
<li><a href="#send-macros">What macros will Postfix send to Milters?</a>
@@ -320,6 +323,11 @@ form <b>inet:</b><i>port</i><b>@</b><i>host</i>. </p> </dd>
</blockquote>
+<p> For advanced configuration see "<a href="#per-client">Different
+settings for different SMTP clients</a>" and "<a
+href="#per-milter">Different settings for different Milter
+applications</a>". </p>
+
<h3> <a name="non-smtp-milters">Non-SMTP Milter applications </a> </h3>
<p> The non-SMTP Milter applications handle mail that arrives via
@@ -564,6 +572,29 @@ and protocol. </p>
}", if you want to have space or comma within a value or around
"="</b>. </p>
+<h3><a name="per-client">Different settings for different SMTP
+clients </a></h3>
+
+<p> The <a href="postconf.5.html#smtpd_milter_maps">smtpd_milter_maps</a> feature supports different Milter settings
+for different client IP addresses. Lookup results override the the
+global <a href="postconf.5.html#smtpd_milters">smtpd_milters</a> setting, and have the same syntax. For example,
+to disable Milter settings for local address ranges: </p>
+
+<pre>
+/etc/postfix/<a href="postconf.5.html">main.cf</a>:
+ <a href="postconf.5.html#smtpd_milter_maps">smtpd_milter_maps</a> = <a href="cidr_table.5.html">cidr</a>:/etc/postfix/smtpd_milter_map
+ <a href="postconf.5.html#smtpd_milters">smtpd_milters</a> = inet:host:port, { inet:host:port, ... }, ...
+
+/etc/postfix/smtpd_milter_map:
+ # Disable Milters for local clients.
+ 127.0.0.0/8 DISABLE
+ 192.168.0.0/16 DISABLE
+ ::/64 DISABLE
+ 2001:db8::/32 DISABLE
+</pre>
+
+<p> This feature is available with Postfix 3.2 and later. </p>
+
<h3><a name="macros">Sendmail macro emulation</a></h3>
<p> Postfix emulates a limited number of Sendmail macros, as shown
@@ -601,19 +632,19 @@ sender </td> </tr>
<tr> <td> {auth_type} </td> <td> MAIL, DATA, EOH, EOM </td> <td> SASL
login method </td> </tr>
-<tr> <td> {client_addr} </td> <td> Always </td> <td> Client IP
-address </td> </tr>
+<tr> <td> {client_addr} </td> <td> Always </td> <td> Remote client
+IP address </td> </tr>
<tr> <td> {client_connections} </td> <td> CONNECT </td> <td>
Connection concurrency for this client (zero if the client is
excluded from all smtpd_client_* limits). </td> </tr>
-<tr> <td> {client_name} </td> <td> Always </td> <td> Client hostname
-<br> When address &rarr; name lookup or name &rarr; address
+<tr> <td> {client_name} </td> <td> Always </td> <td> Remote client
+hostname <br> When address &rarr; name lookup or name &rarr; address
verification fails: "unknown" </td> </tr>
<tr> <td> {client_port} </td> <td> Always (Postfix &ge;2.5) </td>
-<td> Client TCP port </td> </tr>
+<td> Remote client TCP port </td> </tr>
<tr> <td> {client_ptr} </td> <td> CONNECT, HELO, MAIL, DATA </td>
<td> Client name from address &rarr; name lookup <br> When address
@@ -631,9 +662,15 @@ TLS session key size </td> </tr>
<tr> <td> {cipher} </td> <td> HELO, MAIL, DATA, EOH, EOM </td> <td> TLS
cipher </td> </tr>
+<tr> <td> {daemon_addr} </td> <td> Always (Postfix &ge;3.2) </td>
+<td> Local server IP address </td> </tr>
+
<tr> <td> {daemon_name} </td> <td> Always </td> <td> value of
<a href="postconf.5.html#milter_macro_daemon_name">milter_macro_daemon_name</a> </td> </tr>
+<tr> <td> {daemon_port} </td> <td> Always (Postfix &ge;3.2) </td>
+<td> Local server TCP port </td> </tr>
+
<tr> <td> {mail_addr} </td> <td> MAIL </td> <td> Sender address
</td> </tr>
@@ -748,7 +785,8 @@ example. </p>
<li> <p> Some Milter applications use the "<tt>{if_addr}</tt>" macro
to recognize local mail; this macro does not exist in Postfix.
-Workaround: use the "<tt>{client_addr}</tt>" macro instead. </p>
+Workaround: use the "<tt>{daemon_addr}</tt>" (Postfix &ge; 3.2) or
+"<tt>{client_addr}</tt>" macro instead. </p>
<li> <p> Some Milter applications log a warning that looks like
this: </p>
diff --git a/external/ibm-public/postfix/dist/html/MYSQL_README.html b/external/ibm-public/postfix/dist/html/MYSQL_README.html
index 6cdbce49ce3..06a84aa3bfd 100644
--- a/external/ibm-public/postfix/dist/html/MYSQL_README.html
+++ b/external/ibm-public/postfix/dist/html/MYSQL_README.html
@@ -132,7 +132,7 @@ where_field = alias
additional_conditions = AND status = 'paid'
# This is necessary to make UTF8 queries work for Postfix 2.11 .. 3.1,
-# and is the default setting as of Postfix 3.2,
+# and is the default setting as of Postfix 3.2.
option_group = client
</pre>
diff --git a/external/ibm-public/postfix/dist/html/Makefile.in b/external/ibm-public/postfix/dist/html/Makefile.in
index 5eda8f7f2cb..c5481f8aff7 100644
--- a/external/ibm-public/postfix/dist/html/Makefile.in
+++ b/external/ibm-public/postfix/dist/html/Makefile.in
@@ -8,14 +8,14 @@ DAEMONS = bounce.8.html cleanup.8.html defer.8.html error.8.html local.8.html \
oqmgr.8.html spawn.8.html flush.8.html virtual.8.html qmqpd.8.html \
trace.8.html verify.8.html proxymap.8.html anvil.8.html \
scache.8.html discard.8.html tlsmgr.8.html postscreen.8.html \
- dnsblog.8.html tlsproxy.8.html
+ dnsblog.8.html tlsproxy.8.html postlogd.8.html
COMMANDS= mailq.1.html newaliases.1.html postalias.1.html postcat.1.html \
postconf.1.html postfix.1.html postkick.1.html postlock.1.html \
postlog.1.html postdrop.1.html postmap.1.html postmulti.1.html \
postqueue.1.html postsuper.1.html sendmail.1.html \
smtp-source.1.html smtp-sink.1.html posttls-finger.1.html \
qmqp-source.1.html qmqp-sink.1.html \
- qshape.1.html postfix-tls.1.html
+ qshape.1.html postfix-tls.1.html makedefs.1.html
CONFIG = access.5.html aliases.5.html canonical.5.html relocated.5.html \
transport.5.html virtual.5.html pcre_table.5.html regexp_table.5.html \
cidr_table.5.html tcp_table.5.html header_checks.5.html \
@@ -101,6 +101,10 @@ pipe.8.html: ../src/pipe/pipe.c
PATH=../mantools:$$PATH; \
srctoman $? | $(AWK) | $(NROFF) -man | uniq | $(MAN2HTML) | postlink >$@
+postlogd.8.html: ../src/postlogd/postlogd.c
+ PATH=../mantools:$$PATH; \
+ srctoman $? | $(AWK) | $(NROFF) -man | uniq | $(MAN2HTML) | postlink >$@
+
postscreen.8.html: ../src/postscreen/postscreen.c
PATH=../mantools:$$PATH; \
srctoman $? | $(AWK) | $(NROFF) -man | uniq | $(MAN2HTML) | postlink >$@
@@ -246,6 +250,10 @@ qshape.1.html: ../auxiliary/qshape/qshape.pl
PATH=../mantools:$$PATH; \
srctoman - $? | $(AWK) | $(NROFF) -man | uniq | $(MAN2HTML) | postlink >$@
+makedefs.1.html: ../makedefs
+ PATH=../mantools:$$PATH; \
+ srctoman - $? | $(AWK) | $(NROFF) -man | uniq | $(MAN2HTML) | postlink >$@
+
access.5.html: ../proto/access
PATH=../mantools:$$PATH; \
srctoman - $? | $(AWK) | $(NROFF) -man | uniq | $(MAN2HTML) | postlink >$@
diff --git a/external/ibm-public/postfix/dist/html/POSTSCREEN_README.html b/external/ibm-public/postfix/dist/html/POSTSCREEN_README.html
index 81c432d7bea..4405f1e3e51 100644
--- a/external/ibm-public/postfix/dist/html/POSTSCREEN_README.html
+++ b/external/ibm-public/postfix/dist/html/POSTSCREEN_README.html
@@ -106,7 +106,7 @@ problem will get worse before things improve, if ever. Without a
tool like <a href="postscreen.8.html">postscreen(8)</a> that keeps the zombies away, Postfix would be
spending most of its resources not receiving email. </p>
-<p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-it-a-zombie
+<p> The main challenge for <a href="postscreen.8.html">postscreen(8)</a> is to make an is-a-zombie
decision based on a single measurement. This is necessary because
many zombies try to fly under the radar and avoid spamming the same
site repeatedly. Once <a href="postscreen.8.html">postscreen(8)</a> decides that a client is
@@ -124,13 +124,13 @@ mail even when the server tells them to go away. </p>
zombies. First, <a href="postscreen.8.html">postscreen(8)</a> determines if the remote SMTP client
IP address is blacklisted. Second, <a href="postscreen.8.html">postscreen(8)</a> looks for protocol
compromises that are made to speed up delivery. These are good
-indicators for making is-it-a-zombie decisions based on single
+indicators for making is-a-zombie decisions based on single
measurements. </p>
<p> <a href="postscreen.8.html">postscreen(8)</a> does not inspect message content. Message content
can vary from one delivery to the next, especially with clients
that (also) send legitimate email. Content is not a good indicator
-for making is-it-a-zombie decisions based on single measurements,
+for making is-a-zombie decisions based on single measurements,
and that is the problem that <a href="postscreen.8.html">postscreen(8)</a> is focused on. </p>
<h2> <a name="general"> General operation </a> </h2>
@@ -714,16 +714,25 @@ The "<tt><b>after</b> <i>command</i></tt>" portion is logged with
Postfix 2.10 and later. </p>
<p> When an SMTP client makes too many connections at the same time,
-or when all <a href="postscreen.8.html">postscreen(8)</a> ports are busy, <a href="postscreen.8.html">postscreen(8)</a> rejects the
-connection with a 421 status code and logs: </p>
+<a href="postscreen.8.html">postscreen(8)</a> rejects the connection with a 421 status code and logs: </p>
<pre>
<b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b>
+</pre>
+
+<p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> parameter controls this limit. </p>
+
+<p> When an SMTP client connects after <a href="postscreen.8.html">postscreen(8)</a> has reached a
+connection count limit, <a href="postscreen.8.html">postscreen(8)</a> rejects the connection with
+a 421 status code and logs: </p>
+
+<pre>
+ <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all screening ports busy</b>
<b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b>
</pre>
-<p> The <a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a> and
-<a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> parameters control these limits. </p>
+<p> The <a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> and <a href="postconf.5.html#postscreen_post_queue_limit">postscreen_post_queue_limit</a>
+parameters control these limits. </p>
<h2> <a name="victory">When all tests succeed</a> </h2>
@@ -1072,8 +1081,8 @@ of the following options: </p>
<li> <p> A non-persistent <a href="memcache_table.5.html">memcache</a>: temporary whitelist can be shared
between <a href="postscreen.8.html">postscreen(8)</a> daemons on the same host or different
hosts. Disable cache cleanup (<a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a>
- = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons because <a href="memcache_table.5.html">memcache</a>: does not
- implement this (but see example 4 below for <a href="memcache_table.5.html">memcache</a>: with
+ = 0) in all <a href="postscreen.8.html">postscreen(8)</a> daemons because <a href="memcache_table.5.html">memcache</a>: has no
+ first-next API (but see example 4 below for <a href="memcache_table.5.html">memcache</a>: with
persistent backup). This requires Postfix 2.9 or later. </p>
<pre>
diff --git a/external/ibm-public/postfix/dist/html/SASL_README.html b/external/ibm-public/postfix/dist/html/SASL_README.html
index bc5311fa7fb..4b12902235f 100644
--- a/external/ibm-public/postfix/dist/html/SASL_README.html
+++ b/external/ibm-public/postfix/dist/html/SASL_README.html
@@ -15,15 +15,6 @@
<hr>
-<h2>Warning</h2>
-
-<p> People who go to the trouble of installing Postfix may have the
-expectation that Postfix is more secure than some other mailers.
-The Cyrus SASL library contains a lot of code. With this, Postfix
-becomes as secure as other mail systems that use the Cyrus SASL
-library. Dovecot provides an alternative that may be worth
-considering. </p>
-
<h2><a name="intro">How Postfix uses SASL authentication</a></h2>
<p> SMTP servers need to decide whether an SMTP client is authorized
@@ -47,6 +38,13 @@ configuration files belong to the specific SASL
implementation that Postfix will use. This document covers both the
Postfix and non-Postfix configuration. </p>
+<p> NOTE: People who go to the trouble of installing Postfix may
+have the expectation that Postfix is more secure than some other
+mailers. The Cyrus SASL library contains a lot of code. With this,
+Postfix becomes as secure as other mail systems that use the Cyrus
+SASL library. Dovecot provides an alternative that may be worth
+considering. </p>
+
<p> You can read more about the following topics: </p>
<ul>
diff --git a/external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html b/external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html
index 411440c7af5..d77d3bce13d 100644
--- a/external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html
+++ b/external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html
@@ -187,12 +187,6 @@ described in the <a href="postconf.5.html">postconf(5)</a> manual page. </p>
# Don't accept mail from domains that don't exist.
<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
- # Relay control (Postfix 2.10 and later): local clients and
- # authenticated clients may specify any destination domain.
- <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
- <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>,
- <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
-
# Spam control: exclude local clients and authenticated clients
# from DNSBL lookups.
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
@@ -206,6 +200,12 @@ described in the <a href="postconf.5.html">postconf(5)</a> manual page. </p>
<a href="postconf.5.html#reject_rhsbl_helo">reject_rhsbl_helo</a> dbl.spamhaus.org,
<a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> dbl.spamhaus.org
+ # Relay control (Postfix 2.10 and later): local clients and
+ # authenticated clients may specify any destination domain.
+ <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
+ <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>,
+ <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
+
# Block clients that speak too early.
<a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
@@ -246,20 +246,20 @@ Reject HELO/EHLO information </td> </tr>
Optional </td> <td>
Reject MAIL FROM information </td> </tr>
-<tr> <td rowspan="2"> <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> </td> <td> &ge; 2.10
-</td> <td> Required if <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> does not enforce
+<tr> <td rowspan="2"> <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> </td> <td> &ge;
+2.10 </td> <td> Required if <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> does not enforce
relay policy</td>
<td rowspan="2"> Reject RCPT TO information </td> </tr>
-<tr> <td> &lt 2.10</td> <td> Not available </td>
-</tr>
+<tr> <td> &lt; 2.10</td> <td> Required </td> </tr>
-<tr> <td rowspan="2"> <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> </td> <td> &ge;
-2.10 </td> <td> Required if <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> does not enforce
+<tr> <td rowspan="2"> <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> </td> <td> &ge; 2.10
+</td> <td> Required if <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> does not enforce
relay policy</td>
<td rowspan="2"> Reject RCPT TO information </td> </tr>
-<tr> <td> &lt 2.10</td> <td> Required </td> </tr>
+<tr> <td> &lt; 2.10</td> <td> Not available </td>
+</tr>
<tr> <td> <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> </td> <td> &ge; 2.0 </td> <td>
Optional </td> <td>
diff --git a/external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html b/external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html
index 81885fa22f1..da57bc56649 100644
--- a/external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html
+++ b/external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html
@@ -31,7 +31,7 @@ can be found in the Postfix source code, in the directory
examples/smtpd-policy. </p>
<p> Another example of policy delegation is the SPF policy server
-at <a href="http://www.openspf.org/Software">http://www.openspf.org/Software</a>. </p>
+at https://web.archive.org/web/20190221142057/<a href="http://www.openspf.org/Software">http://www.openspf.org/Software</a>. </p>
<p> Policy delegation is now the preferred method for adding policies
to Postfix. It's much easier to develop a new feature in few lines
@@ -65,11 +65,14 @@ multiple times, for up to $<a href="postconf.5.html#max_use">max_use</a> incomin
<h2><a name="protocol">Protocol description</a></h2>
-<p> The Postfix policy delegation protocol is really simple. The
-client request is a sequence of name=value attributes separated by
-newline, and is terminated by an empty line. The server reply is
-one name=value attribute and it, too, is terminated by an empty
-line. </p>
+<p> The Postfix policy delegation protocol is really simple. The client
+sends a request and the server sends a response. Unless there was an
+error, the server must not close the connection, so that the same
+connection can be used multiple times. </p>
+
+<p> The client request is a sequence of name=value attributes separated
+by newline, and is terminated by an empty line. The server reply is one
+name=value attribute and it, too, is terminated by an empty line. </p>
<p> Here is an example of all the attributes that the Postfix SMTP
server sends in a delegated SMTPD access policy request: </p>
@@ -110,6 +113,9 @@ ccert_pubkey_fingerprint=68:B3:29:DA:98:93:E3:40:99:C7:D8:AD:5C:B9:C9:40
client_port=1234
<b>Postfix version 3.1 and later:</b>
policy_context=submission
+<b>Postfix version 3.2 and later:</b>
+server_address=10.3.2.1
+server_port=54321
[empty line]
</pre>
</blockquote>
@@ -137,16 +143,23 @@ policy_context=submission
<li> <p> The "recipient" attribute is available in the "RCPT
TO" stage. It is also available in the "DATA" and "END-OF-MESSAGE"
stages if Postfix accepted only one recipient for the current
- message. </p>
+ message.
+ The DATA protocol state also applies to email that is received
+ with BDAT commands (Postfix 3.4 and later). </p>
<li> <p> The "recipient_count" attribute (Postfix 2.3 and later)
is non-zero only in the "DATA" and "END-OF-MESSAGE" stages. It
specifies the number of recipients that Postfix accepted for
- the current message. </p>
+ the current message.
+ The DATA protocol state also applies to email that is received
+ with BDAT commands (Postfix 3.4 and later). </p>
- <li> <p> The client address is an IPv4 dotted quad in the form
- 1.2.3.4 or it is an IPv6 address in the form 1:2:3::4:5:6.
- </p>
+ <li> <p> The remote client or local server IP address is an
+ IPv4 dotted quad in the form 1.2.3.4 or it is an IPv6 address
+ in the form 1:2:3::4:5:6. </p>
+
+ <li> <p> The remote client or local server port is a decimal
+ number in the range 0-65535. </p>
<li> <p> For a discussion of the differences between reverse
and verified client_name information, see the
@@ -167,8 +180,7 @@ policy_context=submission
<li> <p> The "size" attribute value specifies the message size
that the client specified in the MAIL FROM command (zero if
none was specified). With Postfix 2.2 and later, it specifies
- the actual message size when the client sends the END-OF-DATA
- command.
+ the actual message size after the client sends the END-OF-MESSAGE.
</p>
<li> <p> The "sasl_*" attributes (Postfix 2.2 and later) specify
@@ -214,6 +226,8 @@ policy_context=submission
DATA, END-OF-MESSAGE, VRFY or ETRN; these are the SMTP protocol
states where
the Postfix SMTP server makes an OK/REJECT/HOLD/etc. decision.
+ The DATA protocol state also applies to email that is received
+ with BDAT commands (Postfix 3.4 and later).
</p>
</ul>
@@ -410,11 +424,12 @@ the result. </p>
<blockquote>
<pre>
1 /etc/postfix/<a href="postconf.5.html">main.cf</a>:
-2 <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
+2 mua_recipient_restrictions =
3 ...
4 <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
5 <a href="postconf.5.html#check_policy_service">check_policy_service</a> { inet:host:port,
-6 timeout=10s, default_action=DUNNO }
+6 timeout=10s, default_action=DUNNO
+7 policy_context=submission }
8 ...
</pre>
</blockquote>
@@ -427,7 +442,7 @@ the result. </p>
This supports the exact same "inet" and "unix" syntax as described
earlier. </p>
-<li> <p> Line 6: The remainder of the list contains per-client
+<li> <p> Line 6-7: The remainder of the list contains per-client
settings. These settings override global <a href="postconf.5.html">main.cf</a> parameters,
and have the same name as those parameters, without the
"smtpd_policy_service_" prefix. </p>
diff --git a/external/ibm-public/postfix/dist/html/SMTPUTF8_README.html b/external/ibm-public/postfix/dist/html/SMTPUTF8_README.html
index a40cf36b580..1a3c8d5f162 100644
--- a/external/ibm-public/postfix/dist/html/SMTPUTF8_README.html
+++ b/external/ibm-public/postfix/dist/html/SMTPUTF8_README.html
@@ -7,7 +7,7 @@
<title>Postfix SMTPUTF8 support</title>
-<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
@@ -44,15 +44,17 @@ header values. </p>
<li><a href="#compatibility">Compatibility with pre-SMTPUTF8 environments</a>
+<li><a href="#idna2003">Compatibility with IDNA2003</a>
+
<li><a href="#credits">Credits</a>
</ul>
<h2> <a name="building">Building Postfix with/without SMTPUTF8 support</a> </h2>
-<p> Postfix will build with SMTPUTF8 support if the ICU library and
-header files are installed on the system. The package name varies
-with the OS distribution (and version). The table shows package
+<p> Postfix will build with SMTPUTF8 support if the ICU version
+&ge; 46 library and header files are installed on the system. The
+package name varies with the OS distribution. The table shows package
names for a number of platforms at the time this text was written.
</p>
@@ -104,6 +106,10 @@ parameter in <a href="postconf.5.html">main.cf</a>:</p>
</pre>
</blockquote>
+<p> (With Postfix &le; 3.1, you may also need to specify "<b>option_group
+= client</b>" in Postfix MySQL client files, to enable UTF8 support
+in MySQL queries. This setting is the default as of Postfix 3.2.) </p>
+
<p> With SMTPUTF8 support enabled, Postfix changes behavior with
respect to earlier Postfix releases: </p>
@@ -340,12 +346,36 @@ in address localparts (and in headers) as before. The vast majority
of email software is perfectly capable of handling such email, even
if pre-SMTPUTF8 standards do not support such practice. </p>
-<p> However, when you specify "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", Postfix
+<h3> Rejecting non-UTF8 addresses </h3>
+
+<p> With "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", Postfix
requires that non-ASCII address information is encoded in UTF-8 and
will reject other encodings such as ISO-8859. It is not practical
for Postfix to support multiple encodings at the same time. There
is no problem with <a href="http://tools.ietf.org/html/rfc2047">RFC 2047</a> encodings such as "=?ISO-8859-1?Q?text?=",
-because those use only characters from the ASCII characterset. </p>
+because those use only characters from the ASCII characterset. </p>
+
+<h3> Rejecting non-ASCII addresses in non-SMTPUTF8 transactions </h3>
+
+<p> Setting "<a href="postconf.5.html#strict_smtputf8">strict_smtputf8</a> = yes" in addition to "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a>
+= yes" will enable stricter enforcement of the SMTPUTF8 protocol.
+Specifically, the Postfix SMTP server will not only reject non-UTF8
+sender or recipient addresses, it will in addition accept UTF-8
+sender or recipient addresses only when the client requests an
+SMTPUTF8 mail transaction. </p>
+
+<h2> <a name="idna2003">Compatibility with IDNA2003</a> </h2>
+
+<p> Postfix &ge; 3.2 by default disables the 'transitional'
+compatibility between IDNA2003 and IDNA2008, when converting UTF-8
+domain names to/from the ASCII form that is used in DNS lookups.
+This makes Postfix behavior consistent with current versions of the
+Firefox and Chrome web browsers. Specify "<a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a>
+= yes" to get the historical behavior. </p>
+
+<p> This affects the conversion of domain names that contain for
+example the German sz (ß) and the Greek zeta (ς). See
+<a href="http://unicode.org/cldr/utility/idna.jsp">http://unicode.org/cldr/utility/idna.jsp</a> for more examples. </p>
<h2> <a name="credits">Credits</a> </h2>
diff --git a/external/ibm-public/postfix/dist/html/STRESS_README.html b/external/ibm-public/postfix/dist/html/STRESS_README.html
index 4255dbefa13..2e384ba3399 100644
--- a/external/ibm-public/postfix/dist/html/STRESS_README.html
+++ b/external/ibm-public/postfix/dist/html/STRESS_README.html
@@ -147,8 +147,8 @@ value): </p>
</pre>
</blockquote>
-<p> Services that have local access only never have "-o stress"
-parameters on the command line. This includes services internal to
+<p> You won't see "-o stress" command-line parameters with services
+that have local clients only. These include services internal to
Postfix such as the queue manager, and services that listen on a
loopback interface only, such as after-filter SMTP services. </p>
@@ -171,6 +171,10 @@ default with Postfix 2.6 and later. </p>
<p> Postfix versions before 3.0 use the older form ${stress?x}${stress:y}
instead of the newer form ${stress?{x}:{y}}. </p>
+<p> The syntax of ${name?{value}:{value}}, ${name?value} and
+${name:value} is explained at the beginning of the <a href="postconf.5.html">postconf(5)</a>
+manual page. </p>
+
<p> Translation: <p>
<ul>
@@ -187,7 +191,7 @@ from some clients. No mail should be lost, as long as this measure
is used only temporarily. </p>
<li> <p> Line 2: under conditions of stress, use an <a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a>
-of 1 instead of the default 20. This helps by disconnecting clients
+of 1 instead of the default 20. This disconnects clients
after a single error, giving other clients a chance to connect.
However, this may cause significant delays with legitimate mail,
such as a mailing list that contains a few no-longer-active user
@@ -219,10 +223,6 @@ as this measure is used only temporarily. </p>
</ul>
-<p> The syntax of ${name?{value}:{value}}, ${name?value} and
-${name:value} is explained at the beginning of the <a href="postconf.5.html">postconf(5)</a>
-manual page. </p>
-
<p> NOTE: Please keep in mind that the stress-adaptive feature is
a fairly desperate measure to keep <b>some</b> legitimate mail
flowing under overload conditions. If a site is reaching the SMTP
@@ -415,8 +415,8 @@ in section "<a href="#adapt">Automatic stress-adaptive behavior</a>".
<h2><a name="legacy"> Temporary measures for older Postfix releases </a></h2>
-<p> See the next section, "<a href="#adapt">Automatic stress-adaptive
-behavior</a>", if you are running Postfix version 2.5 or later, or
+<p> See the section "<a href="#adapt">Automatic stress-adaptive
+behavior</a>" if you are running Postfix version 2.5 or later, or
if you have applied the source code patch for stress-adaptive
behavior from the mirrors listed at <a href="http://www.postfix.org/download.html">http://www.postfix.org/download.html</a>.
</p>
diff --git a/external/ibm-public/postfix/dist/html/XCLIENT_README.html b/external/ibm-public/postfix/dist/html/XCLIENT_README.html
index 11b1ca26900..a58a32140d7 100644
--- a/external/ibm-public/postfix/dist/html/XCLIENT_README.html
+++ b/external/ibm-public/postfix/dist/html/XCLIENT_README.html
@@ -80,7 +80,7 @@ names are shown in upper case, they are in fact case insensitive.
xclient-command = XCLIENT 1*( SP attribute-name"="attribute-value )
</p>
<p>
- attribute-name = ( NAME | ADDR | PORT | PROTO | HELO | LOGIN )
+ attribute-name = ( NAME | ADDR | PORT | PROTO | HELO | LOGIN | DESTADDR | DESTPORT )
</p>
<p>
attribute-value = xtext
@@ -92,23 +92,32 @@ names are shown in upper case, they are in fact case insensitive.
<li> <p> Attribute values are xtext encoded as per <a href="http://tools.ietf.org/html/rfc1891">RFC 1891</a>.
</p>
- <li> <p> The NAME attribute specifies an SMTP client hostname
- (not an SMTP client address), [UNAVAILABLE] when client hostname
- lookup failed due to a permanent error, or [TEMPUNAVAIL] when
- the lookup error condition was transient. </p>
+ <li> <p> The NAME attribute specifies a remote SMTP client
+ hostname (not an SMTP client address), [UNAVAILABLE] when client
+ hostname lookup failed due to a permanent error, or [TEMPUNAVAIL]
+ when the lookup error condition was transient. </p>
- <li> <p> The ADDR attribute specifies an SMTP client numerical
- IPv4 network address, an IPv6 address prefixed with IPV6:, or
- [UNAVAILABLE] when the address information is unavailable.
- Address information is not enclosed with []. </p>
+ <li> <p> The ADDR attribute specifies a remote SMTP client
+ numerical IPv4 network address, an IPv6 address prefixed with
+ IPV6:, or [UNAVAILABLE] when the address information is
+ unavailable. Address information is not enclosed with []. </p>
- <li> <p> The PORT attribute specifies the SMTP client TCP port
- number as a decimal number, or [UNAVAILABLE] when the information
- is unavailable. </p>
+ <li> <p> The PORT attribute specifies a remote SMTP client TCP
+ port number as a decimal number, or [UNAVAILABLE] when the
+ information is unavailable. </p>
<li> <p> The PROTO attribute specifies either SMTP or ESMTP.
</p>
+ <li> <p> The DESTADDR attribute specifies a local SMTP server
+ numerical IPv4 network address, an IPv6 address prefixed with
+ IPV6:, or [UNAVAILABLE] when the address information is
+ unavailable. Address information is not enclosed with []. </p>
+
+ <li> <p> The DESTPORT attribute specifies a local SMTP server
+ TCP port number as a decimal number, or [UNAVAILABLE] when the
+ information is unavailable. </p>
+
<li> <p> The HELO attribute specifies an SMTP HELO parameter
value, or the value [UNAVAILABLE] when the information is
unavailable. </p>
diff --git a/external/ibm-public/postfix/dist/html/access.5.html b/external/ibm-public/postfix/dist/html/access.5.html
index 1c9598d11c5..9adcb0271a7 100644
--- a/external/ibm-public/postfix/dist/html/access.5.html
+++ b/external/ibm-public/postfix/dist/html/access.5.html
@@ -114,21 +114,17 @@ ACCESS(5) ACCESS(5)
<i>net.work</i>
- <i>net</i> Matches the specified IPv4 host address or subnetwork. An IPv4
- host address is a sequence of four decimal octets separated by
- ".".
+ <i>net</i> Matches a remote IPv4 host address or network address range.
+ Specify one to four decimal octets separated by ".". Do not
+ specify "[]" , "/", leading zeros, or hexadecimal forms.
- Subnetworks are matched by repeatedly truncating the last
- ".octet" from the remote IPv4 host address string until a match
+ Network ranges are matched by repeatedly truncating the last
+ ".octet" from a remote IPv4 host address string, until a match
is found in the access table, or until further truncation is not
possible.
- NOTE 1: The access map lookup key must be in canonical form: do
- not specify unnecessary null characters, and do not enclose net-
- work address information with "[]" characters.
-
- NOTE 2: use the <b>cidr</b> lookup table type to specify network/net-
- mask patterns. See <a href="cidr_table.5.html"><b>cidr_table</b>(5)</a> for details.
+ NOTE: use the <b>cidr</b> lookup table type to specify network/netmask
+ patterns. See <a href="cidr_table.5.html"><b>cidr_table</b>(5)</a> for details.
<i>net:work:addr:ess</i>
@@ -136,25 +132,19 @@ ACCESS(5) ACCESS(5)
<i>net:work</i>
- <i>net</i> Matches the specified IPv6 host address or subnetwork. An IPv6
- host address is a sequence of three to eight hexadecimal octet
- pairs separated by ":".
-
- Subnetworks are matched by repeatedly truncating the last
- ":octetpair" from the remote IPv6 host address string until a
- match is found in the access table, or until further truncation
- is not possible.
+ <i>net</i> Matches a remote IPv6 host address or network address range.
+ Specify three to eight hexadecimal octet pairs separated by ":",
+ using the compressed form "::" for a sequence of zero-valued
+ octet pairs. Do not specify "[]", "/", leading zeros, or
+ non-compressed forms.
- NOTE 1: the truncation and comparison are done with the string
- representation of the IPv6 host address. Thus, not all the ":"
- subnetworks will be tried.
+ A network range is matched by repeatedly truncating the last
+ ":octetpair" from the compressed-form remote IPv6 host address
+ string, until a match is found in the access table, or until
+ further truncation is not possible.
- NOTE 2: The access map lookup key must be in canonical form: do
- not specify unnecessary null characters, and do not enclose net-
- work address information with "[]" characters.
-
- NOTE 3: use the <b>cidr</b> lookup table type to specify network/net-
- mask patterns. See <a href="cidr_table.5.html"><b>cidr_table</b>(5)</a> for details.
+ NOTE: use the <b>cidr</b> lookup table type to specify network/netmask
+ patterns. See <a href="cidr_table.5.html"><b>cidr_table</b>(5)</a> for details.
IPv6 support is available in Postfix 2.2 and later.
@@ -244,7 +234,7 @@ ACCESS(5) ACCESS(5)
Send one copy of the message to the specified recipient.
If multiple BCC actions are specified within the same SMTP MAIL
- transaction, only the last action will be used.
+ transaction, with Postfix 3.0 only the last action will be used.
This feature is available in Postfix 3.0 and later.
@@ -252,158 +242,158 @@ ACCESS(5) ACCESS(5)
Claim successful delivery and silently discard the message. Log
the optional text if specified, otherwise log a generic message.
- Note: this action currently affects all recipients of the mes-
- sage. To discard only one recipient without discarding the
+ Note: this action currently affects all recipients of the mes-
+ sage. To discard only one recipient without discarding the
entire message, use the <a href="transport.5.html">transport(5)</a> table to direct mail to the
<a href="discard.8.html">discard(8)</a> service.
This feature is available in Postfix 2.0 and later.
<b>DUNNO</b> Pretend that the lookup key was not found. This prevents Postfix
- from trying substrings of the lookup key (such as a subdomain
+ from trying substrings of the lookup key (such as a subdomain
name, or a network address subnetwork).
This feature is available in Postfix 2.0 and later.
<b>FILTER</b> <i>transport:destination</i>
After the message is queued, send the entire message through the
- specified external content filter. The <i>transport</i> name specifies
- the first field of a mail delivery agent definition in <a href="master.5.html">mas-
- ter.cf</a>; the syntax of the next-hop <i>destination</i> is described in
- the manual page of the corresponding delivery agent. More
- information about external content filters is in the Postfix
+ specified external content filter. The <i>transport</i> name specifies
+ the first field of a mail delivery agent definition in <a href="master.5.html">mas-
+ ter.cf</a>; the syntax of the next-hop <i>destination</i> is described in
+ the manual page of the corresponding delivery agent. More
+ information about external content filters is in the Postfix
<a href="FILTER_README.html">FILTER_README</a> file.
- Note 1: do not use $<i>number</i> regular expression substitutions for
- <i>transport</i> or <i>destination</i> unless you know that the information
+ Note 1: do not use $<i>number</i> regular expression substitutions for
+ <i>transport</i> or <i>destination</i> unless you know that the information
has a trusted origin.
- Note 2: this action overrides the <a href="postconf.5.html">main.cf</a> <b><a href="postconf.5.html#content_filter">content_filter</a></b> set-
- ting, and affects all recipients of the message. In the case
- that multiple <b>FILTER</b> actions fire, only the last one is exe-
+ Note 2: this action overrides the <a href="postconf.5.html">main.cf</a> <b><a href="postconf.5.html#content_filter">content_filter</a></b> set-
+ ting, and affects all recipients of the message. In the case
+ that multiple <b>FILTER</b> actions fire, only the last one is exe-
cuted.
Note 3: the purpose of the FILTER command is to override message
- routing. To override the recipient's <i>transport</i> but not the
+ routing. To override the recipient's <i>transport</i> but not the
next-hop <i>destination</i>, specify an empty filter <i>destination</i> (Post-
- fix 2.7 and later), or specify a <i>transport:destination</i> that
- delivers through a different Postfix instance (Postfix 2.6 and
+ fix 2.7 and later), or specify a <i>transport:destination</i> that
+ delivers through a different Postfix instance (Postfix 2.6 and
earlier). Other options are using the recipient-dependent <b><a href="postconf.5.html#transport_maps">trans</a>-</b>
- <b><a href="postconf.5.html#transport_maps">port_maps</a></b> or the sender-dependent <b><a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default-</b>
+ <b><a href="postconf.5.html#transport_maps">port_maps</a></b> or the sender-dependent <b><a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default-</b>
<b>_transport_maps</a></b> features.
This feature is available in Postfix 2.0 and later.
<b>HOLD</b> <i>optional text...</i>
- Place the message on the <b>hold</b> queue, where it will sit until
- someone either deletes it or releases it for delivery. Log the
+ Place the message on the <b>hold</b> queue, where it will sit until
+ someone either deletes it or releases it for delivery. Log the
optional text if specified, otherwise log a generic message.
- Mail that is placed on hold can be examined with the <a href="postcat.1.html"><b>postcat</b>(1)</a>
- command, and can be destroyed or released with the <a href="postsuper.1.html"><b>postsuper</b>(1)</a>
+ Mail that is placed on hold can be examined with the <a href="postcat.1.html"><b>postcat</b>(1)</a>
+ command, and can be destroyed or released with the <a href="postsuper.1.html"><b>postsuper</b>(1)</a>
command.
- Note: use "<b>postsuper -r</b>" to release mail that was kept on hold
- for a significant fraction of <b>$<a href="postconf.5.html#maximal_queue_lifetime">maximal_queue_lifetime</a></b> or
- <b>$<a href="postconf.5.html#bounce_queue_lifetime">bounce_queue_lifetime</a></b>, or longer. Use "<b>postsuper -H</b>" only for
+ Note: use "<b>postsuper -r</b>" to release mail that was kept on hold
+ for a significant fraction of <b>$<a href="postconf.5.html#maximal_queue_lifetime">maximal_queue_lifetime</a></b> or
+ <b>$<a href="postconf.5.html#bounce_queue_lifetime">bounce_queue_lifetime</a></b>, or longer. Use "<b>postsuper -H</b>" only for
mail that will not expire within a few delivery attempts.
- Note: this action currently affects all recipients of the mes-
+ Note: this action currently affects all recipients of the mes-
sage.
This feature is available in Postfix 2.0 and later.
<b>PREPEND</b> <i>headername: headervalue</i>
- Prepend the specified message header to the message. When more
- than one PREPEND action executes, the first prepended header
+ Prepend the specified message header to the message. When more
+ than one PREPEND action executes, the first prepended header
appears before the second etc. prepended header.
- Note: this action must execute before the message content is
- received; it cannot execute in the context of
+ Note: this action must execute before the message content is
+ received; it cannot execute in the context of
<b><a href="postconf.5.html#smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a></b>.
This feature is available in Postfix 2.1 and later.
<b>REDIRECT</b> <i>user@domain</i>
- After the message is queued, send the message to the specified
+ After the message is queued, send the message to the specified
address instead of the intended recipient(s). When multiple <b>RE-</b>
<b>DIRECT</b> actions fire, only the last one takes effect.
- Note: this action overrides the FILTER action, and currently
+ Note: this action overrides the FILTER action, and currently
overrides all recipients of the message.
This feature is available in Postfix 2.1 and later.
<b>INFO</b> <i>optional text...</i>
- Log an informational record with the optional text, together
- with client information and if available, with helo, sender,
+ Log an informational record with the optional text, together
+ with client information and if available, with helo, sender,
recipient and protocol information.
This feature is available in Postfix 3.0 and later.
<b>WARN</b> <i>optional text...</i>
- Log a warning with the optional text, together with client
- information and if available, with helo, sender, recipient and
+ Log a warning with the optional text, together with client
+ information and if available, with helo, sender, recipient and
protocol information.
This feature is available in Postfix 2.1 and later.
<b>ENHANCED STATUS CODES</b>
- Postfix version 2.3 and later support enhanced status codes as defined
- in <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a>. When an enhanced status code is specified in an access
+ Postfix version 2.3 and later support enhanced status codes as defined
+ in <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a>. When an enhanced status code is specified in an access
table, it is subject to modification. The following transformations are
- needed when the same access table is used for client, helo, sender, or
- recipient access restrictions; they happen regardless of whether Post-
+ needed when the same access table is used for client, helo, sender, or
+ recipient access restrictions; they happen regardless of whether Post-
fix replies to a MAIL FROM, RCPT TO or other SMTP command.
- <b>o</b> When a sender address matches a REJECT action, the Postfix SMTP
+ <b>o</b> When a sender address matches a REJECT action, the Postfix SMTP
server will transform a recipient DSN status (e.g., 4.1.1-4.1.6)
into the corresponding sender DSN status, and vice versa.
- <b>o</b> When non-address information matches a REJECT action (such as
- the HELO command argument or the client hostname/address), the
- Postfix SMTP server will transform a sender or recipient DSN
+ <b>o</b> When non-address information matches a REJECT action (such as
+ the HELO command argument or the client hostname/address), the
+ Postfix SMTP server will transform a sender or recipient DSN
status into a generic non-address DSN status (e.g., 4.0.0).
<b>REGULAR EXPRESSION TABLES</b>
- This section describes how the table lookups change when the table is
- given in the form of regular expressions. For a description of regular
+ This section describes how the table lookups change when the table is
+ given in the form of regular expressions. For a description of regular
expression lookup table syntax, see <a href="regexp_table.5.html"><b>regexp_table</b>(5)</a> or <a href="pcre_table.5.html"><b>pcre_table</b>(5)</a>.
- Each pattern is a regular expression that is applied to the entire
+ Each pattern is a regular expression that is applied to the entire
string being looked up. Depending on the application, that string is an
- entire client hostname, an entire client IP address, or an entire mail
- address. Thus, no parent domain or parent network search is done,
- <i>user@domain</i> mail addresses are not broken up into their <i>user@</i> and
- <i>domain</i> constituent parts, nor is <i>user+foo</i> broken up into <i>user</i> and <i>foo</i>.
+ entire client hostname, an entire client IP address, or an entire mail
+ address. Thus, no parent domain or parent network search is done,
+ <i>user@domain</i> mail addresses are not broken up into their <i>user@</i> and
+ <i>domain</i> constituent parts, nor is <i>user+foo</i> broken up into <i>user</i> and <i>foo</i>.
- Patterns are applied in the order as specified in the table, until a
+ Patterns are applied in the order as specified in the table, until a
pattern is found that matches the search string.
- Actions are the same as with indexed file lookups, with the additional
- feature that parenthesized substrings from the pattern can be interpo-
+ Actions are the same as with indexed file lookups, with the additional
+ feature that parenthesized substrings from the pattern can be interpo-
lated as <b>$1</b>, <b>$2</b> and so on.
<b>TCP-BASED TABLES</b>
- This section describes how the table lookups change when lookups are
- directed to a TCP-based server. For a description of the TCP
- client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is not
+ This section describes how the table lookups change when lookups are
+ directed to a TCP-based server. For a description of the TCP
+ client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is not
available up to and including Postfix version 2.4.
- Each lookup operation uses the entire query string once. Depending on
- the application, that string is an entire client hostname, an entire
- client IP address, or an entire mail address. Thus, no parent domain
- or parent network search is done, <i>user@domain</i> mail addresses are not
- broken up into their <i>user@</i> and <i>domain</i> constituent parts, nor is
+ Each lookup operation uses the entire query string once. Depending on
+ the application, that string is an entire client hostname, an entire
+ client IP address, or an entire mail address. Thus, no parent domain
+ or parent network search is done, <i>user@domain</i> mail addresses are not
+ broken up into their <i>user@</i> and <i>domain</i> constituent parts, nor is
<i>user+foo</i> broken up into <i>user</i> and <i>foo</i>.
Actions are the same as with indexed file lookups.
<b>EXAMPLE</b>
- The following example uses an indexed file, so that the order of table
- entries does not matter. The example permits access by the client at
+ The following example uses an indexed file, so that the order of table
+ entries does not matter. The example permits access by the client at
address 1.2.3.4 but rejects all other clients in 1.2.3.0/24. Instead of
- <b>hash</b> lookup tables, some systems use <b>dbm</b>. Use the command "<b>postconf</b>
+ <b>hash</b> lookup tables, some systems use <b>dbm</b>. Use the command "<b>postconf</b>
<b>-m</b>" to find out what lookup tables Postfix supports on your system.
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
@@ -414,7 +404,7 @@ ACCESS(5) ACCESS(5)
1.2.3 REJECT
1.2.3.4 OK
- Execute the command "<b>postmap /etc/postfix/access</b>" after editing the
+ Execute the command "<b>postmap /etc/postfix/access</b>" after editing the
file.
<b>BUGS</b>
diff --git a/external/ibm-public/postfix/dist/html/aliases.5.html b/external/ibm-public/postfix/dist/html/aliases.5.html
index 834df383b05..5a8ad9a6da3 100644
--- a/external/ibm-public/postfix/dist/html/aliases.5.html
+++ b/external/ibm-public/postfix/dist/html/aliases.5.html
@@ -52,52 +52,53 @@ ALIASES(5) ALIASES(5)
or `@'. The <i>name</i> is folded to lowercase, in order to make database
lookups case insensitive.
- In addition, when an alias exists for <b>owner-</b><i>name</i>, delivery diagnostics
- are directed to that address, instead of to the originator of the mes-
- sage. This is typically used to direct delivery errors to the main-
- tainer of a mailing list, who is in a better position to deal with
- mailing list delivery problems than the originator of the undelivered
- mail.
+ In addition, when an alias exists for <b>owner-</b><i>name</i>, this will override
+ the envelope sender address, so that delivery diagnostics are directed
+ to <b>owner-</b><i>name</i>, instead of the originator of the message (for details,
+ see <b><a href="postconf.5.html#owner_request_special">owner_request_special</a></b>, <b><a href="postconf.5.html#expand_owner_alias">expand_owner_alias</a></b> and <b><a href="postconf.5.html#reset_owner_alias">reset_owner_alias</a></b>).
+ This is typically used to direct delivery errors to the maintainer of a
+ mailing list, who is in a better position to deal with mailing list
+ delivery problems than the originator of the undelivered mail.
The <i>value</i> contains one or more of the following:
<i>address</i>
- Mail is forwarded to <i>address</i>, which is compatible with the <a href="http://tools.ietf.org/html/rfc822">RFC</a>
+ Mail is forwarded to <i>address</i>, which is compatible with the <a href="http://tools.ietf.org/html/rfc822">RFC</a>
<a href="http://tools.ietf.org/html/rfc822">822</a> standard.
<i>/file/name</i>
- Mail is appended to <i>/file/name</i>. See <a href="local.8.html"><b>local</b>(8)</a> for details of
- delivery to file. Delivery is not limited to regular files.
+ Mail is appended to <i>/file/name</i>. See <a href="local.8.html"><b>local</b>(8)</a> for details of
+ delivery to file. Delivery is not limited to regular files.
For example, to dispose of unwanted mail, deflect it to
<b>/dev/null</b>.
|<i>command</i>
- Mail is piped into <i>command</i>. Commands that contain special char-
- acters, such as whitespace, should be enclosed between double
+ Mail is piped into <i>command</i>. Commands that contain special char-
+ acters, such as whitespace, should be enclosed between double
quotes. See <a href="local.8.html"><b>local</b>(8)</a> for details of delivery to command.
- When the command fails, a limited amount of command output is
- mailed back to the sender. The file <b>/usr/include/sysexits.h</b>
- defines the expected exit status codes. For example, use <b>"|exit</b>
- <b>67"</b> to simulate a "user unknown" error, and <b>"|exit 0"</b> to imple-
+ When the command fails, a limited amount of command output is
+ mailed back to the sender. The file <b>/usr/include/sysexits.h</b>
+ defines the expected exit status codes. For example, use <b>"|exit</b>
+ <b>67"</b> to simulate a "user unknown" error, and <b>"|exit 0"</b> to imple-
ment an expensive black hole.
<b>:include:</b><i>/file/name</i>
- Mail is sent to the destinations listed in the named file.
- Lines in <b>:include:</b> files have the same syntax as the right-hand
+ Mail is sent to the destinations listed in the named file.
+ Lines in <b>:include:</b> files have the same syntax as the right-hand
side of alias entries.
- A destination can be any destination that is described in this
- manual page. However, delivery to "|<i>command</i>" and <i>/file/name</i> is
- disallowed by default. To enable, edit the <b><a href="postconf.5.html#allow_mail_to_commands">allow_mail_to_com</a>-</b>
+ A destination can be any destination that is described in this
+ manual page. However, delivery to "|<i>command</i>" and <i>/file/name</i> is
+ disallowed by default. To enable, edit the <b><a href="postconf.5.html#allow_mail_to_commands">allow_mail_to_com</a>-</b>
<b><a href="postconf.5.html#allow_mail_to_commands">mands</a></b> and <b><a href="postconf.5.html#allow_mail_to_files">allow_mail_to_files</a></b> configuration parameters.
<b>ADDRESS EXTENSION</b>
- When alias database search fails, and the recipient localpart contains
- the optional recipient delimiter (e.g., <i>user+foo</i>), the search is
+ When alias database search fails, and the recipient localpart contains
+ the optional recipient delimiter (e.g., <i>user+foo</i>), the search is
repeated for the unextended address (e.g., <i>user</i>).
- The <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b> parameter controls whether an
+ The <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b> parameter controls whether an
unmatched address extension (<i>+foo</i>) is propagated to the result of table
lookup.
@@ -106,9 +107,9 @@ ALIASES(5) ALIASES(5)
before database lookup.
<b>REGULAR EXPRESSION TABLES</b>
- This section describes how the table lookups change when the table is
- given in the form of regular expressions. For a description of regular
- expression lookup table syntax, see <a href="regexp_table.5.html"><b>regexp_table</b>(5)</a> or <a href="pcre_table.5.html"><b>pcre_table</b>(5)</a>.
+ This section describes how the table lookups change when the table is
+ given in the form of regular expressions. For a description of regular
+ expression lookup table syntax, see <a href="regexp_table.5.html"><b>regexp_table</b>(5)</a> or <a href="pcre_table.5.html"><b>pcre_table</b>(5)</a>.
NOTE: these formats do not use ":" at the end of a pattern.
Each regular expression is applied to the entire search string. Thus, a
@@ -121,57 +122,59 @@ ALIASES(5) ALIASES(5)
reasons there is no support for <b>$1</b>, <b>$2</b> etc. substring interpolation.
<b>SECURITY</b>
- The <a href="local.8.html"><b>local</b>(8)</a> delivery agent disallows regular expression substitution
+ The <a href="local.8.html"><b>local</b>(8)</a> delivery agent disallows regular expression substitution
of $1 etc. in <b><a href="postconf.5.html#alias_maps">alias_maps</a></b>, because that would open a security hole.
- The <a href="local.8.html"><b>local</b>(8)</a> delivery agent will silently ignore requests to use the
- <a href="proxymap.8.html"><b>proxymap</b>(8)</a> server within <b><a href="postconf.5.html#alias_maps">alias_maps</a></b>. Instead it will open the table
+ The <a href="local.8.html"><b>local</b>(8)</a> delivery agent will silently ignore requests to use the
+ <a href="proxymap.8.html"><b>proxymap</b>(8)</a> server within <b><a href="postconf.5.html#alias_maps">alias_maps</a></b>. Instead it will open the table
directly. Before Postfix version 2.2, the <a href="local.8.html"><b>local</b>(8)</a> delivery agent will
terminate with a fatal error.
<b>CONFIGURATION PARAMETERS</b>
- The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant. The text
- below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more
+ The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant. The text
+ below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more
details including examples.
- <b><a href="postconf.5.html#alias_database">alias_database</a></b>
- List of alias databases that are updated by the <a href="newaliases.1.html"><b>newaliases</b>(1)</a>
- command.
+ <b><a href="postconf.5.html#alias_database">alias_database</a> (see 'postconf -d' output)</b>
+ The alias databases for <a href="local.8.html"><b>local</b>(8)</a> delivery that are updated with
+ "<b>newaliases</b>" or with "<b>sendmail -bi</b>".
- <b><a href="postconf.5.html#alias_maps">alias_maps</a></b>
- List of alias databases queried by the <a href="local.8.html"><b>local</b>(8)</a> delivery agent.
+ <b><a href="postconf.5.html#alias_maps">alias_maps</a> (see 'postconf -d' output)</b>
+ The alias databases that are used for <a href="local.8.html"><b>local</b>(8)</a> delivery.
- <b><a href="postconf.5.html#allow_mail_to_commands">allow_mail_to_commands</a></b>
- Restrict the usage of mail delivery to external command.
+ <b><a href="postconf.5.html#allow_mail_to_commands">allow_mail_to_commands</a> (alias, forward)</b>
+ Restrict <a href="local.8.html"><b>local</b>(8)</a> mail delivery to external commands.
- <b><a href="postconf.5.html#allow_mail_to_files">allow_mail_to_files</a></b>
- Restrict the usage of mail delivery to external file.
+ <b><a href="postconf.5.html#allow_mail_to_files">allow_mail_to_files</a> (alias, forward)</b>
+ Restrict <a href="local.8.html"><b>local</b>(8)</a> mail delivery to external files.
- <b><a href="postconf.5.html#expand_owner_alias">expand_owner_alias</a></b>
- When delivering to an alias that has an <b>owner-</b> companion alias,
- set the envelope sender address to the right-hand side of the
- owner alias, instead using of the left-hand side address.
+ <b><a href="postconf.5.html#expand_owner_alias">expand_owner_alias</a> (no)</b>
+ When delivering to an alias "<i>aliasname</i>" that has an
+ "owner-<i>aliasname</i>" companion alias, set the envelope sender
+ address to the expansion of the "owner-<i>aliasname</i>" alias.
- <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b>
- A list of address rewriting or forwarding mechanisms that propa-
- gate an address extension from the original address to the
- result. Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>, <b>for-</b>
- <b>ward</b>, <b>include</b>, or <b>generic</b>.
+ <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> (canonical, virtual)</b>
+ What address lookup tables copy an address extension from the
+ lookup key to the lookup result.
- <b><a href="postconf.5.html#owner_request_special">owner_request_special</a></b>
- Give special treatment to <b>owner-</b><i>listname</i> and <i>listname</i><b>-request</b>
- addresses.
+ <b><a href="postconf.5.html#owner_request_special">owner_request_special</a> (yes)</b>
+ Enable special treatment for owner-<i>listname</i> entries in the
+ <a href="aliases.5.html"><b>aliases</b>(5)</a> file, and don't split owner-<i>listname</i> and <i>list-</i>
+ <i>name</i>-request address localparts when the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> is
+ set to "-".
- <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a></b>
- Delimiter that separates recipients from address extensions.
+ <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b>
+ The set of characters that can separate a user name from its
+ extension (example: user+foo), or a .forward file name from its
+ extension (example: .forward+foo).
Available in Postfix version 2.3 and later:
- <b><a href="postconf.5.html#frozen_delivered_to">frozen_delivered_to</a></b>
- Update the <a href="local.8.html">local(8)</a> delivery agent's Delivered-To: address (see
- <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a>) only once, at the start of a delivery;
- do not update the Delivered-To: address while expanding aliases
- or .forward files.
+ <b><a href="postconf.5.html#frozen_delivered_to">frozen_delivered_to</a> (yes)</b>
+ Update the <a href="local.8.html"><b>local</b>(8)</a> delivery agent's idea of the Delivered-To:
+ address (see <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a>) only once, at the start
+ of a delivery attempt; do not update the Delivered-To: address
+ while expanding aliases or .forward files.
<b>STANDARDS</b>
<a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages)
diff --git a/external/ibm-public/postfix/dist/html/anvil.8.html b/external/ibm-public/postfix/dist/html/anvil.8.html
index 0ade30a8be7..c4cdc4caa0d 100644
--- a/external/ibm-public/postfix/dist/html/anvil.8.html
+++ b/external/ibm-public/postfix/dist/html/anvil.8.html
@@ -134,7 +134,7 @@ ANVIL(8) ANVIL(8)
is kept.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
Upon exit, and every <b><a href="postconf.5.html#anvil_status_update_time">anvil_status_update_time</a></b> seconds, the server logs
the maximal count and rate values measured, together with (service,
@@ -205,9 +205,13 @@ ANVIL(8) ANVIL(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="smtpd.8.html">smtpd(8)</a>, Postfix SMTP server
diff --git a/external/ibm-public/postfix/dist/html/bounce.8.html b/external/ibm-public/postfix/dist/html/bounce.8.html
index afe41dae75d..67801211a20 100644
--- a/external/ibm-public/postfix/dist/html/bounce.8.html
+++ b/external/ibm-public/postfix/dist/html/bounce.8.html
@@ -51,7 +51,7 @@ BOUNCE(8) BOUNCE(8)
<a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>CONFIGURATION PARAMETERS</b>
Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="bounce.8.html"><b>bounce</b>(8)</a> processes
@@ -139,16 +139,20 @@ BOUNCE(8) BOUNCE(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix 3.0 and later:
<b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b>
- Detect that a message requires SMTPUTF8 support for the speci-
+ Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>FILES</b>
/var/spool/postfix/bounce/* non-delivery records
/var/spool/postfix/defer/* non-delivery records
@@ -160,6 +164,7 @@ BOUNCE(8) BOUNCE(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/canonical.5.html b/external/ibm-public/postfix/dist/html/canonical.5.html
index 484b9ff550c..c54dc0962c3 100644
--- a/external/ibm-public/postfix/dist/html/canonical.5.html
+++ b/external/ibm-public/postfix/dist/html/canonical.5.html
@@ -81,20 +81,23 @@ CANONICAL(5) CANONICAL(5)
<b>TABLE SEARCH ORDER</b>
With lookups from indexed files such as DB or DBM, or from networked
- tables such as NIS, LDAP or SQL, patterns are tried in the order as
- listed below:
+ tables such as NIS, LDAP or SQL, each <i>user</i>@<i>domain</i> query produces a
+ sequence of query patterns as described below.
+
+ Each query pattern is sent to each specified lookup table before trying
+ the next query pattern, until a match is found.
<i>user</i>@<i>domain address</i>
Replace <i>user</i>@<i>domain</i> by <i>address</i>. This form has the highest prece-
dence.
- This is useful to clean up addresses produced by legacy mail
- systems. It can also be used to produce <i>Firstname.Lastname</i>
+ This is useful to clean up addresses produced by legacy mail
+ systems. It can also be used to produce <i>Firstname.Lastname</i>
style addresses, but see below for a simpler solution.
<i>user address</i>
- Replace <i>user</i>@<i>site</i> by <i>address</i> when <i>site</i> is equal to $<b><a href="postconf.5.html#myorigin">myorigin</a></b>,
- when <i>site</i> is listed in $<b><a href="postconf.5.html#mydestination">mydestination</a></b>, or when it is listed in
+ Replace <i>user</i>@<i>site</i> by <i>address</i> when <i>site</i> is equal to $<b><a href="postconf.5.html#myorigin">myorigin</a></b>,
+ when <i>site</i> is listed in $<b><a href="postconf.5.html#mydestination">mydestination</a></b>, or when it is listed in
$<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b> or $<b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b>.
This form is useful for replacing login names by <i>Firstname.Last-</i>
@@ -104,14 +107,28 @@ CANONICAL(5) CANONICAL(5)
Replace other addresses in <i>domain</i> by <i>address</i>. This form has the
lowest precedence.
- Note: @<i>domain</i> is a wild-card. When this form is applied to
- recipient addresses, the Postfix SMTP server accepts mail for
- any recipient in <i>domain</i>, regardless of whether that recipient
- exists. This may turn your mail system into a backscatter
- source: Postfix first accepts mail for non-existent recipients
- and then tries to return that mail as "undeliverable" to the
+ Note: @<i>domain</i> is a wild-card. When this form is applied to
+ recipient addresses, the Postfix SMTP server accepts mail for
+ any recipient in <i>domain</i>, regardless of whether that recipient
+ exists. This may turn your mail system into a backscatter
+ source: Postfix first accepts mail for non-existent recipients
+ and then tries to return that mail as "undeliverable" to the
often forged sender address.
+ To avoid backscatter with mail for a wild-card domain, replace
+ the wild-card mapping with explicit 1:1 mappings, or add a
+ <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> restriction for that domain:
+
+ <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
+ ...
+ <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
+ <a href="postconf.5.html#check_recipient_access">check_recipient_access</a>
+ <a href="DATABASE_README.html#types">inline</a>:{example.com=<a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>}
+ <a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> = 550
+
+ In the above example, Postfix may contact a remote server if the
+ recipient is rewritten to a remote address.
+
<b>RESULT ADDRESS REWRITING</b>
The lookup result is subject to address rewriting:
@@ -170,34 +187,33 @@ CANONICAL(5) CANONICAL(5)
below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more
details including examples.
- <b><a href="postconf.5.html#canonical_classes">canonical_classes</a></b>
- What addresses are subject to canonical address mapping.
+ <b><a href="postconf.5.html#canonical_classes">canonical_classes</a> (envelope_sender, envelope_recipient, header_sender,</b>
+ <b>header_recipient)</b>
+ What addresses are subject to <a href="postconf.5.html#canonical_maps">canonical_maps</a> address mapping.
- <b><a href="postconf.5.html#canonical_maps">canonical_maps</a></b>
- List of canonical mapping tables.
+ <b><a href="postconf.5.html#canonical_maps">canonical_maps</a> (empty)</b>
+ Optional address mapping lookup tables for message headers and
+ envelopes.
- <b><a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a></b>
- Address mapping lookup table for envelope and header recipient
- addresses.
+ <b><a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> (empty)</b>
+ Optional address mapping lookup tables for envelope and header
+ recipient addresses.
- <b><a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a></b>
- Address mapping lookup table for envelope and header sender
- addresses.
+ <b><a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> (empty)</b>
+ Optional address mapping lookup tables for envelope and header
+ sender addresses.
- <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b>
- A list of address rewriting or forwarding mechanisms that propa-
- gate an address extension from the original address to the
- result. Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>, <b>for-</b>
- <b>ward</b>, <b>include</b>, or <b>generic</b>.
+ <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> (canonical, virtual)</b>
+ What address lookup tables copy an address extension from the
+ lookup key to the lookup result.
Other parameters of interest:
- <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b>
- The network interface addresses that this system receives mail
- on. You need to stop and start Postfix when this parameter
- changes.
+ <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b>
+ The network interface addresses that this mail system receives
+ mail on.
- <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a></b>
+ <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> (<a href="postconf.5.html#permit_inet_interfaces">permit_inet_interfaces</a>)</b>
Rewrite message header addresses in mail from these clients and
update incomplete addresses with the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or
$<a href="postconf.5.html#mydomain">mydomain</a>; either don't rewrite message headers from other
@@ -205,33 +221,39 @@ CANONICAL(5) CANONICAL(5)
addresses with the domain specified in the <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_re</a>-
<a href="postconf.5.html#remote_header_rewrite_domain">write_domain</a> parameter.
- <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b>
- Other interfaces that this machine receives mail on by way of a
- proxy agent or network address translator.
+ <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b>
+ The network interface addresses that this mail system receives
+ mail on by way of a proxy or network address translation unit.
- <b><a href="postconf.5.html#masquerade_classes">masquerade_classes</a></b>
- List of address classes subject to masquerading: zero or more of
- <b>envelope_sender</b>, <b>envelope_recipient</b>, <b>header_sender</b>,
- <b>header_recipient</b>.
+ <b><a href="postconf.5.html#masquerade_classes">masquerade_classes</a> (envelope_sender, header_sender, header_recipient)</b>
+ What addresses are subject to address masquerading.
- <b><a href="postconf.5.html#masquerade_domains">masquerade_domains</a></b>
- List of domains that hide their subdomain structure.
+ <b><a href="postconf.5.html#masquerade_domains">masquerade_domains</a> (empty)</b>
+ Optional list of domains whose subdomain structure will be
+ stripped off in email addresses.
- <b><a href="postconf.5.html#masquerade_exceptions">masquerade_exceptions</a></b>
- List of user names that are not subject to address masquerading.
+ <b><a href="postconf.5.html#masquerade_exceptions">masquerade_exceptions</a> (empty)</b>
+ Optional list of user names that are not subjected to address
+ masquerading, even when their address matches $<a href="postconf.5.html#masquerade_domains">masquer</a>-
+ <a href="postconf.5.html#masquerade_domains">ade_domains</a>.
- <b><a href="postconf.5.html#mydestination">mydestination</a></b>
- List of domains that this mail system considers local.
+ <b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b>
+ The list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a>
+ mail delivery transport.
- <b><a href="postconf.5.html#myorigin">myorigin</a></b>
- The domain that is appended to locally-posted mail.
+ <b><a href="postconf.5.html#myorigin">myorigin</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
+ The domain name that locally-posted mail appears to come from,
+ and that locally posted mail is delivered to.
- <b><a href="postconf.5.html#owner_request_special">owner_request_special</a></b>
- Give special treatment to <b>owner-</b><i>xxx</i> and <i>xxx</i><b>-request</b> addresses.
+ <b><a href="postconf.5.html#owner_request_special">owner_request_special</a> (yes)</b>
+ Enable special treatment for owner-<i>listname</i> entries in the
+ <a href="aliases.5.html"><b>aliases</b>(5)</a> file, and don't split owner-<i>listname</i> and <i>list-</i>
+ <i>name</i>-request address localparts when the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> is
+ set to "-".
- <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a></b>
- Don't rewrite message headers from remote clients at all when
- this parameter is empty; otherwise, rewrite message headers and
+ <b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> (empty)</b>
+ Don't rewrite message headers from remote clients at all when
+ this parameter is empty; otherwise, rewrite message headers and
append the specified domain name to incomplete addresses.
<b>SEE ALSO</b>
diff --git a/external/ibm-public/postfix/dist/html/cidr_table.5.html b/external/ibm-public/postfix/dist/html/cidr_table.5.html
index 67b6ceb6c5f..879a792ea81 100644
--- a/external/ibm-public/postfix/dist/html/cidr_table.5.html
+++ b/external/ibm-public/postfix/dist/html/cidr_table.5.html
@@ -30,30 +30,39 @@ CIDR_TABLE(5) CIDR_TABLE(5)
<b>TABLE FORMAT</b>
The general form of a Postfix CIDR table is:
- <i>network</i><b>_</b><i>address</i><b>/</b><i>network</i><b>_</b><i>mask result</i>
- When a search string matches the specified network block, use
- the corresponding <i>result</i> value. Specify 0.0.0.0/0 to match every
- IPv4 address, and ::/0 to match every IPv6 address.
+ <i>pattern result</i>
+ When a search string matches the specified <i>pattern</i>, use the cor-
+ responding <i>result</i> value. The <i>pattern</i> must be in <i>network/prefix</i>
+ or <i>network</i><b>_</b><i>address</i> form (see ADDRESS PATTERN SYNTAX below).
- An IPv4 network address is a sequence of four decimal octets
- separated by ".", and an IPv6 network address is a sequence of
- three to eight hexadecimal octet pairs separated by ":".
+ <b>!</b><i>pattern result</i>
+ When a search string does not match the specified <i>pattern</i>, use
+ the specified <i>result</i> value. The <i>pattern</i> must be in <i>network/pre-</i>
+ <i>fix</i> or <i>network</i><b>_</b><i>address</i> form (see ADDRESS PATTERN SYNTAX below).
- The <i>network</i><b>_</b><i>mask</i> is the number of high-order bits in the <i>net-</i>
- <i>work</i><b>_</b><i>address</i> that the search string must match.
+ This feature is available in Postfix 3.2 and later.
- Before comparisons are made, lookup keys and table entries are
- converted from string to binary. Therefore table entries will be
- matched regardless of redundant zero characters.
+ <b>if</b> <i>pattern</i>
- Note: address information may be enclosed inside "[]" but this
- form is not required.
+ <b>endif</b> When a search string matches the specified <i>pattern</i>, match that
+ search string against the patterns between <b>if</b> and <b>endif</b>. The
+ <i>pattern</i> must be in <i>network/prefix</i> or <i>network</i><b>_</b><i>address</i> form (see
+ ADDRESS PATTERN SYNTAX below). The <b>if</b>..<b>endif</b> can nest.
- IPv6 support is available in Postfix 2.2 and later.
+ Note: do not prepend whitespace to text between <b>if</b>..<b>endif</b>.
- <i>network</i><b>_</b><i>address result</i>
- When a search string matches the specified network address, use
- the corresponding <i>result</i> value.
+ This feature is available in Postfix 3.2 and later.
+
+ <b>if !</b><i>pattern</i>
+
+ <b>endif</b> When a search string does not match the specified <i>pattern</i>, match
+ that search string against the patterns between <b>if</b> and <b>endif</b>.
+ The <i>pattern</i> must be in <i>network/prefix</i> or <i>network</i><b>_</b><i>address</i> form
+ (see ADDRESS PATTERN SYNTAX below). The <b>if</b>..<b>endif</b> can nest.
+
+ Note: do not prepend whitespace to text between <b>if</b>..<b>endif</b>.
+
+ This feature is available in Postfix 3.2 and later.
blank lines and comments
Empty lines and whitespace-only lines are ignored, as are lines
@@ -67,6 +76,28 @@ CIDR_TABLE(5) CIDR_TABLE(5)
Patterns are applied in the order as specified in the table, until a
pattern is found that matches the search string.
+<b>ADDRESS PATTERN SYNTAX</b>
+ Postfix CIDR tables are pattern-based. A pattern is either a <i>net-</i>
+ <i>work</i><b>_</b><i>address</i> which requires an exact match, or a <i>network</i><b>_</b><i>address/pre-</i>
+ <i>fix</i><b>_</b><i>length</i> where the <i>prefix</i><b>_</b><i>length</i> part specifies the length of the
+ <i>network</i><b>_</b><i>address</i> prefix that must be matched (the other bits in the <i>net-</i>
+ <i>work</i><b>_</b><i>address</i> part must be zero).
+
+ An IPv4 network address is a sequence of four decimal octets separated
+ by ".", and an IPv6 network address is a sequence of three to eight
+ hexadecimal octet pairs separated by ":" or "::", where the latter is
+ short-hand for a sequence of one or more all-zero octet pairs. The pat-
+ tern 0.0.0.0/0 matches every IPv4 address, and ::/0 matches every IPv6
+ address. IPv6 support is available in Postfix 2.2 and later.
+
+ Before comparisons are made, lookup keys and table entries are con-
+ verted from string to binary. Therefore, IPv6 patterns will be matched
+ regardless of leading zeros (a leading zero in an IPv4 address octet
+ indicates octal notation).
+
+ Note: address information may be enclosed inside "[]" but this form is
+ not required.
+
<b>EXAMPLE SMTPD ACCESS MAP</b>
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = ... <a href="cidr_table.5.html">cidr</a>:/etc/postfix/client.cidr ...
@@ -76,6 +107,8 @@ CIDR_TABLE(5) CIDR_TABLE(5)
# before more general blacklist entries.
192.168.1.1 OK
192.168.0.0/16 REJECT
+ 2001:db8::1 OK
+ 2001:db8::/32 REJECT
<b>SEE ALSO</b>
<a href="postmap.1.html">postmap(1)</a>, Postfix lookup table manager
diff --git a/external/ibm-public/postfix/dist/html/cleanup.8.html b/external/ibm-public/postfix/dist/html/cleanup.8.html
index 329115f7ef3..a525ddc1939 100644
--- a/external/ibm-public/postfix/dist/html/cleanup.8.html
+++ b/external/ibm-public/postfix/dist/html/cleanup.8.html
@@ -61,7 +61,7 @@ CLEANUP(8) CLEANUP(8)
<a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> (Internet Message Format)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
Table-driven rewriting rules make it hard to express <b>if then else</b> and
@@ -310,7 +310,7 @@ CLEANUP(8) CLEANUP(8)
<b><a href="postconf.5.html#masquerade_exceptions">masquerade_exceptions</a> (empty)</b>
Optional list of user names that are not subjected to address
- masquerading, even when their address matches $<a href="postconf.5.html#masquerade_domains">masquer</a>-
+ masquerading, even when their addresses match $<a href="postconf.5.html#masquerade_domains">masquer</a>-
<a href="postconf.5.html#masquerade_domains">ade_domains</a>.
<b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> (canonical, virtual)</b>
@@ -414,6 +414,13 @@ CLEANUP(8) CLEANUP(8)
Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b>
+ Enable 'transitional' compatibility between IDNA2003 and
+ IDNA2008, when converting UTF-8 domain names to/from the ASCII
+ form that is used for DNS lookups.
+
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
@@ -467,14 +474,26 @@ CLEANUP(8) CLEANUP(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a> (yes)</b>
- Enable support for the X-Original-To message header.
+ Enable support for the original recipient address after an
+ address is rewritten to a different address (for example with
+ aliasing or with canonical mapping).
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
<b>FILES</b>
/etc/postfix/canonical*, canonical mapping table
@@ -490,6 +509,7 @@ CLEANUP(8) CLEANUP(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/defer.8.html b/external/ibm-public/postfix/dist/html/defer.8.html
index afe41dae75d..67801211a20 100644
--- a/external/ibm-public/postfix/dist/html/defer.8.html
+++ b/external/ibm-public/postfix/dist/html/defer.8.html
@@ -51,7 +51,7 @@ BOUNCE(8) BOUNCE(8)
<a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>CONFIGURATION PARAMETERS</b>
Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="bounce.8.html"><b>bounce</b>(8)</a> processes
@@ -139,16 +139,20 @@ BOUNCE(8) BOUNCE(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix 3.0 and later:
<b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b>
- Detect that a message requires SMTPUTF8 support for the speci-
+ Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>FILES</b>
/var/spool/postfix/bounce/* non-delivery records
/var/spool/postfix/defer/* non-delivery records
@@ -160,6 +164,7 @@ BOUNCE(8) BOUNCE(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/discard.8.html b/external/ibm-public/postfix/dist/html/discard.8.html
index ec62e5b799d..8523adc4a93 100644
--- a/external/ibm-public/postfix/dist/html/discard.8.html
+++ b/external/ibm-public/postfix/dist/html/discard.8.html
@@ -36,7 +36,7 @@ DISCARD(8) DISCARD(8)
<a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces and of other trouble.
@@ -90,9 +90,13 @@ DISCARD(8) DISCARD(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="qmgr.8.html">qmgr(8)</a>, queue manager
@@ -101,6 +105,7 @@ DISCARD(8) DISCARD(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/dnsblog.8.html b/external/ibm-public/postfix/dist/html/dnsblog.8.html
index 6b29cccb85d..a2710dc1ef6 100644
--- a/external/ibm-public/postfix/dist/html/dnsblog.8.html
+++ b/external/ibm-public/postfix/dist/html/dnsblog.8.html
@@ -24,26 +24,27 @@ DNSBLOG(8) DNSBLOG(8)
match and replies with the query arguments plus an address list with
the resulting IP addresses, separated by whitespace, and the reply TTL.
Otherwise it replies with the query arguments plus an empty address
- list and the reply TTL (-1 if unavailable). Finally, The <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a>
+ list and the reply TTL; the reply TTL is -1 if there is no reply, or a
+ negative reply that contains no SOA record. Finally, the <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a>
server closes the connection.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>CONFIGURATION PARAMETERS</b>
Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> processes
run for only a limited amount of time. Use the command "<b>postfix reload</b>"
to speed up a change.
- The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
+ The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
more details including examples.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b>
- How much time a Postfix daemon process may take to handle a
+ How much time a Postfix daemon process may take to handle a
request before it is terminated by a built-in watchdog timer.
<b><a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> (empty)</b>
@@ -51,7 +52,7 @@ DNSBLOG(8) DNSBLOG(8)
factors.
<b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b>
- The time limit for sending or receiving information over an
+ The time limit for sending or receiving information over an
internal communication channel.
<b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
@@ -67,14 +68,19 @@ DNSBLOG(8) DNSBLOG(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="smtpd.8.html">smtpd(8)</a>, Postfix SMTP server
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
- syslogd(5), system logging
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
+ syslogd(8), system logging
<b>LICENSE</b>
The Secure Mailer license must be distributed with this software.
diff --git a/external/ibm-public/postfix/dist/html/error.8.html b/external/ibm-public/postfix/dist/html/error.8.html
index dbda16ceef7..a2096fe2ff8 100644
--- a/external/ibm-public/postfix/dist/html/error.8.html
+++ b/external/ibm-public/postfix/dist/html/error.8.html
@@ -37,7 +37,7 @@ ERROR(8) ERROR(8)
<a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces and of other trouble.
@@ -103,9 +103,13 @@ ERROR(8) ERROR(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="qmgr.8.html">qmgr(8)</a>, queue manager
@@ -114,6 +118,7 @@ ERROR(8) ERROR(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/flush.8.html b/external/ibm-public/postfix/dist/html/flush.8.html
index 1c67b93896b..a14f8186760 100644
--- a/external/ibm-public/postfix/dist/html/flush.8.html
+++ b/external/ibm-public/postfix/dist/html/flush.8.html
@@ -61,7 +61,7 @@ FLUSH(8) FLUSH(8)
can run chrooted at fixed low privilege.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
Fast flush logfiles are truncated only after a "send" request, not when
@@ -135,9 +135,13 @@ FLUSH(8) FLUSH(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>FILES</b>
/var/spool/postfix/flush, "fast flush" logfiles.
@@ -148,6 +152,7 @@ FLUSH(8) FLUSH(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/generic.5.html b/external/ibm-public/postfix/dist/html/generic.5.html
index 39b9adaa465..17d31d57257 100644
--- a/external/ibm-public/postfix/dist/html/generic.5.html
+++ b/external/ibm-public/postfix/dist/html/generic.5.html
@@ -70,16 +70,19 @@ GENERIC(5) GENERIC(5)
<b>TABLE SEARCH ORDER</b>
With lookups from indexed files such as DB or DBM, or from networked
- tables such as NIS, LDAP or SQL, patterns are tried in the order as
- listed below:
+ tables such as NIS, LDAP or SQL, each <i>user</i>@<i>domain</i> query produces a
+ sequence of query patterns as described below.
+
+ Each query pattern is sent to each specified lookup table before trying
+ the next query pattern, until a match is found.
<i>user</i>@<i>domain address</i>
Replace <i>user</i>@<i>domain</i> by <i>address</i>. This form has the highest prece-
dence.
<i>user address</i>
- Replace <i>user</i>@<i>site</i> by <i>address</i> when <i>site</i> is equal to $<b><a href="postconf.5.html#myorigin">myorigin</a></b>,
- when <i>site</i> is listed in $<b><a href="postconf.5.html#mydestination">mydestination</a></b>, or when it is listed in
+ Replace <i>user</i>@<i>site</i> by <i>address</i> when <i>site</i> is equal to $<b><a href="postconf.5.html#myorigin">myorigin</a></b>,
+ when <i>site</i> is listed in $<b><a href="postconf.5.html#mydestination">mydestination</a></b>, or when it is listed in
$<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b> or $<b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b>.
@<i>domain address</i>
@@ -89,10 +92,10 @@ GENERIC(5) GENERIC(5)
<b>RESULT ADDRESS REWRITING</b>
The lookup result is subject to address rewriting:
- <b>o</b> When the result has the form @<i>otherdomain</i>, the result becomes
+ <b>o</b> When the result has the form @<i>otherdomain</i>, the result becomes
the same <i>user</i> in <i>otherdomain</i>.
- <b>o</b> When "<b><a href="postconf.5.html#append_at_myorigin">append_at_myorigin</a>=yes</b>", append "<b>@$<a href="postconf.5.html#myorigin">myorigin</a></b>" to addresses
+ <b>o</b> When "<b><a href="postconf.5.html#append_at_myorigin">append_at_myorigin</a>=yes</b>", append "<b>@$<a href="postconf.5.html#myorigin">myorigin</a></b>" to addresses
without "@domain".
<b>o</b> When "<b><a href="postconf.5.html#append_dot_mydomain">append_dot_mydomain</a>=yes</b>", append "<b>.$<a href="postconf.5.html#mydomain">mydomain</a></b>" to addresses
@@ -100,45 +103,45 @@ GENERIC(5) GENERIC(5)
<b>ADDRESS EXTENSION</b>
When a mail address localpart contains the optional recipient delimiter
- (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order becomes: <i>user+foo</i>@<i>domain</i>,
+ (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order becomes: <i>user+foo</i>@<i>domain</i>,
<i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and @<i>domain</i>.
- The <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b> parameter controls whether an
+ The <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b> parameter controls whether an
unmatched address extension (<i>+foo</i>) is propagated to the result of table
lookup.
<b>REGULAR EXPRESSION TABLES</b>
- This section describes how the table lookups change when the table is
- given in the form of regular expressions. For a description of regular
+ This section describes how the table lookups change when the table is
+ given in the form of regular expressions. For a description of regular
expression lookup table syntax, see <a href="regexp_table.5.html"><b>regexp_table</b>(5)</a> or <a href="pcre_table.5.html"><b>pcre_table</b>(5)</a>.
- Each pattern is a regular expression that is applied to the entire
- address being looked up. Thus, <i>user@domain</i> mail addresses are not bro-
- ken up into their <i>user</i> and <i>@domain</i> constituent parts, nor is <i>user+foo</i>
+ Each pattern is a regular expression that is applied to the entire
+ address being looked up. Thus, <i>user@domain</i> mail addresses are not bro-
+ ken up into their <i>user</i> and <i>@domain</i> constituent parts, nor is <i>user+foo</i>
broken up into <i>user</i> and <i>foo</i>.
- Patterns are applied in the order as specified in the table, until a
+ Patterns are applied in the order as specified in the table, until a
pattern is found that matches the search string.
- Results are the same as with indexed file lookups, with the additional
- feature that parenthesized substrings from the pattern can be interpo-
+ Results are the same as with indexed file lookups, with the additional
+ feature that parenthesized substrings from the pattern can be interpo-
lated as <b>$1</b>, <b>$2</b> and so on.
<b>TCP-BASED TABLES</b>
- This section describes how the table lookups change when lookups are
- directed to a TCP-based server. For a description of the TCP
- client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is not
+ This section describes how the table lookups change when lookups are
+ directed to a TCP-based server. For a description of the TCP
+ client/server lookup protocol, see <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>. This feature is not
available up to and including Postfix version 2.4.
- Each lookup operation uses the entire address once. Thus, <i>user@domain</i>
- mail addresses are not broken up into their <i>user</i> and <i>@domain</i> con-
+ Each lookup operation uses the entire address once. Thus, <i>user@domain</i>
+ mail addresses are not broken up into their <i>user</i> and <i>@domain</i> con-
stituent parts, nor is <i>user+foo</i> broken up into <i>user</i> and <i>foo</i>.
Results are the same as with indexed file lookups.
<b>EXAMPLE</b>
- The following shows a generic mapping with an indexed file. When mail
- is sent to a remote host via SMTP, this replaces <i>his@localdomain.local</i>
+ The following shows a generic mapping with an indexed file. When mail
+ is sent to a remote host via SMTP, this replaces <i>his@localdomain.local</i>
by his ISP mail address, replaces <i>her@localdomain.local</i> by her ISP mail
address, and replaces other local addresses by his ISP account, with an
address extension of <i>+local</i> (this example assumes that the ISP supports
@@ -152,38 +155,38 @@ GENERIC(5) GENERIC(5)
her@localdomain.local heraccount@herisp.example
@localdomain.local hisaccount+local@hisisp.example
- Execute the command "<b>postmap /etc/postfix/generic</b>" whenever the table
- is changed. Instead of <b>hash</b>, some systems use <b>dbm</b> database files. To
- find out what tables your system supports use the command "<b>postconf</b>
+ Execute the command "<b>postmap /etc/postfix/generic</b>" whenever the table
+ is changed. Instead of <b>hash</b>, some systems use <b>dbm</b> database files. To
+ find out what tables your system supports use the command "<b>postconf</b>
<b>-m</b>".
<b>BUGS</b>
The table format does not understand quoting conventions.
<b>CONFIGURATION PARAMETERS</b>
- The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant. The text
- below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more
+ The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant. The text
+ below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more
details including examples.
<b><a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a></b>
- Address mapping lookup table for envelope and header sender and
+ Address mapping lookup table for envelope and header sender and
recipient addresses while delivering mail via SMTP.
<b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b>
A list of address rewriting or forwarding mechanisms that propa-
- gate an address extension from the original address to the
+ gate an address extension from the original address to the
result. Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>, <b>for-</b>
<b>ward</b>, <b>include</b>, or <b>generic</b>.
Other parameters of interest:
<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b>
- The network interface addresses that this system receives mail
- on. You need to stop and start Postfix when this parameter
+ The network interface addresses that this system receives mail
+ on. You need to stop and start Postfix when this parameter
changes.
<b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b>
- Other interfaces that this machine receives mail on by way of a
+ Other interfaces that this machine receives mail on by way of a
proxy agent or network address translator.
<b><a href="postconf.5.html#mydestination">mydestination</a></b>
diff --git a/external/ibm-public/postfix/dist/html/header_checks.5.html b/external/ibm-public/postfix/dist/html/header_checks.5.html
index dce6f7cc61a..caf15b5315a 100644
--- a/external/ibm-public/postfix/dist/html/header_checks.5.html
+++ b/external/ibm-public/postfix/dist/html/header_checks.5.html
@@ -260,7 +260,7 @@ HEADER_CHECKS(5) HEADER_CHECKS(5)
This feature is not supported with smtp header/body checks.
<b>IGNORE</b> Delete the current line from the input, and inspect the next
- input line.
+ input line. See <b>STRIP</b> for an alternative that logs the action.
<b>INFO</b> <i>optional text...</i>
Log an "info:" record with the <i>optional text...</i> (or log a
@@ -269,22 +269,34 @@ HEADER_CHECKS(5) HEADER_CHECKS(5)
This feature is available in Postfix 2.8 and later.
+ <b>PASS</b> <i>optional text...</i>
+ Log a "pass:" record with the <i>optional text...</i> (or log a generic
+ text), and turn off header, body, and Milter inspection for the
+ remainder of this message.
+
+ Note: this feature relies on trust in information that is easy
+ to forge.
+
+ This feature is available in Postfix 3.2 and later.
+
+ This feature is not supported with smtp header/body checks.
+
<b>PREPEND</b> <i>text...</i>
- Prepend one line with the specified text, and inspect the next
+ Prepend one line with the specified text, and inspect the next
input line.
Notes:
- <b>o</b> The prepended text is output on a separate line, immedi-
+ <b>o</b> The prepended text is output on a separate line, immedi-
ately before the input that triggered the <b>PREPEND</b> action.
- <b>o</b> The prepended text is not considered part of the input
- stream: it is not subject to header/body checks or
- address rewriting, and it does not affect the way that
+ <b>o</b> The prepended text is not considered part of the input
+ stream: it is not subject to header/body checks or
+ address rewriting, and it does not affect the way that
Postfix adds missing message headers.
- <b>o</b> When prepending text before a message header line, the
- prepended text must begin with a valid message header
+ <b>o</b> When prepending text before a message header line, the
+ prepended text must begin with a valid message header
label.
<b>o</b> This action cannot be used to prepend multi-line text.
@@ -294,13 +306,13 @@ HEADER_CHECKS(5) HEADER_CHECKS(5)
This feature is not supported with <a href="postconf.5.html#milter_header_checks">milter_header_checks</a>.
<b>REDIRECT</b> <i>user@domain</i>
- Write a message redirection request to the queue file, and
- inspect the next input line. After the message is queued, it
- will be sent to the specified address instead of the intended
+ Write a message redirection request to the queue file, and
+ inspect the next input line. After the message is queued, it
+ will be sent to the specified address instead of the intended
recipient(s).
- Note: this action overrides the <b>FILTER</b> action, and affects all
- recipients of the message. If multiple <b>REDIRECT</b> actions fire,
+ Note: this action overrides the <b>FILTER</b> action, and affects all
+ recipients of the message. If multiple <b>REDIRECT</b> actions fire,
only the last one is executed.
This feature is available in Postfix 2.1 and later.
@@ -308,7 +320,7 @@ HEADER_CHECKS(5) HEADER_CHECKS(5)
This feature is not supported with smtp header/body checks.
<b>REPLACE</b> <i>text...</i>
- Replace the current line with the specified text, and inspect
+ Replace the current line with the specified text, and inspect
the next input line.
This feature is available in Postfix 2.2 and later. The descrip-
@@ -316,65 +328,72 @@ HEADER_CHECKS(5) HEADER_CHECKS(5)
Notes:
- <b>o</b> When replacing a message header line, the replacement
+ <b>o</b> When replacing a message header line, the replacement
text must begin with a valid header label.
- <b>o</b> The replaced text remains part of the input stream.
- Unlike the result from the <b>PREPEND</b> action, a replaced
- message header may be subject to address rewriting and
- may affect the way that Postfix adds missing message
+ <b>o</b> The replaced text remains part of the input stream.
+ Unlike the result from the <b>PREPEND</b> action, a replaced
+ message header may be subject to address rewriting and
+ may affect the way that Postfix adds missing message
headers.
<b>REJECT</b> <i>optional text...</i>
- Reject the entire message. Do not inspect the remainder of the
- input message. Reply with <i>optional text...</i> when the optional
+ Reject the entire message. Do not inspect the remainder of the
+ input message. Reply with <i>optional text...</i> when the optional
text is specified, otherwise reply with a generic error message.
Note: this action disables further header or <a href="postconf.5.html#body_checks">body_checks</a> inspec-
tion of the current message and affects all recipients.
- Postfix version 2.3 and later support enhanced status codes.
- When no code is specified at the beginning of <i>optional text...</i>,
+ Postfix version 2.3 and later support enhanced status codes.
+ When no code is specified at the beginning of <i>optional text...</i>,
Postfix inserts a default enhanced status code of "5.7.1".
This feature is not supported with smtp header/body checks.
+ <b>STRIP</b> <i>optional text...</i>
+ Log a "strip:" record with the <i>optional text...</i> (or log a
+ generic text), delete the input line from the input, and inspect
+ the next input line. See <b>IGNORE</b> for a silent alternative.
+
+ This feature is available in Postfix 3.2 and later.
+
<b>WARN</b> <i>optional text...</i>
- Log a "warning:" record with the <i>optional text...</i> (or log a
- generic text), and inspect the next input line. This action is
- useful for debugging and for testing a pattern before applying
+ Log a "warning:" record with the <i>optional text...</i> (or log a
+ generic text), and inspect the next input line. This action is
+ useful for debugging and for testing a pattern before applying
more drastic actions.
<b>BUGS</b>
Empty lines never match, because some map types mis-behave when given a
- zero-length search string. This limitation may be removed for regular
+ zero-length search string. This limitation may be removed for regular
expression tables in a future release.
- Many people overlook the main limitations of header and <a href="postconf.5.html#body_checks">body_checks</a>
+ Many people overlook the main limitations of header and <a href="postconf.5.html#body_checks">body_checks</a>
rules.
- <b>o</b> These rules operate on one logical message header or one body
+ <b>o</b> These rules operate on one logical message header or one body
line at a time. A decision made for one line is not carried over
to the next line.
<b>o</b> If text in the message body is encoded (<a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a>) then the rules
need to be specified for the encoded form.
- <b>o</b> Likewise, when message headers are encoded (<a href="http://tools.ietf.org/html/rfc2047">RFC 2047</a>) then the
+ <b>o</b> Likewise, when message headers are encoded (<a href="http://tools.ietf.org/html/rfc2047">RFC 2047</a>) then the
rules need to be specified for the encoded form.
Message headers added by the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon itself are excluded from
- inspection. Examples of such message headers are <b>From:</b>, <b>To:</b>, <b>Mes-</b>
+ inspection. Examples of such message headers are <b>From:</b>, <b>To:</b>, <b>Mes-</b>
<b>sage-ID:</b>, <b>Date:</b>.
- Message headers deleted by the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon will be examined
- before they are deleted. Examples are: <b>Bcc:</b>, <b>Content-Length:</b>,
+ Message headers deleted by the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon will be examined
+ before they are deleted. Examples are: <b>Bcc:</b>, <b>Content-Length:</b>,
<b>Return-Path:</b>.
<b>CONFIGURATION PARAMETERS</b>
<b><a href="postconf.5.html#body_checks">body_checks</a></b>
- Lookup tables with content filter rules for message body lines.
- These filters see one physical line at a time, in chunks of at
+ Lookup tables with content filter rules for message body lines.
+ These filters see one physical line at a time, in chunks of at
most <b>$<a href="postconf.5.html#line_length_limit">line_length_limit</a></b> bytes.
<b><a href="postconf.5.html#body_checks_size_limit">body_checks_size_limit</a></b>
@@ -386,31 +405,31 @@ HEADER_CHECKS(5) HEADER_CHECKS(5)
<b><a href="postconf.5.html#mime_header_checks">mime_header_checks</a></b> (default: <b>$<a href="postconf.5.html#header_checks">header_checks</a></b>)
<b><a href="postconf.5.html#nested_header_checks">nested_header_checks</a></b> (default: <b>$<a href="postconf.5.html#header_checks">header_checks</a></b>)
- Lookup tables with content filter rules for message header
- lines: respectively, these are applied to the initial message
- headers (not including MIME headers), to the MIME headers any-
- where in the message, and to the initial headers of attached
+ Lookup tables with content filter rules for message header
+ lines: respectively, these are applied to the initial message
+ headers (not including MIME headers), to the MIME headers any-
+ where in the message, and to the initial headers of attached
messages.
- Note: these filters see one logical message header at a time,
+ Note: these filters see one logical message header at a time,
even when a message header spans multiple lines. Message headers
- that are longer than <b>$<a href="postconf.5.html#header_size_limit">header_size_limit</a></b> characters are trun-
+ that are longer than <b>$<a href="postconf.5.html#header_size_limit">header_size_limit</a></b> characters are trun-
cated.
<b><a href="postconf.5.html#disable_mime_input_processing">disable_mime_input_processing</a></b>
- While receiving mail, give no special treatment to MIME related
- message headers; all text after the initial message headers is
- considered to be part of the message body. This means that
+ While receiving mail, give no special treatment to MIME related
+ message headers; all text after the initial message headers is
+ considered to be part of the message body. This means that
<b><a href="postconf.5.html#header_checks">header_checks</a></b> is applied to all the initial message headers, and
that <b><a href="postconf.5.html#body_checks">body_checks</a></b> is applied to the remainder of the message.
- Note: when used in this manner, <b><a href="postconf.5.html#body_checks">body_checks</a></b> will process a
+ Note: when used in this manner, <b><a href="postconf.5.html#body_checks">body_checks</a></b> will process a
multi-line message header one line at a time.
<b>EXAMPLES</b>
Header pattern to block attachments with bad file name extensions. For
convenience, the PCRE /x flag is specified, so that there is no need to
- collapse the pattern into a single line of text. The purpose of the
+ collapse the pattern into a single line of text. The purpose of the
[[:xdigit:]] sub-expressions is to recognize Windows CLSID strings.
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
diff --git a/external/ibm-public/postfix/dist/html/index.html b/external/ibm-public/postfix/dist/html/index.html
index edf9019e7f7..c88728195b3 100644
--- a/external/ibm-public/postfix/dist/html/index.html
+++ b/external/ibm-public/postfix/dist/html/index.html
@@ -46,10 +46,10 @@ configuration examples </a>
<li> <a href="IPV6_README.html"> IP Version 6 Support </a>
-<li> <a href="IPV6_README.html"> IP Version 6 Support </a>
-
<li> <a href="SMTPUTF8_README.html"> SMTPUTF8 Support </a>
+<li> <a href="MAILLOG_README.html"> Postfix logging to file or stdout </a>
+
<li> <a href="COMPATIBILITY_README.html"> Backwards-Compatibility Safety Net</a>
<li> <a href="INSTALL.html"> Installation from source code </a>
@@ -199,6 +199,8 @@ Recipients </a>
<li> <a href="DSN_README.html"> Postfix DSN support </a>
+<li> <a href="BDAT_README.html"> Postfix BDAT (CHUNKING) support </a>
+
<li> <a href="PACKAGE_README.html"> Guidelines for Package Builders
</a>
diff --git a/external/ibm-public/postfix/dist/html/ldap_table.5.html b/external/ibm-public/postfix/dist/html/ldap_table.5.html
index 0fe0225766d..8d4ee06cc86 100644
--- a/external/ibm-public/postfix/dist/html/ldap_table.5.html
+++ b/external/ibm-public/postfix/dist/html/ldap_table.5.html
@@ -30,31 +30,12 @@ LDAP_TABLE(5) LDAP_TABLE(5)
example is given at the end of this manual.
This configuration method is available with Postfix version 2.1 and
- later. See the section "BACKWARDS COMPATIBILITY" below for older Post-
- fix versions.
+ later. See the section "OBSOLETE MAIN.CF PARAMETERS" below for older
+ Postfix versions.
For details about LDAP SSL and STARTTLS, see the section on SSL and
STARTTLS below.
-<b>BACKWARDS COMPATIBILITY</b>
- For backwards compatibility with Postfix version 2.0 and earlier, LDAP
- parameters can also be defined in <a href="postconf.5.html">main.cf</a>. Specify as LDAP source a
- name that doesn't begin with a slash or a dot. The LDAP parameters
- will then be accessible as the name you've given the source in its def-
- inition, an underscore, and the name of the parameter. For example, if
- the map is specified as "<a href="ldap_table.5.html">ldap</a>:<i>ldapsource</i>", the "server_host" parameter
- below would be defined in <a href="postconf.5.html">main.cf</a> as "<i>ldapsource</i>_server_host".
-
- Note: with this form, the passwords for the LDAP sources are written in
- <a href="postconf.5.html">main.cf</a>, which is normally world-readable. Support for this form will
- be removed in a future Postfix version.
-
- For backwards compatibility with the pre 2.2 LDAP clients, <b>result_fil-</b>
- <b>ter</b> can for now be used instead of <b>result_format</b>, when the latter
- parameter is not also set. The new name better reflects the function
- of the parameter. This compatibility interface may be removed in a
- future release.
-
<b>LIST MEMBERSHIP</b>
When using LDAP to store lists such as $<a href="postconf.5.html#mynetworks">mynetworks</a>, $<a href="postconf.5.html#mydestination">mydestination</a>,
$<a href="postconf.5.html#relay_domains">relay_domains</a>, $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, etc., it is important to under-
@@ -651,6 +632,26 @@ LDAP_TABLE(5) LDAP_TABLE(5)
list of their maildrops, which will be treated as <a href="http://tools.ietf.org/html/rfc822">RFC822</a> addresses to
which the message will be delivered.
+<b>OBSOLETE MAIN.CF PARAMETERS</b>
+ For backwards compatibility with Postfix version 2.0 and earlier, LDAP
+ parameters can also be defined in <a href="postconf.5.html">main.cf</a>. Specify as LDAP source a
+ name that doesn't begin with a slash or a dot. The LDAP parameters
+ will then be accessible as the name you've given the source in its def-
+ inition, an underscore, and the name of the parameter. For example, if
+ the map is specified as "<a href="ldap_table.5.html">ldap</a>:<i>ldapsource</i>", the "server_host" parameter
+ below would be defined in <a href="postconf.5.html">main.cf</a> as "<i>ldapsource</i>_server_host".
+
+ Note: with this form, the passwords for the LDAP sources are written in
+ <a href="postconf.5.html">main.cf</a>, which is normally world-readable. Support for this form will
+ be removed in a future Postfix version.
+
+<b>OTHER OBSOLETE FEATURES</b>
+ For backwards compatibility with the pre 2.2 LDAP clients, <b>result_fil-</b>
+ <b>ter</b> can for now be used instead of <b>result_format</b>, when the latter
+ parameter is not also set. The new name better reflects the function
+ of the parameter. This compatibility interface may be removed in a
+ future release.
+
<b>SEE ALSO</b>
<a href="postmap.1.html">postmap(1)</a>, Postfix lookup table manager
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
diff --git a/external/ibm-public/postfix/dist/html/lmtp.8.html b/external/ibm-public/postfix/dist/html/lmtp.8.html
index e458eefd444..a01589cc196 100644
--- a/external/ibm-public/postfix/dist/html/lmtp.8.html
+++ b/external/ibm-public/postfix/dist/html/lmtp.8.html
@@ -10,7 +10,7 @@ SMTP(8) SMTP(8)
smtp - Postfix SMTP+LMTP client
<b>SYNOPSIS</b>
- <b>smtp</b> [generic Postfix daemon options]
+ <b>smtp</b> [generic Postfix daemon options] [flags=DORX]
<b>DESCRIPTION</b>
The Postfix SMTP+LMTP client implements the SMTP and LMTP mail delivery
@@ -41,7 +41,9 @@ SMTP(8) SMTP(8)
can be enabled permanently for specific destinations.
<b>SMTP DESTINATION SYNTAX</b>
- SMTP destinations have the following form:
+ The Postfix SMTP+LMTP client supports multiple destinations separated
+ by comma or whitespace (Postfix 3.5 and later). SMTP destinations have
+ the following form:
<i>domainname</i>
@@ -63,7 +65,9 @@ SMTP(8) SMTP(8)
ted as [<b>ipv6</b>:<i>address</i>].
<b>LMTP DESTINATION SYNTAX</b>
- LMTP destinations have the following form:
+ The Postfix SMTP+LMTP client supports multiple destinations separated
+ by comma or whitespace (Postfix 3.5 and later). LMTP destinations have
+ the following form:
<b>unix</b>:<i>pathname</i>
Connect to the local UNIX-domain server that is bound to the
@@ -84,10 +88,57 @@ SMTP(8) SMTP(8)
will be used. An IPv6 address must be formatted as
[<b>ipv6</b>:<i>address</i>].
+<b>SINGLE-RECIPIENT DELIVERY</b>
+ By default, the Postfix SMTP+LMTP client delivers mail to multiple
+ recipients per delivery request. This is undesirable when prepending a
+ <b>Delivered-to:</b> or <b>X-Original-To:</b> message header. To prevent Postfix from
+ sending multiple recipients per delivery request, specify
+
+ <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> = 1</b>
+
+ in the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, where <i>transport</i> is the name in the first
+ column of the Postfix <a href="master.5.html"><b>master.cf</b></a> entry for this mail delivery service.
+
+<b>COMMAND ATTRIBUTE SYNTAX</b>
+ <b>flags=DORX</b> (optional)
+ Optional message processing flags.
+
+ <b>D</b> Prepend a "<b>Delivered-To:</b> <i>recipient</i>" message header with
+ the envelope recipient address. Note: for this to work,
+ the <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a></b> must be 1 (see
+ SINGLE-RECIPIENT DELIVERY above for details).
+
+ The <b>D</b> flag also enforces loop detection: if a message
+ already contains a <b>Delivered-To:</b> header with the same
+ recipient address, then the message is returned as unde-
+ liverable. The address comparison is case insensitive.
+
+ This feature is available as of Postfix 3.5.
+
+ <b>O</b> Prepend an "<b>X-Original-To:</b> <i>recipient</i>" message header with
+ the recipient address as given to Postfix. Note: for this
+ to work, the <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a></b> must
+ be 1 (see SINGLE-RECIPIENT DELIVERY above for details).
+
+ This feature is available as of Postfix 3.5.
+
+ <b>R</b> Prepend a "<b>Return-Path:</b> &lt;<i>sender</i>&gt;" message header with the
+ envelope sender address.
+
+ This feature is available as of Postfix 3.5.
+
+ <b>X</b> Indicates that the delivery is final. This flag affects
+ the status reported in "success" DSN (delivery status
+ notification) messages, and changes it from "relayed"
+ into "delivered".
+
+ This feature is available as of Postfix 3.5.
+
<b>SECURITY</b>
- The SMTP+LMTP client is moderately security-sensitive. It talks to SMTP
- or LMTP servers and to DNS servers on the network. The SMTP+LMTP client
- can be run chrooted at fixed low privilege.
+ The SMTP+LMTP client is moderately security-sensitive. It
+ talks to SMTP or LMTP servers and to DNS servers on the
+ network. The SMTP+LMTP client can be run chrooted at fixed
+ low privilege.
<b>STANDARDS</b>
<a href="http://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol)
@@ -112,37 +163,35 @@ SMTP(8) SMTP(8)
<a href="http://tools.ietf.org/html/rfc7672">RFC 7672</a> (SMTP security via opportunistic DANE TLS)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8). Corrupted message
- files are marked so that the queue manager can move them to the <b>corrupt</b>
- queue for further inspection.
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
+ Corrupted message files are marked so that the queue manager can move
+ them to the <b>corrupt</b> queue for further inspection.
- Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
+ Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces, protocol problems, and of other trouble.
<b>BUGS</b>
- SMTP and LMTP connection caching does not work with TLS. The necessary
- support for TLS object passivation and re-activation does not exist
- without closing the session, which defeats the purpose.
+ SMTP and LMTP connection reuse for TLS (without closing the SMTP or
+ LMTP connection) is not supported before Postfix 3.4.
- SMTP and LMTP connection caching assumes that SASL credentials are
- valid for all destinations that map onto the same IP address and TCP
- port.
+ SMTP and LMTP connection reuse assumes that SASL credentials are valid
+ for all destinations that map onto the same IP address and TCP port.
<b>CONFIGURATION PARAMETERS</b>
- Before Postfix version 2.3, the LMTP client is a separate program that
- implements only a subset of the functionality available with SMTP:
- there is no support for TLS, and connections are cached in-process,
+ Before Postfix version 2.3, the LMTP client is a separate program that
+ implements only a subset of the functionality available with SMTP:
+ there is no support for TLS, and connections are cached in-process,
making it ineffective when the client is used for multiple domains.
Most smtp_<i>xxx</i> configuration parameters have an lmtp_<i>xxx</i> "mirror" param-
- eter for the equivalent LMTP feature. This document describes only
+ eter for the equivalent LMTP feature. This document describes only
those LMTP-related parameters that aren't simply "mirror" parameters.
- Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="smtp.8.html"><b>smtp</b>(8)</a> processes
+ Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="smtp.8.html"><b>smtp</b>(8)</a> processes
run for only a limited amount of time. Use the command "<b>postfix reload</b>"
to speed up a change.
- The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
+ The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
more details including examples.
<b>COMPATIBILITY CONTROLS</b>
@@ -163,8 +212,8 @@ SMTP(8) SMTP(8)
will send via SMTP.
<b><a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a> (10s)</b>
- How long the Postfix SMTP client pauses before sending
- ".&lt;CR&gt;&lt;LF&gt;" in order to work around the PIX firewall
+ How long the Postfix SMTP client pauses before sending
+ ".&lt;CR&gt;&lt;LF&gt;" in order to work around the PIX firewall
"&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;" bug.
<b><a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a> (500s)</b>
@@ -173,19 +222,19 @@ SMTP(8) SMTP(8)
delivery through firewalls with "smtp fixup" mode turned on.
<b><a href="postconf.5.html#smtp_pix_workarounds">smtp_pix_workarounds</a> (disable_esmtp, delay_dotcrlf)</b>
- A list that specifies zero or more workarounds for CISCO PIX
+ A list that specifies zero or more workarounds for CISCO PIX
firewall bugs.
<b><a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a> (empty)</b>
- Lookup tables, indexed by the remote SMTP server address, with
+ Lookup tables, indexed by the remote SMTP server address, with
per-destination workarounds for CISCO PIX firewall bugs.
<b><a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a> (yes)</b>
- Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO
+ Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO
commands as required by <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a>.
<b><a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> (empty)</b>
- A mechanism to transform replies from remote SMTP servers one
+ A mechanism to transform replies from remote SMTP servers one
line at a time.
<b><a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a> (yes)</b>
@@ -197,68 +246,68 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.0 and earlier:
<b><a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> (yes)</b>
- Skip SMTP servers that greet with a 4XX status code (go away,
+ Skip SMTP servers that greet with a 4XX status code (go away,
try again later).
Available in Postfix version 2.2 and later:
<b><a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a> (empty)</b>
- Lookup tables, indexed by the remote SMTP server address, with
- case insensitive lists of EHLO keywords (pipelining, starttls,
+ Lookup tables, indexed by the remote SMTP server address, with
+ case insensitive lists of EHLO keywords (pipelining, starttls,
auth, etc.) that the Postfix SMTP client will ignore in the EHLO
response from a remote SMTP server.
<b><a href="postconf.5.html#smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a> (empty)</b>
- A case insensitive list of EHLO keywords (pipelining, starttls,
+ A case insensitive list of EHLO keywords (pipelining, starttls,
auth, etc.) that the Postfix SMTP client will ignore in the EHLO
response from a remote SMTP server.
<b><a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a> (empty)</b>
- Optional lookup tables that perform address rewriting in the
- Postfix SMTP client, typically to transform a locally valid
- address into a globally valid address when sending mail across
+ Optional lookup tables that perform address rewriting in the
+ Postfix SMTP client, typically to transform a locally valid
+ address into a globally valid address when sending mail across
the Internet.
Available in Postfix version 2.2.9 and later:
<b><a href="postconf.5.html#smtp_cname_overrides_servername">smtp_cname_overrides_servername</a> (version dependent)</b>
- When the remote SMTP servername is a DNS CNAME, replace the
- servername with the result from CNAME expansion for the purpose
- of logging, SASL password lookup, TLS policy decisions, or TLS
+ When the remote SMTP servername is a DNS CNAME, replace the
+ servername with the result from CNAME expansion for the purpose
+ of logging, SASL password lookup, TLS policy decisions, or TLS
certificate verification.
Available in Postfix version 2.3 and later:
<b><a href="postconf.5.html#lmtp_discard_lhlo_keyword_address_maps">lmtp_discard_lhlo_keyword_address_maps</a> (empty)</b>
- Lookup tables, indexed by the remote LMTP server address, with
- case insensitive lists of LHLO keywords (pipelining, starttls,
+ Lookup tables, indexed by the remote LMTP server address, with
+ case insensitive lists of LHLO keywords (pipelining, starttls,
auth, etc.) that the Postfix LMTP client will ignore in the LHLO
response from a remote LMTP server.
<b><a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> (empty)</b>
- A case insensitive list of LHLO keywords (pipelining, starttls,
+ A case insensitive list of LHLO keywords (pipelining, starttls,
auth, etc.) that the Postfix LMTP client will ignore in the LHLO
response from a remote LMTP server.
Available in Postfix version 2.4.4 and later:
<b><a href="postconf.5.html#send_cyrus_sasl_authzid">send_cyrus_sasl_authzid</a> (no)</b>
- When authenticating to a remote SMTP or LMTP server with the
- default setting "no", send no SASL authoriZation ID (authzid);
- send only the SASL authentiCation ID (authcid) plus the auth-
+ When authenticating to a remote SMTP or LMTP server with the
+ default setting "no", send no SASL authoriZation ID (authzid);
+ send only the SASL authentiCation ID (authcid) plus the auth-
cid's password.
Available in Postfix version 2.5 and later:
<b><a href="postconf.5.html#smtp_header_checks">smtp_header_checks</a> (empty)</b>
- Restricted <a href="header_checks.5.html"><b>header_checks</b>(5)</a> tables for the Postfix SMTP client.
+ Restricted <a href="header_checks.5.html"><b>header_checks</b>(5)</a> tables for the Postfix SMTP client.
<b><a href="postconf.5.html#smtp_mime_header_checks">smtp_mime_header_checks</a> (empty)</b>
- Restricted <b><a href="postconf.5.html#mime_header_checks">mime_header_checks</a></b>(5) tables for the Postfix SMTP
+ Restricted <b><a href="postconf.5.html#mime_header_checks">mime_header_checks</a></b>(5) tables for the Postfix SMTP
client.
<b><a href="postconf.5.html#smtp_nested_header_checks">smtp_nested_header_checks</a> (empty)</b>
- Restricted <b><a href="postconf.5.html#nested_header_checks">nested_header_checks</a></b>(5) tables for the Postfix SMTP
+ Restricted <b><a href="postconf.5.html#nested_header_checks">nested_header_checks</a></b>(5) tables for the Postfix SMTP
client.
<b><a href="postconf.5.html#smtp_body_checks">smtp_body_checks</a> (empty)</b>
@@ -267,7 +316,7 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.6 and later:
<b><a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> (0)</b>
- An optional workaround for routers that break TCP window scal-
+ An optional workaround for routers that break TCP window scal-
ing.
Available in Postfix version 2.8 and later:
@@ -278,14 +327,14 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.9 and later:
<b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b>
- Change the behavior of the smtp_*_timeout time limits, from a
- time limit per read or write system call, to a time limit to
- send or receive a complete record (an SMTP command line, SMTP
- response line, SMTP message content line, or TLS protocol mes-
+ Change the behavior of the smtp_*_timeout time limits, from a
+ time limit per read or write system call, to a time limit to
+ send or receive a complete record (an SMTP command line, SMTP
+ response line, SMTP message content line, or TLS protocol mes-
sage).
<b><a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a> (no)</b>
- Whether or not to append the "AUTH=&lt;&gt;" option to the MAIL FROM
+ Whether or not to append the "AUTH=&lt;&gt;" option to the MAIL FROM
command in SASL-authenticated SMTP sessions.
Available in Postfix version 2.11 and later:
@@ -296,13 +345,26 @@ SMTP(8) SMTP(8)
Available in Postfix version 3.0 and later:
<b><a href="postconf.5.html#smtp_delivery_status_filter">smtp_delivery_status_filter</a> ($<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b>
- Optional filter for the <a href="smtp.8.html"><b>smtp</b>(8)</a> delivery agent to change the
+ Optional filter for the <a href="smtp.8.html"><b>smtp</b>(8)</a> delivery agent to change the
delivery status code or explanatory text of successful or unsuc-
cessful deliveries.
<b><a href="postconf.5.html#smtp_dns_reply_filter">smtp_dns_reply_filter</a> (empty)</b>
Optional filter for Postfix SMTP client DNS lookup results.
+ Available in Postfix version 3.3 and later:
+
+ <b><a href="postconf.5.html#smtp_balance_inet_protocols">smtp_balance_inet_protocols</a> (yes)</b>
+ When a remote destination resolves to a combination of IPv4 and
+ IPv6 addresses, ensure that the Postfix SMTP client can try both
+ address types before it runs into the <a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a>.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
+
<b>MIME PROCESSING CONTROLS</b>
Available in Postfix version 2.0 and later:
@@ -540,19 +602,25 @@ SMTP(8) SMTP(8)
<b><a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> (see 'postconf -d' output)</b>
List or bit-mask of OpenSSL bug work-arounds to disable.
+ Available in Postfix version 2.11-3.1:
+
+ <b><a href="postconf.5.html#tls_dane_digest_agility">tls_dane_digest_agility</a> (on)</b>
+ Configure <a href="http://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility.
+
+ <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b>
+ Enable support for <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain
+ digests of trust-anchors with certificate usage "2".
+
Available in Postfix version 2.11 and later:
<b><a href="postconf.5.html#smtp_tls_trust_anchor_file">smtp_tls_trust_anchor_file</a> (empty)</b>
- Zero or more PEM-format files with trust-anchor certificates
+ Zero or more PEM-format files with trust-anchor certificates
and/or public keys.
<b><a href="postconf.5.html#smtp_tls_force_insecure_host_tlsa_lookup">smtp_tls_force_insecure_host_tlsa_lookup</a> (no)</b>
- Lookup the associated DANE TLSA RRset even when a hostname is
+ Lookup the associated DANE TLSA RRset even when a hostname is
not an alias and its address records lie in an unsigned zone.
- <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b>
- <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> trust-anchor digest support in the Postfix TLS library.
-
<b><a href="postconf.5.html#tlsmgr_service_name">tlsmgr_service_name</a> (tlsmgr)</b>
The name of the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>.
@@ -569,50 +637,60 @@ SMTP(8) SMTP(8)
nexthop destination security level is <b>dane</b>, but the MX record
was found via an "insecure" MX lookup.
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> (no)</b>
+ Try to make multiple deliveries per TLS-encrypted connection.
+
+ <b><a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> (empty)</b>
+ List of one or more PEM files, each holding one or more private
+ keys directly followed by a corresponding certificate chain.
+
+ <b><a href="postconf.5.html#smtp_tls_servername">smtp_tls_servername</a> (empty)</b>
+ Optional name to send to the remote SMTP server in the TLS
+ Server Name Indication (SNI) extension.
+
+ Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later:
+
+ <b><a href="postconf.5.html#tls_fast_shutdown_enable">tls_fast_shutdown_enable</a> (yes)</b>
+ A workaround for implementations that hang Postfix while shut-
+ ting down a TLS session, until Postfix times out.
+
<b>OBSOLETE STARTTLS CONTROLS</b>
- The following configuration parameters exist for compatibility with
- Postfix versions before 2.3. Support for these will be removed in a
+ The following configuration parameters exist for compatibility with
+ Postfix versions before 2.3. Support for these will be removed in a
future release.
<b><a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a> (no)</b>
- Opportunistic mode: use TLS when a remote SMTP server announces
+ Opportunistic mode: use TLS when a remote SMTP server announces
STARTTLS support, otherwise send the mail in the clear.
<b><a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> (no)</b>
- Enforcement mode: require that remote SMTP servers use TLS
+ Enforcement mode: require that remote SMTP servers use TLS
encryption, and never send mail in the clear.
<b><a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> (yes)</b>
- With mandatory TLS encryption, require that the remote SMTP
- server hostname matches the information in the remote SMTP
+ With mandatory TLS encryption, require that the remote SMTP
+ server hostname matches the information in the remote SMTP
server certificate.
<b><a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> (empty)</b>
- Optional lookup tables with the Postfix SMTP client TLS usage
- policy by next-hop destination and by remote SMTP server host-
+ Optional lookup tables with the Postfix SMTP client TLS usage
+ policy by next-hop destination and by remote SMTP server host-
name.
<b><a href="postconf.5.html#smtp_tls_cipherlist">smtp_tls_cipherlist</a> (empty)</b>
- Obsolete Postfix &lt; 2.3 control for the Postfix SMTP client TLS
+ Obsolete Postfix &lt; 2.3 control for the Postfix SMTP client TLS
cipher list.
<b>RESOURCE AND RATE CONTROLS</b>
- <b><a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
- <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
- The maximal number of parallel deliveries to the same destina-
- tion via the smtp message delivery transport.
-
- <b><a href="postconf.5.html#smtp_destination_recipient_limit">smtp_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b>
- The maximal number of recipients per message for the smtp mes-
- sage delivery transport.
-
<b><a href="postconf.5.html#smtp_connect_timeout">smtp_connect_timeout</a> (30s)</b>
- The Postfix SMTP client time limit for completing a TCP connec-
+ The Postfix SMTP client time limit for completing a TCP connec-
tion, or zero (use the operating system built-in time limit).
<b><a href="postconf.5.html#smtp_helo_timeout">smtp_helo_timeout</a> (300s)</b>
- The Postfix SMTP client time limit for sending the HELO or EHLO
- command, and for receiving the initial remote SMTP server
+ The Postfix SMTP client time limit for sending the HELO or EHLO
+ command, and for receiving the initial remote SMTP server
response.
<b><a href="postconf.5.html#lmtp_lhlo_timeout">lmtp_lhlo_timeout</a> (300s)</b>
@@ -624,19 +702,19 @@ SMTP(8) SMTP(8)
mand, and for receiving the remote SMTP server response.
<b><a href="postconf.5.html#smtp_mail_timeout">smtp_mail_timeout</a> (300s)</b>
- The Postfix SMTP client time limit for sending the MAIL FROM
+ The Postfix SMTP client time limit for sending the MAIL FROM
command, and for receiving the remote SMTP server response.
<b><a href="postconf.5.html#smtp_rcpt_timeout">smtp_rcpt_timeout</a> (300s)</b>
- The Postfix SMTP client time limit for sending the SMTP RCPT TO
+ The Postfix SMTP client time limit for sending the SMTP RCPT TO
command, and for receiving the remote SMTP server response.
<b><a href="postconf.5.html#smtp_data_init_timeout">smtp_data_init_timeout</a> (120s)</b>
- The Postfix SMTP client time limit for sending the SMTP DATA
+ The Postfix SMTP client time limit for sending the SMTP DATA
command, and for receiving the remote SMTP server response.
<b><a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a> (180s)</b>
- The Postfix SMTP client time limit for sending the SMTP message
+ The Postfix SMTP client time limit for sending the SMTP message
content.
<b><a href="postconf.5.html#smtp_data_done_timeout">smtp_data_done_timeout</a> (600s)</b>
@@ -650,13 +728,13 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a> (5)</b>
- The maximal number of MX (mail exchanger) IP addresses that can
- result from Postfix SMTP client mail exchanger lookups, or zero
+ The maximal number of MX (mail exchanger) IP addresses that can
+ result from Postfix SMTP client mail exchanger lookups, or zero
(no limit).
<b><a href="postconf.5.html#smtp_mx_session_limit">smtp_mx_session_limit</a> (2)</b>
- The maximal number of SMTP sessions per delivery request before
- the Postfix SMTP client gives up or delivers to a fall-back
+ The maximal number of SMTP sessions per delivery request before
+ the Postfix SMTP client gives up or delivers to a fall-back
<a href="postconf.5.html#relayhost">relay host</a>, or zero (no limit).
<b><a href="postconf.5.html#smtp_rset_timeout">smtp_rset_timeout</a> (20s)</b>
@@ -666,17 +744,17 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.2 and earlier:
<b><a href="postconf.5.html#lmtp_cache_connection">lmtp_cache_connection</a> (yes)</b>
- Keep Postfix LMTP client connections open for up to $<a href="postconf.5.html#max_idle">max_idle</a>
+ Keep Postfix LMTP client connections open for up to $<a href="postconf.5.html#max_idle">max_idle</a>
seconds.
Available in Postfix version 2.2 and later:
<b><a href="postconf.5.html#smtp_connection_cache_destinations">smtp_connection_cache_destinations</a> (empty)</b>
- Permanently enable SMTP connection caching for the specified
+ Permanently enable SMTP connection caching for the specified
destinations.
<b><a href="postconf.5.html#smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a> (yes)</b>
- Temporarily enable SMTP connection caching while a destination
+ Temporarily enable SMTP connection caching while a destination
has a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>.
<b><a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a> (300s)</b>
@@ -690,54 +768,80 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.3 and later:
<b><a href="postconf.5.html#connection_cache_protocol_timeout">connection_cache_protocol_timeout</a> (5s)</b>
- Time limit for connection cache connect, send or receive opera-
+ Time limit for connection cache connect, send or receive opera-
tions.
Available in Postfix version 2.9 and later:
<b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b>
- Change the behavior of the smtp_*_timeout time limits, from a
- time limit per read or write system call, to a time limit to
- send or receive a complete record (an SMTP command line, SMTP
- response line, SMTP message content line, or TLS protocol mes-
+ Change the behavior of the smtp_*_timeout time limits, from a
+ time limit per read or write system call, to a time limit to
+ send or receive a complete record (an SMTP command line, SMTP
+ response line, SMTP message content line, or TLS protocol mes-
sage).
Available in Postfix version 2.11 and later:
<b><a href="postconf.5.html#smtp_connection_reuse_count_limit">smtp_connection_reuse_count_limit</a> (0)</b>
- When SMTP connection caching is enabled, the number of times
- that an SMTP session may be reused before it is closed, or zero
+ When SMTP connection caching is enabled, the number of times
+ that an SMTP session may be reused before it is closed, or zero
(no limit).
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> (no)</b>
+ Try to make multiple deliveries per TLS-encrypted connection.
+
+ Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon:
+
+ <b>transport_destination_concurrency_limit ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
+ <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
+ A transport-specific override for the default_destination_con-
+ currency_limit parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
+
+ <b>transport_destination_recipient_limit ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b>
+ <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>-
+ <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
+
<b>SMTPUTF8 CONTROLS</b>
Preliminary SMTPUTF8 support is introduced with Postfix 3.0.
<b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
- Enable preliminary SMTPUTF8 support for the protocols described
+ Enable preliminary SMTPUTF8 support for the protocols described
in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.
<b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b>
- Detect that a message requires SMTPUTF8 support for the speci-
+ Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b>
+ Enable 'transitional' compatibility between IDNA2003 and
+ IDNA2008, when converting UTF-8 domain names to/from the ASCII
+ form that is used for DNS lookups.
+
<b>TROUBLE SHOOTING CONTROLS</b>
<b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b>
- The increment in verbose logging level when a remote client or
+ The increment in verbose logging level when a remote client or
server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter.
<b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b>
- Optional list of remote client or server hostname or network
+ Optional list of remote client or server hostname or network
address patterns that cause the verbose logging level to
increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>.
<b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b>
- The recipient of postmaster notifications about mail delivery
+ The recipient of postmaster notifications about mail delivery
problems that are caused by policy, resource, software or proto-
col errors.
<b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b>
- What categories of Postfix-generated mail are subject to
- before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>,
+ What categories of Postfix-generated mail are subject to
+ before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>,
<a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>.
<b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b>
@@ -745,46 +849,46 @@ SMTP(8) SMTP(8)
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#best_mx_transport">best_mx_transport</a> (empty)</b>
- Where the Postfix SMTP client should deliver mail when it
+ Where the Postfix SMTP client should deliver mail when it
detects a "mail loops back to myself" error condition.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b>
- How much time a Postfix daemon process may take to handle a
+ How much time a Postfix daemon process may take to handle a
request before it is terminated by a built-in watchdog timer.
<b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b>
- The maximal number of digits after the decimal point when log-
+ The maximal number of digits after the decimal point when log-
ging sub-second delay values.
<b><a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a> (no)</b>
Disable DNS lookups in the Postfix SMTP and LMTP clients.
<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b>
- The network interface addresses that this mail system receives
+ The network interface addresses that this mail system receives
mail on.
<b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (all)</b>
- The Internet protocols Postfix will attempt to use when making
+ The Internet protocols Postfix will attempt to use when making
or accepting connections.
<b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b>
- The time limit for sending or receiving information over an
+ The time limit for sending or receiving information over an
internal communication channel.
<b><a href="postconf.5.html#lmtp_assume_final">lmtp_assume_final</a> (no)</b>
- When a remote LMTP server announces no DSN support, assume that
- the server performs final delivery, and send "delivered" deliv-
+ When a remote LMTP server announces no DSN support, assume that
+ the server performs final delivery, and send "delivered" deliv-
ery status notifications instead of "relayed".
<b><a href="postconf.5.html#lmtp_tcp_port">lmtp_tcp_port</a> (24)</b>
The default TCP port that the Postfix LMTP client connects to.
<b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b>
- The maximum amount of time that an idle Postfix daemon process
+ The maximum amount of time that an idle Postfix daemon process
waits for an incoming connection before terminating voluntarily.
<b><a href="postconf.5.html#max_use">max_use</a> (100)</b>
@@ -798,20 +902,20 @@ SMTP(8) SMTP(8)
The process name of a Postfix command or daemon process.
<b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b>
- The network interface addresses that this mail system receives
+ The network interface addresses that this mail system receives
mail on by way of a proxy or network address translation unit.
<b><a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> (any)</b>
The address type ("ipv6", "ipv4" or "any") that the Postfix SMTP
- client will try first, when a destination has IPv6 and IPv4
+ client will try first, when a destination has IPv6 and IPv4
addresses with equal MX preference.
<b><a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> (empty)</b>
- An optional numerical network address that the Postfix SMTP
+ An optional numerical network address that the Postfix SMTP
client should bind to when making an IPv4 connection.
<b><a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> (empty)</b>
- An optional numerical network address that the Postfix SMTP
+ An optional numerical network address that the Postfix SMTP
client should bind to when making an IPv6 connection.
<b><a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
@@ -831,9 +935,8 @@ SMTP(8) SMTP(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available with Postfix 2.2 and earlier:
@@ -859,6 +962,16 @@ SMTP(8) SMTP(8)
Optional list of relay hosts for LMTP destinations that can't be
found or that are unreachable.
+ Available with Postfix 3.2 and later:
+
+ <b><a href="postconf.5.html#smtp_tcp_port">smtp_tcp_port</a> (smtp)</b>
+ The default TCP port that the Postfix SMTP client connects to.
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>SEE ALSO</b>
<a href="generic.5.html">generic(5)</a>, output address rewriting
<a href="header_checks.5.html">header_checks(5)</a>, message header content inspection
@@ -870,6 +983,7 @@ SMTP(8) SMTP(8)
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
<a href="tlsmgr.8.html">tlsmgr(8)</a>, TLS session and PRNG management
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/local.8.html b/external/ibm-public/postfix/dist/html/local.8.html
index 4fa72c1754f..d433ac8fc44 100644
--- a/external/ibm-public/postfix/dist/html/local.8.html
+++ b/external/ibm-public/postfix/dist/html/local.8.html
@@ -283,9 +283,9 @@ LOCAL(8) LOCAL(8)
<a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8). Corrupted message
- files are marked so that the queue manager can move them to the <b>corrupt</b>
- queue afterwards.
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
+ Corrupted message files are marked so that the queue manager can move
+ them to the <b>corrupt</b> queue afterwards.
Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces and of other trouble.
@@ -327,14 +327,15 @@ LOCAL(8) LOCAL(8)
Whether or not to use the local <a href="postconf.5.html#biff">biff</a> service.
<b><a href="postconf.5.html#expand_owner_alias">expand_owner_alias</a> (no)</b>
- When delivering to an alias "aliasname" that has an
- "owner-aliasname" companion alias, set the envelope sender
- address to the expansion of the "owner-aliasname" alias.
+ When delivering to an alias "<i>aliasname</i>" that has an
+ "owner-<i>aliasname</i>" companion alias, set the envelope sender
+ address to the expansion of the "owner-<i>aliasname</i>" alias.
<b><a href="postconf.5.html#owner_request_special">owner_request_special</a> (yes)</b>
- Give special treatment to owner-listname and listname-request
- address localparts: don't split such addresses when the <a href="postconf.5.html#recipient_delimiter">recipi</a>-
- <a href="postconf.5.html#recipient_delimiter">ent_delimiter</a> is set to "-".
+ Enable special treatment for owner-<i>listname</i> entries in the
+ <a href="aliases.5.html"><b>aliases</b>(5)</a> file, and don't split owner-<i>listname</i> and <i>list-</i>
+ <i>name</i>-request address localparts when the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> is
+ set to "-".
<b><a href="postconf.5.html#sun_mailtool_compatibility">sun_mailtool_compatibility</a> (no)</b>
Obsolete SUN mailtool compatibility feature.
@@ -342,62 +343,62 @@ LOCAL(8) LOCAL(8)
Available in Postfix version 2.3 and later:
<b><a href="postconf.5.html#frozen_delivered_to">frozen_delivered_to</a> (yes)</b>
- Update the <a href="local.8.html"><b>local</b>(8)</a> delivery agent's idea of the Delivered-To:
- address (see <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a>) only once, at the start
- of a delivery attempt; do not update the Delivered-To: address
+ Update the <a href="local.8.html"><b>local</b>(8)</a> delivery agent's idea of the Delivered-To:
+ address (see <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a>) only once, at the start
+ of a delivery attempt; do not update the Delivered-To: address
while expanding aliases or .forward files.
Available in Postfix version 2.5.3 and later:
<b><a href="postconf.5.html#strict_mailbox_ownership">strict_mailbox_ownership</a> (yes)</b>
- Defer delivery when a mailbox file is not owned by its recipi-
+ Defer delivery when a mailbox file is not owned by its recipi-
ent.
<b><a href="postconf.5.html#reset_owner_alias">reset_owner_alias</a> (no)</b>
- Reset the <a href="local.8.html"><b>local</b>(8)</a> delivery agent's idea of the owner-alias
- attribute, when delivering mail to a child alias that does not
+ Reset the <a href="local.8.html"><b>local</b>(8)</a> delivery agent's idea of the owner-alias
+ attribute, when delivering mail to a child alias that does not
have its own owner alias.
Available in Postfix version 3.0 and later:
<b><a href="postconf.5.html#local_delivery_status_filter">local_delivery_status_filter</a> ($<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b>
- Optional filter for the <a href="local.8.html"><b>local</b>(8)</a> delivery agent to change the
- status code or explanatory text of successful or unsuccessful
+ Optional filter for the <a href="local.8.html"><b>local</b>(8)</a> delivery agent to change the
+ status code or explanatory text of successful or unsuccessful
deliveries.
<b>DELIVERY METHOD CONTROLS</b>
- The precedence of <a href="local.8.html"><b>local</b>(8)</a> delivery methods from high to low is:
+ The precedence of <a href="local.8.html"><b>local</b>(8)</a> delivery methods from high to low is:
aliases, .forward files, <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>, <a href="postconf.5.html#mailbox_transport">mailbox_transport</a>,
- <a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_direc</a>-
+ <a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_direc</a>-
<a href="postconf.5.html#mail_spool_directory">tory</a>, <a href="postconf.5.html#fallback_transport_maps">fallback_transport_maps</a>, <a href="postconf.5.html#fallback_transport">fallback_transport</a>, and <a href="postconf.5.html#luser_relay">luser_relay</a>.
<b><a href="postconf.5.html#alias_maps">alias_maps</a> (see 'postconf -d' output)</b>
The alias databases that are used for <a href="local.8.html"><b>local</b>(8)</a> delivery.
<b><a href="postconf.5.html#forward_path">forward_path</a> (see 'postconf -d' output)</b>
- The <a href="local.8.html"><b>local</b>(8)</a> delivery agent search list for finding a .forward
+ The <a href="local.8.html"><b>local</b>(8)</a> delivery agent search list for finding a .forward
file with user-specified delivery methods.
<b><a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a> (empty)</b>
Optional lookup tables with per-recipient message delivery
- transports to use for <a href="local.8.html"><b>local</b>(8)</a> mailbox delivery, whether or not
+ transports to use for <a href="local.8.html"><b>local</b>(8)</a> mailbox delivery, whether or not
the recipients are found in the UNIX passwd database.
<b><a href="postconf.5.html#mailbox_transport">mailbox_transport</a> (empty)</b>
- Optional message delivery transport that the <a href="local.8.html"><b>local</b>(8)</a> delivery
- agent should use for mailbox delivery to all local recipients,
+ Optional message delivery transport that the <a href="local.8.html"><b>local</b>(8)</a> delivery
+ agent should use for mailbox delivery to all local recipients,
whether or not they are found in the UNIX passwd database.
<b><a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a> (empty)</b>
- Optional lookup tables with per-recipient external commands to
+ Optional lookup tables with per-recipient external commands to
use for <a href="local.8.html"><b>local</b>(8)</a> mailbox delivery.
<b><a href="postconf.5.html#mailbox_command">mailbox_command</a> (empty)</b>
- Optional external command that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent
+ Optional external command that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent
should use for mailbox delivery.
<b><a href="postconf.5.html#home_mailbox">home_mailbox</a> (empty)</b>
- Optional pathname of a mailbox file relative to a <a href="local.8.html"><b>local</b>(8)</a>
+ Optional pathname of a mailbox file relative to a <a href="local.8.html"><b>local</b>(8)</a>
user's home directory.
<b><a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a> (see 'postconf -d' output)</b>
@@ -409,17 +410,17 @@ LOCAL(8) LOCAL(8)
not find in the <a href="aliases.5.html"><b>aliases</b>(5)</a> or UNIX password database.
<b><a href="postconf.5.html#fallback_transport">fallback_transport</a> (empty)</b>
- Optional message delivery transport that the <a href="local.8.html"><b>local</b>(8)</a> delivery
- agent should use for names that are not found in the <a href="aliases.5.html"><b>aliases</b>(5)</a>
+ Optional message delivery transport that the <a href="local.8.html"><b>local</b>(8)</a> delivery
+ agent should use for names that are not found in the <a href="aliases.5.html"><b>aliases</b>(5)</a>
or UNIX password database.
<b><a href="postconf.5.html#luser_relay">luser_relay</a> (empty)</b>
- Optional catch-all destination for unknown <a href="local.8.html"><b>local</b>(8)</a> recipients.
+ Optional catch-all destination for unknown <a href="local.8.html"><b>local</b>(8)</a> recipients.
Available in Postfix version 2.2 and later:
<b><a href="postconf.5.html#command_execution_directory">command_execution_directory</a> (empty)</b>
- The <a href="local.8.html"><b>local</b>(8)</a> delivery agent working directory for delivery to
+ The <a href="local.8.html"><b>local</b>(8)</a> delivery agent working directory for delivery to
external command.
<b>MAILBOX LOCKING CONTROLS</b>
@@ -428,15 +429,15 @@ LOCAL(8) LOCAL(8)
mailbox file or <a href="bounce.8.html"><b>bounce</b>(8)</a> logfile.
<b><a href="postconf.5.html#deliver_lock_delay">deliver_lock_delay</a> (1s)</b>
- The time between attempts to acquire an exclusive lock on a
+ The time between attempts to acquire an exclusive lock on a
mailbox file or <a href="bounce.8.html"><b>bounce</b>(8)</a> logfile.
<b><a href="postconf.5.html#stale_lock_time">stale_lock_time</a> (500s)</b>
- The time after which a stale exclusive mailbox lockfile is
+ The time after which a stale exclusive mailbox lockfile is
removed.
<b><a href="postconf.5.html#mailbox_delivery_lock">mailbox_delivery_lock</a> (see 'postconf -d' output)</b>
- How to lock a UNIX-style <a href="local.8.html"><b>local</b>(8)</a> mailbox before attempting
+ How to lock a UNIX-style <a href="local.8.html"><b>local</b>(8)</a> mailbox before attempting
delivery.
<b>RESOURCE AND RATE CONTROLS</b>
@@ -448,6 +449,12 @@ LOCAL(8) LOCAL(8)
cate filter for <a href="aliases.5.html"><b>aliases</b>(5)</a> or <a href="virtual.5.html"><b>virtual</b>(5)</a> alias expansion, or for
<a href="showq.8.html"><b>showq</b>(8)</a> queue displays.
+ <b><a href="postconf.5.html#mailbox_size_limit">mailbox_size_limit</a> (51200000)</b>
+ The maximal size of any <a href="local.8.html"><b>local</b>(8)</a> individual mailbox or maildir
+ file, or zero (no limit).
+
+ Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon:
+
<b><a href="postconf.5.html#local_destination_concurrency_limit">local_destination_concurrency_limit</a> (2)</b>
The maximal number of parallel deliveries via the local mail
delivery transport to the same recipient (when "<a href="postconf.5.html#local_destination_recipient_limit">local_destina</a>-
@@ -459,10 +466,6 @@ LOCAL(8) LOCAL(8)
The maximal number of recipients per message delivery via the
local mail delivery transport.
- <b><a href="postconf.5.html#mailbox_size_limit">mailbox_size_limit</a> (51200000)</b>
- The maximal size of any <a href="local.8.html"><b>local</b>(8)</a> individual mailbox or maildir
- file, or zero (no limit).
-
<b>SECURITY CONTROLS</b>
<b><a href="postconf.5.html#allow_mail_to_commands">allow_mail_to_commands</a> (alias, forward)</b>
Restrict <a href="local.8.html"><b>local</b>(8)</a> mail delivery to external commands.
@@ -471,49 +474,49 @@ LOCAL(8) LOCAL(8)
Restrict <a href="local.8.html"><b>local</b>(8)</a> mail delivery to external files.
<b><a href="postconf.5.html#command_expansion_filter">command_expansion_filter</a> (see 'postconf -d' output)</b>
- Restrict the characters that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent allows
- in $name expansions of $<a href="postconf.5.html#mailbox_command">mailbox_command</a> and $<a href="postconf.5.html#command_execution_directory">command_execu</a>-
+ Restrict the characters that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent allows
+ in $name expansions of $<a href="postconf.5.html#mailbox_command">mailbox_command</a> and $<a href="postconf.5.html#command_execution_directory">command_execu</a>-
<a href="postconf.5.html#command_execution_directory">tion_directory</a>.
<b><a href="postconf.5.html#default_privs">default_privs</a> (nobody)</b>
- The default rights used by the <a href="local.8.html"><b>local</b>(8)</a> delivery agent for
+ The default rights used by the <a href="local.8.html"><b>local</b>(8)</a> delivery agent for
delivery to external file or command.
<b><a href="postconf.5.html#forward_expansion_filter">forward_expansion_filter</a> (see 'postconf -d' output)</b>
- Restrict the characters that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent allows
+ Restrict the characters that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent allows
in $name expansions of $<a href="postconf.5.html#forward_path">forward_path</a>.
Available in Postfix version 2.2 and later:
<b><a href="postconf.5.html#execution_directory_expansion_filter">execution_directory_expansion_filter</a> (see 'postconf -d' output)</b>
- Restrict the characters that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent allows
+ Restrict the characters that the <a href="local.8.html"><b>local</b>(8)</a> delivery agent allows
in $name expansions of $<a href="postconf.5.html#command_execution_directory">command_execution_directory</a>.
Available in Postfix version 2.5.3 and later:
<b><a href="postconf.5.html#strict_mailbox_ownership">strict_mailbox_ownership</a> (yes)</b>
- Defer delivery when a mailbox file is not owned by its recipi-
+ Defer delivery when a mailbox file is not owned by its recipi-
ent.
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b>
- How much time a Postfix daemon process may take to handle a
+ How much time a Postfix daemon process may take to handle a
request before it is terminated by a built-in watchdog timer.
<b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b>
- The maximal number of digits after the decimal point when log-
+ The maximal number of digits after the decimal point when log-
ging sub-second delay values.
<b><a href="postconf.5.html#export_environment">export_environment</a> (see 'postconf -d' output)</b>
- The list of environment variables that a Postfix process will
+ The list of environment variables that a Postfix process will
export to non-Postfix processes.
<b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b>
- The time limit for sending or receiving information over an
+ The time limit for sending or receiving information over an
internal communication channel.
<b><a href="postconf.5.html#local_command_shell">local_command_shell</a> (empty)</b>
@@ -521,7 +524,7 @@ LOCAL(8) LOCAL(8)
mand.
<b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b>
- The maximum amount of time that an idle Postfix daemon process
+ The maximum amount of time that an idle Postfix daemon process
waits for an incoming connection before terminating voluntarily.
<b><a href="postconf.5.html#max_use">max_use</a> (100)</b>
@@ -529,8 +532,8 @@ LOCAL(8) LOCAL(8)
process will service before terminating voluntarily.
<b><a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a> (command, file, forward)</b>
- The message delivery contexts where the Postfix <a href="local.8.html"><b>local</b>(8)</a> deliv-
- ery agent prepends a Delivered-To: message header with the
+ The message delivery contexts where the Postfix <a href="local.8.html"><b>local</b>(8)</a> deliv-
+ ery agent prepends a Delivered-To: message header with the
address that the mail was delivered to.
<b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
@@ -540,15 +543,15 @@ LOCAL(8) LOCAL(8)
The process name of a Postfix command or daemon process.
<b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> (canonical, virtual)</b>
- What address lookup tables copy an address extension from the
+ What address lookup tables copy an address extension from the
lookup key to the lookup result.
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
The location of the Postfix top-level queue directory.
<b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b>
- The set of characters that can separate a user name from its
- extension (example: user+foo), or a .forward file name from its
+ The set of characters that can separate a user name from its
+ extension (example: user+foo), or a .forward file name from its
extension (example: .forward+foo).
<b><a href="postconf.5.html#require_home_directory">require_home_directory</a> (no)</b>
@@ -559,9 +562,24 @@ LOCAL(8) LOCAL(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix version 3.3 and later:
+
+ <b><a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a> (yes)</b>
+ Enable support for the original recipient address after an
+ address is rewritten to a different address (for example with
+ aliasing or with canonical mapping).
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
<b>FILES</b>
The following are examples; details differ between systems.
@@ -577,16 +595,17 @@ LOCAL(8) LOCAL(8)
<a href="aliases.5.html">aliases(5)</a>, format of alias database
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
The Secure Mailer license must be distributed with this software.
<b>HISTORY</b>
- The <b>Delivered-To:</b> message header appears in the <b>qmail</b> system by Daniel
+ The <b>Delivered-To:</b> message header appears in the <b>qmail</b> system by Daniel
Bernstein.
- The <i>maildir</i> structure appears in the <b>qmail</b> system by Daniel Bernstein.
+ The <i>maildir</i> structure appears in the <b>qmail</b> system by Daniel Bernstein.
<b>AUTHOR(S)</b>
Wietse Venema
diff --git a/external/ibm-public/postfix/dist/html/mailq.1.html b/external/ibm-public/postfix/dist/html/mailq.1.html
index a2c3ff72dd6..02f20fe8913 100644
--- a/external/ibm-public/postfix/dist/html/mailq.1.html
+++ b/external/ibm-public/postfix/dist/html/mailq.1.html
@@ -117,49 +117,54 @@ SENDMAIL(1) SENDMAIL(1)
directory. This information is ignored with Postfix versions
before 2.3.
- With all Postfix versions, you can specify a directory pathname
- with the MAIL_CONFIG environment variable to override the loca-
+ With Postfix version 3.2 and later, a non-default directory must
+ be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter-
+ nate_config_directories or <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> parame-
+ ters.
+
+ With all Postfix versions, you can specify a directory pathname
+ with the MAIL_CONFIG environment variable to override the loca-
tion of configuration files.
<b>-F</b> <i>full</i><b>_</b><i>name</i>
- Set the sender full name. This overrides the NAME environment
+ Set the sender full name. This overrides the NAME environment
variable, and is used only with messages that have no <b>From:</b> mes-
sage header.
<b>-f</b> <i>sender</i>
- Set the envelope sender address. This is the address where
+ Set the envelope sender address. This is the address where
delivery problems are sent to. With Postfix versions before 2.1,
- the <b>Errors-To:</b> message header overrides the error return
+ the <b>Errors-To:</b> message header overrides the error return
address.
- <b>-G</b> Gateway (relay) submission, as opposed to initial user submis-
- sion. Either do not rewrite addresses at all, or update incom-
- plete addresses with the domain information specified with
+ <b>-G</b> Gateway (relay) submission, as opposed to initial user submis-
+ sion. Either do not rewrite addresses at all, or update incom-
+ plete addresses with the domain information specified with
<b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a></b>.
This option is ignored before Postfix version 2.3.
<b>-h</b> <i>hop</i><b>_</b><i>count</i> (ignored)
- Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter
+ Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter
instead.
<b>-I</b> Initialize alias database. See the <b>newaliases</b> command above.
- <b>-i</b> When reading a message from standard input, don't treat a line
+ <b>-i</b> When reading a message from standard input, don't treat a line
with only a <b>.</b> character as the end of input.
<b>-L</b> <i>label</i> (ignored)
- The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter
+ The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter
instead.
<b>-m</b> (ignored)
Backwards compatibility.
<b>-N</b> <i>dsn</i> (default: 'delay, failure')
- Delivery status notification control. Specify either a
+ Delivery status notification control. Specify either a
comma-separated list with one or more of <b>failure</b> (send notifica-
- tion when delivery fails), <b>delay</b> (send notification when deliv-
- ery is delayed), or <b>success</b> (send notification when the message
+ tion when delivery fails), <b>delay</b> (send notification when deliv-
+ ery is delayed), or <b>success</b> (send notification when the message
is delivered); or specify <b>never</b> (don't send any notifications at
all).
@@ -169,50 +174,50 @@ SENDMAIL(1) SENDMAIL(1)
Backwards compatibility.
<b>-oA</b><i>alias</i><b>_</b><i>database</i>
- Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>.
+ Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>.
See <a href="postalias.1.html"><b>postalias</b>(1)</a> for details.
<b>-O</b> <i>option=value</i> (ignored)
- Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration
+ Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration
parameter in <a href="postconf.5.html"><b>main.cf</b></a> instead.
<b>-o7</b> (ignored)
<b>-o8</b> (ignored)
- To send 8-bit or binary content, use an appropriate MIME encap-
+ To send 8-bit or binary content, use an appropriate MIME encap-
sulation and specify the appropriate <b>-B</b> command-line option.
- <b>-oi</b> When reading a message from standard input, don't treat a line
+ <b>-oi</b> When reading a message from standard input, don't treat a line
with only a <b>.</b> character as the end of input.
<b>-om</b> (ignored)
The sender is never eliminated from alias etc. expansions.
<b>-o</b> <i>x value</i> (ignored)
- Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame-
+ Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame-
ter in <a href="postconf.5.html"><b>main.cf</b></a> instead.
<b>-r</b> <i>sender</i>
- Set the envelope sender address. This is the address where
+ Set the envelope sender address. This is the address where
delivery problems are sent to. With Postfix versions before 2.1,
- the <b>Errors-To:</b> message header overrides the error return
+ the <b>Errors-To:</b> message header overrides the error return
address.
<b>-R</b> <i>return</i>
- Delivery status notification control. Specify "hdrs" to return
- only the header when a message bounces, "full" to return a full
+ Delivery status notification control. Specify "hdrs" to return
+ only the header when a message bounces, "full" to return a full
copy (the default behavior).
The <b>-R</b> option specifies an upper bound; Postfix will return only
- the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a>
+ the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a>
setting.
This option is ignored before Postfix version 2.10.
- <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe-
+ <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe-
cuting the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command.
- Warning: flushing undeliverable mail frequently will result in
+ Warning: flushing undeliverable mail frequently will result in
poor delivery performance of all other mail.
<b>-q</b><i>interval</i> (ignored)
@@ -221,21 +226,21 @@ SENDMAIL(1) SENDMAIL(1)
<b>-qI</b><i>queueid</i>
Schedule immediate delivery of mail with the specified queue ID.
- This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com-
+ This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com-
mand, and is available with Postfix version 2.4 and later.
<b>-qR</b><i>site</i>
- Schedule immediate delivery of all mail that is queued for the
- named <i>site</i>. This option accepts only <i>site</i> names that are eligi-
- ble for the "fast flush" service, and is implemented by execut-
+ Schedule immediate delivery of all mail that is queued for the
+ named <i>site</i>. This option accepts only <i>site</i> names that are eligi-
+ ble for the "fast flush" service, and is implemented by execut-
ing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information
about the "fast flush" service.
<b>-qS</b><i>site</i>
- This command is not implemented. Use the slower "<b>sendmail -q</b>"
+ This command is not implemented. Use the slower "<b>sendmail -q</b>"
command instead.
- <b>-t</b> Extract recipients from message headers. These are added to any
+ <b>-t</b> Extract recipients from message headers. These are added to any
recipients specified on the command line.
With Postfix versions prior to 2.1, this option requires that no
@@ -251,23 +256,23 @@ SENDMAIL(1) SENDMAIL(1)
This feature is available in Postfix 2.3 and later.
<b>-XV</b> (Postfix 2.2 and earlier: <b>-V</b>)
- Variable Envelope Return Path. Given an envelope sender address
- of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i>
+ Variable Envelope Return Path. Given an envelope sender address
+ of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i>
receives mail with a personalized envelope sender address.
- By default, the personalized envelope sender address is
- <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac-
- ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu-
+ By default, the personalized envelope sender address is
+ <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac-
+ ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu-
ration parameter.
<b>-XV</b><i>xy</i> (Postfix 2.2 and earlier: <b>-V</b><i>xy</i>)
- As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters,
+ As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters,
instead of the characters specified with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delim</a>-</b>
<b><a href="postconf.5.html#default_verp_delimiters">iters</a></b> configuration parameter.
<b>-v</b> Send an email report of the first delivery attempt (Postfix ver-
- sions 2.1 and later). Mail delivery always happens in the back-
- ground. When multiple <b>-v</b> options are given, enable verbose log-
+ sions 2.1 and later). Mail delivery always happens in the back-
+ ground. When multiple <b>-v</b> options are given, enable verbose log-
ging for debugging purposes.
<b>-X</b> <i>log</i><b>_</b><i>file</i> (ignored)
@@ -276,11 +281,12 @@ SENDMAIL(1) SENDMAIL(1)
<b>SECURITY</b>
By design, this program is not set-user (or group) id. However, it must
- handle data from untrusted, possibly remote, users. Thus, the usual
+ handle data from untrusted, possibly remote, users. Thus, the usual
precautions need to be taken against malicious inputs.
<b>DIAGNOSTICS</b>
- Problems are logged to <b>syslogd</b>(8) and to the standard error stream.
+ Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard
+ error stream.
<b>ENVIRONMENT</b>
<b>MAIL_CONFIG</b>
@@ -309,7 +315,7 @@ SENDMAIL(1) SENDMAIL(1)
line endings from &lt;CR&gt;&lt;LF&gt; into UNIX format (&lt;LF&gt;).
<b>TROUBLE SHOOTING CONTROLS</b>
- The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to trouble shoot a Postfix
+ The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix
system.
<b><a href="postconf.5.html#debugger_command">debugger_command</a> (empty)</b>
@@ -400,6 +406,11 @@ SENDMAIL(1) SENDMAIL(1)
The time after which the sender receives a copy of the message
headers of mail that is still queued.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
The UNIX system account that owns the Postfix queue and most
Postfix daemon processes.
@@ -416,9 +427,23 @@ SENDMAIL(1) SENDMAIL(1)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Postfix 3.2 and later:
+
+ <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b>
+ A list of non-default Postfix configuration directories that may
+ be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in
+ the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the
+ MAIL_CONFIG environment parameter.
+
+ <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b>
+ An optional list of non-default Postfix configuration directo-
+ ries; these directories belong to additional Postfix instances
+ that share the Postfix executable files and documentation with
+ the default Postfix instance, and that are started, stopped,
+ etc., together with the default Postfix instance.
<b>FILES</b>
/var/spool/postfix, mail queue
@@ -434,6 +459,7 @@ SENDMAIL(1) SENDMAIL(1)
<a href="postdrop.1.html">postdrop(1)</a>, mail posting utility
<a href="postfix.1.html">postfix(1)</a>, mail system control
<a href="postqueue.1.html">postqueue(1)</a>, mail queue control
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README_FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/makedefs.1.html b/external/ibm-public/postfix/dist/html/makedefs.1.html
new file mode 100644
index 00000000000..cf1f02c1743
--- /dev/null
+++ b/external/ibm-public/postfix/dist/html/makedefs.1.html
@@ -0,0 +1,213 @@
+<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
+ "http://www.w3.org/TR/html4/loose.dtd">
+<html> <head>
+<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
+<title> Postfix manual - makedefs(1) </title>
+</head> <body> <pre>
+MAKEDEFS(1) MAKEDEFS(1)
+
+<b>NAME</b>
+ makedefs - Postfix makefile configuration utility
+
+<b>SYNOPSIS</b>
+ <b>make makefiles</b> <i>name=value...</i>
+
+<b>DESCRIPTION</b>
+ The <b>makedefs</b> command identifies the compilation environment, and emits
+ macro definitions on the standard output stream that can be prepended
+ to template Makefiles. These macros implement an internal interface
+ and are subject to change without notice.
+
+<b>NAME=VALUE OVERRIDES</b>
+ Default settings can be overruled by specifying them as environment
+ variables (or as name=value pairs on the "make" command line). Use
+ quotes if variables contain whitespace or shell meta characters.
+
+ The command "<b>make makefiles name=value...</b>" will replace the string
+ <b>MAIL_VERSION</b> at the end of a value with the Postfix version
+ (<i>major.minor.patchlevel</i> for a stable release, <i>major.minor-date</i> for a
+ development release). Do not try to specify something like <b>$<a href="postconf.5.html#mail_version">mail_ver</a>-</b>
+ <b><a href="postconf.5.html#mail_version">sion</a></b>: that produces inconsistent results with different implementations
+ of the make(1) command.
+
+ <b>AUXLIBS=</b><i>object</i><b>_</b><i>library...</i>
+ Specifies one or more non-default object libraries. Postfix 3.0
+ and later specify some of their database library dependencies
+ with <a href="CDB_README.html">AUXLIBS_CDB</a>, <a href="LDAP_README.html">AUXLIBS_LDAP</a>, <a href="LMDB_README.html">AUXLIBS_LMDB</a>, <a href="MYSQL_README.html">AUXLIBS_MYSQL</a>,
+ <a href="PCRE_README.html">AUXLIBS_PCRE</a>, <a href="PGSQL_README.html">AUXLIBS_PGSQL</a>, <a href="SDBM_README.html">AUXLIBS_SDBM</a>, and <a href="SQLITE_README.html">AUXLIBS_SQLITE</a>,
+ respectively.
+
+ <b>CC=</b><i>compiler</i><b>_</b><i>command</i>
+ Specifies a non-default compiler. On many systems, the default
+ is <b>gcc</b>.
+
+ <b>CCARGS=</b><i>compiler</i><b>_</b><i>arguments</i>
+ Specifies non-default compiler arguments, for example, a
+ non-default <i>include</i> directory. The following directives are
+ special:
+
+ <b>-DNO_DB</b>
+ Do not build with Berkeley DB support.
+
+ <b>-DNO_DEVPOLL</b>
+ Do not build with Solaris /dev/poll support. By default,
+ /dev/poll support is compiled in on platforms that are
+ known to support it.
+
+ <b>-DNO_DNSSEC</b>
+ Do not build with DNSSEC support, even if the resolver
+ library appears to support it.
+
+ <b>-DNO_EPOLL</b>
+ Do not build with Linux EPOLL support. By default, EPOLL
+ support is compiled in on platforms that are known to
+ support it.
+
+ <b>-DNO_EAI</b>
+ Do not build with EAI (SMTPUTF8) support. By default, EAI
+ support is compiled in when the "pkg-config" command is
+ found, or the deprecated "icu-config" command.
+
+ <b>-DNO_INLINE</b>
+ Do not require support for C99 "inline" functions.
+ Instead, implement argument typechecks for
+ non-(printf/scanf)-like functions with ternary operators
+ and unreachable code.
+
+ <b>-DNO_IPV6</b>
+ Do not build with IPv6 support. By default, IPv6 support
+ is compiled in on platforms that are known to have IPv6
+ support.
+
+ Note: this directive is for debugging and testing only.
+ It is not guaranteed to work on all platforms. If you
+ don't want IPv6 support, set "<a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4" in
+ <a href="postconf.5.html">main.cf</a>.
+
+ <b>-DNO_IP_CYRUS_SASL_AUTH</b>
+ Don't pass remote SMTP client and Postfix SMTP server IP
+ address and port information to the Cyrus SASL library.
+ This is compatible with Postfix &lt; 3.2.
+
+ <b>-DNO_KQUEUE</b>
+ Do not build with FreeBSD/NetBSD/OpenBSD/MacOSX KQUEUE
+ support. By default, KQUEUE support is compiled in on
+ platforms that are known to support it.
+
+ <b>-DNO_NIS</b>
+ Do not build with NIS or NISPLUS support. Support for NIS
+ is unavailable on some recent Linux distributions.
+
+ <b>-DNO_NISPLUS</b>
+ Do not build with NISPLUS support. Support for NISPLUS is
+ unavailable on some recent Solaris distributions.
+
+ <b>-DNO_PCRE</b>
+ Do not build with PCRE support. By default, PCRE support
+ is compiled in when the <b>pcre-config</b> utility is installed.
+
+ <b>-DNO_POSIX_GETPW_R</b>
+ Disable support for POSIX getpwnam_r/getpwuid_r.
+
+ <b>-DNO_SIGSETJMP</b>
+ Use setjmp()/longjmp() instead of sigsetjmp()/sig-
+ longjmp(). By default, Postfix uses sigsetjmp()/sig-
+ longjmp() when they appear to work.
+
+ <b>-DNO_SNPRINTF</b>
+ Use sprintf() instead of snprintf(). By default, Postfix
+ uses snprintf() except on ancient systems.
+
+ <b>DEBUG=</b><i>debug</i><b>_</b><i>level</i>
+ Specifies a non-default debugging level. The default is <b>-g</b>.
+ Specify <b>DEBUG=</b> to turn off debugging.
+
+ <b>OPT=</b><i>optimization</i><b>_</b><i>level</i>
+ Specifies a non-default optimization level. The default is <b>-O</b>.
+ Specify <b>OPT=</b> to turn off optimization.
+
+ <b>POSTFIX_INSTALL_OPTS=</b><i>-option...</i>
+ Specifies options for the postfix-install command, separated by
+ whitespace. Currently, the only supported option is
+ <b>-keep-build-mtime</b>.
+
+ <b>SHLIB_CFLAGS=</b><i>flags</i>
+ Override the compiler flags (typically, "-fPIC") for Postfix
+ dynamically-linked libraries and database plugins.
+
+ This feature was introduced with Postfix 3.0.
+
+ <b>SHLIB_RPATH=</b><i>rpath</i>
+ Override the runpath (typically, "'-Wl,-rpath,${SHLIB_DIR}'")
+ for Postfix dynamically-linked libraries.
+
+ This feature was introduced with Postfix 3.0.
+
+ <b>SHLIB_SUFFIX=</b><i>suffix</i>
+ Override the filename suffix (typically, ".so") for Postfix
+ dynamically-linked libraries and database plugins.
+
+ This feature was introduced with Postfix 3.0.
+
+ <b>shared=yes</b>
+
+ <b>shared=no</b>
+ Enable (disable) Postfix builds with dynamically-linked
+ libraries typically named $<a href="postconf.5.html#shlib_directory">shlib_directory</a>/libpostfix-*.so.*.
+
+ This feature was introduced with Postfix 3.0.
+
+ <b>dynamicmaps=yes</b>
+
+ <b>dynamicmaps=no</b>
+ Enable (disable) Postfix builds with the configuration file
+ $<a href="postconf.5.html#meta_directory">meta_directory</a>/dynamicmaps.cf and dynamically-loadable database
+ plugins typically named postfix-*.so.*. The setting "dynam-
+ icmaps=yes" implicitly enables Postfix dynamically-linked
+ libraries.
+
+ This feature was introduced with Postfix 3.0.
+
+ <b>pie=yes</b>
+
+ <b>pie=no</b> Enable (disable) Postfix builds with position-independent exe-
+ cutables, on platforms where this is supported.
+
+ This feature was introduced with Postfix 3.0.
+
+ <i>installation</i><b>_</b><i>parameter</i><b>=</b><i>value</i>...
+ Override the compiled-in default value of the specified instal-
+ lation parameter(s). The following parameters are supported in
+ this context:
+
+ <a href="postconf.5.html#command_directory">command_directory</a> <a href="postconf.5.html#config_directory">config_directory</a> <a href="postconf.5.html#daemon_directory">daemon_directory</a> <a href="postconf.5.html#data_directory">data_direc</a>-
+ <a href="postconf.5.html#data_directory">tory</a> <a href="postconf.5.html#default_database_type">default_database_type</a> <a href="postconf.5.html#html_directory">html_directory</a> <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a>
+ <a href="postconf.5.html#mailq_path">mailq_path</a> <a href="postconf.5.html#manpage_directory">manpage_directory</a> <a href="postconf.5.html#meta_directory">meta_directory</a> <a href="postconf.5.html#newaliases_path">newaliases_path</a>
+ <a href="postconf.5.html#queue_directory">queue_directory</a> <a href="postconf.5.html#readme_directory">readme_directory</a> <a href="postconf.5.html#sendmail_path">sendmail_path</a> <a href="postconf.5.html#shlib_directory">shlib_directory</a>
+ <a href="postconf.5.html#openssl_path">openssl_path</a>
+
+ See the <a href="postconf.5.html">postconf(5)</a> manpage for a description of these parame-
+ ters.
+
+ This feature was introduced with Postfix 3.0.
+
+ <b>WARN=</b><i>warning</i><b>_</b><i>flags</i>
+ Specifies non-default gcc compiler warning options for use when
+ "make" is invoked in a source subdirectory only.
+
+<b>LICENSE</b>
+ The Secure Mailer license must be distributed with this software.
+
+<b>AUTHOR(S)</b>
+ Wietse Venema
+ IBM T.J. Watson Research
+ P.O. Box 704
+ Yorktown Heights, NY 10598, USA
+
+ Wietse Venema
+ Google, Inc.
+ 111 8th Avenue
+ New York, NY 10011, USA
+
+ MAKEDEFS(1)
+</pre> </body> </html>
diff --git a/external/ibm-public/postfix/dist/html/master.5.html b/external/ibm-public/postfix/dist/html/master.5.html
index aa56f04a32b..4e488fc021f 100644
--- a/external/ibm-public/postfix/dist/html/master.5.html
+++ b/external/ibm-public/postfix/dist/html/master.5.html
@@ -65,10 +65,10 @@ MASTER(5) MASTER(5)
The service name is specified as <i>host:port</i>, denoting the
host and port on which new connections should be
accepted. The host part (and colon) may be omitted.
- Either host or port may be given in symbolic form (host
- or service name) or in numeric form (IP address or port
- number). Host information may be enclosed inside "[]";
- this form is necessary only with IPv6 addresses.
+ Either host or port may be given in symbolic form (see
+ <b>hosts</b>(5) or <b>services</b>(5)) or in numeric form (IP address
+ or port number). Host information may be enclosed inside
+ "[]"; this form is necessary only with IPv6 addresses.
Examples: a service named <b>127.0.0.1:smtp</b> or <b>::1:smtp</b>
receives mail via the loopback interface only; and a ser-
@@ -81,8 +81,8 @@ MASTER(5) MASTER(5)
hard-coding loopback IP address information in <a href="master.5.html">master.cf</a>
or in <a href="postconf.5.html">main.cf</a>.
- <b>unix</b> The service listens on a UNIX-domain socket and is acces-
- sible for local clients only.
+ <b>unix</b> The service listens on a UNIX-domain stream socket and is
+ accessible for local clients only.
The service name is a pathname relative to the Postfix
queue directory (pathname controlled with the
@@ -91,29 +91,38 @@ MASTER(5) MASTER(5)
On Solaris 8 and earlier systems the <b>unix</b> type is imple-
mented with streams sockets.
- <b>fifo</b> The service listens on a FIFO (named pipe) and is acces-
- sible for local clients only.
+ <b>unix-dgram</b>
+ The service listens on a UNIX-domain datagram socket and
+ is accessible for local clients only.
The service name is a pathname relative to the Postfix
queue directory (pathname controlled with the
<b><a href="postconf.5.html#queue_directory">queue_directory</a></b> configuration parameter in <a href="postconf.5.html">main.cf</a>).
- <b>pass</b> The service listens on a UNIX-domain socket, and is
- accessible to local clients only. It receives one open
- connection (file descriptor passing) per connection
- request.
+ <b>fifo</b> (obsolete)
+ The service listens on a FIFO (named pipe) and is acces-
+ sible for local clients only.
The service name is a pathname relative to the Postfix
queue directory (pathname controlled with the
<b><a href="postconf.5.html#queue_directory">queue_directory</a></b> configuration parameter in <a href="postconf.5.html">main.cf</a>).
- On Solaris 8 and earlier systems the <b>pass</b> type is imple-
+ <b>pass</b> The service listens on a UNIX-domain stream socket, and
+ is accessible to local clients only. It receives one open
+ connection (file descriptor passing) per connection
+ request.
+
+ The service name is a pathname relative to the Postfix
+ queue directory (pathname controlled with the
+ <b><a href="postconf.5.html#queue_directory">queue_directory</a></b> configuration parameter in <a href="postconf.5.html">main.cf</a>).
+
+ On Solaris 8 and earlier systems the <b>pass</b> type is imple-
mented with streams sockets.
This feature is available as of Postfix version 2.5.
<b>Private (default: y)</b>
- Whether or not access is restricted to the mail system. Inter-
+ Whether or not access is restricted to the mail system. Inter-
net (type <b>inet</b>) services can't be private.
<b>Unprivileged (default: y)</b>
@@ -121,80 +130,80 @@ MASTER(5) MASTER(5)
the Postfix system (the owner name is controlled by the
<b><a href="postconf.5.html#mail_owner">mail_owner</a></b> configuration variable in the <a href="postconf.5.html">main.cf</a> file).
- The <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a>, <a href="spawn.8.html"><b>spawn</b>(8)</a>, and <a href="virtual.8.html"><b>virtual</b>(8)</a> daemons require
+ The <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a>, <a href="spawn.8.html"><b>spawn</b>(8)</a>, and <a href="virtual.8.html"><b>virtual</b>(8)</a> daemons require
privileges.
<b>Chroot (default: Postfix</b> &gt;<b>= 3.0: n, Postfix</b> &lt;<b>3.0: y)</b>
- Whether or not the service runs chrooted to the mail queue
+ Whether or not the service runs chrooted to the mail queue
directory (pathname is controlled by the <b><a href="postconf.5.html#queue_directory">queue_directory</a></b> config-
uration variable in the <a href="postconf.5.html">main.cf</a> file).
- Chroot should not be used with the <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a>, <a href="spawn.8.html"><b>spawn</b>(8)</a>,
+ Chroot should not be used with the <a href="local.8.html"><b>local</b>(8)</a>, <a href="pipe.8.html"><b>pipe</b>(8)</a>, <a href="spawn.8.html"><b>spawn</b>(8)</a>,
and <a href="virtual.8.html"><b>virtual</b>(8)</a> daemons. Although the <a href="proxymap.8.html"><b>proxymap</b>(8)</a> server can run
- chrooted, doing so defeats most of the purpose of having that
+ chrooted, doing so defeats most of the purpose of having that
service in the first place.
The files in the examples/chroot-setup subdirectory of the Post-
- fix source archive show set up a Postfix chroot environment on a
- variety of systems. See also <a href="BASIC_CONFIGURATION_README.html">BASIC_CONFIGURATION_README</a> for
+ fix source show how to set up a Postfix chroot environment on a
+ variety of systems. See also <a href="BASIC_CONFIGURATION_README.html">BASIC_CONFIGURATION_README</a> for
issues related to running daemons chrooted.
<b>Wake up time (default: 0)</b>
Automatically wake up the named service after the specified num-
- ber of seconds. The wake up is implemented by connecting to the
- service and sending a wake up request. A ? at the end of the
- wake-up time field requests that no wake up events be sent
+ ber of seconds. The wake up is implemented by connecting to the
+ service and sending a wake up request. A ? at the end of the
+ wake-up time field requests that no wake up events be sent
before the first time a service is used. Specify 0 for no auto-
matic wake up.
- The <a href="pickup.8.html"><b>pickup</b>(8)</a>, <a href="qmgr.8.html"><b>qmgr</b>(8)</a> and <a href="flush.8.html"><b>flush</b>(8)</a> daemons require a wake up
+ The <a href="pickup.8.html"><b>pickup</b>(8)</a>, <a href="qmgr.8.html"><b>qmgr</b>(8)</a> and <a href="flush.8.html"><b>flush</b>(8)</a> daemons require a wake up
timer.
<b>Process limit (default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b>
- The maximum number of processes that may execute this service
+ The maximum number of processes that may execute this service
simultaneously. Specify 0 for no process count limit.
- NOTE: Some Postfix services must be configured as a sin-
- gle-process service (for example, <a href="qmgr.8.html"><b>qmgr</b>(8)</a>) and some services
- must be configured with no process limit (for example,
+ NOTE: Some Postfix services must be configured as a sin-
+ gle-process service (for example, <a href="qmgr.8.html"><b>qmgr</b>(8)</a>) and some services
+ must be configured with no process limit (for example,
<a href="cleanup.8.html"><b>cleanup</b>(8)</a>). These limits must not be changed.
<b>Command name + arguments</b>
- The command to be executed. Characters that are special to the
- shell such as "&gt;" or "|" have no special meaning here, and
- quotes cannot be used to protect arguments containing white-
- space. To protect whitespace, use "{" and "}" as described
+ The command to be executed. Characters that are special to the
+ shell such as "&gt;" or "|" have no special meaning here, and
+ quotes cannot be used to protect arguments containing white-
+ space. To protect whitespace, use "{" and "}" as described
below.
- The command name is relative to the Postfix daemon directory
- (pathname is controlled by the <b><a href="postconf.5.html#daemon_directory">daemon_directory</a></b> configuration
+ The command name is relative to the Postfix daemon directory
+ (pathname is controlled by the <b><a href="postconf.5.html#daemon_directory">daemon_directory</a></b> configuration
variable).
- The command argument syntax for specific commands is specified
+ The command argument syntax for specific commands is specified
in the respective daemon manual page.
- The following command-line options have the same effect for all
+ The following command-line options have the same effect for all
daemon programs:
- <b>-D</b> Run the daemon under control by the command specified
+ <b>-D</b> Run the daemon under control by the command specified
with the <b><a href="postconf.5.html#debugger_command">debugger_command</a></b> variable in the <a href="postconf.5.html">main.cf</a> config-
uration file. See <a href="DEBUG_README.html">DEBUG_README</a> for hints and tips.
<b>-o {</b> <i>name</i> = <i>value</i> <b>}</b> (long form, Postfix &gt;= 3.0)
<b>-o</b> <i>name</i>=<i>value</i> (short form)
- Override the named <a href="postconf.5.html">main.cf</a> configuration parameter. The
- parameter value can refer to other parameters as <i>$name</i>
- etc., just like in <a href="postconf.5.html">main.cf</a>. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for syntax.
+ Override the named <a href="postconf.5.html">main.cf</a> configuration parameter. The
+ parameter value can refer to other parameters as <i>$name</i>
+ etc., just like in <a href="postconf.5.html">main.cf</a>. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for syntax.
- NOTE 1: With the "long form" shown above, whitespace
- after "{", around "=", and before "}" is ignored, and
+ NOTE 1: With the "long form" shown above, whitespace
+ after "{", around "=", and before "}" is ignored, and
whitespace within the parameter value is preserved.
NOTE 2: with the "short form" shown above, do not specify
- whitespace around the "=" or in parameter values. To
- specify a parameter value that contains whitespace, use
- the long form described above, or use commas instead of
+ whitespace around the "=" or in parameter values. To
+ specify a parameter value that contains whitespace, use
+ the long form described above, or use commas instead of
spaces, or specify the value in <a href="postconf.5.html">main.cf</a>. Example:
/etc/postfix/<a href="master.5.html">master.cf</a>:
@@ -205,18 +214,18 @@ MASTER(5) MASTER(5)
submission_xxx_yyy = text with whitespace...
NOTE 3: Over-zealous use of parameter overrides makes the
- Postfix configuration hard to understand and maintain.
- At a certain point, it might be easier to configure mul-
+ Postfix configuration hard to understand and maintain.
+ At a certain point, it might be easier to configure mul-
tiple instances of Postfix, instead of configuring multi-
ple personalities via <a href="master.5.html">master.cf</a>.
- <b>-v</b> Increase the verbose logging level. Specify multiple <b>-v</b>
- options to make a Postfix daemon process increasingly
+ <b>-v</b> Increase the verbose logging level. Specify multiple <b>-v</b>
+ options to make a Postfix daemon process increasingly
verbose.
Other command-line arguments
Specify "{" and "}" around command arguments that contain
- whitespace (Postfix 3.0 and later). Whitespace after "{"
+ whitespace (Postfix 3.0 and later). Whitespace after "{"
and before "}" is ignored.
<b>SEE ALSO</b>
diff --git a/external/ibm-public/postfix/dist/html/master.8.html b/external/ibm-public/postfix/dist/html/master.8.html
index 701e5e8ffe9..e06802898b5 100644
--- a/external/ibm-public/postfix/dist/html/master.8.html
+++ b/external/ibm-public/postfix/dist/html/master.8.html
@@ -10,7 +10,7 @@ MASTER(8) MASTER(8)
master - Postfix master process
<b>SYNOPSIS</b>
- <b>master</b> [<b>-Ddtvw</b>] [<b>-c</b> <i>config</i><b>_</b><i>dir</i>] [<b>-e</b> <i>exit</i><b>_</b><i>time</i>]
+ <b>master</b> [<b>-Dditvw</b>] [<b>-c</b> <i>config</i><b>_</b><i>dir</i>] [<b>-e</b> <i>exit</i><b>_</b><i>time</i>]
<b>DESCRIPTION</b>
The <a href="master.8.html"><b>master</b>(8)</a> daemon is the resident process that runs Postfix daemons
@@ -47,6 +47,18 @@ MASTER(8) MASTER(8)
Terminate the master process after <i>exit</i><b>_</b><i>time</i> seconds. Child pro-
cesses terminate at their convenience.
+ <b>-i</b> Enable <b>init</b> mode: do not become a session or process group
+ leader; and similar to <b>-s</b>, do not redirect stdout to /dev/null,
+ so that "<a href="postconf.5.html#maillog_file">maillog_file</a> = /dev/stdout" works. This mode is
+ allowed only if the process ID equals 1.
+
+ This feature is available in Postfix 3.3 and later.
+
+ <b>-s</b> Do not redirect stdout to /dev/null, so that "<a href="postconf.5.html#maillog_file">maillog_file</a> =
+ /dev/stdout" works.
+
+ This feature is available in Postfix 3.4 and later.
+
<b>-t</b> Test mode. Return a zero exit status when the <b>master.pid</b> lock
file does not exist or when that file is not locked. This is
evidence that the <a href="master.8.html"><b>master</b>(8)</a> daemon is not running.
@@ -80,9 +92,9 @@ MASTER(8) MASTER(8)
running processes to finish what they are doing.
<b>DIAGNOSTICS</b>
- Problems are reported to <b>syslogd</b>(8). The exit status is non-zero in
- case of problems, including problems while initializing as a master
- daemon process in the background.
+ Problems are reported to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. The exit status is
+ non-zero in case of problems, including problems while initializing as
+ a master daemon process in the background.
<b>ENVIRONMENT</b>
<b>MAIL_DEBUG</b>
@@ -143,11 +155,12 @@ MASTER(8) MASTER(8)
or accepting connections.
<b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
- The list of environment parameters that a Postfix process will
- import from a non-Postfix parent process.
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
<b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
- The UNIX system account that owns the Postfix queue and most
+ The UNIX system account that owns the Postfix queue and most
Postfix daemon processes.
<b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
@@ -163,9 +176,13 @@ MASTER(8) MASTER(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>FILES</b>
To expand the directory names below into their actual values, use the
@@ -181,6 +198,7 @@ MASTER(8) MASTER(8)
<a href="verify.8.html">verify(8)</a>, address verification
<a href="master.5.html">master(5)</a>, <a href="master.5.html">master.cf</a> configuration file syntax
<a href="postconf.5.html">postconf(5)</a>, <a href="postconf.5.html">main.cf</a> configuration file syntax
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/mysql_table.5.html b/external/ibm-public/postfix/dist/html/mysql_table.5.html
index ca15b165637..6dcb4ed29ac 100644
--- a/external/ibm-public/postfix/dist/html/mysql_table.5.html
+++ b/external/ibm-public/postfix/dist/html/mysql_table.5.html
@@ -26,70 +26,41 @@ MYSQL_TABLE(5) MYSQL_TABLE(5)
The file /etc/postfix/mysql-aliases.cf has the same format as the Post-
fix <a href="postconf.5.html">main.cf</a> file, and can specify the parameters described below.
-<b>BACKWARDS COMPATIBILITY</b>
- For compatibility with other Postfix lookup tables, MySQL parameters
- can also be defined in <a href="postconf.5.html">main.cf</a>. In order to do that, specify as MySQL
- source a name that doesn't begin with a slash or a dot. The MySQL
- parameters will then be accessible as the name you've given the source
- in its definition, an underscore, and the name of the parameter. For
- example, if the map is specified as "<a href="mysql_table.5.html">mysql</a>:<i>mysqlname</i>", the parameter
- "hosts" below would be defined in <a href="postconf.5.html">main.cf</a> as "<i>mysqlname</i>_hosts".
-
- Note: with this form, the passwords for the MySQL sources are written
- in <a href="postconf.5.html">main.cf</a>, which is normally world-readable. Support for this form
- will be removed in a future Postfix version.
-
- Normally, the SQL query is specified via a single <b>query</b> parameter
- (described in more detail below). When this parameter is not specified
- in the map definition, Postfix reverts to an older interface, with the
- SQL query constructed from the <b>select_field</b>, <b>table</b>, <b>where_field</b> and
- <b>additional_conditions</b> parameters. The old interface will be gradually
- phased out. To migrate to the new interface set:
-
- <b>query</b> = SELECT [<i>select</i><b>_</b><i>field</i>]
- FROM [<i>table</i>]
- WHERE [<i>where</i><b>_</b><i>field</i>] = '%s'
- [<i>additional</i><b>_</b><i>conditions</i>]
-
- Insert the value, not the name, of each legacy parameter. Note that the
- <b>additional_conditions</b> parameter is optional and if not empty, will
- always start with <b>AND</b>.
-
<b>LIST MEMBERSHIP</b>
- When using SQL to store lists such as $<a href="postconf.5.html#mynetworks">mynetworks</a>, $<a href="postconf.5.html#mydestination">mydestination</a>,
- $<a href="postconf.5.html#relay_domains">relay_domains</a>, $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, etc., it is important to under-
+ When using SQL to store lists such as $<a href="postconf.5.html#mynetworks">mynetworks</a>, $<a href="postconf.5.html#mydestination">mydestination</a>,
+ $<a href="postconf.5.html#relay_domains">relay_domains</a>, $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, etc., it is important to under-
stand that the table must store each list member as a separate key. The
- table lookup verifies the *existence* of the key. See "Postfix lists
+ table lookup verifies the *existence* of the key. See "Postfix lists
versus tables" in the <a href="DATABASE_README.html">DATABASE_README</a> document for a discussion.
- Do NOT create tables that return the full list of domains in $<a href="postconf.5.html#mydestination">mydesti</a>-
+ Do NOT create tables that return the full list of domains in $<a href="postconf.5.html#mydestination">mydesti</a>-
<a href="postconf.5.html#mydestination">nation</a> or $<a href="postconf.5.html#relay_domains">relay_domains</a> etc., or IP addresses in $<a href="postconf.5.html#mynetworks">mynetworks</a>.
DO create tables with each matching item as a key and with an arbitrary
- value. With SQL databases it is not uncommon to return the key itself
+ value. With SQL databases it is not uncommon to return the key itself
or a constant value.
<b>MYSQL PARAMETERS</b>
- <b>hosts</b> The hosts that Postfix will try to connect to and query from.
+ <b>hosts</b> The hosts that Postfix will try to connect to and query from.
Specify <i>unix:</i> for UNIX domain sockets, <i>inet:</i> for TCP connections
(default). Example:
hosts = host1.some.domain host2.some.domain:port
hosts = unix:/file/name
- The hosts are tried in random order, with all connections over
+ The hosts are tried in random order, with all connections over
UNIX domain sockets being tried before those over TCP. The con-
- nections are automatically closed after being idle for about 1
+ nections are automatically closed after being idle for about 1
minute, and are re-opened as necessary. Postfix versions 2.0 and
earlier do not randomize the host order.
NOTE: if you specify localhost as a hostname (even if you prefix
- it with <i>inet:</i>), MySQL will connect to the default UNIX domain
+ it with <i>inet:</i>), MySQL will connect to the default UNIX domain
socket. In order to instruct MySQL to connect to localhost over
TCP you have to specify
hosts = 127.0.0.1
<b>user, password</b>
- The user name and password to log into the mysql server. Exam-
+ The user name and password to log into the mysql server. Exam-
ple:
user = someone
password = some_password
@@ -97,10 +68,15 @@ MYSQL_TABLE(5) MYSQL_TABLE(5)
<b>dbname</b> The database name on the servers. Example:
dbname = customer_database
- <b>query</b> The SQL query template used to search the database, where <b>%s</b> is
- a substitute for the address Postfix is trying to resolve, e.g.
+ <b>query</b> The SQL query template used to search the database, where <b>%s</b> is
+ a substitute for the address Postfix is trying to resolve, e.g.
query = SELECT replacement FROM aliases WHERE mailbox = '%s'
+ By default, every query must return a result set (instead of
+ storing its results in a table); with "<b>require_result_set = no</b>"
+ (Postfix 3.2 and later), the absence of a result set is treated
+ as "not found".
+
This parameter supports the following '%' expansions:
<b>%%</b> This is replaced by a literal '%' character.
@@ -225,20 +201,33 @@ MYSQL_TABLE(5) MYSQL_TABLE(5)
<b>option_file</b>
Read options from the given file instead of the default my.cnf
- location.
+ location. This reads options from the <b>[client]</b> option group,
+ optionally followed by options from the group given with
+ <b>option_group</b>.
This parameter is available with Postfix 2.11 and later.
- <b>option_group</b>
- Read options from the given group.
+ <b>option_group (default: Postfix</b> &gt;<b>=3.2: client,</b> &lt;<b>= 3.1: empty)</b>
+ Read options from the given group of the mysql options file,
+ after reading options from the <b>[client]</b> group.
- Postfix 3.1 and earlier don't read <b>[client]</b> option group set-
- tings unless a non-empty <b>option_file</b> or <b>option_group</b> value are
+ Postfix 3.2 and later read <b>[client]</b> option group settings by
+ default. To disable this specify no <b>option_file</b> and specify
+ "<b>option_group =</b>" (i.e. an empty value).
+
+ Postfix 3.1 and earlier don't read <b>[client]</b> option group set-
+ tings unless a non-empty <b>option_file</b> or <b>option_group</b> value are
specified. To enable this, specify, for example, "<b>option_group =</b>
<b>client</b>".
This parameter is available with Postfix 2.11 and later.
+ <b>require_result_set (default: yes)</b>
+ If "<b>yes</b>", require that every query returns a result set. If
+ "<b>no</b>", treat the absence of a result set as "not found".
+
+ This parameter is available with Postfix 3.2 and later.
+
<b>tls_cert_file</b>
File containing client's X509 certificate.
@@ -268,14 +257,57 @@ MYSQL_TABLE(5) MYSQL_TABLE(5)
This parameter is available with Postfix 2.11 and later.
+<b>USING MYSQL STORED PROCEDURES</b>
+ Postfix 3.2 and later support calling a stored procedure instead of
+ using a SELECT statement in the query, e.g.
+
+ <b>query</b> = CALL lookup('%s')
+
+ The previously described '%' expansions can be used in the parameter(s)
+ to the stored procedure.
+
+ By default, every stored procedure call must return a result set, i.e.
+ every code path must execute a SELECT statement that returns a result
+ set (instead of storing its results in a table). With
+ "<b>require_result_set = no</b>", the absence of a result set is treated as
+ "not found".
+
+ A stored procedure must not return multiple result sets. That is,
+ there must be no code path that executes multiple SELECT statements
+ that return a result (instead of storing their results in a table).
+
+ The following is an example of a stored procedure returning a single
+ result set:
+
+ CREATE [DEFINER=`user`@`host`] PROCEDURE
+ `lookup`(IN `param` VARCHAR(255))
+ READS SQL DATA
+ SQL SECURITY INVOKER
+ BEGIN
+ select goto from alias where address=param;
+ END
+
+<b>OBSOLETE MAIN.CF PARAMETERS</b>
+ For compatibility with other Postfix lookup tables, MySQL parameters
+ can also be defined in <a href="postconf.5.html">main.cf</a>. In order to do that, specify as MySQL
+ source a name that doesn't begin with a slash or a dot. The MySQL
+ parameters will then be accessible as the name you've given the source
+ in its definition, an underscore, and the name of the parameter. For
+ example, if the map is specified as "<a href="mysql_table.5.html">mysql</a>:<i>mysqlname</i>", the parameter
+ "hosts" would be defined in <a href="postconf.5.html">main.cf</a> as "<i>mysqlname</i>_hosts".
+
+ Note: with this form, the passwords for the MySQL sources are written
+ in <a href="postconf.5.html">main.cf</a>, which is normally world-readable. Support for this form
+ will be removed in a future Postfix version.
+
<b>OBSOLETE QUERY INTERFACE</b>
- This section describes an interface that is deprecated as of Postfix
- 2.2. It is replaced by the more general <b>query</b> interface described
- above. If the <b>query</b> parameter is defined, the legacy parameters
- described here ignored. Please migrate to the new interface as the
+ This section describes an interface that is deprecated as of Postfix
+ 2.2. It is replaced by the more general <b>query</b> interface described
+ above. If the <b>query</b> parameter is defined, the legacy parameters
+ described here ignored. Please migrate to the new interface as the
legacy interface may be removed in a future release.
- The following parameters can be used to fill in a SELECT template
+ The following parameters can be used to fill in a SELECT template
statement of the form:
SELECT [<b>select_field</b>]
@@ -284,7 +316,7 @@ MYSQL_TABLE(5) MYSQL_TABLE(5)
[<b>additional_conditions</b>]
The specifier %s is replaced by the search string, and is escaped so if
- it contains single quotes or other odd characters, it will not cause a
+ it contains single quotes or other odd characters, it will not cause a
parse error, or worse, a security problem.
<b>select_field</b>
@@ -330,5 +362,12 @@ MYSQL_TABLE(5) MYSQL_TABLE(5)
P.O. BOX 1-764
RO-014700 Bucharest, ROMANIA
+ Stored-procedure support by John Fawcett.
+
+ Wietse Venema
+ Google, Inc.
+ 111 8th Avenue
+ New York, NY 10011, USA
+
MYSQL_TABLE(5)
</pre> </body> </html>
diff --git a/external/ibm-public/postfix/dist/html/newaliases.1.html b/external/ibm-public/postfix/dist/html/newaliases.1.html
index a2c3ff72dd6..02f20fe8913 100644
--- a/external/ibm-public/postfix/dist/html/newaliases.1.html
+++ b/external/ibm-public/postfix/dist/html/newaliases.1.html
@@ -117,49 +117,54 @@ SENDMAIL(1) SENDMAIL(1)
directory. This information is ignored with Postfix versions
before 2.3.
- With all Postfix versions, you can specify a directory pathname
- with the MAIL_CONFIG environment variable to override the loca-
+ With Postfix version 3.2 and later, a non-default directory must
+ be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter-
+ nate_config_directories or <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> parame-
+ ters.
+
+ With all Postfix versions, you can specify a directory pathname
+ with the MAIL_CONFIG environment variable to override the loca-
tion of configuration files.
<b>-F</b> <i>full</i><b>_</b><i>name</i>
- Set the sender full name. This overrides the NAME environment
+ Set the sender full name. This overrides the NAME environment
variable, and is used only with messages that have no <b>From:</b> mes-
sage header.
<b>-f</b> <i>sender</i>
- Set the envelope sender address. This is the address where
+ Set the envelope sender address. This is the address where
delivery problems are sent to. With Postfix versions before 2.1,
- the <b>Errors-To:</b> message header overrides the error return
+ the <b>Errors-To:</b> message header overrides the error return
address.
- <b>-G</b> Gateway (relay) submission, as opposed to initial user submis-
- sion. Either do not rewrite addresses at all, or update incom-
- plete addresses with the domain information specified with
+ <b>-G</b> Gateway (relay) submission, as opposed to initial user submis-
+ sion. Either do not rewrite addresses at all, or update incom-
+ plete addresses with the domain information specified with
<b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a></b>.
This option is ignored before Postfix version 2.3.
<b>-h</b> <i>hop</i><b>_</b><i>count</i> (ignored)
- Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter
+ Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter
instead.
<b>-I</b> Initialize alias database. See the <b>newaliases</b> command above.
- <b>-i</b> When reading a message from standard input, don't treat a line
+ <b>-i</b> When reading a message from standard input, don't treat a line
with only a <b>.</b> character as the end of input.
<b>-L</b> <i>label</i> (ignored)
- The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter
+ The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter
instead.
<b>-m</b> (ignored)
Backwards compatibility.
<b>-N</b> <i>dsn</i> (default: 'delay, failure')
- Delivery status notification control. Specify either a
+ Delivery status notification control. Specify either a
comma-separated list with one or more of <b>failure</b> (send notifica-
- tion when delivery fails), <b>delay</b> (send notification when deliv-
- ery is delayed), or <b>success</b> (send notification when the message
+ tion when delivery fails), <b>delay</b> (send notification when deliv-
+ ery is delayed), or <b>success</b> (send notification when the message
is delivered); or specify <b>never</b> (don't send any notifications at
all).
@@ -169,50 +174,50 @@ SENDMAIL(1) SENDMAIL(1)
Backwards compatibility.
<b>-oA</b><i>alias</i><b>_</b><i>database</i>
- Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>.
+ Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>.
See <a href="postalias.1.html"><b>postalias</b>(1)</a> for details.
<b>-O</b> <i>option=value</i> (ignored)
- Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration
+ Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration
parameter in <a href="postconf.5.html"><b>main.cf</b></a> instead.
<b>-o7</b> (ignored)
<b>-o8</b> (ignored)
- To send 8-bit or binary content, use an appropriate MIME encap-
+ To send 8-bit or binary content, use an appropriate MIME encap-
sulation and specify the appropriate <b>-B</b> command-line option.
- <b>-oi</b> When reading a message from standard input, don't treat a line
+ <b>-oi</b> When reading a message from standard input, don't treat a line
with only a <b>.</b> character as the end of input.
<b>-om</b> (ignored)
The sender is never eliminated from alias etc. expansions.
<b>-o</b> <i>x value</i> (ignored)
- Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame-
+ Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame-
ter in <a href="postconf.5.html"><b>main.cf</b></a> instead.
<b>-r</b> <i>sender</i>
- Set the envelope sender address. This is the address where
+ Set the envelope sender address. This is the address where
delivery problems are sent to. With Postfix versions before 2.1,
- the <b>Errors-To:</b> message header overrides the error return
+ the <b>Errors-To:</b> message header overrides the error return
address.
<b>-R</b> <i>return</i>
- Delivery status notification control. Specify "hdrs" to return
- only the header when a message bounces, "full" to return a full
+ Delivery status notification control. Specify "hdrs" to return
+ only the header when a message bounces, "full" to return a full
copy (the default behavior).
The <b>-R</b> option specifies an upper bound; Postfix will return only
- the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a>
+ the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a>
setting.
This option is ignored before Postfix version 2.10.
- <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe-
+ <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe-
cuting the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command.
- Warning: flushing undeliverable mail frequently will result in
+ Warning: flushing undeliverable mail frequently will result in
poor delivery performance of all other mail.
<b>-q</b><i>interval</i> (ignored)
@@ -221,21 +226,21 @@ SENDMAIL(1) SENDMAIL(1)
<b>-qI</b><i>queueid</i>
Schedule immediate delivery of mail with the specified queue ID.
- This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com-
+ This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com-
mand, and is available with Postfix version 2.4 and later.
<b>-qR</b><i>site</i>
- Schedule immediate delivery of all mail that is queued for the
- named <i>site</i>. This option accepts only <i>site</i> names that are eligi-
- ble for the "fast flush" service, and is implemented by execut-
+ Schedule immediate delivery of all mail that is queued for the
+ named <i>site</i>. This option accepts only <i>site</i> names that are eligi-
+ ble for the "fast flush" service, and is implemented by execut-
ing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information
about the "fast flush" service.
<b>-qS</b><i>site</i>
- This command is not implemented. Use the slower "<b>sendmail -q</b>"
+ This command is not implemented. Use the slower "<b>sendmail -q</b>"
command instead.
- <b>-t</b> Extract recipients from message headers. These are added to any
+ <b>-t</b> Extract recipients from message headers. These are added to any
recipients specified on the command line.
With Postfix versions prior to 2.1, this option requires that no
@@ -251,23 +256,23 @@ SENDMAIL(1) SENDMAIL(1)
This feature is available in Postfix 2.3 and later.
<b>-XV</b> (Postfix 2.2 and earlier: <b>-V</b>)
- Variable Envelope Return Path. Given an envelope sender address
- of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i>
+ Variable Envelope Return Path. Given an envelope sender address
+ of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i>
receives mail with a personalized envelope sender address.
- By default, the personalized envelope sender address is
- <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac-
- ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu-
+ By default, the personalized envelope sender address is
+ <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac-
+ ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu-
ration parameter.
<b>-XV</b><i>xy</i> (Postfix 2.2 and earlier: <b>-V</b><i>xy</i>)
- As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters,
+ As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters,
instead of the characters specified with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delim</a>-</b>
<b><a href="postconf.5.html#default_verp_delimiters">iters</a></b> configuration parameter.
<b>-v</b> Send an email report of the first delivery attempt (Postfix ver-
- sions 2.1 and later). Mail delivery always happens in the back-
- ground. When multiple <b>-v</b> options are given, enable verbose log-
+ sions 2.1 and later). Mail delivery always happens in the back-
+ ground. When multiple <b>-v</b> options are given, enable verbose log-
ging for debugging purposes.
<b>-X</b> <i>log</i><b>_</b><i>file</i> (ignored)
@@ -276,11 +281,12 @@ SENDMAIL(1) SENDMAIL(1)
<b>SECURITY</b>
By design, this program is not set-user (or group) id. However, it must
- handle data from untrusted, possibly remote, users. Thus, the usual
+ handle data from untrusted, possibly remote, users. Thus, the usual
precautions need to be taken against malicious inputs.
<b>DIAGNOSTICS</b>
- Problems are logged to <b>syslogd</b>(8) and to the standard error stream.
+ Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard
+ error stream.
<b>ENVIRONMENT</b>
<b>MAIL_CONFIG</b>
@@ -309,7 +315,7 @@ SENDMAIL(1) SENDMAIL(1)
line endings from &lt;CR&gt;&lt;LF&gt; into UNIX format (&lt;LF&gt;).
<b>TROUBLE SHOOTING CONTROLS</b>
- The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to trouble shoot a Postfix
+ The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix
system.
<b><a href="postconf.5.html#debugger_command">debugger_command</a> (empty)</b>
@@ -400,6 +406,11 @@ SENDMAIL(1) SENDMAIL(1)
The time after which the sender receives a copy of the message
headers of mail that is still queued.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
The UNIX system account that owns the Postfix queue and most
Postfix daemon processes.
@@ -416,9 +427,23 @@ SENDMAIL(1) SENDMAIL(1)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Postfix 3.2 and later:
+
+ <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b>
+ A list of non-default Postfix configuration directories that may
+ be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in
+ the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the
+ MAIL_CONFIG environment parameter.
+
+ <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b>
+ An optional list of non-default Postfix configuration directo-
+ ries; these directories belong to additional Postfix instances
+ that share the Postfix executable files and documentation with
+ the default Postfix instance, and that are started, stopped,
+ etc., together with the default Postfix instance.
<b>FILES</b>
/var/spool/postfix, mail queue
@@ -434,6 +459,7 @@ SENDMAIL(1) SENDMAIL(1)
<a href="postdrop.1.html">postdrop(1)</a>, mail posting utility
<a href="postfix.1.html">postfix(1)</a>, mail system control
<a href="postqueue.1.html">postqueue(1)</a>, mail queue control
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README_FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/oqmgr.8.html b/external/ibm-public/postfix/dist/html/oqmgr.8.html
index d952c0c7c97..6f6913589c2 100644
--- a/external/ibm-public/postfix/dist/html/oqmgr.8.html
+++ b/external/ibm-public/postfix/dist/html/oqmgr.8.html
@@ -144,9 +144,9 @@ OQMGR(8) OQMGR(8)
environment.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to the <b>syslog</b>(8) daemon. Cor-
- rupted message files are saved to the <b>corrupt</b> queue for further inspec-
- tion.
+ Problems and transactions are logged to the <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>
+ daemon. Corrupted message files are saved to the <b>corrupt</b> queue for
+ further inspection.
Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces and of other trouble.
@@ -207,54 +207,66 @@ OQMGR(8) OQMGR(8)
The default maximal number of parallel deliveries to the same
destination.
- <b><a href="postconf.5.html#transport_destination_concurrency_limit"><i>transport</i>_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
+ <b>transport_destination_concurrency_limit ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the default_destination_con-
+ currency_limit parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
Available in Postfix version 2.5 and later:
- <b><a href="postconf.5.html#transport_initial_destination_concurrency"><i>transport</i>_initial_destination_concurrency</a> ($<a href="postconf.5.html#initial_destination_concurrency">initial_destination_concur</a>-</b>
+ <b>transport_initial_destination_concurrency ($<a href="postconf.5.html#initial_destination_concurrency">initial_destination_concur</a>-</b>
<b><a href="postconf.5.html#initial_destination_concurrency">rency</a>)</b>
- Initial concurrency for delivery via the named message <i>trans-</i>
- <i>port</i>.
+ A transport-specific override for the initial_destination_con-
+ currency parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name
+ of the message delivery transport.
<b><a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_destination_concurrency_failed_cohort_limit</a> (1)</b>
- How many pseudo-cohorts must suffer connection or handshake
- failure before a specific destination is considered unavailable
+ How many pseudo-cohorts must suffer connection or handshake
+ failure before a specific destination is considered unavailable
(and further delivery is suspended).
- <b><a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_desti</a>-</b>
+ <b>transport_destination_concurrency_failed_cohort_limit ($<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_desti</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">nation_concurrency_failed_cohort_limit</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the <a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_destination_con</a>-
+ <a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">currency_failed_cohort_limit</a> parameter value, where <i>transport</i> is
+ the <a href="master.5.html">master.cf</a> name of the message delivery transport.
<b><a href="postconf.5.html#default_destination_concurrency_negative_feedback">default_destination_concurrency_negative_feedback</a> (1)</b>
- The per-destination amount of delivery concurrency negative
- feedback, after a delivery completes with a connection or hand-
+ The per-destination amount of delivery concurrency negative
+ feedback, after a delivery completes with a connection or hand-
shake failure.
- <b><a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a> ($<a href="postconf.5.html#default_destination_concurrency_negative_feedback">default_destina</a>-</b>
+ <b>transport_destination_concurrency_negative_feedback ($<a href="postconf.5.html#default_destination_concurrency_negative_feedback">default_destina</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_negative_feedback">tion_concurrency_negative_feedback</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the default_destination_con-
+ currency_negative_feedback parameter value, where <i>transport</i> is
+ the <a href="master.5.html">master.cf</a> name of the message delivery transport.
<b><a href="postconf.5.html#default_destination_concurrency_positive_feedback">default_destination_concurrency_positive_feedback</a> (1)</b>
- The per-destination amount of delivery concurrency positive
+ The per-destination amount of delivery concurrency positive
feedback, after a delivery completes without connection or hand-
shake failure.
- <b><a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_positive_feedback</a> ($<a href="postconf.5.html#default_destination_concurrency_positive_feedback">default_destina</a>-</b>
+ <b>transport_destination_concurrency_positive_feedback ($<a href="postconf.5.html#default_destination_concurrency_positive_feedback">default_destina</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_positive_feedback">tion_concurrency_positive_feedback</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the default_destination_con-
+ currency_positive_feedback parameter value, where <i>transport</i> is
+ the <a href="master.5.html">master.cf</a> name of the message delivery transport.
<b><a href="postconf.5.html#destination_concurrency_feedback_debug">destination_concurrency_feedback_debug</a> (no)</b>
- Make the queue manager's feedback algorithm verbose for perfor-
+ Make the queue manager's feedback algorithm verbose for perfor-
mance analysis purposes.
<b>RECIPIENT SCHEDULING CONTROLS</b>
<b><a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a> (50)</b>
The default maximal number of recipients per message delivery.
- <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a></b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_destination_recipient_limit ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b>
+ <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>-
+ <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
<b>OTHER RESOURCE AND RATE CONTROLS</b>
<b><a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a> (300s)</b>
@@ -265,50 +277,54 @@ OQMGR(8) OQMGR(8)
The maximal time between attempts to deliver a deferred message.
<b><a href="postconf.5.html#maximal_queue_lifetime">maximal_queue_lifetime</a> (5d)</b>
- Consider a message as undeliverable, when delivery fails with a
+ Consider a message as undeliverable, when delivery fails with a
temporary error, and the time in the queue has reached the <a href="postconf.5.html#maximal_queue_lifetime">maxi</a>-
<a href="postconf.5.html#maximal_queue_lifetime">mal_queue_lifetime</a> limit.
<b><a href="postconf.5.html#queue_run_delay">queue_run_delay</a> (300s)</b>
- The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager;
+ The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager;
prior to Postfix 2.4 the default value was 1000s.
<b><a href="postconf.5.html#transport_retry_time">transport_retry_time</a> (60s)</b>
- The time between attempts by the Postfix queue manager to con-
+ The time between attempts by the Postfix queue manager to con-
tact a malfunctioning message delivery transport.
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#bounce_queue_lifetime">bounce_queue_lifetime</a> (5d)</b>
- Consider a bounce message as undeliverable, when delivery fails
- with a temporary error, and the time in the queue has reached
+ Consider a bounce message as undeliverable, when delivery fails
+ with a temporary error, and the time in the queue has reached
the <a href="postconf.5.html#bounce_queue_lifetime">bounce_queue_lifetime</a> limit.
Available in Postfix version 2.5 and later:
<b><a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a> (0s)</b>
- The default amount of delay that is inserted between individual
- deliveries to the same destination; the resulting behavior
- depends on the value of the corresponding per-destination recip-
- ient limit.
+ The default amount of delay that is inserted between individual
+ message deliveries to the same destination and over the same
+ message delivery transport.
- <b><a href="postconf.5.html#transport_destination_rate_delay"><i>transport</i>_destination_rate_delay</a> $<a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a></b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_destination_rate_delay ($<a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_destination_rate_delay">default_destina</a>-
+ <a href="postconf.5.html#default_destination_rate_delay">tion_rate_delay</a> parameter value, where <i>transport</i> is the <a href="master.5.html">mas-
+ ter.cf</a> name of the message delivery transport.
Available in Postfix version 3.1 and later:
<b><a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a> (0s)</b>
The default amount of delay that is inserted between individual
- deliveries over the same message delivery transport, regardless
- of destination.
+ message deliveries over the same message delivery transport,
+ regardless of destination.
- <b><a href="postconf.5.html#transport_transport_rate_delay"><i>transport</i>_transport_rate_delay</a> $<a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a></b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_transport_rate_delay ($<a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_transport_rate_delay">default_trans</a>-
+ <a href="postconf.5.html#default_transport_rate_delay">port_rate_delay</a> parameter value, where the initial <i>transport</i> in
+ the parameter name is the <a href="master.5.html">master.cf</a> name of the message delivery
+ transport.
<b>SAFETY CONTROLS</b>
<b><a href="postconf.5.html#qmgr_daemon_timeout">qmgr_daemon_timeout</a> (1000s)</b>
How much time a Postfix queue manager process may take to handle
- a request before it is terminated by a built-in watchdog timer.
+ a request before it is terminated by a built-in watchdog timer.
<b><a href="postconf.5.html#qmgr_ipc_timeout">qmgr_ipc_timeout</a> (60s)</b>
The time limit for the queue manager to send or receive informa-
@@ -317,12 +333,12 @@ OQMGR(8) OQMGR(8)
Available in Postfix version 3.1 and later:
<b><a href="postconf.5.html#address_verify_pending_request_limit">address_verify_pending_request_limit</a> (see 'postconf -d' output)</b>
- A safety limit that prevents address verification requests from
+ A safety limit that prevents address verification requests from
overwhelming the Postfix queue.
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#defer_transports">defer_transports</a> (empty)</b>
@@ -330,11 +346,11 @@ OQMGR(8) OQMGR(8)
mail unless someone issues "<b>sendmail -q</b>" or equivalent.
<b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b>
- The maximal number of digits after the decimal point when log-
+ The maximal number of digits after the decimal point when log-
ging sub-second delay values.
<b><a href="postconf.5.html#helpful_warnings">helpful_warnings</a> (yes)</b>
- Log warnings about problematic configuration settings, and pro-
+ Log warnings about problematic configuration settings, and pro-
vide helpful suggestions.
<b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
@@ -350,9 +366,8 @@ OQMGR(8) OQMGR(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 3.0 and later:
@@ -360,6 +375,17 @@ OQMGR(8) OQMGR(8)
After sending a "your message is delayed" notification, inform
the sender when the delay clears up.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
+
<b>FILES</b>
/var/spool/postfix/incoming, <a href="QSHAPE_README.html#incoming_queue">incoming queue</a>
/var/spool/postfix/active, <a href="QSHAPE_README.html#active_queue">active queue</a>
@@ -374,6 +400,7 @@ OQMGR(8) OQMGR(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/pgsql_table.5.html b/external/ibm-public/postfix/dist/html/pgsql_table.5.html
index f92720d1a54..49c4476e977 100644
--- a/external/ibm-public/postfix/dist/html/pgsql_table.5.html
+++ b/external/ibm-public/postfix/dist/html/pgsql_table.5.html
@@ -26,40 +26,6 @@ PGSQL_TABLE(5) PGSQL_TABLE(5)
The file /etc/postfix/pgsql-aliases.cf has the same format as the Post-
fix <a href="postconf.5.html">main.cf</a> file, and can specify the parameters described below.
-<b>BACKWARDS COMPATIBILITY</b>
- For compatibility with other Postfix lookup tables, PostgreSQL parame-
- ters can also be defined in <a href="postconf.5.html">main.cf</a>. In order to do that, specify as
- PostgreSQL source a name that doesn't begin with a slash or a dot. The
- PostgreSQL parameters will then be accessible as the name you've given
- the source in its definition, an underscore, and the name of the param-
- eter. For example, if the map is specified as "<a href="pgsql_table.5.html">pgsql</a>:<i>pgsqlname</i>", the
- parameter "hosts" below would be defined in <a href="postconf.5.html">main.cf</a> as "<i>pgsql-</i>
- <i>name</i>_hosts".
-
- Note: with this form, the passwords for the PostgreSQL sources are
- written in <a href="postconf.5.html">main.cf</a>, which is normally world-readable. Support for this
- form will be removed in a future Postfix version.
-
- Normally, the SQL query is specified via a single <b>query</b> parameter
- (described in more detail below). When this parameter is not specified
- in the map definition, Postfix reverts to an older interface, with the
- SQL query constructed from the <b>select_function</b>, <b>select_field</b>, <b>table</b>,
- <b>where_field</b> and <b>additional_conditions</b> parameters. The old interface
- will be gradually phased out. To migrate to the new interface set:
-
- <b>query</b> = SELECT <i>select</i><b>_</b><i>function</i>('%s')
-
- or in the absence of <b>select_function</b>, the lower precedence:
-
- <b>query</b> = SELECT <i>select</i><b>_</b><i>field</i>
- FROM <i>table</i>
- WHERE <i>where</i><b>_</b><i>field</i> = '%s'
- <i>additional</i><b>_</b><i>conditions</i>
-
- Use the value, not the name, of each legacy parameter. Note that the
- <b>additional_conditions</b> parameter is optional and if not empty, will
- always start with <b>AND</b>.
-
<b>LIST MEMBERSHIP</b>
When using SQL to store lists such as $<a href="postconf.5.html#mynetworks">mynetworks</a>, $<a href="postconf.5.html#mydestination">mydestination</a>,
$<a href="postconf.5.html#relay_domains">relay_domains</a>, $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, etc., it is important to under-
@@ -76,21 +42,18 @@ PGSQL_TABLE(5) PGSQL_TABLE(5)
<b>PGSQL PARAMETERS</b>
<b>hosts</b> The hosts that Postfix will try to connect to and query from.
- Specify <i>unix:</i> for UNIX-domain sockets, <i>inet:</i> for TCP connections
- (default). Example:
+ Besides a <b>postgresql://</b> connection URI, this setting supports
+ the historical forms <b>unix:/</b><i>pathname</i> for UNIX-domain sockets and
+ <b>inet:</b><i>host:port</i> for TCP connections, where the <b>unix:</b> and <b>inet:</b>
+ prefixes are accepted and ignored for backwards compatibility.
+ Examples:
+ hosts = postgresql://username@example.com/tablename?sslmode=require
hosts = host1.some.domain host2.some.domain:port
hosts = unix:/file/name
- The hosts are tried in random order, with all connections over
- UNIX domain sockets being tried before those over TCP. The con-
- nections are automatically closed after being idle for about 1
- minute, and are re-opened as necessary.
-
- NOTE: the <i>unix:</i> and <i>inet:</i> prefixes are accepted for backwards
- compatibility reasons, but are actually ignored. The PostgreSQL
- client library will always try to connect to an UNIX socket if
- the name starts with a slash, and will try a TCP connection oth-
- erwise.
+ The hosts are tried in random order. The connections are auto-
+ matically closed after being idle for about 1 minute, and are
+ re-opened as necessary.
<b>user, password</b>
The user name and password to log into the pgsql server. Exam-
@@ -227,6 +190,19 @@ PGSQL_TABLE(5) PGSQL_TABLE(5)
the limit is exceeded. Setting the limit to 1 ensures that
lookups do not return multiple values.
+<b>OBSOLETE MAIN.CF PARAMETERS</b>
+ For compatibility with other Postfix lookup tables, PostgreSQL parame-
+ ters can also be defined in <a href="postconf.5.html">main.cf</a>. In order to do that, specify as
+ PostgreSQL source a name that doesn't begin with a slash or a dot. The
+ PostgreSQL parameters will then be accessible as the name you've given
+ the source in its definition, an underscore, and the name of the param-
+ eter. For example, if the map is specified as "<a href="pgsql_table.5.html">pgsql</a>:<i>pgsqlname</i>", the
+ parameter "hosts" would be defined in <a href="postconf.5.html">main.cf</a> as "<i>pgsqlname</i>_hosts".
+
+ Note: with this form, the passwords for the PostgreSQL sources are
+ written in <a href="postconf.5.html">main.cf</a>, which is normally world-readable. Support for this
+ form will be removed in a future Postfix version.
+
<b>OBSOLETE QUERY INTERFACES</b>
This section describes query interfaces that are deprecated as of Post-
fix 2.2. Please migrate to the new <b>query</b> interface as the old inter-
diff --git a/external/ibm-public/postfix/dist/html/pickup.8.html b/external/ibm-public/postfix/dist/html/pickup.8.html
index a93ab00cc81..b1a58b29916 100644
--- a/external/ibm-public/postfix/dist/html/pickup.8.html
+++ b/external/ibm-public/postfix/dist/html/pickup.8.html
@@ -30,7 +30,7 @@ PICKUP(8) PICKUP(8)
public service endpoint.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
The <a href="pickup.8.html"><b>pickup</b>(8)</a> daemon copies mail from file to the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon.
@@ -89,9 +89,19 @@ PICKUP(8) PICKUP(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
<b>SEE ALSO</b>
<a href="cleanup.8.html">cleanup(8)</a>, message canonicalization
@@ -100,6 +110,7 @@ PICKUP(8) PICKUP(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/pipe.8.html b/external/ibm-public/postfix/dist/html/pipe.8.html
index 9f93d3735d8..6248898198e 100644
--- a/external/ibm-public/postfix/dist/html/pipe.8.html
+++ b/external/ibm-public/postfix/dist/html/pipe.8.html
@@ -192,8 +192,8 @@ PIPE(8) PIPE(8)
interpreter.
Specify "{" and "}" around command arguments that contain white-
- space (Postfix 3.0 and later). Whitespace after "{" and before
- "}" is ignored.
+ space (Postfix 3.0 and later). Whitespace after the opening "{"
+ and before the closing "}" is ignored.
In the command argument vector, the following macros are recog-
nized and replaced with corresponding information from the Post-
@@ -361,9 +361,9 @@ PIPE(8) PIPE(8)
fications (Postfix 3.0 and later). This command output is not examined
for the presence of an enhanced status code.
- Problems and transactions are logged to <b>syslogd</b>(8). Corrupted message
- files are marked so that the queue manager can move them to the <b>corrupt</b>
- queue for further inspection.
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
+ Corrupted message files are marked so that the queue manager can move
+ them to the <b>corrupt</b> queue for further inspection.
<b>SECURITY</b>
This program needs a dual personality 1) to access the private Postfix
@@ -381,26 +381,24 @@ PIPE(8) PIPE(8)
<b>RESOURCE AND RATE CONTROLS</b>
In the text below, <i>transport</i> is the first field in a <a href="master.5.html"><b>master.cf</b></a> entry.
- <b><a href="postconf.5.html#transport_destination_concurrency_limit"><i>transport</i>_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
- <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
- Limit the number of parallel deliveries to the same destination,
- for delivery via the named <i>transport</i>. The limit is enforced by
- the Postfix queue manager.
+ <b>transport_time_limit ($<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#command_time_limit">command_time_limit</a> parame-
+ ter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message
+ delivery transport.
- <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b>
- <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b>
- Limit the number of recipients per message delivery, for deliv-
- ery via the named <i>transport</i>. The limit is enforced by the Post-
- fix queue manager.
+ Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon:
- <b><a href="postconf.5.html#transport_time_limit"><i>transport</i>_time_limit</a> ($<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b>
- Limit the time for delivery to external command, for delivery
- via the named <i>transport</i>. The limit is enforced by the pipe
- delivery agent.
+ <b>transport_destination_concurrency_limit ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
+ <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
+ A transport-specific override for the default_destination_con-
+ currency_limit parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
- Postfix 2.4 and later support a suffix that specifies the time
- unit: s (seconds), m (minutes), h (hours), d (days), w (weeks).
- The default time unit is seconds.
+ <b>transport_destination_recipient_limit ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b>
+ <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>-
+ <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
@@ -453,23 +451,39 @@ PIPE(8) PIPE(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 3.0 and later:
<b><a href="postconf.5.html#pipe_delivery_status_filter">pipe_delivery_status_filter</a> ($<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b>
- Optional filter for the <a href="pipe.8.html"><b>pipe</b>(8)</a> delivery agent to change the
+ Optional filter for the <a href="pipe.8.html"><b>pipe</b>(8)</a> delivery agent to change the
delivery status code or explanatory text of successful or unsuc-
cessful deliveries.
+ Available in Postfix version 3.3 and later:
+
+ <b><a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a> (yes)</b>
+ Enable support for the original recipient address after an
+ address is rewritten to a different address (for example with
+ aliasing or with canonical mapping).
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
+
<b>SEE ALSO</b>
<a href="qmgr.8.html">qmgr(8)</a>, queue manager
<a href="bounce.8.html">bounce(8)</a>, delivery status reports
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/postalias.1.html b/external/ibm-public/postfix/dist/html/postalias.1.html
index a265e9e988c..b029057d120 100644
--- a/external/ibm-public/postfix/dist/html/postalias.1.html
+++ b/external/ibm-public/postfix/dist/html/postalias.1.html
@@ -81,6 +81,10 @@ POSTALIAS(1) POSTALIAS(1)
found to the standard output stream. The exit status is zero
when the requested information was found.
+ Note: this performs a single query with the key as specified,
+ and does not make iterative queries with substrings of the key
+ as described in the <a href="aliases.5.html">aliases(5)</a> manual page.
+
If a key value of <b>-</b> is specified, the program reads key values
from the standard input stream and writes one line of <i>key: value</i>
output for each key that was found. The exit status is zero when
@@ -145,9 +149,9 @@ POSTALIAS(1) POSTALIAS(1)
base.
<b>DIAGNOSTICS</b>
- Problems are logged to the standard error stream and to <b>syslogd</b>(8). No
- output means that no problems were detected. Duplicate entries are
- skipped and are flagged with a warning.
+ Problems are logged to the standard error stream and to <b>syslogd</b>(8) or
+ <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. No output means that no problems were detected. Duplicate
+ entries are skipped and are flagged with a warning.
<a href="postalias.1.html"><b>postalias</b>(1)</a> terminates with zero exit status in case of success
(including successful "<b>postalias -q</b>" lookup) and terminates with
@@ -187,6 +191,11 @@ POSTALIAS(1) POSTALIAS(1)
The default database type for use in <a href="newaliases.1.html"><b>newaliases</b>(1)</a>, <a href="postalias.1.html"><b>postalias</b>(1)</a>
and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
Enable preliminary SMTPUTF8 support for the protocols described
in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.
@@ -195,9 +204,8 @@ POSTALIAS(1) POSTALIAS(1)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
<b>STANDARDS</b>
<a href="http://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages)
@@ -209,6 +217,7 @@ POSTALIAS(1) POSTALIAS(1)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="postmap.1.html">postmap(1)</a>, create/update/query lookup tables
<a href="newaliases.1.html">newaliases(1)</a>, Sendmail compatibility interface.
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/postcat.1.html b/external/ibm-public/postfix/dist/html/postcat.1.html
index 000619ba92b..9424d55f17e 100644
--- a/external/ibm-public/postfix/dist/html/postcat.1.html
+++ b/external/ibm-public/postfix/dist/html/postcat.1.html
@@ -74,6 +74,11 @@ POSTCAT(1) POSTCAT(1)
The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
The location of the Postfix top-level queue directory.
diff --git a/external/ibm-public/postfix/dist/html/postconf.1.html b/external/ibm-public/postfix/dist/html/postconf.1.html
index 969f0955fcb..e6525618b8d 100644
--- a/external/ibm-public/postfix/dist/html/postconf.1.html
+++ b/external/ibm-public/postfix/dist/html/postconf.1.html
@@ -61,48 +61,46 @@ POSTCONF(1) POSTCONF(1)
<b>DESCRIPTION</b>
By default, the <a href="postconf.1.html"><b>postconf</b>(1)</a> command displays the values of <a href="postconf.5.html"><b>main.cf</b></a> con-
figuration parameters, and warns about possible mis-typed parameter
- names (Postfix 2.9 and later). It can also change <a href="postconf.5.html"><b>main.cf</b></a> configura-
- tion parameter values, or display other configuration information about
- the Postfix mail system.
+ names (Postfix 2.9 and later). The command can also change <a href="postconf.5.html"><b>main.cf</b></a>
+ configuration parameter values, or display other configuration informa-
+ tion about the Postfix mail system.
Options:
- <b>-a</b> List the available SASL server plug-in types. The SASL plug-in
- type is selected with the <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b> configuration parame-
- ter by specifying one of the names listed below.
+ <b>-a</b> List the available SASL plug-in types for the Postfix SMTP
+ server. The plug-in type is selected with the <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>
+ configuration parameter by specifying one of the names listed
+ below.
- <b>cyrus</b> This server plug-in is available when Postfix is built
+ <b>cyrus</b> This server plug-in is available when Postfix is built
with Cyrus SASL support.
<b>dovecot</b>
This server plug-in uses the Dovecot authentication
- server, and is available when Postfix is built with any
+ server, and is available when Postfix is built with any
form of SASL support.
This feature is available with Postfix 2.3 and later.
- <b>-A</b> List the available SASL client plug-in types. The SASL plug-in
- type is selected with the <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b> or <b><a href="postconf.5.html#lmtp_sasl_type">lmtp_sasl_type</a></b> con-
- figuration parameters by specifying one of the names listed
- below.
+ <b>-A</b> List the available SASL plug-in types for the Postfix SMTP
+ client. The plug-in type is selected with the <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b> or
+ <b><a href="postconf.5.html#lmtp_sasl_type">lmtp_sasl_type</a></b> configuration parameters by specifying one of the
+ names listed below.
- <b>cyrus</b> This client plug-in is available when Postfix is built
+ <b>cyrus</b> This client plug-in is available when Postfix is built
with Cyrus SASL support.
This feature is available with Postfix 2.3 and later.
<b>-b</b> [<i>template</i><b>_</b><i>file</i>]
Display the message text that appears at the beginning of deliv-
- ery status notification (DSN) messages, replacing $<b>name</b> expres-
+ ery status notification (DSN) messages, expanding $<b>name</b> expres-
sions with actual values as described in <a href="bounce.5.html"><b>bounce</b>(5)</a>.
- To override the built-in templates, specify a template file name
- at the end of the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line, or specify a file
- name in <a href="postconf.5.html"><b>main.cf</b></a> with the <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a></b> parameter.
-
- To force selection of the built-in templates, specify an empty
- template file name on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line (in shell
- language: "").
+ To override the <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a></b> parameter setting, specify
+ a template file name at the end of the "<b>postconf -b</b>" command
+ line. Specify an empty file name to display built-in templates
+ (in shell language: "").
This feature is available with Postfix 2.3 and later.
@@ -142,7 +140,7 @@ POSTCONF(1) POSTCONF(1)
<i>vice/type=value</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.
With <b>-F</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and replace one
- or more service fields with new values as specied with "<i>ser-</i>
+ or more service fields with new values as specified with "<i>ser-</i>
<i>vice/type/field=value</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line. Cur-
rently, the "command" field contains the command name and com-
mand arguments. this may change in the near future, so that the
@@ -151,7 +149,7 @@ POSTCONF(1) POSTCONF(1)
With <b>-P</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and add or
update one or more service parameter settings (-o parame-
- ter=value settings) with new values as specied with "<i>ser-</i>
+ ter=value settings) with new values as specified with "<i>ser-</i>
<i>vice/type/parameter=value</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.
In all cases the file is copied to a temporary file then renamed
@@ -215,33 +213,43 @@ POSTCONF(1) POSTCONF(1)
tal updates. Available on systems with support for CDB
databases.
+ This feature is available with Postfix 2.2 and later.
+
<b>cidr</b> A table that associates values with Classless
Inter-Domain Routing (CIDR) patterns. This is described
in <a href="cidr_table.5.html"><b>cidr_table</b>(5)</a>.
+ This feature is available with Postfix 2.2 and later.
+
<b>dbm</b> An indexed file type based on hashing. Available on sys-
tems with support for DBM databases.
<b>environ</b>
The UNIX process environment array. The lookup key is the
- variable name. Originally implemented for testing, some-
- one may find this useful someday.
+ environment variable name; the table name is ignored.
+ Originally implemented for testing, someone may find this
+ useful someday.
- <b>fail</b> A table that reliably fails all requests. The lookup ta-
- ble name is used for logging. This table exists to sim-
+ <b>fail</b> A table that reliably fails all requests. The lookup ta-
+ ble name is used for logging. This table exists to sim-
plify Postfix error tests.
+ This feature is available with Postfix 2.9 and later.
+
<b>hash</b> An indexed file type based on hashing. Available on sys-
tems with support for Berkeley DB databases.
<b>inline</b> (read-only)
- A non-shared, in-memory lookup table. Example: "<b><a href="DATABASE_README.html#types">inline</a>:{</b>
- <i>key</i><b>=</b><i>value</i><b>, {</b> <i>key</i> <b>=</b> <i>text with whitespace or comma</i> <b>}}</b>".
- Key-value pairs are separated by whitespace or comma;
- whitespace after "<b>{</b>" and before "<b>}</b>" is ignored. Inline
- tables eliminate the need to create a database file for
- just a few fixed elements. See also the <i><a href="DATABASE_README.html#types">static</a>:</i> map
- type.
+ A non-shared, in-memory lookup table. Example: "<b><a href="DATABASE_README.html#types">inline</a>:{</b>
+ <i>key</i><b>=</b><i>value</i><b>, {</b> <i>key</i> <b>=</b> <i>text with whitespace or comma</i> <b>}}</b>".
+ Key-value pairs are separated by whitespace or comma;
+ with a key-value pair inside "<b>{}</b>", whitespace is ignored
+ after the opening "<b>{</b>", around the "<b>=</b>" between key and
+ value, and before the closing "<b>}</b>". Inline tables elimi-
+ nate the need to create a database file for just a few
+ fixed elements. See also the <i><a href="DATABASE_README.html#types">static</a>:</i> map type.
+
+ This feature is available with Postfix 3.0 and later.
<b>internal</b>
A non-shared, in-memory hash table. Its content are lost
@@ -251,6 +259,8 @@ POSTCONF(1) POSTCONF(1)
file). Available on systems with support for LMDB data-
bases. This is described in <a href="lmdb_table.5.html"><b>lmdb_table</b>(5)</a>.
+ This feature is available with Postfix 2.11 and later.
+
<b>ldap</b> (read-only)
LDAP database client. This is described in <a href="ldap_table.5.html"><b>ldap_table</b>(5)</a>.
@@ -258,6 +268,8 @@ POSTCONF(1) POSTCONF(1)
Memcache database client. This is described in <a href="memcache_table.5.html"><b>mem-</b></a>
<a href="memcache_table.5.html"><b>cache_table</b>(5)</a>.
+ This feature is available with Postfix 2.9 and later.
+
<b>mysql</b> (read-only)
MySQL database client. Available on systems with support
for MySQL databases. This is described in <a href="mysql_table.5.html"><b>mysql_ta-</b></a>
@@ -271,6 +283,8 @@ POSTCONF(1) POSTCONF(1)
PostgreSQL database client. This is described in
<a href="pgsql_table.5.html"><b>pgsql_table</b>(5)</a>.
+ This feature is available with Postfix 2.1 and later.
+
<b>pipemap</b> (read-only)
A lookup table that constructs a pipeline of tables.
Example: "<b><a href="DATABASE_README.html#types">pipemap</a>:{</b><i>type</i><b>_</b><i>1:name</i><b>_</b><i>1, ..., type</i><b>_</b><i>n:name</i><b>_</b><i>n</i><b>}</b>".
@@ -282,9 +296,13 @@ POSTCONF(1) POSTCONF(1)
"<a href="DATABASE_README.html#types">pipemap</a>:" table name must be "<b>{</b>" and "<b>}</b>". Within these,
individual maps are separated with comma or whitespace.
+ This feature is available with Postfix 3.0 and later.
+
<b>proxy</b> Postfix <a href="proxymap.8.html"><b>proxymap</b>(8)</a> client for shared access to Postfix
databases. The table name syntax is <i>type</i><b>:</b><i>name</i>.
+ This feature is available with Postfix 2.0 and later.
+
<b>randmap</b> (read-only)
An in-memory table that performs random selection. Exam-
ple: "<b><a href="DATABASE_README.html#types">randmap</a>:{</b><i>result</i><b>_</b><i>1, ..., result</i><b>_</b><i>n</i><b>}</b>". Each table
@@ -294,6 +312,8 @@ POSTCONF(1) POSTCONF(1)
results are separated with comma or whitespace. To give a
specific result more weight, specify it multiple times.
+ This feature is available with Postfix 3.0 and later.
+
<b>regexp</b> (read-only)
A lookup table based on regular expressions. The file
format is described in <a href="regexp_table.5.html"><b>regexp_table</b>(5)</a>.
@@ -301,75 +321,92 @@ POSTCONF(1) POSTCONF(1)
<b>sdbm</b> An indexed file type based on hashing. Available on sys-
tems with support for SDBM databases.
+ This feature is available with Postfix 2.2 and later.
+
<b>socketmap</b> (read-only)
Sendmail-style socketmap client. The table name is
<b>inet</b>:<i>host</i>:<i>port</i>:<i>name</i> for a TCP/IP server, or <b>unix</b>:<i>path-</i>
<i>name</i>:<i>name</i> for a UNIX-domain server. This is described in
<a href="socketmap_table.5.html"><b>socketmap_table</b>(5)</a>.
+ This feature is available with Postfix 2.10 and later.
+
<b>sqlite</b> (read-only)
SQLite database. This is described in <a href="sqlite_table.5.html"><b>sqlite_table</b>(5)</a>.
+ This feature is available with Postfix 2.8 and later.
+
<b>static</b> (read-only)
A table that always returns its name as lookup result.
For example, <b><a href="DATABASE_README.html#types">static</a>:foobar</b> always returns the string <b>foo-</b>
<b>bar</b> as lookup result. Specify "<b><a href="DATABASE_README.html#types">static</a>:{</b> <i>text with white-</i>
<i>space</i> <b>}</b>" when the result contains whitespace; this form
- ignores whitespace after "<b>{</b>" and before "<b>}</b>". See also the
- <i><a href="DATABASE_README.html#types">inline</a>:</i> map.
+ ignores whitespace after the opening "<b>{</b>" and before the
+ closing "<b>}</b>". See also the <i><a href="DATABASE_README.html#types">inline</a>:</i> map.
+
+ The form "<b><a href="DATABASE_README.html#types">static</a>:{</b><i>text</i><b>}</b> is available with Postfix 3.0 and
+ later.
<b>tcp</b> (read-only)
TCP/IP client. The protocol is described in <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>.
<b>texthash</b> (read-only)
- Produces similar results as <a href="DATABASE_README.html#types">hash</a>: files, except that you
- don't need to run the <a href="postmap.1.html"><b>postmap</b>(1)</a> command before you can
- use the file, and that it does not detect changes after
+ Produces similar results as <a href="DATABASE_README.html#types">hash</a>: files, except that you
+ don't need to run the <a href="postmap.1.html"><b>postmap</b>(1)</a> command before you can
+ use the file, and that it does not detect changes after
the file is read.
+ This feature is available with Postfix 2.8 and later.
+
<b>unionmap</b> (read-only)
- A table that sends each query to multiple lookup tables
- and that concatenates all found results, separated by
+ A table that sends each query to multiple lookup tables
+ and that concatenates all found results, separated by
comma. The table name syntax is the same as for <b>pipemap</b>.
+ This feature is available with Postfix 3.0 and later.
+
<b>unix</b> (read-only)
- A limited view of the UNIX authentication database. The
+ A limited view of the UNIX authentication database. The
following tables are implemented:
<b>unix:passwd.byname</b>
- The table is the UNIX password database. The key
- is a login name. The result is a password file
+ The table is the UNIX password database. The key
+ is a login name. The result is a password file
entry in <b>passwd</b>(5) format.
<b>unix:group.byname</b>
The table is the UNIX group database. The key is a
- group name. The result is a group file entry in
+ group name. The result is a group file entry in
<b>group</b>(5) format.
- Other table types may exist depending on how Postfix was built.
+ Other table types may exist depending on how Postfix was built.
- <b>-M</b> Show <a href="master.5.html"><b>master.cf</b></a> file contents instead of <a href="postconf.5.html"><b>main.cf</b></a> file contents.
+ <b>-M</b> Show <a href="master.5.html"><b>master.cf</b></a> file contents instead of <a href="postconf.5.html"><b>main.cf</b></a> file contents.
Specify <b>-Mf</b> to fold long lines for human readability.
Specify zero or more arguments, each with a <i>service-name</i> or <i>ser-</i>
- <i>vice-name/service-type</i> pair, where <i>service-name</i> is the first
- field of a <a href="master.5.html">master.cf</a> entry and <i>service-type</i> is one of (<b>inet</b>,
+ <i>vice-name/service-type</i> pair, where <i>service-name</i> is the first
+ field of a <a href="master.5.html">master.cf</a> entry and <i>service-type</i> is one of (<b>inet</b>,
<b>unix</b>, <b>fifo</b>, or <b>pass</b>).
- If <i>service-name</i> or <i>service-name/service-type</i> is specified, only
- the matching <a href="master.5.html">master.cf</a> entries will be output. For example,
- "<b>postconf -Mf smtp</b>" will output all services named "smtp", and
- "<b>postconf -Mf smtp/inet</b>" will output only the smtp service that
- listens on the network. Trailing service type fields that are
+ If <i>service-name</i> or <i>service-name/service-type</i> is specified, only
+ the matching <a href="master.5.html">master.cf</a> entries will be output. For example,
+ "<b>postconf -Mf smtp</b>" will output all services named "smtp", and
+ "<b>postconf -Mf smtp/inet</b>" will output only the smtp service that
+ listens on the network. Trailing service type fields that are
omitted will be handled as "*" wildcard fields.
This feature is available with Postfix 2.9 and later. The syntax
- was changed from "<i>name.type</i>" to "<i>name/type</i>", and "*" wildcard
+ was changed from "<i>name.type</i>" to "<i>name/type</i>", and "*" wildcard
support was added with Postfix 2.11.
<b>-n</b> Show only configuration parameters that have explicit <i>name=value</i>
- settings in <a href="postconf.5.html"><b>main.cf</b></a>. Specify <b>-nf</b> to fold long lines for human
- readability (Postfix 2.9 and later).
+ settings in <a href="postconf.5.html"><b>main.cf</b></a>. Specify <b>-nf</b> to fold long lines for human
+ readability (Postfix 2.9 and later). To show settings that dif-
+ fer from built-in defaults only, use the following bash syntax:
+ comm -23 &lt;(postconf -n) &lt;(postconf -d)
+ Replace "-23" with "-12" to show settings that duplicate
+ built-in defaults.
<b>-o</b> <i>name=value</i>
Override <a href="postconf.5.html"><b>main.cf</b></a> parameter settings.
@@ -380,29 +417,26 @@ POSTCONF(1) POSTCONF(1)
This feature is available with Postfix 2.11 and later.
- <b>-P</b> Show <a href="master.5.html"><b>master.cf</b></a> service parameter settings (by default all ser-
- vices and all parameters), formatted as "<i>service/type/parame-</i>
+ <b>-P</b> Show <a href="master.5.html"><b>master.cf</b></a> service parameter settings (by default all ser-
+ vices and all parameters), formatted as "<i>service/type/parame-</i>
<i>ter=value</i>", one per line. Specify <b>-Pf</b> to fold long lines.
- Specify one or more "<i>service/type/parameter</i>" instances on the
- <a href="postconf.1.html"><b>postconf</b>(1)</a> command line to limit the output to parameters of
- interest. Trailing parameter name or service type fields that
+ Specify one or more "<i>service/type/parameter</i>" instances on the
+ <a href="postconf.1.html"><b>postconf</b>(1)</a> command line to limit the output to parameters of
+ interest. Trailing parameter name or service type fields that
are omitted will be handled as "*" wildcard fields.
This feature is available with Postfix 2.11 and later.
<b>-t</b> [<i>template</i><b>_</b><i>file</i>]
- Display the templates for text that appears at the beginning of
- delivery status notification (DSN) messages, without expanding
+ Display the templates for text that appears at the beginning of
+ delivery status notification (DSN) messages, without expanding
$<b>name</b> expressions.
- To override the built-in templates, specify a template file name
- at the end of the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line, or specify a file
- name in <a href="postconf.5.html"><b>main.cf</b></a> with the <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a></b> parameter.
-
- To force selection of the built-in templates, specify an empty
- template file name on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line (in shell
- language: "").
+ To override the <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a></b> parameter setting, specify
+ a template file name at the end of the "<b>postconf -t</b>" command
+ line. Specify an empty file name to display built-in templates
+ (in shell language: "").
This feature is available with Postfix 2.3 and later.
@@ -445,8 +479,8 @@ POSTCONF(1) POSTCONF(1)
With <b>-P</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and remove one
or more service parameter settings (-o parameter=value settings)
- as specied with "<i>service/type/parameter</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a> com-
- mand line.
+ as specified with "<i>service/type/parameter</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a>
+ command line.
In all cases the file is copied to a temporary file then renamed
into place. Specify quotes to protect special characters on the
diff --git a/external/ibm-public/postfix/dist/html/postdrop.1.html b/external/ibm-public/postfix/dist/html/postdrop.1.html
index 07e9ccd8418..7155559b89b 100644
--- a/external/ibm-public/postfix/dist/html/postdrop.1.html
+++ b/external/ibm-public/postfix/dist/html/postdrop.1.html
@@ -38,9 +38,9 @@ POSTDROP(1) POSTDROP(1)
<b>DIAGNOSTICS</b>
Fatal errors: malformed input, I/O error, out of memory. Problems are
- logged to <b>syslogd</b>(8) and to the standard error stream. When the input
- is incomplete, or when the process receives a HUP, INT, QUIT or TERM
- signal, the queue file is deleted.
+ logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a> and to the standard error stream.
+ When the input is incomplete, or when the process receives a HUP, INT,
+ QUIT or TERM signal, the queue file is deleted.
<b>ENVIRONMENT</b>
MAIL_CONFIG
@@ -60,16 +60,18 @@ POSTDROP(1) POSTDROP(1)
<b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b>
A list of non-default Postfix configuration directories that may
- be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line, or
- via the MAIL_CONFIG environment parameter.
+ be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in
+ the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the
+ MAIL_CONFIG environment parameter.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
- The list of environment parameters that a Postfix process will
- import from a non-Postfix parent process.
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
The location of the Postfix top-level queue directory.
@@ -78,18 +80,17 @@ POSTDROP(1) POSTDROP(1)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
<b><a href="postconf.5.html#trigger_timeout">trigger_timeout</a> (10s)</b>
- The time limit for sending a trigger to a Postfix daemon (for
+ The time limit for sending a trigger to a Postfix daemon (for
example, the <a href="pickup.8.html"><b>pickup</b>(8)</a> or <a href="qmgr.8.html"><b>qmgr</b>(8)</a> daemon).
Available in Postfix version 2.2 and later:
<b><a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> (<a href="DATABASE_README.html#types">static</a>:anyone)</b>
- List of users who are authorized to submit mail with the <a href="sendmail.1.html"><b>send-</b></a>
+ List of users who are authorized to submit mail with the <a href="sendmail.1.html"><b>send-</b></a>
<a href="sendmail.1.html"><b>mail</b>(1)</a> command (and with the privileged <a href="postdrop.1.html"><b>postdrop</b>(1)</a> helper com-
mand).
@@ -99,6 +100,7 @@ POSTDROP(1) POSTDROP(1)
<b>SEE ALSO</b>
<a href="sendmail.1.html">sendmail(1)</a>, compatibility interface
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/postfix-manuals.html b/external/ibm-public/postfix/dist/html/postfix-manuals.html
index 18448053c01..9b90c23df64 100644
--- a/external/ibm-public/postfix/dist/html/postfix-manuals.html
+++ b/external/ibm-public/postfix/dist/html/postfix-manuals.html
@@ -208,6 +208,8 @@ the following convention: </p>
<li> <a href="pipe.8.html">pipe(8)</a>, deliver mail to non-Postfix command
+<li> <a href="postlogd.8.html">postlogd(8)</a>, Postfix internal logging service
+
<li> <a href="postscreen.8.html">postscreen(8)</a>, Postfix zombie blocker
<li> <a href="proxymap.8.html">proxymap(8)</a>, Postfix lookup table proxy server
diff --git a/external/ibm-public/postfix/dist/html/postfix.1.html b/external/ibm-public/postfix/dist/html/postfix.1.html
index f4c5660d2ea..4c5c4f93711 100644
--- a/external/ibm-public/postfix/dist/html/postfix.1.html
+++ b/external/ibm-public/postfix/dist/html/postfix.1.html
@@ -36,6 +36,17 @@ POSTFIX(1) POSTFIX(1)
<b>start</b> Start the Postfix mail system. This also runs the configuration
check described above.
+ <b>start-fg</b>
+ Like <b>start</b>, but keep the <a href="master.8.html"><b>master</b>(8)</a> daemon running in the fore-
+ ground, and enable <a href="master.8.html"><b>master</b>(8)</a> "init" mode when running as PID 1.
+ This command requires that multi-instance support is disabled
+ (i.e. the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> parameter value must be
+ empty). When running Postfix inside a container, mount the con-
+ tainer host's /dev/log socket inside the container (example:
+ "docker run -v /dev/log:/dev/log ...") and specify a distinct
+ Postfix "<a href="postconf.5.html#syslog_name">syslog_name</a>" prefix that identifies logging from the
+ Postfix instance.
+
<b>stop</b> Stop the Postfix mail system in an orderly fashion. If possible,
running processes are allowed to terminate at their earliest
convenience.
@@ -73,6 +84,15 @@ POSTFIX(1) POSTFIX(1)
fix 2.0 and earlier, use "<b>$<a href="postconf.5.html#config_directory">config_directory</a>/post-install</b>
<b>set-permissions</b>".
+ <b>logrotate</b>
+ Rotate the logfile specified with $<a href="postconf.5.html#maillog_file">maillog_file</a>, by appending a
+ time-stamp suffix that is formatted according to $<a href="postconf.5.html#maillog_file_rotate_suffix">mail</a>-
+ <a href="postconf.5.html#maillog_file_rotate_suffix">log_file_rotate_suffix</a>, and by compressing the file with the
+ command specified with $<a href="postconf.5.html#maillog_file_compressor">maillog_file_compressor</a>. This will not
+ rotate /dev/* files.
+
+ This feature is available in Postfix 3.4 and later.
+
<b>tls</b> <i>subcommand</i>
Enable opportunistic TLS in the Postfix SMTP client or server,
and manage Postfix SMTP server TLS private keys and certifi-
@@ -130,12 +150,23 @@ POSTFIX(1) POSTFIX(1)
<b>MAIL_DEBUG</b>
This is set when the -D command-line option is present.
+ When the internal logging service is enabled (by setting a non-empty
+ <a href="postconf.5.html#maillog_file">maillog_file</a> parameter value) the <a href="postfix.1.html">postfix(1)</a> command exports settings
+ that are used by child processes before they have processed <a href="postconf.5.html">main.cf</a> or
+ command-line settings.
+
+ <b>POSTLOG_SERVICE</b>
+ The name of the public postlog service endpoint.
+
+ <b>POSTLOG_HOSTNAME</b>
+ The hostname to prepend to internal logging.
+
<b>CONFIGURATION PARAMETERS</b>
The following <a href="postconf.5.html"><b>main.cf</b></a> configuration parameters are exported as environ-
ment variables with the same names:
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b>
@@ -145,22 +176,22 @@ POSTFIX(1) POSTFIX(1)
The directory with Postfix support programs and daemon programs.
<b><a href="postconf.5.html#html_directory">html_directory</a> (see 'postconf -d' output)</b>
- The location of Postfix HTML files that describe how to build,
+ The location of Postfix HTML files that describe how to build,
configure or operate a specific Postfix subsystem or feature.
<b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
- The UNIX system account that owns the Postfix queue and most
+ The UNIX system account that owns the Postfix queue and most
Postfix daemon processes.
<b><a href="postconf.5.html#mailq_path">mailq_path</a> (see 'postconf -d' output)</b>
- Sendmail compatibility feature that specifies where the Postfix
+ Sendmail compatibility feature that specifies where the Postfix
<a href="mailq.1.html"><b>mailq</b>(1)</a> command is installed.
<b><a href="postconf.5.html#manpage_directory">manpage_directory</a> (see 'postconf -d' output)</b>
Where the Postfix manual pages are installed.
<b><a href="postconf.5.html#newaliases_path">newaliases_path</a> (see 'postconf -d' output)</b>
- Sendmail compatibility feature that specifies the location of
+ Sendmail compatibility feature that specifies the location of
the <a href="newaliases.1.html"><b>newaliases</b>(1)</a> command.
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
@@ -171,31 +202,31 @@ POSTFIX(1) POSTFIX(1)
configure or operate a specific Postfix subsystem or feature.
<b><a href="postconf.5.html#sendmail_path">sendmail_path</a> (see 'postconf -d' output)</b>
- A Sendmail compatibility feature that specifies the location of
+ A Sendmail compatibility feature that specifies the location of
the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command.
<b><a href="postconf.5.html#setgid_group">setgid_group</a> (postdrop)</b>
- The group ownership of set-gid Postfix commands and of
+ The group ownership of set-gid Postfix commands and of
group-writable Postfix directories.
Available in Postfix version 2.5 and later:
<b><a href="postconf.5.html#data_directory">data_directory</a> (see 'postconf -d' output)</b>
- The directory with Postfix-writable data files (for example:
+ The directory with Postfix-writable data files (for example:
caches, pseudo-random numbers).
Available in Postfix version 3.0 and later:
<b><a href="postconf.5.html#meta_directory">meta_directory</a> (see 'postconf -d' output)</b>
- The location of non-executable files that are shared among mul-
- tiple Postfix instances, such as postfix-files, dynamicmaps.cf,
- and the multi-instance template files <a href="postconf.5.html">main.cf</a>.proto and <a href="master.5.html">mas-
+ The location of non-executable files that are shared among mul-
+ tiple Postfix instances, such as postfix-files, dynamicmaps.cf,
+ and the multi-instance template files <a href="postconf.5.html">main.cf</a>.proto and <a href="master.5.html">mas-
ter.cf</a>.proto.
<b><a href="postconf.5.html#shlib_directory">shlib_directory</a> (see 'postconf -d' output)</b>
- The location of Postfix dynamically-linked libraries (libpost-
- fix-*.so), and the default location of Postfix database plugins
- (postfix-*.so) that have a relative pathname in the dynam-
+ The location of Postfix dynamically-linked libraries (libpost-
+ fix-*.so), and the default location of Postfix database plugins
+ (postfix-*.so) that have a relative pathname in the dynam-
icmaps.cf file.
Available in Postfix version 3.1 and later:
@@ -206,29 +237,29 @@ POSTFIX(1) POSTFIX(1)
Other configuration parameters:
<b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
- The list of environment parameters that a Postfix process will
- import from a non-Postfix parent process.
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
<b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 2.6 and later:
<b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b>
- An optional list of non-default Postfix configuration directo-
- ries; these directories belong to additional Postfix instances
- that share the Postfix executable files and documentation with
- the default Postfix instance, and that are started, stopped,
+ An optional list of non-default Postfix configuration directo-
+ ries; these directories belong to additional Postfix instances
+ that share the Postfix executable files and documentation with
+ the default Postfix instance, and that are started, stopped,
etc., together with the default Postfix instance.
<b><a href="postconf.5.html#multi_instance_wrapper">multi_instance_wrapper</a> (empty)</b>
- The pathname of a multi-instance manager command that the <a href="postfix.1.html"><b>post-</b></a>
- <a href="postfix.1.html"><b>fix</b>(1)</a> command invokes when the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>
+ The pathname of a multi-instance manager command that the <a href="postfix.1.html"><b>post-</b></a>
+ <a href="postfix.1.html"><b>fix</b>(1)</a> command invokes when the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>
parameter value is non-empty.
<b><a href="postconf.5.html#multi_instance_group">multi_instance_group</a> (empty)</b>
@@ -238,9 +269,29 @@ POSTFIX(1) POSTFIX(1)
The optional instance name of this Postfix instance.
<b><a href="postconf.5.html#multi_instance_enable">multi_instance_enable</a> (no)</b>
- Allow this Postfix instance to be started, stopped, etc., by a
+ Allow this Postfix instance to be started, stopped, etc., by a
multi-instance manager.
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#maillog_file">maillog_file</a> (empty)</b>
+ The name of an optional logfile that is written by the Postfix
+ <a href="postlogd.8.html"><b>postlogd</b>(8)</a> service.
+
+ <b><a href="postconf.5.html#maillog_file_compressor">maillog_file_compressor</a> (gzip)</b>
+ The program to run after rotating $<a href="postconf.5.html#maillog_file">maillog_file</a> with "postfix
+ logrotate".
+
+ <b><a href="postconf.5.html#maillog_file_prefixes">maillog_file_prefixes</a> (/var, /dev/stdout)</b>
+ A list of allowed prefixes for a <a href="postconf.5.html#maillog_file">maillog_file</a> value.
+
+ <b><a href="postconf.5.html#maillog_file_rotate_suffix">maillog_file_rotate_suffix</a> (%Y%M%d-%H%M%S)</b>
+ The format of the suffix to append to $<a href="postconf.5.html#maillog_file">maillog_file</a> while rotat-
+ ing the file with "postfix logrotate".
+
+ <b><a href="postconf.5.html#postlog_service_name">postlog_service_name</a> (postlog)</b>
+ The name of the <a href="postlogd.8.html"><b>postlogd</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>.
+
<b>FILES</b>
Prior to Postfix version 2.6, all of the following files were in <b>$<a href="postconf.5.html#config_directory">con</a>-</b>
<b><a href="postconf.5.html#config_directory">fig_directory</a></b>. Some files are now in <b>$<a href="postconf.5.html#daemon_directory">daemon_directory</a></b> so that they can
@@ -317,6 +368,7 @@ POSTFIX(1) POSTFIX(1)
<a href="qmgr.8.html">oqmgr(8)</a>, old Postfix queue manager
<a href="pickup.8.html">pickup(8)</a>, Postfix local mail pickup
<a href="pipe.8.html">pipe(8)</a>, deliver mail to non-Postfix command
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix internal logging service
<a href="postscreen.8.html">postscreen(8)</a>, Postfix zombie blocker
<a href="proxymap.8.html">proxymap(8)</a>, Postfix lookup table proxy server
<a href="qmgr.8.html">qmgr(8)</a>, Postfix queue manager
diff --git a/external/ibm-public/postfix/dist/html/postkick.1.html b/external/ibm-public/postfix/dist/html/postkick.1.html
index 67b724b9e4a..15af2e11599 100644
--- a/external/ibm-public/postfix/dist/html/postkick.1.html
+++ b/external/ibm-public/postfix/dist/html/postkick.1.html
@@ -61,6 +61,11 @@ POSTKICK(1) POSTKICK(1)
How long the <a href="postkick.1.html"><b>postkick</b>(1)</a> command waits for a request to enter
the Postfix daemon process input buffer before giving up.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
The location of the Postfix top-level queue directory.
diff --git a/external/ibm-public/postfix/dist/html/postlock.1.html b/external/ibm-public/postfix/dist/html/postlock.1.html
index 6ad337adc8b..0ebce6ca776 100644
--- a/external/ibm-public/postfix/dist/html/postlock.1.html
+++ b/external/ibm-public/postfix/dist/html/postlock.1.html
@@ -4,7 +4,7 @@
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<title> Postfix manual - postlock(1) </title>
</head> <body> <pre>
-POSTLOCK(1) General Commands Manual POSTLOCK(1)
+POSTLOCK(1) POSTLOCK(1)
<b>NAME</b>
postlock - lock mail folder and execute command
@@ -91,6 +91,11 @@ POSTLOCK(1) General Commands Manual POSTLOCK(1)
The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b>SEE ALSO</b>
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
diff --git a/external/ibm-public/postfix/dist/html/postlog.1.html b/external/ibm-public/postfix/dist/html/postlog.1.html
index 69bff40a8af..cacbd6a71ce 100644
--- a/external/ibm-public/postfix/dist/html/postlog.1.html
+++ b/external/ibm-public/postfix/dist/html/postlog.1.html
@@ -4,7 +4,7 @@
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<title> Postfix manual - postlog(1) </title>
</head> <body> <pre>
-POSTLOG(1) General Commands Manual POSTLOG(1)
+POSTLOG(1) POSTLOG(1)
<b>NAME</b>
postlog - Postfix-compatible logging utility
@@ -20,16 +20,19 @@ POSTLOG(1) General Commands Manual POSTLOG(1)
record. If no <i>text</i> is specified on the command line, <a href="postlog.1.html"><b>postlog</b>(1)</a> reads
from standard input and logs each input line as one record.
- Logging is sent to <b>syslogd</b>(8); when the standard error stream is con-
- nected to a terminal, logging is sent there as well.
+ By default, logging is sent to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>; when the
+ standard error stream is connected to a terminal, logging is sent there
+ as well.
The following options are implemented:
<b>-c</b> <i>config</i><b>_</b><i>dir</i>
- Read the <a href="postconf.5.html"><b>main.cf</b></a> configuration file in the named directory
+ Read the <a href="postconf.5.html"><b>main.cf</b></a> configuration file in the named directory
instead of the default configuration directory.
- <b>-i</b> Include the process ID in the logging tag.
+ <b>-i</b> (obsolete)
+ Include the process ID in the logging tag. This flag is ignored
+ as of Postfix 3.4, where the PID is always included.
<b>-p</b> <i>priority</i> (default: <b>info</b>)
Specifies the logging severity: <b>info</b>, <b>warn</b>, <b>error</b>, <b>fatal</b>, or
@@ -59,17 +62,31 @@ POSTLOG(1) General Commands Manual POSTLOG(1)
The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.4 and later:
+
+ <b><a href="postconf.5.html#maillog_file">maillog_file</a> (empty)</b>
+ The name of an optional logfile that is written by the Postfix
+ <a href="postlogd.8.html"><b>postlogd</b>(8)</a> service.
+
+ <b><a href="postconf.5.html#postlog_service_name">postlog_service_name</a> (postlog)</b>
+ The name of the <a href="postlogd.8.html"><b>postlogd</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>.
<b>SEE ALSO</b>
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
- syslogd(8), syslog daemon
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
+ syslogd(8), system logging
<b>LICENSE</b>
The Secure Mailer license must be distributed with this software.
diff --git a/external/ibm-public/postfix/dist/html/postlogd.8.html b/external/ibm-public/postfix/dist/html/postlogd.8.html
new file mode 100644
index 00000000000..8cdc50d4d32
--- /dev/null
+++ b/external/ibm-public/postfix/dist/html/postlogd.8.html
@@ -0,0 +1,92 @@
+<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
+ "http://www.w3.org/TR/html4/loose.dtd">
+<html> <head>
+<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
+<title> Postfix manual - postlogd(8) </title>
+</head> <body> <pre>
+POSTLOGD(8) POSTLOGD(8)
+
+<b>NAME</b>
+ postlogd - Postfix internal log server
+
+<b>SYNOPSIS</b>
+ <b>postlogd</b> [generic Postfix daemon options]
+
+<b>DESCRIPTION</b>
+ This program logs events on behalf of Postfix programs when the maillog
+ configuration parameter specifies a non-empty value.
+
+<b>BUGS</b>
+ Non-daemon Postfix programs don't know that they should log to the
+ internal logging service before they have processed command-line
+ options and <a href="postconf.5.html">main.cf</a> parameters. These programs still log earlier events
+ to the syslog service.
+
+ If Postfix is down, the non-daemon programs <a href="postfix.1.html"><b>postfix</b>(1)</a>, <a href="postsuper.1.html"><b>postsuper</b>(1)</a>,
+ <a href="postmulti.1.html"><b>postmulti</b>(1)</a>, and <a href="postlog.1.html"><b>postlog</b>(1)</a>, will log directly to <b>$<a href="postconf.5.html#maillog_file">maillog_file</a></b>. These
+ programs expect to run with root privileges, for example during Postfix
+ start-up, reload, or shutdown.
+
+ Other non-daemon Postfix programs will never write directly to <b>$<a href="postconf.5.html#maillog_file">mail</a>-</b>
+ <b><a href="postconf.5.html#maillog_file">log_file</a></b> (also, logging to stdout would interfere with the operation of
+ some of these programs). These programs can log to <a href="postlogd.8.html"><b>postlogd</b>(8)</a> if they
+ are run by the super-user, or if their executable file has set-gid per-
+ mission. Do not set this permission on programs other than <a href="postdrop.1.html"><b>postdrop</b>(1)</a>
+ and <a href="postqueue.1.html"><b>postqueue</b>(1)</a>.
+
+<b>CONFIGURATION PARAMETERS</b>
+ Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="postlogd.8.html"><b>postlogd</b>(8)</a> pro-
+ cesses run for only a limited amount of time. Use the command "<b>postfix</b>
+ <b>reload</b>" to speed up a change.
+
+ The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
+ more details including examples.
+
+ <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ figuration files.
+
+ <b><a href="postconf.5.html#maillog_file">maillog_file</a> (empty)</b>
+ The name of an optional logfile that is written by the Postfix
+ <a href="postlogd.8.html"><b>postlogd</b>(8)</a> service.
+
+ <b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
+ The process ID of a Postfix command or daemon process.
+
+ <b><a href="postconf.5.html#process_name">process_name</a> (read-only)</b>
+ The process name of a Postfix command or daemon process.
+
+ <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ <b><a href="postconf.5.html#postlogd_watchdog_timeout">postlogd_watchdog_timeout</a> (10s)</b>
+ How much time a <a href="postlogd.8.html"><b>postlogd</b>(8)</a> process may take to process a
+ request before it is terminated by a built-in watchdog timer.
+
+<b>SEE ALSO</b>
+ <a href="postconf.5.html">postconf(5)</a>, configuration parameters
+ syslogd(8), system logging
+
+<b>README_FILES</b>
+ Use "<b>postconf <a href="postconf.5.html#readme_directory">readme_directory</a></b>" or "<b>postconf <a href="postconf.5.html#html_directory">html_directory</a></b>" to locate
+ this information.
+ <a href="MAILLOG_README.html">MAILLOG_README</a>, Postfix logging to file or stdout
+
+<b>LICENSE</b>
+ The Secure Mailer license must be distributed with this software.
+
+<b>HISTORY</b>
+ This service was introduced with Postfix version 3.4.
+
+<b>AUTHOR(S)</b>
+ Wietse Venema
+ Google, Inc.
+ 111 8th Avenue
+ New York, NY 10011, USA
+
+ POSTLOGD(8)
+</pre> </body> </html>
diff --git a/external/ibm-public/postfix/dist/html/postmap.1.html b/external/ibm-public/postfix/dist/html/postmap.1.html
index 9336b3fb2fa..8c23225311d 100644
--- a/external/ibm-public/postfix/dist/html/postmap.1.html
+++ b/external/ibm-public/postfix/dist/html/postmap.1.html
@@ -10,21 +10,18 @@ POSTMAP(1) POSTMAP(1)
postmap - Postfix lookup table management
<b>SYNOPSIS</b>
- <b>postmap</b> [<b>-NbfhimnoprsuUvw</b>] [<b>-c</b> <i>config</i><b>_</b><i>dir</i>] [<b>-d</b> <i>key</i>] [<b>-q</b> <i>key</i>]
+ <b>postmap</b> [<b>-bfFhimnNoprsuUvw</b>] [<b>-c</b> <i>config</i><b>_</b><i>dir</i>] [<b>-d</b> <i>key</i>] [<b>-q</b> <i>key</i>]
[<i>file</i><b>_</b><i>type</i>:]<i>file</i><b>_</b><i>name</i> ...
<b>DESCRIPTION</b>
The <a href="postmap.1.html"><b>postmap</b>(1)</a> command creates or queries one or more Postfix lookup
- tables, or updates an existing one. The input and output file formats
- are expected to be compatible with:
+ tables, or updates an existing one.
- <b>makemap</b> <i>file</i><b>_</b><i>type file</i><b>_</b><i>name</i> &lt; <i>file</i><b>_</b><i>name</i>
-
- If the result files do not exist they will be created with the same
+ If the result files do not exist they will be created with the same
group and other read permissions as their source file.
- While the table update is in progress, signal delivery is postponed,
- and an exclusive, advisory, lock is placed on the entire table, in
+ While the table update is in progress, signal delivery is postponed,
+ and an exclusive, advisory, lock is placed on the entire table, in
order to avoid surprises in spectator processes.
<b>INPUT FILE FORMAT</b>
@@ -34,16 +31,25 @@ POSTMAP(1) POSTMAP(1)
<i>key</i> whitespace <i>value</i>
- <b>o</b> Empty lines and whitespace-only lines are ignored, as are lines
+ <b>o</b> Empty lines and whitespace-only lines are ignored, as are lines
whose first non-whitespace character is a `#'.
- <b>o</b> A logical line starts with non-whitespace text. A line that
+ <b>o</b> A logical line starts with non-whitespace text. A line that
starts with whitespace continues a logical line.
- The <i>key</i> and <i>value</i> are processed as is, except that surrounding white
- space is stripped off. Unlike with Postfix alias databases, quotes can-
- not be used to protect lookup keys that contain special characters such
- as `#' or whitespace.
+ The <i>key</i> and <i>value</i> are processed as is, except that surrounding white
+ space is stripped off. Whitespace in lookup keys is supported as of
+ Postfix 3.2.
+
+ When the <b>-F</b> option is given, the <i>value</i> must specify one or more file-
+ names separated by comma and/or whitespace; <a href="postmap.1.html"><b>postmap</b>(1)</a> will concatenate
+ the file content (with a newline character inserted between files) and
+ will store the base64-encoded result instead of the <i>value</i>.
+
+ When the <i>key</i> specifies email address information, the localpart should
+ be enclosed with double quotes if required by <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a>. For example, an
+ address localpart that contains ";", or a localpart that starts or ends
+ with ".".
By default the lookup key is mapped to lowercase to make the lookups
case insensitive; as of Postfix 2.3 this case folding happens only with
@@ -56,7 +62,7 @@ POSTMAP(1) POSTMAP(1)
<b>COMMAND-LINE ARGUMENTS</b>
<b>-b</b> Enable message body query mode. When reading lookup keys from
standard input with "<b>-q -</b>", process the input as if it is an
- email message in <a href="http://tools.ietf.org/html/rfc2822">RFC 2822</a> format. Each line of body content
+ email message in <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each line of body content
becomes one lookup key.
By default, the <b>-b</b> option starts generating lookup keys at the
@@ -91,9 +97,15 @@ POSTMAP(1) POSTMAP(1)
for regular expression tables. There, case folding is controlled
by appending a flag to a pattern.
+ <b>-F</b> When querying a map, or listing a map, base64-decode each value.
+ When creating a map from source file, process each value as a
+ list of filenames, concatenate the content of those files, and
+ store the base64-encoded result instead of the value (see INPUT
+ FORMAT for details).
+
<b>-h</b> Enable message header query mode. When reading lookup keys from
standard input with "<b>-q -</b>", process the input as if it is an
- email message in <a href="http://tools.ietf.org/html/rfc2822">RFC 2822</a> format. Each logical header line
+ email message in <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each logical header line
becomes one lookup key. A multi-line header becomes one lookup
key with one or more embedded newline characters.
@@ -137,33 +149,38 @@ POSTMAP(1) POSTMAP(1)
found to the standard output stream. The exit status is zero
when the requested information was found.
- If a key value of <b>-</b> is specified, the program reads key values
- from the standard input stream and writes one line of <i>key value</i>
+ Note: this performs a single query with the key as specified,
+ and does not make iterative queries with substrings of the key
+ as described for <a href="access.5.html">access(5)</a>, <a href="canonical.5.html">canonical(5)</a>, <a href="transport.5.html">transport(5)</a>, <a href="virtual.5.html">vir-</a>
+ <a href="virtual.5.html">tual(5)</a> and other Postfix table-driven features.
+
+ If a key value of <b>-</b> is specified, the program reads key values
+ from the standard input stream and writes one line of <i>key value</i>
output for each key that was found. The exit status is zero when
at least one of the requested keys was found.
- <b>-r</b> When updating a table, do not complain about attempts to update
+ <b>-r</b> When updating a table, do not complain about attempts to update
existing entries, and make those updates anyway.
- <b>-s</b> Retrieve all database elements, and write one line of <i>key value</i>
- output for each element. The elements are printed in database
- order, which is not necessarily the same as the original input
+ <b>-s</b> Retrieve all database elements, and write one line of <i>key value</i>
+ output for each element. The elements are printed in database
+ order, which is not necessarily the same as the original input
order.
- This feature is available in Postfix version 2.2 and later, and
+ This feature is available in Postfix version 2.2 and later, and
is not available for all database types.
- <b>-u</b> Disable UTF-8 support. UTF-8 support is enabled by default when
- "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes". It requires that keys and values are
+ <b>-u</b> Disable UTF-8 support. UTF-8 support is enabled by default when
+ "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes". It requires that keys and values are
valid UTF-8 strings.
<b>-U</b> With "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", force UTF-8 syntax checks with the
<b>-b</b> and <b>-h</b> options.
- <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b>
+ <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b>
options make the software increasingly verbose.
- <b>-w</b> When updating a table, do not complain about attempts to update
+ <b>-w</b> When updating a table, do not complain about attempts to update
existing entries, and ignore those attempts.
Arguments:
@@ -175,32 +192,32 @@ POSTMAP(1) POSTMAP(1)
The <a href="postmap.1.html"><b>postmap</b>(1)</a> command can query any supported file type, but it
can create only the following file types:
- <b>btree</b> The output file is a btree file, named <i>file</i><b>_</b><i>name</i><b>.db</b>.
- This is available on systems with support for <b>db</b> data-
+ <b>btree</b> The output file is a btree file, named <i>file</i><b>_</b><i>name</i><b>.db</b>.
+ This is available on systems with support for <b>db</b> data-
bases.
- <b>cdb</b> The output consists of one file, named <i>file</i><b>_</b><i>name</i><b>.cdb</b>.
- This is available on systems with support for <b>cdb</b> data-
+ <b>cdb</b> The output consists of one file, named <i>file</i><b>_</b><i>name</i><b>.cdb</b>.
+ This is available on systems with support for <b>cdb</b> data-
bases.
<b>dbm</b> The output consists of two files, named <i>file</i><b>_</b><i>name</i><b>.pag</b> and
<i>file</i><b>_</b><i>name</i><b>.dir</b>. This is available on systems with support
for <b>dbm</b> databases.
- <b>hash</b> The output file is a hashed file, named <i>file</i><b>_</b><i>name</i><b>.db</b>.
- This is available on systems with support for <b>db</b> data-
+ <b>hash</b> The output file is a hashed file, named <i>file</i><b>_</b><i>name</i><b>.db</b>.
+ This is available on systems with support for <b>db</b> data-
bases.
- <b>fail</b> A table that reliably fails all requests. The lookup ta-
- ble name is used for logging only. This table exists to
+ <b>fail</b> A table that reliably fails all requests. The lookup ta-
+ ble name is used for logging only. This table exists to
simplify Postfix error tests.
<b>sdbm</b> The output consists of two files, named <i>file</i><b>_</b><i>name</i><b>.pag</b> and
<i>file</i><b>_</b><i>name</i><b>.dir</b>. This is available on systems with support
for <b>sdbm</b> databases.
- When no <i>file</i><b>_</b><i>type</i> is specified, the software uses the database
- type specified via the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration
+ When no <i>file</i><b>_</b><i>type</i> is specified, the software uses the database
+ type specified via the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration
parameter.
<i>file</i><b>_</b><i>name</i>
@@ -208,12 +225,12 @@ POSTMAP(1) POSTMAP(1)
base.
<b>DIAGNOSTICS</b>
- Problems are logged to the standard error stream and to <b>syslogd</b>(8). No
- output means that no problems were detected. Duplicate entries are
- skipped and are flagged with a warning.
+ Problems are logged to the standard error stream and to <b>syslogd</b>(8) or
+ <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. No output means that no problems were detected. Duplicate
+ entries are skipped and are flagged with a warning.
<a href="postmap.1.html"><b>postmap</b>(1)</a> terminates with zero exit status in case of success (includ-
- ing successful "<b>postmap -q</b>" lookup) and terminates with non-zero exit
+ ing successful "<b>postmap -q</b>" lookup) and terminates with non-zero exit
status in case of failure.
<b>ENVIRONMENT</b>
@@ -224,12 +241,12 @@ POSTMAP(1) POSTMAP(1)
Enable verbose logging for debugging purposes.
<b>CONFIGURATION PARAMETERS</b>
- The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
- gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a>
+ The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
+ gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a>
<a href="postconf.5.html"><b>conf</b>(5)</a> for more details including examples.
<b><a href="postconf.5.html#berkeley_db_create_buffer_size">berkeley_db_create_buffer_size</a> (16777216)</b>
- The per-table I/O buffer size for programs that create Berkeley
+ The per-table I/O buffer size for programs that create Berkeley
DB hash or btree tables.
<b><a href="postconf.5.html#berkeley_db_read_buffer_size">berkeley_db_read_buffer_size</a> (131072)</b>
@@ -237,29 +254,34 @@ POSTMAP(1) POSTMAP(1)
hash or btree tables.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#default_database_type">default_database_type</a> (see 'postconf -d' output)</b>
The default database type for use in <a href="newaliases.1.html"><b>newaliases</b>(1)</a>, <a href="postalias.1.html"><b>postalias</b>(1)</a>
and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
- Enable preliminary SMTPUTF8 support for the protocols described
+ Enable preliminary SMTPUTF8 support for the protocols described
in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.
<b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
<b>SEE ALSO</b>
<a href="postalias.1.html">postalias(1)</a>, create/update/query alias database
<a href="postconf.1.html">postconf(1)</a>, supported database types
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/postmulti.1.html b/external/ibm-public/postfix/dist/html/postmulti.1.html
index 2d33d21e33e..0115b9fd83f 100644
--- a/external/ibm-public/postfix/dist/html/postmulti.1.html
+++ b/external/ibm-public/postfix/dist/html/postmulti.1.html
@@ -18,9 +18,9 @@ POSTMULTI(1) POSTMULTI(1)
<b>postmulti -l</b> [<b>-aRv</b>] [<b>-g</b> <i>group</i>] [<b>-i</b> <i>name</i>]
- <b>postmulti -p</b> [<b>-av</b>] [<b>-g</b> <i>group</i>] [<b>-i</b> <i>name</i>] <i>command...</i>
+ <b>postmulti -p</b> [<b>-av</b>] [<b>-g</b> <i>group</i>] [<b>-i</b> <i>name</i>] <i>postfix-command...</i>
- <b>postmulti -x</b> [<b>-aRv</b>] [<b>-g</b> <i>group</i>] [<b>-i</b> <i>name</i>] <i>command...</i>
+ <b>postmulti -x</b> [<b>-aRv</b>] [<b>-g</b> <i>group</i>] [<b>-i</b> <i>name</i>] <i>unix-command...</i>
<b>Life-cycle management:</b>
@@ -100,7 +100,8 @@ POSTMULTI(1) POSTMULTI(1)
name, enable/disable status and configuration directory.
<b>Postfix-wrapper mode</b>
- <b>-p</b> Invoke <a href="postfix.1.html"><b>postfix(1)</a></b> to execute the specified <i>command</i>. This option
+ <b>-p</b> <i>postfix-command</i>
+ Invoke <a href="postfix.1.html"><b>postfix(1)</a></b> to execute <i>postfix-command</i>. This option
implements the <a href="postfix-wrapper.5.html"><b>postfix-wrapper</b>(5)</a> interface.
<b>o</b> With "start"-like commands, "postfix check" is executed
@@ -130,10 +131,11 @@ POSTMULTI(1) POSTMULTI(1)
# postmulti -g msa -p start
<b>Command mode</b>
- <b>-x</b> Execute the specified <i>command</i> for all Postfix instances. The
- command runs with appropriate environment settings for MAIL_CON-
- FIG, <a href="postconf.5.html#command_directory">command_directory</a>, <a href="postconf.5.html#daemon_directory">daemon_directory</a>, <a href="postconf.5.html#config_directory">config_directory</a>,
- <a href="postconf.5.html#queue_directory">queue_directory</a>, <a href="postconf.5.html#data_directory">data_directory</a>, <a href="postconf.5.html#multi_instance_name">multi_instance_name</a>,
+ <b>-x</b> <i>unix-command</i>
+ Execute the specified <i>unix-command</i> for all Postfix instances.
+ The command runs with appropriate environment settings for
+ MAIL_CONFIG, <a href="postconf.5.html#command_directory">command_directory</a>, <a href="postconf.5.html#daemon_directory">daemon_directory</a>, <a href="postconf.5.html#config_directory">config_direc</a>-
+ <a href="postconf.5.html#config_directory">tory</a>, <a href="postconf.5.html#queue_directory">queue_directory</a>, <a href="postconf.5.html#data_directory">data_directory</a>, <a href="postconf.5.html#multi_instance_name">multi_instance_name</a>,
<a href="postconf.5.html#multi_instance_group">multi_instance_group</a> and <a href="postconf.5.html#multi_instance_enable">multi_instance_enable</a>.
<b>Other options</b>
@@ -316,14 +318,15 @@ POSTMULTI(1) POSTMULTI(1)
The directory with Postfix support programs and daemon programs.
<b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
- The list of environment parameters that a Postfix process will
- import from a non-Postfix parent process.
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
<b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b>
- An optional list of non-default Postfix configuration directo-
- ries; these directories belong to additional Postfix instances
- that share the Postfix executable files and documentation with
- the default Postfix instance, and that are started, stopped,
+ An optional list of non-default Postfix configuration directo-
+ ries; these directories belong to additional Postfix instances
+ that share the Postfix executable files and documentation with
+ the default Postfix instance, and that are started, stopped,
etc., together with the default Postfix instance.
<b><a href="postconf.5.html#multi_instance_group">multi_instance_group</a> (empty)</b>
@@ -333,28 +336,27 @@ POSTMULTI(1) POSTMULTI(1)
The optional instance name of this Postfix instance.
<b><a href="postconf.5.html#multi_instance_enable">multi_instance_enable</a> (no)</b>
- Allow this Postfix instance to be started, stopped, etc., by a
+ Allow this Postfix instance to be started, stopped, etc., by a
multi-instance manager.
<b><a href="postconf.5.html#postmulti_start_commands">postmulti_start_commands</a> (start)</b>
- The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager
+ The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager
treats as "start" commands.
<b><a href="postconf.5.html#postmulti_stop_commands">postmulti_stop_commands</a> (see 'postconf -d' output)</b>
- The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager
+ The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager
treats as "stop" commands.
<b><a href="postconf.5.html#postmulti_control_commands">postmulti_control_commands</a> (reload flush)</b>
- The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager
+ The <a href="postfix.1.html"><b>postfix</b>(1)</a> commands that the <a href="postmulti.1.html"><b>postmulti</b>(1)</a> instance manager
treats as "control" commands, that operate on running instances.
<b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix 3.0 and later:
@@ -397,5 +399,10 @@ POSTMULTI(1) POSTMULTI(1)
P.O. Box 704
Yorktown Heights, NY 10598, USA
+ Wietse Venema
+ Google, Inc.
+ 111 8th Avenue
+ New York, NY 10011, USA
+
POSTMULTI(1)
</pre> </body> </html>
diff --git a/external/ibm-public/postfix/dist/html/postqueue.1.html b/external/ibm-public/postfix/dist/html/postqueue.1.html
index 71984717e62..c4b3e1e1d11 100644
--- a/external/ibm-public/postfix/dist/html/postqueue.1.html
+++ b/external/ibm-public/postfix/dist/html/postqueue.1.html
@@ -80,23 +80,28 @@ POSTQUEUE(1) POSTQUEUE(1)
ery attempt will be made until the mail is taken off
hold.
+ <b>#</b> The message is forced to expire. See the <a href="postsuper.1.html"><b>postsuper</b>(1)</a>
+ options <b>-e</b> or <b>-f</b>.
+
+ This feature is available in Postfix 3.5 and later.
+
<b>-s</b> <i>site</i>
- Schedule immediate delivery of all mail that is queued for the
- named <i>site</i>. A numerical site must be specified as a valid <a href="http://tools.ietf.org/html/rfc5321">RFC</a>
+ Schedule immediate delivery of all mail that is queued for the
+ named <i>site</i>. A numerical site must be specified as a valid <a href="http://tools.ietf.org/html/rfc5321">RFC</a>
<a href="http://tools.ietf.org/html/rfc5321">5321</a> address literal enclosed in [], just like in email
- addresses. The site must be eligible for the "fast flush" ser-
- vice. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information about the "fast flush"
+ addresses. The site must be eligible for the "fast flush" ser-
+ vice. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information about the "fast flush"
service.
- This option implements the traditional "<b>sendmail -qR</b><i>site</i>" com-
+ This option implements the traditional "<b>sendmail -qR</b><i>site</i>" com-
mand, by contacting the Postfix <a href="flush.8.html"><b>flush</b>(8)</a> daemon.
- <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b>
- options make the software increasingly verbose. As of Postfix
+ <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b>
+ options make the software increasingly verbose. As of Postfix
2.3, this option is available for the super-user only.
<b>JSON OBJECT FORMAT</b>
- Each JSON object represents one queue file; it is emitted as a single
+ Each JSON object represents one queue file; it is emitted as a single
text line followed by a newline character.
Object members have string values unless indicated otherwise. Programs
@@ -104,28 +109,34 @@ POSTQUEUE(1) POSTQUEUE(1)
bers is expected to grow over time.
<b>queue_name</b>
- The name of the queue where the message was found. Note that
- the contents of the mail queue may change while it is being
- listed; some messages may appear more than once, and some mes-
+ The name of the queue where the message was found. Note that
+ the contents of the mail queue may change while it is being
+ listed; some messages may appear more than once, and some mes-
sages may be missed.
<b>queue_id</b>
The queue file name. The queue_id may be reused within a Postfix
instance unless "<a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a> = true" and time is mono-
- tonic. Even then, the queue_id is not expected to be unique
- between different Postfix instances. Management tools that
- require a unique name should combine the queue_id with the
+ tonic. Even then, the queue_id is not expected to be unique
+ between different Postfix instances. Management tools that
+ require a unique name should combine the queue_id with the
<a href="postconf.5.html#myhostname">myhostname</a> setting of the Postfix instance.
<b>arrival_time</b>
The number of seconds since the start of the UNIX epoch.
<b>message_size</b>
- The number of bytes in the message header and body. This number
- does not include message envelope information. It is approxi-
- mately equal to the number of bytes that would be transmitted
+ The number of bytes in the message header and body. This number
+ does not include message envelope information. It is approxi-
+ mately equal to the number of bytes that would be transmitted
via SMTP including the &lt;CR&gt;&lt;LF&gt; line endings.
+ <b>forced_expire</b>
+ The message is forced to expire (<b>true</b> or <b>false</b>). See the <a href="postsuper.1.html"><b>post-</b></a>
+ <a href="postsuper.1.html"><b>super</b>(1)</a> options <b>-e</b> or <b>-f</b>.
+
+ This feature is available in Postfix 3.5 and later.
+
<b>sender</b> The envelope sender address.
<b>recipients</b>
@@ -148,28 +159,30 @@ POSTQUEUE(1) POSTQUEUE(1)
<a href="http://tools.ietf.org/html/rfc7159">RFC 7159</a> (JSON notation)
<b>DIAGNOSTICS</b>
- Problems are logged to <b>syslogd</b>(8) and to the standard error stream.
+ Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard
+ error stream.
<b>ENVIRONMENT</b>
MAIL_CONFIG
- Directory with the <a href="postconf.5.html"><b>main.cf</b></a> file. In order to avoid exploitation
- of set-group ID privileges, a non-standard directory is allowed
+ Directory with the <a href="postconf.5.html"><b>main.cf</b></a> file. In order to avoid exploitation
+ of set-group ID privileges, a non-standard directory is allowed
only if:
- <b>o</b> The name is listed in the standard <a href="postconf.5.html"><b>main.cf</b></a> file with the
+ <b>o</b> The name is listed in the standard <a href="postconf.5.html"><b>main.cf</b></a> file with the
<b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a></b> configuration parameter.
<b>o</b> The command is invoked by the super-user.
<b>CONFIGURATION PARAMETERS</b>
- The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
- gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a>
+ The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
+ gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a>
<a href="postconf.5.html"><b>conf</b>(5)</a> for more details including examples.
<b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b>
A list of non-default Postfix configuration directories that may
- be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line, or
- via the MAIL_CONFIG environment parameter.
+ be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in
+ the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the
+ MAIL_CONFIG environment parameter.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
@@ -183,8 +196,9 @@ POSTQUEUE(1) POSTQUEUE(1)
tion logfiles with mail that is queued to those destinations.
<b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
- The list of environment parameters that a Postfix process will
- import from a non-Postfix parent process.
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
The location of the Postfix top-level queue directory.
@@ -193,9 +207,8 @@ POSTQUEUE(1) POSTQUEUE(1)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
<b><a href="postconf.5.html#trigger_timeout">trigger_timeout</a> (10s)</b>
The time limit for sending a trigger to a Postfix daemon (for
@@ -218,6 +231,8 @@ POSTQUEUE(1) POSTQUEUE(1)
<a href="flush.8.html">flush(8)</a>, fast flush service
<a href="sendmail.1.html">sendmail(1)</a>, Sendmail-compatible user interface
<a href="postsuper.1.html">postsuper(1)</a>, privileged queue operations
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
+ syslogd(8), system logging
<b>README FILES</b>
<a href="ETRN_README.html">ETRN_README</a>, Postfix ETRN howto
diff --git a/external/ibm-public/postfix/dist/html/postscreen.8.html b/external/ibm-public/postfix/dist/html/postscreen.8.html
index 3f6d3a2db99..0ebc296e600 100644
--- a/external/ibm-public/postfix/dist/html/postscreen.8.html
+++ b/external/ibm-public/postfix/dist/html/postscreen.8.html
@@ -22,8 +22,8 @@ POSTSCREEN(8) POSTSCREEN(8)
This program should not be used on SMTP ports that receive mail from
end-user clients (MUAs). In a typical deployment, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> handles
- the MX service on TCP port 25, while MUA clients submit mail via the
- <b>submission</b> service on TCP port 587 which requires client authentica-
+ the MX service on TCP port 25, and <a href="smtpd.8.html"><b>smtpd</b>(8)</a> receives mail from MUAs on
+ the <b>submission</b> service (TCP port 587) which requires client authentica-
tion. Alternatively, a site could set up a dedicated, non-postscreen,
"port 25" server that provides <b>submission</b> service and client authenti-
cation, but no MX service.
@@ -64,45 +64,41 @@ POSTSCREEN(8) POSTSCREEN(8)
<a href="http://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Status Codes)
<a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol)
Not: <a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining)
+ <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> (CHUNKING without BINARYMIME)
<a href="http://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command)
<a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension)
<a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes)
<a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol, including multi-line 220 banners)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
The <a href="postscreen.8.html"><b>postscreen</b>(8)</a> built-in SMTP protocol engine currently does not
announce support for AUTH, XCLIENT or XFORWARD. If you need to make
these services available on port 25, then do not enable the optional
- "after 220 server greeting" tests, and do not use DNSBLs that reject
- traffic from dial-up and residential networks.
-
- The optional "after 220 server greeting" tests involve <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s
- built-in SMTP protocol engine. When these tests succeed, <a href="postscreen.8.html"><b>postscreen</b>(8)</a>
- adds the client to the temporary whitelist, but it cannot hand off the
- "live" connection to a Postfix SMTP server process in the middle of a
- session. Instead, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> defers attempts to deliver mail with a
- 4XX status, and waits for the client to disconnect. When the client
- connects again, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will allow the client to talk to a Post-
- fix SMTP server process (provided that the whitelist status has not
- expired). <a href="postscreen.8.html"><b>postscreen</b>(8)</a> mitigates the impact of this limitation by
- giving the "after 220 server greeting" tests a long expiration time.
+ "after 220 server greeting" tests.
+
+ The optional "after 220 server greeting" tests may result in unexpected
+ delivery delays from senders that retry email delivery from a different
+ IP address. Reason: after passing these tests a new client must dis-
+ connect, and reconnect from the same IP address before it can deliver
+ mail. See <a href="POSTSCREEN_README.html">POSTSCREEN_README</a>, section "Tests after the 220 SMTP server
+ greeting", for a discussion.
<b>CONFIGURATION PARAMETERS</b>
- Changes to <a href="postconf.5.html">main.cf</a> are not picked up automatically, as <a href="postscreen.8.html"><b>postscreen</b>(8)</a>
- processes may run for several hours. Use the command "postfix reload"
+ Changes to <a href="postconf.5.html">main.cf</a> are not picked up automatically, as <a href="postscreen.8.html"><b>postscreen</b>(8)</a>
+ processes may run for several hours. Use the command "postfix reload"
after a configuration change.
- The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
+ The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
more details including examples.
- NOTE: Some <a href="postscreen.8.html"><b>postscreen</b>(8)</a> parameters implement stress-dependent behav-
- ior. This is supported only when the default parameter value is
- stress-dependent (that is, it looks like ${stress?{X}:{Y}}, or it is
- the $<i>name</i> of an smtpd parameter with a stress-dependent default).
- Other parameters always evaluate as if the <b>stress</b> parameter value is
+ NOTE: Some <a href="postscreen.8.html"><b>postscreen</b>(8)</a> parameters implement stress-dependent behav-
+ ior. This is supported only when the default parameter value is
+ stress-dependent (that is, it looks like ${stress?{X}:{Y}}, or it is
+ the $<i>name</i> of an smtpd parameter with a stress-dependent default).
+ Other parameters always evaluate as if the <b>stress</b> parameter value is
the empty string.
<b>COMPATIBILITY CONTROLS</b>
@@ -111,14 +107,14 @@ POSTSCREEN(8) POSTSCREEN(8)
<b><a href="postconf.5.html#postscreen_discard_ehlo_keyword_address_maps">postscreen_discard_ehlo_keyword_address_maps</a> ($<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_key</a>-</b>
<b><a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">word_address_maps</a>)</b>
- Lookup tables, indexed by the remote SMTP client address, with
- case insensitive lists of EHLO keywords (pipelining, starttls,
- auth, etc.) that the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server will not send in the
+ Lookup tables, indexed by the remote SMTP client address, with
+ case insensitive lists of EHLO keywords (pipelining, starttls,
+ auth, etc.) that the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server will not send in the
EHLO response to a remote SMTP client.
<b><a href="postconf.5.html#postscreen_discard_ehlo_keywords">postscreen_discard_ehlo_keywords</a> ($<a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>)</b>
- A case insensitive list of EHLO keywords (pipelining, starttls,
- auth, etc.) that the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server will not send in the
+ A case insensitive list of EHLO keywords (pipelining, starttls,
+ auth, etc.) that the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server will not send in the
EHLO response to a remote SMTP client.
Available in Postfix version 3.1 and later:
@@ -126,6 +122,12 @@ POSTSCREEN(8) POSTSCREEN(8)
<b><a href="postconf.5.html#dns_ncache_ttl_fix_enable">dns_ncache_ttl_fix_enable</a> (no)</b>
Enable a workaround for future libc incompatibility.
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#postscreen_reject_footer_maps">postscreen_reject_footer_maps</a> ($<a href="postconf.5.html#smtpd_reject_footer_maps">smtpd_reject_footer_maps</a>)</b>
+ Optional lookup table for information that is appended after a
+ 4XX or 5XX <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server response.
+
<b>TROUBLE SHOOTING CONTROLS</b>
<b><a href="postconf.5.html#postscreen_expansion_filter">postscreen_expansion_filter</a> (see 'postconf -d' output)</b>
List of characters that are permitted in
@@ -399,14 +401,25 @@ POSTSCREEN(8) POSTSCREEN(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
<b>SEE ALSO</b>
<a href="smtpd.8.html">smtpd(8)</a>, Postfix SMTP server
<a href="tlsproxy.8.html">tlsproxy(8)</a>, Postfix TLS proxy server
<a href="dnsblog.8.html">dnsblog(8)</a>, DNS black/whitelist logger
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/postsuper.1.html b/external/ibm-public/postfix/dist/html/postsuper.1.html
index 13d77850054..66078977264 100644
--- a/external/ibm-public/postfix/dist/html/postsuper.1.html
+++ b/external/ibm-public/postfix/dist/html/postsuper.1.html
@@ -10,7 +10,9 @@ POSTSUPER(1) POSTSUPER(1)
postsuper - Postfix superintendent
<b>SYNOPSIS</b>
- <b>postsuper</b> [<b>-psSv</b>] [<b>-c</b> <i>config</i><b>_</b><i>dir</i>] [<b>-d</b> <i>queue</i><b>_</b><i>id</i>]
+ <b>postsuper</b> [<b>-psSv</b>]
+ [<b>-c</b> <i>config</i><b>_</b><i>dir</i>] [<b>-d</b> <i>queue</i><b>_</b><i>id</i>]
+ [<b>-e</b> <i>queue</i><b>_</b><i>id</i>] [<b>-f</b> <i>queue</i><b>_</b><i>id</i>]
[<b>-h</b> <i>queue</i><b>_</b><i>id</i>] [<b>-H</b> <i>queue</i><b>_</b><i>id</i>]
[<b>-r</b> <i>queue</i><b>_</b><i>id</i>] [<i>directory ...</i>]
@@ -22,8 +24,9 @@ POSTSUPER(1) POSTSUPER(1)
By default, <a href="postsuper.1.html"><b>postsuper</b>(1)</a> performs the operations requested with the <b>-s</b>
and <b>-p</b> command-line options on all Postfix queue directories - this
- includes the <b>incoming</b>, <b>active</b> and <b>deferred</b> directories with mail files
- and the <b>bounce</b>, <b>defer</b>, <b>trace</b> and <b>flush</b> directories with log files.
+ includes the <b>incoming</b>, <b>active</b>, <b>deferred</b>, and <b>hold</b> directories with mes-
+ sage files and the <b>bounce</b>, <b>defer</b>, <b>trace</b> and <b>flush</b> directories with log
+ files.
Options:
@@ -33,18 +36,19 @@ POSTSUPER(1) POSTSUPER(1)
environment setting below.
<b>-d</b> <i>queue</i><b>_</b><i>id</i>
- Delete one message with the named queue ID from the named mail
+ Delete one message with the named queue ID from the named mail
queue(s) (default: <b>hold</b>, <b>incoming</b>, <b>active</b> and <b>deferred</b>).
- If a <i>queue</i><b>_</b><i>id</i> of <b>-</b> is specified, the program reads queue IDs
- from standard input. For example, to delete all mail with
- exactly one recipient <b>user@example.com</b>:
+ To delete multiple files, specify the <b>-d</b> option multiple times,
+ or specify a <i>queue</i><b>_</b><i>id</i> of <b>-</b> to read queue IDs from standard
+ input. For example, to delete all mail with exactly one recipi-
+ ent <b>user@example.com</b>:
- mailq | tail +2 | grep -v '^ *(' | awk 'BEGIN { RS = "" }
+ mailq | tail -n +2 | grep -v '^ *(' | awk 'BEGIN { RS = "" }
# $7=sender, $8=recipient1, $9=recipient2
{ if ($8 == "user@example.com" &amp;&amp; $9 == "")
print $1 }
- ' | tr -d '*!' | postsuper -d -
+ ' | tr -d '*!' | postsuper -d -
Specify "<b>-d ALL</b>" to remove all messages; for example, specify
"<b>-d ALL deferred</b>" to delete all mail in the <b>deferred</b> queue. As
@@ -73,14 +77,47 @@ POSTSUPER(1) POSTSUPER(1)
3) <a href="postsuper.1.html"><b>postsuper</b>(1)</a> deletes the new message, instead of the old
message that it should have deleted.
+ <b>-e</b> <i>queue</i><b>_</b><i>id</i>
+
+ <b>-f</b> <i>queue</i><b>_</b><i>id</i>
+ Request forced expiration for one message with the named queue
+ ID in the named mail queue(s) (default: <b>hold</b>, <b>incoming</b>, <b>active</b>
+ and <b>deferred</b>).
+
+ <b>o</b> The message will be returned to the sender when the queue
+ manager attempts to deliver that message (note that Post-
+ fix will never deliver messages in the <b>hold</b> queue).
+
+ <b>o</b> The <b>-e</b> and <b>-f</b> options both request forced expiration. The
+ difference is that <b>-f</b> will also release a message if it
+ is in the <b>hold</b> queue. With <b>-e</b>, such a message would not
+ be returned to the sender until it is released with <b>-f</b> or
+ <b>-H</b>.
+
+ <b>o</b> When a deferred message is force-expired, the return mes-
+ sage will state the reason for the delay. Otherwise, the
+ reason will be "message is administratively expired".
+
+ To expire multiple files, specify the <b>-e</b> or <b>-f</b> option multiple
+ times, or specify a <i>queue</i><b>_</b><i>id</i> of <b>-</b> to read queue IDs from stan-
+ dard input (see the <b>-d</b> option above for an example, but be sure
+ to replace <b>-d</b> in the example).
+
+ Specify "<b>-e ALL</b>" or "<b>-f ALL</b>" to expire all messages; for exam-
+ ple, specify "<b>-e ALL deferred</b>" to expire all mail in the
+ <b>deferred</b> queue. As a safety measure, the word <b>ALL</b> must be spec-
+ ified in upper case.
+
+ These features are available in Postfix 3.5 and later.
+
<b>-h</b> <i>queue</i><b>_</b><i>id</i>
Put mail "on hold" so that no attempt is made to deliver it.
Move one message with the named queue ID from the named mail
queue(s) (default: <b>incoming</b>, <b>active</b> and <b>deferred</b>) to the <b>hold</b>
queue.
- If a <i>queue</i><b>_</b><i>id</i> of <b>-</b> is specified, the program reads queue IDs
- from standard input.
+ To hold multiple files, specify the <b>-h</b> option multiple times, or
+ specify a <i>queue</i><b>_</b><i>id</i> of <b>-</b> to read queue IDs from standard input.
Specify "<b>-h ALL</b>" to hold all messages; for example, specify "<b>-h</b>
<b>ALL deferred</b>" to hold all mail in the <b>deferred</b> queue. As a
@@ -98,65 +135,67 @@ POSTSUPER(1) POSTSUPER(1)
named queue ID from the named mail queue(s) (default: <b>hold</b>) to
the <b>deferred</b> queue.
- If a <i>queue</i><b>_</b><i>id</i> of <b>-</b> is specified, the program reads queue IDs
- from standard input.
+ To release multiple files, specify the <b>-H</b> option multiple times,
+ or specify a <i>queue</i><b>_</b><i>id</i> of <b>-</b> to read queue IDs from standard
+ input.
- Note: specify "<b>postsuper -r</b>" to release mail that was kept on
- hold for a significant fraction of <b>$<a href="postconf.5.html#maximal_queue_lifetime">maximal_queue_lifetime</a></b> or
+ Note: specify "<b>postsuper -r</b>" to release mail that was kept on
+ hold for a significant fraction of <b>$<a href="postconf.5.html#maximal_queue_lifetime">maximal_queue_lifetime</a></b> or
<b>$<a href="postconf.5.html#bounce_queue_lifetime">bounce_queue_lifetime</a></b>, or longer.
- Specify "<b>-H ALL</b>" to release all mail that is "on hold". As a
+ Specify "<b>-H ALL</b>" to release all mail that is "on hold". As a
safety measure, the word <b>ALL</b> must be specified in upper case.
This feature is available in Postfix 2.0 and later.
- <b>-p</b> Purge old temporary files that are left over after system or
- software crashes.
+ <b>-p</b> Purge old temporary files that are left over after system or
+ software crashes. The <b>-p</b>, <b>-s</b>, and <b>-S</b> operations are done before
+ other operations.
<b>-r</b> <i>queue</i><b>_</b><i>id</i>
Requeue the message with the named queue ID from the named mail
- queue(s) (default: <b>hold</b>, <b>incoming</b>, <b>active</b> and <b>deferred</b>). To
- requeue multiple messages, specify multiple <b>-r</b> command-line
- options.
+ queue(s) (default: <b>hold</b>, <b>incoming</b>, <b>active</b> and <b>deferred</b>).
- Alternatively, if a <i>queue</i><b>_</b><i>id</i> of <b>-</b> is specified, the program
- reads queue IDs from standard input.
+ To requeue multiple files, specify the <b>-r</b> option multiple times,
+ or specify a <i>queue</i><b>_</b><i>id</i> of <b>-</b> to read queue IDs from standard
+ input.
- Specify "<b>-r ALL</b>" to requeue all messages. As a safety measure,
+ Specify "<b>-r ALL</b>" to requeue all messages. As a safety measure,
the word <b>ALL</b> must be specified in upper case.
A requeued message is moved to the <b>maildrop</b> queue, from where it
is copied by the <a href="pickup.8.html"><b>pickup</b>(8)</a> and <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemons to a new queue
- file. In many respects its handling differs from that of a new
+ file. In many respects its handling differs from that of a new
local submission.
- <b>o</b> The message is not subjected to the <a href="postconf.5.html#smtpd_milters">smtpd_milters</a> or
+ <b>o</b> The message is not subjected to the <a href="postconf.5.html#smtpd_milters">smtpd_milters</a> or
<a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a> settings. When mail has passed through
- an external content filter, this would produce incorrect
- results with Milter applications that depend on original
+ an external content filter, this would produce incorrect
+ results with Milter applications that depend on original
SMTP connection state information.
- <b>o</b> The message is subjected again to mail address rewriting
+ <b>o</b> The message is subjected again to mail address rewriting
and substitution. This is useful when rewriting rules or
virtual mappings have changed.
- The address rewriting context (local or remote) is the
+ The address rewriting context (local or remote) is the
same as when the message was received.
- <b>o</b> The message is subjected to the same <a href="postconf.5.html#content_filter">content_filter</a> set-
- tings (if any) as used for new local mail submissions.
+ <b>o</b> The message is subjected to the same <a href="postconf.5.html#content_filter">content_filter</a> set-
+ tings (if any) as used for new local mail submissions.
This is useful when <a href="postconf.5.html#content_filter">content_filter</a> settings have changed.
- Warning: Postfix queue IDs are reused (always with Postfix &lt;=
- 2.8; and with Postfix &gt;= 2.9 when <a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>=no).
+ Warning: Postfix queue IDs are reused (always with Postfix &lt;=
+ 2.8; and with Postfix &gt;= 2.9 when <a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>=no).
There is a very small possibility that <a href="postsuper.1.html"><b>postsuper</b>(1)</a> requeues the
- wrong message file when it is executed while the Postfix mail
+ wrong message file when it is executed while the Postfix mail
system is running, but no harm should be done.
This feature is available in Postfix 1.1 and later.
- <b>-s</b> Structure check and structure repair. This should be done once
- before Postfix startup.
+ <b>-s</b> Structure check and structure repair. This should be done once
+ before Postfix startup. The <b>-p</b>, <b>-s</b>, and <b>-S</b> operations are done
+ before other operations.
<b>o</b> Rename files whose name does not match the message file
inode number. This operation is necessary after restoring
@@ -183,18 +222,22 @@ POSTSUPER(1) POSTSUPER(1)
<b>-S</b> A redundant version of <b>-s</b> that requires that long file names
also match the message file inode number. This option exists for
- testing purposes, and is available with Postfix 2.9 and later.
+ testing purposes, and is available with Postfix 2.9 and later.
+ The <b>-p</b>, <b>-s</b>, and <b>-S</b> operations are done before other operations.
<b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b>
options make the software increasingly verbose.
<b>DIAGNOSTICS</b>
- Problems are reported to the standard error stream and to <b>syslogd</b>(8).
+ Problems are reported to the standard error stream and to <b>syslogd</b>(8) or
+ <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<a href="postsuper.1.html"><b>postsuper</b>(1)</a> reports the number of messages deleted with <b>-d</b>, the number
- of messages requeued with <b>-r</b>, and the number of messages whose queue
- file name was fixed with <b>-s</b>. The report is written to the standard
- error stream and to <b>syslogd</b>(8).
+ of messages expired with <b>-e</b>, the number of messages expired or released
+ with <b>-f</b>, the number of messages held or released with <b>-h</b> or <b>-H</b>, the
+ number of messages requeued with <b>-r</b>, and the number of messages whose
+ queue file name was fixed with <b>-s</b>. The report is written to the stan-
+ dard error stream and to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>ENVIRONMENT</b>
MAIL_CONFIG
@@ -205,22 +248,27 @@ POSTSUPER(1) POSTSUPER(1)
cannot be placed "on hold".
<b>CONFIGURATION PARAMETERS</b>
- The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
- gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a>
+ The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
+ gram. The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a>
<a href="postconf.5.html"><b>conf</b>(5)</a> for more details including examples.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> (1)</b>
- The number of subdirectory levels for queue directories listed
+ The number of subdirectory levels for queue directories listed
with the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> parameter.
<b><a href="postconf.5.html#hash_queue_names">hash_queue_names</a> (deferred, defer)</b>
- The names of queue directories that are split across multiple
+ The names of queue directories that are split across multiple
subdirectory levels.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
The location of the Postfix top-level queue directory.
@@ -228,9 +276,8 @@ POSTSUPER(1) POSTSUPER(1)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 2.9 and later:
@@ -240,6 +287,8 @@ POSTSUPER(1) POSTSUPER(1)
<b>SEE ALSO</b>
<a href="sendmail.1.html">sendmail(1)</a>, Sendmail-compatible user interface
<a href="postqueue.1.html">postqueue(1)</a>, unprivileged queue operations
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
+ syslogd(8), system logging
<b>LICENSE</b>
The Secure Mailer license must be distributed with this software.
diff --git a/external/ibm-public/postfix/dist/html/posttls-finger.1.html b/external/ibm-public/postfix/dist/html/posttls-finger.1.html
index 1d99eabc1a5..4a47a4818b8 100644
--- a/external/ibm-public/postfix/dist/html/posttls-finger.1.html
+++ b/external/ibm-public/postfix/dist/html/posttls-finger.1.html
@@ -4,7 +4,7 @@
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<title> Postfix manual - posttls-finger(1) </title>
</head> <body> <pre>
-POSTTLS-FINGER(1) General Commands Manual POSTTLS-FINGER(1)
+POSTTLS-FINGER(1) POSTTLS-FINGER(1)
<b>NAME</b>
posttls-finger - Probe the TLS properties of an ESMTP or LMTP server.
@@ -127,6 +127,17 @@ POSTTLS-FINGER(1) General Commands Manual POSTTLS-FINGER(1)
The hostname lookup methods used for the connection. See the
documentation of <a href="postconf.5.html#smtp_host_lookup">smtp_host_lookup</a> for syntax and semantics.
+ <b>-H</b> <i>chainfiles</i> (default: <i>none</i>)
+ List of files with a sequence PEM-encoded TLS client certificate
+ chains. The list can be built-up incrementally, by specifying
+ the option multiple times, or all at once via a comma or white-
+ space separated list of filenames. Each chain starts with a
+ private key, which is followed immediately by the corresponding
+ certificate, and optionally by additional issuer certificates.
+ Each new key begins a new chain for the corresponding algorithm.
+ This option is mutually exclusive with the below <b>-k</b> and <b>-K</b>
+ options.
+
<b>-k</b> <i>certfile</i> (default: <i>keyfile</i>)
File with PEM-encoded TLS client certificate chain. This
defaults to <i>keyfile</i> if one is specified.
@@ -259,6 +270,13 @@ POSTTLS-FINGER(1) General Commands Manual POSTTLS-FINGER(1)
the <b>-m</b> option. By default reconnection is disabled, specify a
positive delay to enable this behavior.
+ <b>-s</b> <i>servername</i>
+ The server name to send with the TLS Server Name Indication
+ (SNI) extension. When the server has DANE TLSA records, this
+ parameter is ignored and the TLSA base domain is used instead.
+ Otherwise, SNI is not used by default, but can be enabled by
+ specifying the desired value with this option.
+
<b>-S</b> Disable SMTP; that is, connect to an LMTP server. The default
port for LMTP over TCP is 24. Alternative ports can specified
by appending "<i>:servicename</i>" or ":<i>portnumber</i>" to the destination
@@ -269,17 +287,20 @@ POSTTLS-FINGER(1) General Commands Manual POSTTLS-FINGER(1)
reading the remote server's 220 banner.
<b>-T</b> <i>timeout</i> (default: <b>30</b>)
- The SMTP/LMTP command timeout for EHLO/LHLO, STARTTLS and QUIT.
+ The SMTP/LMTP command timeout for EHLO/LHLO, STARTTLS and QUIT.
- <b>-v</b> Enable verbose Postfix logging. Specify more than once to
+ <b>-v</b> Enable verbose Postfix logging. Specify more than once to
increase the level of verbose logging.
- <b>-w</b> Enable outgoing TLS wrapper mode, or SMTPS support. This is
- typically provided on port 465 by servers that are compatible
- with the ad-hoc SMTP in SSL protocol, rather than the standard
+ <b>-w</b> Enable outgoing TLS wrapper mode, or SMTPS support. This is
+ typically provided on port 465 by servers that are compatible
+ with the ad-hoc SMTP in SSL protocol, rather than the standard
STARTTLS protocol. The destination <i>domain</i>:<i>port</i> should of course
provide such a service.
+ <b>-X</b> Enable <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> mode. This is an unsupported mode, for pro-
+ gram development only.
+
[<b>inet:</b>]<i>domain</i>[:<i>port</i>]
Connect via TCP to domain <i>domain</i>, port <i>port</i>. The default port is
<b>smtp</b> (or 24 with LMTP). With SMTP an MX lookup is performed to
@@ -329,6 +350,11 @@ POSTTLS-FINGER(1) General Commands Manual POSTTLS-FINGER(1)
P.O. Box 704
Yorktown Heights, NY 10598, USA
+ Wietse Venema
+ Google, Inc.
+ 111 8th Avenue
+ New York, NY 10011, USA
+
Viktor Dukhovni
POSTTLS-FINGER(1)
diff --git a/external/ibm-public/postfix/dist/html/proxymap.8.html b/external/ibm-public/postfix/dist/html/proxymap.8.html
index 488a60550b3..649d399f5f2 100644
--- a/external/ibm-public/postfix/dist/html/proxymap.8.html
+++ b/external/ibm-public/postfix/dist/html/proxymap.8.html
@@ -123,7 +123,7 @@ PROXYMAP(8) PROXYMAP(8)
its content.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
The <a href="proxymap.8.html"><b>proxymap</b>(8)</a> server provides service to multiple clients, and must
@@ -189,6 +189,11 @@ PROXYMAP(8) PROXYMAP(8)
The lookup tables that the <a href="proxymap.8.html"><b>proxymap</b>(8)</a> server is allowed to
access for the read-write service.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>SEE ALSO</b>
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
diff --git a/external/ibm-public/postfix/dist/html/qmgr.8.html b/external/ibm-public/postfix/dist/html/qmgr.8.html
index a919a173ddf..f30a5b8de58 100644
--- a/external/ibm-public/postfix/dist/html/qmgr.8.html
+++ b/external/ibm-public/postfix/dist/html/qmgr.8.html
@@ -149,10 +149,11 @@ QMGR(8) QMGR(8)
environment.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to the syslog daemon. Corrupted
- message files are saved to the <b>corrupt</b> queue for further inspection.
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
+ Corrupted message files are saved to the <b>corrupt</b> queue for further
+ inspection.
- Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
+ Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces and of other trouble.
<b>BUGS</b>
@@ -165,7 +166,7 @@ QMGR(8) QMGR(8)
sistent process. Use the "<b>postfix reload</b>" command after a configuration
change.
- The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
+ The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
more details including examples.
In the text below, <i>transport</i> is the first field in a <a href="master.5.html"><b>master.cf</b></a> entry.
@@ -174,26 +175,26 @@ QMGR(8) QMGR(8)
Available before Postfix version 2.5:
<b><a href="postconf.5.html#allow_min_user">allow_min_user</a> (no)</b>
- Allow a sender or recipient address to have `-' as the first
+ Allow a sender or recipient address to have `-' as the first
character.
Available with Postfix version 2.7 and later:
<b><a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> (empty)</b>
- When a <a href="postconf.5.html#content_filter">content_filter</a> or FILTER request specifies no explicit
- next-hop destination, use $<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> instead; when
+ When a <a href="postconf.5.html#content_filter">content_filter</a> or FILTER request specifies no explicit
+ next-hop destination, use $<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> instead; when
that value is empty, use the domain in the recipient address.
<b>ACTIVE QUEUE CONTROLS</b>
<b><a href="postconf.5.html#qmgr_clog_warn_time">qmgr_clog_warn_time</a> (300s)</b>
- The minimal delay between warnings that a specific destination
+ The minimal delay between warnings that a specific destination
is clogging up the Postfix <a href="QSHAPE_README.html#active_queue">active queue</a>.
<b><a href="postconf.5.html#qmgr_message_active_limit">qmgr_message_active_limit</a> (20000)</b>
The maximal number of messages in the <a href="QSHAPE_README.html#active_queue">active queue</a>.
<b><a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> (20000)</b>
- The maximal number of recipients held in memory by the Postfix
+ The maximal number of recipients held in memory by the Postfix
queue manager, and the maximal size of the short-term, in-memory
"dead" destination status cache.
@@ -204,31 +205,39 @@ QMGR(8) QMGR(8)
The default per-transport upper limit on the number of in-memory
recipients.
- <b><a href="postconf.5.html#transport_recipient_limit"><i>transport</i>_recipient_limit</a> ($<a href="postconf.5.html#default_recipient_limit">default_recipient_limit</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_recipient_limit ($<a href="postconf.5.html#default_recipient_limit">default_recipient_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_recipient_limit">default_recipient_limit</a>
+ parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the
+ message delivery transport.
<b><a href="postconf.5.html#default_extra_recipient_limit">default_extra_recipient_limit</a> (1000)</b>
- The default value for the extra per-transport limit imposed on
+ The default value for the extra per-transport limit imposed on
the number of in-memory recipients.
- <b><a href="postconf.5.html#transport_extra_recipient_limit"><i>transport</i>_extra_recipient_limit</a> ($<a href="postconf.5.html#default_extra_recipient_limit">default_extra_recipient_limit</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_extra_recipient_limit ($<a href="postconf.5.html#default_extra_recipient_limit">default_extra_recipient_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_extra_recipient_limit">default_extra_recipi</a>-
+ <a href="postconf.5.html#default_extra_recipient_limit">ent_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name
+ of the message delivery transport.
Available in Postfix version 2.4 and later:
<b><a href="postconf.5.html#default_recipient_refill_limit">default_recipient_refill_limit</a> (100)</b>
- The default per-transport limit on the number of recipients
+ The default per-transport limit on the number of recipients
refilled at once.
- <b><a href="postconf.5.html#transport_recipient_refill_limit"><i>transport</i>_recipient_refill_limit</a> ($<a href="postconf.5.html#default_recipient_refill_limit">default_recipient_refill_limit</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_recipient_refill_limit ($<a href="postconf.5.html#default_recipient_refill_limit">default_recipient_refill_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_recipient_refill_limit">default_recipi</a>-
+ <a href="postconf.5.html#default_recipient_refill_limit">ent_refill_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">mas-
+ ter.cf</a> name of the message delivery transport.
<b><a href="postconf.5.html#default_recipient_refill_delay">default_recipient_refill_delay</a> (5s)</b>
The default per-transport maximum delay between recipients
refills.
- <b><a href="postconf.5.html#transport_recipient_refill_delay"><i>transport</i>_recipient_refill_delay</a> ($<a href="postconf.5.html#default_recipient_refill_delay">default_recipient_refill_delay</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_recipient_refill_delay ($<a href="postconf.5.html#default_recipient_refill_delay">default_recipient_refill_delay</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_recipient_refill_delay">default_recipi</a>-
+ <a href="postconf.5.html#default_recipient_refill_delay">ent_refill_delay</a> parameter value, where <i>transport</i> is the <a href="master.5.html">mas-
+ ter.cf</a> name of the message delivery transport.
<b>DELIVERY CONCURRENCY CONTROLS</b>
<b><a href="postconf.5.html#initial_destination_concurrency">initial_destination_concurrency</a> (5)</b>
@@ -236,46 +245,55 @@ QMGR(8) QMGR(8)
delivery to the same destination.
<b><a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a> (20)</b>
- The default maximal number of parallel deliveries to the same
+ The default maximal number of parallel deliveries to the same
destination.
- <b><a href="postconf.5.html#transport_destination_concurrency_limit"><i>transport</i>_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
+ <b>transport_destination_concurrency_limit ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the default_destination_con-
+ currency_limit parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
Available in Postfix version 2.5 and later:
- <b><a href="postconf.5.html#transport_initial_destination_concurrency"><i>transport</i>_initial_destination_concurrency</a> ($<a href="postconf.5.html#initial_destination_concurrency">initial_destination_concur</a>-</b>
+ <b>transport_initial_destination_concurrency ($<a href="postconf.5.html#initial_destination_concurrency">initial_destination_concur</a>-</b>
<b><a href="postconf.5.html#initial_destination_concurrency">rency</a>)</b>
- Initial concurrency for delivery via the named message <i>trans-</i>
- <i>port</i>.
+ A transport-specific override for the initial_destination_con-
+ currency parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name
+ of the message delivery transport.
<b><a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_destination_concurrency_failed_cohort_limit</a> (1)</b>
How many pseudo-cohorts must suffer connection or handshake
failure before a specific destination is considered unavailable
(and further delivery is suspended).
- <b><a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_desti</a>-</b>
+ <b>transport_destination_concurrency_failed_cohort_limit ($<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_desti</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">nation_concurrency_failed_cohort_limit</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the <a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_destination_con</a>-
+ <a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">currency_failed_cohort_limit</a> parameter value, where <i>transport</i> is
+ the <a href="master.5.html">master.cf</a> name of the message delivery transport.
<b><a href="postconf.5.html#default_destination_concurrency_negative_feedback">default_destination_concurrency_negative_feedback</a> (1)</b>
The per-destination amount of delivery concurrency negative
feedback, after a delivery completes with a connection or hand-
shake failure.
- <b><a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a> ($<a href="postconf.5.html#default_destination_concurrency_negative_feedback">default_destina</a>-</b>
+ <b>transport_destination_concurrency_negative_feedback ($<a href="postconf.5.html#default_destination_concurrency_negative_feedback">default_destina</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_negative_feedback">tion_concurrency_negative_feedback</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the default_destination_con-
+ currency_negative_feedback parameter value, where <i>transport</i> is
+ the <a href="master.5.html">master.cf</a> name of the message delivery transport.
<b><a href="postconf.5.html#default_destination_concurrency_positive_feedback">default_destination_concurrency_positive_feedback</a> (1)</b>
The per-destination amount of delivery concurrency positive
feedback, after a delivery completes without connection or hand-
shake failure.
- <b><a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_positive_feedback</a> ($<a href="postconf.5.html#default_destination_concurrency_positive_feedback">default_destina</a>-</b>
+ <b>transport_destination_concurrency_positive_feedback ($<a href="postconf.5.html#default_destination_concurrency_positive_feedback">default_destina</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_positive_feedback">tion_concurrency_positive_feedback</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the default_destination_con-
+ currency_positive_feedback parameter value, where <i>transport</i> is
+ the <a href="master.5.html">master.cf</a> name of the message delivery transport.
<b><a href="postconf.5.html#destination_concurrency_feedback_debug">destination_concurrency_feedback_debug</a> (no)</b>
Make the queue manager's feedback algorithm verbose for perfor-
@@ -285,38 +303,48 @@ QMGR(8) QMGR(8)
<b><a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a> (50)</b>
The default maximal number of recipients per message delivery.
- <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b>
+ <b>transport_destination_recipient_limit ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b>
<b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>-
+ <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
<b>MESSAGE SCHEDULING CONTROLS</b>
<b><a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a> (5)</b>
How often the Postfix queue manager's scheduler is allowed to
preempt delivery of one message with another.
- <b><a href="postconf.5.html#transport_delivery_slot_cost"><i>transport</i>_delivery_slot_cost</a> ($<a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_delivery_slot_cost ($<a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a>
+ parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the
+ message delivery transport.
<b><a href="postconf.5.html#default_minimum_delivery_slots">default_minimum_delivery_slots</a> (3)</b>
How many recipients a message must have in order to invoke the
Postfix queue manager's scheduling algorithm at all.
- <b><a href="postconf.5.html#transport_minimum_delivery_slots"><i>transport</i>_minimum_delivery_slots</a> ($<a href="postconf.5.html#default_minimum_delivery_slots">default_minimum_delivery_slots</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_minimum_delivery_slots ($<a href="postconf.5.html#default_minimum_delivery_slots">default_minimum_delivery_slots</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_minimum_delivery_slots">default_minimum_deliv</a>-
+ <a href="postconf.5.html#default_minimum_delivery_slots">ery_slots</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name
+ of the message delivery transport.
<b><a href="postconf.5.html#default_delivery_slot_discount">default_delivery_slot_discount</a> (50)</b>
The default value for transport-specific _delivery_slot_discount
settings.
- <b><a href="postconf.5.html#transport_delivery_slot_discount"><i>transport</i>_delivery_slot_discount</a> ($<a href="postconf.5.html#default_delivery_slot_discount">default_delivery_slot_discount</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_delivery_slot_discount ($<a href="postconf.5.html#default_delivery_slot_discount">default_delivery_slot_discount</a>)</b>
+ A transport-specific override for the default_delivery_slot_dis-
+ count parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
+ the message delivery transport.
<b><a href="postconf.5.html#default_delivery_slot_loan">default_delivery_slot_loan</a> (3)</b>
The default value for transport-specific _delivery_slot_loan
settings.
- <b><a href="postconf.5.html#transport_delivery_slot_loan"><i>transport</i>_delivery_slot_loan</a> ($<a href="postconf.5.html#default_delivery_slot_loan">default_delivery_slot_loan</a>)</b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_delivery_slot_loan ($<a href="postconf.5.html#default_delivery_slot_loan">default_delivery_slot_loan</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_delivery_slot_loan">default_delivery_slot_loan</a>
+ parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the
+ message delivery transport.
<b>OTHER RESOURCE AND RATE CONTROLS</b>
<b><a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a> (300s)</b>
@@ -350,22 +378,26 @@ QMGR(8) QMGR(8)
<b><a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a> (0s)</b>
The default amount of delay that is inserted between individual
- deliveries to the same destination; the resulting behavior
- depends on the value of the corresponding per-destination recip-
- ient limit.
+ message deliveries to the same destination and over the same
+ message delivery transport.
- <b><a href="postconf.5.html#transport_destination_rate_delay"><i>transport</i>_destination_rate_delay</a> $<a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a></b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_destination_rate_delay ($<a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_destination_rate_delay">default_destina</a>-
+ <a href="postconf.5.html#default_destination_rate_delay">tion_rate_delay</a> parameter value, where <i>transport</i> is the <a href="master.5.html">mas-
+ ter.cf</a> name of the message delivery transport.
Available in Postfix version 3.1 and later:
<b><a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a> (0s)</b>
- The default amount of delay that is inserted between individual
- deliveries over the same message delivery transport, regardless
- of destination.
+ The default amount of delay that is inserted between individual
+ message deliveries over the same message delivery transport,
+ regardless of destination.
- <b><a href="postconf.5.html#transport_transport_rate_delay"><i>transport</i>_transport_rate_delay</a> $<a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a></b>
- Idem, for delivery via the named message <i>transport</i>.
+ <b>transport_transport_rate_delay ($<a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_transport_rate_delay">default_trans</a>-
+ <a href="postconf.5.html#default_transport_rate_delay">port_rate_delay</a> parameter value, where the initial <i>transport</i> in
+ the parameter name is the <a href="master.5.html">master.cf</a> name of the message delivery
+ transport.
<b>SAFETY CONTROLS</b>
<b><a href="postconf.5.html#qmgr_daemon_timeout">qmgr_daemon_timeout</a> (1000s)</b>
@@ -412,16 +444,26 @@ QMGR(8) QMGR(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 3.0 and later:
<b><a href="postconf.5.html#confirm_delay_cleared">confirm_delay_cleared</a> (no)</b>
- After sending a "your message is delayed" notification, inform
+ After sending a "your message is delayed" notification, inform
the sender when the delay clears up.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
+
<b>FILES</b>
/var/spool/postfix/incoming, <a href="QSHAPE_README.html#incoming_queue">incoming queue</a>
/var/spool/postfix/active, <a href="QSHAPE_README.html#active_queue">active queue</a>
@@ -436,6 +478,7 @@ QMGR(8) QMGR(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/qmqpd.8.html b/external/ibm-public/postfix/dist/html/qmqpd.8.html
index a781dd57795..4086cec53c1 100644
--- a/external/ibm-public/postfix/dist/html/qmqpd.8.html
+++ b/external/ibm-public/postfix/dist/html/qmqpd.8.html
@@ -27,7 +27,7 @@ QMQPD(8) QMQPD(8)
chrooted at fixed low privilege.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
The QMQP protocol provides only one server reply per message delivery.
@@ -66,6 +66,13 @@ QMQPD(8) QMQPD(8)
Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b>
+ Enable 'transitional' compatibility between IDNA2003 and
+ IDNA2008, when converting UTF-8 domain names to/from the ASCII
+ form that is used for DNS lookups.
+
<b>RESOURCE AND RATE CONTROLS</b>
<b><a href="postconf.5.html#line_length_limit">line_length_limit</a> (2048)</b>
Upon input, long lines are chopped up into pieces of at most
@@ -140,12 +147,11 @@ QMQPD(8) QMQPD(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
<b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b>
- The characters Postfix accepts as VERP delimiter characters on
+ The characters Postfix accepts as VERP delimiter characters on
the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command line and in SMTP commands.
Available in Postfix version 2.5 and later:
@@ -154,10 +160,16 @@ QMQPD(8) QMQPD(8)
Enable logging of the remote QMQP client port in addition to the
hostname and IP address.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>SEE ALSO</b>
<a href="http://cr.yp.to/proto/qmqp.html">http://cr.yp.to/proto/qmqp.html</a>, QMQP protocol
<a href="cleanup.8.html">cleanup(8)</a>, message canonicalization
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/scache.8.html b/external/ibm-public/postfix/dist/html/scache.8.html
index da7b5bc4f46..6b2512678d2 100644
--- a/external/ibm-public/postfix/dist/html/scache.8.html
+++ b/external/ibm-public/postfix/dist/html/scache.8.html
@@ -73,7 +73,7 @@ SCACHE(8) SCACHE(8)
store information that is security sensitive.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
The session cache cannot be shared among multiple machines.
@@ -126,14 +126,19 @@ SCACHE(8) SCACHE(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="smtp.8.html">smtp(8)</a>, SMTP client
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/sendmail.1.html b/external/ibm-public/postfix/dist/html/sendmail.1.html
index a2c3ff72dd6..02f20fe8913 100644
--- a/external/ibm-public/postfix/dist/html/sendmail.1.html
+++ b/external/ibm-public/postfix/dist/html/sendmail.1.html
@@ -117,49 +117,54 @@ SENDMAIL(1) SENDMAIL(1)
directory. This information is ignored with Postfix versions
before 2.3.
- With all Postfix versions, you can specify a directory pathname
- with the MAIL_CONFIG environment variable to override the loca-
+ With Postfix version 3.2 and later, a non-default directory must
+ be authorized in the default <a href="postconf.5.html"><b>main.cf</b></a> file, through the alter-
+ nate_config_directories or <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> parame-
+ ters.
+
+ With all Postfix versions, you can specify a directory pathname
+ with the MAIL_CONFIG environment variable to override the loca-
tion of configuration files.
<b>-F</b> <i>full</i><b>_</b><i>name</i>
- Set the sender full name. This overrides the NAME environment
+ Set the sender full name. This overrides the NAME environment
variable, and is used only with messages that have no <b>From:</b> mes-
sage header.
<b>-f</b> <i>sender</i>
- Set the envelope sender address. This is the address where
+ Set the envelope sender address. This is the address where
delivery problems are sent to. With Postfix versions before 2.1,
- the <b>Errors-To:</b> message header overrides the error return
+ the <b>Errors-To:</b> message header overrides the error return
address.
- <b>-G</b> Gateway (relay) submission, as opposed to initial user submis-
- sion. Either do not rewrite addresses at all, or update incom-
- plete addresses with the domain information specified with
+ <b>-G</b> Gateway (relay) submission, as opposed to initial user submis-
+ sion. Either do not rewrite addresses at all, or update incom-
+ plete addresses with the domain information specified with
<b><a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a></b>.
This option is ignored before Postfix version 2.3.
<b>-h</b> <i>hop</i><b>_</b><i>count</i> (ignored)
- Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter
+ Hop count limit. Use the <b><a href="postconf.5.html#hopcount_limit">hopcount_limit</a></b> configuration parameter
instead.
<b>-I</b> Initialize alias database. See the <b>newaliases</b> command above.
- <b>-i</b> When reading a message from standard input, don't treat a line
+ <b>-i</b> When reading a message from standard input, don't treat a line
with only a <b>.</b> character as the end of input.
<b>-L</b> <i>label</i> (ignored)
- The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter
+ The logging label. Use the <b><a href="postconf.5.html#syslog_name">syslog_name</a></b> configuration parameter
instead.
<b>-m</b> (ignored)
Backwards compatibility.
<b>-N</b> <i>dsn</i> (default: 'delay, failure')
- Delivery status notification control. Specify either a
+ Delivery status notification control. Specify either a
comma-separated list with one or more of <b>failure</b> (send notifica-
- tion when delivery fails), <b>delay</b> (send notification when deliv-
- ery is delayed), or <b>success</b> (send notification when the message
+ tion when delivery fails), <b>delay</b> (send notification when deliv-
+ ery is delayed), or <b>success</b> (send notification when the message
is delivered); or specify <b>never</b> (don't send any notifications at
all).
@@ -169,50 +174,50 @@ SENDMAIL(1) SENDMAIL(1)
Backwards compatibility.
<b>-oA</b><i>alias</i><b>_</b><i>database</i>
- Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>.
+ Non-default alias database. Specify <i>pathname</i> or <i>type</i>:<i>pathname</i>.
See <a href="postalias.1.html"><b>postalias</b>(1)</a> for details.
<b>-O</b> <i>option=value</i> (ignored)
- Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration
+ Set the named <i>option</i> to <i>value</i>. Use the equivalent configuration
parameter in <a href="postconf.5.html"><b>main.cf</b></a> instead.
<b>-o7</b> (ignored)
<b>-o8</b> (ignored)
- To send 8-bit or binary content, use an appropriate MIME encap-
+ To send 8-bit or binary content, use an appropriate MIME encap-
sulation and specify the appropriate <b>-B</b> command-line option.
- <b>-oi</b> When reading a message from standard input, don't treat a line
+ <b>-oi</b> When reading a message from standard input, don't treat a line
with only a <b>.</b> character as the end of input.
<b>-om</b> (ignored)
The sender is never eliminated from alias etc. expansions.
<b>-o</b> <i>x value</i> (ignored)
- Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame-
+ Set option <i>x</i> to <i>value</i>. Use the equivalent configuration parame-
ter in <a href="postconf.5.html"><b>main.cf</b></a> instead.
<b>-r</b> <i>sender</i>
- Set the envelope sender address. This is the address where
+ Set the envelope sender address. This is the address where
delivery problems are sent to. With Postfix versions before 2.1,
- the <b>Errors-To:</b> message header overrides the error return
+ the <b>Errors-To:</b> message header overrides the error return
address.
<b>-R</b> <i>return</i>
- Delivery status notification control. Specify "hdrs" to return
- only the header when a message bounces, "full" to return a full
+ Delivery status notification control. Specify "hdrs" to return
+ only the header when a message bounces, "full" to return a full
copy (the default behavior).
The <b>-R</b> option specifies an upper bound; Postfix will return only
- the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a>
+ the header, when a full copy would exceed the <a href="postconf.5.html#bounce_size_limit">bounce_size_limit</a>
setting.
This option is ignored before Postfix version 2.10.
- <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe-
+ <b>-q</b> Attempt to deliver all queued mail. This is implemented by exe-
cuting the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command.
- Warning: flushing undeliverable mail frequently will result in
+ Warning: flushing undeliverable mail frequently will result in
poor delivery performance of all other mail.
<b>-q</b><i>interval</i> (ignored)
@@ -221,21 +226,21 @@ SENDMAIL(1) SENDMAIL(1)
<b>-qI</b><i>queueid</i>
Schedule immediate delivery of mail with the specified queue ID.
- This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com-
+ This option is implemented by executing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> com-
mand, and is available with Postfix version 2.4 and later.
<b>-qR</b><i>site</i>
- Schedule immediate delivery of all mail that is queued for the
- named <i>site</i>. This option accepts only <i>site</i> names that are eligi-
- ble for the "fast flush" service, and is implemented by execut-
+ Schedule immediate delivery of all mail that is queued for the
+ named <i>site</i>. This option accepts only <i>site</i> names that are eligi-
+ ble for the "fast flush" service, and is implemented by execut-
ing the <a href="postqueue.1.html"><b>postqueue</b>(1)</a> command. See <a href="flush.8.html"><b>flush</b>(8)</a> for more information
about the "fast flush" service.
<b>-qS</b><i>site</i>
- This command is not implemented. Use the slower "<b>sendmail -q</b>"
+ This command is not implemented. Use the slower "<b>sendmail -q</b>"
command instead.
- <b>-t</b> Extract recipients from message headers. These are added to any
+ <b>-t</b> Extract recipients from message headers. These are added to any
recipients specified on the command line.
With Postfix versions prior to 2.1, this option requires that no
@@ -251,23 +256,23 @@ SENDMAIL(1) SENDMAIL(1)
This feature is available in Postfix 2.3 and later.
<b>-XV</b> (Postfix 2.2 and earlier: <b>-V</b>)
- Variable Envelope Return Path. Given an envelope sender address
- of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i>
+ Variable Envelope Return Path. Given an envelope sender address
+ of the form <i>owner-listname</i>@<i>origin</i>, each recipient <i>user</i>@<i>domain</i>
receives mail with a personalized envelope sender address.
- By default, the personalized envelope sender address is
- <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac-
- ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu-
+ By default, the personalized envelope sender address is
+ <i>owner-listname</i><b>+</b><i>user</i><b>=</b><i>domain</i>@<i>origin</i>. The default <b>+</b> and <b>=</b> charac-
+ ters are configurable with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a></b> configu-
ration parameter.
<b>-XV</b><i>xy</i> (Postfix 2.2 and earlier: <b>-V</b><i>xy</i>)
- As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters,
+ As <b>-XV</b>, but uses <i>x</i> and <i>y</i> as the VERP delimiter characters,
instead of the characters specified with the <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delim</a>-</b>
<b><a href="postconf.5.html#default_verp_delimiters">iters</a></b> configuration parameter.
<b>-v</b> Send an email report of the first delivery attempt (Postfix ver-
- sions 2.1 and later). Mail delivery always happens in the back-
- ground. When multiple <b>-v</b> options are given, enable verbose log-
+ sions 2.1 and later). Mail delivery always happens in the back-
+ ground. When multiple <b>-v</b> options are given, enable verbose log-
ging for debugging purposes.
<b>-X</b> <i>log</i><b>_</b><i>file</i> (ignored)
@@ -276,11 +281,12 @@ SENDMAIL(1) SENDMAIL(1)
<b>SECURITY</b>
By design, this program is not set-user (or group) id. However, it must
- handle data from untrusted, possibly remote, users. Thus, the usual
+ handle data from untrusted, possibly remote, users. Thus, the usual
precautions need to be taken against malicious inputs.
<b>DIAGNOSTICS</b>
- Problems are logged to <b>syslogd</b>(8) and to the standard error stream.
+ Problems are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>, and to the standard
+ error stream.
<b>ENVIRONMENT</b>
<b>MAIL_CONFIG</b>
@@ -309,7 +315,7 @@ SENDMAIL(1) SENDMAIL(1)
line endings from &lt;CR&gt;&lt;LF&gt; into UNIX format (&lt;LF&gt;).
<b>TROUBLE SHOOTING CONTROLS</b>
- The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to trouble shoot a Postfix
+ The <a href="DEBUG_README.html">DEBUG_README</a> file gives examples of how to troubleshoot a Postfix
system.
<b><a href="postconf.5.html#debugger_command">debugger_command</a> (empty)</b>
@@ -400,6 +406,11 @@ SENDMAIL(1) SENDMAIL(1)
The time after which the sender receives a copy of the message
headers of mail that is still queued.
+ <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
+ name=value environment overrides.
+
<b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
The UNIX system account that owns the Postfix queue and most
Postfix daemon processes.
@@ -416,9 +427,23 @@ SENDMAIL(1) SENDMAIL(1)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Postfix 3.2 and later:
+
+ <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b>
+ A list of non-default Postfix configuration directories that may
+ be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in
+ the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with the "-C" option), or via the
+ MAIL_CONFIG environment parameter.
+
+ <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b>
+ An optional list of non-default Postfix configuration directo-
+ ries; these directories belong to additional Postfix instances
+ that share the Postfix executable files and documentation with
+ the default Postfix instance, and that are started, stopped,
+ etc., together with the default Postfix instance.
<b>FILES</b>
/var/spool/postfix, mail queue
@@ -434,6 +459,7 @@ SENDMAIL(1) SENDMAIL(1)
<a href="postdrop.1.html">postdrop(1)</a>, mail posting utility
<a href="postfix.1.html">postfix(1)</a>, mail system control
<a href="postqueue.1.html">postqueue(1)</a>, mail queue control
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README_FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/showq.8.html b/external/ibm-public/postfix/dist/html/showq.8.html
index ab9311f5735..e95ce0f32da 100644
--- a/external/ibm-public/postfix/dist/html/showq.8.html
+++ b/external/ibm-public/postfix/dist/html/showq.8.html
@@ -31,7 +31,7 @@ SHOWQ(8) SHOWQ(8)
None. The <a href="showq.8.html"><b>showq</b>(8)</a> daemon does not interact with the outside world.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>CONFIGURATION PARAMETERS</b>
Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically as <a href="showq.8.html"><b>showq</b>(8)</a> processes
@@ -82,15 +82,19 @@ SHOWQ(8) SHOWQ(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 2.9 and later:
<b><a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a> (no)</b>
Enable long, non-repeating, queue IDs (queue file names).
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>FILES</b>
/var/spool/postfix, queue directories
@@ -100,6 +104,7 @@ SHOWQ(8) SHOWQ(8)
<a href="qmgr.8.html">qmgr(8)</a>, queue manager
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/smtp.8.html b/external/ibm-public/postfix/dist/html/smtp.8.html
index e458eefd444..a01589cc196 100644
--- a/external/ibm-public/postfix/dist/html/smtp.8.html
+++ b/external/ibm-public/postfix/dist/html/smtp.8.html
@@ -10,7 +10,7 @@ SMTP(8) SMTP(8)
smtp - Postfix SMTP+LMTP client
<b>SYNOPSIS</b>
- <b>smtp</b> [generic Postfix daemon options]
+ <b>smtp</b> [generic Postfix daemon options] [flags=DORX]
<b>DESCRIPTION</b>
The Postfix SMTP+LMTP client implements the SMTP and LMTP mail delivery
@@ -41,7 +41,9 @@ SMTP(8) SMTP(8)
can be enabled permanently for specific destinations.
<b>SMTP DESTINATION SYNTAX</b>
- SMTP destinations have the following form:
+ The Postfix SMTP+LMTP client supports multiple destinations separated
+ by comma or whitespace (Postfix 3.5 and later). SMTP destinations have
+ the following form:
<i>domainname</i>
@@ -63,7 +65,9 @@ SMTP(8) SMTP(8)
ted as [<b>ipv6</b>:<i>address</i>].
<b>LMTP DESTINATION SYNTAX</b>
- LMTP destinations have the following form:
+ The Postfix SMTP+LMTP client supports multiple destinations separated
+ by comma or whitespace (Postfix 3.5 and later). LMTP destinations have
+ the following form:
<b>unix</b>:<i>pathname</i>
Connect to the local UNIX-domain server that is bound to the
@@ -84,10 +88,57 @@ SMTP(8) SMTP(8)
will be used. An IPv6 address must be formatted as
[<b>ipv6</b>:<i>address</i>].
+<b>SINGLE-RECIPIENT DELIVERY</b>
+ By default, the Postfix SMTP+LMTP client delivers mail to multiple
+ recipients per delivery request. This is undesirable when prepending a
+ <b>Delivered-to:</b> or <b>X-Original-To:</b> message header. To prevent Postfix from
+ sending multiple recipients per delivery request, specify
+
+ <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> = 1</b>
+
+ in the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, where <i>transport</i> is the name in the first
+ column of the Postfix <a href="master.5.html"><b>master.cf</b></a> entry for this mail delivery service.
+
+<b>COMMAND ATTRIBUTE SYNTAX</b>
+ <b>flags=DORX</b> (optional)
+ Optional message processing flags.
+
+ <b>D</b> Prepend a "<b>Delivered-To:</b> <i>recipient</i>" message header with
+ the envelope recipient address. Note: for this to work,
+ the <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a></b> must be 1 (see
+ SINGLE-RECIPIENT DELIVERY above for details).
+
+ The <b>D</b> flag also enforces loop detection: if a message
+ already contains a <b>Delivered-To:</b> header with the same
+ recipient address, then the message is returned as unde-
+ liverable. The address comparison is case insensitive.
+
+ This feature is available as of Postfix 3.5.
+
+ <b>O</b> Prepend an "<b>X-Original-To:</b> <i>recipient</i>" message header with
+ the recipient address as given to Postfix. Note: for this
+ to work, the <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a></b> must
+ be 1 (see SINGLE-RECIPIENT DELIVERY above for details).
+
+ This feature is available as of Postfix 3.5.
+
+ <b>R</b> Prepend a "<b>Return-Path:</b> &lt;<i>sender</i>&gt;" message header with the
+ envelope sender address.
+
+ This feature is available as of Postfix 3.5.
+
+ <b>X</b> Indicates that the delivery is final. This flag affects
+ the status reported in "success" DSN (delivery status
+ notification) messages, and changes it from "relayed"
+ into "delivered".
+
+ This feature is available as of Postfix 3.5.
+
<b>SECURITY</b>
- The SMTP+LMTP client is moderately security-sensitive. It talks to SMTP
- or LMTP servers and to DNS servers on the network. The SMTP+LMTP client
- can be run chrooted at fixed low privilege.
+ The SMTP+LMTP client is moderately security-sensitive. It
+ talks to SMTP or LMTP servers and to DNS servers on the
+ network. The SMTP+LMTP client can be run chrooted at fixed
+ low privilege.
<b>STANDARDS</b>
<a href="http://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol)
@@ -112,37 +163,35 @@ SMTP(8) SMTP(8)
<a href="http://tools.ietf.org/html/rfc7672">RFC 7672</a> (SMTP security via opportunistic DANE TLS)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8). Corrupted message
- files are marked so that the queue manager can move them to the <b>corrupt</b>
- queue for further inspection.
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
+ Corrupted message files are marked so that the queue manager can move
+ them to the <b>corrupt</b> queue for further inspection.
- Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
+ Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces, protocol problems, and of other trouble.
<b>BUGS</b>
- SMTP and LMTP connection caching does not work with TLS. The necessary
- support for TLS object passivation and re-activation does not exist
- without closing the session, which defeats the purpose.
+ SMTP and LMTP connection reuse for TLS (without closing the SMTP or
+ LMTP connection) is not supported before Postfix 3.4.
- SMTP and LMTP connection caching assumes that SASL credentials are
- valid for all destinations that map onto the same IP address and TCP
- port.
+ SMTP and LMTP connection reuse assumes that SASL credentials are valid
+ for all destinations that map onto the same IP address and TCP port.
<b>CONFIGURATION PARAMETERS</b>
- Before Postfix version 2.3, the LMTP client is a separate program that
- implements only a subset of the functionality available with SMTP:
- there is no support for TLS, and connections are cached in-process,
+ Before Postfix version 2.3, the LMTP client is a separate program that
+ implements only a subset of the functionality available with SMTP:
+ there is no support for TLS, and connections are cached in-process,
making it ineffective when the client is used for multiple domains.
Most smtp_<i>xxx</i> configuration parameters have an lmtp_<i>xxx</i> "mirror" param-
- eter for the equivalent LMTP feature. This document describes only
+ eter for the equivalent LMTP feature. This document describes only
those LMTP-related parameters that aren't simply "mirror" parameters.
- Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="smtp.8.html"><b>smtp</b>(8)</a> processes
+ Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="smtp.8.html"><b>smtp</b>(8)</a> processes
run for only a limited amount of time. Use the command "<b>postfix reload</b>"
to speed up a change.
- The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
+ The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
more details including examples.
<b>COMPATIBILITY CONTROLS</b>
@@ -163,8 +212,8 @@ SMTP(8) SMTP(8)
will send via SMTP.
<b><a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a> (10s)</b>
- How long the Postfix SMTP client pauses before sending
- ".&lt;CR&gt;&lt;LF&gt;" in order to work around the PIX firewall
+ How long the Postfix SMTP client pauses before sending
+ ".&lt;CR&gt;&lt;LF&gt;" in order to work around the PIX firewall
"&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;" bug.
<b><a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a> (500s)</b>
@@ -173,19 +222,19 @@ SMTP(8) SMTP(8)
delivery through firewalls with "smtp fixup" mode turned on.
<b><a href="postconf.5.html#smtp_pix_workarounds">smtp_pix_workarounds</a> (disable_esmtp, delay_dotcrlf)</b>
- A list that specifies zero or more workarounds for CISCO PIX
+ A list that specifies zero or more workarounds for CISCO PIX
firewall bugs.
<b><a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a> (empty)</b>
- Lookup tables, indexed by the remote SMTP server address, with
+ Lookup tables, indexed by the remote SMTP server address, with
per-destination workarounds for CISCO PIX firewall bugs.
<b><a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a> (yes)</b>
- Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO
+ Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO
commands as required by <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a>.
<b><a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> (empty)</b>
- A mechanism to transform replies from remote SMTP servers one
+ A mechanism to transform replies from remote SMTP servers one
line at a time.
<b><a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a> (yes)</b>
@@ -197,68 +246,68 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.0 and earlier:
<b><a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> (yes)</b>
- Skip SMTP servers that greet with a 4XX status code (go away,
+ Skip SMTP servers that greet with a 4XX status code (go away,
try again later).
Available in Postfix version 2.2 and later:
<b><a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a> (empty)</b>
- Lookup tables, indexed by the remote SMTP server address, with
- case insensitive lists of EHLO keywords (pipelining, starttls,
+ Lookup tables, indexed by the remote SMTP server address, with
+ case insensitive lists of EHLO keywords (pipelining, starttls,
auth, etc.) that the Postfix SMTP client will ignore in the EHLO
response from a remote SMTP server.
<b><a href="postconf.5.html#smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a> (empty)</b>
- A case insensitive list of EHLO keywords (pipelining, starttls,
+ A case insensitive list of EHLO keywords (pipelining, starttls,
auth, etc.) that the Postfix SMTP client will ignore in the EHLO
response from a remote SMTP server.
<b><a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a> (empty)</b>
- Optional lookup tables that perform address rewriting in the
- Postfix SMTP client, typically to transform a locally valid
- address into a globally valid address when sending mail across
+ Optional lookup tables that perform address rewriting in the
+ Postfix SMTP client, typically to transform a locally valid
+ address into a globally valid address when sending mail across
the Internet.
Available in Postfix version 2.2.9 and later:
<b><a href="postconf.5.html#smtp_cname_overrides_servername">smtp_cname_overrides_servername</a> (version dependent)</b>
- When the remote SMTP servername is a DNS CNAME, replace the
- servername with the result from CNAME expansion for the purpose
- of logging, SASL password lookup, TLS policy decisions, or TLS
+ When the remote SMTP servername is a DNS CNAME, replace the
+ servername with the result from CNAME expansion for the purpose
+ of logging, SASL password lookup, TLS policy decisions, or TLS
certificate verification.
Available in Postfix version 2.3 and later:
<b><a href="postconf.5.html#lmtp_discard_lhlo_keyword_address_maps">lmtp_discard_lhlo_keyword_address_maps</a> (empty)</b>
- Lookup tables, indexed by the remote LMTP server address, with
- case insensitive lists of LHLO keywords (pipelining, starttls,
+ Lookup tables, indexed by the remote LMTP server address, with
+ case insensitive lists of LHLO keywords (pipelining, starttls,
auth, etc.) that the Postfix LMTP client will ignore in the LHLO
response from a remote LMTP server.
<b><a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> (empty)</b>
- A case insensitive list of LHLO keywords (pipelining, starttls,
+ A case insensitive list of LHLO keywords (pipelining, starttls,
auth, etc.) that the Postfix LMTP client will ignore in the LHLO
response from a remote LMTP server.
Available in Postfix version 2.4.4 and later:
<b><a href="postconf.5.html#send_cyrus_sasl_authzid">send_cyrus_sasl_authzid</a> (no)</b>
- When authenticating to a remote SMTP or LMTP server with the
- default setting "no", send no SASL authoriZation ID (authzid);
- send only the SASL authentiCation ID (authcid) plus the auth-
+ When authenticating to a remote SMTP or LMTP server with the
+ default setting "no", send no SASL authoriZation ID (authzid);
+ send only the SASL authentiCation ID (authcid) plus the auth-
cid's password.
Available in Postfix version 2.5 and later:
<b><a href="postconf.5.html#smtp_header_checks">smtp_header_checks</a> (empty)</b>
- Restricted <a href="header_checks.5.html"><b>header_checks</b>(5)</a> tables for the Postfix SMTP client.
+ Restricted <a href="header_checks.5.html"><b>header_checks</b>(5)</a> tables for the Postfix SMTP client.
<b><a href="postconf.5.html#smtp_mime_header_checks">smtp_mime_header_checks</a> (empty)</b>
- Restricted <b><a href="postconf.5.html#mime_header_checks">mime_header_checks</a></b>(5) tables for the Postfix SMTP
+ Restricted <b><a href="postconf.5.html#mime_header_checks">mime_header_checks</a></b>(5) tables for the Postfix SMTP
client.
<b><a href="postconf.5.html#smtp_nested_header_checks">smtp_nested_header_checks</a> (empty)</b>
- Restricted <b><a href="postconf.5.html#nested_header_checks">nested_header_checks</a></b>(5) tables for the Postfix SMTP
+ Restricted <b><a href="postconf.5.html#nested_header_checks">nested_header_checks</a></b>(5) tables for the Postfix SMTP
client.
<b><a href="postconf.5.html#smtp_body_checks">smtp_body_checks</a> (empty)</b>
@@ -267,7 +316,7 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.6 and later:
<b><a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> (0)</b>
- An optional workaround for routers that break TCP window scal-
+ An optional workaround for routers that break TCP window scal-
ing.
Available in Postfix version 2.8 and later:
@@ -278,14 +327,14 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.9 and later:
<b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b>
- Change the behavior of the smtp_*_timeout time limits, from a
- time limit per read or write system call, to a time limit to
- send or receive a complete record (an SMTP command line, SMTP
- response line, SMTP message content line, or TLS protocol mes-
+ Change the behavior of the smtp_*_timeout time limits, from a
+ time limit per read or write system call, to a time limit to
+ send or receive a complete record (an SMTP command line, SMTP
+ response line, SMTP message content line, or TLS protocol mes-
sage).
<b><a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a> (no)</b>
- Whether or not to append the "AUTH=&lt;&gt;" option to the MAIL FROM
+ Whether or not to append the "AUTH=&lt;&gt;" option to the MAIL FROM
command in SASL-authenticated SMTP sessions.
Available in Postfix version 2.11 and later:
@@ -296,13 +345,26 @@ SMTP(8) SMTP(8)
Available in Postfix version 3.0 and later:
<b><a href="postconf.5.html#smtp_delivery_status_filter">smtp_delivery_status_filter</a> ($<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b>
- Optional filter for the <a href="smtp.8.html"><b>smtp</b>(8)</a> delivery agent to change the
+ Optional filter for the <a href="smtp.8.html"><b>smtp</b>(8)</a> delivery agent to change the
delivery status code or explanatory text of successful or unsuc-
cessful deliveries.
<b><a href="postconf.5.html#smtp_dns_reply_filter">smtp_dns_reply_filter</a> (empty)</b>
Optional filter for Postfix SMTP client DNS lookup results.
+ Available in Postfix version 3.3 and later:
+
+ <b><a href="postconf.5.html#smtp_balance_inet_protocols">smtp_balance_inet_protocols</a> (yes)</b>
+ When a remote destination resolves to a combination of IPv4 and
+ IPv6 addresses, ensure that the Postfix SMTP client can try both
+ address types before it runs into the <a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a>.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
+
<b>MIME PROCESSING CONTROLS</b>
Available in Postfix version 2.0 and later:
@@ -540,19 +602,25 @@ SMTP(8) SMTP(8)
<b><a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> (see 'postconf -d' output)</b>
List or bit-mask of OpenSSL bug work-arounds to disable.
+ Available in Postfix version 2.11-3.1:
+
+ <b><a href="postconf.5.html#tls_dane_digest_agility">tls_dane_digest_agility</a> (on)</b>
+ Configure <a href="http://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility.
+
+ <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b>
+ Enable support for <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain
+ digests of trust-anchors with certificate usage "2".
+
Available in Postfix version 2.11 and later:
<b><a href="postconf.5.html#smtp_tls_trust_anchor_file">smtp_tls_trust_anchor_file</a> (empty)</b>
- Zero or more PEM-format files with trust-anchor certificates
+ Zero or more PEM-format files with trust-anchor certificates
and/or public keys.
<b><a href="postconf.5.html#smtp_tls_force_insecure_host_tlsa_lookup">smtp_tls_force_insecure_host_tlsa_lookup</a> (no)</b>
- Lookup the associated DANE TLSA RRset even when a hostname is
+ Lookup the associated DANE TLSA RRset even when a hostname is
not an alias and its address records lie in an unsigned zone.
- <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b>
- <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> trust-anchor digest support in the Postfix TLS library.
-
<b><a href="postconf.5.html#tlsmgr_service_name">tlsmgr_service_name</a> (tlsmgr)</b>
The name of the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>.
@@ -569,50 +637,60 @@ SMTP(8) SMTP(8)
nexthop destination security level is <b>dane</b>, but the MX record
was found via an "insecure" MX lookup.
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> (no)</b>
+ Try to make multiple deliveries per TLS-encrypted connection.
+
+ <b><a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> (empty)</b>
+ List of one or more PEM files, each holding one or more private
+ keys directly followed by a corresponding certificate chain.
+
+ <b><a href="postconf.5.html#smtp_tls_servername">smtp_tls_servername</a> (empty)</b>
+ Optional name to send to the remote SMTP server in the TLS
+ Server Name Indication (SNI) extension.
+
+ Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later:
+
+ <b><a href="postconf.5.html#tls_fast_shutdown_enable">tls_fast_shutdown_enable</a> (yes)</b>
+ A workaround for implementations that hang Postfix while shut-
+ ting down a TLS session, until Postfix times out.
+
<b>OBSOLETE STARTTLS CONTROLS</b>
- The following configuration parameters exist for compatibility with
- Postfix versions before 2.3. Support for these will be removed in a
+ The following configuration parameters exist for compatibility with
+ Postfix versions before 2.3. Support for these will be removed in a
future release.
<b><a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a> (no)</b>
- Opportunistic mode: use TLS when a remote SMTP server announces
+ Opportunistic mode: use TLS when a remote SMTP server announces
STARTTLS support, otherwise send the mail in the clear.
<b><a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> (no)</b>
- Enforcement mode: require that remote SMTP servers use TLS
+ Enforcement mode: require that remote SMTP servers use TLS
encryption, and never send mail in the clear.
<b><a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> (yes)</b>
- With mandatory TLS encryption, require that the remote SMTP
- server hostname matches the information in the remote SMTP
+ With mandatory TLS encryption, require that the remote SMTP
+ server hostname matches the information in the remote SMTP
server certificate.
<b><a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> (empty)</b>
- Optional lookup tables with the Postfix SMTP client TLS usage
- policy by next-hop destination and by remote SMTP server host-
+ Optional lookup tables with the Postfix SMTP client TLS usage
+ policy by next-hop destination and by remote SMTP server host-
name.
<b><a href="postconf.5.html#smtp_tls_cipherlist">smtp_tls_cipherlist</a> (empty)</b>
- Obsolete Postfix &lt; 2.3 control for the Postfix SMTP client TLS
+ Obsolete Postfix &lt; 2.3 control for the Postfix SMTP client TLS
cipher list.
<b>RESOURCE AND RATE CONTROLS</b>
- <b><a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
- <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
- The maximal number of parallel deliveries to the same destina-
- tion via the smtp message delivery transport.
-
- <b><a href="postconf.5.html#smtp_destination_recipient_limit">smtp_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b>
- The maximal number of recipients per message for the smtp mes-
- sage delivery transport.
-
<b><a href="postconf.5.html#smtp_connect_timeout">smtp_connect_timeout</a> (30s)</b>
- The Postfix SMTP client time limit for completing a TCP connec-
+ The Postfix SMTP client time limit for completing a TCP connec-
tion, or zero (use the operating system built-in time limit).
<b><a href="postconf.5.html#smtp_helo_timeout">smtp_helo_timeout</a> (300s)</b>
- The Postfix SMTP client time limit for sending the HELO or EHLO
- command, and for receiving the initial remote SMTP server
+ The Postfix SMTP client time limit for sending the HELO or EHLO
+ command, and for receiving the initial remote SMTP server
response.
<b><a href="postconf.5.html#lmtp_lhlo_timeout">lmtp_lhlo_timeout</a> (300s)</b>
@@ -624,19 +702,19 @@ SMTP(8) SMTP(8)
mand, and for receiving the remote SMTP server response.
<b><a href="postconf.5.html#smtp_mail_timeout">smtp_mail_timeout</a> (300s)</b>
- The Postfix SMTP client time limit for sending the MAIL FROM
+ The Postfix SMTP client time limit for sending the MAIL FROM
command, and for receiving the remote SMTP server response.
<b><a href="postconf.5.html#smtp_rcpt_timeout">smtp_rcpt_timeout</a> (300s)</b>
- The Postfix SMTP client time limit for sending the SMTP RCPT TO
+ The Postfix SMTP client time limit for sending the SMTP RCPT TO
command, and for receiving the remote SMTP server response.
<b><a href="postconf.5.html#smtp_data_init_timeout">smtp_data_init_timeout</a> (120s)</b>
- The Postfix SMTP client time limit for sending the SMTP DATA
+ The Postfix SMTP client time limit for sending the SMTP DATA
command, and for receiving the remote SMTP server response.
<b><a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a> (180s)</b>
- The Postfix SMTP client time limit for sending the SMTP message
+ The Postfix SMTP client time limit for sending the SMTP message
content.
<b><a href="postconf.5.html#smtp_data_done_timeout">smtp_data_done_timeout</a> (600s)</b>
@@ -650,13 +728,13 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a> (5)</b>
- The maximal number of MX (mail exchanger) IP addresses that can
- result from Postfix SMTP client mail exchanger lookups, or zero
+ The maximal number of MX (mail exchanger) IP addresses that can
+ result from Postfix SMTP client mail exchanger lookups, or zero
(no limit).
<b><a href="postconf.5.html#smtp_mx_session_limit">smtp_mx_session_limit</a> (2)</b>
- The maximal number of SMTP sessions per delivery request before
- the Postfix SMTP client gives up or delivers to a fall-back
+ The maximal number of SMTP sessions per delivery request before
+ the Postfix SMTP client gives up or delivers to a fall-back
<a href="postconf.5.html#relayhost">relay host</a>, or zero (no limit).
<b><a href="postconf.5.html#smtp_rset_timeout">smtp_rset_timeout</a> (20s)</b>
@@ -666,17 +744,17 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.2 and earlier:
<b><a href="postconf.5.html#lmtp_cache_connection">lmtp_cache_connection</a> (yes)</b>
- Keep Postfix LMTP client connections open for up to $<a href="postconf.5.html#max_idle">max_idle</a>
+ Keep Postfix LMTP client connections open for up to $<a href="postconf.5.html#max_idle">max_idle</a>
seconds.
Available in Postfix version 2.2 and later:
<b><a href="postconf.5.html#smtp_connection_cache_destinations">smtp_connection_cache_destinations</a> (empty)</b>
- Permanently enable SMTP connection caching for the specified
+ Permanently enable SMTP connection caching for the specified
destinations.
<b><a href="postconf.5.html#smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a> (yes)</b>
- Temporarily enable SMTP connection caching while a destination
+ Temporarily enable SMTP connection caching while a destination
has a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>.
<b><a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a> (300s)</b>
@@ -690,54 +768,80 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.3 and later:
<b><a href="postconf.5.html#connection_cache_protocol_timeout">connection_cache_protocol_timeout</a> (5s)</b>
- Time limit for connection cache connect, send or receive opera-
+ Time limit for connection cache connect, send or receive opera-
tions.
Available in Postfix version 2.9 and later:
<b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b>
- Change the behavior of the smtp_*_timeout time limits, from a
- time limit per read or write system call, to a time limit to
- send or receive a complete record (an SMTP command line, SMTP
- response line, SMTP message content line, or TLS protocol mes-
+ Change the behavior of the smtp_*_timeout time limits, from a
+ time limit per read or write system call, to a time limit to
+ send or receive a complete record (an SMTP command line, SMTP
+ response line, SMTP message content line, or TLS protocol mes-
sage).
Available in Postfix version 2.11 and later:
<b><a href="postconf.5.html#smtp_connection_reuse_count_limit">smtp_connection_reuse_count_limit</a> (0)</b>
- When SMTP connection caching is enabled, the number of times
- that an SMTP session may be reused before it is closed, or zero
+ When SMTP connection caching is enabled, the number of times
+ that an SMTP session may be reused before it is closed, or zero
(no limit).
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> (no)</b>
+ Try to make multiple deliveries per TLS-encrypted connection.
+
+ Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon:
+
+ <b>transport_destination_concurrency_limit ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
+ <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
+ A transport-specific override for the default_destination_con-
+ currency_limit parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
+
+ <b>transport_destination_recipient_limit ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b>
+ <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>-
+ <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
+ name of the message delivery transport.
+
<b>SMTPUTF8 CONTROLS</b>
Preliminary SMTPUTF8 support is introduced with Postfix 3.0.
<b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
- Enable preliminary SMTPUTF8 support for the protocols described
+ Enable preliminary SMTPUTF8 support for the protocols described
in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.
<b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b>
- Detect that a message requires SMTPUTF8 support for the speci-
+ Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b>
+ Enable 'transitional' compatibility between IDNA2003 and
+ IDNA2008, when converting UTF-8 domain names to/from the ASCII
+ form that is used for DNS lookups.
+
<b>TROUBLE SHOOTING CONTROLS</b>
<b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b>
- The increment in verbose logging level when a remote client or
+ The increment in verbose logging level when a remote client or
server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter.
<b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b>
- Optional list of remote client or server hostname or network
+ Optional list of remote client or server hostname or network
address patterns that cause the verbose logging level to
increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>.
<b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b>
- The recipient of postmaster notifications about mail delivery
+ The recipient of postmaster notifications about mail delivery
problems that are caused by policy, resource, software or proto-
col errors.
<b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b>
- What categories of Postfix-generated mail are subject to
- before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>,
+ What categories of Postfix-generated mail are subject to
+ before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>,
<a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>.
<b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b>
@@ -745,46 +849,46 @@ SMTP(8) SMTP(8)
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#best_mx_transport">best_mx_transport</a> (empty)</b>
- Where the Postfix SMTP client should deliver mail when it
+ Where the Postfix SMTP client should deliver mail when it
detects a "mail loops back to myself" error condition.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b>
- How much time a Postfix daemon process may take to handle a
+ How much time a Postfix daemon process may take to handle a
request before it is terminated by a built-in watchdog timer.
<b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b>
- The maximal number of digits after the decimal point when log-
+ The maximal number of digits after the decimal point when log-
ging sub-second delay values.
<b><a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a> (no)</b>
Disable DNS lookups in the Postfix SMTP and LMTP clients.
<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b>
- The network interface addresses that this mail system receives
+ The network interface addresses that this mail system receives
mail on.
<b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (all)</b>
- The Internet protocols Postfix will attempt to use when making
+ The Internet protocols Postfix will attempt to use when making
or accepting connections.
<b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b>
- The time limit for sending or receiving information over an
+ The time limit for sending or receiving information over an
internal communication channel.
<b><a href="postconf.5.html#lmtp_assume_final">lmtp_assume_final</a> (no)</b>
- When a remote LMTP server announces no DSN support, assume that
- the server performs final delivery, and send "delivered" deliv-
+ When a remote LMTP server announces no DSN support, assume that
+ the server performs final delivery, and send "delivered" deliv-
ery status notifications instead of "relayed".
<b><a href="postconf.5.html#lmtp_tcp_port">lmtp_tcp_port</a> (24)</b>
The default TCP port that the Postfix LMTP client connects to.
<b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b>
- The maximum amount of time that an idle Postfix daemon process
+ The maximum amount of time that an idle Postfix daemon process
waits for an incoming connection before terminating voluntarily.
<b><a href="postconf.5.html#max_use">max_use</a> (100)</b>
@@ -798,20 +902,20 @@ SMTP(8) SMTP(8)
The process name of a Postfix command or daemon process.
<b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b>
- The network interface addresses that this mail system receives
+ The network interface addresses that this mail system receives
mail on by way of a proxy or network address translation unit.
<b><a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> (any)</b>
The address type ("ipv6", "ipv4" or "any") that the Postfix SMTP
- client will try first, when a destination has IPv6 and IPv4
+ client will try first, when a destination has IPv6 and IPv4
addresses with equal MX preference.
<b><a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> (empty)</b>
- An optional numerical network address that the Postfix SMTP
+ An optional numerical network address that the Postfix SMTP
client should bind to when making an IPv4 connection.
<b><a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> (empty)</b>
- An optional numerical network address that the Postfix SMTP
+ An optional numerical network address that the Postfix SMTP
client should bind to when making an IPv6 connection.
<b><a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
@@ -831,9 +935,8 @@ SMTP(8) SMTP(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available with Postfix 2.2 and earlier:
@@ -859,6 +962,16 @@ SMTP(8) SMTP(8)
Optional list of relay hosts for LMTP destinations that can't be
found or that are unreachable.
+ Available with Postfix 3.2 and later:
+
+ <b><a href="postconf.5.html#smtp_tcp_port">smtp_tcp_port</a> (smtp)</b>
+ The default TCP port that the Postfix SMTP client connects to.
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>SEE ALSO</b>
<a href="generic.5.html">generic(5)</a>, output address rewriting
<a href="header_checks.5.html">header_checks(5)</a>, message header content inspection
@@ -870,6 +983,7 @@ SMTP(8) SMTP(8)
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
<a href="tlsmgr.8.html">tlsmgr(8)</a>, TLS session and PRNG management
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/smtpd.8.html b/external/ibm-public/postfix/dist/html/smtpd.8.html
index c0679b10048..b81b864cdf6 100644
--- a/external/ibm-public/postfix/dist/html/smtpd.8.html
+++ b/external/ibm-public/postfix/dist/html/smtpd.8.html
@@ -50,6 +50,7 @@ SMTPD(8) SMTPD(8)
<a href="http://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command)
<a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol)
<a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP pipelining)
+ <a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> (CHUNKING without BINARYMIME)
<a href="http://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command)
<a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN extension)
<a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes)
@@ -62,7 +63,7 @@ SMTPD(8) SMTPD(8)
<a href="http://tools.ietf.org/html/rfc7505">RFC 7505</a> ("Null MX" No Service Resource Record)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces, protocol problems, policy violations, and
@@ -236,11 +237,12 @@ SMTPD(8) SMTPD(8)
Postfix 2.6 the default protocol is 2.
<b><a href="postconf.5.html#milter_default_action">milter_default_action</a> (tempfail)</b>
- The default action when a Milter (mail filter) application is
- unavailable or mis-configured.
+ The default action when a Milter (mail filter) response is
+ unavailable (for example, bad Postfix configuration or Milter
+ failure).
<b><a href="postconf.5.html#milter_macro_daemon_name">milter_macro_daemon_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
- The {daemon_name} macro value for Milter (mail filter) applica-
+ The {daemon_name} macro value for Milter (mail filter) applica-
tions.
<b><a href="postconf.5.html#milter_macro_v">milter_macro_v</a> ($<a href="postconf.5.html#mail_name">mail_name</a> $<a href="postconf.5.html#mail_version">mail_version</a>)</b>
@@ -251,52 +253,58 @@ SMTPD(8) SMTPD(8)
tion, and for negotiating protocol options.
<b><a href="postconf.5.html#milter_command_timeout">milter_command_timeout</a> (30s)</b>
- The time limit for sending an SMTP command to a Milter (mail
+ The time limit for sending an SMTP command to a Milter (mail
filter) application, and for receiving the response.
<b><a href="postconf.5.html#milter_content_timeout">milter_content_timeout</a> (300s)</b>
- The time limit for sending message content to a Milter (mail
+ The time limit for sending message content to a Milter (mail
filter) application, and for receiving the response.
<b><a href="postconf.5.html#milter_connect_macros">milter_connect_macros</a> (see 'postconf -d' output)</b>
- The macros that are sent to Milter (mail filter) applications
+ The macros that are sent to Milter (mail filter) applications
after completion of an SMTP connection.
<b><a href="postconf.5.html#milter_helo_macros">milter_helo_macros</a> (see 'postconf -d' output)</b>
- The macros that are sent to Milter (mail filter) applications
+ The macros that are sent to Milter (mail filter) applications
after the SMTP HELO or EHLO command.
<b><a href="postconf.5.html#milter_mail_macros">milter_mail_macros</a> (see 'postconf -d' output)</b>
- The macros that are sent to Milter (mail filter) applications
+ The macros that are sent to Milter (mail filter) applications
after the SMTP MAIL FROM command.
<b><a href="postconf.5.html#milter_rcpt_macros">milter_rcpt_macros</a> (see 'postconf -d' output)</b>
- The macros that are sent to Milter (mail filter) applications
+ The macros that are sent to Milter (mail filter) applications
after the SMTP RCPT TO command.
<b><a href="postconf.5.html#milter_data_macros">milter_data_macros</a> (see 'postconf -d' output)</b>
- The macros that are sent to version 4 or higher Milter (mail
+ The macros that are sent to version 4 or higher Milter (mail
filter) applications after the SMTP DATA command.
<b><a href="postconf.5.html#milter_unknown_command_macros">milter_unknown_command_macros</a> (see 'postconf -d' output)</b>
- The macros that are sent to version 3 or higher Milter (mail
+ The macros that are sent to version 3 or higher Milter (mail
filter) applications after an unknown SMTP command.
<b><a href="postconf.5.html#milter_end_of_header_macros">milter_end_of_header_macros</a> (see 'postconf -d' output)</b>
- The macros that are sent to Milter (mail filter) applications
+ The macros that are sent to Milter (mail filter) applications
after the end of the message header.
<b><a href="postconf.5.html#milter_end_of_data_macros">milter_end_of_data_macros</a> (see 'postconf -d' output)</b>
- The macros that are sent to Milter (mail filter) applications
+ The macros that are sent to Milter (mail filter) applications
after the message end-of-data.
Available in Postfix version 3.1 and later:
<b><a href="postconf.5.html#milter_macro_defaults">milter_macro_defaults</a> (empty)</b>
- Optional list of <i>name=value</i> pairs that specify default values
- for arbitrary macros that Postfix may send to Milter applica-
+ Optional list of <i>name=value</i> pairs that specify default values
+ for arbitrary macros that Postfix may send to Milter applica-
tions.
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#smtpd_milter_maps">smtpd_milter_maps</a> (empty)</b>
+ Lookup tables with Milter settings per remote SMTP client IP
+ address.
+
<b>GENERAL CONTENT INSPECTION CONTROLS</b>
The following parameters are applicable for both built-in and external
content filters.
@@ -382,17 +390,23 @@ SMTPD(8) SMTPD(8)
The service name that is passed to the SASL plug-in that is
selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b> and <b><a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a></b>.
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#smtpd_sasl_response_limit">smtpd_sasl_response_limit</a> (12288)</b>
+ The maximum length of a SASL client's response to a server chal-
+ lenge.
+
<b>STARTTLS SUPPORT CONTROLS</b>
- Detailed information about STARTTLS configuration may be found in the
+ Detailed information about STARTTLS configuration may be found in the
<a href="TLS_README.html">TLS_README</a> document.
<b><a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> (empty)</b>
- The SMTP TLS security level for the Postfix SMTP server; when a
+ The SMTP TLS security level for the Postfix SMTP server; when a
non-empty value is specified, this overrides the obsolete param-
eters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>.
<b><a href="postconf.5.html#smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a> ($<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b>
- The SASL authentication security options that the Postfix SMTP
+ The SASL authentication security options that the Postfix SMTP
server uses for TLS encrypted SMTP sessions.
<b><a href="postconf.5.html#smtpd_starttls_timeout">smtpd_starttls_timeout</a> (see 'postconf -d' output)</b>
@@ -400,25 +414,25 @@ SMTPD(8) SMTPD(8)
during TLS startup and shutdown handshake procedures.
<b><a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> (empty)</b>
- A file containing (PEM format) CA certificates of root CAs
+ A file containing (PEM format) CA certificates of root CAs
trusted to sign either remote SMTP client certificates or inter-
mediate CA certificates.
<b><a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> (empty)</b>
- A directory containing (PEM format) CA certificates of root CAs
+ A directory containing (PEM format) CA certificates of root CAs
trusted to sign either remote SMTP client certificates or inter-
mediate CA certificates.
<b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b>
- Force the Postfix SMTP server to issue a TLS session id, even
- when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_ses</a>-
+ Force the Postfix SMTP server to issue a TLS session id, even
+ when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_ses</a>-
<a href="postconf.5.html#smtpd_tls_session_cache_database">sion_cache_database</a> is empty).
<b><a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> (no)</b>
Ask a remote SMTP client for a client certificate.
<b><a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> (no)</b>
- When TLS encryption is optional in the Postfix SMTP server, do
+ When TLS encryption is optional in the Postfix SMTP server, do
not announce or accept SASL authentication over unencrypted con-
nections.
@@ -429,18 +443,18 @@ SMTPD(8) SMTPD(8)
File with the Postfix SMTP server RSA certificate in PEM format.
<b><a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> (empty)</b>
- List of ciphers or cipher types to exclude from the SMTP server
+ List of ciphers or cipher types to exclude from the SMTP server
cipher list at all TLS security levels.
<b><a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> (empty)</b>
File with the Postfix SMTP server DSA certificate in PEM format.
<b><a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> (empty)</b>
- File with DH parameters that the Postfix SMTP server should use
+ File with DH parameters that the Postfix SMTP server should use
with non-export EDH ciphers.
<b><a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> (empty)</b>
- File with DH parameters that the Postfix SMTP server should use
+ File with DH parameters that the Postfix SMTP server should use
with export-grade EDH ciphers.
<b><a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a> ($<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b>
@@ -453,35 +467,35 @@ SMTPD(8) SMTPD(8)
Enable additional Postfix SMTP server logging of TLS activity.
<b><a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> (medium)</b>
- The minimum TLS cipher grade that the Postfix SMTP server will
+ The minimum TLS cipher grade that the Postfix SMTP server will
use with mandatory TLS encryption.
<b><a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> (empty)</b>
- Additional list of ciphers or cipher types to exclude from the
- Postfix SMTP server cipher list at mandatory TLS security lev-
+ Additional list of ciphers or cipher types to exclude from the
+ Postfix SMTP server cipher list at mandatory TLS security lev-
els.
<b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (!SSLv2, !SSLv3)</b>
- The SSL/TLS protocols accepted by the Postfix SMTP server with
+ The SSL/TLS protocols accepted by the Postfix SMTP server with
mandatory TLS encryption.
<b><a href="postconf.5.html#smtpd_tls_received_header">smtpd_tls_received_header</a> (no)</b>
Request that the Postfix SMTP server produces Received: message
- headers that include information about the protocol and cipher
- used, as well as the remote SMTP client CommonName and client
+ headers that include information about the protocol and cipher
+ used, as well as the remote SMTP client CommonName and client
certificate issuer CommonName.
<b><a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a> (no)</b>
- With mandatory TLS encryption, require a trusted remote SMTP
+ With mandatory TLS encryption, require a trusted remote SMTP
client certificate in order to allow TLS connections to proceed.
<b><a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> (no)</b>
- Run the Postfix SMTP server in the non-standard "wrapper" mode,
+ Run the Postfix SMTP server in the non-standard "wrapper" mode,
instead of using the STARTTLS command.
<b><a href="postconf.5.html#tls_daemon_random_bytes">tls_daemon_random_bytes</a> (32)</b>
- The number of pseudo-random bytes that an <a href="smtp.8.html"><b>smtp</b>(8)</a> or <a href="smtpd.8.html"><b>smtpd</b>(8)</a>
- process requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed its
+ The number of pseudo-random bytes that an <a href="smtp.8.html"><b>smtp</b>(8)</a> or <a href="smtpd.8.html"><b>smtpd</b>(8)</a>
+ process requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed its
internal pseudo random number generator (PRNG).
<b><a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> (see 'postconf -d' output)</b>
@@ -497,41 +511,41 @@ SMTPD(8) SMTPD(8)
The OpenSSL cipherlist for "export" or higher grade ciphers.
<b><a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> (eNULL:!aNULL)</b>
- The OpenSSL cipherlist for "NULL" grade ciphers that provide
+ The OpenSSL cipherlist for "NULL" grade ciphers that provide
authentication without encryption.
Available in Postfix version 2.5 and later:
<b><a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> (md5)</b>
- The message digest algorithm to construct remote SMTP
- client-certificate fingerprints or public key fingerprints
- (Postfix 2.9 and later) for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b>per-</b>
+ The message digest algorithm to construct remote SMTP
+ client-certificate fingerprints or public key fingerprints
+ (Postfix 2.9 and later) for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b>per-</b>
<b>mit_tls_clientcerts</b>.
Available in Postfix version 2.6 and later:
<b><a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> (!SSLv2, !SSLv3)</b>
- List of TLS protocols that the Postfix SMTP server will exclude
+ List of TLS protocols that the Postfix SMTP server will exclude
or include with opportunistic TLS encryption.
<b><a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> (medium)</b>
- The minimum TLS cipher grade that the Postfix SMTP server will
+ The minimum TLS cipher grade that the Postfix SMTP server will
use with opportunistic TLS encryption.
<b><a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> (empty)</b>
- File with the Postfix SMTP server ECDSA certificate in PEM for-
+ File with the Postfix SMTP server ECDSA certificate in PEM for-
mat.
<b><a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a> ($<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b>
- File with the Postfix SMTP server ECDSA private key in PEM for-
+ File with the Postfix SMTP server ECDSA private key in PEM for-
mat.
<b><a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> (see 'postconf -d' output)</b>
- The Postfix SMTP server security grade for ephemeral ellip-
+ The Postfix SMTP server security grade for ephemeral ellip-
tic-curve Diffie-Hellman (EECDH) key exchange.
<b><a href="postconf.5.html#tls_eecdh_strong_curve">tls_eecdh_strong_curve</a> (prime256v1)</b>
- The elliptic curve used by the Postfix SMTP server for sensibly
+ The elliptic curve used by the Postfix SMTP server for sensibly
strong ephemeral ECDH key exchange.
<b><a href="postconf.5.html#tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a> (secp384r1)</b>
@@ -542,7 +556,7 @@ SMTPD(8) SMTPD(8)
<b><a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> (no)</b>
With SSLv3 and later, use the Postfix SMTP server's cipher pref-
- erence order instead of the remote client's cipher preference
+ erence order instead of the remote client's cipher preference
order.
<b><a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> (see 'postconf -d' output)</b>
@@ -555,17 +569,46 @@ SMTPD(8) SMTPD(8)
Available in Postfix version 3.0 and later:
- <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a> (Postfix</b> &gt;<b>= 3.0: aes-256-cbc, Postfix</b> &lt; <b>3.0:</b>
+ <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a> (Postfix</b> &gt;<b>= 3.0: aes-256-cbc, Postfix</b> &lt; <b>3.0:</b>
<b>aes-128-cbc)</b>
Algorithm used to encrypt <a href="http://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets.
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> (see 'postconf -d' output)</b>
+ The prioritized list of elliptic curves supported by the Postfix
+ SMTP client and server.
+
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a> (empty)</b>
+ List of one or more PEM files, each holding one or more private
+ keys directly followed by a corresponding certificate chain.
+
+ <b><a href="postconf.5.html#tls_server_sni_maps">tls_server_sni_maps</a> (empty)</b>
+ Optional lookup tables that map names received from remote SMTP
+ clients via the TLS Server Name Indication (SNI) extension to
+ the appropriate keys and certificate chains.
+
+ Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later:
+
+ <b><a href="postconf.5.html#tls_fast_shutdown_enable">tls_fast_shutdown_enable</a> (yes)</b>
+ A workaround for implementations that hang Postfix while shut-
+ ting down a TLS session, until Postfix times out.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
+
<b>OBSOLETE STARTTLS CONTROLS</b>
- The following configuration parameters exist for compatibility with
- Postfix versions before 2.3. Support for these will be removed in a
+ The following configuration parameters exist for compatibility with
+ Postfix versions before 2.3. Support for these will be removed in a
future release.
<b><a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> (no)</b>
- Opportunistic TLS: announce STARTTLS support to remote SMTP
+ Opportunistic TLS: announce STARTTLS support to remote SMTP
clients, but do not require that clients use TLS encryption.
<b><a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> (no)</b>
@@ -573,85 +616,92 @@ SMTPD(8) SMTPD(8)
and require that clients use TLS encryption.
<b><a href="postconf.5.html#smtpd_tls_cipherlist">smtpd_tls_cipherlist</a> (empty)</b>
- Obsolete Postfix &lt; 2.3 control for the Postfix SMTP server TLS
+ Obsolete Postfix &lt; 2.3 control for the Postfix SMTP server TLS
cipher list.
<b>SMTPUTF8 CONTROLS</b>
Preliminary SMTPUTF8 support is introduced with Postfix 3.0.
<b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
- Enable preliminary SMTPUTF8 support for the protocols described
+ Enable preliminary SMTPUTF8 support for the protocols described
in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.
<b><a href="postconf.5.html#strict_smtputf8">strict_smtputf8</a> (no)</b>
Enable stricter enforcement of the SMTPUTF8 protocol.
<b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b>
- Detect that a message requires SMTPUTF8 support for the speci-
+ Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b>
+ Enable 'transitional' compatibility between IDNA2003 and
+ IDNA2008, when converting UTF-8 domain names to/from the ASCII
+ form that is used for DNS lookups.
+
<b>VERP SUPPORT CONTROLS</b>
- With VERP style delivery, each recipient of a message receives a cus-
- tomized copy of the message with his/her own recipient address encoded
+ With VERP style delivery, each recipient of a message receives a cus-
+ tomized copy of the message with his/her own recipient address encoded
in the envelope sender address. The <a href="VERP_README.html">VERP_README</a> file describes config-
- uration and operation details of Postfix support for variable envelope
- return path addresses. VERP style delivery is requested with the SMTP
- XVERP command or with the "sendmail -V" command-line option and is
+ uration and operation details of Postfix support for variable envelope
+ return path addresses. VERP style delivery is requested with the SMTP
+ XVERP command or with the "sendmail -V" command-line option and is
available in Postfix version 1.1 and later.
<b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a> (+=)</b>
The two default VERP delimiter characters.
<b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b>
- The characters Postfix accepts as VERP delimiter characters on
+ The characters Postfix accepts as VERP delimiter characters on
the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command line and in SMTP commands.
Available in Postfix version 1.1 and 2.0:
<b><a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b>
- What remote SMTP clients are allowed to specify the XVERP com-
+ What remote SMTP clients are allowed to specify the XVERP com-
mand.
Available in Postfix version 2.1 and later:
<b><a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> ($<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b>
- What remote SMTP clients are allowed to specify the XVERP com-
+ What remote SMTP clients are allowed to specify the XVERP com-
mand.
<b>TROUBLE SHOOTING CONTROLS</b>
- The <a href="DEBUG_README.html">DEBUG_README</a> document describes how to debug parts of the Postfix
- mail system. The methods vary from making the software log a lot of
+ The <a href="DEBUG_README.html">DEBUG_README</a> document describes how to debug parts of the Postfix
+ mail system. The methods vary from making the software log a lot of
detail, to running some daemon processes under control of a call tracer
or debugger.
<b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b>
- The increment in verbose logging level when a remote client or
+ The increment in verbose logging level when a remote client or
server matches a pattern in the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter.
<b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b>
- Optional list of remote client or server hostname or network
+ Optional list of remote client or server hostname or network
address patterns that cause the verbose logging level to
increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>.
<b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b>
- The recipient of postmaster notifications about mail delivery
+ The recipient of postmaster notifications about mail delivery
problems that are caused by policy, resource, software or proto-
col errors.
<b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b>
- What categories of Postfix-generated mail are subject to
- before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>,
+ What categories of Postfix-generated mail are subject to
+ before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>,
<a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>.
<b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b>
The list of error classes that are reported to the postmaster.
<b><a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> (empty)</b>
- Optional information that is appended after each Postfix SMTP
+ Optional information that is appended after each Postfix SMTP
server 4XX or 5XX response.
<b><a href="postconf.5.html#soft_bounce">soft_bounce</a> (no)</b>
- Safety net to keep mail queued that would otherwise be returned
+ Safety net to keep mail queued that would otherwise be returned
to the sender.
Available in Postfix version 2.1 and later:
@@ -662,28 +712,32 @@ SMTPD(8) SMTPD(8)
Available in Postfix version 2.10 and later:
<b><a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> (empty)</b>
- Enable logging of the named "permit" actions in SMTP server
- access lists (by default, the SMTP server logs "reject" actions
+ Enable logging of the named "permit" actions in SMTP server
+ access lists (by default, the SMTP server logs "reject" actions
but not "permit" actions).
<b>KNOWN VERSUS UNKNOWN RECIPIENT CONTROLS</b>
- As of Postfix version 2.0, the SMTP server rejects mail for unknown
+ As of Postfix version 2.0, the SMTP server rejects mail for unknown
recipients. This prevents the mail queue from clogging up with undeliv-
- erable MAILER-DAEMON messages. Additional information on this topic is
+ erable MAILER-DAEMON messages. Additional information on this topic is
in the <a href="LOCAL_RECIPIENT_README.html">LOCAL_RECIPIENT_README</a> and <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> documents.
<b><a href="postconf.5.html#show_user_unknown_table_name">show_user_unknown_table_name</a> (yes)</b>
- Display the name of the recipient table in the "User unknown"
+ Display the name of the recipient table in the "User unknown"
responses.
<b><a href="postconf.5.html#canonical_maps">canonical_maps</a> (empty)</b>
- Optional address mapping lookup tables for message headers and
+ Optional address mapping lookup tables for message headers and
envelopes.
<b><a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> (empty)</b>
- Optional address mapping lookup tables for envelope and header
+ Optional address mapping lookup tables for envelope and header
recipient addresses.
+ <b><a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> (empty)</b>
+ Optional address mapping lookup tables for envelope and header
+ sender addresses.
+
Parameters concerning known/unknown local recipients:
<b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b>
@@ -1165,7 +1219,7 @@ SMTPD(8) SMTPD(8)
<b><a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b>
The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_host</a>-
- <a href="postconf.5.html#reject_unknown_helo_hostname">name</a> fails due to an temporary error condition.
+ <a href="postconf.5.html#reject_unknown_helo_hostname">name</a> fails due to a temporary error condition.
<b><a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b>
The Postfix SMTP server's action when
@@ -1241,14 +1295,13 @@ SMTPD(8) SMTPD(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 2.2 and later:
<b><a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> (CONNECT, GET, POST)</b>
- List of commands that cause the Postfix SMTP server to immedi-
+ List of commands that cause the Postfix SMTP server to immedi-
ately terminate the session with a 221 code.
Available in Postfix version 2.5 and later:
@@ -1257,6 +1310,17 @@ SMTPD(8) SMTPD(8)
Enable logging of the remote SMTP client port in addition to the
hostname and IP address.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.4 and later:
+
+ <b><a href="postconf.5.html#smtpd_reject_footer_maps">smtpd_reject_footer_maps</a> (empty)</b>
+ Lookup tables, indexed by the complete Postfix SMTP server 4xx
+ or 5xx response, with reject footer templates.
+
<b>SEE ALSO</b>
<a href="anvil.8.html">anvil(8)</a>, connection/rate limiting
<a href="cleanup.8.html">cleanup(8)</a>, message canonicalization
@@ -1266,11 +1330,13 @@ SMTPD(8) SMTPD(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
<a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>, blocking unknown hosted or relay recipients
- <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> Postfix address manipulation
+ <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a>, Postfix address manipulation
+ <a href="BDAT_README.html">BDAT_README</a>, Postfix CHUNKING support
<a href="FILTER_README.html">FILTER_README</a>, external after-queue content filter
<a href="LOCAL_RECIPIENT_README.html">LOCAL_RECIPIENT_README</a>, blocking unknown local recipients
<a href="MILTER_README.html">MILTER_README</a>, before-queue mail filter applications
diff --git a/external/ibm-public/postfix/dist/html/socketmap_table.5.html b/external/ibm-public/postfix/dist/html/socketmap_table.5.html
index 163aa91d20a..b46fddf782f 100644
--- a/external/ibm-public/postfix/dist/html/socketmap_table.5.html
+++ b/external/ibm-public/postfix/dist/html/socketmap_table.5.html
@@ -27,8 +27,8 @@ SOCKETMAP_TABLE(5) SOCKETMAP_TABLE(5)
<b>PROTOCOL</b>
Socketmaps use a simple protocol: the client sends one request, and the
- server sends one reply. Each request and reply are sent as one net-
- string object.
+ server sends one reply. Each request and each reply are sent as one
+ netstring object.
<b>REQUEST FORMAT</b>
The socketmap protocol supports only the lookup request. The request
diff --git a/external/ibm-public/postfix/dist/html/spawn.8.html b/external/ibm-public/postfix/dist/html/spawn.8.html
index 2b2e2d82969..51bb9045db5 100644
--- a/external/ibm-public/postfix/dist/html/spawn.8.html
+++ b/external/ibm-public/postfix/dist/html/spawn.8.html
@@ -51,7 +51,7 @@ SPAWN(8) SPAWN(8)
<b>DIAGNOSTICS</b>
The <a href="spawn.8.html"><b>spawn</b>(8)</a> daemon reports abnormal child exits. Problems are logged
- to <b>syslogd</b>(8).
+ to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>SECURITY</b>
This program needs root privilege in order to execute external commands
@@ -71,37 +71,34 @@ SPAWN(8) SPAWN(8)
<a href="master.5.html"><b>master.cf</b></a> file.
<b>RESOURCE AND RATE CONTROL</b>
- <b><a href="postconf.5.html#transport_time_limit"><i>transport</i>_time_limit</a> ($<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b>
- The amount of time the command is allowed to run before it is
- terminated.
-
- Postfix 2.4 and later support a suffix that specifies the time
- unit: s (seconds), m (minutes), h (hours), d (days), w (weeks).
- The default time unit is seconds.
+ <b>transport_time_limit ($<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b>
+ A transport-specific override for the <a href="postconf.5.html#command_time_limit">command_time_limit</a> parame-
+ ter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message
+ delivery transport.
<b>MISCELLANEOUS</b>
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b>
- How much time a Postfix daemon process may take to handle a
+ How much time a Postfix daemon process may take to handle a
request before it is terminated by a built-in watchdog timer.
<b><a href="postconf.5.html#export_environment">export_environment</a> (see 'postconf -d' output)</b>
- The list of environment variables that a Postfix process will
+ The list of environment variables that a Postfix process will
export to non-Postfix processes.
<b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b>
- The time limit for sending or receiving information over an
+ The time limit for sending or receiving information over an
internal communication channel.
<b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
- The UNIX system account that owns the Postfix queue and most
+ The UNIX system account that owns the Postfix queue and most
Postfix daemon processes.
<b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b>
- The maximum amount of time that an idle Postfix daemon process
+ The maximum amount of time that an idle Postfix daemon process
waits for an incoming connection before terminating voluntarily.
<b><a href="postconf.5.html#max_use">max_use</a> (100)</b>
@@ -121,13 +118,18 @@ SPAWN(8) SPAWN(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/sqlite_table.5.html b/external/ibm-public/postfix/dist/html/sqlite_table.5.html
index 44f5678df75..7ca5fd3bb61 100644
--- a/external/ibm-public/postfix/dist/html/sqlite_table.5.html
+++ b/external/ibm-public/postfix/dist/html/sqlite_table.5.html
@@ -26,94 +26,69 @@ SQLITE_TABLE(5) SQLITE_TABLE(5)
The file /etc/postfix/sqlite-aliases.cf has the same format as the
Postfix <a href="postconf.5.html">main.cf</a> file, and can specify the parameters described below.
-<b>BACKWARDS COMPATIBILITY</b>
- For compatibility with other Postfix lookup tables, SQLite parameters
- can also be defined in <a href="postconf.5.html">main.cf</a>. In order to do that, specify as SQLite
- source a name that doesn't begin with a slash or a dot. The SQLite
- parameters will then be accessible as the name you've given the source
- in its definition, an underscore, and the name of the parameter. For
- example, if the map is specified as "<a href="sqlite_table.5.html">sqlite</a>:<i>sqlitename</i>", the parameter
- "query" below would be defined in <a href="postconf.5.html">main.cf</a> as "<i>sqlitename</i>_query".
-
- Normally, the SQL query is specified via a single <b>query</b> parameter
- (described in more detail below). When this parameter is not specified
- in the map definition, Postfix reverts to an older interface, with the
- SQL query constructed from the <b>select_field</b>, <b>table</b>, <b>where_field</b> and
- <b>additional_conditions</b> parameters. The old interface will be gradually
- phased out. To migrate to the new interface set:
-
- <b>query</b> = SELECT [<i>select</i><b>_</b><i>field</i>]
- FROM [<i>table</i>]
- WHERE [<i>where</i><b>_</b><i>field</i>] = '%s'
- [<i>additional</i><b>_</b><i>conditions</i>]
-
- Insert the value, not the name, of each legacy parameter. Note that the
- <b>additional_conditions</b> parameter is optional and if not empty, will
- always start with <b>AND</b>.
-
<b>LIST MEMBERSHIP</b>
- When using SQL to store lists such as $<a href="postconf.5.html#mynetworks">mynetworks</a>, $<a href="postconf.5.html#mydestination">mydestination</a>,
- $<a href="postconf.5.html#relay_domains">relay_domains</a>, $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, etc., it is important to under-
+ When using SQL to store lists such as $<a href="postconf.5.html#mynetworks">mynetworks</a>, $<a href="postconf.5.html#mydestination">mydestination</a>,
+ $<a href="postconf.5.html#relay_domains">relay_domains</a>, $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, etc., it is important to under-
stand that the table must store each list member as a separate key. The
- table lookup verifies the *existence* of the key. See "Postfix lists
+ table lookup verifies the *existence* of the key. See "Postfix lists
versus tables" in the <a href="DATABASE_README.html">DATABASE_README</a> document for a discussion.
- Do NOT create tables that return the full list of domains in $<a href="postconf.5.html#mydestination">mydesti</a>-
+ Do NOT create tables that return the full list of domains in $<a href="postconf.5.html#mydestination">mydesti</a>-
<a href="postconf.5.html#mydestination">nation</a> or $<a href="postconf.5.html#relay_domains">relay_domains</a> etc., or IP addresses in $<a href="postconf.5.html#mynetworks">mynetworks</a>.
DO create tables with each matching item as a key and with an arbitrary
- value. With SQL databases it is not uncommon to return the key itself
+ value. With SQL databases it is not uncommon to return the key itself
or a constant value.
<b>SQLITE PARAMETERS</b>
<b>dbpath</b> The SQLite database file location. Example:
dbpath = customer_database
- <b>query</b> The SQL query template used to search the database, where <b>%s</b> is
- a substitute for the address Postfix is trying to resolve, e.g.
+ <b>query</b> The SQL query template used to search the database, where <b>%s</b> is
+ a substitute for the address Postfix is trying to resolve, e.g.
query = SELECT replacement FROM aliases WHERE mailbox = '%s'
This parameter supports the following '%' expansions:
<b>%%</b> This is replaced by a literal '%' character.
- <b>%s</b> This is replaced by the input key. SQL quoting is used
- to make sure that the input key does not add unexpected
+ <b>%s</b> This is replaced by the input key. SQL quoting is used
+ to make sure that the input key does not add unexpected
metacharacters.
<b>%u</b> When the input key is an address of the form user@domain,
- <b>%u</b> is replaced by the SQL quoted local part of the
- address. Otherwise, <b>%u</b> is replaced by the entire search
- string. If the localpart is empty, the query is sup-
+ <b>%u</b> is replaced by the SQL quoted local part of the
+ address. Otherwise, <b>%u</b> is replaced by the entire search
+ string. If the localpart is empty, the query is sup-
pressed and returns no results.
<b>%d</b> When the input key is an address of the form user@domain,
- <b>%d</b> is replaced by the SQL quoted domain part of the
- address. Otherwise, the query is suppressed and returns
+ <b>%d</b> is replaced by the SQL quoted domain part of the
+ address. Otherwise, the query is suppressed and returns
no results.
<b>%[SUD]</b> The upper-case equivalents of the above expansions behave
- in the <b>query</b> parameter identically to their lower-case
- counter-parts. With the <b>result_format</b> parameter (see
- below), they expand the input key rather than the result
+ in the <b>query</b> parameter identically to their lower-case
+ counter-parts. With the <b>result_format</b> parameter (see
+ below), they expand the input key rather than the result
value.
- <b>%[1-9]</b> The patterns %1, %2, ... %9 are replaced by the corre-
- sponding most significant component of the input key's
- domain. If the input key is <i>user@mail.example.com</i>, then
+ <b>%[1-9]</b> The patterns %1, %2, ... %9 are replaced by the corre-
+ sponding most significant component of the input key's
+ domain. If the input key is <i>user@mail.example.com</i>, then
%1 is <b>com</b>, %2 is <b>example</b> and %3 is <b>mail</b>. If the input key
- is unqualified or does not have enough domain components
- to satisfy all the specified patterns, the query is sup-
+ is unqualified or does not have enough domain components
+ to satisfy all the specified patterns, the query is sup-
pressed and returns no results.
- The <b>domain</b> parameter described below limits the input keys to
- addresses in matching domains. When the <b>domain</b> parameter is
+ The <b>domain</b> parameter described below limits the input keys to
+ addresses in matching domains. When the <b>domain</b> parameter is
non-empty, SQL queries for unqualified addresses or addresses in
non-matching domains are suppressed and return no results.
- This parameter is available with Postfix 2.2. In prior releases
- the SQL query was built from the separate parameters:
- <b>select_field</b>, <b>table</b>, <b>where_field</b> and <b>additional_conditions</b>. The
+ This parameter is available with Postfix 2.2. In prior releases
+ the SQL query was built from the separate parameters:
+ <b>select_field</b>, <b>table</b>, <b>where_field</b> and <b>additional_conditions</b>. The
mapping from the old parameters to the equivalent query is:
SELECT [<b>select_field</b>]
@@ -121,50 +96,50 @@ SQLITE_TABLE(5) SQLITE_TABLE(5)
WHERE [<b>where_field</b>] = '%s'
[<b>additional_conditions</b>]
- The '%s' in the <b>WHERE</b> clause expands to the escaped search
- string. With Postfix 2.2 these legacy parameters are used if
+ The '%s' in the <b>WHERE</b> clause expands to the escaped search
+ string. With Postfix 2.2 these legacy parameters are used if
the <b>query</b> parameter is not specified.
NOTE: DO NOT put quotes around the query parameter.
<b>result_format (default: %s</b>)
Format template applied to result attributes. Most commonly used
- to append (or prepend) text to the result. This parameter sup-
+ to append (or prepend) text to the result. This parameter sup-
ports the following '%' expansions:
<b>%%</b> This is replaced by a literal '%' character.
- <b>%s</b> This is replaced by the value of the result attribute.
+ <b>%s</b> This is replaced by the value of the result attribute.
When result is empty it is skipped.
<b>%u</b> When the result attribute value is an address of the form
- user@domain, <b>%u</b> is replaced by the local part of the
- address. When the result has an empty localpart it is
+ user@domain, <b>%u</b> is replaced by the local part of the
+ address. When the result has an empty localpart it is
skipped.
- <b>%d</b> When a result attribute value is an address of the form
- user@domain, <b>%d</b> is replaced by the domain part of the
- attribute value. When the result is unqualified it is
+ <b>%d</b> When a result attribute value is an address of the form
+ user@domain, <b>%d</b> is replaced by the domain part of the
+ attribute value. When the result is unqualified it is
skipped.
<b>%[SUD1-9]</b>
- The upper-case and decimal digit expansions interpolate
- the parts of the input key rather than the result. Their
- behavior is identical to that described with <b>query</b>, and
- in fact because the input key is known in advance,
- queries whose key does not contain all the information
- specified in the result template are suppressed and
+ The upper-case and decimal digit expansions interpolate
+ the parts of the input key rather than the result. Their
+ behavior is identical to that described with <b>query</b>, and
+ in fact because the input key is known in advance,
+ queries whose key does not contain all the information
+ specified in the result template are suppressed and
return no results.
For example, using "result_format = <a href="smtp.8.html">smtp</a>:[%s]" allows one to use
a mailHost attribute as the basis of a <a href="transport.5.html">transport(5)</a> table. After
- applying the result format, multiple values are concatenated as
+ applying the result format, multiple values are concatenated as
comma separated strings. The expansion_limit and parameter
- explained below allows one to restrict the number of values in
+ explained below allows one to restrict the number of values in
the result, which is especially useful for maps that must return
at most one value.
- The default value <b>%s</b> specifies that each result value should be
+ The default value <b>%s</b> specifies that each result value should be
used as is.
This parameter is available with Postfix 2.2 and later.
@@ -173,14 +148,14 @@ SQLITE_TABLE(5) SQLITE_TABLE(5)
<b>domain (default: no domain list)</b>
This is a list of domain names, paths to files, or dictionaries.
- When specified, only fully qualified search keys with a
- *non-empty* localpart and a matching domain are eligible for
+ When specified, only fully qualified search keys with a
+ *non-empty* localpart and a matching domain are eligible for
lookup: 'user' lookups, bare domain lookups and "@domain"
- lookups are not performed. This can significantly reduce the
+ lookups are not performed. This can significantly reduce the
query load on the SQLite server.
domain = postfix.org, <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/searchdomains
- It is best not to use SQL to store the domains eligible for SQL
+ It is best not to use SQL to store the domains eligible for SQL
lookups.
This parameter is available with Postfix 2.2 and later.
@@ -189,20 +164,29 @@ SQLITE_TABLE(5) SQLITE_TABLE(5)
the input keys are always unqualified.
<b>expansion_limit (default: 0)</b>
- A limit on the total number of result elements returned (as a
+ A limit on the total number of result elements returned (as a
comma separated list) by a lookup against the map. A setting of
- zero disables the limit. Lookups fail with a temporary error if
- the limit is exceeded. Setting the limit to 1 ensures that
+ zero disables the limit. Lookups fail with a temporary error if
+ the limit is exceeded. Setting the limit to 1 ensures that
lookups do not return multiple values.
+<b>OBSOLETE MAIN.CF PARAMETERS</b>
+ For compatibility with other Postfix lookup tables, SQLite parameters
+ can also be defined in <a href="postconf.5.html">main.cf</a>. In order to do that, specify as SQLite
+ source a name that doesn't begin with a slash or a dot. The SQLite
+ parameters will then be accessible as the name you've given the source
+ in its definition, an underscore, and the name of the parameter. For
+ example, if the map is specified as "<a href="sqlite_table.5.html">sqlite</a>:<i>sqlitename</i>", the parameter
+ "query" would be defined in <a href="postconf.5.html">main.cf</a> as "<i>sqlitename</i>_query".
+
<b>OBSOLETE QUERY INTERFACE</b>
- This section describes an interface that is deprecated as of Postfix
- 2.2. It is replaced by the more general <b>query</b> interface described
- above. If the <b>query</b> parameter is defined, the legacy parameters
- described here ignored. Please migrate to the new interface as the
+ This section describes an interface that is deprecated as of Postfix
+ 2.2. It is replaced by the more general <b>query</b> interface described
+ above. If the <b>query</b> parameter is defined, the legacy parameters
+ described here ignored. Please migrate to the new interface as the
legacy interface may be removed in a future release.
- The following parameters can be used to fill in a SELECT template
+ The following parameters can be used to fill in a SELECT template
statement of the form:
SELECT [<b>select_field</b>]
@@ -211,7 +195,7 @@ SQLITE_TABLE(5) SQLITE_TABLE(5)
[<b>additional_conditions</b>]
The specifier %s is replaced by the search string, and is escaped so if
- it contains single quotes or other odd characters, it will not cause a
+ it contains single quotes or other odd characters, it will not cause a
parse error, or worse, a security problem.
<b>select_field</b>
diff --git a/external/ibm-public/postfix/dist/html/tcp_table.5.html b/external/ibm-public/postfix/dist/html/tcp_table.5.html
index 3fa2e9b46ea..ea8291e5f38 100644
--- a/external/ibm-public/postfix/dist/html/tcp_table.5.html
+++ b/external/ibm-public/postfix/dist/html/tcp_table.5.html
@@ -34,14 +34,17 @@ TCP_TABLE(5) TCP_TABLE(5)
Send and receive operations must complete in 100 seconds.
<b>REQUEST FORMAT</b>
- Each request specifies a command, a lookup key, and possibly a lookup
- result.
+ The tcp_table protocol supports only the lookup request. The request
+ has the following form:
<b>get</b> SPACE <i>key</i> NEWLINE
Look up data under the specified key.
- <b>put</b> SPACE <i>key</i> SPACE <i>value</i> NEWLINE
- This request is currently not implemented.
+ Postfix will not generate partial search keys such as domain names
+ without one or more subdomains, network addresses without one or more
+ least-significant octets, or email addresses without the localpart,
+ address extension or domain portion. This behavior is also found with
+ <a href="cidr_table.5.html">cidr</a>:, <a href="pcre_table.5.html">pcre</a>:, and <a href="regexp_table.5.html">regexp</a>: tables.
<b>REPLY FORMAT</b>
Each reply specifies a status code and text. Replies must be no longer
@@ -49,8 +52,7 @@ TCP_TABLE(5) TCP_TABLE(5)
<b>500</b> SPACE <i>text</i> NEWLINE
In case of a lookup request, the requested data does not exist.
- In case of an update request, the request was rejected. The
- text describes the nature of the problem.
+ The text describes the nature of the problem.
<b>400</b> SPACE <i>text</i> NEWLINE
This indicates an error condition. The text describes the nature
@@ -61,24 +63,24 @@ TCP_TABLE(5) TCP_TABLE(5)
text contains an encoded version of the requested data.
<b>ENCODING</b>
- In request and reply parameters, the character %, each non-printing
+ In request and reply parameters, the character %, each non-printing
character, and each whitespace character must be replaced by %XX, where
XX is the corresponding ASCII hexadecimal character value. The hexadec-
imal codes can be specified in any case (upper, lower, mixed).
- The Postfix client always encodes a request. The server may omit the
- encoding as long as the reply is guaranteed to not contain the % or
+ The Postfix client always encodes a request. The server may omit the
+ encoding as long as the reply is guaranteed to not contain the % or
NEWLINE character.
<b>SECURITY</b>
- Do not use TCP lookup tables for security critical purposes. The
+ Do not use TCP lookup tables for security critical purposes. The
client-server connection is not protected and the server is not authen-
ticated.
<b>BUGS</b>
Only the lookup method is currently implemented.
- The client does not hang up when the connection is idle for a long
+ The client does not hang up when the connection is idle for a long
time.
<b>SEE ALSO</b>
diff --git a/external/ibm-public/postfix/dist/html/tlsmgr.8.html b/external/ibm-public/postfix/dist/html/tlsmgr.8.html
index c1810230e68..7f3ac18737a 100644
--- a/external/ibm-public/postfix/dist/html/tlsmgr.8.html
+++ b/external/ibm-public/postfix/dist/html/tlsmgr.8.html
@@ -50,7 +50,7 @@ TLSMGR(8) TLSMGR(8)
Postfix-owned <b><a href="postconf.5.html#data_directory">data_directory</a></b>, and a warning is logged.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to the syslog daemon.
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
There is no automatic means to limit the number of entries in the TLS
@@ -146,9 +146,13 @@ TLSMGR(8) TLSMGR(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="smtp.8.html">smtp(8)</a>, Postfix SMTP client
@@ -156,6 +160,7 @@ TLSMGR(8) TLSMGR(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/tlsproxy.8.html b/external/ibm-public/postfix/dist/html/tlsproxy.8.html
index d9125667805..4e43ee2b45d 100644
--- a/external/ibm-public/postfix/dist/html/tlsproxy.8.html
+++ b/external/ibm-public/postfix/dist/html/tlsproxy.8.html
@@ -13,61 +13,164 @@ TLSPROXY(8) TLSPROXY(8)
<b>tlsproxy</b> [generic Postfix daemon options]
<b>DESCRIPTION</b>
- The <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server implements a server-side TLS proxy. It is used
- by <a href="postscreen.8.html"><b>postscreen</b>(8)</a> to talk SMTP-over-TLS with remote SMTP clients that
- are not whitelisted (including clients whose whitelist status has
- expired), but it should also work for non-SMTP protocols.
-
- Although one <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> process can serve multiple sessions at the
- same time, it is a good idea to allow the number of processes to
+ The <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server implements a two-way TLS proxy. It is used by
+ the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server to talk SMTP-over-TLS with remote SMTP clients
+ that are not whitelisted (including clients whose whitelist status has
+ expired), and by the <a href="smtp.8.html"><b>smtp</b>(8)</a> client to support TLS connection reuse,
+ but it should also work for non-SMTP protocols.
+
+ Although one <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> process can serve multiple sessions at the
+ same time, it is a good idea to allow the number of processes to
increase with load, so that the service remains responsive.
<b>PROTOCOL EXAMPLE</b>
- The example below concerns <a href="postscreen.8.html"><b>postscreen</b>(8)</a>. However, the <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>
+ The example below concerns <a href="postscreen.8.html"><b>postscreen</b>(8)</a>. However, the <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>
server is agnostic of the application protocol, and the example is eas-
ily adapted to other applications.
- After receiving a valid remote SMTP client STARTTLS command, the
- <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server sends the remote SMTP client endpoint string, the
- requested role (server), and the requested timeout to <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>.
- <a href="postscreen.8.html"><b>postscreen</b>(8)</a> then receives a "TLS available" indication from
- <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>. If the TLS service is available, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> sends the
+ After receiving a valid remote SMTP client STARTTLS command, the
+ <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server sends the remote SMTP client endpoint string, the
+ requested role (server), and the requested timeout to <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>.
+ <a href="postscreen.8.html"><b>postscreen</b>(8)</a> then receives a "TLS available" indication from
+ <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>. If the TLS service is available, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> sends the
remote SMTP client file descriptor to <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>, and sends the plain-
text 220 greeting to the remote SMTP client. This triggers TLS negoti-
ations between the remote SMTP client and <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>. Upon completion
- of the TLS-level handshake, <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> translates between plaintext
+ of the TLS-level handshake, <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> translates between plaintext
from/to <a href="postscreen.8.html"><b>postscreen</b>(8)</a> and ciphertext to/from the remote SMTP client.
<b>SECURITY</b>
- The <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server is moderately security-sensitive. It talks to
- untrusted clients on the network. The process can be run chrooted at
+ The <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server is moderately security-sensitive. It talks to
+ untrusted clients on the network. The process can be run chrooted at
fixed low privilege.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>CONFIGURATION PARAMETERS</b>
Changes to <a href="postconf.5.html"><b>main.cf</b></a> are not picked up automatically, as <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> pro-
- cesses may run for a long time depending on mail server load. Use the
+ cesses may run for a long time depending on mail server load. Use the
command "<b>postfix reload</b>" to speed up a change.
- The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
+ The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
more details including examples.
-<b>STARTTLS SUPPORT CONTROLS</b>
+<b>STARTTLS GLOBAL CONTROLS</b>
+ The following settings are global and therefore cannot be overruled by
+ information specified in a <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client request.
+
+ <b><a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> (no)</b>
+ Append the system-supplied default Certification Authority cer-
+ tificates to the ones specified with *_tls_CApath or
+ *_tls_CAfile.
+
+ <b><a href="postconf.5.html#tls_daemon_random_bytes">tls_daemon_random_bytes</a> (32)</b>
+ The number of pseudo-random bytes that an <a href="smtp.8.html"><b>smtp</b>(8)</a> or <a href="smtpd.8.html"><b>smtpd</b>(8)</a>
+ process requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed its
+ internal pseudo random number generator (PRNG).
+
+ <b><a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> (see 'postconf -d' output)</b>
+ The OpenSSL cipherlist for "high" grade ciphers.
+
+ <b><a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> (see 'postconf -d' output)</b>
+ The OpenSSL cipherlist for "medium" or higher grade ciphers.
+
+ <b><a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> (see 'postconf -d' output)</b>
+ The OpenSSL cipherlist for "low" or higher grade ciphers.
+
+ <b><a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> (see 'postconf -d' output)</b>
+ The OpenSSL cipherlist for "export" or higher grade ciphers.
+
+ <b><a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> (eNULL:!aNULL)</b>
+ The OpenSSL cipherlist for "NULL" grade ciphers that provide
+ authentication without encryption.
+
+ <b><a href="postconf.5.html#tls_eecdh_strong_curve">tls_eecdh_strong_curve</a> (prime256v1)</b>
+ The elliptic curve used by the Postfix SMTP server for sensibly
+ strong ephemeral ECDH key exchange.
+
+ <b><a href="postconf.5.html#tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a> (secp384r1)</b>
+ The elliptic curve used by the Postfix SMTP server for maximally
+ strong ephemeral ECDH key exchange.
+
+ <b><a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> (see 'postconf -d' output)</b>
+ List or bit-mask of OpenSSL bug work-arounds to disable.
+
+ <b><a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> (no)</b>
+ With SSLv3 and later, use the Postfix SMTP server's cipher pref-
+ erence order instead of the remote client's cipher preference
+ order.
+
+ Available in Postfix version 2.9 and later:
+
+ <b><a href="postconf.5.html#tls_legacy_public_key_fingerprint">tls_legacy_public_key_fingerprints</a> (no)</b>
+ A temporary migration aid for sites that use certificate <i>pub-</i>
+ <i>lic-key</i> fingerprints with Postfix 2.9.0..2.9.5, which use an
+ incorrect algorithm.
+
+ Available in Postfix version 2.11-3.1:
+
+ <b><a href="postconf.5.html#tls_dane_digest_agility">tls_dane_digest_agility</a> (on)</b>
+ Configure <a href="http://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility.
+
+ <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b>
+ Enable support for <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain
+ digests of trust-anchors with certificate usage "2".
+
+ Available in Postfix version 2.11 and later:
+
+ <b><a href="postconf.5.html#tlsmgr_service_name">tlsmgr_service_name</a> (tlsmgr)</b>
+ The name of the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>.
+
+ Available in Postfix version 3.0 and later:
+
+ <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a> (Postfix</b> &gt;<b>= 3.0: aes-256-cbc, Postfix</b> &lt; <b>3.0:</b>
+ <b>aes-128-cbc)</b>
+ Algorithm used to encrypt <a href="http://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets.
+
+ <b><a href="postconf.5.html#openssl_path">openssl_path</a> (openssl)</b>
+ The location of the OpenSSL command line program <b>openssl</b>(1).
+
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> (see 'postconf -d' output)</b>
+ The prioritized list of elliptic curves supported by the Postfix
+ SMTP client and server.
+
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#tls_server_sni_maps">tls_server_sni_maps</a> (empty)</b>
+ Optional lookup tables that map names received from remote SMTP
+ clients via the TLS Server Name Indication (SNI) extension to
+ the appropriate keys and certificate chains.
+
+ Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later:
+
+ <b><a href="postconf.5.html#tls_fast_shutdown_enable">tls_fast_shutdown_enable</a> (yes)</b>
+ A workaround for implementations that hang Postfix while shut-
+ ting down a TLS session, until Postfix times out.
+
+<b>STARTTLS SERVER CONTROLS</b>
+ These settings are clones of Postfix SMTP server settings. They allow
+ <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> to load the same certificate and private key information as
+ the Postfix SMTP server, before dropping privileges, so that the key
+ files can be kept read-only for root. These settings can currently not
+ be overruled by information in a <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client request, but that
+ limitation may be removed in a future version.
+
<b><a href="postconf.5.html#tlsproxy_tls_CAfile">tlsproxy_tls_CAfile</a> ($<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)</b>
- A file containing (PEM format) CA certificates of root CAs
+ A file containing (PEM format) CA certificates of root CAs
trusted to sign either remote SMTP client certificates or inter-
mediate CA certificates.
<b><a href="postconf.5.html#tlsproxy_tls_CApath">tlsproxy_tls_CApath</a> ($<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>)</b>
- A directory containing (PEM format) CA certificates of root CAs
+ A directory containing (PEM format) CA certificates of root CAs
trusted to sign either remote SMTP client certificates or inter-
mediate CA certificates.
<b><a href="postconf.5.html#tlsproxy_tls_always_issue_session_ids">tlsproxy_tls_always_issue_session_ids</a> ($<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_ses</a>-</b>
<b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">sion_ids</a>)</b>
- Force the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server to issue a TLS session id,
+ Force the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server to issue a TLS session id,
even when TLS session caching is turned off.
<b><a href="postconf.5.html#tlsproxy_tls_ask_ccert">tlsproxy_tls_ask_ccert</a> ($<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>)</b>
@@ -77,7 +180,7 @@ TLSPROXY(8) TLSPROXY(8)
The verification depth for remote SMTP client certificates.
<b><a href="postconf.5.html#tlsproxy_tls_cert_file">tlsproxy_tls_cert_file</a> ($<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b>
- File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server RSA certificate in PEM
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server RSA certificate in PEM
format.
<b><a href="postconf.5.html#tlsproxy_tls_ciphers">tlsproxy_tls_ciphers</a> ($<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>)</b>
@@ -85,47 +188,47 @@ TLSPROXY(8) TLSPROXY(8)
will use with opportunistic TLS encryption.
<b><a href="postconf.5.html#tlsproxy_tls_dcert_file">tlsproxy_tls_dcert_file</a> ($<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b>
- File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server DSA certificate in PEM
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server DSA certificate in PEM
format.
<b><a href="postconf.5.html#tlsproxy_tls_dh1024_param_file">tlsproxy_tls_dh1024_param_file</a> ($<a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>)</b>
- File with DH parameters that the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server
+ File with DH parameters that the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server
should use with non-export EDH ciphers.
<b><a href="postconf.5.html#tlsproxy_tls_dh512_param_file">tlsproxy_tls_dh512_param_file</a> ($<a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>)</b>
- File with DH parameters that the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server
+ File with DH parameters that the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server
should use with export-grade EDH ciphers.
<b><a href="postconf.5.html#tlsproxy_tls_dkey_file">tlsproxy_tls_dkey_file</a> ($<a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>)</b>
- File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server DSA private key in PEM
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server DSA private key in PEM
format.
<b><a href="postconf.5.html#tlsproxy_tls_eccert_file">tlsproxy_tls_eccert_file</a> ($<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b>
- File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server ECDSA certificate in
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server ECDSA certificate in
PEM format.
<b><a href="postconf.5.html#tlsproxy_tls_eckey_file">tlsproxy_tls_eckey_file</a> ($<a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>)</b>
- File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server ECDSA private key in
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server ECDSA private key in
PEM format.
<b><a href="postconf.5.html#tlsproxy_tls_eecdh_grade">tlsproxy_tls_eecdh_grade</a> ($<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>)</b>
- The Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server security grade for ephemeral
+ The Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server security grade for ephemeral
elliptic-curve Diffie-Hellman (EECDH) key exchange.
<b><a href="postconf.5.html#tlsproxy_tls_exclude_ciphers">tlsproxy_tls_exclude_ciphers</a> ($<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>)</b>
- List of ciphers or cipher types to exclude from the <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>
+ List of ciphers or cipher types to exclude from the <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>
server cipher list at all TLS security levels.
<b><a href="postconf.5.html#tlsproxy_tls_fingerprint_digest">tlsproxy_tls_fingerprint_digest</a> ($<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>)</b>
- The message digest algorithm to construct remote SMTP
+ The message digest algorithm to construct remote SMTP
client-certificate fingerprints.
<b><a href="postconf.5.html#tlsproxy_tls_key_file">tlsproxy_tls_key_file</a> ($<a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a>)</b>
- File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server RSA private key in PEM
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server RSA private key in PEM
format.
<b><a href="postconf.5.html#tlsproxy_tls_loglevel">tlsproxy_tls_loglevel</a> ($<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a>)</b>
- Enable additional Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server logging of TLS
+ Enable additional Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server logging of TLS
activity.
<b><a href="postconf.5.html#tlsproxy_tls_mandatory_ciphers">tlsproxy_tls_mandatory_ciphers</a> ($<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>)</b>
@@ -134,7 +237,7 @@ TLSPROXY(8) TLSPROXY(8)
<b><a href="postconf.5.html#tlsproxy_tls_mandatory_exclude_ciphers">tlsproxy_tls_mandatory_exclude_ciphers</a> ($<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_manda</a>-</b>
<b><a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">tory_exclude_ciphers</a>)</b>
- Additional list of ciphers or cipher types to exclude from the
+ Additional list of ciphers or cipher types to exclude from the
<a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server cipher list at mandatory TLS security levels.
<b><a href="postconf.5.html#tlsproxy_tls_mandatory_protocols">tlsproxy_tls_mandatory_protocols</a> ($<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>)</b>
@@ -142,22 +245,103 @@ TLSPROXY(8) TLSPROXY(8)
with mandatory TLS encryption.
<b><a href="postconf.5.html#tlsproxy_tls_protocols">tlsproxy_tls_protocols</a> ($<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a>)</b>
- List of TLS protocols that the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server will
+ List of TLS protocols that the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server will
exclude or include with opportunistic TLS encryption.
<b><a href="postconf.5.html#tlsproxy_tls_req_ccert">tlsproxy_tls_req_ccert</a> ($<a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>)</b>
- With mandatory TLS encryption, require a trusted remote SMTP
+ With mandatory TLS encryption, require a trusted remote SMTP
client certificate in order to allow TLS connections to proceed.
<b><a href="postconf.5.html#tlsproxy_tls_security_level">tlsproxy_tls_security_level</a> ($<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b>
- The SMTP TLS security level for the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server;
+ The SMTP TLS security level for the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server;
when a non-empty value is specified, this overrides the obsolete
parameters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>.
- Available in Postfix version 2.11 and later:
+ <b><a href="postconf.5.html#tlsproxy_tls_chain_files">tlsproxy_tls_chain_files</a> ($<a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a>)</b>
+ Files with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> server keys and certificate
+ chains in PEM format.
- <b><a href="postconf.5.html#tlsmgr_service_name">tlsmgr_service_name</a> (tlsmgr)</b>
- The name of the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>.
+<b>STARTTLS CLIENT CONTROLS</b>
+ These settings are clones of Postfix SMTP client settings. They allow
+ <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> to load the same certificate and private key information as
+ the Postfix SMTP client, before dropping privileges, so that the key
+ files can be kept read-only for root. Some settings may be overruled by
+ information in a <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client request.
+
+ Available in Postfix version 3.4 and later:
+
+ <b><a href="postconf.5.html#tlsproxy_client_CAfile">tlsproxy_client_CAfile</a> ($<a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>)</b>
+ A file containing CA certificates of root CAs trusted to sign
+ either remote TLS server certificates or intermediate CA cer-
+ tificates.
+
+ <b><a href="postconf.5.html#tlsproxy_client_CApath">tlsproxy_client_CApath</a> ($<a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a>)</b>
+ Directory with PEM format Certification Authority certificates
+ that the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client uses to verify a remote TLS
+ server certificate.
+
+ <b><a href="postconf.5.html#tlsproxy_client_chain_files">tlsproxy_client_chain_files</a> ($<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a>)</b>
+ Files with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client keys and certificate
+ chains in PEM format.
+
+ <b><a href="postconf.5.html#tlsproxy_client_cert_file">tlsproxy_client_cert_file</a> ($<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>)</b>
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client RSA certificate in PEM
+ format.
+
+ <b><a href="postconf.5.html#tlsproxy_client_key_file">tlsproxy_client_key_file</a> ($<a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a>)</b>
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client RSA private key in PEM
+ format.
+
+ <b><a href="postconf.5.html#tlsproxy_client_dcert_file">tlsproxy_client_dcert_file</a> ($<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>)</b>
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client DSA certificate in PEM
+ format.
+
+ <b><a href="postconf.5.html#tlsproxy_client_dkey_file">tlsproxy_client_dkey_file</a> ($<a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a>)</b>
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client DSA private key in PEM
+ format.
+
+ <b><a href="postconf.5.html#tlsproxy_client_eccert_file">tlsproxy_client_eccert_file</a> ($<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>)</b>
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client ECDSA certificate in
+ PEM format.
+
+ <b><a href="postconf.5.html#tlsproxy_client_eckey_file">tlsproxy_client_eckey_file</a> ($<a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a>)</b>
+ File with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client ECDSA private key in
+ PEM format.
+
+ <b><a href="postconf.5.html#tlsproxy_client_fingerprint_digest">tlsproxy_client_fingerprint_digest</a> ($<a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>)</b>
+ The message digest algorithm used to construct remote TLS server
+ certificate fingerprints.
+
+ <b><a href="postconf.5.html#tlsproxy_client_loglevel">tlsproxy_client_loglevel</a> ($<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a>)</b>
+ Enable additional Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client logging of TLS
+ activity.
+
+ <b><a href="postconf.5.html#tlsproxy_client_loglevel_parameter">tlsproxy_client_loglevel_parameter</a> (<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a>)</b>
+ The name of the parameter that provides the
+ <a href="postconf.5.html#tlsproxy_client_loglevel">tlsproxy_client_loglevel</a> value.
+
+ <b><a href="postconf.5.html#tlsproxy_client_scert_verifydepth">tlsproxy_client_scert_verifydepth</a> ($<a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>)</b>
+ The verification depth for remote TLS server certificates.
+
+ <b><a href="postconf.5.html#tlsproxy_client_security_level">tlsproxy_client_security_level</a> ($<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a>)</b>
+ The default TLS security level for the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a>
+ client.
+
+ <b><a href="postconf.5.html#tlsproxy_client_policy_maps">tlsproxy_client_policy_maps</a> ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>)</b>
+ Optional lookup tables with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client TLS
+ security policy by next-hop destination.
+
+ <b><a href="postconf.5.html#tlsproxy_client_use_tls">tlsproxy_client_use_tls</a> ($<a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>)</b>
+ Opportunistic mode: use TLS when a remote server announces TLS
+ support.
+
+ <b><a href="postconf.5.html#tlsproxy_client_enforce_tls">tlsproxy_client_enforce_tls</a> ($<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>)</b>
+ Enforcement mode: require that SMTP servers use TLS encryption.
+
+ <b><a href="postconf.5.html#tlsproxy_client_per_site">tlsproxy_client_per_site</a> ($<a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a>)</b>
+ Optional lookup tables with the Postfix <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> client TLS
+ usage policy by next-hop destination and by remote TLS server
+ hostname.
<b>OBSOLETE STARTTLS SUPPORT CONTROLS</b>
These parameters are supported for compatibility with <a href="smtpd.8.html"><b>smtpd</b>(8)</a> legacy
@@ -191,15 +375,20 @@ TLSPROXY(8) TLSPROXY(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="postscreen.8.html">postscreen(8)</a>, Postfix zombie blocker
<a href="smtpd.8.html">smtpd(8)</a>, Postfix SMTP server
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
- syslogd(5), system logging
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
+ syslogd(8), system logging
<b>LICENSE</b>
The Secure Mailer license must be distributed with this software.
diff --git a/external/ibm-public/postfix/dist/html/trace.8.html b/external/ibm-public/postfix/dist/html/trace.8.html
index afe41dae75d..67801211a20 100644
--- a/external/ibm-public/postfix/dist/html/trace.8.html
+++ b/external/ibm-public/postfix/dist/html/trace.8.html
@@ -51,7 +51,7 @@ BOUNCE(8) BOUNCE(8)
<a href="http://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications)
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>CONFIGURATION PARAMETERS</b>
Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="bounce.8.html"><b>bounce</b>(8)</a> processes
@@ -139,16 +139,20 @@ BOUNCE(8) BOUNCE(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix 3.0 and later:
<b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b>
- Detect that a message requires SMTPUTF8 support for the speci-
+ Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>FILES</b>
/var/spool/postfix/bounce/* non-delivery records
/var/spool/postfix/defer/* non-delivery records
@@ -160,6 +164,7 @@ BOUNCE(8) BOUNCE(8)
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="master.5.html">master(5)</a>, generic daemon options
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>LICENSE</b>
diff --git a/external/ibm-public/postfix/dist/html/transport.5.html b/external/ibm-public/postfix/dist/html/transport.5.html
index b1771abac16..05da59f70c1 100644
--- a/external/ibm-public/postfix/dist/html/transport.5.html
+++ b/external/ibm-public/postfix/dist/html/transport.5.html
@@ -134,13 +134,17 @@ TRANSPORT(5) TRANSPORT(5)
(the first name of a mail delivery service entry in the Postfix <a href="master.5.html"><b>mas-</b>
<b>ter.cf</b></a> file).
- The interpretation of the nexthop field is transport dependent. In the
- case of SMTP, specify a service on a non-default port as <i>host</i>:<i>service</i>,
- and disable MX (mail exchanger) DNS lookups with [<i>host</i>] or [<i>host</i>]:<i>port</i>.
- The [] form is required when you specify an IP address instead of a
- hostname.
+ The nexthop field usually specifies one recipient domain or hostname.
+ In the case of the Postfix SMTP/LMTP client, the nexthop field may con-
+ tain a list of nexthop destinations separated by comma or whitespace
+ (Postfix 3.5 and later).
- A null <i>transport</i> and null <i>nexthop</i> result means "do not change": use the
+ The syntax of a nexthop destination is transport dependent. With SMTP,
+ specify a service on a non-default port as <i>host</i>:<i>service</i>, and disable MX
+ (mail exchanger) DNS lookups with [<i>host</i>] or [<i>host</i>]:<i>port</i>. The [] form is
+ required when you specify an IP address instead of a hostname.
+
+ A null <i>transport</i> and null <i>nexthop</i> field means "do not change": use the
delivery transport and nexthop information that would be used when the
entire transport table did not exist.
@@ -185,7 +189,7 @@ TRANSPORT(5) TRANSPORT(5)
In the above example, the [] suppress MX lookups. This prevents mail
routing loops when your machine is primary MX host for <b>example.com</b>.
- In the case of delivery via SMTP, one may specify <i>hostname</i>:<i>service</i>
+ In the case of delivery via SMTP or LMTP, one may specify <i>host</i>:<i>service</i>
instead of just a host:
<b>example.com <a href="smtp.8.html">smtp</a>:bar.example:2025</b>
@@ -194,6 +198,14 @@ TRANSPORT(5) TRANSPORT(5)
Instead of a numerical port a symbolic name may be used. Specify []
around the hostname if MX lookups must be disabled.
+ Deliveries via SMTP or LMTP support multiple destinations (Postfix &gt;=
+ 3.5):
+
+ <b>example.com <a href="smtp.8.html">smtp</a>:bar.example, foo.example</b>
+
+ This tries to deliver to <b>bar.example</b> before trying to deliver to
+ <b>foo.example</b>.
+
The error mailer can be used to bounce mail:
<b>.example.com <a href="error.8.html">error</a>:mail for *.example.com is not deliverable</b>
@@ -234,16 +246,17 @@ TRANSPORT(5) TRANSPORT(5)
below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more
details including examples.
- <b><a href="postconf.5.html#empty_address_recipient">empty_address_recipient</a></b>
- The address that is looked up instead of the null sender
- address.
+ <b><a href="postconf.5.html#empty_address_recipient">empty_address_recipient</a> (MAILER-DAEMON)</b>
+ The recipient of mail addressed to the null address.
- <b><a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a></b>
- List of Postfix features that use <i>domain.tld</i> patterns to match
- <i>sub.domain.tld</i> (as opposed to requiring <i>.domain.tld</i> patterns).
+ <b><a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> (see 'postconf -d' output)</b>
+ A list of Postfix features where the pattern "example.com" also
+ matches subdomains of example.com, instead of requiring an
+ explicit ".example.com" pattern.
- <b><a href="postconf.5.html#transport_maps">transport_maps</a></b>
- List of transport lookup tables.
+ <b><a href="postconf.5.html#transport_maps">transport_maps</a> (empty)</b>
+ Optional lookup tables with mappings from recipient address to
+ (message delivery transport, next-hop destination).
<b>SEE ALSO</b>
<a href="trivial-rewrite.8.html">trivial-rewrite(8)</a>, rewrite and resolve addresses
diff --git a/external/ibm-public/postfix/dist/html/trivial-rewrite.8.html b/external/ibm-public/postfix/dist/html/trivial-rewrite.8.html
index e4a4cd6ddcb..d5e2fdc1f18 100644
--- a/external/ibm-public/postfix/dist/html/trivial-rewrite.8.html
+++ b/external/ibm-public/postfix/dist/html/trivial-rewrite.8.html
@@ -73,7 +73,7 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8)
fixed low privilege in a chrooted environment.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>CONFIGURATION PARAMETERS</b>
On busy mail systems a long time may pass before a <a href="postconf.5.html"><b>main.cf</b></a> change
@@ -289,21 +289,26 @@ TRIVIAL-REWRITE(8) TRIVIAL-REWRITE(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 2.0 and later:
<b><a href="postconf.5.html#helpful_warnings">helpful_warnings</a> (yes)</b>
- Log warnings about problematic configuration settings, and pro-
+ Log warnings about problematic configuration settings, and pro-
vide helpful suggestions.
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
<b>SEE ALSO</b>
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
<a href="transport.5.html">transport(5)</a>, transport table format
<a href="relocated.5.html">relocated(5)</a>, format of the "user has moved" table
<a href="master.8.html">master(8)</a>, process manager
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README FILES</b>
diff --git a/external/ibm-public/postfix/dist/html/verify.8.html b/external/ibm-public/postfix/dist/html/verify.8.html
index fa605f0fe19..f1805b01ae3 100644
--- a/external/ibm-public/postfix/dist/html/verify.8.html
+++ b/external/ibm-public/postfix/dist/html/verify.8.html
@@ -58,7 +58,7 @@ VERIFY(8) VERIFY(8)
warning is logged.
<b>DIAGNOSTICS</b>
- Problems and transactions are logged to <b>syslogd</b>(8).
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
<b>BUGS</b>
Address verification probe messages add additional traffic to the mail
@@ -169,6 +169,13 @@ VERIFY(8) VERIFY(8)
Detect that a message requires SMTPUTF8 support for the speci-
fied mail origin classes.
+ Available in Postfix version 3.2 and later:
+
+ <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b>
+ Enable 'transitional' compatibility between IDNA2003 and
+ IDNA2008, when converting UTF-8 domain names to/from the ASCII
+ form that is used for DNS lookups.
+
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
@@ -195,15 +202,20 @@ VERIFY(8) VERIFY(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
+
+ Available in Postfix 3.3 and later:
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
<b>SEE ALSO</b>
<a href="smtpd.8.html">smtpd(8)</a>, Postfix SMTP server
<a href="cleanup.8.html">cleanup(8)</a>, enqueue Postfix message
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
- syslogd(5), system logging
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
+ syslogd(8), system logging
<b>README FILES</b>
<a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a>, address verification howto
diff --git a/external/ibm-public/postfix/dist/html/virtual.5.html b/external/ibm-public/postfix/dist/html/virtual.5.html
index b5f6a952691..97e7e5e3e13 100644
--- a/external/ibm-public/postfix/dist/html/virtual.5.html
+++ b/external/ibm-public/postfix/dist/html/virtual.5.html
@@ -77,33 +77,50 @@ VIRTUAL(5) VIRTUAL(5)
<b>TABLE SEARCH ORDER</b>
With lookups from indexed files such as DB or DBM, or from networked
- tables such as NIS, LDAP or SQL, patterns are tried in the order as
- listed below:
+ tables such as NIS, LDAP or SQL, each <i>user</i>@<i>domain</i> query produces a
+ sequence of query patterns as described below.
+
+ Each query pattern is sent to each specified lookup table before trying
+ the next query pattern, until a match is found.
<i>user</i>@<i>domain address, address, ...</i>
- Redirect mail for <i>user</i>@<i>domain</i> to <i>address</i>. This form has the
+ Redirect mail for <i>user</i>@<i>domain</i> to <i>address</i>. This form has the
highest precedence.
<i>user address, address, ...</i>
- Redirect mail for <i>user</i>@<i>site</i> to <i>address</i> when <i>site</i> is equal to
- $<b><a href="postconf.5.html#myorigin">myorigin</a></b>, when <i>site</i> is listed in $<b><a href="postconf.5.html#mydestination">mydestination</a></b>, or when it is
+ Redirect mail for <i>user</i>@<i>site</i> to <i>address</i> when <i>site</i> is equal to
+ $<b><a href="postconf.5.html#myorigin">myorigin</a></b>, when <i>site</i> is listed in $<b><a href="postconf.5.html#mydestination">mydestination</a></b>, or when it is
listed in $<b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b> or $<b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b>.
- This functionality overlaps with functionality of the local
- <i>aliases</i>(5) database. The difference is that <a href="virtual.5.html"><b>virtual</b>(5)</a> mapping
+ This functionality overlaps with functionality of the local
+ <i>aliases</i>(5) database. The difference is that <a href="virtual.5.html"><b>virtual</b>(5)</a> mapping
can be applied to non-local addresses.
@<i>domain address, address, ...</i>
- Redirect mail for other users in <i>domain</i> to <i>address</i>. This form
+ Redirect mail for other users in <i>domain</i> to <i>address</i>. This form
has the lowest precedence.
- Note: @<i>domain</i> is a wild-card. With this form, the Postfix SMTP
- server accepts mail for any recipient in <i>domain</i>, regardless of
- whether that recipient exists. This may turn your mail system
- into a backscatter source: Postfix first accepts mail for
- non-existent recipients and then tries to return that mail as
+ Note: @<i>domain</i> is a wild-card. With this form, the Postfix SMTP
+ server accepts mail for any recipient in <i>domain</i>, regardless of
+ whether that recipient exists. This may turn your mail system
+ into a backscatter source: Postfix first accepts mail for
+ non-existent recipients and then tries to return that mail as
"undeliverable" to the often forged sender address.
+ To avoid backscatter with mail for a wild-card domain, replace
+ the wild-card mapping with explicit 1:1 mappings, or add a
+ <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> restriction for that domain:
+
+ <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
+ ...
+ <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
+ <a href="postconf.5.html#check_recipient_access">check_recipient_access</a>
+ <a href="DATABASE_README.html#types">inline</a>:{example.com=<a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>}
+ <a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> = 550
+
+ In the above example, Postfix may contact a remote server if the
+ recipient is aliased to a remote address.
+
<b>RESULT ADDRESS REWRITING</b>
The lookup result is subject to address rewriting:
@@ -208,39 +225,42 @@ VIRTUAL(5) VIRTUAL(5)
See the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file for syntax details and for default values.
Use the "<b>postfix reload</b>" command after a configuration change.
- <b><a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a></b>
- List of virtual aliasing tables.
+ <b><a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> ($<a href="postconf.5.html#virtual_maps">virtual_maps</a>)</b>
+ Optional lookup tables that alias specific mail addresses or
+ domains to other local or remote address.
- <b><a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a></b>
- List of <a href="ADDRESS_CLASS_README.html#virtual_alias_class">virtual alias domains</a>. This uses the same syntax as the
- <b><a href="postconf.5.html#mydestination">mydestination</a></b> parameter.
+ <b><a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> ($<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>)</b>
+ Postfix is final destination for the specified list of virtual
+ alias domains, that is, domains for which all addresses are
+ aliased to addresses in other local or remote domains.
- <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a></b>
- A list of address rewriting or forwarding mechanisms that propa-
- gate an address extension from the original address to the
- result. Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>, <b>for-</b>
- <b>ward</b>, <b>include</b>, or <b>generic</b>.
+ <b><a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> (canonical, virtual)</b>
+ What address lookup tables copy an address extension from the
+ lookup key to the lookup result.
Other parameters of interest:
- <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a></b>
- The network interface addresses that this system receives mail
- on. You need to stop and start Postfix when this parameter
- changes.
+ <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b>
+ The network interface addresses that this mail system receives
+ mail on.
- <b><a href="postconf.5.html#mydestination">mydestination</a></b>
- List of domains that this mail system considers local.
+ <b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b>
+ The list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a>
+ mail delivery transport.
- <b><a href="postconf.5.html#myorigin">myorigin</a></b>
- The domain that is appended to any address that does not have a
- domain.
+ <b><a href="postconf.5.html#myorigin">myorigin</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
+ The domain name that locally-posted mail appears to come from,
+ and that locally posted mail is delivered to.
- <b><a href="postconf.5.html#owner_request_special">owner_request_special</a></b>
- Give special treatment to <b>owner-</b><i>xxx</i> and <i>xxx</i><b>-request</b> addresses.
+ <b><a href="postconf.5.html#owner_request_special">owner_request_special</a> (yes)</b>
+ Enable special treatment for owner-<i>listname</i> entries in the
+ <a href="aliases.5.html"><b>aliases</b>(5)</a> file, and don't split owner-<i>listname</i> and <i>list-</i>
+ <i>name</i>-request address localparts when the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> is
+ set to "-".
- <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a></b>
- Other interfaces that this machine receives mail on by way of a
- proxy agent or network address translator.
+ <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b>
+ The network interface addresses that this mail system receives
+ mail on by way of a proxy or network address translation unit.
<b>SEE ALSO</b>
<a href="cleanup.8.html">cleanup(8)</a>, canonicalize and enqueue mail
diff --git a/external/ibm-public/postfix/dist/html/virtual.8.html b/external/ibm-public/postfix/dist/html/virtual.8.html
index c04da357be2..b15b4d492fb 100644
--- a/external/ibm-public/postfix/dist/html/virtual.8.html
+++ b/external/ibm-public/postfix/dist/html/virtual.8.html
@@ -125,9 +125,9 @@ VIRTUAL(8) VIRTUAL(8)
over disk quota. In all other cases, mail for an existing recipient is
deferred and a warning is logged.
- Problems and transactions are logged to <b>syslogd</b>(8). Corrupted message
- files are marked so that the queue manager can move them to the <b>corrupt</b>
- queue afterwards.
+ Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>.
+ Corrupted message files are marked so that the queue manager can move
+ them to the <b>corrupt</b> queue afterwards.
Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas-
ter is notified of bounces and of other trouble.
@@ -205,20 +205,22 @@ VIRTUAL(8) VIRTUAL(8)
removed.
<b>RESOURCE AND RATE CONTROLS</b>
+ <b><a href="postconf.5.html#virtual_mailbox_limit">virtual_mailbox_limit</a> (51200000)</b>
+ The maximal size in bytes of an individual <a href="virtual.8.html"><b>virtual</b>(8)</a> mailbox or
+ maildir file, or zero (no limit).
+
+ Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon:
+
<b><a href="postconf.5.html#virtual_destination_concurrency_limit">virtual_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b>
<b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b>
- The maximal number of parallel deliveries to the same destina-
+ The maximal number of parallel deliveries to the same destina-
tion via the virtual message delivery transport.
<b><a href="postconf.5.html#virtual_destination_recipient_limit">virtual_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b>
<b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b>
- The maximal number of recipients per message for the virtual
+ The maximal number of recipients per message for the virtual
message delivery transport.
- <b><a href="postconf.5.html#virtual_mailbox_limit">virtual_mailbox_limit</a> (51200000)</b>
- The maximal size in bytes of an individual <a href="virtual.8.html"><b>virtual</b>(8)</a> mailbox or
- maildir file, or zero (no limit).
-
<b>MISCELLANEOUS CONTROLS</b>
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
@@ -257,21 +259,37 @@ VIRTUAL(8) VIRTUAL(8)
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- The mail system name that is prepended to the process name in
- syslog records, so that "smtpd" becomes, for example, "post-
- fix/smtpd".
+ A prefix that is prepended to the process name in syslog
+ records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 3.0 and later:
<b><a href="postconf.5.html#virtual_delivery_status_filter">virtual_delivery_status_filter</a> ($<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b>
- Optional filter for the <a href="virtual.8.html"><b>virtual</b>(8)</a> delivery agent to change the
+ Optional filter for the <a href="virtual.8.html"><b>virtual</b>(8)</a> delivery agent to change the
delivery status code or explanatory text of successful or unsuc-
cessful deliveries.
+ Available in Postfix version 3.3 and later:
+
+ <b><a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a> (yes)</b>
+ Enable support for the original recipient address after an
+ address is rewritten to a different address (for example with
+ aliasing or with canonical mapping).
+
+ <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b>
+ The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process.
+
+ Available in Postfix 3.5 and later:
+
+ <b>info_log_address_format (external)</b>
+ The email address form that will be used in non-debug logging
+ (info, warning, etc.).
+
<b>SEE ALSO</b>
<a href="qmgr.8.html">qmgr(8)</a>, queue manager
<a href="bounce.8.html">bounce(8)</a>, delivery status reports
<a href="postconf.5.html">postconf(5)</a>, configuration parameters
+ <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging
syslogd(8), system logging
<b>README_FILES</b>
diff --git a/external/ibm-public/postfix/dist/man/Makefile.in b/external/ibm-public/postfix/dist/man/Makefile.in
index e01ce282415..f98402ca9a8 100644
--- a/external/ibm-public/postfix/dist/man/Makefile.in
+++ b/external/ibm-public/postfix/dist/man/Makefile.in
@@ -8,7 +8,7 @@ DAEMONS = man8/bounce.8 man8/defer.8 man8/cleanup.8 man8/error.8 man8/local.8 \
man8/oqmgr.8 man8/spawn.8 man8/flush.8 man8/virtual.8 man8/qmqpd.8 \
man8/verify.8 man8/trace.8 man8/proxymap.8 man8/anvil.8 \
man8/scache.8 man8/discard.8 man8/tlsmgr.8 man8/postscreen.8 \
- man8/dnsblog.8 man8/tlsproxy.8
+ man8/dnsblog.8 man8/tlsproxy.8 man8/postlogd.8
COMMANDS= man1/postalias.1 man1/postcat.1 man1/postconf.1 man1/postfix.1 \
man1/postkick.1 man1/postlock.1 man1/postlog.1 man1/postdrop.1 \
man1/postmap.1 man1/postmulti.1 man1/postqueue.1 man1/postsuper.1 \
@@ -22,7 +22,8 @@ CONFIG = man5/access.5 man5/aliases.5 man5/canonical.5 man5/relocated.5 \
man5/generic.5 man5/bounce.5 man5/postfix-wrapper.5 \
man5/sqlite_table.5 man5/socketmap_table.5
TOOLS = man1/smtp-sink.1 man1/smtp-source.1 man1/qmqp-sink.1 \
- man1/qmqp-source.1 man1/qshape.1 man1/posttls-finger.1
+ man1/qmqp-source.1 man1/qshape.1 man1/posttls-finger.1 \
+ man1/makedefs.1
update: $(DAEMONS) $(COMMANDS) $(CONFIG) $(TOOLS)
@@ -108,6 +109,11 @@ man8/pipe.8: ../src/pipe/pipe.c
(cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman $? >$@
+man8/postlogd.8: ../src/postlogd/postlogd.c
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
+ ../mantools/srctoman $? >$@
+
man8/postscreen.8: ../src/postscreen/postscreen.c
../mantools/fixman ../proto/postconf.proto $? >junk && \
(cmp -s junk $? || mv junk $?) && rm -f junk
@@ -253,69 +259,111 @@ man1/newaliases.1:
echo .so man1/sendmail.1 >$@
man5/access.5: ../proto/access
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/aliases.5: ../proto/aliases
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/bounce.5: ../proto/bounce
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/canonical.5: ../proto/canonical
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/cidr_table.5: ../proto/cidr_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/generic.5: ../proto/generic
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/header_checks.5: ../proto/header_checks
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/body_checks.5: ../proto/header_checks
echo .so man5/header_checks.5 >$@
man5/ldap_table.5: ../proto/ldap_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/lmdb_table.5: ../proto/lmdb_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/master.5: ../proto/master
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/memcache_table.5: ../proto/memcache_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/mysql_table.5: ../proto/mysql_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/socketmap_table.5: ../proto/socketmap_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/sqlite_table.5: ../proto/sqlite_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/nisplus_table.5: ../proto/nisplus_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/pcre_table.5: ../proto/pcre_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/pgsql_table.5: ../proto/pgsql_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/regexp_table.5: ../proto/regexp_table
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/relocated.5: ../proto/relocated
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/transport.5: ../proto/transport
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/virtual.5: ../proto/virtual
+ ../mantools/fixman ../proto/postconf.proto $? >junk && \
+ (cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman - $? >$@
man5/postfix-wrapper.5: ../proto/postfix-wrapper
@@ -338,6 +386,9 @@ man1/posttls-finger.1: ../src/posttls-finger/posttls-finger.c
(cmp -s junk $? || mv junk $?) && rm -f junk
../mantools/srctoman $? >$@
+man1/makedefs.1: ../makedefs
+ ../mantools/srctoman - $? >$@
+
man5/tcp_table.5: ../proto/tcp_table
../mantools/srctoman - $? >$@
diff --git a/external/ibm-public/postfix/dist/man/man1/makedefs.1 b/external/ibm-public/postfix/dist/man/man1/makedefs.1
new file mode 100644
index 00000000000..5dceadb69a8
--- /dev/null
+++ b/external/ibm-public/postfix/dist/man/man1/makedefs.1
@@ -0,0 +1,191 @@
+.\" $NetBSD: makedefs.1,v 1.1.1.1 2020/03/18 18:59:30 christos Exp $
+.\"
+.TH MAKEDEFS 1
+.ad
+.fi
+.SH NAME
+makedefs
+\-
+Postfix makefile configuration utility
+.SH "SYNOPSIS"
+.na
+.nf
+\fBmake makefiles \fIname=value...\fR
+.SH DESCRIPTION
+.ad
+.fi
+The \fBmakedefs\fR command identifies the compilation
+environment, and emits macro definitions on the standard
+output stream that can be prepended to template Makefiles.
+These macros implement an internal interface and are subject
+to change without notice.
+.SH "NAME=VALUE OVERRIDES"
+.na
+.nf
+.ad
+.fi
+Default settings can be overruled by specifying them as
+environment variables (or as name=value pairs on the "make"
+command line). Use quotes if variables contain whitespace
+or shell meta characters.
+
+The command "\fBmake makefiles name=value...\fR" will replace
+the string \fBMAIL_VERSION\fR at the end of a value with the
+Postfix version (\fImajor.minor.patchlevel\fR for a stable
+release, \fImajor.minor\-date\fR for a development release).
+Do not try to specify something like \fB$mail_version\fR:
+that produces inconsistent results with different implementations
+of the make(1) command.
+.IP \fBAUXLIBS=\fIobject_library...\fR
+Specifies one or more non\-default object libraries. Postfix
+3.0 and later specify some of their database library
+dependencies with AUXLIBS_CDB, AUXLIBS_LDAP, AUXLIBS_LMDB,
+AUXLIBS_MYSQL, AUXLIBS_PCRE, AUXLIBS_PGSQL, AUXLIBS_SDBM,
+and AUXLIBS_SQLITE, respectively.
+.IP \fBCC=\fIcompiler_command\fR
+Specifies a non\-default compiler. On many systems, the default
+is \fBgcc\fR.
+.IP \fBCCARGS=\fIcompiler_arguments\fR
+Specifies non\-default compiler arguments, for example, a non\-default
+\fIinclude\fR directory.
+The following directives are special:
+.RS
+.IP \fB\-DNO_DB\fR
+Do not build with Berkeley DB support.
+.IP \fB\-DNO_DEVPOLL\fR
+Do not build with Solaris /dev/poll support.
+By default, /dev/poll support is compiled in on platforms that
+are known to support it.
+.IP \fB\-DNO_DNSSEC\fR
+Do not build with DNSSEC support, even if the resolver
+library appears to support it.
+.IP \fB\-DNO_EPOLL\fR
+Do not build with Linux EPOLL support.
+By default, EPOLL support is compiled in on platforms that
+are known to support it.
+.IP \fB\-DNO_EAI\fR
+Do not build with EAI (SMTPUTF8) support. By default, EAI
+support is compiled in when the "pkg\-config" command is
+found, or the deprecated "icu\-config" command.
+.IP \fB\-DNO_INLINE\fR
+Do not require support for C99 "inline" functions. Instead,
+implement argument typechecks for non\-(printf/scanf)\-like
+functions with ternary operators and unreachable code.
+.IP \fB\-DNO_IPV6\fR
+Do not build with IPv6 support.
+By default, IPv6 support is compiled in on platforms that
+are known to have IPv6 support.
+
+Note: this directive is for debugging and testing only. It
+is not guaranteed to work on all platforms. If you don't
+want IPv6 support, set "inet_protocols = ipv4" in main.cf.
+.IP \fB\-DNO_IP_CYRUS_SASL_AUTH\fR
+Don't pass remote SMTP client and Postfix SMTP server IP
+address and port information to the Cyrus SASL library.
+This is compatible with Postfix < 3.2.
+.IP \fB\-DNO_KQUEUE\fR
+Do not build with FreeBSD/NetBSD/OpenBSD/MacOSX KQUEUE support.
+By default, KQUEUE support is compiled in on platforms that
+are known to support it.
+.IP \fB\-DNO_NIS\fR
+Do not build with NIS or NISPLUS support. Support for NIS
+is unavailable on some recent Linux distributions.
+.IP \fB\-DNO_NISPLUS\fR
+Do not build with NISPLUS support. Support for NISPLUS
+is unavailable on some recent Solaris distributions.
+.IP \fB\-DNO_PCRE\fR
+Do not build with PCRE support.
+By default, PCRE support is compiled in when the \fBpcre\-config\fR
+utility is installed.
+.IP \fB\-DNO_POSIX_GETPW_R\fR
+Disable support for POSIX getpwnam_r/getpwuid_r.
+.IP \fB\-DNO_SIGSETJMP\fR
+Use setjmp()/longjmp() instead of sigsetjmp()/siglongjmp().
+By default, Postfix uses sigsetjmp()/siglongjmp() when they
+appear to work.
+.IP \fB\-DNO_SNPRINTF\fR
+Use sprintf() instead of snprintf(). By default, Postfix
+uses snprintf() except on ancient systems.
+.RE
+.IP \fBDEBUG=\fIdebug_level\fR
+Specifies a non\-default debugging level. The default is \fB\-g\fR.
+Specify \fBDEBUG=\fR to turn off debugging.
+.IP \fBOPT=\fIoptimization_level\fR
+Specifies a non\-default optimization level. The default is \fB\-O\fR.
+Specify \fBOPT=\fR to turn off optimization.
+.IP \fBPOSTFIX_INSTALL_OPTS=\fI\-option...\fR
+Specifies options for the postfix\-install command, separated
+by whitespace. Currently, the only supported option is
+\fB\-keep\-build\-mtime\fR.
+.IP \fBSHLIB_CFLAGS=\fIflags\fR
+Override the compiler flags (typically, "\-fPIC") for Postfix
+dynamically\-linked libraries and database plugins.
+
+This feature was introduced with Postfix 3.0.
+.IP \fBSHLIB_RPATH=\fIrpath\fR
+Override the runpath (typically, "'\-Wl,\-rpath,${SHLIB_DIR}'")
+for Postfix dynamically\-linked libraries.
+
+This feature was introduced with Postfix 3.0.
+.IP \fBSHLIB_SUFFIX=\fIsuffix\fR
+Override the filename suffix (typically, ".so") for Postfix
+dynamically\-linked libraries and database plugins.
+
+This feature was introduced with Postfix 3.0.
+.IP \fBshared=yes\fR
+.IP \fBshared=no\fR
+Enable (disable) Postfix builds with dynamically\-linked
+libraries typically named $shlib_directory/libpostfix\-*.so.*.
+
+This feature was introduced with Postfix 3.0.
+.IP \fBdynamicmaps=yes\fR
+.IP \fBdynamicmaps=no\fR
+Enable (disable) Postfix builds with the configuration file
+$meta_directory/dynamicmaps.cf and dynamically\-loadable
+database plugins typically named postfix\-*.so.*. The setting
+"dynamicmaps=yes" implicitly enables Postfix dynamically\-linked
+libraries.
+
+This feature was introduced with Postfix 3.0.
+.IP \fBpie=yes\fR
+.IP \fBpie=no\fR
+Enable (disable) Postfix builds with position\-independent
+executables, on platforms where this is supported.
+
+This feature was introduced with Postfix 3.0.
+.IP \fIinstallation_parameter\fB=\fIvalue\fR...
+Override the compiled\-in default value of the specified
+installation parameter(s). The following parameters are
+supported in this context:
+
+command_directory config_directory daemon_directory
+data_directory default_database_type html_directory
+mail_spool_directory mailq_path manpage_directory meta_directory
+newaliases_path queue_directory readme_directory sendmail_path
+shlib_directory openssl_path
+
+See the postconf(5) manpage for a description of these
+parameters.
+
+This feature was introduced with Postfix 3.0.
+.IP \fBWARN=\fIwarning_flags\fR
+Specifies non\-default gcc compiler warning options for use when
+"make" is invoked in a source subdirectory only.
+.SH "LICENSE"
+.na
+.nf
+.ad
+.fi
+The Secure Mailer license must be distributed with this software.
+.SH "AUTHOR(S)"
+.na
+.nf
+Wietse Venema
+IBM T.J. Watson Research
+P.O. Box 704
+Yorktown Heights, NY 10598, USA
+
+Wietse Venema
+Google, Inc.
+111 8th Avenue
+New York, NY 10011, USA
diff --git a/external/ibm-public/postfix/dist/man/man8/postlogd.8 b/external/ibm-public/postfix/dist/man/man8/postlogd.8
new file mode 100644
index 00000000000..8fac39ba637
--- /dev/null
+++ b/external/ibm-public/postfix/dist/man/man8/postlogd.8
@@ -0,0 +1,104 @@
+.\" $NetBSD: postlogd.8,v 1.1.1.1 2020/03/18 18:59:30 christos Exp $
+.\"
+.TH POSTLOGD 8
+.ad
+.fi
+.SH NAME
+postlogd
+\-
+Postfix internal log server
+.SH "SYNOPSIS"
+.na
+.nf
+\fBpostlogd\fR [generic Postfix daemon options]
+.SH DESCRIPTION
+.ad
+.fi
+This program logs events on behalf of Postfix programs
+when the maillog configuration parameter specifies a non\-empty
+value.
+.SH BUGS
+.ad
+.fi
+Non\-daemon Postfix programs don't know that they should log
+to the internal logging service before they have processed
+command\-line options and main.cf parameters. These programs
+still log earlier events to the syslog service.
+
+If Postfix is down, the non\-daemon programs \fBpostfix\fR(1),
+\fBpostsuper\fR(1), \fBpostmulti\fR(1), and \fBpostlog\fR(1),
+will log directly to \fB$maillog_file\fR. These programs
+expect to run with root privileges, for example during
+Postfix start\-up, reload, or shutdown.
+
+Other non\-daemon Postfix programs will never write directly to
+\fB$maillog_file\fR (also, logging to stdout would interfere
+with the operation of some of these programs). These programs
+can log to \fBpostlogd\fR(8) if they are run by the super\-user,
+or if their executable file has set\-gid permission. Do not
+set this permission on programs other than \fBpostdrop\fR(1)
+and \fBpostqueue\fR(1).
+.SH "CONFIGURATION PARAMETERS"
+.na
+.nf
+.ad
+.fi
+Changes to \fBmain.cf\fR are picked up automatically, as
+\fBpostlogd\fR(8) processes run for only a limited amount
+of time. Use the command "\fBpostfix reload\fR" to speed
+up a change.
+
+The text below provides only a parameter summary. See
+\fBpostconf\fR(5) for more details including examples.
+.IP "\fBconfig_directory (see 'postconf -d' output)\fR"
+The default location of the Postfix main.cf and master.cf
+configuration files.
+.IP "\fBmaillog_file (empty)\fR"
+The name of an optional logfile that is written by the Postfix
+\fBpostlogd\fR(8) service.
+.IP "\fBprocess_id (read\-only)\fR"
+The process ID of a Postfix command or daemon process.
+.IP "\fBprocess_name (read\-only)\fR"
+The process name of a Postfix command or daemon process.
+.IP "\fBsyslog_name (see 'postconf -d' output)\fR"
+A prefix that is prepended to the process name in syslog
+records, so that, for example, "smtpd" becomes "prefix/smtpd".
+.IP "\fBservice_name (read\-only)\fR"
+The master.cf service name of a Postfix daemon process.
+.IP "\fBpostlogd_watchdog_timeout (10s)\fR"
+How much time a \fBpostlogd\fR(8) process may take to process a request
+before it is terminated by a built\-in watchdog timer.
+.SH "SEE ALSO"
+.na
+.nf
+postconf(5), configuration parameters
+syslogd(8), system logging
+.SH "README_FILES"
+.na
+.nf
+.ad
+.fi
+Use "\fBpostconf readme_directory\fR" or
+"\fBpostconf html_directory\fR" to locate this information.
+.na
+.nf
+MAILLOG_README, Postfix logging to file or stdout
+.SH "LICENSE"
+.na
+.nf
+.ad
+.fi
+The Secure Mailer license must be distributed with this software.
+.SH HISTORY
+.ad
+.fi
+.ad
+.fi
+This service was introduced with Postfix version 3.4.
+.SH "AUTHOR(S)"
+.na
+.nf
+Wietse Venema
+Google, Inc.
+111 8th Avenue
+New York, NY 10011, USA
diff --git a/external/ibm-public/postfix/dist/mantools/ccformat b/external/ibm-public/postfix/dist/mantools/ccformat
index c9ec6aeb629..9ac6c57af58 100755
--- a/external/ibm-public/postfix/dist/mantools/ccformat
+++ b/external/ibm-public/postfix/dist/mantools/ccformat
@@ -4,7 +4,7 @@
# @(#) ccformat.sh 1.3 11/5/89 14:39:29
-# how to supress newlines in echo
+# how to suppress newlines in echo
case `echo -n` in
"") n=-n; c=;;
@@ -139,7 +139,7 @@ exit
# These are often carefully laid out by the programmer.
# .sp
# Comments that appear in-between statements are lined up with
-# the surrounding program text, and are adjusted to accomodate
+# the surrounding program text, and are adjusted to accommodate
# as many words on a line as possible.
# However, a blank line in the middle of a comment is respected.
# .sp
diff --git a/external/ibm-public/postfix/dist/mantools/fixman b/external/ibm-public/postfix/dist/mantools/fixman
index ff29ab23b61..6c2c6ea912f 100755
--- a/external/ibm-public/postfix/dist/mantools/fixman
+++ b/external/ibm-public/postfix/dist/mantools/fixman
@@ -230,6 +230,14 @@ while(<>) {
next;
}
+ if ($incomment == 2 && /^(\/\*|#) +\.IP +"?\\fI([a-zA-Z0-9_]+)\\fB([a-zA-Z0-9_]+)( +\((.*)\))?/) {
+ emit_text($1) if ($name ne "");
+ $name = "$2$3";
+ $defval = $4;
+ $text = "";
+ next;
+ }
+
if ($incomment == 2 && /^(\/\*|#) +([A-Z][A-Z][A-Z]+|\.[A-Z][A-Z])/) {
emit_text($1) if ($name ne "");
$incomment = 0 if /^(\/\*|#) +(SEE +ALSO|README +FILES|LICENSE|AUTHOR)/;
diff --git a/external/ibm-public/postfix/dist/mantools/make-relnotes b/external/ibm-public/postfix/dist/mantools/make-relnotes
index 4d07e66329c..f5d26f37bf8 100755
--- a/external/ibm-public/postfix/dist/mantools/make-relnotes
+++ b/external/ibm-public/postfix/dist/mantools/make-relnotes
@@ -3,12 +3,14 @@
# Transform RELEASE_NOTES, split into "leader", and "major changes",
# split into major categories, and prepend dates to paragraphs.
#
-# Input format: the leader text is copied verbatim; each paragraph
-# starts with [class, class] where a class specifies one or more
-# categories that the change should be listed under. Adding class
-# info is the only manual processing needed to go from a RELEASE_NOTES
-# file to the transformed representation.
-#
+# Input format: the leader text is copied verbatim; each section
+# starts with "Incompatible changes with snapshot YYYYMMDD" or "Major
+# changes with snapshot YYYYMMDD"; each paragraph starts with [class,
+# class] where a class specifies one or more categories that the
+# change should be listed under. Adding class info is the only manual
+# processing needed to go from a RELEASE_NOTES file to the transformed
+# representation.
+#
# Output format: each category is printed with a little header and
# each paragraph is tagged with [Incompat yyyymmdd] or with [Feature
# yyyymmdd].
diff --git a/external/ibm-public/postfix/dist/mantools/missing-proxy-read-maps b/external/ibm-public/postfix/dist/mantools/missing-proxy-read-maps
new file mode 100755
index 00000000000..58dc39071c5
--- /dev/null
+++ b/external/ibm-public/postfix/dist/mantools/missing-proxy-read-maps
@@ -0,0 +1,56 @@
+#!/usr/bin/perl
+
+# Outputs missing mail_params.h lines for the proxy_read_maps default
+# value.
+#
+# First, get the proxy_read_maps default value from postconf command
+# output. This gives us a list of parameter names that are already
+# present in the proxy_read_maps default value.
+
+$command = "bin/postconf -dh proxy_read_maps | tr ' ' '\12'";
+open(PROXY_READ_MAPS, "$command|")
+ || die "can't execute $command: !$\n";
+while (<PROXY_READ_MAPS>) {
+ chomp;
+ next unless /^\$(.+)$/;
+ $proxy_read_maps{$1} = 1;
+}
+close(PROXY_READ_MAPS) || die "close $command: $!\n";
+
+# Parse mail_params.h, to determine the VAR_XXX name for each main.cf
+# parameter. Ignore parameter names composed from multiple strings,
+# unless the parameter name is known to be of interest. The code
+# block after this one will discover if we ignored too much.
+
+$mail_params_h = "src/global/mail_params.h";
+open(MAIL_PARAMS, "<$mail_params_h")
+ || die "Open $mail_params_h";
+while ($line = <MAIL_PARAMS>) {
+ chomp;
+ if ($line =~ /^#define\s+(VAR\S+)\s+"(\S+)"\s*(\/\*.*\*\/)?$/) {
+ $mail_params{$2} = $1;
+ } elsif ($line =~/^#define\s+(VAR\S+)\s+"address_verify_"\s+VAR_SND_DEF_XPORT_MAPS/) {
+ $mail_params{"address_verify_sender_dependent_default_transport_maps"} = $1;
+ } elsif ($line =~/^#define\s+(VAR\S+)\s+"sender_dependent_"\s+VAR_DEF_TRANSPORT\s+"_maps"/) {
+ $mail_params{"sender_dependent_default_transport_maps"} = $1;
+ }
+}
+close(MAIL_PARAMS) || die "close $mail_params_h: !$\n";
+#
+# Produce mail_params.h lines for all parameters that have names
+# ending in _maps and that are not listed in proxy_read_maps. We get
+# the full parameter name list from postconf command output. Abort
+# if we discover that our mail_params.h parser missed something.
+
+$command = "bin/postconf -H";
+open(ALL_PARAM_NAMES, "$command|")
+ || die "can't execute $command: !$\n";
+while ($param_name = <ALL_PARAM_NAMES>) {
+ chomp($param_name);
+ next unless ($param_name =~ /_maps$/);
+ next if ($param_name =~ /^(proxy_read|proxy_write)_maps$/);
+ next if defined($proxy_read_maps{$param_name});
+ die "unknown parameter: $param_name\n"
+ unless defined($mail_params{$param_name});
+ print "\t\t\t\t\" \$\" $mail_params{$param_name} \\\n";
+}
diff --git a/external/ibm-public/postfix/dist/mantools/postlink b/external/ibm-public/postfix/dist/mantools/postlink
index 0e4eb9c22c3..46f187e91cd 100755
--- a/external/ibm-public/postfix/dist/mantools/postlink
+++ b/external/ibm-public/postfix/dist/mantools/postlink
@@ -227,6 +227,7 @@ while (<>) {
s;\blmtp_reply_filter\b;<a href="postconf.5.html#lmtp_reply_filter">$&</a>;g;
s;\blmtp_sasl_password_maps\b;<a href="postconf.5.html#lmtp_sasl_password_maps">$&</a>;g;
s;\blmtp_send_dummy_mail_auth\b;<a href="postconf.5.html#lmtp_send_dummy_mail_auth">$&</a>;g;
+ s;\blmtp_balance_inet_protocols\b;<a href="postconf.5.html#lmtp_balance_inet_protocols">$&</a>;g;
s;\blmtp_sender_dependent_authentication\b;<a href="postconf.5.html#lmtp_sender_dependent_authentication">$&</a>;g;
s;\blmtp_bind_address\b;<a href="postconf.5.html#lmtp_bind_address">$&</a>;g;
s;\blmtp_bind_address6\b;<a href="postconf.5.html#lmtp_bind_address6">$&</a>;g;
@@ -246,10 +247,12 @@ while (<>) {
s;\blmtp_tls_policy_maps\b;<a href="postconf.5.html#lmtp_tls_policy_maps">$&</a>;g;
s;\blmtp_tls_secure_cert_match\b;<a href="postconf.5.html#lmtp_tls_secure_cert_match">$&</a>;g;
s;\blmtp_tls_security_level\b;<a href="postconf.5.html#lmtp_tls_security_level">$&</a>;g;
+ s;\blmtp_tls_servername\b;<a href="postconf.5.html#lmtp_tls_servername">$&</a>;g;
s;\blmtp_tls_fingerprint_cert_match\b;<a href="postconf.5.html#lmtp_tls_fingerprint_cert_match">$&</a>;g;
s;\blmtp_tls_verify_cert_match\b;<a href="postconf.5.html#lmtp_tls_verify_cert_match">$&</a>;g;
s;\blmtp_tls_trust_anchor_file\b;<a href="postconf.5.html#lmtp_tls_trust_anchor_file">$&</a>;g;
s;\blmtp_tls_per_site\b;<a href="postconf.5.html#lmtp_tls_per_site">$&</a>;g;
+ s;\blmtp_tls_chain_files\b;<a href="postconf.5.html#lmtp_tls_chain_files">$&</a>;g;
s;\blmtp_tls_cert_file\b;<a href="postconf.5.html#lmtp_tls_cert_file">$&</a>;g;
s;\blmtp_tls_key_file\b;<a href="postconf.5.html#lmtp_tls_key_file">$&</a>;g;
s;\blmtp_tls_dcert_file\b;<a href="postconf.5.html#lmtp_tls_dcert_file">$&</a>;g;
@@ -323,7 +326,7 @@ while (<>) {
s;\bmail_owner\b;<a href="postconf.5.html#mail_owner">$&</a>;g;
s;\bmail_release_date\b;<a href="postconf.5.html#mail_release_date">$&</a>;g;
s;\bmail_spool_direc[-</bB>]*\n* *[<bB>]*tory\b;<a href="postconf.5.html#mail_spool_directory">$&</a>;g;
- s;\bmail_version\b;<a href="postconf.5.html#mail_version">$&</a>;g;
+ s;\bmail_ver[-</bB>]*\n* *[<bB>]*sion\b;<a href="postconf.5.html#mail_version">$&</a>;g;
s;\bmail[-</bB>]*\n* *[<bB>]*box_com[-</bB>]*\n* *[<bB>]*mand\b;<a href="postconf.5.html#mailbox_command">$&</a>;g;
s;\bmail[-</bB>]*\n* *[<bB>]*box_com[-</bB>]*\n* *[<bB>]*mand_maps\b;<a href="postconf.5.html#mailbox_command_maps">$&</a>;g;
s;\bmail[-</bB>]*\n* *[<bB>]*box_deliv[-</Bb>]*\n* *[<Bb>]*ery_lock\b;<a href="postconf.5.html#mailbox_delivery_lock">$&</a>;g;
@@ -390,6 +393,7 @@ while (<>) {
s;\bqmgr_daemon_timeout\b;<a href="postconf.5.html#qmgr_daemon_timeout">$&</a>;g;
s;\bqmgr_ipc_timeout\b;<a href="postconf.5.html#qmgr_ipc_timeout">$&</a>;g;
s;\bqmqpd_authorized_clients\b;<a href="postconf.5.html#qmqpd_authorized_clients">$&</a>;g;
+ s;\bservice_name\b;<a href="postconf.5.html#service_name">$&</a>;g;
s;\bdefault_desti[-</Bb>]*\n* *[<Bb>]*na[-</Bb>]*\n* *[<Bb>]*tion_concur[-</Bb>]*\n* *[<Bb>]*rency_negative_feedback\b;<a href="postconf.5.html#default_destination_concurrency_negative_feedback">$&</a>;g;
s;\bdefault_desti[-</Bb>]*\n* *[<Bb>]*na[-</Bb>]*\n* *[<Bb>]*tion_concur[-</Bb>]*\n* *[<Bb>]*rency_positive_feedback\b;<a href="postconf.5.html#default_destination_concurrency_positive_feedback">$&</a>;g;
@@ -517,6 +521,7 @@ while (<>) {
s;\bsmtp_skip_4xx_greeting\b;<a href="postconf.5.html#smtp_skip_4xx_greeting">$&</a>;g;
s;\bsmtp_skip_5xx_greeting\b;<a href="postconf.5.html#smtp_skip_5xx_greeting">$&</a>;g;
s;\bsmtp_skip_quit_response\b;<a href="postconf.5.html#smtp_skip_quit_response">$&</a>;g;
+ s;\bsmtp_tcp_port\b;<a href="postconf.5.html#smtp_tcp_port">$&</a>;g;
s;\bsmtp_xforward_timeout\b;<a href="postconf.5.html#smtp_xforward_timeout">$&</a>;g;
s;\bsmtpd_log_access_permit_actions\b;<a href="postconf.5.html#smtpd_log_access_permit_actions">$&</a>;g;
s;\bsmtpd_autho[-</bB>]*\n*[ <bB>]*rized_verp_clients\b;<a href="postconf.5.html#smtpd_authorized_verp_clients">$&</a>;g;
@@ -549,6 +554,7 @@ while (<>) {
s;\bsmtpd_history_flush_threshold\b;<a href="postconf.5.html#smtpd_history_flush_threshold">$&</a>;g;
s;\bsmtpd_junk_command_limit\b;<a href="postconf.5.html#smtpd_junk_command_limit">$&</a>;g;
s;\bsmtpd_milters\b;<a href="postconf.5.html#smtpd_milters">$&</a>;g;
+ s;\bsmtpd_milter_maps\b;<a href="postconf.5.html#smtpd_milter_maps">$&</a>;g;
s;\bsmtpd_noop_commands\b;<a href="postconf.5.html#smtpd_noop_commands">$&</a>;g;
s;\bsmtpd_null_access_lookup_key\b;<a href="postconf.5.html#smtpd_null_access_lookup_key">$&</a>;g;
s;\bsmtpd_recipient_overshoot_limit\b;<a href="postconf.5.html#smtpd_recipient_overshoot_limit">$&</a>;g;
@@ -578,6 +584,7 @@ while (<>) {
s;\bsmtpd_sasl_authenticated_header\b;<a href="postconf.5.html#smtpd_sasl_authenticated_header">$&</a>;g;
s;\bsmtpd_sasl_exceptions_networks\b;<a href="postconf.5.html#smtpd_sasl_exceptions_networks">$&</a>;g;
s;\bsmtpd_sasl_local_domain\b;<a href="postconf.5.html#smtpd_sasl_local_domain">$&</a>;g;
+ s;\bsmtpd_sasl_response_limit\b;<a href="postconf.5.html#smtpd_sasl_response_limit">$&</a>;g;
s;\bsmtpd_sasl_secu[-</Bb>]*\n* *[<Bb>]*rity_options\b;<a href="postconf.5.html#smtpd_sasl_security_options">$&</a>;g;
s;\bsmtpd_sender_login_maps\b;<a href="postconf.5.html#smtpd_sender_login_maps">$&</a>;g;
s;\bsmtpd_sender_restrictions\b;<a href="postconf.5.html#smtpd_sender_restrictions">$&</a>;g;
@@ -645,6 +652,7 @@ while (<>) {
s;\bsmtp_starttls_timeout\b;<a href="postconf.5.html#smtp_starttls_timeout">$&</a>;g;
s;\bsmtp_tls_CAfile\b;<a href="postconf.5.html#smtp_tls_CAfile">$&</a>;g;
s;\bsmtp_tls_CApath\b;<a href="postconf.5.html#smtp_tls_CApath">$&</a>;g;
+ s;\bsmtp_tls_chain_files\b;<a href="postconf.5.html#smtp_tls_chain_files">$&</a>;g;
s;\bsmtp_tls_cert_file\b;<a href="postconf.5.html#smtp_tls_cert_file">$&</a>;g;
s;\bsmtp_tls_fingerprint_digest\b;<a href="postconf.5.html#smtp_tls_fingerprint_digest">$&</a>;g;
s;\bsmtp_tls_protocols\b;<a href="postconf.5.html#smtp_tls_protocols">$&</a>;g;
@@ -667,6 +675,7 @@ while (<>) {
s;\bsmtp_tls_fingerprint_cert_match\b;<a href="postconf.5.html#smtp_tls_fingerprint_cert_match">$&</a>;g;
s;\bsmtp_tls_verify_cert_match\b;<a href="postconf.5.html#smtp_tls_verify_cert_match">$&</a>;g;
s;\bsmtp_tls_secure_cert_match\b;<a href="postconf.5.html#smtp_tls_secure_cert_match">$&</a>;g;
+ s;\bsmtp_tls_servername\b;<a href="postconf.5.html#smtp_tls_servername">$&</a>;g;
s;\bsmtp_tls_trust_anchor_file\b;<a href="postconf.5.html#smtp_tls_trust_anchor_file">$&</a>;g;
s;\bsmtp_tls_scert_verifydepth\b;<a href="postconf.5.html#smtp_tls_scert_verifydepth">$&</a>;g;
s;\bsmtp_tls_secu[-</Bb>]*\n* *[<Bb>]*rity_level\b;<a href="postconf.5.html#smtp_tls_security_level">$&</a>;g;
@@ -685,6 +694,9 @@ while (<>) {
s;\bsmtp_address_preference\b;<a href="postconf.5.html#smtp_address_preference">$&</a>;g;
s;\bsmtp_per_record_deadline\b;<a href="postconf.5.html#smtp_per_record_deadline">$&</a>;g;
s;\bsmtp_send_dummy_mail_auth\b;<a href="postconf.5.html#smtp_send_dummy_mail_auth">$&</a>;g;
+ s;\bsmtp_balance_inet_protocols\b;<a href="postconf.5.html#smtp_balance_inet_protocols">$&</a>;g;
+ s;\bsmtp_tls_connection_reuse\b;<a href="postconf.5.html#smtp_tls_connection_reuse">$&</a>;g;
+ s;\blmtp_tls_connection_reuse\b;<a href="postconf.5.html#lmtp_tls_connection_reuse">$&</a>;g;
s;\bsmtpd_enforce_tls\b;<a href="postconf.5.html#smtpd_enforce_tls">$&</a>;g;
s;\bsmtpd_sasl_tls_security_options\b;<a href="postconf.5.html#smtpd_sasl_tls_security_options">$&</a>;g;
s;\bsmtpd_sasl_type\b;<a href="postconf.5.html#smtpd_sasl_type">$&</a>;g;
@@ -694,6 +706,7 @@ while (<>) {
s;\bsmtpd_tls_ask_ccert\b;<a href="postconf.5.html#smtpd_tls_ask_ccert">$&</a>;g;
s;\bsmtpd_tls_auth_only\b;<a href="postconf.5.html#smtpd_tls_auth_only">$&</a>;g;
s;\bsmtpd_tls_ccert_verify[-</bB>]*\n*[ <bB>]*depth\b;<a href="postconf.5.html#smtpd_tls_ccert_verifydepth">$&</a>;g;
+ s;\bsmtpd_tls_chain_files\b;<a href="postconf.5.html#smtpd_tls_chain_files">$&</a>;g;
s;\bsmtpd_tls_cert_file\b;<a href="postconf.5.html#smtpd_tls_cert_file">$&</a>;g;
s;\bsmtpd_tls_cipherlist\b;<a href="postconf.5.html#smtpd_tls_cipherlist">$&</a>;g;
s;\bsmtpd_tls_exclude_ciphers\b;<a href="postconf.5.html#smtpd_tls_exclude_ciphers">$&</a>;g;
@@ -721,6 +734,7 @@ while (<>) {
s;\bsmtpd_tls_wrappermode\b;<a href="postconf.5.html#smtpd_tls_wrappermode">$&</a>;g;
s;\bsmtpd_use_tls\b;<a href="postconf.5.html#smtpd_use_tls">$&</a>;g;
s;\bsmtpd_reject_footer\b;<a href="postconf.5.html#smtpd_reject_footer">$&</a>;g;
+ s;\bsmtpd_reject_footer_maps\b;<a href="postconf.5.html#smtpd_reject_footer_maps">$&</a>;g;
s;\bsmtpd_per_record_deadline\b;<a href="postconf.5.html#smtpd_per_record_deadline">$&</a>;g;
s;\bsmtpd_upstream_proxy_protocol\b;<a href="postconf.5.html#smtpd_upstream_proxy_protocol">$&</a>;g;
s;\bsmtpd_upstream_proxy_timeout\b;<a href="postconf.5.html#smtpd_upstream_proxy_timeout">$&</a>;g;
@@ -737,17 +751,21 @@ while (<>) {
s;\btls_low_cipherlist\b;<a href="postconf.5.html#tls_low_cipherlist">$&</a>;g;
s;\btls_export_cipherlist\b;<a href="postconf.5.html#tls_export_cipherlist">$&</a>;g;
s;\btls_null_cipherlist\b;<a href="postconf.5.html#tls_null_cipherlist">$&</a>;g;
+ s;\btls_eecdh_auto_curves\b;<a href="postconf.5.html#tls_eecdh_auto_curves">$&</a>;g;
s;\btls_eecdh_strong_curve\b;<a href="postconf.5.html#tls_eecdh_strong_curve">$&</a>;g;
s;\btls_eecdh_ultra_curve\b;<a href="postconf.5.html#tls_eecdh_ultra_curve">$&</a>;g;
s;\btls_preempt_cipherlist\b;<a href="postconf.5.html#tls_preempt_cipherlist">$&</a>;g;
s;\btls_disable_workarounds\b;<a href="postconf.5.html#tls_disable_workarounds">$&</a>;g;
s;\btls_append_default_CA\b;<a href="postconf.5.html#tls_append_default_CA">$&</a>;g;
s;\btls_legacy_public_key_fingerprints\b;<a href="postconf.5.html#tls_legacy_public_key_fingerprint">$&</a>;g;
- s;\btls_dane_trust_anchor_digest_enable\b;<a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">$&</a>;g;
s;\btls_dane_digests\b;<a href="postconf.5.html#tls_dane_digests">$&</a>;g;
s;\btls_wildcard_matches_multiple_labels\b;<a href="postconf.5.html#tls_wildcard_matches_multiple_labels">$&</a>;g;
s;\btls_session_ticket_cipher\b;<a href="postconf.5.html#tls_session_ticket_cipher">$&</a>;g;
+ s;\btls_server_sni_maps\b;<a href="postconf.5.html#tls_server_sni_maps">$&</a>;g;
s;\btls_ssl_options\b;<a href="postconf.5.html#tls_ssl_options">$&</a>;g;
+ s;\btls_dane_digest_agility\b;<a href="postconf.5.html#tls_dane_digest_agility">$&</a>;g;
+ s;\btls_dane_trust_anchor_digest_enable\b;<a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">$&</a>;g;
+ s;\btls_fast_shutdown_enable\b;<a href="postconf.5.html#tls_fast_shutdown_enable">$&</a>;g;
s;\bfrozen_delivered_to\b;<a href="postconf.5.html#frozen_delivered_to">$&</a>;g;
s;\breset_owner_alias\b;<a href="postconf.5.html#reset_owner_alias">$&</a>;g;
@@ -796,6 +814,7 @@ while (<>) {
s/[<bB>]*mas[-<\/bB>]*\n* *[<bB>]*ter[<\/bB>]*\(8\)/<a href="master.8.html">$&<\/a>/g;
s/[<bB>]*pickup[<\/bB>]*\(8\)/<a href="pickup.8.html">$&<\/a>/g;
s/[<bB>]*pipe[<\/bB>]*\(8\)/<a href="pipe.8.html">$&<\/a>/g;
+ s/[<bB>]*postlogd[<\/bB>]*\(8\)/<a href="postlogd.8.html">$&<\/a>/g;
s/[<bB>]*postscreen[<\/bB>]*\(8\)/<a href="postscreen.8.html">$&<\/a>/g;
s/[<bB>]*oqmgr[<\/bB>]*\(8\)/<a href="qmgr.8.html">$&<\/a>/g;
s/[<bB>]*\bqmgr[<\/bB>]*\(8\)/<a href="qmgr.8.html">$&<\/a>/g;
@@ -823,7 +842,7 @@ while (<>) {
s/[<bB>]*postmap[<\/bB>]*\(1\)/<a href="postmap.1.html">$&<\/a>/g;
s/[<bB>]*postmulti[<\/bB>]*\(1\)/<a href="postmulti.1.html">$&<\/a>/g;
s/[<bB>]*postqueue[<\/bB>]*\(1\)/<a href="postqueue.1.html">$&<\/a>/g;
- s/[<bB>]*post[-<\/bB>]*\n*[ <bB>]*super[<\/bB>]*\(1\)/<a href="postsuper.1.html">$&<\/a>/g;
+ s/[<bB>]*post[-<\/bB>]*\n*[ <bB>]*su[-<\/bB>]*\n*[ <bB>]*per[<\/bB>]*\(1\)/<a href="postsuper.1.html">$&<\/a>/g;
s/[<bB>]*post[-<\/bB>]*\n*[ <bB>]*tls-finger[<\/bB>]*\(1\)/<a href="posttls-finger.1.html">$&<\/a>/g;
s/[<bB>]*send[-<\/bB>]*\n*[ <bB>]*mail[<\/bB>]*\(1\)/<a href="sendmail.1.html">$&<\/a>/g;
s/[<bB>]*smtp-[<\/bB>]*\n* *[<bB>]*source[<\/bB>]*\(1\)/<a href="smtp-source.1.html">$&<\/a>/g;
@@ -1039,6 +1058,7 @@ while (<>) {
s;\bpostscreen_discard_ehlo_keywords\b;<a href="postconf.5.html#postscreen_discard_ehlo_keywords">$&</a>;g;
s;\bpostscreen_expansion_filter\b;<a href="postconf.5.html#postscreen_expansion_filter">$&</a>;g;
s;\bpostscreen_reject_footer\b;<a href="postconf.5.html#postscreen_reject_footer">$&</a>;g;
+ s;\bpostscreen_reject_footer_maps\b;<a href="postconf.5.html#postscreen_reject_footer_maps">$&</a>;g;
s;\bpostscreen_command_filter\b;<a href="postconf.5.html#postscreen_command_filter">$&</a>;g;
s;\bpostscreen_whitelist_interfaces\b;<a href="postconf.5.html#postscreen_whitelist_interfaces">$&</a>;g;
s;\bpostscreen_upstream_proxy_protocol\b;<a href="postconf.5.html#postscreen_upstream_proxy_protocol">$&</a>;g;
@@ -1051,6 +1071,7 @@ while (<>) {
s;\btlsproxy_tls_always_issue_session_ids\b;<a href="postconf.5.html#tlsproxy_tls_always_issue_session_ids">$&</a>;g;
s;\btlsproxy_tls_ask_ccert\b;<a href="postconf.5.html#tlsproxy_tls_ask_ccert">$&</a>;g;
s;\btlsproxy_tls_ccert_verifydepth\b;<a href="postconf.5.html#tlsproxy_tls_ccert_verifydepth">$&</a>;g;
+ s;\btlsproxy_tls_chain_files\b;<a href="postconf.5.html#tlsproxy_tls_chain_files">$&</a>;g;
s;\btlsproxy_tls_cert_file\b;<a href="postconf.5.html#tlsproxy_tls_cert_file">$&</a>;g;
s;\btlsproxy_tls_ciphers\b;<a href="postconf.5.html#tlsproxy_tls_ciphers">$&</a>;g;
s;\btlsproxy_tls_dcert_file\b;<a href="postconf.5.html#tlsproxy_tls_dcert_file">$&</a>;g;
@@ -1072,11 +1093,40 @@ while (<>) {
s;\btlsproxy_tls_security_level\b;<a href="postconf.5.html#tlsproxy_tls_security_level">$&</a>;g;
s;\btlsproxy_use_tls\b;<a href="postconf.5.html#tlsproxy_use_tls">$&</a>;g;
+ s;\btlsproxy_client_CAfile\b;<a href="postconf.5.html#tlsproxy_client_CAfile">$&</a>;g;
+ s;\btlsproxy_client_CApath\b;<a href="postconf.5.html#tlsproxy_client_CApath">$&</a>;g;
+ s;\btlsproxy_client_chain_files\b;<a href="postconf.5.html#tlsproxy_client_chain_files">$&</a>;g;
+ s;\btlsproxy_client_cert_file\b;<a href="postconf.5.html#tlsproxy_client_cert_file">$&</a>;g;
+ s;\btlsproxy_client_dcert_file\b;<a href="postconf.5.html#tlsproxy_client_dcert_file">$&</a>;g;
+ s;\btlsproxy_client_dkey_file\b;<a href="postconf.5.html#tlsproxy_client_dkey_file">$&</a>;g;
+ s;\btlsproxy_client_eccert_file\b;<a href="postconf.5.html#tlsproxy_client_eccert_file">$&</a>;g;
+ s;\btlsproxy_client_eckey_file\b;<a href="postconf.5.html#tlsproxy_client_eckey_file">$&</a>;g;
+ s;\btlsproxy_client_fingerprint_digest\b;<a href="postconf.5.html#tlsproxy_client_fingerprint_digest">$&</a>;g;
+ s;\btlsproxy_client_key_file\b;<a href="postconf.5.html#tlsproxy_client_key_file">$&</a>;g;
+ s;\btlsproxy_client_loglevel\b;<a href="postconf.5.html#tlsproxy_client_loglevel">$&</a>;g;
+ s;\btlsproxy_client_loglevel_parameter\b;<a href="postconf.5.html#tlsproxy_client_loglevel_parameter">$&</a>;g;
+ s;\btlsproxy_client_scert_verifydepth\b;<a href="postconf.5.html#tlsproxy_client_scert_verifydepth">$&</a>;g;
+
+ s;\btlsproxy_client_security_level\b;<a href="postconf.5.html#tlsproxy_client_security_level">$&</a>;g;
+ s;\btlsproxy_client_per_site\b;<a href="postconf.5.html#tlsproxy_client_per_site">$&</a>;g;
+ s;\btlsproxy_client_policy_maps\b;<a href="postconf.5.html#tlsproxy_client_policy_maps">$&</a>;g;
+ s;\btlsproxy_client_use_tls\b;<a href="postconf.5.html#tlsproxy_client_use_tls">$&</a>;g;
+ s;\btlsproxy_client_enforce_tls\b;<a href="postconf.5.html#tlsproxy_client_enforce_tls">$&</a>;g;
+
# SMTPUTF8
s;\bsmtputf8_enable\b;<a href="postconf.5.html#smtputf8_enable">$&</a>;g;
s;\bstrict_smtputf8\b;<a href="postconf.5.html#strict_smtputf8">$&</a>;g;
s;\bsmtputf8_autodetect_classes\b;<a href="postconf.5.html#smtputf8_autodetect_classes">$&</a>;g;
+ s;\benable_idna2003_compatibility\b;<a href="postconf.5.html#enable_idna2003_compatibility">$&</a>;g;
+
+ # Internal logging.
+ s;\bmail[-</bB>]*\n*[ <bB>]*log_file\b;<a href="postconf.5.html#maillog_file">$&</a>;g;
+ s;\bmail[-</bB>]*\n*[ <bB>]*log_file_compressor\b;<a href="postconf.5.html#maillog_file_compressor">$&</a>;g;
+ s;\bmail[-</bB>]*\n*[ <bB>]*log_file_prefixes\b;<a href="postconf.5.html#maillog_file_prefixes">$&</a>;g;
+ s;\bmail[-</bB>]*\n*[ <bB>]*log_file_rotate_suffix\b;<a href="postconf.5.html#maillog_file_rotate_suffix">$&</a>;g;
+ s;\bpostlog_service_name\b;<a href="postconf.5.html#postlog_service_name">$&</a>;g;
+ s;\bpostlogd_watchdog_timeout\b;<a href="postconf.5.html#postlogd_watchdog_timeout">$&</a>;g;
# Service-defined parameters...
diff --git a/external/ibm-public/postfix/dist/mantools/spelldiff b/external/ibm-public/postfix/dist/mantools/spelldiff
new file mode 100755
index 00000000000..ba059fe575a
--- /dev/null
+++ b/external/ibm-public/postfix/dist/mantools/spelldiff
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# Usage: spelldiff baseline files...
+
+case $# in
+0|1) echo Usage: $0 baseline files... 1>&2; exit 1;;
+esac
+
+baseline="$1"; shift
+
+for f
+do
+ if [ -f "${baseline}/${f}" ]
+ then
+ diff -U0 "${baseline}/${f}" "${f}" | sed -n '
+ /^+/{
+ s/.//
+ p
+ }'
+ else
+ cat "${f}"
+ fi
+done
diff --git a/external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html b/external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html
index b3796f3d01f..82f870c910e 100644
--- a/external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html
+++ b/external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html
@@ -1052,7 +1052,7 @@ deliveries to commands or files in "root"-owned aliases. </p>
<h3> <a name="forward"> Local per-user .forward files </a> </h3>
-<p> With delivery via the local(8) deliver agent, users can control
+<p> With delivery via the local(8) delivery agent, users can control
their own mail delivery by specifying destinations in a file called
.forward in their home directories. The syntax of these files is
the same as with the local aliases(5) file, except that the left-hand
diff --git a/external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html b/external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html
index 80cf6d2676c..f8d94b02c24 100644
--- a/external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html
+++ b/external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html
@@ -264,17 +264,18 @@ clients that send mail from outside an authorized network block.
This is explained in the SASL_README and TLS_README documents. </p>
<p> IMPORTANT: If your machine is connected to a wide area network
-then your default mynetworks setting may be too friendly. </p>
+then the "mynetworks_style = host" setting may be too friendly. </p>
<p> Examples (specify only one of the following): </p>
<blockquote>
<pre>
/etc/postfix/main.cf:
- mynetworks_style = subnet (default: authorize subnetworks)
- mynetworks_style = host (safe: authorize local machine only)
- mynetworks = 127.0.0.0/8 (safe: authorize local machine only)
+ mynetworks_style = subnet (not safe on a wide area network)
+ mynetworks_style = host (authorize local machine only)
+ mynetworks = 127.0.0.0/8 (authorize local machine only)
mynetworks = 127.0.0.0/8 168.100.189.2/32 (authorize local machine)
+ mynetworks = 127.0.0.0/8 168.100.189.2/28 (authorize local networks)
</pre>
</blockquote>
diff --git a/external/ibm-public/postfix/dist/proto/BDAT_README.html b/external/ibm-public/postfix/dist/proto/BDAT_README.html
new file mode 100644
index 00000000000..60f0d1fa1b0
--- /dev/null
+++ b/external/ibm-public/postfix/dist/proto/BDAT_README.html
@@ -0,0 +1,178 @@
+<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
+ "http://www.w3.org/TR/html4/loose.dtd">
+
+<html>
+
+<head>
+
+<title>Postfix BDAT (CHUNKING) support</title>
+
+<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
+
+</head>
+
+<body>
+
+<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix
+BDAT (CHUNKING) support</h1>
+
+<hr>
+
+<h2>Overview </h2>
+
+<p> Postfix SMTP server supports RFC 3030 CHUNKING (the BDAT command)
+without BINARYMIME, in both smtpd(8) and postscreen(8). It is enabled
+by default. </p>
+
+<p> Topics covered in this document: </p>
+
+<ul>
+
+<li><a href="#disable"> Disabling BDAT support</a>
+
+<li><a href="#impact"> Impact on existing configurations</a>
+
+<li><a href="#example"> Example SMTP session</a>
+
+<li> <a href="#benefits">Benefits of CHUNKING (BDAT) support without BINARYMIME</a>
+
+<li> <a href="#downsides">Downsides of CHUNKING (BDAT) support</a>
+
+</ul>
+
+<h2> <a name="disable"> Disabling BDAT support </a> </h2>
+
+<p> BDAT support is enabled by default. To disable BDAT support
+globally: </p>
+
+<blockquote>
+<pre>
+/etc/postfix/main.cf:
+ # The logging alternative:
+ smtpd_discard_ehlo_keywords = chunking
+ # The non-logging alternative:
+ smtpd_discard_ehlo_keywords = chunking, silent_discard
+</pre>
+</blockquote>
+
+<p> Specify '-o smtpd_discard_ehlo_keywords=' in master.cf
+for the submission and smtps services, if you have clients
+that benefit from CHUNKING support. </p>
+
+<h2> <a name="impact"> Impact on existing configurations </a> </h2>
+
+<ul>
+
+<li> <p> There are no changes for smtpd_mumble_restrictions,
+smtpd_proxy_filter, smtpd_milters, or for postscreen settings,
+except for the above mentioned option to suppress the SMTP server's
+CHUNKING service announcement. </p>
+
+<li> <p> There are no changes in the Postfix queue file content,
+no changes for down-stream SMTP servers or after-queue content
+filters, and no changes in the envelope or message content that
+Milters will receive. </p>
+
+</ul>
+
+<h2> <a name="example"> Example SMTP session</a> </h2>
+
+<p> The main differences are that the Postfix SMTP server announces
+"CHUNKING" support in the EHLO response, and that instead of sending
+one DATA request, the remote SMTP client may send one or more BDAT
+requests. In the example below, "S:" indicates server responses,
+and "C:" indicates client requests (bold font). </p>
+
+<blockquote>
+<pre>
+ S: 220 server.example.com
+ C: <b>EHLO client.example.com</b>
+ S: 250-server.example.com
+ S: 250-PIPELINING
+ S: 250-SIZE 153600000
+ S: 250-VRFY
+ S: 250-ETRN
+ S: 250-STARTTLS
+ S: 250-AUTH PLAIN LOGIN
+ S: 250-ENHANCEDSTATUSCODES
+ S: 250-8BITMIME
+ S: 250-DSN
+ S: 250-SMTPUTF8
+ S: 250 CHUNKING
+ C: <b>MAIL FROM:&lt;sender@example.com&gt;</b>
+ S: 250 2.1.0 Ok
+ C: <b>RCPT TO:&lt;recipient@example.com&gt;</b>
+ S: 250 2.1.5 Ok
+ C: <b>BDAT 10000</b>
+ C: <b>..followed by 10000 bytes...</b>
+ S: 250 2.0.0 Ok: 10000 bytes
+ C: <b>BDAT 123</b>
+ C: <b>..followed by 123 bytes...</b>
+ S: 250 2.0.0 Ok: 123 bytes
+ C: <b>BDAT 0 LAST</b>
+ S: 250 2.0.0 Ok: 10123 bytes queued as 41yYhh41qmznjbD
+ C: <b>QUIT</b>
+ S: 221 2.0.0 Bye
+</pre>
+</blockquote>
+
+<p> Internally in Postfix, there is no difference between mail that
+was received with BDAT or with DATA. Postfix smtpd_mumble_restrictions,
+policy delegation queries, smtpd_proxy_filter and Milters all behave
+as if Postfix received (MAIL + RCPT + DATA + end-of-data). However,
+Postfix will log BDAT-related failures as "xxx after BDAT" to avoid
+complicating troubleshooting (xxx = 'lost connection' or 'timeout'),
+and will log a warning when a client sends a malformed BDAT command.
+</p>
+
+<h2> <a name="benefits">Benefits of CHUNKING (BDAT) support without
+BINARYMIME</a> </h2>
+
+<p> Support for CHUNKING (BDAT) was added to improve interoperability
+with some clients, a benefit that would reportedly exist even without
+Postfix support for BINARYMIME. Since June 2018, Wietse's mail
+server has received BDAT commands from a variety of systems. </p>
+
+<p> Postfix does not support BINARYMIME at this time because: </p>
+
+<ul>
+
+<li> <p> BINARYMIME support would require moderately invasive
+changes to Postfix, to support email content that is not line-oriented.
+With BINARYMIME, the Content-Length: message header specifies the
+length of content that may or may not have line boundaries. Without
+BINARYMIME support, email RFCs require that binary content is
+base64-encoded, and formatted as lines of text. </p>
+
+<li> <p> For delivery to non-BINARYMIME systems including UNIX mbox,
+the available options are to convert binary content into 8bit text,
+one of the 7bit forms (base64 or quoted-printable), or to return
+email as undeliverable. Any conversion would obviously break digital
+signatures, so conversion would have to happen before signing. </p>
+
+</ul>
+
+<h2> <a name="downsides">Downsides of CHUNKING (BDAT) support</a>
+</h2>
+
+<p> The RFC 3030 authors did not specify any limitations on how
+clients may pipeline commands (i.e. send commands without waiting
+for a server response). If a server announces PIPELINING support,
+like Postfix does, then a remote SMTP client can pipeline all
+commands following EHLO, for example, MAIL/RCPT/BDAT/BDAT/MAIL/RCPT/BDAT,
+without ever having to wait for a server response. This means that
+with BDAT, the Postfix SMTP server cannot distinguish between a
+well-behaved client and a spambot, based on their command pipelining
+behavior. If you require "reject_unauth_pipelining" to block spambots,
+then turn off Postfix's CHUNKING announcement as described above.
+</p>
+
+<p> In RFC 4468, the authors write that a client may pipeline
+commands, and that after sending BURL LAST or BDAT LAST, a client
+must wait for the server's response. But as this text does not
+appear in RFC 3030 which defines BDAT, is it a useless restriction
+that Postfix will not enforce. </p>
+
+</body>
+
+</html>
diff --git a/external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html b/external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html
index e8a3a60da11..291979d982d 100644
--- a/external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html
+++ b/external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html
@@ -48,7 +48,7 @@ continuity of service. Based on this logging the system administrator
can decide if any backwards-compatible settings need to be made
permanent in main.cf or master.cf, before <a href="#turnoff">turning
off the backwards-compatibility safety net</a> as described at the
-end of this document. </p>
+end of this document. </p>
<p> The following messages may be logged: </p>
@@ -60,6 +60,9 @@ default setting append_dot_mydomain=yes </a> </p>
<li> <p> <a href="#chroot"> Using backwards-compatible default setting
chroot=y</a> </p>
+<li><p> <a href="#relay_restrictions"> Using backwards-compatible
+default setting smtpd_relay_restrictions = (empty)</a> </p>
+
<li> <p> <a href="#mynetworks_style"> Using backwards-compatible
default setting mynetworks_style=subnet </a> </p>
@@ -79,15 +82,19 @@ sections that follow. </p>
<p> When no more backwards-compatible settings need to be made
permanent, the system administrator should <a href="#turnoff">turn
off the backwards-compatibility safety net</a> as described at the
-end of this document. </p>
+end of this document. </p>
<h2> <a name="append_dot_mydomain"> Using backwards-compatible default
setting append_dot_mydomain=yes</a> </h2>
<p> The append_dot_mydomain default value has changed from "yes"
-to "no". As long as the append_dot_mydomain parameter is left at
-its implicit default value, and the backwards-compatible default
-setting is turned on, Postfix may log one of the following messages:</p>
+to "no". This could result in unexpected non-delivery of email after
+Postfix is updated from an older version. The backwards-compatibility
+safety net is designed to prevent such surprises. </p>
+
+<p> As long as the append_dot_mydomain parameter is left at
+its implicit default value, and the compatibility_level setting is
+less than 1, Postfix may log one of the following messages:</p>
<ul>
@@ -136,9 +143,16 @@ in main.cf: </p>
setting chroot=y</a> </h2>
<p> The master.cf chroot default value has changed from "y" (yes)
-to "n" (no). As long as a master.cf chroot field is left at its
-implicit default value, and the backwards-compatible default setting
-is turned on, Postfix may log the following message while it
+to "n" (no). The new default avoids the need for copies of system
+files under the Postfix queue directory. However, sites with strict
+security requirements may want to keep the chroot feature enabled
+after updating Postfix from an older version. The backwards-compatibility
+safety net is designed allow the administrator to choose if they
+want to keep the old behavior. </p>
+
+<p> As long as a master.cf chroot field is left at its
+implicit default value, and the compatibility_level setting
+is less than 1, Postfix may log the following message while it
reads the master.cf file: </p>
<blockquote>
@@ -160,15 +174,58 @@ setting for the "smtp inet" service: </p>
</pre>
</blockquote>
+<h2> <a name="relay_restrictions"> Using backwards-compatible default
+setting smtpd_relay_restrictions = (empty)</a> </h2>
+
+<p> The smtpd_relay_restrictions feature was introduced with Postfix
+version 2.10, as a safety mechanism for configuration errors in
+smtpd_recipient_restrictions that could make Postfix an open relay.
+</p>
+
+<p> The smtpd_relay_restrictions implicit default setting forbids
+mail to remote destinations from clients that don't match
+permit_mynetworks or permit_sasl_authenticated. This could result
+in unexpected 'Relay access denied' errors after Postfix is updated
+from an older Postfix version. The backwards-compatibility safety
+net is designed to prevent such surprises. </p>
+
+<p> When the compatibility_level less than 1, and the
+smtpd_relay_restrictions parameter is left at its implicit default
+setting, Postfix may log the following message: </p>
+
+<blockquote>
+<pre>
+postfix/smtpd[38463]: using backwards-compatible default setting
+ "smtpd_relay_restrictions = (empty)" to avoid "Relay access
+ denied" error for recipient "user@example.com" from client
+ "host.example.net[10.0.0.2]"
+</pre>
+</blockquote>
+
+<p> If this request should not be blocked, then the system
+administrator should make the backwards-compatible setting
+"smtpd_relay_restrictions=" (i.e. empty) permanent in main.cf:
+
+<blockquote>
+<pre>
+# <b>postconf smtpd_relay_restrictions=</b>
+# <b>postfix reload</b>
+</pre>
+</blockquote>
+
<h2> <a name="mynetworks_style"> Using backwards-compatible default
setting mynetworks_style=subnet</a> </h2>
<p> The mynetworks_style default value has changed from "subnet"
to "host". This parameter is used to implement the "permit_mynetworks"
-feature. As long as the mynetworks and mynetworks_style parameters
-are left at their implicit default values, and the backwards-compatible
-default setting is turned on, the Postfix SMTP server may log one
-of the following messages: </p>
+feature. The change could in unexpected 'access denied' errors after
+Postfix is updated from an older version. The backwards-compatibility
+safety net is designed to prevent such surprises. </p>
+
+<p> As long as the mynetworks and mynetworks_style parameters are
+left at their implicit default values, and the compatibility_level
+setting is less than 2, the Postfix SMTP server may log one of the
+following messages: </p>
<blockquote>
<pre>
@@ -201,10 +258,14 @@ administrator should make the backwards-compatible setting
setting relay_domains=$mydestination </a> </h2>
<p> The relay_domains default value has changed from "$mydestination"
-to the empty value. As long as the relay_domains parameter is left
-at its implicit default value, and the backwards-compatible default
-setting is turned on, Postfix may log one of the following messages.
-</p>
+to the empty value. This could result in unexpected 'Relay access
+denied' errors or ETRN errors after Postfix is updated from an older
+version. The backwards-compatibility safety net is designed to
+prevent such surprises. </p>
+
+<p> As long as the relay_domains parameter is left at its implicit
+default value, and the compatibility_level setting is less than 2,
+Postfix may log one of the following messages. </p>
<ul>
@@ -268,13 +329,13 @@ setting smtputf8_enable=no</a> </h2>
<p> The smtputf8_enable default value has changed from "no" to "yes.
With the new "yes" setting, the Postfix SMTP server rejects non-ASCII
-addresses from clients that don't request SMTPUTF8 support. With
-the old "no" setting, Postfix will accept such addresses, even if
-such addresses are not permitted by traditional SMTP standards. </p>
+addresses from clients that don't request SMTPUTF8 support, after
+Postfix is updated from an older version. The backwards-compatibility
+safety net is designed to prevent such surprises. </p>
<p> As long as the smtputf8_enable parameter is left at its implicit
-default value, and the backwards-compatible default setting is
-turned on, Postfix logs a warning each time an SMTP command uses a
+default value, and the compatibility_level setting is
+less than 1, Postfix logs a warning each time an SMTP command uses a
non-ASCII address localpart without requesting SMTPUTF8 support: </p>
<blockquote>
diff --git a/external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html b/external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html
index ef10848cbf8..7ffd7bb04db 100644
--- a/external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html
+++ b/external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html
@@ -22,6 +22,10 @@
<p> This document describes the Postfix connection cache implementation,
which is available with Postfix version 2.2 and later. </p>
+<p> See <a href="TLS_README.html#client_tls_reuse">Client-side TLS
+connection reuse</a> for how this connection cache is used to
+implement multiple deliveries per TLS-encrypted connection. </p>
+
<p> Topics covered in this document: </p>
<ul>
@@ -232,7 +236,7 @@ the smtp_connection_reuse_time_limit parameter. In addition, Postfix
times a connection may be reused, but this feature is unsafe as it
introduces a "fatal attractor" failure mode (when a destination has
multiple inbound MTAs, the slowest inbound MTA will attract most
-connections from Postfix to that destination). </p>.
+connections from Postfix to that destination). </p>
<p> Postfix 2.3 logs the use count of multiply-used connections,
as shown in the following example: </p>
@@ -260,13 +264,11 @@ This prevents mis-delivery of mail. </p>
<ul>
-<li> <p> The Postfix shared connection cache cannot be used with
-TLS, because saved TLS session information can be used only when a
-new connection is created (this limitation does not exist in
-connection caching implementations that reuse a connection only in
-the process that creates it). For this reason, the Postfix smtp(8)
-client always closes the connection after completing an attempt to
-deliver mail over TLS. </p>
+<li> <p> With Postfix versions &lt; 3.4, the Postfix shared connection
+cache cannot be used with TLS, because an open TLS connection can
+be reused only in the process that creates it. For this reason,
+the Postfix smtp(8) client historically always closed the connection
+after completing an attempt to deliver mail over TLS.</p>
<li> <p> Postfix connection caching currently does not support
multiple SASL accounts per mail server. Specifically, Postfix
diff --git a/external/ibm-public/postfix/dist/proto/DATABASE_README.html b/external/ibm-public/postfix/dist/proto/DATABASE_README.html
index c6525ed4c27..19bb9ae329d 100644
--- a/external/ibm-public/postfix/dist/proto/DATABASE_README.html
+++ b/external/ibm-public/postfix/dist/proto/DATABASE_README.html
@@ -317,8 +317,10 @@ name as used in "hash:table" is the database file name without the
<dd> A non-shared, in-memory lookup table. Example: "inline:{
<i>key=value</i>, { <i>key = text with whitespace or comma</i> }}".
-Key-value pairs are separated by whitespace or comma; whitespace
-after "{" and before "}" is ignored. Inline tables eliminate the
+Key-value pairs are separated by whitespace or comma; with a key-value
+pair inside "{}", whitespace is ignored after the opening "{",
+around the "=" between key and value, and before the closing "}".
+Inline tables eliminate the
need to create a database file for just a few fixed elements. See
also the static: map type. </dd>
@@ -401,7 +403,8 @@ databases. The lookup table name syntax is "proxy:type:table".
Each table query returns a random choice from the specified results.
The first and last characters of the "randmap:" table name must be
"{" and "}". Within these, individual maps are separated with comma
-or whitespace. </dd>
+or whitespace. To give a specific result more weight, specify it
+multiple times. </dd>
<dt> <b>regexp</b> (read-only) </dt>
@@ -436,7 +439,8 @@ server. See socketmap_table(5) for details. </dd>
For example, "static:foobar" always returns the string "foobar" as
lookup result. Specify "static:{ <i>text with whitespace</i> }"
when the result contains whitespace; this form ignores whitespace
-after "{" and before "}". See also the inline: map type. </dd>
+after the opening "{" and before the closing "}". See also the
+inline: map type. </dd>
<dt> <b>tcp</b> </dt>
diff --git a/external/ibm-public/postfix/dist/proto/DEBUG_README.html b/external/ibm-public/postfix/dist/proto/DEBUG_README.html
index 4c1877c9c42..2a5b012ab6d 100644
--- a/external/ibm-public/postfix/dist/proto/DEBUG_README.html
+++ b/external/ibm-public/postfix/dist/proto/DEBUG_README.html
@@ -71,9 +71,20 @@ debugger</a>
<h2><a name="logging">Look for obvious signs of trouble</a></h2>
-<p> Postfix logs all failed and successful deliveries to a logfile.
-The file is usually called /var/log/maillog or /var/log/mail; the
-exact pathname is defined in the /etc/syslog.conf file. </p>
+<p> Postfix logs all failed and successful deliveries to a logfile. </p>
+
+<ul>
+
+<li> <p> When Postfix uses syslog logging (the default), the file
+is usually called /var/log/maillog, /var/log/mail, or something
+similar; the exact pathname is configured in a file called
+/etc/syslog.conf, /etc/rsyslog.conf, or something similar. </p>
+
+<li> <p> When Postfix uses its own logging system (see MAILLOG_README),
+the location of the logfile is configured with the Postfix maillog_file
+parameter. </p>
+
+</ul>
<p> When Postfix does not receive or deliver mail, the first order
of business is to look for errors that prevent Postfix from working
diff --git a/external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html b/external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html
index 36110b8d82a..eee8b09617a 100644
--- a/external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html
+++ b/external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html
@@ -226,33 +226,36 @@ implements the P-256 curve, forward secrecy just works. </p>
setting the main.cf parameter smtpd_tls_eecdh_grade to "strong".
</p> </blockquote>
-<p> The elliptic curve situation is evolving, with new curves being
-introduced to augment or replace the NIST curves tarnished by the
-Snowden revelations. Fortunately, TLS clients advertise the list
-of supported curves to the server so that servers can in principle
-choose newer stronger curves when mutually supported. The OpenSSL
-code for making this possible is not yet released as of late 2013
-(it is available only in OpenSSL development snapshots). </p>
-
-<p> At some point Postfix will need to adjust to the new API for
-setting the elliptic-curve options. Fortunately, when EECDH support
-was added to Postfix, it introduced a layer of indirection: </p>
+<p> The elliptic curve standards are evolving, with new curves
+introduced in RFC 8031 to augment or replace the NIST curves tarnished
+by the Snowden revelations. Fortunately, TLS clients advertise
+their list of supported curves to the server so that servers can
+choose newer stronger curves when mutually supported. OpenSSL 1.0.2
+released in January 2015 was the first release to implement negotiation
+of supported curves in TLS servers. In older OpenSSL releases, the
+server is limited to selecting a single widely supported curve. </p>
+
+<p> With Postfix prior to 3.2 or OpenSSL prior to 1.0.2, only a
+single server-side curve can be configured, by specifying a suitable
+EECDH "grade": </p>
<blockquote>
<pre>
smtpd_tls_eecdh_grade = strong | ultra
- tls_eecdh_strong_curve = prime256v1
- tls_eecdh_ultra_curve = secp384r1
+ # Underlying curves, best not changed:
+ # tls_eecdh_strong_curve = prime256v1
+ # tls_eecdh_ultra_curve = secp384r1
</pre>
</blockquote>
-<p> When it becomes possible in OpenSSL to support a "menu" of
-curves, we will likely extend "tls_eecdh_strong_curve" to be an
-ordered list of curves and likewise with the "ultra" version, where
-the two might now overlap, and differ mostly in the preference
-order. As a result most existing configurations will then support
-more curves at the desired security level without any changes to
-main.cf. </p>
+<p> Postfix &ge; 3.2 supports the curve negotiation API of OpenSSL
+&ge; 1.0.2. When using this software combination, the default setting
+of "smtpd_tls_eecdh_grade" changes to "auto", which selects a curve
+that is supported by both the server and client. The list of
+candidate curves can be configured via "tls_eecdh_auto_curves",
+which can be used to configure a prioritized list of supported
+curves (most preferred first) on both the server and client.
+The default list is suitable for most users. </p>
<h2> <a name="client_fs">Forward Secrecy in the Postfix SMTP Client</a> </h2>
@@ -267,6 +270,13 @@ traffic between the server and client will resist decryption even
if the server's long-term authentication keys are <i>later</i>
compromised. </p>
+<p> Postfix &ge; 3.2 supports the curve negotiation API of OpenSSL
+&ge; 1.0.2. The list of candidate curves can be changed via the
+"tls_eecdh_auto_curves" configuration parameter, which can be used
+to select a prioritized list of supported curves (most preferred
+first) on both the Postfix SMTP server and SMTP client. The default
+list is suitable for most users. </p>
+
<p> The default Postfix SMTP client cipher lists are correctly
ordered to prefer EECDH and EDH cipher suites ahead of similar
cipher suites that don't implement forward secrecy. Administrators
@@ -285,7 +295,15 @@ table. </p>
<h3> EECDH Client support (Postfix &ge; 2.2 with OpenSSL &ge; 1.0.0) </h3>
-<p> This works "out of the box" without additional configuration. </p>
+<p> This works "out of the box" with no need for additional
+configuration. </p>
+
+<p> Postfix &ge; 3.2 supports the curve negotiation API of OpenSSL
+&ge; 1.0.2. The list of candidate curves can be changed via the
+"tls_eecdh_auto_curves" configuration parameter, which can be used
+to select a prioritized list of supported curves (most preferred
+first) on both the Postfix SMTP server and SMTP client. The default
+list is suitable for most users. </p>
<h3> EECDH Server support (Postfix &ge; 2.6 with OpenSSL &ge; 1.0.0) </h3>
@@ -297,7 +315,8 @@ by the vendor, as in some versions of RedHat Linux. </p>
<blockquote>
<pre>
/etc/postfix/main.cf:
- # Postfix 2.6 or 2.7 only. This is default with Postfix 2.8 and later.
+ # Postfix 2.6 &amp; 2.7 only. EECDH is on by default with Postfix &ge; 2.8.
+ # The default grade is "auto" with Postfix &ge; 3.2.
smtpd_tls_eecdh_grade = strong
</pre>
</blockquote>
@@ -322,9 +341,9 @@ few seconds to a few minutes): </p>
<pre>
# cd /etc/postfix
# umask 022
-# openssl dhparam -out dh512.tmp 512 && mv dh512.tmp dh512.pem
-# openssl dhparam -out dh1024.tmp 1024 && mv dh1024.tmp dh1024.pem
-# openssl dhparam -out dh2048.tmp 2048 && mv dh2048.tmp dh2048.pem
+# openssl dhparam -out dh512.tmp 512 &amp;&amp; mv dh512.tmp dh512.pem
+# openssl dhparam -out dh1024.tmp 1024 &amp;&amp; mv dh1024.tmp dh1024.pem
+# openssl dhparam -out dh2048.tmp 2048 &amp;&amp; mv dh2048.tmp dh2048.pem
# chmod 644 dh512.pem dh1024.pem dh2048.pem
</pre>
</blockquote>
@@ -378,7 +397,9 @@ peer certificate or public-key verification status. </p>
<li> <p> With "smtp_tls_loglevel = 1" and "smtpd_tls_loglevel = 1",
the Postfix SMTP client and server will log TLS connection information
-to the maillog file. The general logfile format is: </p>
+to the maillog file. The general logfile format is shown below.
+With TLS 1.3 there may be additional properties logged after the
+cipher name and bits. </p>
<blockquote>
<pre>
@@ -395,7 +416,8 @@ from host.example.com[192.168.0.2]: TLSv1 with cipher <i>cipher-name</i>
<li> <p> With "smtpd_tls_received_header = yes", the Postfix SMTP
server will record TLS connection information in the Received:
header in the form of comments (text inside parentheses). The general
-format depends on the smtpd_tls_ask_ccert setting:
+format depends on the smtpd_tls_ask_ccert setting. With TLS 1.3 there
+may be additional properties logged after the cipher name and bits. </p>
<blockquote>
<pre>
@@ -411,6 +433,46 @@ Received: from host.example.com (host.example.com [192.168.0.2])
</pre>
</blockquote>
+<p> TLS 1.3 examples. Some of the new attributes may not appear when not
+applicable or not available in older versions of the OpenSSL library. </p>
+
+<blockquote>
+<pre>
+Received: from localhost (localhost [127.0.0.1])
+ (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
+ (No client certificate requested)
+
+Received: from localhost (localhost [127.0.0.1])
+ (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256)
+ (Client CN "example.org", Issuer "example.org" (not verified))
+</pre>
+</blockquote>
+
+<ul>
+<li> <p> The "key-exchange" attribute records the type of "Diffie-Hellman"
+group used for key agreement. Possible values include "DHE", "ECDHE", "X25519"
+and "X448". With "DHE", the bit size of the prime will be reported in
+parentheses after the algorithm name, with "ECDHE", the curve name. </p>
+
+<li> <p> The "server-signature" attribute shows the public key signature
+algorithm used by the server. With "RSA-PSS", the bit size of the modulus will
+be reported in parentheses. With "ECDSA", the curve name. If, for example,
+the server has both an RSA and an ECDSA private key and certificate, it will be
+possible to track which one was used for a given connection. </p>
+
+<li> <p> The new "server-digest" attribute records the digest algorithm used by
+the server to prepare handshake messages for signing. The Ed25519 and Ed448
+signature algorithms do not make use of such a digest, so no "server-digest"
+will be shown for these signature algorithms. </p>
+
+<li> <p> When a client certificate is requested with "smtpd_tls_ask_ccert" and
+the client uses a TLS client-certificate, the "client-signature" and
+"client-digest" attributes will record the corresponding properties of the
+client's TLS handshake signature. </p> </ul>
+
</ul>
<p> The next sections will explain what <i>cipher-name</i>,
@@ -462,6 +524,75 @@ are generally the same with non-export ciphers, but may they
differ for the legacy export ciphers where the actual key
is artificially shortened. </p>
+<p> Starting with TLS 1.3 the cipher name no longer contains enough
+information to determine which forward-secrecy scheme was employed,
+but TLS 1.3 <b>always</b> uses forward-secrecy. On the client side,
+up-to-date Postfix releases log additional information for TLS 1.3
+connections, reporting the signature and key exchange algorithms.
+Two examples below (the long single line messages are folded across
+multiple lines for readability): </p>
+
+<blockquote>
+<pre>
+postfix/smtp[<i>process-id</i>]:
+ Untrusted TLS connection established to 127.0.0.1[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+
+postfix/smtp[<i>process-id</i>]:
+ Untrusted TLS connection established to 127.0.0.1[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256
+</pre>
+</blockquote>
+
+<p> In the above connections, the "key-exchange" value records the
+"Diffie-Hellman" algorithm used for key agreement. The "server-signature" value
+records the public key algorithm used by the server to sign the key exchange.
+The "server-digest" value records any hash algorithm used to prepare the data
+for signing. With "ED25519" and "ED448", no separate hash algorithm is used.
+</p>
+
+<p> Examples of Postfix SMTP server logging: </p>
+
+<blockquote>
+<pre>
+postfix/smtpd[<i>process-id</i>]:
+ Untrusted TLS connection established from localhost[127.0.0.1]:25:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+
+postfix/smtpd[<i>process-id</i>]:
+ Anonymous TLS connection established from localhost[127.0.0.1]:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ server-signature RSA-PSS (2048 bits) server-digest SHA256
+
+postfix/smtpd[<i>process-id</i>]:
+ Anonymous TLS connection established from localhost[127.0.0.1]:
+ TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ server-signature ED25519
+</pre>
+</blockquote>
+
+<p> Note that Postfix &ge; 3.4 server logging may also include a
+"to <i>sni-name</i>" element to record the use of an alternate
+server certificate chain for the connection in question. This happens
+when the client uses the TLS SNI extension, and the server selects
+a non-default certificate chain based on the client's SNI value:
+</p>
+
+<blockquote>
+<pre>
+postfix/smtpd[<i>process-id</i>]:
+ Untrusted TLS connection established from client.example[192.0.2.1]
+ to server.example: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+ key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
+ client-signature ECDSA (P-256) client-digest SHA256
+</pre>
+</blockquote>
+
<h2><a name="status"> What do "Anonymous", "Untrusted", etc. in
Postfix logging mean? </a> </h2>
diff --git a/external/ibm-public/postfix/dist/proto/MAILLOG_README.html b/external/ibm-public/postfix/dist/proto/MAILLOG_README.html
new file mode 100644
index 00000000000..9804983a702
--- /dev/null
+++ b/external/ibm-public/postfix/dist/proto/MAILLOG_README.html
@@ -0,0 +1,183 @@
+<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
+ "http://www.w3.org/TR/html4/loose.dtd">
+
+<html>
+
+<head>
+
+<title>Postfix logging to file or stdout</title>
+
+<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
+
+</head>
+
+<body>
+
+<h1><img src="postfix-logo.jpg" width="203" height="98" ALT="">Postfix
+logging to file or stdout</h1>
+
+<hr>
+
+<h2>Overview </h2>
+
+<p> Postfix supports it own logging system as an alternative to
+syslog (which remains the default). This is available with Postfix
+version 3.4 or later. </p>
+
+<p> Topics covered in this document: </p>
+
+<ul>
+
+<li><a href="#log-to-file">Configuring logging to file</a>
+
+<li><a href="#log-to-stdout">Configuring logging to stdout</a>
+
+<li><a href="#logrotate">Rotating logs </a>
+
+<li><a href="#limitations">Limitations</a>
+
+</ul>
+
+<h2> <a name="log-to-file"> Configuring logging to file </a> </h2>
+
+<p> Logging to file solves a usability problem for MacOS, and
+eliminates multiple problems for systemd-based systems. </p>
+
+<ol>
+
+<li> <p> Add the following line to master.cf if not already present
+(note: there must be no whitespace at the start of the line): </p>
+
+<blockquote>
+<pre>
+postlog unix-dgram n - n - 1 postlogd
+</pre>
+</blockquote>
+
+<p> Note: the service type "<b>unix-dgram</b>" was introduced with
+Postfix 3.4. Remove the above line before backing out to an older
+Postfix version. </p>
+
+<li> <p> Configure Postfix to write logging, to, for example,
+/var/log/postfix.log. See also the "<a href="#logrotate">Logfile
+rotation</a>" section below for logfile management. </p>
+
+<blockquote>
+<pre>
+# postfix stop
+# postconf maillog_file=/var/log/postfix.log
+# postfix start
+</pre>
+</blockquote>
+
+<p> By default, the logfile name must start with "/var" or "/dev/stdout"
+(the list of allowed prefixes is configured with the maillog_file_prefixes
+parameter). This safety mechanism limits the damage from a single
+configuration mistake. </p>
+
+</ol>
+
+<h2> <a name="log-to-stdout"> Configuring logging to stdout </a> </h2>
+
+<p> Logging to stdout is useful when Postfix runs in a container,
+as it eliminates a syslogd dependency. </p>
+
+<ol>
+
+<li> <p> Add the following line to master.cf if not already present (note:
+there must be no whitespace at the start of the line): </p>
+
+<blockquote>
+<pre>
+postlog unix-dgram n - n - 1 postlogd
+</pre>
+</blockquote>
+
+<p> Note: the service type "<b>unix-dgram</b>" was introduced with
+Postfix 3.4. Remove the above line before backing out to an older
+Postfix version. </p>
+
+<li> <p> Configure main.cf with "maillog_file = /dev/stdout". </p>
+
+<li> <p> Start Postfix with "<b>postfix start-fg</b>". </p>
+
+</ol>
+
+<h2> <a name="logrotate"> Rotating logs </a> </h2>
+
+<p> The command "<b>postfix logrotate</b>" may be run by hand or
+by a cronjob. It logs all errors, and reports errors to stderr if
+run from a terminal. This command implements the following steps:
+</p>
+
+<ul>
+
+<li> <p> Rename the current logfile by appending a suffix that
+contains the date and time. This suffix is configured with the
+maillog_file_rotate_suffix parameter (default: %Y%M%d-%H%M%S). </p>
+
+<li> <p> Reload Postfix so that postlogd(8) immediately closes the
+old logfile. </p>
+
+<li> <p> After a brief pause, compress the old logfile. The compression
+program is configured with the maillog_file_compressor parameter
+(default: gzip). </p>
+
+</ul>
+
+<p> Notes: </p>
+
+<ul>
+
+<li> <p> This command will not rotate a logfile with pathname under
+the /dev directory, such as /dev/stdout. </p>
+
+<li> <p> This command does not (yet) remove old logfiles. </p>
+
+</ul>
+
+<h2> <a name="limitations">Limitations</a> </h2>
+
+<p> Background: </p>
+
+<ul>
+
+<li> <p> Postfix consists of a number of daemon programs that run
+in the background, as well as non-daemon programs for local mail
+submission or Postfix management.
+
+<li> <p> Logging to Postfix logfile or stdout requires the Postfix
+postlogd(8) service. This ensures that simultaneous logging from
+different programs will not get mixed up. </p>
+
+<li> <p> All Postfix programs can log to syslog, but not all programs
+have sufficient privileges to use the Postfix logging service, and
+many non-daemon programs must not log to stdout as that would corrupt
+their output. </p>
+
+</ul>
+
+<p> Limitations: </p>
+
+<ul>
+
+<li> <p> Non-daemon Postfix programs will log errors to syslogd(8)
+before they have processed command-line options and main.cf parameters.
+
+<li> <p> If Postfix is down, the non-daemon programs postfix(1),
+postsuper(1), postmulti(1), and postlog(1), will log directly to
+$maillog_file. These programs expect to run with root privileges,
+for example during Postfix start-up, reload, or shutdown.
+
+<li> <p> Other non-daemon Postfix programs will never write directly
+to $maillog_file (also, logging to stdout would interfere with the
+operation of some of these programs). These programs can log to
+postlogd(8) if they are run by the super-user, or if their executable
+file has set-gid permission. Do not set this permission on programs
+other than postdrop(1) and postqueue(1).
+
+</ul>
+
+</body>
+
+</html>
diff --git a/external/ibm-public/postfix/dist/proto/MILTER_README.html b/external/ibm-public/postfix/dist/proto/MILTER_README.html
index c7031d48ec8..886299f4f75 100644
--- a/external/ibm-public/postfix/dist/proto/MILTER_README.html
+++ b/external/ibm-public/postfix/dist/proto/MILTER_README.html
@@ -259,6 +259,9 @@ support per-Milter timeouts, per-Milter error handling, etc. </p>
<li><a href="#per-milter">Different settings for different Milter
applications </a>
+<li><a href="#per-client">Different settings for different SMTP
+clients </a>
+
<li><a href="#macros">Sendmail macro emulation</a>
<li><a href="#send-macros">What macros will Postfix send to Milters?</a>
@@ -320,6 +323,11 @@ form <b>inet:</b><i>port</i><b>@</b><i>host</i>. </p> </dd>
</blockquote>
+<p> For advanced configuration see "<a href="#per-client">Different
+settings for different SMTP clients</a>" and "<a
+href="#per-milter">Different settings for different Milter
+applications</a>". </p>
+
<h3> <a name="non-smtp-milters">Non-SMTP Milter applications </a> </h3>
<p> The non-SMTP Milter applications handle mail that arrives via
@@ -564,6 +572,29 @@ main.cf: items separated by space or comma. There is one difference:
}", if you want to have space or comma within a value or around
"="</b>. </p>
+<h3><a name="per-client">Different settings for different SMTP
+clients </a></h3>
+
+<p> The smtpd_milter_maps feature supports different Milter settings
+for different client IP addresses. Lookup results override the the
+global smtpd_milters setting, and have the same syntax. For example,
+to disable Milter settings for local address ranges: </p>
+
+<pre>
+/etc/postfix/main.cf:
+ smtpd_milter_maps = cidr:/etc/postfix/smtpd_milter_map
+ smtpd_milters = inet:host:port, { inet:host:port, ... }, ...
+
+/etc/postfix/smtpd_milter_map:
+ # Disable Milters for local clients.
+ 127.0.0.0/8 DISABLE
+ 192.168.0.0/16 DISABLE
+ ::/64 DISABLE
+ 2001:db8::/32 DISABLE
+</pre>
+
+<p> This feature is available with Postfix 3.2 and later. </p>
+
<h3><a name="macros">Sendmail macro emulation</a></h3>
<p> Postfix emulates a limited number of Sendmail macros, as shown
@@ -601,19 +632,19 @@ sender </td> </tr>
<tr> <td> {auth_type} </td> <td> MAIL, DATA, EOH, EOM </td> <td> SASL
login method </td> </tr>
-<tr> <td> {client_addr} </td> <td> Always </td> <td> Client IP
-address </td> </tr>
+<tr> <td> {client_addr} </td> <td> Always </td> <td> Remote client
+IP address </td> </tr>
<tr> <td> {client_connections} </td> <td> CONNECT </td> <td>
Connection concurrency for this client (zero if the client is
excluded from all smtpd_client_* limits). </td> </tr>
-<tr> <td> {client_name} </td> <td> Always </td> <td> Client hostname
-<br> When address &rarr; name lookup or name &rarr; address
+<tr> <td> {client_name} </td> <td> Always </td> <td> Remote client
+hostname <br> When address &rarr; name lookup or name &rarr; address
verification fails: "unknown" </td> </tr>
<tr> <td> {client_port} </td> <td> Always (Postfix &ge;2.5) </td>
-<td> Client TCP port </td> </tr>
+<td> Remote client TCP port </td> </tr>
<tr> <td> {client_ptr} </td> <td> CONNECT, HELO, MAIL, DATA </td>
<td> Client name from address &rarr; name lookup <br> When address
@@ -631,9 +662,15 @@ TLS session key size </td> </tr>
<tr> <td> {cipher} </td> <td> HELO, MAIL, DATA, EOH, EOM </td> <td> TLS
cipher </td> </tr>
+<tr> <td> {daemon_addr} </td> <td> Always (Postfix &ge;3.2) </td>
+<td> Local server IP address </td> </tr>
+
<tr> <td> {daemon_name} </td> <td> Always </td> <td> value of
milter_macro_daemon_name </td> </tr>
+<tr> <td> {daemon_port} </td> <td> Always (Postfix &ge;3.2) </td>
+<td> Local server TCP port </td> </tr>
+
<tr> <td> {mail_addr} </td> <td> MAIL </td> <td> Sender address
</td> </tr>
@@ -748,7 +785,8 @@ example. </p>
<li> <p> Some Milter applications use the "<tt>{if_addr}</tt>" macro
to recognize local mail; this macro does not exist in Postfix.
-Workaround: use the "<tt>{client_addr}</tt>" macro instead. </p>
+Workaround: use the "<tt>{daemon_addr}</tt>" (Postfix &ge; 3.2) or
+"<tt>{client_addr}</tt>" macro instead. </p>
<li> <p> Some Milter applications log a warning that looks like
this: </p>
diff --git a/external/ibm-public/postfix/dist/proto/MYSQL_README.html b/external/ibm-public/postfix/dist/proto/MYSQL_README.html
index 73e8b2da3fb..3b37a006275 100644
--- a/external/ibm-public/postfix/dist/proto/MYSQL_README.html
+++ b/external/ibm-public/postfix/dist/proto/MYSQL_README.html
@@ -132,7 +132,7 @@ where_field = alias
additional_conditions = AND status = 'paid'
# This is necessary to make UTF8 queries work for Postfix 2.11 .. 3.1,
-# and is the default setting as of Postfix 3.2,
+# and is the default setting as of Postfix 3.2.
option_group = client
</pre>
diff --git a/external/ibm-public/postfix/dist/proto/Makefile.in b/external/ibm-public/postfix/dist/proto/Makefile.in
index a9cc15287ab..6f435ee4a6c 100644
--- a/external/ibm-public/postfix/dist/proto/Makefile.in
+++ b/external/ibm-public/postfix/dist/proto/Makefile.in
@@ -11,6 +11,7 @@ HTML = ../html/ADDRESS_CLASS_README.html \
../html/ADDRESS_VERIFICATION_README.html \
../html/BACKSCATTER_README.html \
../html/BASIC_CONFIGURATION_README.html \
+ ../html/BDAT_README.html \
../html/BUILTIN_FILTER_README.html \
../html/CDB_README.html \
../html/COMPATIBILITY_README.html \
@@ -25,6 +26,7 @@ HTML = ../html/ADDRESS_CLASS_README.html \
../html/LDAP_README.html \
../html/LINUX_README.html \
../html/LOCAL_RECIPIENT_README.html ../html/MAILDROP_README.html \
+ ../html/MAILLOG_README.html \
../html/LMDB_README.html \
../html/MEMCACHE_README.html \
../html/MILTER_README.html \
@@ -56,6 +58,7 @@ README = ../README_FILES/ADDRESS_CLASS_README \
../README_FILES/ADDRESS_VERIFICATION_README \
../README_FILES/BACKSCATTER_README \
../README_FILES/BASIC_CONFIGURATION_README \
+ ../README_FILES/BDAT_README \
../README_FILES/BUILTIN_FILTER_README \
../README_FILES/CDB_README \
../README_FILES/COMPATIBILITY_README \
@@ -70,6 +73,7 @@ README = ../README_FILES/ADDRESS_CLASS_README \
../README_FILES/LDAP_README \
../README_FILES/LINUX_README \
../README_FILES/LOCAL_RECIPIENT_README ../README_FILES/MAILDROP_README \
+ ../README_FILES/MAILLOG_README \
../README_FILES/LMDB_README \
../README_FILES/MEMCACHE_README \
../README_FILES/MILTER_README \
@@ -177,6 +181,9 @@ clobber:
../html/BASIC_CONFIGURATION_README.html: BASIC_CONFIGURATION_README.html
$(DETAB) $? | $(POSTLINK) >$@
+../html/BDAT_README.html: BDAT_README.html
+ $(DETAB) $? | $(POSTLINK) >$@
+
../html/BUILTIN_FILTER_README.html: BUILTIN_FILTER_README.html
$(DETAB) $? | $(POSTLINK) >$@
@@ -219,6 +226,9 @@ clobber:
../html/MAILDROP_README.html: MAILDROP_README.html
$(DETAB) $? | $(POSTLINK) >$@
+../html/MAILLOG_README.html: MAILLOG_README.html
+ $(DETAB) $? | $(POSTLINK) >$@
+
../html/LMDB_README.html: LMDB_README.html
$(DETAB) $? | $(POSTLINK) >$@
@@ -333,6 +343,9 @@ clobber:
../README_FILES/BASIC_CONFIGURATION_README: BASIC_CONFIGURATION_README.html
$(DETAB) $? | $(HT2READ) >$@
+../README_FILES/BDAT_README: BDAT_README.html
+ $(DETAB) $? | $(HT2READ) >$@
+
../README_FILES/BUILTIN_FILTER_README: BUILTIN_FILTER_README.html
$(DETAB) $? | $(HT2READ) >$@
@@ -390,6 +403,9 @@ clobber:
../README_FILES/MAILDROP_README: MAILDROP_README.html
$(DETAB) $? | $(HT2READ) >$@
+../README_FILES/MAILLOG_README: MAILLOG_README.html
+ $(DETAB) $? | $(HT2READ) >$@
+
../README_FILES/LMDB_README: LMDB_README.html
$(DETAB) $? | $(HT2READ) >$@
diff --git a/external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html b/external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html
index d0ad3e7fc91..66f8f87707a 100644
--- a/external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html
+++ b/external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html
@@ -106,7 +106,7 @@ problem will get worse before things improve, if ever. Without a
tool like postscreen(8) that keeps the zombies away, Postfix would be
spending most of its resources not receiving email. </p>
-<p> The main challenge for postscreen(8) is to make an is-it-a-zombie
+<p> The main challenge for postscreen(8) is to make an is-a-zombie
decision based on a single measurement. This is necessary because
many zombies try to fly under the radar and avoid spamming the same
site repeatedly. Once postscreen(8) decides that a client is
@@ -124,13 +124,13 @@ mail even when the server tells them to go away. </p>
zombies. First, postscreen(8) determines if the remote SMTP client
IP address is blacklisted. Second, postscreen(8) looks for protocol
compromises that are made to speed up delivery. These are good
-indicators for making is-it-a-zombie decisions based on single
+indicators for making is-a-zombie decisions based on single
measurements. </p>
<p> postscreen(8) does not inspect message content. Message content
can vary from one delivery to the next, especially with clients
that (also) send legitimate email. Content is not a good indicator
-for making is-it-a-zombie decisions based on single measurements,
+for making is-a-zombie decisions based on single measurements,
and that is the problem that postscreen(8) is focused on. </p>
<h2> <a name="general"> General operation </a> </h2>
@@ -714,16 +714,25 @@ The "<tt><b>after</b> <i>command</i></tt>" portion is logged with
Postfix 2.10 and later. </p>
<p> When an SMTP client makes too many connections at the same time,
-or when all postscreen(8) ports are busy, postscreen(8) rejects the
-connection with a 421 status code and logs: </p>
+postscreen(8) rejects the connection with a 421 status code and logs: </p>
<pre>
<b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: too many connections</b>
+</pre>
+
+<p> The postscreen_client_connection_count_limit parameter controls this limit. </p>
+
+<p> When an SMTP client connects after postscreen(8) has reached a
+connection count limit, postscreen(8) rejects the connection with
+a 421 status code and logs: </p>
+
+<pre>
+ <b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all screening ports busy</b>
<b>NOQUEUE: reject: CONNECT from</b> <i>[address]:port</i><b>: all server ports busy</b>
</pre>
-<p> The postscreen_client_connection_count_limit and
-postscreen_pre_queue_limit parameters control these limits. </p>
+<p> The postscreen_pre_queue_limit and postscreen_post_queue_limit
+parameters control these limits. </p>
<h2> <a name="victory">When all tests succeed</a> </h2>
@@ -1072,8 +1081,8 @@ of the following options: </p>
<li> <p> A non-persistent memcache: temporary whitelist can be shared
between postscreen(8) daemons on the same host or different
hosts. Disable cache cleanup (postscreen_cache_cleanup_interval
- = 0) in all postscreen(8) daemons because memcache: does not
- implement this (but see example 4 below for memcache: with
+ = 0) in all postscreen(8) daemons because memcache: has no
+ first-next API (but see example 4 below for memcache: with
persistent backup). This requires Postfix 2.9 or later. </p>
<pre>
diff --git a/external/ibm-public/postfix/dist/proto/SASL_README.html b/external/ibm-public/postfix/dist/proto/SASL_README.html
index 00e2ab1432a..89b1cf40185 100644
--- a/external/ibm-public/postfix/dist/proto/SASL_README.html
+++ b/external/ibm-public/postfix/dist/proto/SASL_README.html
@@ -15,15 +15,6 @@
<hr>
-<h2>Warning</h2>
-
-<p> People who go to the trouble of installing Postfix may have the
-expectation that Postfix is more secure than some other mailers.
-The Cyrus SASL library contains a lot of code. With this, Postfix
-becomes as secure as other mail systems that use the Cyrus SASL
-library. Dovecot provides an alternative that may be worth
-considering. </p>
-
<h2><a name="intro">How Postfix uses SASL authentication</a></h2>
<p> SMTP servers need to decide whether an SMTP client is authorized
@@ -47,6 +38,13 @@ configuration files belong to the specific SASL
implementation that Postfix will use. This document covers both the
Postfix and non-Postfix configuration. </p>
+<p> NOTE: People who go to the trouble of installing Postfix may
+have the expectation that Postfix is more secure than some other
+mailers. The Cyrus SASL library contains a lot of code. With this,
+Postfix becomes as secure as other mail systems that use the Cyrus
+SASL library. Dovecot provides an alternative that may be worth
+considering. </p>
+
<p> You can read more about the following topics: </p>
<ul>
diff --git a/external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html b/external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html
index ef45e1dd412..af73f78b58c 100644
--- a/external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html
+++ b/external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html
@@ -187,12 +187,6 @@ described in the postconf(5) manual page. </p>
# Don't accept mail from domains that don't exist.
smtpd_sender_restrictions = reject_unknown_sender_domain
- # Relay control (Postfix 2.10 and later): local clients and
- # authenticated clients may specify any destination domain.
- smtpd_relay_restrictions = permit_mynetworks,
- permit_sasl_authenticated,
- reject_unauth_destination
-
# Spam control: exclude local clients and authenticated clients
# from DNSBL lookups.
smtpd_recipient_restrictions = permit_mynetworks,
@@ -206,6 +200,12 @@ described in the postconf(5) manual page. </p>
reject_rhsbl_helo dbl.spamhaus.org,
reject_rhsbl_sender dbl.spamhaus.org
+ # Relay control (Postfix 2.10 and later): local clients and
+ # authenticated clients may specify any destination domain.
+ smtpd_relay_restrictions = permit_mynetworks,
+ permit_sasl_authenticated,
+ reject_unauth_destination
+
# Block clients that speak too early.
smtpd_data_restrictions = reject_unauth_pipelining
@@ -246,20 +246,20 @@ Reject HELO/EHLO information </td> </tr>
Optional </td> <td>
Reject MAIL FROM information </td> </tr>
-<tr> <td rowspan="2"> smtpd_relay_restrictions </td> <td> &ge; 2.10
-</td> <td> Required if smtpd_recipient_restrictions does not enforce
+<tr> <td rowspan="2"> smtpd_recipient_restrictions </td> <td> &ge;
+2.10 </td> <td> Required if smtpd_relay_restrictions does not enforce
relay policy</td>
<td rowspan="2"> Reject RCPT TO information </td> </tr>
-<tr> <td> &lt 2.10</td> <td> Not available </td>
-</tr>
+<tr> <td> &lt; 2.10</td> <td> Required </td> </tr>
-<tr> <td rowspan="2"> smtpd_recipient_restrictions </td> <td> &ge;
-2.10 </td> <td> Required if smtpd_relay_restrictions does not enforce
+<tr> <td rowspan="2"> smtpd_relay_restrictions </td> <td> &ge; 2.10
+</td> <td> Required if smtpd_recipient_restrictions does not enforce
relay policy</td>
<td rowspan="2"> Reject RCPT TO information </td> </tr>
-<tr> <td> &lt 2.10</td> <td> Required </td> </tr>
+<tr> <td> &lt; 2.10</td> <td> Not available </td>
+</tr>
<tr> <td> smtpd_data_restrictions </td> <td> &ge; 2.0 </td> <td>
Optional </td> <td>
diff --git a/external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html b/external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html
index b38a759eac5..e2554b217e1 100644
--- a/external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html
+++ b/external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html
@@ -31,7 +31,7 @@ can be found in the Postfix source code, in the directory
examples/smtpd-policy. </p>
<p> Another example of policy delegation is the SPF policy server
-at http://www.openspf.org/Software. </p>
+at https://web.archive.org/web/20190221142057/http://www.openspf.org/Software. </p>
<p> Policy delegation is now the preferred method for adding policies
to Postfix. It's much easier to develop a new feature in few lines
@@ -65,11 +65,14 @@ multiple times, for up to $max_use incoming SMTP connections. </p>
<h2><a name="protocol">Protocol description</a></h2>
-<p> The Postfix policy delegation protocol is really simple. The
-client request is a sequence of name=value attributes separated by
-newline, and is terminated by an empty line. The server reply is
-one name=value attribute and it, too, is terminated by an empty
-line. </p>
+<p> The Postfix policy delegation protocol is really simple. The client
+sends a request and the server sends a response. Unless there was an
+error, the server must not close the connection, so that the same
+connection can be used multiple times. </p>
+
+<p> The client request is a sequence of name=value attributes separated
+by newline, and is terminated by an empty line. The server reply is one
+name=value attribute and it, too, is terminated by an empty line. </p>
<p> Here is an example of all the attributes that the Postfix SMTP
server sends in a delegated SMTPD access policy request: </p>
@@ -110,6 +113,9 @@ ccert_pubkey_fingerprint=68:B3:29:DA:98:93:E3:40:99:C7:D8:AD:5C:B9:C9:40
client_port=1234
<b>Postfix version 3.1 and later:</b>
policy_context=submission
+<b>Postfix version 3.2 and later:</b>
+server_address=10.3.2.1
+server_port=54321
[empty line]
</pre>
</blockquote>
@@ -137,16 +143,23 @@ policy_context=submission
<li> <p> The "recipient" attribute is available in the "RCPT
TO" stage. It is also available in the "DATA" and "END-OF-MESSAGE"
stages if Postfix accepted only one recipient for the current
- message. </p>
+ message.
+ The DATA protocol state also applies to email that is received
+ with BDAT commands (Postfix 3.4 and later). </p>
<li> <p> The "recipient_count" attribute (Postfix 2.3 and later)
is non-zero only in the "DATA" and "END-OF-MESSAGE" stages. It
specifies the number of recipients that Postfix accepted for
- the current message. </p>
+ the current message.
+ The DATA protocol state also applies to email that is received
+ with BDAT commands (Postfix 3.4 and later). </p>
- <li> <p> The client address is an IPv4 dotted quad in the form
- 1.2.3.4 or it is an IPv6 address in the form 1:2:3::4:5:6.
- </p>
+ <li> <p> The remote client or local server IP address is an
+ IPv4 dotted quad in the form 1.2.3.4 or it is an IPv6 address
+ in the form 1:2:3::4:5:6. </p>
+
+ <li> <p> The remote client or local server port is a decimal
+ number in the range 0-65535. </p>
<li> <p> For a discussion of the differences between reverse
and verified client_name information, see the
@@ -167,8 +180,7 @@ policy_context=submission
<li> <p> The "size" attribute value specifies the message size
that the client specified in the MAIL FROM command (zero if
none was specified). With Postfix 2.2 and later, it specifies
- the actual message size when the client sends the END-OF-DATA
- command.
+ the actual message size after the client sends the END-OF-MESSAGE.
</p>
<li> <p> The "sasl_*" attributes (Postfix 2.2 and later) specify
@@ -214,6 +226,8 @@ policy_context=submission
DATA, END-OF-MESSAGE, VRFY or ETRN; these are the SMTP protocol
states where
the Postfix SMTP server makes an OK/REJECT/HOLD/etc. decision.
+ The DATA protocol state also applies to email that is received
+ with BDAT commands (Postfix 3.4 and later).
</p>
</ul>
@@ -410,11 +424,12 @@ the result. </p>
<blockquote>
<pre>
1 /etc/postfix/main.cf:
-2 smtpd_recipient_restrictions =
+2 mua_recipient_restrictions =
3 ...
4 reject_unauth_destination
5 check_policy_service { inet:host:port,
-6 timeout=10s, default_action=DUNNO }
+6 timeout=10s, default_action=DUNNO
+7 policy_context=submission }
8 ...
</pre>
</blockquote>
@@ -427,7 +442,7 @@ the result. </p>
This supports the exact same "inet" and "unix" syntax as described
earlier. </p>
-<li> <p> Line 6: The remainder of the list contains per-client
+<li> <p> Line 6-7: The remainder of the list contains per-client
settings. These settings override global main.cf parameters,
and have the same name as those parameters, without the
"smtpd_policy_service_" prefix. </p>
diff --git a/external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html b/external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html
index 9f6e1c04228..9389297ad05 100644
--- a/external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html
+++ b/external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html
@@ -7,7 +7,7 @@
<title>Postfix SMTPUTF8 support</title>
-<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
@@ -44,15 +44,17 @@ header values. </p>
<li><a href="#compatibility">Compatibility with pre-SMTPUTF8 environments</a>
+<li><a href="#idna2003">Compatibility with IDNA2003</a>
+
<li><a href="#credits">Credits</a>
</ul>
<h2> <a name="building">Building Postfix with/without SMTPUTF8 support</a> </h2>
-<p> Postfix will build with SMTPUTF8 support if the ICU library and
-header files are installed on the system. The package name varies
-with the OS distribution (and version). The table shows package
+<p> Postfix will build with SMTPUTF8 support if the ICU version
+&ge; 46 library and header files are installed on the system. The
+package name varies with the OS distribution. The table shows package
names for a number of platforms at the time this text was written.
</p>
@@ -104,6 +106,10 @@ parameter in main.cf:</p>
</pre>
</blockquote>
+<p> (With Postfix &le; 3.1, you may also need to specify "<b>option_group
+= client</b>" in Postfix MySQL client files, to enable UTF8 support
+in MySQL queries. This setting is the default as of Postfix 3.2.) </p>
+
<p> With SMTPUTF8 support enabled, Postfix changes behavior with
respect to earlier Postfix releases: </p>
@@ -340,12 +346,36 @@ in address localparts (and in headers) as before. The vast majority
of email software is perfectly capable of handling such email, even
if pre-SMTPUTF8 standards do not support such practice. </p>
-<p> However, when you specify "smtputf8_enable = yes", Postfix
+<h3> Rejecting non-UTF8 addresses </h3>
+
+<p> With "smtputf8_enable = yes", Postfix
requires that non-ASCII address information is encoded in UTF-8 and
will reject other encodings such as ISO-8859. It is not practical
for Postfix to support multiple encodings at the same time. There
is no problem with RFC 2047 encodings such as "=?ISO-8859-1?Q?text?=",
-because those use only characters from the ASCII characterset. </p>
+because those use only characters from the ASCII characterset. </p>
+
+<h3> Rejecting non-ASCII addresses in non-SMTPUTF8 transactions </h3>
+
+<p> Setting "strict_smtputf8 = yes" in addition to "smtputf8_enable
+= yes" will enable stricter enforcement of the SMTPUTF8 protocol.
+Specifically, the Postfix SMTP server will not only reject non-UTF8
+sender or recipient addresses, it will in addition accept UTF-8
+sender or recipient addresses only when the client requests an
+SMTPUTF8 mail transaction. </p>
+
+<h2> <a name="idna2003">Compatibility with IDNA2003</a> </h2>
+
+<p> Postfix &ge; 3.2 by default disables the 'transitional'
+compatibility between IDNA2003 and IDNA2008, when converting UTF-8
+domain names to/from the ASCII form that is used in DNS lookups.
+This makes Postfix behavior consistent with current versions of the
+Firefox and Chrome web browsers. Specify "enable_idna2003_compatibility
+= yes" to get the historical behavior. </p>
+
+<p> This affects the conversion of domain names that contain for
+example the German sz (ß) and the Greek zeta (ς). See
+http://unicode.org/cldr/utility/idna.jsp for more examples. </p>
<h2> <a name="credits">Credits</a> </h2>
diff --git a/external/ibm-public/postfix/dist/proto/STRESS_README.html b/external/ibm-public/postfix/dist/proto/STRESS_README.html
index 31d01c5af26..b5e3ccbfeb3 100644
--- a/external/ibm-public/postfix/dist/proto/STRESS_README.html
+++ b/external/ibm-public/postfix/dist/proto/STRESS_README.html
@@ -147,8 +147,8 @@ value): </p>
</pre>
</blockquote>
-<p> Services that have local access only never have "-o stress"
-parameters on the command line. This includes services internal to
+<p> You won't see "-o stress" command-line parameters with services
+that have local clients only. These include services internal to
Postfix such as the queue manager, and services that listen on a
loopback interface only, such as after-filter SMTP services. </p>
@@ -171,6 +171,10 @@ default with Postfix 2.6 and later. </p>
<p> Postfix versions before 3.0 use the older form ${stress?x}${stress:y}
instead of the newer form ${stress?{x}:{y}}. </p>
+<p> The syntax of ${name?{value}:{value}}, ${name?value} and
+${name:value} is explained at the beginning of the postconf(5)
+manual page. </p>
+
<p> Translation: <p>
<ul>
@@ -187,7 +191,7 @@ from some clients. No mail should be lost, as long as this measure
is used only temporarily. </p>
<li> <p> Line 2: under conditions of stress, use an smtpd_hard_error_limit
-of 1 instead of the default 20. This helps by disconnecting clients
+of 1 instead of the default 20. This disconnects clients
after a single error, giving other clients a chance to connect.
However, this may cause significant delays with legitimate mail,
such as a mailing list that contains a few no-longer-active user
@@ -219,10 +223,6 @@ as this measure is used only temporarily. </p>
</ul>
-<p> The syntax of ${name?{value}:{value}}, ${name?value} and
-${name:value} is explained at the beginning of the postconf(5)
-manual page. </p>
-
<p> NOTE: Please keep in mind that the stress-adaptive feature is
a fairly desperate measure to keep <b>some</b> legitimate mail
flowing under overload conditions. If a site is reaching the SMTP
@@ -415,8 +415,8 @@ in section "<a href="#adapt">Automatic stress-adaptive behavior</a>".
<h2><a name="legacy"> Temporary measures for older Postfix releases </a></h2>
-<p> See the next section, "<a href="#adapt">Automatic stress-adaptive
-behavior</a>", if you are running Postfix version 2.5 or later, or
+<p> See the section "<a href="#adapt">Automatic stress-adaptive
+behavior</a>" if you are running Postfix version 2.5 or later, or
if you have applied the source code patch for stress-adaptive
behavior from the mirrors listed at http://www.postfix.org/download.html.
</p>
diff --git a/external/ibm-public/postfix/dist/proto/XCLIENT_README.html b/external/ibm-public/postfix/dist/proto/XCLIENT_README.html
index d53e295c742..e4e2f0a1f92 100644
--- a/external/ibm-public/postfix/dist/proto/XCLIENT_README.html
+++ b/external/ibm-public/postfix/dist/proto/XCLIENT_README.html
@@ -80,7 +80,7 @@ names are shown in upper case, they are in fact case insensitive.
xclient-command = XCLIENT 1*( SP attribute-name"="attribute-value )
</p>
<p>
- attribute-name = ( NAME | ADDR | PORT | PROTO | HELO | LOGIN )
+ attribute-name = ( NAME | ADDR | PORT | PROTO | HELO | LOGIN | DESTADDR | DESTPORT )
</p>
<p>
attribute-value = xtext
@@ -92,23 +92,32 @@ names are shown in upper case, they are in fact case insensitive.
<li> <p> Attribute values are xtext encoded as per RFC 1891.
</p>
- <li> <p> The NAME attribute specifies an SMTP client hostname
- (not an SMTP client address), [UNAVAILABLE] when client hostname
- lookup failed due to a permanent error, or [TEMPUNAVAIL] when
- the lookup error condition was transient. </p>
+ <li> <p> The NAME attribute specifies a remote SMTP client
+ hostname (not an SMTP client address), [UNAVAILABLE] when client
+ hostname lookup failed due to a permanent error, or [TEMPUNAVAIL]
+ when the lookup error condition was transient. </p>
- <li> <p> The ADDR attribute specifies an SMTP client numerical
- IPv4 network address, an IPv6 address prefixed with IPV6:, or
- [UNAVAILABLE] when the address information is unavailable.
- Address information is not enclosed with []. </p>
+ <li> <p> The ADDR attribute specifies a remote SMTP client
+ numerical IPv4 network address, an IPv6 address prefixed with
+ IPV6:, or [UNAVAILABLE] when the address information is
+ unavailable. Address information is not enclosed with []. </p>
- <li> <p> The PORT attribute specifies the SMTP client TCP port
- number as a decimal number, or [UNAVAILABLE] when the information
- is unavailable. </p>
+ <li> <p> The PORT attribute specifies a remote SMTP client TCP
+ port number as a decimal number, or [UNAVAILABLE] when the
+ information is unavailable. </p>
<li> <p> The PROTO attribute specifies either SMTP or ESMTP.
</p>
+ <li> <p> The DESTADDR attribute specifies a local SMTP server
+ numerical IPv4 network address, an IPv6 address prefixed with
+ IPV6:, or [UNAVAILABLE] when the address information is
+ unavailable. Address information is not enclosed with []. </p>
+
+ <li> <p> The DESTPORT attribute specifies a local SMTP server
+ TCP port number as a decimal number, or [UNAVAILABLE] when the
+ information is unavailable. </p>
+
<li> <p> The HELO attribute specifies an SMTP HELO parameter
value, or the value [UNAVAILABLE] when the information is
unavailable. </p>
diff --git a/external/ibm-public/postfix/dist/proto/access b/external/ibm-public/postfix/dist/proto/access
index 3232c817907..e01cc0f0e9e 100644
--- a/external/ibm-public/postfix/dist/proto/access
+++ b/external/ibm-public/postfix/dist/proto/access
@@ -105,43 +105,33 @@
# .IP \fInet.work.addr\fR
# .IP \fInet.work\fR
# .IP \fInet\fR
-# Matches the specified IPv4 host address or subnetwork. An
-# IPv4 host address is a sequence of four decimal octets
-# separated by ".".
+# Matches a remote IPv4 host address or network address range.
+# Specify one to four decimal octets separated by ".". Do not
+# specify "[]" , "/", leading zeros, or hexadecimal forms.
#
-# Subnetworks are matched by repeatedly truncating the last
-# ".octet" from the remote IPv4 host address string until a
+# Network ranges are matched by repeatedly truncating the last
+# ".octet" from a remote IPv4 host address string, until a
# match is found in the access table, or until further
# truncation is not possible.
#
-# NOTE 1: The access map lookup key must be in canonical form:
-# do not specify unnecessary null characters, and do not
-# enclose network address information with "[]" characters.
-#
-# NOTE 2: use the \fBcidr\fR lookup table type to specify
+# NOTE: use the \fBcidr\fR lookup table type to specify
# network/netmask patterns. See \fBcidr_table\fR(5) for details.
# .IP \fInet:work:addr:ess\fR
# .IP \fInet:work:addr\fR
# .IP \fInet:work\fR
# .IP \fInet\fR
-# Matches the specified IPv6 host address or subnetwork. An
-# IPv6 host address is a sequence of three to eight hexadecimal
-# octet pairs separated by ":".
-#
-# Subnetworks are matched by repeatedly truncating the last
-# ":octetpair" from the remote IPv6 host address string until
-# a match is found in the access table, or until further
-# truncation is not possible.
-#
-# NOTE 1: the truncation and comparison are done with the
-# string representation of the IPv6 host address. Thus, not
-# all the ":" subnetworks will be tried.
+# Matches a remote IPv6 host address or network address range.
+# Specify three to eight hexadecimal octet pairs separated
+# by ":", using the compressed form "::" for a sequence of
+# zero-valued octet pairs. Do not specify "[]", "/", leading
+# zeros, or non-compressed forms.
#
-# NOTE 2: The access map lookup key must be in canonical form:
-# do not specify unnecessary null characters, and do not
-# enclose network address information with "[]" characters.
+# A network range is matched by repeatedly truncating the
+# last ":octetpair" from the compressed-form remote IPv6 host
+# address string, until a match is found in the access table,
+# or until further truncation is not possible.
#
-# NOTE 3: use the \fBcidr\fR lookup table type to specify
+# NOTE: use the \fBcidr\fR lookup table type to specify
# network/netmask patterns. See \fBcidr_table\fR(5) for details.
#
# IPv6 support is available in Postfix 2.2 and later.
@@ -231,7 +221,8 @@
# Send one copy of the message to the specified recipient.
# .sp
# If multiple BCC actions are specified within the same SMTP
-# MAIL transaction, only the last action will be used.
+# MAIL transaction, with Postfix 3.0 only the last action
+# will be used.
# .sp
# This feature is available in Postfix 3.0 and later.
# \" .IP "\fBDELAY \fItime\fR"
diff --git a/external/ibm-public/postfix/dist/proto/aliases b/external/ibm-public/postfix/dist/proto/aliases
index 1c33bed0b1f..6442ac1d558 100644
--- a/external/ibm-public/postfix/dist/proto/aliases
+++ b/external/ibm-public/postfix/dist/proto/aliases
@@ -50,9 +50,12 @@
# such as whitespace, `#', `:', or `@'. The \fIname\fR is folded to
# lowercase, in order to make database lookups case insensitive.
# .PP
-# In addition, when an alias exists for \fBowner-\fIname\fR, delivery
-# diagnostics are directed to that address, instead of to the originator
-# of the message.
+# In addition, when an alias exists for \fBowner-\fIname\fR,
+# this will override the envelope sender address, so that
+# delivery diagnostics are directed to \fBowner-\fIname\fR,
+# instead of the originator of the message (for details, see
+# \fBowner_request_special\fR, \fBexpand_owner_alias\fR and
+# \fBreset_owner_alias\fR).
# This is typically used to direct delivery errors to the maintainer of
# a mailing list, who is in a better position to deal with mailing
# list delivery problems than the originator of the undelivered mail.
@@ -139,37 +142,37 @@
# The following \fBmain.cf\fR parameters are especially relevant.
# The text below provides only a parameter summary. See
# \fBpostconf\fR(5) for more details including examples.
-# .IP \fBalias_database\fR
-# List of alias databases that are updated by the
-# \fBnewaliases\fR(1) command.
-# .IP \fBalias_maps\fR
-# List of alias databases queried by the \fBlocal\fR(8) delivery agent.
-# .IP \fBallow_mail_to_commands\fR
-# Restrict the usage of mail delivery to external command.
-# .IP \fBallow_mail_to_files\fR
-# Restrict the usage of mail delivery to external file.
-# .IP \fBexpand_owner_alias\fR
-# When delivering to an alias that has an \fBowner-\fR companion alias,
-# set the envelope sender address to the right-hand side of the
-# owner alias, instead using of the left-hand side address.
-# .IP \fBpropagate_unmatched_extensions\fR
-# A list of address rewriting or forwarding mechanisms that
-# propagate an address extension from the original address
-# to the result. Specify zero or more of \fBcanonical\fR,
-# \fBvirtual\fR, \fBalias\fR, \fBforward\fR, \fBinclude\fR,
-# or \fBgeneric\fR.
-# .IP \fBowner_request_special\fR
-# Give special treatment to \fBowner-\fIlistname\fR and
-# \fIlistname\fB-request\fR
-# addresses.
-# .IP \fBrecipient_delimiter\fR
-# Delimiter that separates recipients from address extensions.
+# .IP "\fBalias_database (see 'postconf -d' output)\fR"
+# The alias databases for \fBlocal\fR(8) delivery that are updated with
+# "\fBnewaliases\fR" or with "\fBsendmail -bi\fR".
+# .IP "\fBalias_maps (see 'postconf -d' output)\fR"
+# The alias databases that are used for \fBlocal\fR(8) delivery.
+# .IP "\fBallow_mail_to_commands (alias, forward)\fR"
+# Restrict \fBlocal\fR(8) mail delivery to external commands.
+# .IP "\fBallow_mail_to_files (alias, forward)\fR"
+# Restrict \fBlocal\fR(8) mail delivery to external files.
+# .IP "\fBexpand_owner_alias (no)\fR"
+# When delivering to an alias "\fIaliasname\fR" that has an
+# "owner-\fIaliasname\fR" companion alias, set the envelope sender
+# address to the expansion of the "owner-\fIaliasname\fR" alias.
+# .IP "\fBpropagate_unmatched_extensions (canonical, virtual)\fR"
+# What address lookup tables copy an address extension from the lookup
+# key to the lookup result.
+# .IP "\fBowner_request_special (yes)\fR"
+# Enable special treatment for owner-\fIlistname\fR entries in the
+# \fBaliases\fR(5) file, and don't split owner-\fIlistname\fR and
+# \fIlistname\fR-request address localparts when the recipient_delimiter
+# is set to "-".
+# .IP "\fBrecipient_delimiter (empty)\fR"
+# The set of characters that can separate a user name from its
+# extension (example: user+foo), or a .forward file name from its
+# extension (example: .forward+foo).
# .PP
# Available in Postfix version 2.3 and later:
-# .IP \fBfrozen_delivered_to\fR
-# Update the local(8) delivery agent's Delivered-To: address
-# (see prepend_delivered_header) only once, at the start of
-# a delivery; do not update the Delivered-To: address while
+# .IP "\fBfrozen_delivered_to (yes)\fR"
+# Update the \fBlocal\fR(8) delivery agent's idea of the Delivered-To:
+# address (see prepend_delivered_header) only once, at the start of
+# a delivery attempt; do not update the Delivered-To: address while
# expanding aliases or .forward files.
# STANDARDS
# RFC 822 (ARPA Internet Text Messages)
diff --git a/external/ibm-public/postfix/dist/proto/canonical b/external/ibm-public/postfix/dist/proto/canonical
index 828094a3e97..de9e19143da 100644
--- a/external/ibm-public/postfix/dist/proto/canonical
+++ b/external/ibm-public/postfix/dist/proto/canonical
@@ -76,8 +76,12 @@
# .ad
# .fi
# With lookups from indexed files such as DB or DBM, or from networked
-# tables such as NIS, LDAP or SQL, patterns are tried in the order as
-# listed below:
+# tables such as NIS, LDAP or SQL, each \fIuser\fR@\fIdomain\fR
+# query produces a sequence of query patterns as described below.
+#
+# Each query pattern is sent to each specified lookup table
+# before trying the next query pattern, until a match is
+# found.
# .IP "\fIuser\fR@\fIdomain address\fR"
# Replace \fIuser\fR@\fIdomain\fR by \fIaddress\fR. This form
# has the highest precedence.
@@ -104,6 +108,23 @@
# a backscatter source: Postfix first accepts mail for
# non-existent recipients and then tries to return that mail
# as "undeliverable" to the often forged sender address.
+# .sp
+# To avoid backscatter with mail for a wild-card domain,
+# replace the wild-card mapping with explicit 1:1 mappings,
+# or add a reject_unverified_recipient restriction for that
+# domain:
+#
+# .nf
+# smtpd_recipient_restrictions =
+# ...
+# reject_unauth_destination
+# check_recipient_access
+# inline:{example.com=reject_unverified_recipient}
+# unverified_recipient_reject_code = 550
+# .fi
+#
+# In the above example, Postfix may contact a remote server
+# if the recipient is rewritten to a remote address.
# RESULT ADDRESS REWRITING
# .ad
# .fi
@@ -169,56 +190,58 @@
# The following \fBmain.cf\fR parameters are especially relevant.
# The text below provides only a parameter summary. See
# \fBpostconf\fR(5) for more details including examples.
-# .IP \fBcanonical_classes\fR
-# What addresses are subject to canonical address mapping.
-# .IP \fBcanonical_maps\fR
-# List of canonical mapping tables.
-# .IP \fBrecipient_canonical_maps\fR
-# Address mapping lookup table for envelope and header recipient
-# addresses.
-# .IP \fBsender_canonical_maps\fR
-# Address mapping lookup table for envelope and header sender
-# addresses.
-# .IP \fBpropagate_unmatched_extensions\fR
-# A list of address rewriting or forwarding mechanisms that propagate
-# an address extension from the original address to the result.
-# Specify zero or more of \fBcanonical\fR, \fBvirtual\fR, \fBalias\fR,
-# \fBforward\fR, \fBinclude\fR, or \fBgeneric\fR.
+# .IP "\fBcanonical_classes (envelope_sender, envelope_recipient, header_sender, header_recipient)\fR"
+# What addresses are subject to canonical_maps address mapping.
+# .IP "\fBcanonical_maps (empty)\fR"
+# Optional address mapping lookup tables for message headers and
+# envelopes.
+# .IP "\fBrecipient_canonical_maps (empty)\fR"
+# Optional address mapping lookup tables for envelope and header
+# recipient addresses.
+# .IP "\fBsender_canonical_maps (empty)\fR"
+# Optional address mapping lookup tables for envelope and header
+# sender addresses.
+# .IP "\fBpropagate_unmatched_extensions (canonical, virtual)\fR"
+# What address lookup tables copy an address extension from the lookup
+# key to the lookup result.
# .PP
# Other parameters of interest:
-# .IP \fBinet_interfaces\fR
-# The network interface addresses that this system receives mail on.
-# You need to stop and start Postfix when this parameter changes.
-# .IP \fBlocal_header_rewrite_clients\fR
-# Rewrite message header addresses in mail from these clients
-# and update incomplete addresses with the domain name in
-# $myorigin or $mydomain; either don't rewrite message headers
-# from other clients at all, or rewrite message headers and
-# update incomplete addresses with the domain specified in
-# the remote_header_rewrite_domain parameter.
-# .IP \fBproxy_interfaces\fR
-# Other interfaces that this machine receives mail on by way of a
-# proxy agent or network address translator.
-# .IP \fBmasquerade_classes\fR
-# List of address classes subject to masquerading: zero or more of
-# \fBenvelope_sender\fR, \fBenvelope_recipient\fR, \fBheader_sender\fR,
-# \fBheader_recipient\fR.
-# .IP \fBmasquerade_domains\fR
-# List of domains that hide their subdomain structure.
-# .IP \fBmasquerade_exceptions\fR
-# List of user names that are not subject to address masquerading.
-# .IP \fBmydestination\fR
-# List of domains that this mail system considers local.
-# .IP \fBmyorigin\fR
-# The domain that is appended to locally-posted mail.
-# .IP \fBowner_request_special\fR
-# Give special treatment to \fBowner-\fIxxx\fR and \fIxxx\fB-request\fR
-# addresses.
-# .IP \fBremote_header_rewrite_domain\fR
-# Don't rewrite message headers from remote clients at all
-# when this parameter is empty; otherwise, rewrite message
-# headers and append the specified domain name to incomplete
-# addresses.
+# .IP "\fBinet_interfaces (all)\fR"
+# The network interface addresses that this mail system receives
+# mail on.
+# .IP "\fBlocal_header_rewrite_clients (permit_inet_interfaces)\fR"
+# Rewrite message header addresses in mail from these clients and
+# update incomplete addresses with the domain name in $myorigin or
+# $mydomain; either don't rewrite message headers from other clients
+# at all, or rewrite message headers and update incomplete addresses
+# with the domain specified in the remote_header_rewrite_domain
+# parameter.
+# .IP "\fBproxy_interfaces (empty)\fR"
+# The network interface addresses that this mail system receives mail
+# on by way of a proxy or network address translation unit.
+# .IP "\fBmasquerade_classes (envelope_sender, header_sender, header_recipient)\fR"
+# What addresses are subject to address masquerading.
+# .IP "\fBmasquerade_domains (empty)\fR"
+# Optional list of domains whose subdomain structure will be stripped
+# off in email addresses.
+# .IP "\fBmasquerade_exceptions (empty)\fR"
+# Optional list of user names that are not subjected to address
+# masquerading, even when their address matches $masquerade_domains.
+# .IP "\fBmydestination ($myhostname, localhost.$mydomain, localhost)\fR"
+# The list of domains that are delivered via the $local_transport
+# mail delivery transport.
+# .IP "\fBmyorigin ($myhostname)\fR"
+# The domain name that locally-posted mail appears to come
+# from, and that locally posted mail is delivered to.
+# .IP "\fBowner_request_special (yes)\fR"
+# Enable special treatment for owner-\fIlistname\fR entries in the
+# \fBaliases\fR(5) file, and don't split owner-\fIlistname\fR and
+# \fIlistname\fR-request address localparts when the recipient_delimiter
+# is set to "-".
+# .IP "\fBremote_header_rewrite_domain (empty)\fR"
+# Don't rewrite message headers from remote clients at all when
+# this parameter is empty; otherwise, rewrite message headers and
+# append the specified domain name to incomplete addresses.
# SEE ALSO
# cleanup(8), canonicalize and enqueue mail
# postmap(1), Postfix lookup table manager
diff --git a/external/ibm-public/postfix/dist/proto/cidr_table b/external/ibm-public/postfix/dist/proto/cidr_table
index 4787a79d35c..91ac7e716bf 100644
--- a/external/ibm-public/postfix/dist/proto/cidr_table
+++ b/external/ibm-public/postfix/dist/proto/cidr_table
@@ -25,30 +25,42 @@
# .ad
# .fi
# The general form of a Postfix CIDR table is:
-# .IP "\fInetwork_address\fB/\fInetwork_mask result\fR"
-# When a search string matches the specified network block,
-# use the corresponding \fIresult\fR value. Specify
-# 0.0.0.0/0 to match every IPv4 address, and ::/0 to match
-# every IPv6 address.
-#
-# An IPv4 network address is a sequence of four decimal octets
-# separated by ".", and an IPv6 network address is a sequence
-# of three to eight hexadecimal octet pairs separated by ":".
-#
-# The \fInetwork_mask\fR is the number of high-order bits in
-# the \fInetwork_address\fR that the search string must match.
-#
-# Before comparisons are made, lookup keys and table entries
-# are converted from string to binary. Therefore table entries
-# will be matched regardless of redundant zero characters.
-#
-# Note: address information may be enclosed inside "[]" but
-# this form is not required.
-#
-# IPv6 support is available in Postfix 2.2 and later.
-# .IP "\fInetwork_address result\fR"
-# When a search string matches the specified network address,
-# use the corresponding \fIresult\fR value.
+# .IP "\fIpattern result\fR"
+# When a search string matches the specified \fIpattern\fR, use
+# the corresponding \fIresult\fR value. The \fIpattern\fR must be
+# in \fInetwork/prefix\fR or \fInetwork_address\fR form (see
+# ADDRESS PATTERN SYNTAX below).
+# .IP "\fB!\fIpattern result\fR"
+# When a search string does not match the specified \fIpattern\fR,
+# use the specified \fIresult\fR value. The \fIpattern\fR must
+# be in \fInetwork/prefix\fR or \fInetwork_address\fR form (see
+# ADDRESS PATTERN SYNTAX below).
+# .sp
+# This feature is available in Postfix 3.2 and later.
+# .IP "\fBif \fIpattern\fR"
+# .IP "\fBendif\fR"
+# When a search string matches the specified \fIpattern\fR, match
+# that search string against the patterns between \fBif\fR and
+# \fBendif\fR. The \fIpattern\fR must be in \fInetwork/prefix\fR or
+# \fInetwork_address\fR form (see ADDRESS PATTERN SYNTAX below). The
+# \fBif\fR..\fBendif\fR can nest.
+# .sp
+# Note: do not prepend whitespace to text between
+# \fBif\fR..\fBendif\fR.
+# .sp
+# This feature is available in Postfix 3.2 and later.
+# .IP "\fBif !\fIpattern\fR"
+# .IP "\fBendif\fR"
+# When a search string does not match the specified \fIpattern\fR,
+# match that search string against the patterns between \fBif\fR and
+# \fBendif\fR. The \fIpattern\fR must be in \fInetwork/prefix\fR or
+# \fInetwork_address\fR form (see ADDRESS PATTERN SYNTAX below). The
+# \fBif\fR..\fBendif\fR can nest.
+# .sp
+# Note: do not prepend whitespace to text between
+# \fBif\fR..\fBendif\fR.
+# .sp
+# This feature is available in Postfix 3.2 and later.
# .IP "blank lines and comments"
# Empty lines and whitespace-only lines are ignored, as
# are lines whose first non-whitespace character is a `#'.
@@ -60,6 +72,32 @@
# .fi
# Patterns are applied in the order as specified in the table, until a
# pattern is found that matches the search string.
+# ADDRESS PATTERN SYNTAX
+# .ad
+# .fi
+# Postfix CIDR tables are pattern-based. A pattern is either
+# a \fInetwork_address\fR which requires an exact match, or a
+# \fInetwork_address/prefix_length\fR where the \fIprefix_length\fR
+# part specifies the length of the \fInetwork_address\fR prefix
+# that must be matched (the other bits in the \fInetwork_address\fR
+# part must be zero).
+#
+# An IPv4 network address is a sequence of four decimal octets
+# separated by ".", and an IPv6 network address is a sequence
+# of three to eight hexadecimal octet pairs separated by ":"
+# or "::", where the latter is short-hand for a sequence of
+# one or more all-zero octet pairs. The pattern 0.0.0.0/0
+# matches every IPv4 address, and ::/0 matches every IPv6
+# address. IPv6 support is available in Postfix 2.2 and
+# later.
+#
+# Before comparisons are made, lookup keys and table entries
+# are converted from string to binary. Therefore, IPv6 patterns
+# will be matched regardless of leading zeros (a leading zero in
+# an IPv4 address octet indicates octal notation).
+#
+# Note: address information may be enclosed inside "[]" but
+# this form is not required.
# EXAMPLE SMTPD ACCESS MAP
# .nf
# /etc/postfix/main.cf:
@@ -70,6 +108,8 @@
# # before more general blacklist entries.
# 192.168.1.1 OK
# 192.168.0.0/16 REJECT
+# 2001:db8::1 OK
+# 2001:db8::/32 REJECT
# .fi
# SEE ALSO
# postmap(1), Postfix lookup table manager
diff --git a/external/ibm-public/postfix/dist/proto/generic b/external/ibm-public/postfix/dist/proto/generic
index b563b99f41c..77d62252b4a 100644
--- a/external/ibm-public/postfix/dist/proto/generic
+++ b/external/ibm-public/postfix/dist/proto/generic
@@ -68,8 +68,12 @@
# .ad
# .fi
# With lookups from indexed files such as DB or DBM, or from networked
-# tables such as NIS, LDAP or SQL, patterns are tried in the order as
-# listed below:
+# tables such as NIS, LDAP or SQL, each \fIuser\fR@\fIdomain\fR
+# query produces a sequence of query patterns as described below.
+#
+# Each query pattern is sent to each specified lookup table
+# before trying the next query pattern, until a match is
+# found.
# .IP "\fIuser\fR@\fIdomain address\fR"
# Replace \fIuser\fR@\fIdomain\fR by \fIaddress\fR. This form
# has the highest precedence.
diff --git a/external/ibm-public/postfix/dist/proto/header_checks b/external/ibm-public/postfix/dist/proto/header_checks
index e78ea081536..1aa6f5a712f 100644
--- a/external/ibm-public/postfix/dist/proto/header_checks
+++ b/external/ibm-public/postfix/dist/proto/header_checks
@@ -287,13 +287,25 @@
# This feature is not supported with smtp header/body checks.
# .IP \fBIGNORE\fR
# Delete the current line from the input, and inspect
-# the next input line.
+# the next input line. See \fBSTRIP\fR for an alternative
+# that logs the action.
# .IP "\fBINFO \fIoptional text...\fR
# Log an "info:" record with the \fIoptional text...\fR (or
# log a generic text), and inspect the next input line. This
# action is useful for routine logging or for debugging.
# .sp
# This feature is available in Postfix 2.8 and later.
+# .IP "\fBPASS \fIoptional text...\fR"
+# Log a "pass:" record with the \fIoptional text...\fR (or
+# log a generic text), and turn off header, body, and Milter
+# inspection for the remainder of this message.
+# .sp
+# Note: this feature relies on trust in information that is
+# easy to forge.
+# .sp
+# This feature is available in Postfix 3.2 and later.
+# .sp
+# This feature is not supported with smtp header/body checks.
# .IP "\fBPREPEND \fItext...\fR"
# Prepend one line with the specified text, and inspect the next
# input line.
@@ -364,6 +376,13 @@
# "5.7.1".
# .sp
# This feature is not supported with smtp header/body checks.
+# .IP "\fBSTRIP \fIoptional text...\fR"
+# Log a "strip:" record with the \fIoptional text...\fR (or
+# log a generic text), delete the input line from the input,
+# and inspect the next input line. See \fBIGNORE\fR for a
+# silent alternative.
+# .sp
+# This feature is available in Postfix 3.2 and later.
# .IP "\fBWARN \fIoptional text...\fR
# Log a "warning:" record with the \fIoptional text...\fR (or
# log a generic text), and inspect the next input line. This
diff --git a/external/ibm-public/postfix/dist/proto/ldap_table b/external/ibm-public/postfix/dist/proto/ldap_table
index 5492fa82729..b770e4a162e 100644
--- a/external/ibm-public/postfix/dist/proto/ldap_table
+++ b/external/ibm-public/postfix/dist/proto/ldap_table
@@ -26,33 +26,11 @@
# described below. An example is given at the end of this manual.
#
# This configuration method is available with Postfix version
-# 2.1 and later. See the section "BACKWARDS COMPATIBILITY"
+# 2.1 and later. See the section "OBSOLETE MAIN.CF PARAMETERS"
# below for older Postfix versions.
#
# For details about LDAP SSL and STARTTLS, see the section
# on SSL and STARTTLS below.
-# BACKWARDS COMPATIBILITY
-# .ad
-# .fi
-# For backwards compatibility with Postfix version 2.0 and earlier,
-# LDAP parameters can also be defined in main.cf. Specify
-# as LDAP source a name that doesn't begin with a slash or
-# a dot. The LDAP parameters will then be accessible as the
-# name you've given the source in its definition, an underscore,
-# and the name of the parameter. For example, if the map is
-# specified as "ldap:\fIldapsource\fR", the "server_host"
-# parameter below would be defined in main.cf as
-# "\fIldapsource\fR_server_host".
-#
-# Note: with this form, the passwords for the LDAP sources are
-# written in main.cf, which is normally world-readable. Support
-# for this form will be removed in a future Postfix version.
-#
-# For backwards compatibility with the pre
-# 2.2 LDAP clients, \fBresult_filter\fR can for now be used instead
-# of \fBresult_format\fR, when the latter parameter is not also set.
-# The new name better reflects the function of the parameter. This
-# compatibility interface may be removed in a future release.
# LIST MEMBERSHIP
# .ad
# .fi
@@ -684,6 +662,30 @@
# the "maildrop" attributes of those found, and build a list
# of their maildrops, which will be treated as RFC822 addresses
# to which the message will be delivered.
+# OBSOLETE MAIN.CF PARAMETERS
+# .ad
+# .fi
+# For backwards compatibility with Postfix version 2.0 and earlier,
+# LDAP parameters can also be defined in main.cf. Specify
+# as LDAP source a name that doesn't begin with a slash or
+# a dot. The LDAP parameters will then be accessible as the
+# name you've given the source in its definition, an underscore,
+# and the name of the parameter. For example, if the map is
+# specified as "ldap:\fIldapsource\fR", the "server_host"
+# parameter below would be defined in main.cf as
+# "\fIldapsource\fR_server_host".
+#
+# Note: with this form, the passwords for the LDAP sources are
+# written in main.cf, which is normally world-readable. Support
+# for this form will be removed in a future Postfix version.
+# OTHER OBSOLETE FEATURES
+# .ad
+# .fi
+# For backwards compatibility with the pre
+# 2.2 LDAP clients, \fBresult_filter\fR can for now be used instead
+# of \fBresult_format\fR, when the latter parameter is not also set.
+# The new name better reflects the function of the parameter. This
+# compatibility interface may be removed in a future release.
# SEE ALSO
# postmap(1), Postfix lookup table manager
# postconf(5), configuration parameters
diff --git a/external/ibm-public/postfix/dist/proto/master b/external/ibm-public/postfix/dist/proto/master
index 7eb4091b061..670b800a12b 100644
--- a/external/ibm-public/postfix/dist/proto/master
+++ b/external/ibm-public/postfix/dist/proto/master
@@ -61,8 +61,8 @@
# The service name is specified as \fIhost:port\fR, denoting
# the host and port on which new connections should be
# accepted. The host part (and colon) may be omitted. Either
-# host or port may be given in symbolic form (host or service
-# name) or in numeric form (IP address or port number).
+# host or port may be given in symbolic form (see \fBhosts\fR(5) or
+# \fBservices\fR(5)) or in numeric form (IP address or port number).
# Host information may be enclosed inside "[]"; this form
# is necessary only with IPv6 addresses.
# .sp
@@ -79,8 +79,8 @@
# of hard-coding loopback IP address information in master.cf
# or in main.cf.
# .IP \fBunix\fR
-# The service listens on a UNIX-domain socket and is accessible
-# for local clients only.
+# The service listens on a UNIX-domain stream socket and is
+# accessible for local clients only.
#
# The service name is a pathname relative to the Postfix
# queue directory (pathname controlled with the \fBqueue_directory\fR
@@ -88,7 +88,14 @@
# .sp
# On Solaris 8 and earlier systems the \fBunix\fR type is
# implemented with streams sockets.
-# .IP \fBfifo\fR
+# .IP \fBunix-dgram\fR
+# The service listens on a UNIX-domain datagram socket and is
+# accessible for local clients only.
+#
+# The service name is a pathname relative to the Postfix
+# queue directory (pathname controlled with the \fBqueue_directory\fR
+# configuration parameter in main.cf).
+# .IP "\fBfifo\fR (obsolete)"
# The service listens on a FIFO (named pipe) and is accessible
# for local clients only.
#
@@ -96,9 +103,9 @@
# queue directory (pathname controlled with the \fBqueue_directory\fR
# configuration parameter in main.cf).
# .IP \fBpass\fR
-# The service listens on a UNIX-domain socket, and is accessible
-# to local clients only. It receives one open connection (file
-# descriptor passing) per connection request.
+# The service listens on a UNIX-domain stream socket, and is
+# accessible to local clients only. It receives one open
+# connection (file descriptor passing) per connection request.
#
# The service name is a pathname relative to the Postfix
# queue directory (pathname controlled with the \fBqueue_directory\fR
@@ -133,7 +140,7 @@
# place.
# .sp
# The files in the examples/chroot-setup subdirectory of the
-# Postfix source archive show set up a Postfix chroot environment
+# Postfix source show how to set up a Postfix chroot environment
# on a variety of systems. See also BASIC_CONFIGURATION_README
# for issues related to running daemons chrooted.
# .IP "\fBWake up time (default: 0)\fR"
diff --git a/external/ibm-public/postfix/dist/proto/mysql_table b/external/ibm-public/postfix/dist/proto/mysql_table
index 3aa5138c31b..b4c7c75b007 100644
--- a/external/ibm-public/postfix/dist/proto/mysql_table
+++ b/external/ibm-public/postfix/dist/proto/mysql_table
@@ -22,41 +22,6 @@
# The file /etc/postfix/mysql-aliases.cf has the same format as
# the Postfix main.cf file, and can specify the parameters
# described below.
-# BACKWARDS COMPATIBILITY
-# .ad
-# .fi
-# For compatibility with other Postfix lookup tables, MySQL
-# parameters can also be defined in main.cf. In order to do that,
-# specify as MySQL source a name that doesn't begin with a slash
-# or a dot. The MySQL parameters will then be accessible as the
-# name you've given the source in its definition, an underscore,
-# and the name of the parameter. For example, if the map is
-# specified as "mysql:\fImysqlname\fR", the parameter "hosts"
-# below would be defined in main.cf as "\fImysqlname\fR_hosts".
-#
-# Note: with this form, the passwords for the MySQL sources are
-# written in main.cf, which is normally world-readable. Support
-# for this form will be removed in a future Postfix version.
-#
-# Normally, the SQL query is specified via a single \fBquery\fR
-# parameter (described in more detail below). When this
-# parameter is not specified in the map definition, Postfix
-# reverts to an older interface, with the SQL query constructed
-# from the \fBselect_field\fR, \fBtable\fR, \fBwhere_field\fR
-# and \fBadditional_conditions\fR parameters. The old interface
-# will be gradually phased out. To migrate to the new interface
-# set:
-#
-# .nf
-# \fBquery\fR = SELECT [\fIselect_field\fR]
-# FROM [\fItable\fR]
-# WHERE [\fIwhere_field\fR] = '%s'
-# [\fIadditional_conditions\fR]
-# .fi
-#
-# Insert the value, not the name, of each legacy parameter. Note
-# that the \fBadditional_conditions\fR parameter is optional
-# and if not empty, will always start with \fBAND\fR.
# LIST MEMBERSHIP
# .ad
# .fi
@@ -120,6 +85,11 @@
# query = SELECT replacement FROM aliases WHERE mailbox = '%s'
# .fi
#
+# By default, every query must return a result set (instead
+# of storing its results in a table); with "\fBrequire_result_set
+# = no\fR" (Postfix 3.2 and later), the absence of a result
+# set is treated as "not found".
+#
# This parameter supports the following '%' expansions:
# .RS
# .IP "\fB%%\fR"
@@ -246,11 +216,18 @@
# values.
# .IP "\fBoption_file\fR"
# Read options from the given file instead of the default my.cnf
-# location.
+# location. This reads options from the \fB[client]\fR option
+# group, optionally followed by options from the group given
+# with \fBoption_group\fR.
# .sp
# This parameter is available with Postfix 2.11 and later.
-# .IP "\fBoption_group\fR"
-# Read options from the given group.
+# .IP "\fBoption_group (default: Postfix >=3.2: client, <= 3.1: empty)\fR"
+# Read options from the given group of the mysql options file,
+# after reading options from the \fB[client]\fR group.
+# .sp
+# Postfix 3.2 and later read \fB[client]\fR option group
+# settings by default. To disable this specify no \fBoption_file\fR
+# and specify "\fBoption_group =\fR" (i.e. an empty value).
# .sp
# Postfix 3.1 and earlier don't read \fB[client]\fR option
# group settings unless a non-empty \fBoption_file\fR or
@@ -258,6 +235,12 @@
# specify, for example, "\fBoption_group = client\fR".
# .sp
# This parameter is available with Postfix 2.11 and later.
+# .IP "\fBrequire_result_set (default: yes)\fR"
+# If "\fByes\fR", require that every query returns a result
+# set. If "\fBno\fR", treat the absence of a result set as
+# "not found".
+# .sp
+# This parameter is available with Postfix 3.2 and later.
# .IP "\fBtls_cert_file\fR"
# File containing client's X509 certificate.
# .sp
@@ -282,12 +265,63 @@
# certificate.
# .sp
# This parameter is available with Postfix 2.11 and later.
+# USING MYSQL STORED PROCEDURES
+# .ad
+# .fi
+# Postfix 3.2 and later support calling a stored procedure
+# instead of using a SELECT statement in the query, e.g.
+#
+# .nf
+# \fBquery\fR = CALL lookup('%s')
+# .fi
+#
+# The previously described '%' expansions can be used in the
+# parameter(s) to the stored procedure.
+#
+# By default, every stored procedure call must return a result
+# set, i.e. every code path must execute a SELECT statement
+# that returns a result set (instead of storing its results
+# in a table). With "\fBrequire_result_set = no\fR", the
+# absence of a result set is treated as "not found".
+#
+# A stored procedure must not return multiple result sets.
+# That is, there must be no code path that executes multiple
+# SELECT statements that return a result (instead of storing
+# their results in a table).
+#
+# The following is an example of a stored procedure returning
+# a single result set:
+#
+# .nf
+# CREATE [DEFINER=`user`@`host`] PROCEDURE
+# `lookup`(IN `param` VARCHAR(255))
+# READS SQL DATA
+# SQL SECURITY INVOKER
+# BEGIN
+# select goto from alias where address=param;
+# END
+# .fi
+# OBSOLETE MAIN.CF PARAMETERS
+# .ad
+# .fi
+# For compatibility with other Postfix lookup tables, MySQL
+# parameters can also be defined in main.cf. In order to do that,
+# specify as MySQL source a name that doesn't begin with a slash
+# or a dot. The MySQL parameters will then be accessible as the
+# name you've given the source in its definition, an underscore,
+# and the name of the parameter. For example, if the map is
+# specified as "mysql:\fImysqlname\fR", the parameter "hosts"
+# would be defined in main.cf as "\fImysqlname\fR_hosts".
+#
+# Note: with this form, the passwords for the MySQL sources are
+# written in main.cf, which is normally world-readable. Support
+# for this form will be removed in a future Postfix version.
# OBSOLETE QUERY INTERFACE
# .ad
# .fi
# This section describes an interface that is deprecated as
# of Postfix 2.2. It is replaced by the more general \fBquery\fR
-# interface described above. If the \fBquery\fR parameter
+# interface described above. If the \fBquery\fR parameter
# is defined, the legacy parameters described here ignored.
# Please migrate to the new interface as the legacy interface
# may be removed in a future release.
@@ -356,4 +390,11 @@
# Institute of Mathematics of the Romanian Academy
# P.O. BOX 1-764
# RO-014700 Bucharest, ROMANIA
+#
+# Stored-procedure support by John Fawcett.
+#
+# Wietse Venema
+# Google, Inc.
+# 111 8th Avenue
+# New York, NY 10011, USA
#--
diff --git a/external/ibm-public/postfix/dist/proto/pgsql_table b/external/ibm-public/postfix/dist/proto/pgsql_table
index 32e872fdb21..fefc7a830ef 100644
--- a/external/ibm-public/postfix/dist/proto/pgsql_table
+++ b/external/ibm-public/postfix/dist/proto/pgsql_table
@@ -22,49 +22,6 @@
# The file /etc/postfix/pgsql-aliases.cf has the same format as
# the Postfix main.cf file, and can specify the parameters
# described below.
-# BACKWARDS COMPATIBILITY
-# .ad
-# .fi
-# For compatibility with other Postfix lookup tables, PostgreSQL
-# parameters can also be defined in main.cf. In order to do
-# that, specify as PostgreSQL source a name that doesn't begin
-# with a slash or a dot. The PostgreSQL parameters will then
-# be accessible as the name you've given the source in its
-# definition, an underscore, and the name of the parameter. For
-# example, if the map is specified as "pgsql:\fIpgsqlname\fR",
-# the parameter "hosts" below would be defined in main.cf as
-# "\fIpgsqlname\fR_hosts".
-#
-# Note: with this form, the passwords for the PostgreSQL sources
-# are written in main.cf, which is normally world-readable.
-# Support for this form will be removed in a future Postfix
-# version.
-#
-# Normally, the SQL query is specified via a single \fBquery\fR
-# parameter (described in more detail below). When this
-# parameter is not specified in the map definition, Postfix
-# reverts to an older interface, with the SQL query
-# constructed from the \fBselect_function\fR, \fBselect_field\fR,
-# \fBtable\fR, \fBwhere_field\fR and \fBadditional_conditions\fR
-# parameters. The old interface will be gradually phased
-# out. To migrate to the new interface set:
-#
-# .nf
-# \fBquery\fR = SELECT \fIselect_function\fR('%s')
-# .fi
-#
-# or in the absence of \fBselect_function\fR, the lower precedence:
-#
-# .nf
-# \fBquery\fR = SELECT \fIselect_field\fR
-# FROM \fItable\fR
-# WHERE \fIwhere_field\fR = '%s'
-# \fIadditional_conditions\fR
-# .fi
-#
-# Use the value, not the name, of each legacy parameter. Note
-# that the \fBadditional_conditions\fR parameter is optional
-# and if not empty, will always start with \fBAND\fR.
# LIST MEMBERSHIP
# .ad
# .fi
@@ -87,24 +44,22 @@
# .ad
# .fi
# .IP "\fBhosts\fR"
-# The hosts that Postfix will try to connect to and query from.
-# Specify \fIunix:\fR for UNIX-domain sockets, \fIinet:\fR for TCP
-# connections (default). Example:
+# The hosts that Postfix will try to connect to and query
+# from. Besides a \fBpostgresql://\fR connection URI, this
+# setting supports the historical forms \fBunix:/\fIpathname\fR
+# for UNIX-domain sockets and \fBinet:\fIhost:port\fR for TCP
+# connections, where the \fBunix:\fR and \fBinet:\fR prefixes
+# are accepted and ignored for backwards compatibility.
+# Examples:
# .nf
+# hosts = postgresql://username@example.com/tablename?sslmode=require
# hosts = host1.some.domain host2.some.domain:port
# hosts = unix:/file/name
# .fi
#
-# The hosts are tried in random order, with all connections over
-# UNIX domain sockets being tried before those over TCP. The
-# connections are automatically closed after being idle for about
-# 1 minute, and are re-opened as necessary.
-#
-# NOTE: the \fIunix:\fR and \fIinet:\fR prefixes are accepted for
-# backwards compatibility reasons, but are actually ignored.
-# The PostgreSQL client library will always try to connect to an
-# UNIX socket if the name starts with a slash, and will try a TCP
-# connection otherwise.
+# The hosts are tried in random order. The connections are
+# automatically closed after being idle for about 1 minute,
+# and are re-opened as necessary.
# .IP "\fBuser, password\fR"
# The user name and password to log into the pgsql server.
# Example:
@@ -245,6 +200,23 @@
# temporary error if the limit is exceeded. Setting the
# limit to 1 ensures that lookups do not return multiple
# values.
+# OBSOLETE MAIN.CF PARAMETERS
+# .ad
+# .fi
+# For compatibility with other Postfix lookup tables, PostgreSQL
+# parameters can also be defined in main.cf. In order to do
+# that, specify as PostgreSQL source a name that doesn't begin
+# with a slash or a dot. The PostgreSQL parameters will then
+# be accessible as the name you've given the source in its
+# definition, an underscore, and the name of the parameter. For
+# example, if the map is specified as "pgsql:\fIpgsqlname\fR",
+# the parameter "hosts" would be defined in main.cf as
+# "\fIpgsqlname\fR_hosts".
+#
+# Note: with this form, the passwords for the PostgreSQL sources
+# are written in main.cf, which is normally world-readable.
+# Support for this form will be removed in a future Postfix
+# version.
# OBSOLETE QUERY INTERFACES
# .ad
# .fi
diff --git a/external/ibm-public/postfix/dist/proto/postconf.html.prolog b/external/ibm-public/postfix/dist/proto/postconf.html.prolog
index 2c0f3397d51..a7d41eec04f 100644
--- a/external/ibm-public/postfix/dist/proto/postconf.html.prolog
+++ b/external/ibm-public/postfix/dist/proto/postconf.html.prolog
@@ -43,25 +43,30 @@ that starts with whitespace continues a logical line. </p>
<ul>
<li> <p> The expressions "$name" and "${name}" are recursively
-replaced with the value of the named parameter, except where noted.
+replaced with the value of the named parameter. The parameter name
+must contain only characters from the set [a-zA-Z0-9_].
An undefined parameter value is replaced with the empty value. </p>
<li> <p> The expressions "${name?value}" and "${name?{value}}" are
-replaced with "value" when "$name" is non-empty. These forms are
+replaced with "value" when "$name" is non-empty. The parameter name
+must contain only characters from the set [a-zA-Z0-9_]. These forms are
supported with Postfix versions &ge; 2.2 and &ge; 3.0, respectively.
</p>
-<li> <p> The expressions "${name:value}" and "${name?{value}}" are
-replaced with "value" when "$name" is empty. These forms are supported
-with Postfix versions &ge; 2.2 and &ge; 3.0, respectively. </p>
+<li> <p> The expressions "${name:value}" and "${name:{value}}" are
+replaced with "value" when "$name" is empty. The parameter name must
+contain only characters from the set [a-zA-Z0-9_]. These forms are
+supported with Postfix versions &ge; 2.2 and &ge; 3.0, respectively.
+</p>
<li> <p> The expression "${name?{value1}:{value2}}" is replaced
with "value1" when "$name" is non-empty, and with "value2" when
"$name" is empty. The "{}" is required for "value1", optional for
-"value2". This form is supported with Postfix versions &ge; 3.0.
-</p>
+"value2". The parameter name must contain only characters from the
+set [a-zA-Z0-9_]. This form is supported with Postfix versions
+&ge; 3.0. </p>
-<li> <p> The first item inside "${...}" may be a logical expression
+<li> <p> The first item inside "${...}" may be a relational expression
of the form: "{value3} == {value4}". Besides the "==" (equality)
operator Postfix supports "!=" (inequality), "&lt;", "&le;", "&ge;",
and "&gt;". The comparison is numerical when both operands are all
@@ -69,7 +74,7 @@ digits, otherwise the comparison is lexicographical. These forms
are supported with Postfix versions &ge; 3.0. </p>
<li> <p> Each "value" is subject to recursive named parameter and
-logical expression evaluation, except where noted. </p>
+relational expression evaluation, except where noted. </p>
<li> <p> Whitespace before or after each "{value}" is ignored. </p>
diff --git a/external/ibm-public/postfix/dist/proto/postconf.man.prolog b/external/ibm-public/postfix/dist/proto/postconf.man.prolog
index 7edda14f542..64b1e973c60 100644
--- a/external/ibm-public/postfix/dist/proto/postconf.man.prolog
+++ b/external/ibm-public/postfix/dist/proto/postconf.man.prolog
@@ -33,30 +33,34 @@ A parameter value may refer to other parameters.
.RS
.IP \(bu
The expressions "$name" and "${name}" are recursively replaced with
-the value of the named parameter. An undefined parameter value is
-replaced with the empty value.
+the value of the named parameter. The parameter name must contain
+only characters from the set [a-zA-Z0-9_]. An undefined parameter
+value is replaced with the empty value.
.IP \(bu
The expressions "${name?value}" and "${name?{value}}" are replaced
-with "value" when "$name" is non-empty. These forms are supported
-with Postfix versions >= 2.2 and >= 3.0, respectively.
+with "value" when "$name" is non-empty. The parameter name must
+contain only characters from the set [a-zA-Z0-9_]. These forms are
+supported with Postfix versions >= 2.2 and >= 3.0, respectively.
.IP \(bu
The expressions "${name:value}" and "${name:{value}}" are replaced
-with "value" when "$name" is empty. These forms are supported with
-Postfix versions >= 2.2 and >= 3.0, respectively.
+with "value" when "$name" is empty. The parameter name must contain
+only characters from the set [a-zA-Z0-9_]. These forms are supported
+with Postfix versions >= 2.2 and >= 3.0, respectively.
.IP \(bu
The expression "${name?{value1}:{value2}}" is replaced with "value1"
when "$name" is non-empty, and with "value2" when "$name" is empty.
-The "{}" is required for "value1", optional for "value2". This form
-is supported with Postfix versions >= 3.0.
+The "{}" is required for "value1", optional for "value2". The
+parameter name must contain only characters from the set [a-zA-Z0-9_].
+This form is supported with Postfix versions >= 3.0.
.IP \(bu
-The first item inside "${...}" may be a logical expression of the
+The first item inside "${...}" may be a relational expression of the
form: "{value3} == {value4}". Besides the "==" (equality) operator
Postfix supports "!=" (inequality), "<", "<=", ">=", and ">". The
comparison is numerical when both operands are all digits, otherwise
the comparison is lexicographical. These forms are supported with
Postfix versions >= 3.0.
.IP \(bu
-Each "value" is subject to recursive named parameter and logical
+Each "value" is subject to recursive named parameter and relational
expression evaluation, except where noted.
.IP \(bu
Whitespace before or after each "{value}" is ignored.
diff --git a/external/ibm-public/postfix/dist/proto/socketmap_table b/external/ibm-public/postfix/dist/proto/socketmap_table
index 90d8d660552..be010540fd6 100644
--- a/external/ibm-public/postfix/dist/proto/socketmap_table
+++ b/external/ibm-public/postfix/dist/proto/socketmap_table
@@ -25,7 +25,7 @@
# .fi
# Socketmaps use a simple protocol: the client sends one
# request, and the server sends one reply. Each request and
-# reply are sent as one netstring object.
+# each reply are sent as one netstring object.
# REQUEST FORMAT
# .ad
# .fi
diff --git a/external/ibm-public/postfix/dist/proto/sqlite_table b/external/ibm-public/postfix/dist/proto/sqlite_table
index 51ee41785f1..aeaba341d7a 100644
--- a/external/ibm-public/postfix/dist/proto/sqlite_table
+++ b/external/ibm-public/postfix/dist/proto/sqlite_table
@@ -22,37 +22,6 @@
# The file /etc/postfix/sqlite-aliases.cf has the same format as
# the Postfix main.cf file, and can specify the parameters
# described below.
-# BACKWARDS COMPATIBILITY
-# .ad
-# .fi
-# For compatibility with other Postfix lookup tables, SQLite
-# parameters can also be defined in main.cf. In order to do that,
-# specify as SQLite source a name that doesn't begin with a slash
-# or a dot. The SQLite parameters will then be accessible as the
-# name you've given the source in its definition, an underscore,
-# and the name of the parameter. For example, if the map is
-# specified as "sqlite:\fIsqlitename\fR", the parameter "query"
-# below would be defined in main.cf as "\fIsqlitename\fR_query".
-#
-# Normally, the SQL query is specified via a single \fBquery\fR
-# parameter (described in more detail below). When this
-# parameter is not specified in the map definition, Postfix
-# reverts to an older interface, with the SQL query constructed
-# from the \fBselect_field\fR, \fBtable\fR, \fBwhere_field\fR
-# and \fBadditional_conditions\fR parameters. The old interface
-# will be gradually phased out. To migrate to the new interface
-# set:
-#
-# .nf
-# \fBquery\fR = SELECT [\fIselect_field\fR]
-# FROM [\fItable\fR]
-# WHERE [\fIwhere_field\fR] = '%s'
-# [\fIadditional_conditions\fR]
-# .fi
-#
-# Insert the value, not the name, of each legacy parameter. Note
-# that the \fBadditional_conditions\fR parameter is optional
-# and if not empty, will always start with \fBAND\fR.
# LIST MEMBERSHIP
# .ad
# .fi
@@ -211,6 +180,17 @@
# temporary error if the limit is exceeded. Setting the
# limit to 1 ensures that lookups do not return multiple
# values.
+# OBSOLETE MAIN.CF PARAMETERS
+# .ad
+# .fi
+# For compatibility with other Postfix lookup tables, SQLite
+# parameters can also be defined in main.cf. In order to do that,
+# specify as SQLite source a name that doesn't begin with a slash
+# or a dot. The SQLite parameters will then be accessible as the
+# name you've given the source in its definition, an underscore,
+# and the name of the parameter. For example, if the map is
+# specified as "sqlite:\fIsqlitename\fR", the parameter "query"
+# would be defined in main.cf as "\fIsqlitename\fR_query".
# OBSOLETE QUERY INTERFACE
# .ad
# .fi
diff --git a/external/ibm-public/postfix/dist/proto/stop b/external/ibm-public/postfix/dist/proto/stop
index bdb08382e79..85a3d562ce3 100644
--- a/external/ibm-public/postfix/dist/proto/stop
+++ b/external/ibm-public/postfix/dist/proto/stop
@@ -1531,3 +1531,9 @@ xn
xyy
xzz
ymd
+INLINE
+SNPRINTF
+inline
+mtime
+snprintf
+sprintf
diff --git a/external/ibm-public/postfix/dist/proto/tcp_table b/external/ibm-public/postfix/dist/proto/tcp_table
index a7cae78efa5..d1ddb8151ef 100644
--- a/external/ibm-public/postfix/dist/proto/tcp_table
+++ b/external/ibm-public/postfix/dist/proto/tcp_table
@@ -8,16 +8,16 @@
#
# \fBpostmap -q - tcp:\fIhost:port\fB <\fIinputfile\fR
# DESCRIPTION
-# The Postfix mail system uses optional tables for address
-# rewriting or mail routing. These tables are usually in
-# \fBdbm\fR or \fBdb\fR format. Alternatively, table lookups
-# can be directed to a TCP server.
+# The Postfix mail system uses optional tables for address
+# rewriting or mail routing. These tables are usually in
+# \fBdbm\fR or \fBdb\fR format. Alternatively, table lookups
+# can be directed to a TCP server.
#
-# To find out what types of lookup tables your Postfix system
-# supports use the "\fBpostconf -m\fR" command.
+# To find out what types of lookup tables your Postfix system
+# supports use the "\fBpostconf -m\fR" command.
#
-# To test lookup tables, use the "\fBpostmap -q\fR" command as
-# described in the SYNOPSIS above.
+# To test lookup tables, use the "\fBpostmap -q\fR" command as
+# described in the SYNOPSIS above.
# PROTOCOL DESCRIPTION
# .ad
# .fi
@@ -31,12 +31,17 @@
# REQUEST FORMAT
# .ad
# .fi
-# Each request specifies a command, a lookup key, and possibly a
-# lookup result.
+# The tcp_table protocol supports only the lookup request.
+# The request has the following form:
# .IP "\fBget\fR SPACE \fIkey\fR NEWLINE"
# Look up data under the specified key.
-# .IP "\fBput\fR SPACE \fIkey\fR SPACE \fIvalue\fR NEWLINE"
-# This request is currently not implemented.
+# .PP
+# Postfix will not generate partial search keys such as domain
+# names without one or more subdomains, network addresses
+# without one or more least-significant octets, or email
+# addresses without the localpart, address extension or domain
+# portion. This behavior is also found with cidr:, pcre:, and
+# regexp: tables.
# REPLY FORMAT
# .ad
# .fi
@@ -44,7 +49,6 @@
# longer than 4096 characters including the newline terminator.
# .IP "\fB500\fR SPACE \fItext\fR NEWLINE"
# In case of a lookup request, the requested data does not exist.
-# In case of an update request, the request was rejected.
# The text describes the nature of the problem.
# .IP "\fB400\fR SPACE \fItext\fR NEWLINE"
# This indicates an error condition. The text describes the nature of
diff --git a/external/ibm-public/postfix/dist/proto/transport b/external/ibm-public/postfix/dist/proto/transport
index be0771126c1..49b3441d851 100644
--- a/external/ibm-public/postfix/dist/proto/transport
+++ b/external/ibm-public/postfix/dist/proto/transport
@@ -129,13 +129,18 @@
# (the first name of a mail delivery service entry in the Postfix
# \fBmaster.cf\fR file).
#
-# The interpretation of the nexthop field is transport
-# dependent. In the case of SMTP, specify a service on a non-default
+# The nexthop field usually specifies one recipient domain
+# or hostname. In the case of the Postfix SMTP/LMTP client,
+# the nexthop field may contain a list of nexthop destinations
+# separated by comma or whitespace (Postfix 3.5 and later).
+#
+# The syntax of a nexthop destination is transport dependent.
+# With SMTP, specify a service on a non-default
# port as \fIhost\fR:\fIservice\fR, and disable MX (mail exchanger)
# DNS lookups with [\fIhost\fR] or [\fIhost\fR]:\fIport\fR. The [] form
# is required when you specify an IP address instead of a hostname.
#
-# A null \fItransport\fR and null \fInexthop\fR result means "do
+# A null \fItransport\fR and null \fInexthop\fR field means "do
# not change": use the delivery transport and nexthop information
# that would be used when the entire transport table did not exist.
#
@@ -191,8 +196,8 @@
# This prevents mail routing loops when your machine is primary MX
# host for \fBexample.com\fR.
#
-# In the case of delivery via SMTP, one may specify
-# \fIhostname\fR:\fIservice\fR instead of just a host:
+# In the case of delivery via SMTP or LMTP, one may specify
+# \fIhost\fR:\fIservice\fR instead of just a host:
#
# .nf
# \fBexample.com smtp:bar.example:2025\fR
@@ -202,6 +207,16 @@
# port \fB2025\fR. Instead of a numerical port a symbolic name may be
# used. Specify [] around the hostname if MX lookups must be disabled.
#
+# Deliveries via SMTP or LMTP support multiple destinations
+# (Postfix >= 3.5):
+#
+# .nf
+# \fBexample.com smtp:bar.example, foo.example\fR
+# .fi
+#
+# This tries to deliver to \fBbar.example\fR before trying
+# to deliver to \fBfoo.example\fR.
+#
# The error mailer can be used to bounce mail:
#
# .nf
@@ -249,14 +264,15 @@
# The following \fBmain.cf\fR parameters are especially relevant.
# The text below provides only a parameter summary. See
# \fBpostconf\fR(5) for more details including examples.
-# .IP \fBempty_address_recipient\fR
-# The address that is looked up instead of the null sender address.
-# .IP \fBparent_domain_matches_subdomains\fR
-# List of Postfix features that use \fIdomain.tld\fR patterns
-# to match \fIsub.domain.tld\fR (as opposed to
-# requiring \fI.domain.tld\fR patterns).
-# .IP \fBtransport_maps\fR
-# List of transport lookup tables.
+# .IP "\fBempty_address_recipient (MAILER-DAEMON)\fR"
+# The recipient of mail addressed to the null address.
+# .IP "\fBparent_domain_matches_subdomains (see 'postconf -d' output)\fR"
+# A list of Postfix features where the pattern "example.com" also
+# matches subdomains of example.com,
+# instead of requiring an explicit ".example.com" pattern.
+# .IP "\fBtransport_maps (empty)\fR"
+# Optional lookup tables with mappings from recipient address to
+# (message delivery transport, next-hop destination).
# SEE ALSO
# trivial-rewrite(8), rewrite and resolve addresses
# master(5), master.cf file format
diff --git a/external/ibm-public/postfix/dist/proto/virtual b/external/ibm-public/postfix/dist/proto/virtual
index f3f4026e42a..8f047322f67 100644
--- a/external/ibm-public/postfix/dist/proto/virtual
+++ b/external/ibm-public/postfix/dist/proto/virtual
@@ -74,8 +74,12 @@
# .ad
# .fi
# With lookups from indexed files such as DB or DBM, or from networked
-# tables such as NIS, LDAP or SQL, patterns are tried in the order as
-# listed below:
+# tables such as NIS, LDAP or SQL, each \fIuser\fR@\fIdomain\fR
+# query produces a sequence of query patterns as described below.
+#
+# Each query pattern is sent to each specified lookup table
+# before trying the next query pattern, until a match is
+# found.
# .IP "\fIuser\fR@\fIdomain address, address, ...\fR"
# Redirect mail for \fIuser\fR@\fIdomain\fR to \fIaddress\fR.
# This form has the highest precedence.
@@ -99,6 +103,23 @@
# a backscatter source: Postfix first accepts mail for
# non-existent recipients and then tries to return that mail
# as "undeliverable" to the often forged sender address.
+# .sp
+# To avoid backscatter with mail for a wild-card domain,
+# replace the wild-card mapping with explicit 1:1 mappings,
+# or add a reject_unverified_recipient restriction for that
+# domain:
+#
+# .nf
+# smtpd_recipient_restrictions =
+# ...
+# reject_unauth_destination
+# check_recipient_access
+# inline:{example.com=reject_unverified_recipient}
+# unverified_recipient_reject_code = 550
+#.fi
+#
+# In the above example, Postfix may contact a remote server
+# if the recipient is aliased to a remote address.
# RESULT ADDRESS REWRITING
# .ad
# .fi
@@ -220,31 +241,35 @@
# this topic. See the Postfix \fBmain.cf\fR file for syntax details
# and for default values. Use the "\fBpostfix reload\fR" command after
# a configuration change.
-# .IP \fBvirtual_alias_maps\fR
-# List of virtual aliasing tables.
-# .IP \fBvirtual_alias_domains\fR
-# List of virtual alias domains. This uses the same syntax
-# as the \fBmydestination\fR parameter.
-# .IP \fBpropagate_unmatched_extensions\fR
-# A list of address rewriting or forwarding mechanisms that propagate
-# an address extension from the original address to the result.
-# Specify zero or more of \fBcanonical\fR, \fBvirtual\fR, \fBalias\fR,
-# \fBforward\fR, \fBinclude\fR, or \fBgeneric\fR.
+# .IP "\fBvirtual_alias_maps ($virtual_maps)\fR"
+# Optional lookup tables that alias specific mail addresses or domains
+# to other local or remote address.
+# .IP "\fBvirtual_alias_domains ($virtual_alias_maps)\fR"
+# Postfix is final destination for the specified list of virtual
+# alias domains, that is, domains for which all addresses are aliased
+# to addresses in other local or remote domains.
+# .IP "\fBpropagate_unmatched_extensions (canonical, virtual)\fR"
+# What address lookup tables copy an address extension from the lookup
+# key to the lookup result.
# .PP
# Other parameters of interest:
-# .IP \fBinet_interfaces\fR
-# The network interface addresses that this system receives mail on.
-# You need to stop and start Postfix when this parameter changes.
-# .IP \fBmydestination\fR
-# List of domains that this mail system considers local.
-# .IP \fBmyorigin\fR
-# The domain that is appended to any address that does not have a domain.
-# .IP \fBowner_request_special\fR
-# Give special treatment to \fBowner-\fIxxx\fR and \fIxxx\fB-request\fR
-# addresses.
-# .IP \fBproxy_interfaces\fR
-# Other interfaces that this machine receives mail on by way of a
-# proxy agent or network address translator.
+# .IP "\fBinet_interfaces (all)\fR"
+# The network interface addresses that this mail system receives
+# mail on.
+# .IP "\fBmydestination ($myhostname, localhost.$mydomain, localhost)\fR"
+# The list of domains that are delivered via the $local_transport
+# mail delivery transport.
+# .IP "\fBmyorigin ($myhostname)\fR"
+# The domain name that locally-posted mail appears to come
+# from, and that locally posted mail is delivered to.
+# .IP "\fBowner_request_special (yes)\fR"
+# Enable special treatment for owner-\fIlistname\fR entries in the
+# \fBaliases\fR(5) file, and don't split owner-\fIlistname\fR and
+# \fIlistname\fR-request address localparts when the recipient_delimiter
+# is set to "-".
+# .IP "\fBproxy_interfaces (empty)\fR"
+# The network interface addresses that this mail system receives mail
+# on by way of a proxy or network address translation unit.
# SEE ALSO
# cleanup(8), canonicalize and enqueue mail
# postmap(1), Postfix lookup table manager
diff --git a/external/ibm-public/postfix/dist/src/anvil/Makefile.in b/external/ibm-public/postfix/dist/src/anvil/Makefile.in
index f06ccd9466a..2caa0a9c949 100644
--- a/external/ibm-public/postfix/dist/src/anvil/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/anvil/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/bounce/Makefile.in b/external/ibm-public/postfix/dist/src/bounce/Makefile.in
index 5714e58237b..80f038f983d 100644
--- a/external/ibm-public/postfix/dist/src/bounce/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/bounce/Makefile.in
@@ -90,7 +90,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/cleanup/Makefile.in b/external/ibm-public/postfix/dist/src/cleanup/Makefile.in
index e44418862b6..546aae1c948 100644
--- a/external/ibm-public/postfix/dist/src/cleanup/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/cleanup/Makefile.in
@@ -78,7 +78,8 @@ milter_tests: cleanup_milter_test bug_tests \
cleanup_milter_test10b cleanup_milter_test10c cleanup_milter_test10d \
cleanup_milter_test10e cleanup_milter_test11 cleanup_milter_test12 \
cleanup_milter_test13a cleanup_milter_test13b cleanup_milter_test13c \
- cleanup_milter_test13d \
+ cleanup_milter_test13d cleanup_milter_test13e cleanup_milter_test13f \
+ cleanup_milter_test13g cleanup_milter_test13h cleanup_milter_test13i \
cleanup_milter_test14a cleanup_milter_test14b cleanup_milter_test14c \
cleanup_milter_test14d cleanup_milter_test14e cleanup_milter_test14f \
cleanup_milter_test14g \
@@ -357,6 +358,51 @@ cleanup_milter_test13d: cleanup_milter test-queue-file13d cleanup_milter.in13d \
diff cleanup_milter.ref13d cleanup_milter.tmp
rm -f test-queue-file13d.tmp cleanup_milter.tmp
+cleanup_milter_test13e: cleanup_milter test-queue-file13e cleanup_milter.in13e \
+ cleanup_milter.ref13e ../postcat/postcat
+ cp test-queue-file13e test-queue-file13e.tmp
+ chmod u+w test-queue-file13e.tmp
+ $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13e
+ $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13e.tmp 2>/dev/null >cleanup_milter.tmp
+ diff cleanup_milter.ref13e cleanup_milter.tmp
+ rm -f test-queue-file13e.tmp cleanup_milter.tmp
+
+cleanup_milter_test13g: cleanup_milter test-queue-file13g cleanup_milter.in13g \
+ cleanup_milter.ref13g ../postcat/postcat
+ cp test-queue-file13g test-queue-file13g.tmp
+ chmod u+w test-queue-file13g.tmp
+ $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13g
+ $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13g.tmp 2>/dev/null >cleanup_milter.tmp
+ diff cleanup_milter.ref13g cleanup_milter.tmp
+ rm -f test-queue-file13g.tmp cleanup_milter.tmp
+
+cleanup_milter_test13h: cleanup_milter test-queue-file13h cleanup_milter.in13h \
+ cleanup_milter.ref13h ../postcat/postcat
+ cp test-queue-file13h test-queue-file13h.tmp
+ chmod u+w test-queue-file13h.tmp
+ $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13h
+ $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13h.tmp 2>/dev/null >cleanup_milter.tmp
+ diff cleanup_milter.ref13h cleanup_milter.tmp
+ rm -f test-queue-file13h.tmp cleanup_milter.tmp
+
+cleanup_milter_test13i: cleanup_milter test-queue-file13i cleanup_milter.in13i \
+ cleanup_milter.ref13i ../postcat/postcat
+ cp test-queue-file13i test-queue-file13i.tmp
+ chmod u+w test-queue-file13i.tmp
+ $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13i
+ $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13i.tmp 2>/dev/null >cleanup_milter.tmp
+ diff cleanup_milter.ref13i cleanup_milter.tmp
+ rm -f test-queue-file13i.tmp cleanup_milter.tmp
+
+cleanup_milter_test13f: cleanup_milter test-queue-file13f cleanup_milter.in13f \
+ cleanup_milter.ref13f ../postcat/postcat
+ cp test-queue-file13f test-queue-file13f.tmp
+ chmod u+w test-queue-file13f.tmp
+ $(SHLIB_ENV) ./cleanup_milter <cleanup_milter.in13f
+ $(SHLIB_ENV) ../postcat/postcat -ov test-queue-file13f.tmp 2>/dev/null >cleanup_milter.tmp
+ diff cleanup_milter.ref13f cleanup_milter.tmp
+ rm -f test-queue-file13f.tmp cleanup_milter.tmp
+
cleanup_milter_test14a: cleanup_milter test-queue-file14 cleanup_milter.in14a \
cleanup_milter.ref14a1 ../postcat/postcat cleanup_milter.ref14a2 \
cleanup_milter.reg14a
@@ -559,7 +605,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -614,6 +660,7 @@ cleanup_addr.o: ../../include/htable.h
cleanup_addr.o: ../../include/iostuff.h
cleanup_addr.o: ../../include/mail_addr.h
cleanup_addr.o: ../../include/mail_addr_find.h
+cleanup_addr.o: ../../include/mail_addr_form.h
cleanup_addr.o: ../../include/mail_conf.h
cleanup_addr.o: ../../include/mail_params.h
cleanup_addr.o: ../../include/mail_proto.h
@@ -627,6 +674,7 @@ cleanup_addr.o: ../../include/myflock.h
cleanup_addr.o: ../../include/mymalloc.h
cleanup_addr.o: ../../include/nvtable.h
cleanup_addr.o: ../../include/rec_type.h
+cleanup_addr.o: ../../include/record.h
cleanup_addr.o: ../../include/resolve_clnt.h
cleanup_addr.o: ../../include/smtputf8.h
cleanup_addr.o: ../../include/string_list.h
@@ -890,6 +938,7 @@ cleanup_init.o: ../../include/mime_state.h
cleanup_init.o: ../../include/msg.h
cleanup_init.o: ../../include/myflock.h
cleanup_init.o: ../../include/mymalloc.h
+cleanup_init.o: ../../include/name_code.h
cleanup_init.o: ../../include/name_mask.h
cleanup_init.o: ../../include/nvtable.h
cleanup_init.o: ../../include/resolve_clnt.h
@@ -912,6 +961,7 @@ cleanup_map11.o: ../../include/dsn_mask.h
cleanup_map11.o: ../../include/header_body_checks.h
cleanup_map11.o: ../../include/header_opts.h
cleanup_map11.o: ../../include/htable.h
+cleanup_map11.o: ../../include/mail_addr_form.h
cleanup_map11.o: ../../include/mail_addr_map.h
cleanup_map11.o: ../../include/mail_conf.h
cleanup_map11.o: ../../include/mail_stream.h
@@ -945,6 +995,7 @@ cleanup_map1n.o: ../../include/dsn_mask.h
cleanup_map1n.o: ../../include/header_body_checks.h
cleanup_map1n.o: ../../include/header_opts.h
cleanup_map1n.o: ../../include/htable.h
+cleanup_map1n.o: ../../include/mail_addr_form.h
cleanup_map1n.o: ../../include/mail_addr_map.h
cleanup_map1n.o: ../../include/mail_conf.h
cleanup_map1n.o: ../../include/mail_params.h
@@ -1015,6 +1066,7 @@ cleanup_message.o: ../../include/ext_prop.h
cleanup_message.o: ../../include/header_body_checks.h
cleanup_message.o: ../../include/header_opts.h
cleanup_message.o: ../../include/htable.h
+cleanup_message.o: ../../include/info_log_addr_form.h
cleanup_message.o: ../../include/iostuff.h
cleanup_message.o: ../../include/is_header.h
cleanup_message.o: ../../include/lex_822.h
@@ -1058,6 +1110,8 @@ cleanup_milter.o: ../../include/dsn_util.h
cleanup_milter.o: ../../include/header_body_checks.h
cleanup_milter.o: ../../include/header_opts.h
cleanup_milter.o: ../../include/htable.h
+cleanup_milter.o: ../../include/inet_proto.h
+cleanup_milter.o: ../../include/info_log_addr_form.h
cleanup_milter.o: ../../include/iostuff.h
cleanup_milter.o: ../../include/is_header.h
cleanup_milter.o: ../../include/lex_822.h
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_body_edit.c b/external/ibm-public/postfix/dist/src/cleanup/cleanup_body_edit.c
index 06d9756444e..8eda3f60afb 100644
--- a/external/ibm-public/postfix/dist/src/cleanup/cleanup_body_edit.c
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_body_edit.c
@@ -1,4 +1,4 @@
-/* $NetBSD: cleanup_body_edit.c,v 1.1.1.1 2009/06/23 10:08:42 tron Exp $ */
+/* $NetBSD: cleanup_body_edit.c,v 1.1.1.2 2020/03/18 18:59:32 christos Exp $ */
/*++
/* NAME
@@ -60,6 +60,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -112,7 +117,7 @@ int cleanup_body_edit_start(CLEANUP_STATE *state)
cleanup_region_return(state, state->body_regions);
/*
- * Select the first region. XXX This will usally be the original body
+ * Select the first region. XXX This will usually be the original body
* segment, but we must not count on that. Region assignments may change
* when header editing also uses queue file regions. XXX We don't really
* know if the first region will be large enough to hold the first body
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13e b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13e
new file mode 100644
index 00000000000..a657c3cbf77
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13e
@@ -0,0 +1,10 @@
+#verbose on
+open test-queue-file13e.tmp
+
+# Change the sender.
+
+sender_bcc_maps static:a@porcupine.org
+chg_from m@porcupine.org esmtpstuff
+#chg_from n@porcupine.org esmtpstuff
+
+close
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13f b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13f
new file mode 100644
index 00000000000..aeb7f5aaee9
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13f
@@ -0,0 +1,10 @@
+#verbose on
+open test-queue-file13f.tmp
+
+# Change the sender.
+
+sender_bcc_maps static:a@porcupine.org
+chg_from m@porcupine.org esmtpstuff
+chg_from n@porcupine.org esmtpstuff
+
+close
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13g b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13g
new file mode 100644
index 00000000000..c88e3c9141d
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13g
@@ -0,0 +1,11 @@
+#verbose on
+open test-queue-file13g.tmp
+
+# Change the sender.
+
+sender_bcc_maps static:a@porcupine.org
+chg_from m@porcupine.org esmtpstuff
+chg_from n@porcupine.org esmtpstuff
+chg_from o@porcupine.org esmtpstuff
+
+close
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13h b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13h
new file mode 100644
index 00000000000..b5af3239fd0
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13h
@@ -0,0 +1,8 @@
+#verbose on
+open test-queue-file13h.tmp
+
+# Change the sender.
+
+chg_from m@porcupine.org { ret=hdrs envid=env-for-m }
+
+close
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13i b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13i
new file mode 100644
index 00000000000..85dfeb02185
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13i
@@ -0,0 +1,9 @@
+#verbose on
+open test-queue-file13i.tmp
+
+# Change the sender.
+
+chg_from m@porcupine.org { ret=hdrs envid=env-for-m }
+chg_from n@porcupine.org { ret=full envid=env-for-n }
+
+close
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13c b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13c
index 17df1b845ab..3ec05312227 100644
--- a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13c
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13c
@@ -4,9 +4,11 @@
100 create_time: Sun Jan 21 13:33:08 2007
124 named_attribute: rewrite_context=local
147 sender_fullname: Wietse Venema
- 162 pointer_record: 607
+ 162 pointer_record: 573
+ 573 pointer_record: 607
607 sender: n@porcupine.org
- 624 pointer_record: 180
+ 624 pointer_record: 590
+ 590 pointer_record: 180
180 *** MESSAGE CONTENTS test-queue-file13c.tmp ***
182 regular_text: Received: by hades.porcupine.org (Postfix, from userid 1001)
244 regular_text: id DE040290405; Sun, 21 Jan 2007 13:33:08 -0500 (EST)
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13d b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13d
index 9820162e550..df9f1dc355d 100644
--- a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13d
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13d
@@ -3,9 +3,11 @@
81 message_arrival_time: Mon Apr 27 20:41:30 2009
100 create_time: Mon Apr 27 20:41:41 2009
124 named_attribute: rewrite_context=local
- 147 pointer_record: 1009
+ 147 pointer_record: 975
+ 975 pointer_record: 1009
1009 sender: n@porcupine.org
- 1026 pointer_record: 164
+ 1026 pointer_record: 992
+ 992 pointer_record: 164
164 named_attribute: log_client_name=localhost
191 named_attribute: log_client_address=127.0.0.1
221 named_attribute: log_client_port=51286
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13e b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13e
new file mode 100644
index 00000000000..495c7fa3c45
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13e
@@ -0,0 +1,30 @@
+*** ENVELOPE RECORDS test-queue-file13e.tmp ***
+ 0 message_size: 332 182 1 0 332
+ 81 message_arrival_time: Sun Jan 21 13:32:59 2007
+ 100 create_time: Sun Jan 21 13:33:08 2007
+ 124 named_attribute: rewrite_context=local
+ 147 sender_fullname: Wietse Venema
+ 162 pointer_record: 573
+ 573 sender: m@porcupine.org
+ 590 named_attribute: notify_flags=1
+ 606 original_recipient: a@porcupine.org
+ 623 recipient: a@porcupine.org
+ 640 pointer_record: 180
+ 180 *** MESSAGE CONTENTS test-queue-file13e.tmp ***
+ 182 regular_text: Received: by hades.porcupine.org (Postfix, from userid 1001)
+ 244 regular_text: id DE040290405; Sun, 21 Jan 2007 13:33:08 -0500 (EST)
+ 300 regular_text: From: me@porcupine.org
+ 324 regular_text: To: you@porcupine.org
+ 347 regular_text: Message-Id: <20060725192735.5EC2D29013F@hades.porcupine.org>
+ 409 regular_text: Date: Tue, 25 Jul 2006 15:27:19 -0400 (EDT)
+ 454 regular_text: Subject: hey!
+ 469 padding: 0
+ 472 pointer_record: 0
+ 489 regular_text:
+ 491 regular_text: text
+ 497 pointer_record: 0
+ 514 *** HEADER EXTRACTED test-queue-file13e.tmp ***
+ 516 original_recipient: you@porcupine.org
+ 535 recipient: you@porcupine.org
+ 554 pointer_record: 0
+ 571 *** MESSAGE FILE END test-queue-file13e.tmp ***
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13f b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13f
new file mode 100644
index 00000000000..dcc563ab67d
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13f
@@ -0,0 +1,32 @@
+*** ENVELOPE RECORDS test-queue-file13f.tmp ***
+ 0 message_size: 332 182 1 0 332
+ 81 message_arrival_time: Sun Jan 21 13:32:59 2007
+ 100 create_time: Sun Jan 21 13:33:08 2007
+ 124 named_attribute: rewrite_context=local
+ 147 sender_fullname: Wietse Venema
+ 162 pointer_record: 573
+ 573 pointer_record: 657
+ 657 sender: n@porcupine.org
+ 674 pointer_record: 590
+ 590 named_attribute: notify_flags=1
+ 606 original_recipient: a@porcupine.org
+ 623 recipient: a@porcupine.org
+ 640 pointer_record: 180
+ 180 *** MESSAGE CONTENTS test-queue-file13f.tmp ***
+ 182 regular_text: Received: by hades.porcupine.org (Postfix, from userid 1001)
+ 244 regular_text: id DE040290405; Sun, 21 Jan 2007 13:33:08 -0500 (EST)
+ 300 regular_text: From: me@porcupine.org
+ 324 regular_text: To: you@porcupine.org
+ 347 regular_text: Message-Id: <20060725192735.5EC2D29013F@hades.porcupine.org>
+ 409 regular_text: Date: Tue, 25 Jul 2006 15:27:19 -0400 (EDT)
+ 454 regular_text: Subject: hey!
+ 469 padding: 0
+ 472 pointer_record: 0
+ 489 regular_text:
+ 491 regular_text: text
+ 497 pointer_record: 0
+ 514 *** HEADER EXTRACTED test-queue-file13f.tmp ***
+ 516 original_recipient: you@porcupine.org
+ 535 recipient: you@porcupine.org
+ 554 pointer_record: 0
+ 571 *** MESSAGE FILE END test-queue-file13f.tmp ***
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13g b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13g
new file mode 100644
index 00000000000..acadf22558c
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13g
@@ -0,0 +1,34 @@
+*** ENVELOPE RECORDS test-queue-file13g.tmp ***
+ 0 message_size: 332 182 1 0 332
+ 81 message_arrival_time: Sun Jan 21 13:32:59 2007
+ 100 create_time: Sun Jan 21 13:33:08 2007
+ 124 named_attribute: rewrite_context=local
+ 147 sender_fullname: Wietse Venema
+ 162 pointer_record: 573
+ 573 pointer_record: 657
+ 657 pointer_record: 691
+ 691 sender: o@porcupine.org
+ 708 pointer_record: 674
+ 674 pointer_record: 590
+ 590 named_attribute: notify_flags=1
+ 606 original_recipient: a@porcupine.org
+ 623 recipient: a@porcupine.org
+ 640 pointer_record: 180
+ 180 *** MESSAGE CONTENTS test-queue-file13g.tmp ***
+ 182 regular_text: Received: by hades.porcupine.org (Postfix, from userid 1001)
+ 244 regular_text: id DE040290405; Sun, 21 Jan 2007 13:33:08 -0500 (EST)
+ 300 regular_text: From: me@porcupine.org
+ 324 regular_text: To: you@porcupine.org
+ 347 regular_text: Message-Id: <20060725192735.5EC2D29013F@hades.porcupine.org>
+ 409 regular_text: Date: Tue, 25 Jul 2006 15:27:19 -0400 (EDT)
+ 454 regular_text: Subject: hey!
+ 469 padding: 0
+ 472 pointer_record: 0
+ 489 regular_text:
+ 491 regular_text: text
+ 497 pointer_record: 0
+ 514 *** HEADER EXTRACTED test-queue-file13g.tmp ***
+ 516 original_recipient: you@porcupine.org
+ 535 recipient: you@porcupine.org
+ 554 pointer_record: 0
+ 571 *** MESSAGE FILE END test-queue-file13g.tmp ***
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13h b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13h
new file mode 100644
index 00000000000..c3a8fe93995
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13h
@@ -0,0 +1,29 @@
+*** ENVELOPE RECORDS test-queue-file13h.tmp ***
+ 0 message_size: 332 182 1 0 332
+ 81 message_arrival_time: Sun Jan 21 13:32:59 2007
+ 100 create_time: Sun Jan 21 13:33:08 2007
+ 124 named_attribute: rewrite_context=local
+ 147 sender_fullname: Wietse Venema
+ 162 pointer_record: 573
+ 573 named_attribute: envelope_id=env-for-m
+ 596 named_attribute: ret_flags=2
+ 609 sender: m@porcupine.org
+ 626 pointer_record: 180
+ 180 *** MESSAGE CONTENTS test-queue-file13h.tmp ***
+ 182 regular_text: Received: by hades.porcupine.org (Postfix, from userid 1001)
+ 244 regular_text: id DE040290405; Sun, 21 Jan 2007 13:33:08 -0500 (EST)
+ 300 regular_text: From: me@porcupine.org
+ 324 regular_text: To: you@porcupine.org
+ 347 regular_text: Message-Id: <20060725192735.5EC2D29013F@hades.porcupine.org>
+ 409 regular_text: Date: Tue, 25 Jul 2006 15:27:19 -0400 (EDT)
+ 454 regular_text: Subject: hey!
+ 469 padding: 0
+ 472 pointer_record: 0
+ 489 regular_text:
+ 491 regular_text: text
+ 497 pointer_record: 0
+ 514 *** HEADER EXTRACTED test-queue-file13h.tmp ***
+ 516 original_recipient: you@porcupine.org
+ 535 recipient: you@porcupine.org
+ 554 pointer_record: 0
+ 571 *** MESSAGE FILE END test-queue-file13h.tmp ***
diff --git a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13i b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13i
new file mode 100644
index 00000000000..006ef13b70f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13i
@@ -0,0 +1,33 @@
+*** ENVELOPE RECORDS test-queue-file13i.tmp ***
+ 0 message_size: 332 182 1 0 332
+ 81 message_arrival_time: Sun Jan 21 13:32:59 2007
+ 100 create_time: Sun Jan 21 13:33:08 2007
+ 124 named_attribute: rewrite_context=local
+ 147 sender_fullname: Wietse Venema
+ 162 pointer_record: 573
+ 573 named_attribute: envelope_id=env-for-m
+ 596 named_attribute: ret_flags=2
+ 609 pointer_record: 643
+ 643 named_attribute: envelope_id=env-for-n
+ 666 named_attribute: ret_flags=1
+ 679 sender: n@porcupine.org
+ 696 pointer_record: 626
+ 626 pointer_record: 180
+ 180 *** MESSAGE CONTENTS test-queue-file13i.tmp ***
+ 182 regular_text: Received: by hades.porcupine.org (Postfix, from userid 1001)
+ 244 regular_text: id DE040290405; Sun, 21 Jan 2007 13:33:08 -0500 (EST)
+ 300 regular_text: From: me@porcupine.org
+ 324 regular_text: To: you@porcupine.org
+ 347 regular_text: Message-Id: <20060725192735.5EC2D29013F@hades.porcupine.org>
+ 409 regular_text: Date: Tue, 25 Jul 2006 15:27:19 -0400 (EDT)
+ 454 regular_text: Subject: hey!
+ 469 padding: 0
+ 472 pointer_record: 0
+ 489 regular_text:
+ 491 regular_text: text
+ 497 pointer_record: 0
+ 514 *** HEADER EXTRACTED test-queue-file13i.tmp ***
+ 516 original_recipient: you@porcupine.org
+ 535 recipient: you@porcupine.org
+ 554 pointer_record: 0
+ 571 *** MESSAGE FILE END test-queue-file13i.tmp ***
diff --git a/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13e b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13e
new file mode 100644
index 00000000000..4979c1df57f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13e
Binary files differ
diff --git a/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13f b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13f
new file mode 100644
index 00000000000..4979c1df57f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13f
Binary files differ
diff --git a/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13g b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13g
new file mode 100644
index 00000000000..4979c1df57f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13g
Binary files differ
diff --git a/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13h b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13h
new file mode 100644
index 00000000000..4979c1df57f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13h
Binary files differ
diff --git a/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13i b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13i
new file mode 100644
index 00000000000..4979c1df57f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/cleanup/test-queue-file13i
Binary files differ
diff --git a/external/ibm-public/postfix/dist/src/discard/Makefile.in b/external/ibm-public/postfix/dist/src/discard/Makefile.in
index 218f28bc5bf..f8c3b6572f1 100644
--- a/external/ibm-public/postfix/dist/src/discard/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/discard/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/dns/Makefile.in b/external/ibm-public/postfix/dist/src/dns/Makefile.in
index 8e87a5e50eb..aec91e0b5e2 100644
--- a/external/ibm-public/postfix/dist/src/dns/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/dns/Makefile.in
@@ -1,10 +1,10 @@
SHELL = /bin/sh
SRCS = dns_lookup.c dns_rr.c dns_strerror.c dns_strtype.c dns_rr_to_pa.c \
dns_sa_to_rr.c dns_rr_eq_sa.c dns_rr_to_sa.c dns_strrecord.c \
- dns_rr_filter.c
+ dns_rr_filter.c dns_str_resflags.c
OBJS = dns_lookup.o dns_rr.o dns_strerror.o dns_strtype.o dns_rr_to_pa.o \
dns_sa_to_rr.o dns_rr_eq_sa.o dns_rr_to_sa.o dns_strrecord.o \
- dns_rr_filter.o
+ dns_rr_filter.o dns_str_resflags.o
HDRS = dns.h
TESTSRC = test_dns_lookup.c test_alias_token.c
DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE)
@@ -165,7 +165,6 @@ mxonly_test: test_dns_lookup mxonly_test.ref
dnsbl_ttl_127.0.0.1_bind_plain_test: test_dns_lookup dnsbl_ttl_127.0.0.1_bind_plain.ref
(set -e; \
$(SHLIB_ENV) ./test_dns_lookup a 1.0.0.127.zen.spamhaus.org; \
- $(SHLIB_ENV) ./test_dns_lookup a 1.0.0.127.b.barracudacentral.org; \
$(SHLIB_ENV) ./test_dns_lookup a 1.0.0.127.bl.spamcop.net; \
) 2>&1 | $(DNSBL_NEXIST_REPLY_FIX) >dnsbl_ttl_127.0.0.1_bind_plain.tmp
diff dnsbl_ttl_127.0.0.1_bind_plain.ref dnsbl_ttl_127.0.0.1_bind_plain.tmp
@@ -176,7 +175,6 @@ dnsbl_ttl_127.0.0.1_bind_plain_test: test_dns_lookup dnsbl_ttl_127.0.0.1_bind_pl
dnsbl_ttl_127.0.0.1_priv_plain_test: test_dns_lookup dnsbl_ttl_127.0.0.1_bind_plain.ref
(set -e; \
$(SHLIB_ENV) ./test_dns_lookup -p a 1.0.0.127.zen.spamhaus.org; \
- $(SHLIB_ENV) ./test_dns_lookup -p a 1.0.0.127.b.barracudacentral.org; \
$(SHLIB_ENV) ./test_dns_lookup -p a 1.0.0.127.bl.spamcop.net; \
) 2>&1 | $(DNSBL_NEXIST_REPLY_FIX) >dnsbl_ttl_127.0.0.1_priv_plain.tmp
diff dnsbl_ttl_127.0.0.1_bind_plain.ref dnsbl_ttl_127.0.0.1_priv_plain.tmp
@@ -187,7 +185,6 @@ dnsbl_ttl_127.0.0.1_priv_plain_test: test_dns_lookup dnsbl_ttl_127.0.0.1_bind_pl
dnsbl_ttl_127.0.0.1_bind_ncache_test: test_dns_lookup dnsbl_ttl_127.0.0.1_bind_ncache.ref
(set -e; \
$(SHLIB_ENV) ./test_dns_lookup -n a 1.0.0.127.zen.spamhaus.org; \
- $(SHLIB_ENV) ./test_dns_lookup -n a 1.0.0.127.b.barracudacentral.org; \
$(SHLIB_ENV) ./test_dns_lookup -n a 1.0.0.127.bl.spamcop.net; \
) 2>&1 | $(DNSBL_NEXIST_REPLY_FIX) >dnsbl_ttl_127.0.0.1_bind_ncache.tmp
diff dnsbl_ttl_127.0.0.1_bind_ncache.ref dnsbl_ttl_127.0.0.1_bind_ncache.tmp
@@ -198,7 +195,6 @@ dnsbl_ttl_127.0.0.1_bind_ncache_test: test_dns_lookup dnsbl_ttl_127.0.0.1_bind_n
dnsbl_ttl_127.0.0.1_priv_ncache_test: test_dns_lookup dnsbl_ttl_127.0.0.1_bind_ncache.ref
(set -e; \
$(SHLIB_ENV) ./test_dns_lookup -n -p a 1.0.0.127.zen.spamhaus.org; \
- $(SHLIB_ENV) ./test_dns_lookup -n -p a 1.0.0.127.b.barracudacentral.org; \
$(SHLIB_ENV) ./test_dns_lookup -n -p a 1.0.0.127.bl.spamcop.net; \
) 2>&1 | $(DNSBL_NEXIST_REPLY_FIX) >dnsbl_ttl_127.0.0.1_priv_ncache.tmp
diff dnsbl_ttl_127.0.0.1_bind_ncache.ref dnsbl_ttl_127.0.0.1_priv_ncache.tmp
@@ -209,7 +205,6 @@ dnsbl_ttl_127.0.0.1_priv_ncache_test: test_dns_lookup dnsbl_ttl_127.0.0.1_bind_n
dnsbl_ttl_127.0.0.2_bind_plain_test: test_dns_lookup dnsbl_ttl_127.0.0.2_bind_plain.ref
(set -e; \
$(SHLIB_ENV) ./test_dns_lookup a 2.0.0.127.zen.spamhaus.org; \
- $(SHLIB_ENV) ./test_dns_lookup a 2.0.0.127.b.barracudacentral.org; \
$(SHLIB_ENV) ./test_dns_lookup a 2.0.0.127.bl.spamcop.net; \
) 2>&1 | $(DNSBL_EXIST_REPLY_FIX) >dnsbl_ttl_127.0.0.2_bind_plain.tmp
diff dnsbl_ttl_127.0.0.2_bind_plain.ref dnsbl_ttl_127.0.0.2_bind_plain.tmp
@@ -220,7 +215,6 @@ dnsbl_ttl_127.0.0.2_bind_plain_test: test_dns_lookup dnsbl_ttl_127.0.0.2_bind_pl
dnsbl_ttl_127.0.0.2_priv_plain_test: test_dns_lookup dnsbl_ttl_127.0.0.2_bind_plain.ref
(set -e; \
$(SHLIB_ENV) ./test_dns_lookup -p a 2.0.0.127.zen.spamhaus.org; \
- $(SHLIB_ENV) ./test_dns_lookup -p a 2.0.0.127.b.barracudacentral.org; \
$(SHLIB_ENV) ./test_dns_lookup -p a 2.0.0.127.bl.spamcop.net; \
) 2>&1 | $(DNSBL_EXIST_REPLY_FIX) >dnsbl_ttl_127.0.0.2_priv_plain.tmp
diff dnsbl_ttl_127.0.0.2_bind_plain.ref dnsbl_ttl_127.0.0.2_priv_plain.tmp
@@ -231,7 +225,6 @@ dnsbl_ttl_127.0.0.2_priv_plain_test: test_dns_lookup dnsbl_ttl_127.0.0.2_bind_pl
dnsbl_ttl_127.0.0.2_bind_ncache_test: test_dns_lookup dnsbl_ttl_127.0.0.2_bind_plain.ref
(set -e; \
$(SHLIB_ENV) ./test_dns_lookup -n a 2.0.0.127.zen.spamhaus.org; \
- $(SHLIB_ENV) ./test_dns_lookup -n a 2.0.0.127.b.barracudacentral.org; \
$(SHLIB_ENV) ./test_dns_lookup -n a 2.0.0.127.bl.spamcop.net; \
) 2>&1 | $(DNSBL_EXIST_REPLY_FIX) >dnsbl_ttl_127.0.0.2_bind_ncache.tmp
diff dnsbl_ttl_127.0.0.2_bind_plain.ref dnsbl_ttl_127.0.0.2_bind_ncache.tmp
@@ -242,7 +235,6 @@ dnsbl_ttl_127.0.0.2_bind_ncache_test: test_dns_lookup dnsbl_ttl_127.0.0.2_bind_p
dnsbl_ttl_127.0.0.2_priv_ncache_test: test_dns_lookup dnsbl_ttl_127.0.0.2_bind_plain.ref
(set -e; \
$(SHLIB_ENV) ./test_dns_lookup -n -p a 2.0.0.127.zen.spamhaus.org; \
- $(SHLIB_ENV) ./test_dns_lookup -n -p a 2.0.0.127.b.barracudacentral.org; \
$(SHLIB_ENV) ./test_dns_lookup -n -p a 2.0.0.127.bl.spamcop.net; \
) 2>&1 | $(DNSBL_EXIST_REPLY_FIX) >dnsbl_ttl_127.0.0.2_priv_ncache.tmp
diff dnsbl_ttl_127.0.0.2_bind_plain.ref dnsbl_ttl_127.0.0.2_priv_ncache.tmp
@@ -271,7 +263,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -354,6 +346,15 @@ dns_sa_to_rr.o: ../../include/vbuf.h
dns_sa_to_rr.o: ../../include/vstring.h
dns_sa_to_rr.o: dns.h
dns_sa_to_rr.o: dns_sa_to_rr.c
+dns_str_resflags.o: ../../include/check_arg.h
+dns_str_resflags.o: ../../include/myaddrinfo.h
+dns_str_resflags.o: ../../include/name_mask.h
+dns_str_resflags.o: ../../include/sock_addr.h
+dns_str_resflags.o: ../../include/sys_defs.h
+dns_str_resflags.o: ../../include/vbuf.h
+dns_str_resflags.o: ../../include/vstring.h
+dns_str_resflags.o: dns.h
+dns_str_resflags.o: dns_str_resflags.c
dns_strerror.o: ../../include/check_arg.h
dns_strerror.o: ../../include/myaddrinfo.h
dns_strerror.o: ../../include/sock_addr.h
diff --git a/external/ibm-public/postfix/dist/src/dns/dns_str_resflags.c b/external/ibm-public/postfix/dist/src/dns/dns_str_resflags.c
new file mode 100644
index 00000000000..dbb7dc7b18e
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/dns/dns_str_resflags.c
@@ -0,0 +1,130 @@
+/* $NetBSD: dns_str_resflags.c,v 1.1.1.1 2020/03/18 18:59:33 christos Exp $ */
+
+/*++
+/* NAME
+/* dns_str_resflags 3
+/* SUMMARY
+/* convert resolver flags to printable form
+/* SYNOPSIS
+/* #include <dns.h>
+/*
+/* const char *dns_str_resflags(mask)
+/* unsigned long mask;
+/* DESCRIPTION
+/* dns_str_resflags() converts RES_* resolver(5) flags from internal
+/* form to printable string. Individual flag names are separated
+/* with '|'. The result is overwritten with each call.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+ /*
+ * Utility library.
+ */
+#include <name_mask.h>
+
+ /*
+ * DNS library.
+ */
+#include <dns.h>
+
+ /*
+ * Application-specific.
+ */
+
+ /*
+ * This list overlaps with dns_res_opt_masks[] in smtp.c, but there we
+ * permit only a small subset of all possible flags.
+ */
+static const LONG_NAME_MASK resflag_table[] = {
+ "RES_INIT", RES_INIT,
+ "RES_DEBUG", RES_DEBUG,
+#ifdef RES_AAONLY
+ "RES_AAONLY", RES_AAONLY,
+#endif
+ "RES_USEVC", RES_USEVC,
+#ifdef RES_PRIMARY
+ "RES_PRIMARY", RES_PRIMARY,
+#endif
+ "RES_IGNTC", RES_IGNTC,
+ "RES_RECURSE", RES_RECURSE,
+ "RES_DEFNAMES", RES_DEFNAMES,
+ "RES_STAYOPEN", RES_STAYOPEN,
+ "RES_DNSRCH", RES_DNSRCH,
+#ifdef RES_INSECURE1
+ "RES_INSECURE1", RES_INSECURE1,
+#endif
+#ifdef RES_INSECURE2
+ "RES_INSECURE2", RES_INSECURE2,
+#endif
+ "RES_NOALIASES", RES_NOALIASES,
+#ifdef RES_USE_INET6
+ "RES_USE_INET6", RES_USE_INET6,
+#endif
+#ifdef RES_ROTATE
+ "RES_ROTATE", RES_ROTATE,
+#endif
+#ifdef RES_NOCHECKNAME
+ "RES_NOCHECKNAME", RES_NOCHECKNAME,
+#endif
+ "RES_USE_EDNS0", RES_USE_EDNS0,
+ "RES_USE_DNSSEC", RES_USE_DNSSEC,
+#ifdef RES_KEEPTSIG
+ "RES_KEEPTSIG", RES_KEEPTSIG,
+#endif
+#ifdef RES_BLAST
+ "RES_BLAST", RES_BLAST,
+#endif
+#ifdef RES_USEBSTRING
+ "RES_USEBSTRING", RES_USEBSTRING,
+#endif
+#ifdef RES_NSID
+ "RES_NSID", RES_NSID,
+#endif
+#ifdef RES_NOIP6DOTINT
+ "RES_NOIP6DOTINT", RES_NOIP6DOTINT,
+#endif
+#ifdef RES_USE_DNAME
+ "RES_USE_DNAME", RES_USE_DNAME,
+#endif
+#ifdef RES_NO_NIBBLE2
+ "RES_NO_NIBBLE2", RES_NO_NIBBLE2,
+#endif
+#ifdef RES_SNGLKUP
+ "RES_SNGLKUP", RES_SNGLKUP,
+#endif
+#ifdef RES_SNGLKUPREOP
+ "RES_SNGLKUPREOP", RES_SNGLKUPREOP,
+#endif
+#ifdef RES_NOTLDQUERY
+ "RES_NOTLDQUERY", RES_NOTLDQUERY,
+#endif
+ 0,
+};
+
+/* dns_str_resflags - convert RES_* resolver flags to printable form */
+
+const char *dns_str_resflags(unsigned long mask)
+{
+ static VSTRING *buf;
+
+ if (buf == 0)
+ buf = vstring_alloc(20);
+ return (str_long_name_mask_opt(buf, "dsns_str_resflags", resflag_table,
+ mask, NAME_MASK_NUMBER | NAME_MASK_PIPE));
+}
diff --git a/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_ncache.ref b/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_ncache.ref
index 134309fd6fd..af7b6bcff35 100644
--- a/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_ncache.ref
+++ b/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_ncache.ref
@@ -1,13 +1,10 @@
-./test_dns_lookup: lookup 1.0.0.127.zen.spamhaus.org type A flags 2097152
+./test_dns_lookup: lookup 1.0.0.127.zen.spamhaus.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: 1.0.0.127.zen.spamhaus.org (A): Host not found
./test_dns_lookup: dns_get_answer: type SOA for zen.spamhaus.org
./test_dns_lookup: warning: Host or domain name not found. Name service error for name=1.0.0.127.zen.spamhaus.org type=A: Host not found (rcode=3)
1.0.0.127.zen.spamhaus.org: fqdn: zen.spamhaus.org
ad: 0, rr: zen.spamhaus.org. TTL IN SOA - - D D D D D
-./test_dns_lookup: lookup 1.0.0.127.b.barracudacentral.org type A flags 2097152
-./test_dns_lookup: dns_query: 1.0.0.127.b.barracudacentral.org (A): Host not found
-./test_dns_lookup: warning: Host or domain name not found. Name service error for name=1.0.0.127.b.barracudacentral.org type=A: Host not found (rcode=3)
-./test_dns_lookup: lookup 1.0.0.127.bl.spamcop.net type A flags 2097152
+./test_dns_lookup: lookup 1.0.0.127.bl.spamcop.net type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: 1.0.0.127.bl.spamcop.net (A): Host not found
./test_dns_lookup: dns_get_answer: type SOA for bl.spamcop.net
./test_dns_lookup: warning: Host or domain name not found. Name service error for name=1.0.0.127.bl.spamcop.net type=A: Host not found (rcode=3)
diff --git a/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_plain.ref b/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_plain.ref
index e5741d34cd9..b84554a0c2d 100644
--- a/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_plain.ref
+++ b/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_plain.ref
@@ -1,9 +1,6 @@
-./test_dns_lookup: lookup 1.0.0.127.zen.spamhaus.org type A flags 2097152
+./test_dns_lookup: lookup 1.0.0.127.zen.spamhaus.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: 1.0.0.127.zen.spamhaus.org (A): Host not found
./test_dns_lookup: warning: Host or domain name not found. Name service error for name=1.0.0.127.zen.spamhaus.org type=A: Host not found (rcode=3)
-./test_dns_lookup: lookup 1.0.0.127.b.barracudacentral.org type A flags 2097152
-./test_dns_lookup: dns_query: 1.0.0.127.b.barracudacentral.org (A): Host not found
-./test_dns_lookup: warning: Host or domain name not found. Name service error for name=1.0.0.127.b.barracudacentral.org type=A: Host not found (rcode=3)
-./test_dns_lookup: lookup 1.0.0.127.bl.spamcop.net type A flags 2097152
+./test_dns_lookup: lookup 1.0.0.127.bl.spamcop.net type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: 1.0.0.127.bl.spamcop.net (A): Host not found
./test_dns_lookup: warning: Host or domain name not found. Name service error for name=1.0.0.127.bl.spamcop.net type=A: Host not found (rcode=3)
diff --git a/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.2_bind_plain.ref b/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.2_bind_plain.ref
index 06bc7d8481d..81dd845d474 100644
--- a/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.2_bind_plain.ref
+++ b/external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.2_bind_plain.ref
@@ -1,14 +1,9 @@
-./test_dns_lookup: lookup 2.0.0.127.zen.spamhaus.org type A flags 2097152
+./test_dns_lookup: lookup 2.0.0.127.zen.spamhaus.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: 2.0.0.127.zen.spamhaus.org (A): OK
./test_dns_lookup: dns_get_answer: type A for 2.0.0.127.zen.spamhaus.org
2.0.0.127.zen.spamhaus.org: fqdn: 2.0.0.127.zen.spamhaus.org
ad: 0, rr: 2.0.0.127.zen.spamhaus.org. TTL IN A 127.0.0.D
-./test_dns_lookup: lookup 2.0.0.127.b.barracudacentral.org type A flags 2097152
-./test_dns_lookup: dns_query: 2.0.0.127.b.barracudacentral.org (A): OK
-./test_dns_lookup: dns_get_answer: type A for 2.0.0.127.b.barracudacentral.org
-2.0.0.127.b.barracudacentral.org: fqdn: 2.0.0.127.b.barracudacentral.org
-ad: 0, rr: 2.0.0.127.b.barracudacentral.org. TTL IN A 127.0.0.D
-./test_dns_lookup: lookup 2.0.0.127.bl.spamcop.net type A flags 2097152
+./test_dns_lookup: lookup 2.0.0.127.bl.spamcop.net type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: 2.0.0.127.bl.spamcop.net (A): OK
./test_dns_lookup: dns_get_answer: type A for 2.0.0.127.bl.spamcop.net
2.0.0.127.bl.spamcop.net: fqdn: 2.0.0.127.bl.spamcop.net
diff --git a/external/ibm-public/postfix/dist/src/dns/error.ref b/external/ibm-public/postfix/dist/src/dns/error.ref
index 4b19ee49910..806cfe042c9 100644
--- a/external/ibm-public/postfix/dist/src/dns/error.ref
+++ b/external/ibm-public/postfix/dist/src/dns/error.ref
@@ -1,10 +1,10 @@
-./test_dns_lookup: lookup spike.porcupine.org type A flags 2097152
+./test_dns_lookup: lookup spike.porcupine.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: spike.porcupine.org (A): OK
./test_dns_lookup: dns_get_answer: type A for spike.porcupine.org
./test_dns_lookup: dict_regexp_lookup: error.reg: spike.porcupine.org. 3600 IN A 168.100.189.2
./test_dns_lookup: maps_find: DNS reply filter: regexp:error.reg(0,lock|fold_fix): spike.porcupine.org. 3600 IN A 168.100.189.2 = oops
./test_dns_lookup: warning: DNS reply filter: unknown DNS filter action: "oops"
-./test_dns_lookup: lookup spike.porcupine.org type AAAA flags 2097152
+./test_dns_lookup: lookup spike.porcupine.org type AAAA flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: spike.porcupine.org (AAAA): OK
./test_dns_lookup: dns_get_answer: type AAAA for spike.porcupine.org
./test_dns_lookup: dict_regexp_lookup: error.reg: spike.porcupine.org. 3600 IN AAAA 2604:8d00:189::2
diff --git a/external/ibm-public/postfix/dist/src/dns/mxonly_test.ref b/external/ibm-public/postfix/dist/src/dns/mxonly_test.ref
index ec8eda54cfa..44f22d61d79 100644
--- a/external/ibm-public/postfix/dist/src/dns/mxonly_test.ref
+++ b/external/ibm-public/postfix/dist/src/dns/mxonly_test.ref
@@ -1,11 +1,11 @@
-./test_dns_lookup: lookup porcupine.org type MX flags 2097152
+./test_dns_lookup: lookup porcupine.org type MX flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: porcupine.org (MX): OK
./test_dns_lookup: dns_get_answer: type MX for porcupine.org
./test_dns_lookup: dns_get_answer: type MX for porcupine.org
./test_dns_lookup: dns_get_answer: type MX for porcupine.org
-./test_dns_lookup: lookup porcupine.org type A flags 2097152
+./test_dns_lookup: lookup porcupine.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: porcupine.org (A): Host found but no data record of requested type
ad: 0, rr: porcupine.org. 3600 IN MX 10 spike.porcupine.org.
-ad: 0, rr: porcupine.org. 3600 IN MX 20 fist.porcupine.org.
ad: 0, rr: porcupine.org. 3600 IN MX 30 m1.porcupine.org.
+ad: 0, rr: porcupine.org. 3600 IN MX 30 vz.porcupine.org.
porcupine.org: fqdn: porcupine.org
diff --git a/external/ibm-public/postfix/dist/src/dns/no-a.ref b/external/ibm-public/postfix/dist/src/dns/no-a.ref
index 72b64446e12..88ba511c483 100644
--- a/external/ibm-public/postfix/dist/src/dns/no-a.ref
+++ b/external/ibm-public/postfix/dist/src/dns/no-a.ref
@@ -1,10 +1,10 @@
-./test_dns_lookup: lookup spike.porcupine.org type A flags 2097152
+./test_dns_lookup: lookup spike.porcupine.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: spike.porcupine.org (A): OK
./test_dns_lookup: dns_get_answer: type A for spike.porcupine.org
./test_dns_lookup: dict_regexp_lookup: no-a.reg: spike.porcupine.org. 3600 IN A 168.100.189.2
./test_dns_lookup: maps_find: DNS reply filter: regexp:no-a.reg(0,lock|fold_fix): spike.porcupine.org. 3600 IN A 168.100.189.2 = ignore
./test_dns_lookup: ignoring DNS RR: spike.porcupine.org. 3600 IN A 168.100.189.2
-./test_dns_lookup: lookup spike.porcupine.org type AAAA flags 2097152
+./test_dns_lookup: lookup spike.porcupine.org type AAAA flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: spike.porcupine.org (AAAA): OK
./test_dns_lookup: dns_get_answer: type AAAA for spike.porcupine.org
./test_dns_lookup: dict_regexp_lookup: no-a.reg: spike.porcupine.org. 3600 IN AAAA 2604:8d00:189::2
diff --git a/external/ibm-public/postfix/dist/src/dns/no-aaaa.ref b/external/ibm-public/postfix/dist/src/dns/no-aaaa.ref
index eabe0525a30..f2a678c3303 100644
--- a/external/ibm-public/postfix/dist/src/dns/no-aaaa.ref
+++ b/external/ibm-public/postfix/dist/src/dns/no-aaaa.ref
@@ -1,9 +1,9 @@
-./test_dns_lookup: lookup spike.porcupine.org type A flags 2097152
+./test_dns_lookup: lookup spike.porcupine.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: spike.porcupine.org (A): OK
./test_dns_lookup: dns_get_answer: type A for spike.porcupine.org
./test_dns_lookup: dict_regexp_lookup: no-aaaa.reg: spike.porcupine.org. 3600 IN A 168.100.189.2
./test_dns_lookup: maps_find: DNS reply filter: spike.porcupine.org. 3600 IN A 168.100.189.2: not found
-./test_dns_lookup: lookup spike.porcupine.org type AAAA flags 2097152
+./test_dns_lookup: lookup spike.porcupine.org type AAAA flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: spike.porcupine.org (AAAA): OK
./test_dns_lookup: dns_get_answer: type AAAA for spike.porcupine.org
./test_dns_lookup: dict_regexp_lookup: no-aaaa.reg: spike.porcupine.org. 3600 IN AAAA 2604:8d00:189::2
diff --git a/external/ibm-public/postfix/dist/src/dns/no-mx.ref b/external/ibm-public/postfix/dist/src/dns/no-mx.ref
index 314541b6a03..5adc7bfb9c5 100644
--- a/external/ibm-public/postfix/dist/src/dns/no-mx.ref
+++ b/external/ibm-public/postfix/dist/src/dns/no-mx.ref
@@ -1,15 +1,15 @@
./test_dns_lookup: dict_regexp_lookup: no-mx.reg: porcupine.org. 3600 IN MX 10 spike.porcupine.org.
-./test_dns_lookup: dict_regexp_lookup: no-mx.reg: porcupine.org. 3600 IN MX 20 fist.porcupine.org.
./test_dns_lookup: dict_regexp_lookup: no-mx.reg: porcupine.org. 3600 IN MX 30 m1.porcupine.org.
+./test_dns_lookup: dict_regexp_lookup: no-mx.reg: porcupine.org. 3600 IN MX 30 vz.porcupine.org.
./test_dns_lookup: dns_get_answer: type MX for porcupine.org
./test_dns_lookup: dns_get_answer: type MX for porcupine.org
./test_dns_lookup: dns_get_answer: type MX for porcupine.org
./test_dns_lookup: dns_query: porcupine.org (MX): OK
./test_dns_lookup: ignoring DNS RR: porcupine.org. 3600 IN MX 10 spike.porcupine.org.
-./test_dns_lookup: ignoring DNS RR: porcupine.org. 3600 IN MX 20 fist.porcupine.org.
./test_dns_lookup: ignoring DNS RR: porcupine.org. 3600 IN MX 30 m1.porcupine.org.
-./test_dns_lookup: lookup porcupine.org type MX flags 2097152
+./test_dns_lookup: ignoring DNS RR: porcupine.org. 3600 IN MX 30 vz.porcupine.org.
+./test_dns_lookup: lookup porcupine.org type MX flags RES_USE_DNSSEC
./test_dns_lookup: maps_find: DNS reply filter: regexp:no-mx.reg(0,lock|fold_fix): porcupine.org. 3600 IN MX 10 spike.porcupine.org. = ignore
-./test_dns_lookup: maps_find: DNS reply filter: regexp:no-mx.reg(0,lock|fold_fix): porcupine.org. 3600 IN MX 20 fist.porcupine.org. = ignore
./test_dns_lookup: maps_find: DNS reply filter: regexp:no-mx.reg(0,lock|fold_fix): porcupine.org. 3600 IN MX 30 m1.porcupine.org. = ignore
+./test_dns_lookup: maps_find: DNS reply filter: regexp:no-mx.reg(0,lock|fold_fix): porcupine.org. 3600 IN MX 30 vz.porcupine.org. = ignore
./test_dns_lookup: warning: Error looking up name=porcupine.org type=MX: DNS reply filter drops all results (rcode=0)
diff --git a/external/ibm-public/postfix/dist/src/dns/nullmx_test.ref b/external/ibm-public/postfix/dist/src/dns/nullmx_test.ref
index 176023889d4..2386b53611a 100644
--- a/external/ibm-public/postfix/dist/src/dns/nullmx_test.ref
+++ b/external/ibm-public/postfix/dist/src/dns/nullmx_test.ref
@@ -1,7 +1,7 @@
-./test_dns_lookup: lookup nullmx.porcupine.org type MX flags 2097152
+./test_dns_lookup: lookup nullmx.porcupine.org type MX flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: nullmx.porcupine.org (MX): OK
./test_dns_lookup: dns_get_answer: type MX for nullmx.porcupine.org
-./test_dns_lookup: lookup nullmx.porcupine.org type A flags 2097152
+./test_dns_lookup: lookup nullmx.porcupine.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: nullmx.porcupine.org (A): OK
./test_dns_lookup: dns_get_answer: type A for nullmx.porcupine.org
nullmx.porcupine.org: fqdn: nullmx.porcupine.org
diff --git a/external/ibm-public/postfix/dist/src/dns/nxdomain_test.ref b/external/ibm-public/postfix/dist/src/dns/nxdomain_test.ref
index aecbeb454ae..15be203b13e 100644
--- a/external/ibm-public/postfix/dist/src/dns/nxdomain_test.ref
+++ b/external/ibm-public/postfix/dist/src/dns/nxdomain_test.ref
@@ -1,5 +1,5 @@
-./test_dns_lookup: lookup nxdomain.porcupine.org type MX flags 2097152
+./test_dns_lookup: lookup nxdomain.porcupine.org type MX flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: nxdomain.porcupine.org (MX): Host not found
-./test_dns_lookup: lookup nxdomain.porcupine.org type A flags 2097152
+./test_dns_lookup: lookup nxdomain.porcupine.org type A flags RES_USE_DNSSEC
./test_dns_lookup: dns_query: nxdomain.porcupine.org (A): Host not found
./test_dns_lookup: warning: Host or domain name not found. Name service error for name=nxdomain.porcupine.org type=A: Host not found (rcode=3)
diff --git a/external/ibm-public/postfix/dist/src/dnsblog/Makefile.in b/external/ibm-public/postfix/dist/src/dnsblog/Makefile.in
index f5bf0dffc63..c2ed8488118 100644
--- a/external/ibm-public/postfix/dist/src/dnsblog/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/dnsblog/Makefile.in
@@ -56,7 +56,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/error/Makefile.in b/external/ibm-public/postfix/dist/src/error/Makefile.in
index c4f636ef3a0..c98a267cf55 100644
--- a/external/ibm-public/postfix/dist/src/error/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/error/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/flush/Makefile.in b/external/ibm-public/postfix/dist/src/flush/Makefile.in
index df9214def96..8d490bf590a 100644
--- a/external/ibm-public/postfix/dist/src/flush/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/flush/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/fsstone/Makefile.in b/external/ibm-public/postfix/dist/src/fsstone/Makefile.in
index 532abe082d8..d34b0a2ae18 100644
--- a/external/ibm-public/postfix/dist/src/fsstone/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/fsstone/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/global/Makefile.in b/external/ibm-public/postfix/dist/src/global/Makefile.in
index 871e4975172..14f7283e306 100644
--- a/external/ibm-public/postfix/dist/src/global/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/global/Makefile.in
@@ -33,7 +33,10 @@ SRCS = abounce.c anvil_clnt.c been_here.c bounce.c bounce_log.c \
smtp_reply_footer.c safe_ultostr.c verify_sender_addr.c \
dict_memcache.c mail_version.c memcache_proto.c server_acl.c \
mkmap_fail.c haproxy_srvr.c dsn_filter.c dynamicmaps.c uxtext.c \
- smtputf8.c mail_conf_over.c mail_parm_split.c midna_adomain.c
+ smtputf8.c mail_conf_over.c mail_parm_split.c midna_adomain.c \
+ mail_addr_form.c quote_flags.c maillog_client.c \
+ normalize_mailhost_addr.c map_search.c reject_deliver_request.c \
+ info_log_addr_form.c
OBJS = abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \
canon_addr.o cfg_parser.o cleanup_strerror.o cleanup_strflags.o \
clnt_stream.o conv_time.o db_common.o debug_peer.o debug_process.o \
@@ -69,7 +72,9 @@ OBJS = abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \
dict_memcache.o mail_version.o memcache_proto.o server_acl.o \
mkmap_fail.o haproxy_srvr.o dsn_filter.o dynamicmaps.o uxtext.o \
smtputf8.o attr_override.o mail_parm_split.o midna_adomain.o \
- $(NON_PLUGIN_MAP_OBJ)
+ $(NON_PLUGIN_MAP_OBJ) mail_addr_form.o quote_flags.o maillog_client.o \
+ normalize_mailhost_addr.o map_search.o reject_deliver_request.o \
+ info_log_addr_form.o
# MAP_OBJ is for maps that may be dynamically loaded with dynamicmaps.cf.
# When hard-linking these maps, makedefs sets NON_PLUGIN_MAP_OBJ=$(MAP_OBJ),
# otherwise it sets the PLUGIN_* macros.
@@ -102,7 +107,9 @@ HDRS = abounce.h anvil_clnt.h been_here.h bounce.h bounce_log.h \
addr_match_list.h smtp_reply_footer.h safe_ultostr.h \
verify_sender_addr.h dict_memcache.h memcache_proto.h server_acl.h \
haproxy_srvr.h dsn_filter.h dynamicmaps.h uxtext.h smtputf8.h \
- attr_override.h mail_parm_split.h midna_adomain.h
+ attr_override.h mail_parm_split.h midna_adomain.h mail_addr_form.h \
+ maillog_client.h normalize_mailhost_addr.h map_search.h \
+ info_log_addr_form.h
TESTSRC = rec2stream.c stream2rec.c recdump.c
DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE)
CFLAGS = $(DEBUG) $(OPT) $(DEFS)
@@ -117,7 +124,8 @@ TESTPROG= domain_list dot_lockfile mail_addr_crunch mail_addr_find \
valid_mailhost_addr own_inet_addr header_body_checks \
data_redirect addr_match_list safe_ultostr verify_sender_addr \
mail_version mail_dict server_acl uxtext mail_parm_split \
- fold_addr smtp_reply_footer
+ fold_addr smtp_reply_footer mail_addr_map normalize_mailhost_addr \
+ haproxy_srvr map_search
LIBS = ../../lib/lib$(LIB_PREFIX)util$(LIB_SUFFIX)
LIB_DIR = ../../lib
@@ -248,7 +256,7 @@ off_cvt: $(LIB) $(LIBS)
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
mv junk $@.o
-mail_addr_map: $(LIB) $(LIBS)
+mail_addr_map: mail_addr_map.c $(LIB) $(LIBS)
mv $@.o junk
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
mv junk $@.o
@@ -376,110 +384,122 @@ fold_addr: fold_addr.c $(LIB) $(LIBS)
smtp_reply_footer: smtp_reply_footer.c $(LIB) $(LIBS)
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
+normalize_mailhost_addr: normalize_mailhost_addr.c $(LIB) $(LIBS)
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
+
+haproxy_srvr: haproxy_srvr.c $(LIB) $(LIBS)
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
+
+map_search: map_search.c $(LIB) $(LIBS)
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
+
tests: tok822_test mime_tests strip_addr_test tok822_limit_test \
xtext_test scache_multi_test ehlo_mask_test \
namadr_list_test mail_conf_time_test header_body_checks_tests \
mail_version_test server_acl_test resolve_local_test maps_test \
safe_ultostr_test mail_parm_split_test fold_addr_test \
- smtp_reply_footer_test
+ smtp_reply_footer_test off_cvt_test mail_addr_crunch_test \
+ mail_addr_find_test mail_addr_map_test quote_822_local_test \
+ normalize_mailhost_addr_test haproxy_srvr_test map_search_test
mime_tests: mime_test mime_nest mime_8bit mime_dom mime_trunc mime_cvt \
mime_cvt2 mime_cvt3 mime_garb1 mime_garb2 mime_garb3 mime_garb4
header_body_checks_tests: header_body_checks_null_test \
header_body_checks_warn_test header_body_checks_prepend_test \
- header_body_checks_ignore_test header_body_checks_replace_test
+ header_body_checks_ignore_test header_body_checks_replace_test \
+ header_body_checks_strip_test
root_tests: rewrite_clnt_test resolve_clnt_test verify_sender_addr_test
tok822_test: tok822_parse tok822_parse.in tok822_parse.ref
- $(SHLIB_ENV) ./tok822_parse <tok822_parse.in >tok822_parse.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./tok822_parse <tok822_parse.in >tok822_parse.tmp 2>&1
diff tok822_parse.ref tok822_parse.tmp
rm -f tok822_parse.tmp
mime_test: mime_state mime_test.in mime_test.ref
- $(SHLIB_ENV) ./mime_state <mime_test.in >mime_test.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_test.in >mime_test.tmp
diff mime_test.ref mime_test.tmp
rm -f mime_test.tmp
mime_nest: mime_state mime_nest.in mime_nest.ref
- $(SHLIB_ENV) ./mime_state <mime_nest.in >mime_nest.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_nest.in >mime_nest.tmp
diff mime_nest.ref mime_nest.tmp
rm -f mime_nest.tmp
mime_8bit: mime_state mime_8bit.in mime_8bit.ref
- $(SHLIB_ENV) ./mime_state <mime_8bit.in >mime_8bit.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_8bit.in >mime_8bit.tmp
diff mime_8bit.ref mime_8bit.tmp
rm -f mime_8bit.tmp
mime_dom: mime_state mime_dom.in mime_dom.ref
- $(SHLIB_ENV) ./mime_state <mime_dom.in >mime_dom.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_dom.in >mime_dom.tmp
diff mime_dom.ref mime_dom.tmp
rm -f mime_dom.tmp
mime_trunc: mime_state mime_trunc.in mime_trunc.ref
- $(SHLIB_ENV) ./mime_state <mime_trunc.in >mime_trunc.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_trunc.in >mime_trunc.tmp
diff mime_trunc.ref mime_trunc.tmp
rm -f mime_trunc.tmp
mime_cvt: mime_state mime_cvt.in mime_cvt.ref
- $(SHLIB_ENV) ./mime_state <mime_cvt.in >mime_cvt.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_cvt.in >mime_cvt.tmp
diff mime_cvt.ref mime_cvt.tmp
rm -f mime_cvt.tmp
mime_cvt2: mime_state mime_cvt.in2 mime_cvt.ref2
- $(SHLIB_ENV) ./mime_state <mime_cvt.in2 >mime_cvt.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_cvt.in2 >mime_cvt.tmp
diff mime_cvt.ref2 mime_cvt.tmp
rm -f mime_cvt.tmp
mime_cvt3: mime_state mime_cvt.in3 mime_cvt.ref3
- $(SHLIB_ENV) ./mime_state <mime_cvt.in3 >mime_cvt.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_cvt.in3 >mime_cvt.tmp
diff mime_cvt.ref3 mime_cvt.tmp
rm -f mime_cvt.tmp
mime_garb1: mime_state mime_garb1.in mime_garb1.ref
- $(SHLIB_ENV) ./mime_state <mime_garb1.in >mime_cvt.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_garb1.in >mime_cvt.tmp
diff mime_garb1.ref mime_cvt.tmp
rm -f mime_cvt.tmp
mime_garb2: mime_state mime_garb2.in mime_garb2.ref
- $(SHLIB_ENV) ./mime_state <mime_garb2.in >mime_cvt.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_garb2.in >mime_cvt.tmp
diff mime_garb2.ref mime_cvt.tmp
rm -f mime_cvt.tmp
mime_garb3: mime_state mime_garb3.in mime_garb3.ref
- $(SHLIB_ENV) ./mime_state <mime_garb3.in >mime_cvt.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_garb3.in >mime_cvt.tmp
diff mime_garb3.ref mime_cvt.tmp
rm -f mime_cvt.tmp
mime_garb4: mime_state mime_garb4.in mime_garb4.ref
- $(SHLIB_ENV) ./mime_state <mime_garb4.in >mime_cvt.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mime_state <mime_garb4.in >mime_cvt.tmp
diff mime_garb4.ref mime_cvt.tmp
rm -f mime_cvt.tmp
tok822_limit_test: tok822_parse tok822_limit.in tok822_limit.ref
- $(SHLIB_ENV) ./tok822_parse <tok822_limit.in >tok822_limit.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./tok822_parse <tok822_limit.in >tok822_limit.tmp
diff tok822_limit.ref tok822_limit.tmp
rm -f tok822_limit.tmp
strip_addr_test: strip_addr strip_addr.ref
- $(SHLIB_ENV) ./strip_addr 2>strip_addr.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./strip_addr 2>strip_addr.tmp
diff strip_addr.ref strip_addr.tmp
rm -f strip_addr.tmp
xtext_test: xtext
- $(SHLIB_ENV) ./xtext <xtext.c | od -cb >xtext.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./xtext <xtext.c | od -cb >xtext.tmp
od -cb <xtext.c >xtext.ref
cmp xtext.ref xtext.tmp
rm -f xtext.ref xtext.tmp
mail_version_test: mail_version mail_version.in mail_version.ref
- $(SHLIB_ENV) ./mail_version <mail_version.in >mail_version.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mail_version <mail_version.in >mail_version.tmp
diff mail_version.ref mail_version.tmp
rm -f mail_version.tmp
server_acl_test: server_acl server_acl.in server_acl.ref
- $(SHLIB_ENV) ./server_acl <server_acl.in >server_acl.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./server_acl <server_acl.in >server_acl.tmp 2>&1
diff server_acl.ref server_acl.tmp
rm -f server_acl.tmp
@@ -495,15 +515,15 @@ maps_test: maps maps.in maps.ref
surrogate_test: mail_dict surrogate.ref
cp /dev/null surrogate.tmp
- echo get foo| $(SHLIB_ENV) ./mail_dict ldap:/xx write >>surrogate.tmp 2>&1
- echo get foo| $(SHLIB_ENV) ./mail_dict ldap:/xx read >>surrogate.tmp 2>&1
- echo get foo| $(SHLIB_ENV) ./mail_dict mysql:/xx write >>surrogate.tmp 2>&1
- echo get foo| $(SHLIB_ENV) ./mail_dict mysql:/xx read >>surrogate.tmp 2>&1
- echo get foo| $(SHLIB_ENV) ./mail_dict pgsql:/xx write >>surrogate.tmp 2>&1
- echo get foo| $(SHLIB_ENV) ./mail_dict pgsql:/xx read >>surrogate.tmp 2>&1
- echo get foo| $(SHLIB_ENV) ./mail_dict sqlite:/xx write >>surrogate.tmp 2>&1
- echo get foo| $(SHLIB_ENV) ./mail_dict sqlite:/xx read >>surrogate.tmp 2>&1
- echo get foo| $(SHLIB_ENV) ./mail_dict memcache:/xx read >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict ldap:/xx write >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict ldap:/xx read >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict mysql:/xx write >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict mysql:/xx read >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict pgsql:/xx write >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict pgsql:/xx read >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict sqlite:/xx write >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict sqlite:/xx read >>surrogate.tmp 2>&1
+ echo get foo| $(SHLIB_ENV) $(VALGRIND) ./mail_dict memcache:/xx read >>surrogate.tmp 2>&1
diff surrogate.ref surrogate.tmp
rm -f surrogate.tmp
@@ -516,7 +536,7 @@ rewrite_clnt_test: rewrite_clnt rewrite_clnt.in rewrite_clnt.ref
esac
@test -n "`postconf -h remote_header_rewrite_domain`" || { \
echo 'This test requires non-empty remote_header_rewrite_domain'; exit 1; }
- $(SHLIB_ENV) ./rewrite_clnt <rewrite_clnt.in >rewrite_clnt.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./rewrite_clnt <rewrite_clnt.in >rewrite_clnt.tmp
sed -e "s/MYDOMAIN/`postconf -h mydomain`/" \
-e "s/INVALID_DOMAIN/`postconf -h remote_header_rewrite_domain`/" \
rewrite_clnt.ref | diff - rewrite_clnt.tmp
@@ -535,7 +555,7 @@ resolve_clnt_test: resolve_clnt resolve_clnt.in resolve_clnt.ref
echo 'This test requires no transport map'; exit 1; }
sed -e "s/MYDOMAIN/`postconf -h mydomain`/g" \
-e "s/MYHOSTNAME/`postconf -h myhostname`/g" \
- resolve_clnt.in | $(SHLIB_ENV) ./resolve_clnt >resolve_clnt.tmp
+ resolve_clnt.in | $(SHLIB_ENV) $(VALGRIND) ./resolve_clnt >resolve_clnt.tmp
sed -e "s/MYDOMAIN/`postconf -h mydomain`/g" \
-e "s/MYHOSTNAME/`postconf -h myhostname`/g" \
-e "s/RELAYHOST/`postconf -h mydomain`/g" \
@@ -551,12 +571,12 @@ verify_sender_addr_test: verify_sender_addr verify_sender_addr.ref
esac
@test "X`postconf -h append_dot_mydomain`" = Xyes || { \
echo 'This test requires append_dot_mydomain=yes'; exit 1; }
- ($(SHLIB_ENV) ./verify_sender_addr aa@bb 0; \
- $(SHLIB_ENV) ./verify_sender_addr aa@bb 1; \
- $(SHLIB_ENV) ./verify_sender_addr aa 0; \
- $(SHLIB_ENV) ./verify_sender_addr aa 1; \
- $(SHLIB_ENV) ./verify_sender_addr '' 0; \
- $(SHLIB_ENV) ./verify_sender_addr '' 1) | \
+ ($(SHLIB_ENV) $(VALGRIND) ./verify_sender_addr aa@bb 0; \
+ $(SHLIB_ENV) $(VALGRIND) ./verify_sender_addr aa@bb 1; \
+ $(SHLIB_ENV) $(VALGRIND) ./verify_sender_addr aa 0; \
+ $(SHLIB_ENV) $(VALGRIND) ./verify_sender_addr aa 1; \
+ $(SHLIB_ENV) $(VALGRIND) ./verify_sender_addr '' 0; \
+ $(SHLIB_ENV) $(VALGRIND) ./verify_sender_addr '' 1) | \
sed 's/[A-Z0-9][A-Z0-9]*@/STAMP@/' > verify_sender_addr.tmp
sed -e "s/MYDOMAIN/`postconf -h mydomain`/g" \
-e "s/MYORIGIN/`postconf -h myorigin`/g" \
@@ -567,44 +587,44 @@ verify_sender_addr_test: verify_sender_addr verify_sender_addr.ref
rm -f verify_sender_addr.tmp
scache_multi_test: scache scache_multi.in scache_multi.ref
- $(SHLIB_ENV) ./scache <scache_multi.in >scache_multi.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./scache <scache_multi.in >scache_multi.tmp
diff scache_multi.ref scache_multi.tmp
rm -f scache_multi.tmp
ehlo_mask_test: ehlo_mask ehlo_mask.in ehlo_mask.ref
- $(SHLIB_ENV) ./ehlo_mask <ehlo_mask.in >ehlo_mask.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./ehlo_mask <ehlo_mask.in >ehlo_mask.tmp
diff ehlo_mask.ref ehlo_mask.tmp
rm -f ehlo_mask.tmp
namadr_list_test: namadr_list namadr_list.in namadr_list.ref
- -sh namadr_list.in >namadr_list.tmp 2>&1
+ -$(SHLIB_ENV) sh namadr_list.in >namadr_list.tmp 2>&1
diff namadr_list.ref namadr_list.tmp
rm -f namadr_list.tmp
mail_conf_time_test: mail_conf_time mail_conf_time.ref
- $(SHLIB_ENV) ./mail_conf_time >mail_conf_time.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./mail_conf_time >mail_conf_time.tmp
diff mail_conf_time.ref mail_conf_time.tmp
rm -f mail_conf_time.tmp
safe_ultostr_test: safe_ultostr safe_ultostr.in safe_ultostr.ref
- $(SHLIB_ENV) ./safe_ultostr <safe_ultostr.in >safe_ultostr.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./safe_ultostr <safe_ultostr.in >safe_ultostr.tmp 2>&1
diff safe_ultostr.ref safe_ultostr.tmp
rm -f safe_ultostr.tmp
header_body_checks_null_test: header_body_checks header_body_checks_null.ref
- $(SHLIB_ENV) ./header_body_checks "" "" "" "" \
+ $(SHLIB_ENV) $(VALGRIND) ./header_body_checks "" "" "" "" \
<mime_test.in >header_body_checks_null.tmp 2>&1
cmp header_body_checks_null.ref header_body_checks_null.tmp
- $(SHLIB_ENV) ./header_body_checks static:dunno static:dunno static:dunno static:dunno \
+ $(SHLIB_ENV) $(VALGRIND) ./header_body_checks static:dunno static:dunno static:dunno static:dunno \
<mime_test.in >header_body_checks_null.tmp 2>&1
cmp header_body_checks_null.ref header_body_checks_null.tmp
- $(SHLIB_ENV) ./header_body_checks static:ok static:ok static:ok static:ok \
+ $(SHLIB_ENV) $(VALGRIND) ./header_body_checks static:ok static:ok static:ok static:ok \
<mime_test.in >header_body_checks_null.tmp 2>&1
cmp header_body_checks_null.ref header_body_checks_null.tmp
rm -f header_body_checks_null.tmp
header_body_checks_warn_test: header_body_checks header_body_checks_warn.ref
- $(SHLIB_ENV) ./header_body_checks static:warn static:warn static:warn static:warn \
+ $(SHLIB_ENV) $(VALGRIND) ./header_body_checks static:warn static:warn static:warn static:warn \
<mime_test.in >header_body_checks_warn.tmp 2>&1
cmp header_body_checks_warn.ref header_body_checks_warn.tmp
rm -f header_body_checks_warn.tmp
@@ -614,7 +634,7 @@ header_body_checks_prepend_test: header_body_checks header_body_checks_prepend.r
echo /./ prepend header: mime >header_body_checks_mime
echo /./ prepend header: nest >header_body_checks_nest
echo /./ prepend body >header_body_checks_body
- $(SHLIB_ENV) ./header_body_checks regexp:header_body_checks_head regexp:header_body_checks_mime \
+ $(SHLIB_ENV) $(VALGRIND) ./header_body_checks regexp:header_body_checks_head regexp:header_body_checks_mime \
regexp:header_body_checks_nest regexp:header_body_checks_body \
<mime_test.in >header_body_checks_prepend.tmp 2>&1
cmp header_body_checks_prepend.ref header_body_checks_prepend.tmp
@@ -625,7 +645,7 @@ header_body_checks_prepend_test: header_body_checks header_body_checks_prepend.r
# errors. We can eliminate this restriction by allowing individual
# map types to advertise whether they can handle null queries.
header_body_checks_ignore_test: header_body_checks header_body_checks_ignore.ref
- $(SHLIB_ENV) ./header_body_checks static:ignore static:ignore static:ignore static:ignore \
+ $(SHLIB_ENV) $(VALGRIND) ./header_body_checks static:ignore static:ignore static:ignore static:ignore \
<mime_test.in >header_body_checks_ignore.tmp 2>&1
cmp header_body_checks_ignore.ref header_body_checks_ignore.tmp
rm -f header_body_checks_ignore.tmp header_body_checks_head header_body_checks_mime header_body_checks_nest header_body_checks_body
@@ -635,27 +655,79 @@ header_body_checks_replace_test: header_body_checks header_body_checks_replace.r
echo /./ replace header: mime >header_body_checks_mime
echo /./ replace header: nest >header_body_checks_nest
echo /./ replace body >header_body_checks_body
- $(SHLIB_ENV) ./header_body_checks regexp:header_body_checks_head regexp:header_body_checks_mime \
+ $(SHLIB_ENV) $(VALGRIND) ./header_body_checks regexp:header_body_checks_head regexp:header_body_checks_mime \
regexp:header_body_checks_nest regexp:header_body_checks_body \
<mime_test.in >header_body_checks_replace.tmp 2>&1
cmp header_body_checks_replace.ref header_body_checks_replace.tmp
rm -f header_body_checks_replace.tmp header_body_checks_head header_body_checks_mime header_body_checks_nest header_body_checks_body
+header_body_checks_strip_test: header_body_checks header_body_checks_strip.ref
+ echo /./ strip header line >header_body_checks_head
+ echo /./ strip mime header line >header_body_checks_mime
+ echo /./ strip nested header >header_body_checks_nest
+ echo /./ strip body line >header_body_checks_body
+ $(SHLIB_ENV) $(VALGRIND) ./header_body_checks regexp:header_body_checks_head regexp:header_body_checks_mime \
+ regexp:header_body_checks_nest regexp:header_body_checks_body \
+ <mime_test.in >header_body_checks_strip.tmp 2>&1
+ cmp header_body_checks_strip.ref header_body_checks_strip.tmp
+ rm -f header_body_checks_strip.tmp header_body_checks_head header_body_checks_mime header_body_checks_nest header_body_checks_body
+
mail_parm_split_test: mail_parm_split mail_parm_split.in mail_parm_split.ref
- $(SHLIB_ENV) ./mail_parm_split <mail_parm_split.in >mail_parm_split.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./mail_parm_split <mail_parm_split.in >mail_parm_split.tmp 2>&1
diff mail_parm_split.ref mail_parm_split.tmp
rm -f mail_parm_split.tmp
fold_addr_test: fold_addr fold_addr_test.in fold_addr_test.ref
- $(SHLIB_ENV) ./fold_addr <fold_addr_test.in >fold_addr_test.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./fold_addr <fold_addr_test.in >fold_addr_test.tmp 2>&1
diff fold_addr_test.ref fold_addr_test.tmp
rm -f fold_addr_test.tmp
smtp_reply_footer_test: smtp_reply_footer smtp_reply_footer.ref
- $(SHLIB_ENV) ./smtp_reply_footer >smtp_reply_footer.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./smtp_reply_footer >smtp_reply_footer.tmp 2>&1
diff smtp_reply_footer.ref smtp_reply_footer.tmp
rm -f smtp_reply_footer.tmp
+off_cvt_test: off_cvt off_cvt.in off_cvt.ref
+ $(SHLIB_ENV) $(VALGRIND) ./off_cvt <off_cvt.in >off_cvt.tmp 2>&1
+ diff off_cvt.ref off_cvt.tmp
+ rm -f off_cvt.tmp
+
+mail_addr_crunch_test: update mail_addr_crunch mail_addr_crunch.in mail_addr_crunch.ref
+ -$(SHLIB_ENV) sh mail_addr_crunch.in >mail_addr_crunch.tmp 2>&1
+ diff mail_addr_crunch.ref mail_addr_crunch.tmp
+ rm -f mail_addr_crunch.tmp
+
+mail_addr_find_test: update mail_addr_find mail_addr_find.in mail_addr_find.ref
+ -$(SHLIB_ENV) $(VALGRIND) ./mail_addr_find <mail_addr_find.in >mail_addr_find.tmp 2>&1
+ diff mail_addr_find.ref mail_addr_find.tmp
+ rm -f mail_addr_find.tmp
+
+mail_addr_map_test: update mail_addr_map mail_addr_map.ref
+ -$(SHLIB_ENV) $(VALGRIND) ./mail_addr_map pass_tests
+ -$(SHLIB_ENV) $(VALGRIND) ./mail_addr_map fail_tests >mail_addr_map.tmp 2>&1
+ diff mail_addr_map.ref mail_addr_map.tmp
+ rm -f mail_addr_map.tmp
+
+quote_822_local_test: update quote_822_local quote_822_local.in quote_822_local.ref
+ -$(SHLIB_ENV) $(VALGRIND) ./quote_822_local < quote_822_local.in >quote_822_local.tmp 2>&1
+ diff quote_822_local.ref quote_822_local.tmp
+ rm -f quote_822_local.tmp
+
+normalize_mailhost_addr_test: update normalize_mailhost_addr
+ -$(SHLIB_ENV) $(VALGRIND) ./normalize_mailhost_addr >normalize_mailhost_addr.tmp 2>&1
+ diff /dev/null normalize_mailhost_addr.tmp
+ rm -f normalize_mailhost_addr.tmp
+
+haproxy_srvr_test: update haproxy_srvr
+ -$(SHLIB_ENV) $(VALGRIND) ./haproxy_srvr >haproxy_srvr.tmp 2>&1
+ diff /dev/null haproxy_srvr.tmp
+ rm -f haproxy_srvr.tmp
+
+map_search_test: update map_search map_search.ref
+ -$(SHLIB_ENV) $(VALGRIND) ./map_search >map_search.tmp 2>&1
+ diff map_search.ref map_search.tmp
+ rm -f map_search.tmp
+
printfck: $(OBJS) $(PROG)
rm -rf printfck
mkdir printfck
@@ -679,7 +751,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -1070,13 +1142,31 @@ dict_memcache.o: dict_memcache.c
dict_memcache.o: dict_memcache.h
dict_memcache.o: memcache_proto.h
dict_memcache.o: string_list.h
+dict_mysql.o: ../../include/argv.h
+dict_mysql.o: ../../include/check_arg.h
+dict_mysql.o: ../../include/dict.h
+dict_mysql.o: ../../include/events.h
+dict_mysql.o: ../../include/find_inet.h
+dict_mysql.o: ../../include/match_list.h
+dict_mysql.o: ../../include/msg.h
+dict_mysql.o: ../../include/myflock.h
+dict_mysql.o: ../../include/mymalloc.h
+dict_mysql.o: ../../include/myrand.h
+dict_mysql.o: ../../include/split_at.h
+dict_mysql.o: ../../include/stringops.h
dict_mysql.o: ../../include/sys_defs.h
+dict_mysql.o: ../../include/vbuf.h
+dict_mysql.o: ../../include/vstream.h
+dict_mysql.o: ../../include/vstring.h
+dict_mysql.o: cfg_parser.h
+dict_mysql.o: db_common.h
dict_mysql.o: dict_mysql.c
+dict_mysql.o: dict_mysql.h
+dict_mysql.o: string_list.h
dict_pgsql.o: ../../include/argv.h
dict_pgsql.o: ../../include/check_arg.h
dict_pgsql.o: ../../include/dict.h
dict_pgsql.o: ../../include/events.h
-dict_pgsql.o: ../../include/find_inet.h
dict_pgsql.o: ../../include/match_list.h
dict_pgsql.o: ../../include/msg.h
dict_pgsql.o: ../../include/myflock.h
@@ -1311,6 +1401,7 @@ haproxy_srvr.o: ../../include/inet_proto.h
haproxy_srvr.o: ../../include/msg.h
haproxy_srvr.o: ../../include/myaddrinfo.h
haproxy_srvr.o: ../../include/mymalloc.h
+haproxy_srvr.o: ../../include/split_at.h
haproxy_srvr.o: ../../include/stringops.h
haproxy_srvr.o: ../../include/sys_defs.h
haproxy_srvr.o: ../../include/valid_hostname.h
@@ -1357,6 +1448,18 @@ header_token.o: ../../include/vstring.h
header_token.o: header_token.c
header_token.o: header_token.h
header_token.o: lex_822.h
+info_log_addr_form.o: ../../include/check_arg.h
+info_log_addr_form.o: ../../include/msg.h
+info_log_addr_form.o: ../../include/name_code.h
+info_log_addr_form.o: ../../include/sys_defs.h
+info_log_addr_form.o: ../../include/vbuf.h
+info_log_addr_form.o: ../../include/vstring.h
+info_log_addr_form.o: info_log_addr_form.c
+info_log_addr_form.o: info_log_addr_form.h
+info_log_addr_form.o: mail_addr_form.h
+info_log_addr_form.o: mail_params.h
+info_log_addr_form.o: quote_822_local.h
+info_log_addr_form.o: quote_flags.h
input_transp.o: ../../include/check_arg.h
input_transp.o: ../../include/msg.h
input_transp.o: ../../include/name_mask.h
@@ -1400,6 +1503,7 @@ log_adhoc.o: ../../include/vbuf.h
log_adhoc.o: ../../include/vstream.h
log_adhoc.o: ../../include/vstring.h
log_adhoc.o: dsn.h
+log_adhoc.o: info_log_addr_form.h
log_adhoc.o: log_adhoc.c
log_adhoc.o: log_adhoc.h
log_adhoc.o: mail_params.h
@@ -1422,6 +1526,9 @@ mail_addr_crunch.o: ../../include/vstring.h
mail_addr_crunch.o: canon_addr.h
mail_addr_crunch.o: mail_addr_crunch.c
mail_addr_crunch.o: mail_addr_crunch.h
+mail_addr_crunch.o: mail_addr_form.h
+mail_addr_crunch.o: quote_822_local.h
+mail_addr_crunch.o: quote_flags.h
mail_addr_crunch.o: resolve_clnt.h
mail_addr_crunch.o: tok822.h
mail_addr_find.o: ../../include/argv.h
@@ -1430,6 +1537,7 @@ mail_addr_find.o: ../../include/dict.h
mail_addr_find.o: ../../include/msg.h
mail_addr_find.o: ../../include/myflock.h
mail_addr_find.o: ../../include/mymalloc.h
+mail_addr_find.o: ../../include/name_mask.h
mail_addr_find.o: ../../include/stringops.h
mail_addr_find.o: ../../include/sys_defs.h
mail_addr_find.o: ../../include/vbuf.h
@@ -1437,10 +1545,17 @@ mail_addr_find.o: ../../include/vstream.h
mail_addr_find.o: ../../include/vstring.h
mail_addr_find.o: mail_addr_find.c
mail_addr_find.o: mail_addr_find.h
+mail_addr_find.o: mail_addr_form.h
mail_addr_find.o: mail_params.h
mail_addr_find.o: maps.h
+mail_addr_find.o: quote_822_local.h
+mail_addr_find.o: quote_flags.h
mail_addr_find.o: resolve_local.h
mail_addr_find.o: strip_addr.h
+mail_addr_form.o: ../../include/name_code.h
+mail_addr_form.o: ../../include/sys_defs.h
+mail_addr_form.o: mail_addr_form.c
+mail_addr_form.o: mail_addr_form.h
mail_addr_map.o: ../../include/argv.h
mail_addr_map.o: ../../include/check_arg.h
mail_addr_map.o: ../../include/dict.h
@@ -1453,9 +1568,12 @@ mail_addr_map.o: ../../include/vstream.h
mail_addr_map.o: ../../include/vstring.h
mail_addr_map.o: mail_addr_crunch.h
mail_addr_map.o: mail_addr_find.h
+mail_addr_map.o: mail_addr_form.h
mail_addr_map.o: mail_addr_map.c
mail_addr_map.o: mail_addr_map.h
mail_addr_map.o: maps.h
+mail_addr_map.o: quote_822_local.h
+mail_addr_map.o: quote_flags.h
mail_command_client.o: ../../include/attr.h
mail_command_client.o: ../../include/check_arg.h
mail_command_client.o: ../../include/htable.h
@@ -1698,6 +1816,7 @@ mail_params.o: ../../include/htable.h
mail_params.o: ../../include/inet_addr_list.h
mail_params.o: ../../include/inet_proto.h
mail_params.o: ../../include/iostuff.h
+mail_params.o: ../../include/midna_domain.h
mail_params.o: ../../include/msg.h
mail_params.o: ../../include/msg_syslog.h
mail_params.o: ../../include/myaddrinfo.h
@@ -1836,6 +1955,38 @@ mail_version.o: ../../include/vbuf.h
mail_version.o: ../../include/vstring.h
mail_version.o: mail_version.c
mail_version.o: mail_version.h
+maillog_client.o: ../../include/argv.h
+maillog_client.o: ../../include/attr.h
+maillog_client.o: ../../include/check_arg.h
+maillog_client.o: ../../include/htable.h
+maillog_client.o: ../../include/iostuff.h
+maillog_client.o: ../../include/logwriter.h
+maillog_client.o: ../../include/msg.h
+maillog_client.o: ../../include/msg_logger.h
+maillog_client.o: ../../include/msg_syslog.h
+maillog_client.o: ../../include/mymalloc.h
+maillog_client.o: ../../include/nvtable.h
+maillog_client.o: ../../include/safe.h
+maillog_client.o: ../../include/stringops.h
+maillog_client.o: ../../include/sys_defs.h
+maillog_client.o: ../../include/vbuf.h
+maillog_client.o: ../../include/vstream.h
+maillog_client.o: ../../include/vstring.h
+maillog_client.o: mail_params.h
+maillog_client.o: mail_proto.h
+maillog_client.o: maillog_client.c
+maillog_client.o: maillog_client.h
+map_search.o: ../../include/check_arg.h
+map_search.o: ../../include/htable.h
+map_search.o: ../../include/msg.h
+map_search.o: ../../include/mymalloc.h
+map_search.o: ../../include/name_code.h
+map_search.o: ../../include/stringops.h
+map_search.o: ../../include/sys_defs.h
+map_search.o: ../../include/vbuf.h
+map_search.o: ../../include/vstring.h
+map_search.o: map_search.c
+map_search.o: map_search.h
maps.o: ../../include/argv.h
maps.o: ../../include/check_arg.h
maps.o: ../../include/dict.h
@@ -2129,6 +2280,19 @@ namadr_list.o: ../../include/vbuf.h
namadr_list.o: ../../include/vstring.h
namadr_list.o: namadr_list.c
namadr_list.o: namadr_list.h
+normalize_mailhost_addr.o: ../../include/check_arg.h
+normalize_mailhost_addr.o: ../../include/inet_proto.h
+normalize_mailhost_addr.o: ../../include/msg.h
+normalize_mailhost_addr.o: ../../include/myaddrinfo.h
+normalize_mailhost_addr.o: ../../include/mymalloc.h
+normalize_mailhost_addr.o: ../../include/stringops.h
+normalize_mailhost_addr.o: ../../include/sys_defs.h
+normalize_mailhost_addr.o: ../../include/valid_hostname.h
+normalize_mailhost_addr.o: ../../include/vbuf.h
+normalize_mailhost_addr.o: ../../include/vstring.h
+normalize_mailhost_addr.o: normalize_mailhost_addr.c
+normalize_mailhost_addr.o: normalize_mailhost_addr.h
+normalize_mailhost_addr.o: valid_mailhost_addr.h
off_cvt.o: ../../include/check_arg.h
off_cvt.o: ../../include/msg.h
off_cvt.o: ../../include/sys_defs.h
@@ -2141,6 +2305,7 @@ opened.o: ../../include/msg.h
opened.o: ../../include/sys_defs.h
opened.o: ../../include/vbuf.h
opened.o: ../../include/vstring.h
+opened.o: info_log_addr_form.h
opened.o: opened.c
opened.o: opened.h
own_inet_addr.o: ../../include/check_arg.h
@@ -2219,6 +2384,13 @@ quote_822_local.o: ../../include/vstring.h
quote_822_local.o: quote_822_local.c
quote_822_local.o: quote_822_local.h
quote_822_local.o: quote_flags.h
+quote_flags.o: ../../include/check_arg.h
+quote_flags.o: ../../include/name_mask.h
+quote_flags.o: ../../include/sys_defs.h
+quote_flags.o: ../../include/vbuf.h
+quote_flags.o: ../../include/vstring.h
+quote_flags.o: quote_flags.c
+quote_flags.o: quote_flags.h
rcpt_buf.o: ../../include/attr.h
rcpt_buf.o: ../../include/check_arg.h
rcpt_buf.o: ../../include/htable.h
@@ -2308,6 +2480,25 @@ record.o: off_cvt.h
record.o: rec_type.h
record.o: record.c
record.o: record.h
+reject_deliver_request.o: ../../include/attr.h
+reject_deliver_request.o: ../../include/check_arg.h
+reject_deliver_request.o: ../../include/htable.h
+reject_deliver_request.o: ../../include/msg.h
+reject_deliver_request.o: ../../include/mymalloc.h
+reject_deliver_request.o: ../../include/nvtable.h
+reject_deliver_request.o: ../../include/sys_defs.h
+reject_deliver_request.o: ../../include/vbuf.h
+reject_deliver_request.o: ../../include/vstream.h
+reject_deliver_request.o: ../../include/vstring.h
+reject_deliver_request.o: bounce.h
+reject_deliver_request.o: defer.h
+reject_deliver_request.o: deliver_completed.h
+reject_deliver_request.o: deliver_request.h
+reject_deliver_request.o: dsn.h
+reject_deliver_request.o: dsn_buf.h
+reject_deliver_request.o: msg_stats.h
+reject_deliver_request.o: recipient_list.h
+reject_deliver_request.o: reject_deliver_request.c
remove.o: ../../include/check_arg.h
remove.o: ../../include/sys_defs.h
remove.o: ../../include/vbuf.h
@@ -2477,6 +2668,7 @@ smtp_reply_footer.o: ../../include/check_arg.h
smtp_reply_footer.o: ../../include/mac_expand.h
smtp_reply_footer.o: ../../include/mac_parse.h
smtp_reply_footer.o: ../../include/msg.h
+smtp_reply_footer.o: ../../include/mymalloc.h
smtp_reply_footer.o: ../../include/sys_defs.h
smtp_reply_footer.o: ../../include/vbuf.h
smtp_reply_footer.o: ../../include/vstring.h
diff --git a/external/ibm-public/postfix/dist/src/global/been_here.h b/external/ibm-public/postfix/dist/src/global/been_here.h
index 302f631aa17..f423e5ca3a6 100644
--- a/external/ibm-public/postfix/dist/src/global/been_here.h
+++ b/external/ibm-public/postfix/dist/src/global/been_here.h
@@ -1,4 +1,4 @@
-/* $NetBSD: been_here.h,v 1.1.1.1 2009/06/23 10:08:45 tron Exp $ */
+/* $NetBSD: been_here.h,v 1.1.1.2 2020/03/18 18:59:33 christos Exp $ */
#ifndef _BEEN_HERE_H_INCLUDED_
#define _BEEN_HERE_H_INCLUDED_
@@ -27,6 +27,7 @@ typedef struct {
struct HTABLE *table;
} BH_TABLE;
+#define BH_BOUND_NONE 0 /* no upper bound */
#define BH_FLAG_NONE 0 /* no special processing */
#define BH_FLAG_FOLD (1<<0) /* fold case */
diff --git a/external/ibm-public/postfix/dist/src/global/haproxy_srvr.c b/external/ibm-public/postfix/dist/src/global/haproxy_srvr.c
index f75435d6ded..96b6099e26b 100644
--- a/external/ibm-public/postfix/dist/src/global/haproxy_srvr.c
+++ b/external/ibm-public/postfix/dist/src/global/haproxy_srvr.c
@@ -1,4 +1,4 @@
-/* $NetBSD: haproxy_srvr.c,v 1.1.1.1 2013/09/25 19:06:30 tron Exp $ */
+/* $NetBSD: haproxy_srvr.c,v 1.1.1.2 2020/03/18 18:59:33 christos Exp $ */
/*++
/* NAME
@@ -8,20 +8,45 @@
/* SYNOPSIS
/* #include <haproxy_srvr.h>
/*
-/* const char *haproxy_srvr_parse(str,
+/* const char *haproxy_srvr_parse(str, str_len, non_proxy,
/* smtp_client_addr, smtp_client_port,
/* smtp_server_addr, smtp_server_port)
/* const char *str;
+/* ssize_t *str_len;
+/* int *non_proxy;
+/* MAI_HOSTADDR_STR *smtp_client_addr,
+/* MAI_SERVPORT_STR *smtp_client_port,
+/* MAI_HOSTADDR_STR *smtp_server_addr,
+/* MAI_SERVPORT_STR *smtp_server_port;
+/*
+/* const char *haproxy_srvr_receive(fd, non_proxy,
+/* smtp_client_addr, smtp_client_port,
+/* smtp_server_addr, smtp_server_port)
+/* int fd;
+/* int *non_proxy;
/* MAI_HOSTADDR_STR *smtp_client_addr,
/* MAI_SERVPORT_STR *smtp_client_port,
/* MAI_HOSTADDR_STR *smtp_server_addr,
/* MAI_SERVPORT_STR *smtp_server_port;
/* DESCRIPTION
-/* haproxy_srvr_parse() parses a haproxy line. The result is
-/* null in case of success, a pointer to text (with the error
-/* type) in case of error. If both IPv6 and IPv4 support are
-/* enabled, IPV4_IN_IPV6 address syntax (::ffff:1.2.3.4) is
-/* converted to IPV4 syntax.
+/* haproxy_srvr_parse() parses a haproxy v1 or v2 protocol
+/* message. The result is null in case of success, a pointer
+/* to text (with the error type) in case of error. If both
+/* IPv6 and IPv4 support are enabled, IPV4_IN_IPV6 address
+/* form (::ffff:1.2.3.4) is converted to IPV4 form. In case
+/* of success, the str_len argument is updated with the number
+/* of bytes parsed, and the non_proxy argument is true or false
+/* if the haproxy message specifies a non-proxied connection.
+/*
+/* haproxy_srvr_receive() receives and parses a haproxy protocol
+/* handshake. This must be called before any I/O is done on
+/* the specified file descriptor. The result is 0 in case of
+/* success, -1 in case of error. All errors are logged.
+/*
+/* The haproxy v2 protocol support is limited to TCP over IPv4,
+/* TCP over IPv6, and non-proxied connections. In the latter
+/* case, the caller is responsible for any local or remote
+/* address/port lookup.
/* LICENSE
/* .ad
/* .fi
@@ -31,6 +56,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -52,6 +82,8 @@
#include <stringops.h>
#include <mymalloc.h>
#include <inet_proto.h>
+#include <split_at.h>
+#include <sock_addr.h>
/* Global library. */
@@ -59,8 +91,86 @@
/* Application-specific. */
+ /*
+ * The haproxy protocol assumes that a haproxy header will normally not
+ * exceed the default IPv4 TCP MSS, i.e. 576-40=536 bytes (the IPv6 default
+ * is larger: 1280-60=1220). With a proxy header that contains IPv6
+ * addresses, that leaves room for 536-52=484 bytes of TLVs. The Postfix
+ * implementation does not support headers with UNIX-domain addresses.
+ */
+#define HAPROXY_HEADER_MAX_LEN 536
+
+ /*
+ * Begin protocol v2 definitions from haproxy/include/types/connection.h.
+ */
+#define PP2_SIGNATURE "\r\n\r\n\0\r\nQUIT\n"
+#define PP2_SIGNATURE_LEN 12
+#define PP2_HEADER_LEN 16
+
+/* ver_cmd byte */
+#define PP2_CMD_LOCAL 0x00
+#define PP2_CMD_PROXY 0x01
+#define PP2_CMD_MASK 0x0F
+
+#define PP2_VERSION 0x20
+#define PP2_VERSION_MASK 0xF0
+
+/* fam byte */
+#define PP2_TRANS_UNSPEC 0x00
+#define PP2_TRANS_STREAM 0x01
+#define PP2_TRANS_DGRAM 0x02
+#define PP2_TRANS_MASK 0x0F
+
+#define PP2_FAM_UNSPEC 0x00
+#define PP2_FAM_INET 0x10
+#define PP2_FAM_INET6 0x20
+#define PP2_FAM_UNIX 0x30
+#define PP2_FAM_MASK 0xF0
+
+/* len field (2 bytes) */
+#define PP2_ADDR_LEN_UNSPEC (0)
+#define PP2_ADDR_LEN_INET (4 + 4 + 2 + 2)
+#define PP2_ADDR_LEN_INET6 (16 + 16 + 2 + 2)
+#define PP2_ADDR_LEN_UNIX (108 + 108)
+
+#define PP2_HDR_LEN_UNSPEC (PP2_HEADER_LEN + PP2_ADDR_LEN_UNSPEC)
+#define PP2_HDR_LEN_INET (PP2_HEADER_LEN + PP2_ADDR_LEN_INET)
+#define PP2_HDR_LEN_INET6 (PP2_HEADER_LEN + PP2_ADDR_LEN_INET6)
+#define PP2_HDR_LEN_UNIX (PP2_HEADER_LEN + PP2_ADDR_LEN_UNIX)
+
+struct proxy_hdr_v2 {
+ uint8_t sig[PP2_SIGNATURE_LEN]; /* PP2_SIGNATURE */
+ uint8_t ver_cmd; /* protocol version | command */
+ uint8_t fam; /* protocol family and transport */
+ uint16_t len; /* length of remainder */
+ union {
+ struct { /* for TCP/UDP over IPv4, len = 12 */
+ uint32_t src_addr;
+ uint32_t dst_addr;
+ uint16_t src_port;
+ uint16_t dst_port;
+ } ip4;
+ struct { /* for TCP/UDP over IPv6, len = 36 */
+ uint8_t src_addr[16];
+ uint8_t dst_addr[16];
+ uint16_t src_port;
+ uint16_t dst_port;
+ } ip6;
+ struct { /* for AF_UNIX sockets, len = 216 */
+ uint8_t src_addr[108];
+ uint8_t dst_addr[108];
+ } unx;
+ } addr;
+};
+
+ /*
+ * End protocol v2 definitions from haproxy/include/types/connection.h.
+ */
+
static INET_PROTO_INFO *proto_info;
+#define STR_OR_NULL(str) ((str) ? (str) : "(null)")
+
/* haproxy_srvr_parse_lit - extract and validate string literal */
static int haproxy_srvr_parse_lit(const char *str,...)
@@ -68,15 +178,19 @@ static int haproxy_srvr_parse_lit(const char *str,...)
va_list ap;
const char *cp;
int result = -1;
+ int count;
if (msg_verbose)
- msg_info("haproxy_srvr_parse: %s", str);
+ msg_info("haproxy_srvr_parse: %s", STR_OR_NULL(str));
if (str != 0) {
va_start(ap, str);
- while (result < 0 && (cp = va_arg(ap, const char *)) != 0)
- if (strcmp(str, cp) == 0)
- result = 0;
+ for (count = 0; (cp = va_arg(ap, const char *)) != 0; count++) {
+ if (strcmp(str, cp) == 0) {
+ result = count;
+ break;
+ }
+ }
va_end(ap);
}
return (result);
@@ -87,7 +201,7 @@ static int haproxy_srvr_parse_lit(const char *str,...)
static int haproxy_srvr_parse_proto(const char *str, int *addr_family)
{
if (msg_verbose)
- msg_info("haproxy_srvr_parse: proto=%s", str);
+ msg_info("haproxy_srvr_parse: proto=%s", STR_OR_NULL(str));
#ifdef AF_INET6
if (strcasecmp(str, "TCP6") == 0) {
@@ -111,8 +225,12 @@ static int haproxy_srvr_parse_proto(const char *str, int *addr_family)
static int haproxy_srvr_parse_addr(const char *str, MAI_HOSTADDR_STR *addr,
int addr_family)
{
+ struct addrinfo *res = 0;
+ int err;
+
if (msg_verbose)
- msg_info("haproxy_srvr_parse: addr=%s proto=%d", str, addr_family);
+ msg_info("haproxy_srvr_parse: addr=%s proto=%d",
+ STR_OR_NULL(str), addr_family);
if (str == 0 || strlen(str) >= sizeof(MAI_HOSTADDR_STR))
return (-1);
@@ -120,26 +238,28 @@ static int haproxy_srvr_parse_addr(const char *str, MAI_HOSTADDR_STR *addr,
switch (addr_family) {
#ifdef AF_INET6
case AF_INET6:
- if (!valid_ipv6_hostaddr(str, DONT_GRIPE))
- return (-1);
- if (strncasecmp("::ffff:", str, 7) == 0
- && strchr((char *) proto_info->sa_family_list, AF_INET) != 0) {
- memcpy(addr->buf, str + 7, strlen(str) + 1 - 7);
- return (0);
- } else {
- memcpy(addr->buf, str, strlen(str) + 1);
- return (0);
- }
+ err = !valid_ipv6_hostaddr(str, DONT_GRIPE);
+ break;
#endif
case AF_INET:
- if (!valid_ipv4_hostaddr(str, DONT_GRIPE))
- return (-1);
- memcpy(addr->buf, str, strlen(str) + 1);
- return (0);
+ err = !valid_ipv4_hostaddr(str, DONT_GRIPE);
+ break;
default:
msg_panic("haproxy_srvr_parse: unexpected address family: %d",
addr_family);
}
+ if (err == 0)
+ err = (hostaddr_to_sockaddr(str, (char *) 0, 0, &res)
+ || sockaddr_to_hostaddr(res->ai_addr, res->ai_addrlen,
+ addr, (MAI_SERVPORT_STR *) 0, 0));
+ if (res)
+ freeaddrinfo(res);
+ if (err)
+ return (-1);
+ if (addr->buf[0] == ':' && strncasecmp("::ffff:", addr->buf, 7) == 0
+ && strchr((char *) proto_info->sa_family_list, AF_INET) != 0)
+ memmove(addr->buf, addr->buf + 7, strlen(addr->buf) + 1 - 7);
+ return (0);
}
/* haproxy_srvr_parse_port - extract and validate TCP port */
@@ -147,7 +267,7 @@ static int haproxy_srvr_parse_addr(const char *str, MAI_HOSTADDR_STR *addr,
static int haproxy_srvr_parse_port(const char *str, MAI_SERVPORT_STR *port)
{
if (msg_verbose)
- msg_info("haproxy_srvr_parse: port=%s", str);
+ msg_info("haproxy_srvr_parse: port=%s", STR_OR_NULL(str));
if (str == 0 || strlen(str) >= sizeof(MAI_SERVPORT_STR)
|| !valid_hostport(str, DONT_GRIPE)) {
return (-1);
@@ -157,18 +277,161 @@ static int haproxy_srvr_parse_port(const char *str, MAI_SERVPORT_STR *port)
}
}
+/* haproxy_srvr_parse_v2_addr_v4 - parse IPv4 info from v2 header */
+
+static int haproxy_srvr_parse_v2_addr_v4(uint32_t sin_addr,
+ unsigned sin_port,
+ MAI_HOSTADDR_STR *addr,
+ MAI_SERVPORT_STR *port)
+{
+ struct sockaddr_in sin;
+
+ memset((void *) &sin, 0, sizeof(sin));
+ sin.sin_family = AF_INET;
+ sin.sin_addr.s_addr = sin_addr;
+ sin.sin_port = sin_port;
+ if (sockaddr_to_hostaddr((struct sockaddr *) &sin, sizeof(sin),
+ addr, port, 0) < 0)
+ return (-1);
+ return (0);
+}
+
+#ifdef AF_INET6
+
+/* haproxy_srvr_parse_v2_addr_v6 - parse IPv6 info from v2 header */
+
+static int haproxy_srvr_parse_v2_addr_v6(uint8_t *sin6_addr,
+ unsigned sin6_port,
+ MAI_HOSTADDR_STR *addr,
+ MAI_SERVPORT_STR *port)
+{
+ struct sockaddr_in6 sin6;
+
+ memset((void *) &sin6, 0, sizeof(sin6));
+ sin6.sin6_family = AF_INET6;
+ memcpy(&sin6.sin6_addr, sin6_addr, 16);
+ sin6.sin6_port = sin6_port;
+ if (sockaddr_to_hostaddr((struct sockaddr *) &sin6,
+ sizeof(sin6), addr, port, 0) < 0)
+ return (-1);
+ if (addr->buf[0] == ':'
+ && strncasecmp("::ffff:", addr->buf, 7) == 0
+ && strchr((char *) proto_info->sa_family_list, AF_INET) != 0)
+ memmove(addr->buf, addr->buf + 7,
+ strlen(addr->buf) + 1 - 7);
+ return (0);
+}
+
+#endif
+
+/* haproxy_srvr_parse_v2_hdr - parse v2 header address info */
+
+static const char *haproxy_srvr_parse_v2_hdr(const char *str, ssize_t *str_len,
+ int *non_proxy,
+ MAI_HOSTADDR_STR *smtp_client_addr,
+ MAI_SERVPORT_STR *smtp_client_port,
+ MAI_HOSTADDR_STR *smtp_server_addr,
+ MAI_SERVPORT_STR *smtp_server_port)
+{
+ const char myname[] = "haproxy_srvr_parse_v2_hdr";
+ struct proxy_hdr_v2 *hdr_v2;
+
+ if (*str_len < PP2_HEADER_LEN)
+ return ("short protocol header");
+ hdr_v2 = (struct proxy_hdr_v2 *) str;
+ if (memcmp(hdr_v2->sig, PP2_SIGNATURE, PP2_SIGNATURE_LEN) != 0)
+ return ("unrecognized protocol header");
+ if ((hdr_v2->ver_cmd & PP2_VERSION_MASK) != PP2_VERSION)
+ return ("unrecognized protocol version");
+ if (*str_len < PP2_HEADER_LEN + ntohs(hdr_v2->len))
+ return ("short version 2 protocol header");
+
+ switch (hdr_v2->ver_cmd & PP2_CMD_MASK) {
+
+ /*
+ * Proxied connection, use the proxy-provided connection info.
+ */
+ case PP2_CMD_PROXY:
+ switch (hdr_v2->fam) {
+ case PP2_FAM_INET | PP2_TRANS_STREAM:{ /* TCP4 */
+ if (strchr((char *) proto_info->sa_family_list, AF_INET) == 0)
+ return ("Postfix IPv4 support is disabled");
+ if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET)
+ return ("short address field");
+ if (haproxy_srvr_parse_v2_addr_v4(hdr_v2->addr.ip4.src_addr,
+ hdr_v2->addr.ip4.src_port,
+ smtp_client_addr, smtp_client_port) < 0)
+ return ("client network address conversion error");
+ if (msg_verbose)
+ msg_info("%s: smtp_client_addr=%s smtp_client_port=%s",
+ myname, smtp_client_addr->buf, smtp_client_port->buf);
+ if (haproxy_srvr_parse_v2_addr_v4(hdr_v2->addr.ip4.dst_addr,
+ hdr_v2->addr.ip4.dst_port,
+ smtp_server_addr, smtp_server_port) < 0)
+ return ("server network address conversion error");
+ if (msg_verbose)
+ msg_info("%s: smtp_server_addr=%s smtp_server_port=%s",
+ myname, smtp_server_addr->buf, smtp_server_port->buf);
+ break;
+ }
+ case PP2_FAM_INET6 | PP2_TRANS_STREAM:{/* TCP6 */
+#ifdef AF_INET6
+ if (strchr((char *) proto_info->sa_family_list, AF_INET6) == 0)
+ return ("Postfix IPv6 support is disabled");
+ if (ntohs(hdr_v2->len) < PP2_ADDR_LEN_INET6)
+ return ("short address field");
+ if (haproxy_srvr_parse_v2_addr_v6(hdr_v2->addr.ip6.src_addr,
+ hdr_v2->addr.ip6.src_port,
+ smtp_client_addr,
+ smtp_client_port) < 0)
+ return ("client network address conversion error");
+ if (msg_verbose)
+ msg_info("%s: smtp_client_addr=%s smtp_client_port=%s",
+ myname, smtp_client_addr->buf, smtp_client_port->buf);
+ if (haproxy_srvr_parse_v2_addr_v6(hdr_v2->addr.ip6.dst_addr,
+ hdr_v2->addr.ip6.dst_port,
+ smtp_server_addr,
+ smtp_server_port) < 0)
+ return ("server network address conversion error");
+ if (msg_verbose)
+ msg_info("%s: smtp_server_addr=%s smtp_server_port=%s",
+ myname, smtp_server_addr->buf, smtp_server_port->buf);
+ break;
+#else
+ return ("Postfix IPv6 support is not compiled in");
+#endif
+ }
+ default:
+ return ("unsupported network protocol");
+ }
+ /* For now, skip and ignore TLVs. */
+ *non_proxy = 0;
+ *str_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
+ return (0);
+
+ /*
+ * Non-proxied connection, use the proxy-to-server connection info.
+ */
+ case PP2_CMD_LOCAL:
+ /* For now, skip and ignore TLVs. */
+ *non_proxy = 1;
+ *str_len = PP2_HEADER_LEN + ntohs(hdr_v2->len);
+ return (0);
+ default:
+ return ("bad command in proxy header");
+ }
+}
+
/* haproxy_srvr_parse - parse haproxy line */
-const char *haproxy_srvr_parse(const char *str,
+const char *haproxy_srvr_parse(const char *str, ssize_t *str_len,
+ int *non_proxy,
MAI_HOSTADDR_STR *smtp_client_addr,
MAI_SERVPORT_STR *smtp_client_port,
MAI_HOSTADDR_STR *smtp_server_addr,
MAI_SERVPORT_STR *smtp_server_port)
{
- char *saved_str = mystrdup(str);
- char *cp = saved_str;
const char *err;
- int addr_family;
if (proto_info == 0)
proto_info = inet_proto_info();
@@ -177,23 +440,449 @@ const char *haproxy_srvr_parse(const char *str,
* XXX We don't accept connections with the "UNKNOWN" protocol type,
* because those would sidestep address-based access control mechanisms.
*/
-#define NEXT_TOKEN mystrtok(&cp, " \r\n")
- if (haproxy_srvr_parse_lit(NEXT_TOKEN, "PROXY", (char *) 0) < 0)
- err = "unexpected protocol header";
- else if (haproxy_srvr_parse_proto(NEXT_TOKEN, &addr_family) < 0)
- err = "unsupported protocol type";
- else if (haproxy_srvr_parse_addr(NEXT_TOKEN, smtp_client_addr,
- addr_family) < 0)
- err = "unexpected client address syntax";
- else if (haproxy_srvr_parse_addr(NEXT_TOKEN, smtp_server_addr,
- addr_family) < 0)
- err = "unexpected server address syntax";
- else if (haproxy_srvr_parse_port(NEXT_TOKEN, smtp_client_port) < 0)
- err = "unexpected client port syntax";
- else if (haproxy_srvr_parse_port(NEXT_TOKEN, smtp_server_port) < 0)
- err = "unexpected server port syntax";
- else
- err = 0;
- myfree(saved_str);
- return (err);
+
+ /*
+ * Try version 1 protocol.
+ */
+ if (strncmp(str, "PROXY ", 6) == 0) {
+ char *saved_str = mystrndup(str, *str_len);
+ char *cp = saved_str;
+ char *beyond_header = split_at(saved_str, '\n');
+ int addr_family;
+
+#define NEXT_TOKEN mystrtok(&cp, " \r")
+ if (beyond_header == 0)
+ err = "missing protocol header terminator";
+ else if (haproxy_srvr_parse_lit(NEXT_TOKEN, "PROXY", (char *) 0) < 0)
+ err = "unexpected protocol header";
+ else if (haproxy_srvr_parse_proto(NEXT_TOKEN, &addr_family) < 0)
+ err = "unsupported protocol type";
+ else if (haproxy_srvr_parse_addr(NEXT_TOKEN, smtp_client_addr,
+ addr_family) < 0)
+ err = "unexpected client address syntax";
+ else if (haproxy_srvr_parse_addr(NEXT_TOKEN, smtp_server_addr,
+ addr_family) < 0)
+ err = "unexpected server address syntax";
+ else if (haproxy_srvr_parse_port(NEXT_TOKEN, smtp_client_port) < 0)
+ err = "unexpected client port syntax";
+ else if (haproxy_srvr_parse_port(NEXT_TOKEN, smtp_server_port) < 0)
+ err = "unexpected server port syntax";
+ else {
+ err = 0;
+ *str_len = beyond_header - saved_str;
+ }
+ myfree(saved_str);
+
+ *non_proxy = 0;
+ return (err);
+ }
+
+ /*
+ * Try version 2 protocol.
+ */
+ else {
+ return (haproxy_srvr_parse_v2_hdr(str, str_len, non_proxy,
+ smtp_client_addr, smtp_client_port,
+ smtp_server_addr, smtp_server_port));
+ }
}
+
+/* haproxy_srvr_receive - receive and parse haproxy protocol handshake */
+
+int haproxy_srvr_receive(int fd, int *non_proxy,
+ MAI_HOSTADDR_STR *smtp_client_addr,
+ MAI_SERVPORT_STR *smtp_client_port,
+ MAI_HOSTADDR_STR *smtp_server_addr,
+ MAI_SERVPORT_STR *smtp_server_port)
+{
+ const char *err;
+ VSTRING *escape_buf;
+ char read_buf[HAPROXY_HEADER_MAX_LEN + 1];
+ ssize_t read_len;
+
+ /*
+ * We must not read(2) past the end of the HaProxy handshake. The v2
+ * protocol assumes that the handshake will never be fragmented,
+ * therefore we peek, parse the entire input, then read(2) only the
+ * number of bytes parsed.
+ */
+ if ((read_len = recv(fd, read_buf, sizeof(read_buf) - 1, MSG_PEEK)) <= 0) {
+ msg_warn("haproxy read: EOF");
+ return (-1);
+ }
+
+ /*
+ * Parse the haproxy handshake, and determine the handshake length.
+ */
+ read_buf[read_len] = 0;
+
+ if ((err = haproxy_srvr_parse(read_buf, &read_len, non_proxy,
+ smtp_client_addr, smtp_client_port,
+ smtp_server_addr, smtp_server_port)) != 0) {
+ escape_buf = vstring_alloc(read_len * 2);
+ escape(escape_buf, read_buf, read_len);
+ msg_warn("haproxy read: %s: %s", err, vstring_str(escape_buf));
+ vstring_free(escape_buf);
+ return (-1);
+ }
+
+ /*
+ * Try to pop the haproxy handshake off the input queue.
+ */
+ if (recv(fd, read_buf, read_len, 0) != read_len) {
+ msg_warn("haproxy read: %m");
+ return (-1);
+ }
+ return (0);
+}
+
+ /*
+ * Test program.
+ */
+#ifdef TEST
+
+ /*
+ * Test cases with inputs and expected outputs. A request may contain
+ * trailing garbage, and it may be too short. A v1 request may also contain
+ * malformed address or port information.
+ */
+typedef struct TEST_CASE {
+ const char *haproxy_request; /* v1 or v2 request including thrash */
+ ssize_t haproxy_req_len; /* request length including thrash */
+ ssize_t exp_req_len; /* parsed request length */
+ int exp_non_proxy; /* request is not proxied */
+ const char *exp_return; /* expected error string */
+ const char *exp_client_addr; /* expected client address string */
+ const char *exp_server_addr; /* expected client port string */
+ const char *exp_client_port; /* expected client address string */
+ const char *exp_server_port; /* expected server port string */
+} TEST_CASE;
+static TEST_CASE v1_test_cases[] = {
+ /* IPv6. */
+ {"PROXY TCP6 fc:00:00:00:1:2:3:4 fc:00:00:00:4:3:2:1 123 321\n", 0, 0, 0, 0, "fc::1:2:3:4", "fc::4:3:2:1", "123", "321"},
+ {"PROXY TCP6 FC:00:00:00:1:2:3:4 FC:00:00:00:4:3:2:1 123 321\n", 0, 0, 0, 0, "fc::1:2:3:4", "fc::4:3:2:1", "123", "321"},
+ {"PROXY TCP6 1.2.3.4 4.3.2.1 123 321\n", 0, 0, 0, "unexpected client address syntax"},
+ {"PROXY TCP6 fc:00:00:00:1:2:3:4 4.3.2.1 123 321\n", 0, 0, 0, "unexpected server address syntax"},
+ /* IPv4 in IPv6. */
+ {"PROXY TCP6 ::ffff:1.2.3.4 ::ffff:4.3.2.1 123 321\n", 0, 0, 0, 0, "1.2.3.4", "4.3.2.1", "123", "321"},
+ {"PROXY TCP6 ::FFFF:1.2.3.4 ::FFFF:4.3.2.1 123 321\n", 0, 0, 0, 0, "1.2.3.4", "4.3.2.1", "123", "321"},
+ {"PROXY TCP4 ::ffff:1.2.3.4 ::ffff:4.3.2.1 123 321\n", 0, 0, 0, "unexpected client address syntax"},
+ {"PROXY TCP4 1.2.3.4 ::ffff:4.3.2.1 123 321\n", 0, 0, 0, "unexpected server address syntax"},
+ /* IPv4. */
+ {"PROXY TCP4 1.2.3.4 4.3.2.1 123 321\n", 0, 0, 0, 0, "1.2.3.4", "4.3.2.1", "123", "321"},
+ {"PROXY TCP4 01.02.03.04 04.03.02.01 123 321\n", 0, 0, 0, 0, "1.2.3.4", "4.3.2.1", "123", "321"},
+ {"PROXY TCP4 1.2.3.4 4.3.2.1 123456 321\n", 0, 0, 0, "unexpected client port syntax"},
+ {"PROXY TCP4 1.2.3.4 4.3.2.1 123 654321\n", 0, 0, 0, "unexpected server port syntax"},
+ {"PROXY TCP4 1.2.3.4 4.3.2.1 0123 321\n", 0, 0, 0, "unexpected client port syntax"},
+ {"PROXY TCP4 1.2.3.4 4.3.2.1 123 0321\n", 0, 0, 0, "unexpected server port syntax"},
+ /* Missing fields. */
+ {"PROXY TCP6 fc:00:00:00:1:2:3:4 fc:00:00:00:4:3:2:1 123\n", 0, 0, 0, "unexpected server port syntax"},
+ {"PROXY TCP6 fc:00:00:00:1:2:3:4 fc:00:00:00:4:3:2:1\n", 0, 0, 0, "unexpected client port syntax"},
+ {"PROXY TCP6 fc:00:00:00:1:2:3:4\n", 0, 0, 0, "unexpected server address syntax"},
+ {"PROXY TCP6\n", 0, 0, 0, "unexpected client address syntax"},
+ {"PROXY TCP4 1.2.3.4 4.3.2.1 123\n", 0, 0, 0, "unexpected server port syntax"},
+ {"PROXY TCP4 1.2.3.4 4.3.2.1\n", 0, 0, 0, "unexpected client port syntax"},
+ {"PROXY TCP4 1.2.3.4\n", 0, 0, 0, "unexpected server address syntax"},
+ {"PROXY TCP4\n", 0, 0, 0, "unexpected client address syntax"},
+ /* Other. */
+ {"PROXY BLAH\n", 0, 0, 0, "unsupported protocol type"},
+ {"BLAH\n", 0, 0, 0, "short protocol header"},
+ 0,
+};
+
+static struct proxy_hdr_v2 v2_local_request = {
+ PP2_SIGNATURE, PP2_VERSION | PP2_CMD_LOCAL,
+};
+static TEST_CASE v2_non_proxy_test = {
+ (char *) &v2_local_request, PP2_HEADER_LEN, PP2_HEADER_LEN, 1,
+};
+
+#define STR(x) vstring_str(x)
+#define LEN(x) VSTRING_LEN(x)
+
+/* evaluate_test_case - evaluate one test case */
+
+static int evaluate_test_case(const char *test_label,
+ const TEST_CASE *test_case)
+{
+ /* Actual results. */
+ const char *act_return;
+ ssize_t act_req_len;
+ int act_non_proxy;
+ MAI_HOSTADDR_STR act_smtp_client_addr;
+ MAI_HOSTADDR_STR act_smtp_server_addr;
+ MAI_SERVPORT_STR act_smtp_client_port;
+ MAI_SERVPORT_STR act_smtp_server_port;
+ int test_failed;
+
+ if (msg_verbose)
+ msg_info("test case=%s exp_client_addr=%s exp_server_addr=%s "
+ "exp_client_port=%s exp_server_port=%s",
+ test_label, STR_OR_NULL(test_case->exp_client_addr),
+ STR_OR_NULL(test_case->exp_server_addr),
+ STR_OR_NULL(test_case->exp_client_port),
+ STR_OR_NULL(test_case->exp_server_port));
+
+ /*
+ * Start the test.
+ */
+ test_failed = 0;
+ act_req_len = test_case->haproxy_req_len;
+ act_return =
+ haproxy_srvr_parse(test_case->haproxy_request, &act_req_len,
+ &act_non_proxy,
+ &act_smtp_client_addr, &act_smtp_client_port,
+ &act_smtp_server_addr, &act_smtp_server_port);
+ if (act_return != test_case->exp_return) {
+ msg_warn("test case %s return expected=%s actual=%s",
+ test_label, STR_OR_NULL(test_case->exp_return),
+ STR_OR_NULL(act_return));
+ test_failed = 1;
+ return (test_failed);
+ }
+ if (act_req_len != test_case->exp_req_len) {
+ msg_warn("test case %s str_len expected=%ld actual=%ld",
+ test_label,
+ (long) test_case->exp_req_len, (long) act_req_len);
+ test_failed = 1;
+ return (test_failed);
+ }
+ if (act_non_proxy != test_case->exp_non_proxy) {
+ msg_warn("test case %s non_proxy expected=%d actual=%d",
+ test_label,
+ test_case->exp_non_proxy, act_non_proxy);
+ test_failed = 1;
+ return (test_failed);
+ }
+ if (test_case->exp_non_proxy || test_case->exp_return != 0)
+ /* No expected address/port results. */
+ return (test_failed);
+
+ /*
+ * Compare address/port results against expected results.
+ */
+ if (strcmp(test_case->exp_client_addr, act_smtp_client_addr.buf)) {
+ msg_warn("test case %s client_addr expected=%s actual=%s",
+ test_label,
+ test_case->exp_client_addr, act_smtp_client_addr.buf);
+ test_failed = 1;
+ }
+ if (strcmp(test_case->exp_server_addr, act_smtp_server_addr.buf)) {
+ msg_warn("test case %s server_addr expected=%s actual=%s",
+ test_label,
+ test_case->exp_server_addr, act_smtp_server_addr.buf);
+ test_failed = 1;
+ }
+ if (strcmp(test_case->exp_client_port, act_smtp_client_port.buf)) {
+ msg_warn("test case %s client_port expected=%s actual=%s",
+ test_label,
+ test_case->exp_client_port, act_smtp_client_port.buf);
+ test_failed = 1;
+ }
+ if (strcmp(test_case->exp_server_port, act_smtp_server_port.buf)) {
+ msg_warn("test case %s server_port expected=%s actual=%s",
+ test_label,
+ test_case->exp_server_port, act_smtp_server_port.buf);
+ test_failed = 1;
+ }
+ return (test_failed);
+}
+
+/* convert_v1_proxy_req_to_v2 - convert well-formed v1 proxy request to v2 */
+
+static void convert_v1_proxy_req_to_v2(VSTRING *buf, const char *req,
+ ssize_t req_len)
+{
+ const char myname[] = "convert_v1_proxy_req_to_v2";
+ const char *err;
+ int non_proxy;
+ MAI_HOSTADDR_STR smtp_client_addr;
+ MAI_SERVPORT_STR smtp_client_port;
+ MAI_HOSTADDR_STR smtp_server_addr;
+ MAI_SERVPORT_STR smtp_server_port;
+ struct proxy_hdr_v2 *hdr_v2;
+ struct addrinfo *src_res;
+ struct addrinfo *dst_res;
+
+ /*
+ * Allocate buffer space for the largest possible protocol header, so we
+ * don't have to worry about hidden realloc() calls.
+ */
+ VSTRING_RESET(buf);
+ VSTRING_SPACE(buf, sizeof(struct proxy_hdr_v2));
+ hdr_v2 = (struct proxy_hdr_v2 *) STR(buf);
+
+ /*
+ * Fill in the header,
+ */
+ memcpy(hdr_v2->sig, PP2_SIGNATURE, PP2_SIGNATURE_LEN);
+ hdr_v2->ver_cmd = PP2_VERSION | PP2_CMD_PROXY;
+ if ((err = haproxy_srvr_parse(req, &req_len, &non_proxy, &smtp_client_addr,
+ &smtp_client_port, &smtp_server_addr,
+ &smtp_server_port)) != 0 || non_proxy)
+ msg_fatal("%s: malformed or non-proxy request: %s",
+ myname, req);
+
+ if (hostaddr_to_sockaddr(smtp_client_addr.buf, smtp_client_port.buf, 0,
+ &src_res) != 0)
+ msg_fatal("%s: unable to convert source address %s port %s",
+ myname, smtp_client_addr.buf, smtp_client_port.buf);
+ if (hostaddr_to_sockaddr(smtp_server_addr.buf, smtp_server_port.buf, 0,
+ &dst_res) != 0)
+ msg_fatal("%s: unable to convert destination address %s port %s",
+ myname, smtp_server_addr.buf, smtp_server_port.buf);
+ if (src_res->ai_family != dst_res->ai_family)
+ msg_fatal("%s: mixed source/destination address families", myname);
+#ifdef AF_INET6
+ if (src_res->ai_family == PF_INET6) {
+ hdr_v2->fam = PP2_FAM_INET6 | PP2_TRANS_STREAM;
+ hdr_v2->len = htons(PP2_ADDR_LEN_INET6);
+ memcpy(hdr_v2->addr.ip6.src_addr,
+ &SOCK_ADDR_IN6_ADDR(src_res->ai_addr),
+ sizeof(hdr_v2->addr.ip6.src_addr));
+ hdr_v2->addr.ip6.src_port = SOCK_ADDR_IN6_PORT(src_res->ai_addr);
+ memcpy(hdr_v2->addr.ip6.dst_addr,
+ &SOCK_ADDR_IN6_ADDR(dst_res->ai_addr),
+ sizeof(hdr_v2->addr.ip6.dst_addr));
+ hdr_v2->addr.ip6.dst_port = SOCK_ADDR_IN6_PORT(dst_res->ai_addr);
+ } else
+#endif
+ if (src_res->ai_family == PF_INET) {
+ hdr_v2->fam = PP2_FAM_INET | PP2_TRANS_STREAM;
+ hdr_v2->len = htons(PP2_ADDR_LEN_INET);
+ hdr_v2->addr.ip4.src_addr = SOCK_ADDR_IN_ADDR(src_res->ai_addr).s_addr;
+ hdr_v2->addr.ip4.src_port = SOCK_ADDR_IN_PORT(src_res->ai_addr);
+ hdr_v2->addr.ip4.dst_addr = SOCK_ADDR_IN_ADDR(dst_res->ai_addr).s_addr;
+ hdr_v2->addr.ip4.dst_port = SOCK_ADDR_IN_PORT(dst_res->ai_addr);
+ } else {
+ msg_panic("unknown address family 0x%x", src_res->ai_family);
+ }
+ vstring_set_payload_size(buf, PP2_SIGNATURE_LEN + ntohs(hdr_v2->len));
+ freeaddrinfo(src_res);
+ freeaddrinfo(dst_res);
+}
+
+int main(int argc, char **argv)
+{
+ VSTRING *test_label;
+ TEST_CASE *v1_test_case;
+ TEST_CASE v2_test_case;
+ TEST_CASE mutated_test_case;
+ VSTRING *v2_request_buf;
+ VSTRING *mutated_request_buf;
+
+ /* Findings. */
+ int tests_failed = 0;
+ int test_failed;
+
+ test_label = vstring_alloc(100);
+ v2_request_buf = vstring_alloc(100);
+ mutated_request_buf = vstring_alloc(100);
+
+ for (tests_failed = 0, v1_test_case = v1_test_cases;
+ v1_test_case->haproxy_request != 0;
+ tests_failed += test_failed, v1_test_case++) {
+
+ /*
+ * Fill in missing string length info in v1 test data.
+ */
+ if (v1_test_case->haproxy_req_len == 0)
+ v1_test_case->haproxy_req_len =
+ strlen(v1_test_case->haproxy_request);
+ if (v1_test_case->exp_req_len == 0)
+ v1_test_case->exp_req_len = v1_test_case->haproxy_req_len;
+
+ /*
+ * Evaluate each v1 test case.
+ */
+ vstring_sprintf(test_label, "%d", (int) (v1_test_case - v1_test_cases));
+ test_failed = evaluate_test_case(STR(test_label), v1_test_case);
+
+ /*
+ * If the v1 test input is malformed, skip the mutation tests.
+ */
+ if (v1_test_case->exp_return != 0)
+ continue;
+
+ /*
+ * Mutation test: a well-formed v1 test case should still pass after
+ * appending a byte, and should return the actual parsed header
+ * length. The test uses the implicit VSTRING null safety byte.
+ */
+ vstring_sprintf(test_label, "%d (one byte appended)",
+ (int) (v1_test_case - v1_test_cases));
+ mutated_test_case = *v1_test_case;
+ mutated_test_case.haproxy_req_len += 1;
+ /* reuse v1_test_case->exp_req_len */
+ test_failed += evaluate_test_case(STR(test_label), &mutated_test_case);
+
+ /*
+ * Mutation test: a well-formed v1 test case should fail after
+ * stripping the terminator.
+ */
+ vstring_sprintf(test_label, "%d (last byte stripped)",
+ (int) (v1_test_case - v1_test_cases));
+ mutated_test_case = *v1_test_case;
+ mutated_test_case.exp_return = "missing protocol header terminator";
+ mutated_test_case.haproxy_req_len -= 1;
+ mutated_test_case.exp_req_len = mutated_test_case.haproxy_req_len;
+ test_failed += evaluate_test_case(STR(test_label), &mutated_test_case);
+
+ /*
+ * A 'well-formed' v1 test case should pass after conversion to v2.
+ */
+ vstring_sprintf(test_label, "%d (converted to v2)",
+ (int) (v1_test_case - v1_test_cases));
+ v2_test_case = *v1_test_case;
+ convert_v1_proxy_req_to_v2(v2_request_buf,
+ v1_test_case->haproxy_request,
+ v1_test_case->haproxy_req_len);
+ v2_test_case.haproxy_request = STR(v2_request_buf);
+ v2_test_case.haproxy_req_len = PP2_HEADER_LEN
+ + ntohs(((struct proxy_hdr_v2 *) STR(v2_request_buf))->len);
+ v2_test_case.exp_req_len = v2_test_case.haproxy_req_len;
+ test_failed += evaluate_test_case(STR(test_label), &v2_test_case);
+
+ /*
+ * Mutation test: a well-formed v2 test case should still pass after
+ * appending a byte, and should return the actual parsed header
+ * length. The test uses the implicit VSTRING null safety byte.
+ */
+ vstring_sprintf(test_label, "%d (converted to v2, one byte appended)",
+ (int) (v1_test_case - v1_test_cases));
+ mutated_test_case = v2_test_case;
+ mutated_test_case.haproxy_req_len += 1;
+ /* reuse v2_test_case->exp_req_len */
+ test_failed += evaluate_test_case(STR(test_label), &mutated_test_case);
+
+ /*
+ * Mutation test: a well-formed v2 test case should fail after
+ * stripping one byte
+ */
+ vstring_sprintf(test_label, "%d (converted to v2, last byte stripped)",
+ (int) (v1_test_case - v1_test_cases));
+ mutated_test_case = v2_test_case;
+ mutated_test_case.haproxy_req_len -= 1;
+ mutated_test_case.exp_req_len = mutated_test_case.haproxy_req_len;
+ mutated_test_case.exp_return = "short version 2 protocol header";
+ test_failed += evaluate_test_case(STR(test_label), &mutated_test_case);
+ }
+
+ /*
+ * Additional V2-only tests.
+ */
+ test_failed +=
+ evaluate_test_case("v2 non-proxy request", &v2_non_proxy_test);
+
+ /*
+ * Clean up.
+ */
+ vstring_free(v2_request_buf);
+ vstring_free(mutated_request_buf);
+ vstring_free(test_label);
+ if (tests_failed)
+ msg_info("tests failed: %d", tests_failed);
+ exit(tests_failed != 0);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/global/haproxy_srvr.h b/external/ibm-public/postfix/dist/src/global/haproxy_srvr.h
index 42eeaefe53e..91cb5a62297 100644
--- a/external/ibm-public/postfix/dist/src/global/haproxy_srvr.h
+++ b/external/ibm-public/postfix/dist/src/global/haproxy_srvr.h
@@ -1,4 +1,4 @@
-/* $NetBSD: haproxy_srvr.h,v 1.1.1.1 2013/09/25 19:06:30 tron Exp $ */
+/* $NetBSD: haproxy_srvr.h,v 1.1.1.2 2020/03/18 18:59:33 christos Exp $ */
#ifndef _HAPROXY_SRVR_H_INCLUDED_
#define _HAPROXY_SRVR_H_INCLUDED_
@@ -21,12 +21,14 @@
/*
* External interface.
*/
-extern const char *haproxy_srvr_parse(const char *,
+extern const char *haproxy_srvr_parse(const char *, ssize_t *, int *,
+ MAI_HOSTADDR_STR *, MAI_SERVPORT_STR *,
+ MAI_HOSTADDR_STR *, MAI_SERVPORT_STR *);
+extern int haproxy_srvr_receive(int, int *,
MAI_HOSTADDR_STR *, MAI_SERVPORT_STR *,
MAI_HOSTADDR_STR *, MAI_SERVPORT_STR *);
#define HAPROXY_PROTO_NAME "haproxy"
-#define HAPROXY_MAX_LEN (256 + 2)
#ifndef DO_GRIPE
#define DO_GRIPE 1
@@ -42,6 +44,11 @@ extern const char *haproxy_srvr_parse(const char *,
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/header_body_checks_strip.ref b/external/ibm-public/postfix/dist/src/global/header_body_checks_strip.ref
new file mode 100644
index 00000000000..1e0207508b2
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/header_body_checks_strip.ref
@@ -0,0 +1,41 @@
+header_body_checks: test-queueID: strip: header subject: primary subject: header line
+header_body_checks: test-queueID: strip: header content-type: multipart/(co\m\)ment)mumble mumble; boundary = "ab\cd ? ef" mumble: mime header line
+HEADER END
+2 BODY N 0 |
+header_body_checks: test-queueID: strip: body abcdef prolog: body line
+4 BODY N 15 |
+header_body_checks: test-queueID: strip: body --abcd ef: body line
+header_body_checks: test-queueID: strip: header content-type: message/rfc822; mumble: mime header line
+7 BODY N 0 |
+header_body_checks: test-queueID: strip: header subject: nested subject: nested header
+header_body_checks: test-queueID: strip: header content-type: multipart/mumble; boundary(comment)="pqrs": mime header line
+header_body_checks: test-queueID: strip: header content-transfer-encoding: base64: mime header line
+header_body_checks: warning: invalid message/* or multipart/* encoding domain: base64
+11 BODY N 0 |
+header_body_checks: test-queueID: strip: body pqrs prolog: body line
+13 BODY N 13 |
+header_body_checks: test-queueID: strip: body --pqrs: body line
+header_body_checks: test-queueID: strip: header header: pqrs part 01: mime header line
+16 BODY N 0 |
+header_body_checks: test-queueID: strip: body body pqrs part 01: body line
+18 BODY N 19 |
+header_body_checks: test-queueID: strip: body --pqrs: body line
+header_body_checks: test-queueID: strip: header header: pqrs part 02: mime header line
+21 BODY N 0 |
+header_body_checks: test-queueID: strip: body body pqrs part 02: body line
+23 BODY N 19 |
+header_body_checks: test-queueID: strip: body --bogus-boundary: body line
+header_body_checks: test-queueID: strip: body header: wietse: body line
+26 BODY N 52 |
+header_body_checks: test-queueID: strip: body body asdasads: body line
+28 BODY N 67 |
+header_body_checks: test-queueID: strip: body --abcd ef: body line
+header_body_checks: test-queueID: strip: header header: abcdef part 02: mime header line
+31 BODY N 0 |
+header_body_checks: test-queueID: strip: body body abcdef part 02: body line
+33 BODY N 21 |
+header_body_checks: test-queueID: strip: body --abcd ef--: body line
+35 BODY N 12 |
+header_body_checks: test-queueID: strip: body epilog: body line
+BODY END
+header_body_checks: warning: improper message/* or multipart/* encoding domain
diff --git a/external/ibm-public/postfix/dist/src/global/info_log_addr_form.c b/external/ibm-public/postfix/dist/src/global/info_log_addr_form.c
new file mode 100644
index 00000000000..f5b405dce58
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/info_log_addr_form.c
@@ -0,0 +1,126 @@
+/* $NetBSD: info_log_addr_form.c,v 1.1.1.1 2020/03/18 18:59:33 christos Exp $ */
+
+/*++
+/* NAME
+/* info_log_addr_form 3
+/* SUMMARY
+/* format internal-form information for info logging
+/* SYNOPSIS
+/* #include <info_log_addr_form.h>
+/*
+/* const char *info_log_addr_form_recipient(
+/* const char *recipient_addr)
+/*
+/* const char *info_log_addr_form_sender_addr(
+/* const char *sender_addr)
+/* DESCRIPTION
+/* info_log_addr_form_recipient() and info_log_addr_form_sender_addr()
+/* format an internal-form recipient or sender email address
+/* for non-debug logging. Each function has its own private
+/* buffer. Each call overwrites the result from a previous call.
+/*
+/* Note: the empty address is passed unchanged; it is not
+/* formatted as "".
+/* .IP recipient_addr
+/* .IP *sender_addr
+/* An internal-form email address.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+
+ /*
+ * Utility library.
+ */
+#include <msg.h>
+#include <name_code.h>
+#include <vstring.h>
+
+ /*
+ * Global library.
+ */
+#include <info_log_addr_form.h>
+#include <mail_addr_form.h>
+#include <mail_params.h>
+#include <quote_822_local.h>
+
+#define INFO_LOG_ADDR_FORM_VAL_NOT_SET 0
+#define INFO_LOG_ADDR_FORM_VAL_INTERNAL 1
+#define INFO_LOG_ADDR_FORM_VAL_EXTERNAL 2
+
+/* Format for info logging. */
+
+int info_log_addr_form_form = INFO_LOG_ADDR_FORM_VAL_NOT_SET;
+
+#define STR(x) vstring_str(x)
+
+/* info_log_addr_form_init - one-time initialization */
+
+static void info_log_addr_form_init(void)
+{
+ static NAME_CODE info_log_addr_form_table[] = {
+ INFO_LOG_ADDR_FORM_NAME_EXTERNAL, INFO_LOG_ADDR_FORM_VAL_EXTERNAL,
+ INFO_LOG_ADDR_FORM_NAME_INTERNAL, INFO_LOG_ADDR_FORM_VAL_INTERNAL,
+ 0, INFO_LOG_ADDR_FORM_VAL_NOT_SET,
+ };
+ info_log_addr_form_form = name_code(info_log_addr_form_table,
+ NAME_CODE_FLAG_NONE,
+ var_info_log_addr_form);
+
+ if (info_log_addr_form_form == INFO_LOG_ADDR_FORM_VAL_NOT_SET)
+ msg_fatal("invalid parameter setting \"%s = %s\"",
+ VAR_INFO_LOG_ADDR_FORM, var_info_log_addr_form);
+}
+
+/* info_log_addr_form - format an email address for info logging */
+
+static VSTRING *info_log_addr_form(VSTRING *buf, const char *addr)
+{
+ const char myname[] = "info_log_addr_form";
+
+ if (buf == 0)
+ buf = vstring_alloc(100);
+ if (info_log_addr_form_form == INFO_LOG_ADDR_FORM_VAL_NOT_SET)
+ info_log_addr_form_init();
+ if (*addr == 0
+ || info_log_addr_form_form == INFO_LOG_ADDR_FORM_VAL_INTERNAL) {
+ vstring_strcpy(buf, addr);
+ } else if (info_log_addr_form_form == INFO_LOG_ADDR_FORM_VAL_EXTERNAL) {
+ quote_822_local(buf, addr);
+ } else {
+ msg_panic("%s: bad format type: %d",
+ myname, info_log_addr_form_form);
+ }
+ return (buf);
+}
+
+/* info_log_addr_form_recipient - format a recipient address for info logging */
+
+const char *info_log_addr_form_recipient(const char *recipient_addr)
+{
+ static VSTRING *recipient_buffer = 0;
+
+ recipient_buffer = info_log_addr_form(recipient_buffer, recipient_addr);
+ return (STR(recipient_buffer));
+}
+
+/* info_log_addr_form_sender - format a sender address for info logging */
+
+const char *info_log_addr_form_sender(const char *sender_addr)
+{
+ static VSTRING *sender_buffer = 0;
+
+ sender_buffer = info_log_addr_form(sender_buffer, sender_addr);
+ return (STR(sender_buffer));
+}
diff --git a/external/ibm-public/postfix/dist/src/global/info_log_addr_form.h b/external/ibm-public/postfix/dist/src/global/info_log_addr_form.h
new file mode 100644
index 00000000000..757d7a36a59
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/info_log_addr_form.h
@@ -0,0 +1,33 @@
+/* $NetBSD: info_log_addr_form.h,v 1.1.1.1 2020/03/18 18:59:33 christos Exp $ */
+
+#ifndef _INFO_LOG_ADDR_FORM_H_INCLUDED_
+#define _INFO_LOG_ADDR_FORM_H_INCLUDED_
+
+/*++
+/* NAME
+/* info_log_addr_form 3h
+/* SUMMARY
+/* format mail address for info logging
+/* SYNOPSIS
+/* #include <info_log_addr_form.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * External interface.
+ */
+extern const char *info_log_addr_form_recipient(const char *);
+extern const char *info_log_addr_form_sender(const char *);
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.h b/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.h
index c9a271213c9..015d321c902 100644
--- a/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.h
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.h
@@ -1,4 +1,4 @@
-/* $NetBSD: mail_addr_crunch.h,v 1.1.1.1 2009/06/23 10:08:46 tron Exp $ */
+/* $NetBSD: mail_addr_crunch.h,v 1.1.1.2 2020/03/18 18:59:33 christos Exp $ */
#ifndef _MAIL_ADDR_CRUNCH_H_INCLUDED_
#define _MAIL_ADDR_CRUNCH_H_INCLUDED_
@@ -19,9 +19,21 @@
#include <argv.h>
/*
+ * Global library.
+ */
+#include <mail_addr_form.h>
+
+ /*
* External interface.
*/
-extern ARGV *mail_addr_crunch(const char *, const char *);
+extern ARGV *mail_addr_crunch_opt(const char *, const char *, int, int);
+
+ /*
+ * The least-overhead form.
+ */
+#define mail_addr_crunch_ext_to_int(string, extension) \
+ mail_addr_crunch_opt((string), (extension), MA_FORM_EXTERNAL, \
+ MA_FORM_INTERNAL)
/* LICENSE
/* .ad
@@ -32,6 +44,11 @@ extern ARGV *mail_addr_crunch(const char *, const char *);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.in b/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.in
new file mode 100644
index 00000000000..bf25737e50f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.in
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+echo ==== external to internal, with extension
+$VALGRIND ./mail_addr_crunch <<'EOF'
+external
+internal
++extension
+foo@example.com, "foo bar"@example.com, foo+ext@example.com
+EOF
+
+echo ==== external to internal, without extension
+$VALGRIND ./mail_addr_crunch <<'EOF'
+external
+internal
+
+foo@example.com, "foo bar"@example.com, foo+ext@example.com
+EOF
+
+echo ==== external to external, with extension
+$VALGRIND ./mail_addr_crunch <<'EOF'
+external
+external
++extension
+foo@example.com, "foo bar"@example.com, foo+ext@example.com
+EOF
+
+echo ==== external to external, without extension
+$VALGRIND ./mail_addr_crunch <<'EOF'
+external
+external
+
+foo@example.com, "foo bar"@example.com, foo+ext@example.com
+EOF
+
+echo ==== internal to internal, with extension
+$VALGRIND ./mail_addr_crunch <<'EOF'
+internal
+internal
++extension
+foo@example.com
+foo+ext@example.com
+EOF
+
+echo ==== internal to internal, without extension
+$VALGRIND ./mail_addr_crunch <<'EOF'
+internal
+internal
+
+foo@example.com
+foo+ext@example.com
+EOF
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.ref b/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.ref
new file mode 100644
index 00000000000..fe5fb2e27a9
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_crunch.ref
@@ -0,0 +1,22 @@
+==== external to internal, with extension
+|foo+extension@example.com|
+|foo bar+extension@example.com|
+|foo+ext+extension@example.com|
+==== external to internal, without extension
+|foo@example.com|
+|foo bar@example.com|
+|foo+ext@example.com|
+==== external to external, with extension
+|foo+extension@example.com|
+|"foo bar+extension"@example.com|
+|foo+ext+extension@example.com|
+==== external to external, without extension
+|foo@example.com|
+|"foo bar"@example.com|
+|foo+ext@example.com|
+==== internal to internal, with extension
+|foo+extension@example.com|
+|foo+ext+extension@example.com|
+==== internal to internal, without extension
+|foo@example.com|
+|foo+ext@example.com|
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_find.h b/external/ibm-public/postfix/dist/src/global/mail_addr_find.h
index f432774d637..8518735fdd2 100644
--- a/external/ibm-public/postfix/dist/src/global/mail_addr_find.h
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_find.h
@@ -1,4 +1,4 @@
-/* $NetBSD: mail_addr_find.h,v 1.1.1.1 2009/06/23 10:08:46 tron Exp $ */
+/* $NetBSD: mail_addr_find.h,v 1.1.1.2 2020/03/18 18:59:33 christos Exp $ */
#ifndef _MAIL_ADDR_FIND_H_INCLUDED_
#define _MAIL_ADDR_FIND_H_INCLUDED_
@@ -16,12 +16,54 @@
/*
* Global library.
*/
+#include <mail_addr_form.h>
#include <maps.h>
/*
* External interface.
*/
-extern const char *mail_addr_find(MAPS *, const char *, char **);
+extern const char *mail_addr_find_opt(MAPS *, const char *, char **,
+ int, int, int, int);
+
+#define MA_FIND_FULL (1<<0) /* localpart+ext@domain */
+#define MA_FIND_NOEXT (1<<1) /* localpart@domain */
+#define MA_FIND_LOCALPART_IF_LOCAL \
+ (1<<2) /* localpart (maybe localpart+ext) */
+#define MA_FIND_LOCALPART_AT_IF_LOCAL \
+ (1<<3) /* ditto, with @ at end */
+#define MA_FIND_AT_DOMAIN (1<<4) /* @domain */
+#define MA_FIND_DOMAIN (1<<5) /* domain */
+#define MA_FIND_PDMS (1<<6) /* parent matches subdomain */
+#define MA_FIND_PDDMDS (1<<7) /* parent matches dot-subdomain */
+#define MA_FIND_LOCALPART_AT \
+ (1<<8) /* localpart@ (maybe localpart+ext@) */
+
+#define MA_FIND_DEFAULT (MA_FIND_FULL | MA_FIND_NOEXT \
+ | MA_FIND_LOCALPART_IF_LOCAL \
+ | MA_FIND_AT_DOMAIN)
+
+ /* The least-overhead form. */
+#define mail_addr_find_int_to_ext(maps, address, extension) \
+ mail_addr_find_opt((maps), (address), (extension), \
+ MA_FORM_INTERNAL, MA_FORM_EXTERNAL, \
+ MA_FORM_EXTERNAL, MA_FIND_DEFAULT)
+
+ /* The legacy forms. */
+#define MA_FIND_FORM_LEGACY \
+ MA_FORM_INTERNAL, MA_FORM_EXTERNAL_FIRST, \
+ MA_FORM_EXTERNAL
+
+#define mail_addr_find_strategy(maps, address, extension, strategy) \
+ mail_addr_find_opt((maps), (address), (extension), \
+ MA_FIND_FORM_LEGACY, (strategy))
+
+#define mail_addr_find(maps, address, extension) \
+ mail_addr_find_strategy((maps), (address), (extension), \
+ MA_FIND_DEFAULT)
+
+#define mail_addr_find_to_internal(maps, address, extension) \
+ mail_addr_find_opt((maps), (address), (extension), \
+ MA_FIND_FORM_LEGACY, MA_FIND_DEFAULT)
/* LICENSE
/* .ad
@@ -32,6 +74,11 @@ extern const char *mail_addr_find(MAPS *, const char *, char **);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_find.in b/external/ibm-public/postfix/dist/src/global/mail_addr_find.in
new file mode 100644
index 00000000000..f4f2fe48f7a
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_find.in
@@ -0,0 +1,77 @@
+#!/bin/sh
+
+# Format: input form:output form:query:expected result:expected extension
+# The last fields are optional.
+
+echo ==== no search string extension
+maps inline:{plain1@1.example=plain2@2.example,{"aa bb"@cc.example="dd ee"@dd.example}}
+test internal:external:external:default:plain1@1.example:plain2@2.example
+test internal:external:external:default:aa bb@cc.example:"dd ee"@dd.example
+test external:external:external:default:"aa bb"@cc.example:"dd ee"@dd.example
+test external:external:internal:default:"aa bb"@cc.example:dd ee@dd.example
+test internal:internal:external:default:plain1@1.example:plain2@2.example
+test internal:internal:external:default:aa bb@cc.example
+test internal:internal:external:default:"aa bb"@cc.example:"dd ee"@dd.example
+
+echo ==== with search string extension
+maps inline:{plain1@1.example=plain2@2.example,{"aa bb"@cc.example="dd ee"@dd.example}}
+test internal:external:external:default:plain1+ext@1.example:plain2@2.example:+ext
+test internal:external:external:default:aa bb+ax bx@cc.example:"dd ee"@dd.example:+ax bx
+test external:external:external:default:"aa bb+ax bx"@cc.example:"dd ee"@dd.example:+ax bx
+test external:external:internal:default:"aa bb+ax bx"@cc.example:dd ee@dd.example:+ax bx
+test internal:internal:external:default:plain1+ext@1.example:plain2@2.example:+ext
+test internal:internal:external:default:"aa bb+ax bx"@cc.example
+test internal:internal:external:default:"aa bb"+ax bx@cc.example:"dd ee"@dd.example:+ax bx
+
+echo ==== at in localpart
+maps inline:{"a@b"=foo@example,"a.b."=bar@example}
+test external:external:external:default:"a@b"@localhost.localdomain:foo@example
+test external:external:external:default:"a@b+ext"@localhost.localdomain:foo@example:+ext
+test external:external:external:default:"a.b."@localhost.localdomain:bar@example
+
+echo ==== legacy support
+maps inline:{"a@b"=extern-1@example,a@b=intern-1@example,a.b.=intern-2@example}
+test internal:external-first:external:default:a@b@localhost.localdomain:extern-1@example
+test internal:external-first:external:default:a.b.@localhost.localdomain:intern-2@example
+
+echo ==== at_domain test
+maps inline:{plain1@1.example=plain2@2.example,@3.example=plain4@4.example,plain5@3.example=plain6@6.example}
+test external:external:external:default:plain1+ext@1.example:plain2@2.example:+ext
+test external:external:external:default:plain2@2.example:
+test external:external:external:default:plain3@3.example:plain4@4.example
+test external:external:external:default:plain5@3.example:plain6@6.example
+
+echo ==== domain test
+maps inline:{plain1@1.example=plain2@2.example,3.example=plain4@4.example,plain5@3.example=plain6@6.example}
+test external:external:external:full|noext|domain:plain1+ext@1.example:plain2@2.example:+ext
+test external:external:external:full|noext|domain:plain2@2.example:
+test external:external:external:full|noext|domain:plain3@3.example:plain4@4.example
+test external:external:external:full|noext|domain:plain5@3.example:plain6@6.example
+
+echo ==== at_domain for local domain
+maps inline:{ab=foo@example,@localhost.localdomain=@bar.example}
+test external:external:external:default:ab@localhost.localdomain:foo@example:
+test external:external:external:default:cd@localhost.localdomain:@bar.example
+
+echo ==== localpart_at_if_local and domain test
+maps inline:{ab@=foo@example,localhost.localdomain=@bar.example}
+test internal:external:external:localpart_at_if_local|domain:ab@localhost.localdomain:foo@example:
+test internal:external:external:localpart_at_if_local|noext|domain:ab+ext@localhost.localdomain:foo@example:+ext
+test internal:external:external:localpart_at_if_local|domain:cd@localhost.localdomain:@bar.example
+
+echo ==== localpart_at has less precedence than domain test
+maps inline:{ab@=foo@example,localhost.localdomain=@bar.example}
+test external:external:external:localpart_at|domain:ab@localhost.localdomain:@bar.example:
+test external:external:external:localpart_at|domain:ab@foo:foo@example
+
+echo ==== domain and subdomain test
+maps inline:{example=example-result,.example=dot-example-result}
+test external:external:external:domain:plain1+ext@1.example
+test external:external:external:domain:foo@sub.example
+test external:external:external:domain:foo@example:example-result
+test external:external:external:domain|pdms:foo@example:example-result
+test external:external:external:domain|pdms:foo@sub.example:example-result
+test external:external:external:domain|pdms:foo@sub.sub.example:example-result
+test external:external:external:domain|pddms:foo@example:example-result
+test external:external:external:domain|pddms:foo@sub.example:dot-example-result
+test external:external:external:domain|pddms:foo@sub.sub.example:dot-example-result
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_find.ref b/external/ibm-public/postfix/dist/src/global/mail_addr_find.ref
new file mode 100644
index 00000000000..6833eecc5d7
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_find.ref
@@ -0,0 +1,63 @@
+==== no search string extension
+inline:{plain1@1.example=plain2@2.example,{"aa bb"@cc.example="dd ee"@dd.example}}
+internal:plain1@1.example -external-> external:plain2@2.example (null extension)
+internal:aa bb@cc.example -external-> external:"dd ee"@dd.example (null extension)
+external:"aa bb"@cc.example -external-> external:"dd ee"@dd.example (null extension)
+external:"aa bb"@cc.example -external-> internal:dd ee@dd.example (null extension)
+internal:plain1@1.example -internal-> external:plain2@2.example (null extension)
+internal:aa bb@cc.example -internal-> external:(not found) (null extension)
+internal:"aa bb"@cc.example -internal-> external:"dd ee"@dd.example (null extension)
+==== with search string extension
+inline:{plain1@1.example=plain2@2.example,{"aa bb"@cc.example="dd ee"@dd.example}}
+internal:plain1+ext@1.example -external-> external:plain2@2.example (+ext)
+internal:aa bb+ax bx@cc.example -external-> external:"dd ee"@dd.example (+ax bx)
+external:"aa bb+ax bx"@cc.example -external-> external:"dd ee"@dd.example (+ax bx)
+external:"aa bb+ax bx"@cc.example -external-> internal:dd ee@dd.example (+ax bx)
+internal:plain1+ext@1.example -internal-> external:plain2@2.example (+ext)
+internal:"aa bb+ax bx"@cc.example -internal-> external:(not found) (null extension)
+internal:"aa bb"+ax bx@cc.example -internal-> external:"dd ee"@dd.example (+ax bx)
+==== at in localpart
+inline:{"a@b"=foo@example,"a.b."=bar@example}
+external:"a@b"@localhost.localdomain -external-> external:foo@example (null extension)
+external:"a@b+ext"@localhost.localdomain -external-> external:foo@example (+ext)
+external:"a.b."@localhost.localdomain -external-> external:bar@example (null extension)
+==== legacy support
+inline:{"a@b"=extern-1@example,a@b=intern-1@example,a.b.=intern-2@example}
+internal:a@b@localhost.localdomain -external-first-> external:extern-1@example (null extension)
+internal:a.b.@localhost.localdomain -external-first-> external:intern-2@example (null extension)
+==== at_domain test
+inline:{plain1@1.example=plain2@2.example,@3.example=plain4@4.example,plain5@3.example=plain6@6.example}
+external:plain1+ext@1.example -external-> external:plain2@2.example (+ext)
+external:plain2@2.example -external-> external:(not found) (null extension)
+external:plain3@3.example -external-> external:plain4@4.example (null extension)
+external:plain5@3.example -external-> external:plain6@6.example (null extension)
+==== domain test
+inline:{plain1@1.example=plain2@2.example,3.example=plain4@4.example,plain5@3.example=plain6@6.example}
+external:plain1+ext@1.example -external-> external:plain2@2.example (+ext)
+external:plain2@2.example -external-> external:(not found) (null extension)
+external:plain3@3.example -external-> external:plain4@4.example (null extension)
+external:plain5@3.example -external-> external:plain6@6.example (null extension)
+==== at_domain for local domain
+inline:{ab=foo@example,@localhost.localdomain=@bar.example}
+external:ab@localhost.localdomain -external-> external:foo@example (null extension)
+external:cd@localhost.localdomain -external-> external:@bar.example (null extension)
+==== localpart_at_if_local and domain test
+inline:{ab@=foo@example,localhost.localdomain=@bar.example}
+internal:ab@localhost.localdomain -external-> external:foo@example (null extension)
+internal:ab+ext@localhost.localdomain -external-> external:foo@example (+ext)
+internal:cd@localhost.localdomain -external-> external:@bar.example (null extension)
+==== localpart_at has less precedence than domain test
+inline:{ab@=foo@example,localhost.localdomain=@bar.example}
+external:ab@localhost.localdomain -external-> external:@bar.example (null extension)
+external:ab@foo -external-> external:foo@example (null extension)
+==== domain and subdomain test
+inline:{example=example-result,.example=dot-example-result}
+external:plain1+ext@1.example -external-> external:(not found) (null extension)
+external:foo@sub.example -external-> external:(not found) (null extension)
+external:foo@example -external-> external:example-result (null extension)
+external:foo@example -external-> external:example-result (null extension)
+external:foo@sub.example -external-> external:example-result (null extension)
+external:foo@sub.sub.example -external-> external:example-result (null extension)
+external:foo@example -external-> external:example-result (null extension)
+external:foo@sub.example -external-> external:dot-example-result (null extension)
+external:foo@sub.sub.example -external-> external:dot-example-result (null extension)
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_form.c b/external/ibm-public/postfix/dist/src/global/mail_addr_form.c
new file mode 100644
index 00000000000..a562684d002
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_form.c
@@ -0,0 +1,67 @@
+/* $NetBSD: mail_addr_form.c,v 1.1.1.1 2020/03/18 18:59:33 christos Exp $ */
+
+/*++
+/* NAME
+/* mail_addr_form 3
+/* SUMMARY
+/* mail address formats
+/* SYNOPSIS
+/* #include <mail_addr_form.h>
+/*
+/* int mail_addr_form_from_string(const char *addr_form_name)
+/*
+/* const char *mail_addr_form_to_string(int addr_form)
+/* DESCRIPTION
+/* mail_addr_form_from_string() converts a symbolic mail address
+/* form name ("internal", "external", "internal-first") into the
+/* corresponding internal code. The result is -1 if an unrecognized
+/* name was specified.
+/*
+/* mail_addr_form_to_string() converts from internal code
+/* to the corresponding symbolic name. The result is null if
+/* an unrecognized code was specified.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+
+ /*
+ * Utility library.
+ */
+#include <name_code.h>
+
+ /*
+ * Global library.
+ */
+#include <mail_addr_form.h>
+
+static const NAME_CODE addr_form_table[] = {
+ "external", MA_FORM_EXTERNAL,
+ "internal", MA_FORM_INTERNAL,
+ "external-first", MA_FORM_EXTERNAL_FIRST,
+ "internal-first", MA_FORM_INTERNAL_FIRST,
+ 0, -1,
+};
+
+/* mail_addr_form_from_string - symbolic mail address to internal form */
+
+int mail_addr_form_from_string(const char *addr_form_name)
+{
+ return (name_code(addr_form_table, NAME_CODE_FLAG_NONE, addr_form_name));
+}
+
+const char *mail_addr_form_to_string(int addr_form)
+{
+ return (str_name_code(addr_form_table, addr_form));
+}
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_form.h b/external/ibm-public/postfix/dist/src/global/mail_addr_form.h
new file mode 100644
index 00000000000..9382656c901
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_form.h
@@ -0,0 +1,38 @@
+/* $NetBSD: mail_addr_form.h,v 1.1.1.1 2020/03/18 18:59:33 christos Exp $ */
+
+#ifndef _MAIL_ADDR_FORM_H_INCLUDED_
+#define _MAIL_ADDR_FORM_H_INCLUDED_
+
+/*++
+/* NAME
+/* mail_addr_form 3h
+/* SUMMARY
+/* mail address formats
+/* SYNOPSIS
+/* #include <mail_addr_form.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * External interface.
+ */
+#define MA_FORM_INTERNAL 1 /* unquoted form */
+#define MA_FORM_EXTERNAL 2 /* quoted form */
+#define MA_FORM_EXTERNAL_FIRST 3 /* quoted form, then unquoted */
+#define MA_FORM_INTERNAL_FIRST 4 /* unquoted form, then quoted */
+
+extern int mail_addr_form_from_string(const char *);
+extern const char *mail_addr_form_to_string(int);
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_map.h b/external/ibm-public/postfix/dist/src/global/mail_addr_map.h
index a2d13fafaf6..8ae955f6728 100644
--- a/external/ibm-public/postfix/dist/src/global/mail_addr_map.h
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_map.h
@@ -1,4 +1,4 @@
-/* $NetBSD: mail_addr_map.h,v 1.1.1.1 2009/06/23 10:08:46 tron Exp $ */
+/* $NetBSD: mail_addr_map.h,v 1.1.1.2 2020/03/18 18:59:33 christos Exp $ */
#ifndef _MAIL_ADDR_MAP_H_INCLUDED_
#define _MAIL_ADDR_MAP_H_INCLUDED_
@@ -21,12 +21,18 @@
/*
* Global library.
*/
+#include <mail_addr_form.h>
#include <maps.h>
/*
* External interface.
*/
-extern ARGV *mail_addr_map(MAPS *, const char *, int);
+extern ARGV *mail_addr_map_opt(MAPS *, const char *, int, int, int, int);
+
+ /* The least-overhead form. */
+#define mail_addr_map_internal(path, address, propagate) \
+ mail_addr_map_opt((path), (address), (propagate), \
+ MA_FORM_INTERNAL, MA_FORM_EXTERNAL, MA_FORM_INTERNAL)
/* LICENSE
/* .ad
@@ -37,6 +43,11 @@ extern ARGV *mail_addr_map(MAPS *, const char *, int);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/mail_addr_map.ref b/external/ibm-public/postfix/dist/src/global/mail_addr_map.ref
new file mode 100644
index 00000000000..28647b136ec
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/mail_addr_map.ref
@@ -0,0 +1,26 @@
+unknown: warning: fail test selftest 1 external -external-> external, no extension, quoted: expect[0]='"bXb"@example.com', result[0]='"b b"@example.com'
+unknown: database = inline:{ {"a a"@example.com="b b"@example.com} }
+unknown: propagate = 1
+unknown: delimiter = '+'
+unknown: in_form = external
+unknown: query_form = external
+unknown: out_form = external
+unknown: address = "a a"@example.com
+unknown: warning: fail test selftest 2 external -external-> external, no extension, quoted: expects 1 results but there were 0
+unknown: no result to match expect[0]='"b b"@example.com'
+unknown: database = inline:{ {"a a"@example.com="b b"@example.com} }
+unknown: propagate = 1
+unknown: delimiter = '+'
+unknown: in_form = external
+unknown: query_form = external
+unknown: out_form = external
+unknown: address = "aXa"@example.com
+unknown: warning: fail test selftest 3 external -external-> external, no extension, quoted: expects 0 results but there were 1
+unknown: no expect to match result[0]='"b b"@example.com'
+unknown: database = inline:{ {"a a"@example.com="b b"@example.com} }
+unknown: propagate = 1
+unknown: delimiter = '+'
+unknown: in_form = external
+unknown: query_form = external
+unknown: out_form = external
+unknown: address = "a a"@example.com
diff --git a/external/ibm-public/postfix/dist/src/global/mail_conf_long.c b/external/ibm-public/postfix/dist/src/global/mail_conf_long.c
index cbbd384dda9..077effda1d4 100644
--- a/external/ibm-public/postfix/dist/src/global/mail_conf_long.c
+++ b/external/ibm-public/postfix/dist/src/global/mail_conf_long.c
@@ -1,4 +1,4 @@
-/* $NetBSD: mail_conf_long.c,v 1.1.1.2 2011/03/02 19:32:15 tron Exp $ */
+/* $NetBSD: mail_conf_long.c,v 1.1.1.3 2020/03/18 18:59:33 christos Exp $ */
/*++
/* NAME
@@ -75,6 +75,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -169,9 +174,21 @@ long get_mail_conf_long_fn(const char *name, stupid_indent_long defval,
void set_mail_conf_long(const char *name, long value)
{
+ const char myname[] = "set_mail_conf_long";
char buf[BUFSIZ]; /* yeah! crappy code! */
+#ifndef NO_SNPRINTF
+ ssize_t ret;
+
+ ret = snprintf(buf, sizeof(buf), "%ld", value);
+ if (ret < 0)
+ msg_panic("%s: output error for %%ld", myname);
+ if (ret >= sizeof(buf))
+ msg_panic("%s: output for %%ld exceeds space %ld",
+ myname, (long) sizeof(buf));
+#else
sprintf(buf, "%ld", value); /* yeah! more crappy code! */
+#endif
mail_conf_update(name, buf);
}
diff --git a/external/ibm-public/postfix/dist/src/global/mail_conf_nint.c b/external/ibm-public/postfix/dist/src/global/mail_conf_nint.c
index 89bf7a9bbe6..1348b5c5a8e 100644
--- a/external/ibm-public/postfix/dist/src/global/mail_conf_nint.c
+++ b/external/ibm-public/postfix/dist/src/global/mail_conf_nint.c
@@ -1,4 +1,4 @@
-/* $NetBSD: mail_conf_nint.c,v 1.1.1.2 2011/03/02 19:32:15 tron Exp $ */
+/* $NetBSD: mail_conf_nint.c,v 1.1.1.3 2020/03/18 18:59:33 christos Exp $ */
/*++
/* NAME
@@ -80,6 +80,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -188,9 +193,21 @@ void set_mail_conf_nint(const char *name, const char *value)
void set_mail_conf_nint_int(const char *name, int value)
{
+ const char myname[] = "set_mail_conf_nint_int";
char buf[BUFSIZ]; /* yeah! crappy code! */
+#ifndef NO_SNPRINTF
+ ssize_t ret;
+
+ ret = snprintf(buf, sizeof(buf), "%d", value);
+ if (ret < 0)
+ msg_panic("%s: output error for %%d", myname);
+ if (ret >= sizeof(buf))
+ msg_panic("%s: output for %%d exceeds space %ld",
+ myname, (long) sizeof(buf));
+#else
sprintf(buf, "%d", value); /* yeah! more crappy code! */
+#endif
mail_conf_update(name, buf);
}
diff --git a/external/ibm-public/postfix/dist/src/global/mail_copy.c b/external/ibm-public/postfix/dist/src/global/mail_copy.c
index 264dd6407b1..bd5ba95d241 100644
--- a/external/ibm-public/postfix/dist/src/global/mail_copy.c
+++ b/external/ibm-public/postfix/dist/src/global/mail_copy.c
@@ -1,4 +1,4 @@
-/* $NetBSD: mail_copy.c,v 1.1.1.3 2013/01/02 18:58:58 tron Exp $ */
+/* $NetBSD: mail_copy.c,v 1.1.1.4 2020/03/18 18:59:33 christos Exp $ */
/*++
/* NAME
@@ -54,7 +54,8 @@
/* The address is quoted according to RFC822 rules.
/* .IP MAIL_COPY_ORIG_RCPT
/* Prepend an X-Original-To: header with the original
-/* envelope recipient address.
+/* envelope recipient address. This is a NOOP with
+/* var_enable_orcpt === 0.
/* .IP MAIL_COPY_RETURN_PATH
/* Prepend a Return-Path: header with the value of the
/* \fIsender\fR attribute.
@@ -89,6 +90,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -199,7 +205,7 @@ int mail_copy(const char *sender,
* An empty original recipient record almost certainly means that
* original recipient processing was disabled.
*/
- if (*orig_rcpt) {
+ if (var_enable_orcpt && *orig_rcpt) {
quote_822_local(buf, orig_rcpt);
vstream_fprintf(dst, "X-Original-To: %s%s", vstring_str(buf), eol);
}
diff --git a/external/ibm-public/postfix/dist/src/global/mail_error.c b/external/ibm-public/postfix/dist/src/global/mail_error.c
index badeb5dbb91..27354f4246e 100644
--- a/external/ibm-public/postfix/dist/src/global/mail_error.c
+++ b/external/ibm-public/postfix/dist/src/global/mail_error.c
@@ -1,4 +1,4 @@
-/* $NetBSD: mail_error.c,v 1.1.1.2 2013/01/02 18:58:58 tron Exp $ */
+/* $NetBSD: mail_error.c,v 1.1.1.3 2020/03/18 18:59:33 christos Exp $ */
/*++
/* NAME
@@ -23,7 +23,7 @@
/* does not exist, and so on.
/* .IP "2bounce (MAIL_ERROR_2BOUNCE)"
/* A bounce message could not be delivered.
-/* .IP "dat (MAIL_ERROR_DATA)"
+/* .IP "data (MAIL_ERROR_DATA)"
/* A message could not be delivered because a critical data
/* file was unavailable.
/* .IP "policy (MAIL_ERROR_POLICY)"
diff --git a/external/ibm-public/postfix/dist/src/global/mail_task.c b/external/ibm-public/postfix/dist/src/global/mail_task.c
index 13e78ad92db..c3e03fc01f4 100644
--- a/external/ibm-public/postfix/dist/src/global/mail_task.c
+++ b/external/ibm-public/postfix/dist/src/global/mail_task.c
@@ -1,4 +1,4 @@
-/* $NetBSD: mail_task.c,v 1.1.1.2 2009/08/31 17:54:01 tron Exp $ */
+/* $NetBSD: mail_task.c,v 1.1.1.3 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -17,8 +17,10 @@
/* are easier to recognize. The mail system name is specified
/* with the "syslog_name" configuration parameter.
/*
-/* The result is volatile. Make a copy of the result if it is
-/* to be used for any appreciable amount of time.
+/* The result is overwritten with each call.
+/*
+/* A null argv0 argument requests that the current
+/* result is returned.
/* LICENSE
/* .ad
/* .fi
@@ -28,6 +30,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -54,15 +61,17 @@ const char *mail_task(const char *argv0)
const char *slash;
const char *tag;
- if (canon_name == 0)
- canon_name = vstring_alloc(10);
- if ((slash = strrchr(argv0, '/')) != 0 && slash[1])
- argv0 = slash + 1;
- /* Setenv()-ed from main.cf, or inherited from master. */
- if ((tag = safe_getenv(CONF_ENV_LOGTAG)) == 0)
- /* Check main.cf settings directly, in case set-gid. */
- tag = var_syslog_name ? var_syslog_name :
- mail_conf_eval(DEF_SYSLOG_NAME);
- vstring_sprintf(canon_name, "%s/%s", tag, argv0);
+ if (argv0) {
+ if (canon_name == 0)
+ canon_name = vstring_alloc(10);
+ if ((slash = strrchr(argv0, '/')) != 0 && slash[1])
+ argv0 = slash + 1;
+ /* Setenv()-ed from main.cf, or inherited from master. */
+ if ((tag = safe_getenv(CONF_ENV_LOGTAG)) == 0)
+ /* Check main.cf settings directly, in case set-gid. */
+ tag = var_syslog_name ? var_syslog_name :
+ mail_conf_eval(DEF_SYSLOG_NAME);
+ vstring_sprintf(canon_name, "%s/%s", tag, argv0);
+ }
return (vstring_str(canon_name));
}
diff --git a/external/ibm-public/postfix/dist/src/global/maillog_client.c b/external/ibm-public/postfix/dist/src/global/maillog_client.c
new file mode 100644
index 00000000000..7418eda4405
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/maillog_client.c
@@ -0,0 +1,300 @@
+/* $NetBSD: maillog_client.c,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+/*++
+/* NAME
+/* maillog_client 3
+/* SUMMARY
+/* choose between syslog client and postlog client
+/* SYNOPSIS
+/* #include <maillog_client.h>
+/*
+/* int maillog_client_init(
+/* const char *progname,
+/* int flags)
+/* DESCRIPTION
+/* maillog_client_init() chooses between logging to the syslog
+/* service or to the internal postlog service.
+/*
+/* maillog_client_init() may be called before configuration
+/* parameters are initialized. During this time, logging is
+/* controlled by the presence or absence of POSTLOG_SERVICE
+/* in the process environment (this is ignored if a program
+/* runs with set-uid or set-gid permissions).
+/*
+/* maillog_client_init() may also be called after configuration
+/* parameters are initialized. During this time, logging is
+/* controlled by the "maillog_file" parameter value.
+/*
+/* Arguments:
+/* .IP progname
+/* The program name that will be prepended to logfile records.
+/* .IP flags
+/* Specify one of the following:
+/* .RS
+/* .IP MAILLOG_CLIENT_FLAG_NONE
+/* No special processing.
+/* .IP MAILLOG_CLIENT_FLAG_LOGWRITER_FALLBACK
+/* Try to fall back to writing the "maillog_file" directly,
+/* if logging to the internal postlog service is enabled, but
+/* the postlog service is unavailable. If the fallback fails,
+/* die with a fatal error.
+/* .RE
+/* ENVIRONMENT
+/* .ad
+/* .fi
+/* When logging to the internal postlog service is enabled,
+/* each process exports the following information, to help
+/* initialize the logging in a child process, before the child
+/* has initialized its configuration parameters.
+/* .IP POSTLOG_SERVICE
+/* The pathname of the public postlog service endpoint, usually
+/* "$queue_directory/public/$postlog_service_name".
+/* .IP POSTLOG_HOSTNAME
+/* The hostname to prepend to information that is sent to the
+/* internal postlog logging service, usually "$myhostname".
+/* CONFIGURATION PARAMETERS
+/* .ad
+/* .fi
+/* .IP "maillog_file (empty)"
+/* The name of an optional logfile. If the value is empty, or
+/* unitialized and the process environment does not specify
+/* POSTLOG_SERVICE, the program will log to the syslog service
+/* instead.
+/* .IP "myhostname (default: see postconf -d output)"
+/* The internet hostname of this mail system.
+/* .IP "postlog_service_name (postlog)"
+/* The name of the internal postlog logging service.
+/* SEE ALSO
+/* msg_syslog(3) syslog client
+/* msg_logger(3) internal logger
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this
+/* software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <stdlib.h>
+#include <string.h>
+
+ /*
+ * Utility library.
+ */
+#include <argv.h>
+#include <logwriter.h>
+#include <msg_logger.h>
+#include <msg_syslog.h>
+#include <safe.h>
+#include <stringops.h>
+
+ /*
+ * Global library.
+ */
+#include <mail_params.h>
+#include <mail_proto.h>
+#include <maillog_client.h>
+#include <msg.h>
+
+ /*
+ * Using logging to debug logging is painful.
+ */
+#define MAILLOG_CLIENT_DEBUG 0
+
+ /*
+ * Application-specific.
+ */
+static int maillog_client_flags;
+
+#define POSTLOG_SERVICE_ENV "POSTLOG_SERVICE"
+#define POSTLOG_HOSTNAME_ENV "POSTLOG_HOSTNAME"
+
+/* maillog_client_logwriter_fallback - fall back to logfile writer or bust */
+
+static void maillog_client_logwriter_fallback(const char *text)
+{
+ static int fallback_guard = 0;
+
+ /*
+ * Guard against recursive calls.
+ *
+ * If an error happened before the maillog_file parameter was initialized,
+ * or if maillog_file logging is disabled, then we cannot fall back to a
+ * logfile. All we can do is to hope that stderr logging will bring out
+ * the bad news.
+ */
+ if (fallback_guard == 0 && var_maillog_file && *var_maillog_file
+ && logwriter_one_shot(var_maillog_file, text, strlen(text)) < 0) {
+ fallback_guard = 1;
+ msg_fatal("logfile '%s' write error: %m", var_maillog_file);
+ }
+}
+
+/* maillog_client_init - set up syslog or internal log client */
+
+void maillog_client_init(const char *progname, int flags)
+{
+ char *import_service_path;
+ char *import_hostname;
+
+ /*
+ * Crucially, only one logger mode can be in effect at any time,
+ * otherwise postlogd(8) may go into a loop.
+ */
+ enum {
+ MAILLOG_CLIENT_MODE_SYSLOG, MAILLOG_CLIENT_MODE_POSTLOG,
+ } logger_mode;
+
+ /*
+ * Security: this code may run before the import_environment setting has
+ * taken effect. It has to guard against privilege escalation attacks on
+ * setgid programs, using malicious environment settings.
+ *
+ * Import the postlog service name and hostname from the environment.
+ *
+ * - These will be used and kept if the process has not yet initialized its
+ * configuration parameters.
+ *
+ * - These will be set or updated if the configuration enables postlog
+ * logging.
+ *
+ * - These will be removed if the configuration does not enable postlog
+ * logging.
+ */
+ if ((import_service_path = safe_getenv(POSTLOG_SERVICE_ENV)) != 0
+ && *import_service_path == 0)
+ import_service_path = 0;
+ if ((import_hostname = safe_getenv(POSTLOG_HOSTNAME_ENV)) != 0
+ && *import_hostname == 0)
+ import_hostname = 0;
+
+#if MAILLOG_CLIENT_DEBUG
+#define STRING_OR_NULL(s) ((s) ? (s) : "(null)")
+ msg_syslog_init(progname, LOG_PID, LOG_FACILITY);
+ msg_info("import_service_path=%s", STRING_OR_NULL(import_service_path));
+ msg_info("import_hostname=%s", STRING_OR_NULL(import_hostname));
+#endif
+
+ /*
+ * Before configuration parameters are initialized, the logging mode is
+ * controlled by the presence or absence of POSTLOG_SERVICE in the
+ * process environment. After configuration parameters are initialized,
+ * the logging mode is controlled by the "maillog_file" parameter value.
+ *
+ * The configured mode may change after a process is started. The
+ * postlogd(8) server will proxy logging to syslogd where needed.
+ */
+ if (var_maillog_file ? *var_maillog_file == 0 : import_service_path == 0) {
+ logger_mode = MAILLOG_CLIENT_MODE_SYSLOG;
+ } else {
+ /* var_maillog_file ? *var_maillog_file : import_service_path != 0 */
+ logger_mode = MAILLOG_CLIENT_MODE_POSTLOG;
+ }
+
+ /*
+ * Postlog logging is enabled. Update the 'progname' as that may have
+ * changed since an earlier call, and update the environment settings if
+ * they differ from configuration settings. This blends two code paths,
+ * one code path where configuration parameters are initialized (the
+ * preferred path), and one code path that uses imports from environment.
+ */
+ if (logger_mode == MAILLOG_CLIENT_MODE_POSTLOG) {
+ char *myhostname;
+ char *service_path;
+
+ if (var_maillog_file && *var_maillog_file) {
+ ARGV *good_prefixes = argv_split(var_maillog_file_pfxs,
+ CHARS_COMMA_SP);
+ char **cpp;
+
+ for (cpp = good_prefixes->argv; /* see below */ ; cpp++) {
+ if (*cpp == 0)
+ msg_fatal("%s value '%s' does not match any prefix in %s",
+ VAR_MAILLOG_FILE, var_maillog_file,
+ VAR_MAILLOG_FILE_PFXS);
+ if (strncmp(var_maillog_file, *cpp, strlen(*cpp)) == 0)
+ break;
+ }
+ argv_free(good_prefixes);
+ }
+ if (var_myhostname && *var_myhostname) {
+ myhostname = var_myhostname;
+ } else if ((myhostname = import_hostname) == 0) {
+ myhostname = "amnesiac";
+ }
+#if MAILLOG_CLIENT_DEBUG
+ msg_info("myhostname=%s", STRING_OR_NULL(myhostname));
+#endif
+ if (var_postlog_service) {
+ service_path = concatenate(var_queue_dir, "/", MAIL_CLASS_PUBLIC,
+ "/", var_postlog_service, (char *) 0);
+ } else {
+ service_path = import_service_path;
+ }
+ maillog_client_flags = flags;
+ msg_logger_init(progname, myhostname, service_path,
+ (flags & MAILLOG_CLIENT_FLAG_LOGWRITER_FALLBACK) ?
+ maillog_client_logwriter_fallback :
+ (MSG_LOGGER_FALLBACK_FN) 0);
+
+ /*
+ * Export or update the exported postlog service pathname and the
+ * hostname, so that a child process can bootstrap postlog logging
+ * before it has processed main.cf and command-line options.
+ */
+ if (import_service_path == 0
+ || strcmp(service_path, import_service_path) != 0) {
+#if MAILLOG_CLIENT_DEBUG
+ msg_info("export %s=%s", POSTLOG_SERVICE_ENV, service_path);
+#endif
+ if (setenv(POSTLOG_SERVICE_ENV, service_path, 1) < 0)
+ msg_fatal("setenv: %m");
+ }
+ if (import_hostname == 0 || strcmp(myhostname, import_hostname) != 0) {
+#if MAILLOG_CLIENT_DEBUG
+ msg_info("export %s=%s", POSTLOG_HOSTNAME_ENV, myhostname);
+#endif
+ if (setenv(POSTLOG_HOSTNAME_ENV, myhostname, 1) < 0)
+ msg_fatal("setenv: %m");
+ }
+ if (service_path != import_service_path)
+ myfree(service_path);
+ msg_logger_control(CA_MSG_LOGGER_CTL_CONNECT_NOW,
+ CA_MSG_LOGGER_CTL_END);
+ }
+
+ /*
+ * Postlog logging is disabled. Silence the msg_logger client, and remove
+ * the environment settings that bootstrap postlog logging in a child
+ * process.
+ */
+ else {
+ msg_logger_control(CA_MSG_LOGGER_CTL_DISABLE, CA_MSG_LOGGER_CTL_END);
+ if ((import_service_path && unsetenv(POSTLOG_SERVICE_ENV))
+ || (import_hostname && unsetenv(POSTLOG_HOSTNAME_ENV)))
+ msg_fatal("unsetenv: %m");
+ }
+
+ /*
+ * Syslog logging is enabled. Update the 'progname' as that may have
+ * changed since an earlier call.
+ */
+ if (logger_mode == MAILLOG_CLIENT_MODE_SYSLOG) {
+ msg_syslog_init(progname, LOG_PID, LOG_FACILITY);
+ }
+
+ /*
+ * Syslog logging is disabled, silence the syslog client.
+ */
+ else {
+ msg_syslog_disable();
+ }
+}
diff --git a/external/ibm-public/postfix/dist/src/global/maillog_client.h b/external/ibm-public/postfix/dist/src/global/maillog_client.h
new file mode 100644
index 00000000000..44921292040
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/maillog_client.h
@@ -0,0 +1,35 @@
+/* $NetBSD: maillog_client.h,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+#ifndef _MAILLOG_CLIENT_H_INCLUDED_
+#define _MAILLOG_CLIENT_H_INCLUDED_
+
+/*++
+/* NAME
+/* maillog_client 3h
+/* SUMMARY
+/* choose between syslog client and postlog client
+/* SYNOPSIS
+/* #include <maillog_client.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * External interface.
+ */
+#define MAILLOG_CLIENT_FLAG_NONE (0)
+#define MAILLOG_CLIENT_FLAG_LOGWRITER_FALLBACK (1<<0)
+
+extern void maillog_client_init(const char *, int);
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/global/map_search.c b/external/ibm-public/postfix/dist/src/global/map_search.c
new file mode 100644
index 00000000000..6d45c1570c2
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/map_search.c
@@ -0,0 +1,398 @@
+/* $NetBSD: map_search.c,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+/*++
+/* NAME
+/* map_search_search 3
+/* SUMMARY
+/* lookup table search list support
+/* SYNOPSIS
+/* #include <map_search_search.h>
+/*
+/* typedef struct {
+/* .in +4
+/* char *map_type_name; /* type:name, owned */
+/* char *search_order; /* null or owned */
+/* .in -4
+/* } MAP_SEARCH;
+/*
+/* void map_search_init(
+/* const NAME_CODE *search_actions)
+/*
+/* const MAP_SEARCH *map_search_create(
+/* const char *map_spec)
+/*
+/* const MAP_SEARCH *map_search_lookup(
+/* const char *map_spec);
+/* DESCRIPTION
+/* This module implements configurable search order support
+/* for Postfix lookup tables.
+/*
+/* map_search_init() must be called once, before other functions
+/* in this module.
+/*
+/* map_search_create() creates a MAP_SEARCH instance for
+/* map_spec, ignoring duplicate requests.
+/*
+/* map_search_lookup() looks up the MAP_SEARCH instance that
+/* was created by map_search_create().
+/*
+/* Arguments:
+/* .IP search_actions
+/* The mapping from search action string form to numeric form.
+/* The numbers must be in the range [1..126] (inclusive). The
+/* value 0 is reserved for the MAP_SEARCH.search_order terminator,
+/* and the value MAP_SEARCH_CODE_UNKNOWN is reserved for the
+/* 'not found' result. The argument is copied (the pointer
+/* value, not the table).
+/* .IP map_spec
+/* lookup table and optional search order: either maptype:mapname,
+/* or { maptype:mapname, { search = name, name }}. The search
+/* attribute is optional. The comma is equivalent to whitespace.
+/* DIAGNOSTICS
+/* map_search_create() returns a null pointer when a map_spec
+/* is a) malformed, b) specifies an unexpected attribute name,
+/* c) the search attribute contains an unknown name. Thus,
+/* map_search_create() will never return a search_order that
+/* contains the value MAP_SEARCH_CODE_UNKNOWN.
+/*
+/* Panic: interface violations. Fatal errors: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <string.h>
+
+#ifdef STRCASECMP_IN_STRINGS_H
+#include <strings.h>
+#endif
+
+ /*
+ * Utility library.
+ */
+#include <htable.h>
+#include <msg.h>
+#include <mymalloc.h>
+#include <name_code.h>
+#include <stringops.h>
+#include <vstring.h>
+
+ /*
+ * Global library.
+ */
+#include <map_search.h>
+
+ /*
+ * Application-specific.
+ */
+static HTABLE *map_search_table;
+static const NAME_CODE *map_search_actions;
+
+#define STR(x) vstring_str(x)
+
+/* map_search_init - one-time initialization */
+
+void map_search_init(const NAME_CODE *search_actions)
+{
+ if (map_search_table != 0 || map_search_actions != 0)
+ msg_panic("map_search_init: multiple calls");
+ map_search_table = htable_create(100);
+ map_search_actions = search_actions;
+}
+
+/* map_search_create - store MAP_SEARCH instance */
+
+const MAP_SEARCH *map_search_create(const char *map_spec)
+{
+ char *copy_of_map_spec = 0;
+ char *bp = 0;
+ const char *const_err;
+ char *heap_err = 0;
+ VSTRING *search_order = 0;
+ const char *map_type_name;
+ char *attr_name_val = 0;
+ char *attr_name = 0;
+ char *attr_value = 0;
+ MAP_SEARCH *map_search;
+ char *atom;
+ int code;
+
+ /*
+ * Sanity check.
+ */
+ if (map_search_table == 0 || map_search_actions == 0)
+ msg_panic("map_search_create: missing initialization");
+
+ /*
+ * Allow exact duplicates. This won't catch duplicates that differ only
+ * in their use of whitespace or comma.
+ */
+ if ((map_search =
+ (MAP_SEARCH *) htable_find(map_search_table, map_spec)) != 0)
+ return (map_search);
+
+ /*
+ * Macro for readability and safety. Let the compiler worry about code
+ * duplication and redundant conditions.
+ */
+#define MAP_SEARCH_CREATE_RETURN(x) do { \
+ if (copy_of_map_spec) myfree(copy_of_map_spec); \
+ if (heap_err) myfree(heap_err); \
+ if (search_order) vstring_free(search_order); \
+ return (x); \
+ } while (0)
+
+ /*
+ * Long form specifies maptype_mapname and optional search attribute.
+ */
+ if (*map_spec == CHARS_BRACE[0]) {
+ bp = copy_of_map_spec = mystrdup(map_spec);
+ if ((heap_err = extpar(&bp, CHARS_BRACE, EXTPAR_FLAG_STRIP)) != 0) {
+ msg_warn("malformed map specification: '%s'", heap_err);
+ MAP_SEARCH_CREATE_RETURN(0);
+ } else if ((map_type_name = mystrtok(&bp, CHARS_COMMA_SP)) == 0) {
+ msg_warn("empty map specification: '%s'", map_spec);
+ MAP_SEARCH_CREATE_RETURN(0);
+ }
+ } else {
+ map_type_name = map_spec;
+ }
+
+ /*
+ * Sanity check the map spec before parsing attributes.
+ */
+ if (strchr(map_type_name, ':') == 0) {
+ msg_warn("malformed map specification: '%s'", map_spec);
+ msg_warn("expected maptype:mapname instead of '%s'", map_type_name);
+ MAP_SEARCH_CREATE_RETURN(0);
+ }
+
+ /*
+ * Parse the attribute list. XXX This does not detect multiple attributes
+ * with the same attribute name.
+ */
+ if (bp != 0) {
+ while ((attr_name_val = mystrtokq(&bp, CHARS_COMMA_SP, CHARS_BRACE)) != 0) {
+ if (*attr_name_val == CHARS_BRACE[0]) {
+ if ((heap_err = extpar(&attr_name_val, CHARS_BRACE,
+ EXTPAR_FLAG_STRIP)) != 0) {
+ msg_warn("malformed map attribute: %s", heap_err);
+ MAP_SEARCH_CREATE_RETURN(0);
+ }
+ }
+ msg_info("split_nameval(\"%s\"", attr_name_val);
+ if ((const_err = split_nameval(attr_name_val, &attr_name,
+ &attr_value)) != 0) {
+ msg_warn("malformed map attribute in '%s': '%s'",
+ map_spec, const_err);
+ MAP_SEARCH_CREATE_RETURN(0);
+ }
+ if (strcasecmp(attr_name, MAP_SEARCH_ATTR_NAME_SEARCH) != 0) {
+ msg_warn("unknown map attribute in '%s': '%s'",
+ map_spec, attr_name);
+ MAP_SEARCH_CREATE_RETURN(0);
+ }
+ }
+ }
+
+ /*
+ * Parse the search list if any.
+ */
+ if (attr_name != 0) {
+ search_order = vstring_alloc(10);
+ while ((atom = mystrtok(&attr_value, CHARS_COMMA_SP)) != 0) {
+ if ((code = name_code(map_search_actions, NAME_CODE_FLAG_NONE,
+ atom)) == MAP_SEARCH_CODE_UNKNOWN) {
+ msg_warn("unknown search type '%s' in '%s'", atom, map_spec);
+ MAP_SEARCH_CREATE_RETURN(0);
+ }
+ VSTRING_ADDCH(search_order, code);
+ }
+ VSTRING_TERMINATE(search_order);
+ }
+
+ /*
+ * Bundle up the result.
+ */
+ map_search = (MAP_SEARCH *) mymalloc(sizeof(*map_search));
+ map_search->map_type_name = mystrdup(map_type_name);
+ if (search_order) {
+ map_search->search_order = vstring_export(search_order);
+ search_order = 0;
+ } else {
+ map_search->search_order = 0;
+ }
+
+ /*
+ * Save the ACL to cache.
+ */
+ (void) htable_enter(map_search_table, map_spec, map_search);
+
+ MAP_SEARCH_CREATE_RETURN(map_search);
+}
+
+/* map_search_lookup - lookup MAP_SEARCH instance */
+
+const MAP_SEARCH *map_search_lookup(const char *map_spec)
+{
+
+ /*
+ * Sanity check.
+ */
+ if (map_search_table == 0 || map_search_actions == 0)
+ msg_panic("map_search_lookup: missing initialization");
+
+ return ((MAP_SEARCH *) htable_find(map_search_table, map_spec));
+}
+
+ /*
+ * Test driver.
+ */
+#ifdef TEST
+#include <stdlib.h>
+
+ /*
+ * Test search actions.
+ */
+#define TEST_NAME_1 "one"
+#define TEST_NAME_2 "two"
+#define TEST_CODE_1 1
+#define TEST_CODE_2 2
+
+#define BAD_NAME "bad"
+
+static const NAME_CODE search_actions[] = {
+ TEST_NAME_1, TEST_CODE_1,
+ TEST_NAME_2, TEST_CODE_2,
+ 0, MAP_SEARCH_CODE_UNKNOWN,
+};
+
+/* Helpers to simplify tests. */
+
+static const char *string_or_null(const char *s)
+{
+ return (s ? s : "(null)");
+}
+
+static char *escape_order(VSTRING *buf, const char *search_order)
+{
+ return (STR(escape(buf, search_order, strlen(search_order))));
+}
+
+int main(int argc, char **argv)
+{
+ /* Test cases with inputs and expected outputs. */
+ typedef struct TEST_CASE {
+ const char *map_spec;
+ int exp_return; /* 0=fail, 1=success */
+ const char *exp_map_type_name; /* 0 or match */
+ const char *exp_search_order; /* 0 or match */
+ } TEST_CASE;
+ static TEST_CASE test_cases[] = {
+ {"type", 0, 0, 0},
+ {"type:name", 1, "type:name", 0},
+ {"{type:name}", 1, "type:name", 0},
+ {"{type:name", 0, 0, 0}, /* } */
+ {"{type}", 0, 0, 0},
+ {"{type:name foo}", 0, 0, 0},
+ {"{type:name foo=bar}", 0, 0, 0},
+ {"{type:name search_order=}", 1, "type:name", ""},
+ {"{type:name search_order=one, two}", 0, 0, 0},
+ {"{type:name {search_order=one, two}}", 1, "type:name", "\01\02"},
+ {"{type:name {search_order=one, two, bad}}", 0, 0, 0},
+ {"{inline:{a=b} {search_order=one, two}}", 1, "inline:{a=b}", "\01\02"},
+ {0},
+ };
+ TEST_CASE *test_case;
+
+ /* Actual results. */
+ const MAP_SEARCH *map_search_from_create;
+ const MAP_SEARCH *map_search_from_create_2nd;
+ const MAP_SEARCH *map_search_from_lookup;
+
+ /* Findings. */
+ int tests_failed = 0;
+ int test_failed;
+
+ /* Scratch */
+ VSTRING *expect_escaped = vstring_alloc(100);
+ VSTRING *actual_escaped = vstring_alloc(100);
+
+ map_search_init(search_actions);
+
+ for (tests_failed = 0, test_case = test_cases; test_case->map_spec;
+ tests_failed += test_failed, test_case++) {
+ test_failed = 0;
+ msg_info("test case %d: '%s'",
+ (int) (test_case - test_cases), test_case->map_spec);
+ map_search_from_create = map_search_create(test_case->map_spec);
+ if (!test_case->exp_return != !map_search_from_create) {
+ if (map_search_from_create)
+ msg_warn("test case %d return expected %s actual {%s, %s}",
+ (int) (test_case - test_cases),
+ test_case->exp_return ? "success" : "fail",
+ map_search_from_create->map_type_name,
+ escape_order(actual_escaped,
+ map_search_from_create->search_order));
+ else
+ msg_warn("test case %d return expected %s actual %s",
+ (int) (test_case - test_cases), "success",
+ map_search_from_create ? "success" : "fail");
+ test_failed = 1;
+ continue;
+ }
+ if (test_case->exp_return == 0)
+ continue;
+ map_search_from_lookup = map_search_lookup(test_case->map_spec);
+ if (map_search_from_create != map_search_from_lookup) {
+ msg_warn("test case %d map_search_lookup expected=%p actual=%p",
+ (int) (test_case - test_cases),
+ map_search_from_create, map_search_from_lookup);
+ test_failed = 1;
+ }
+ map_search_from_create_2nd = map_search_create(test_case->map_spec);
+ if (map_search_from_create != map_search_from_create_2nd) {
+ msg_warn("test case %d repeated map_search_create "
+ "expected=%p actual=%p",
+ (int) (test_case - test_cases),
+ map_search_from_create, map_search_from_create_2nd);
+ test_failed = 1;
+ }
+ if (strcmp(string_or_null(test_case->exp_map_type_name),
+ string_or_null(map_search_from_create->map_type_name))) {
+ msg_warn("test case %d map_type_name expected=%s actual=%s",
+ (int) (test_case - test_cases),
+ string_or_null(test_case->exp_map_type_name),
+ string_or_null(map_search_from_create->map_type_name));
+ test_failed = 1;
+ }
+ if (strcmp(string_or_null(test_case->exp_search_order),
+ string_or_null(map_search_from_create->search_order))) {
+ msg_warn("test case %d search_order expected=%s actual=%s",
+ (int) (test_case - test_cases),
+ escape_order(expect_escaped,
+ string_or_null(test_case->exp_search_order)),
+ escape_order(actual_escaped,
+ string_or_null(map_search_from_create->search_order)));
+ test_failed = 1;
+ }
+ }
+ vstring_free(expect_escaped);
+ vstring_free(actual_escaped);
+
+ if (tests_failed)
+ msg_info("tests failed: %d", tests_failed);
+ exit(tests_failed != 0);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/global/map_search.h b/external/ibm-public/postfix/dist/src/global/map_search.h
new file mode 100644
index 00000000000..7991bcb742c
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/map_search.h
@@ -0,0 +1,73 @@
+/* $NetBSD: map_search.h,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+/*++
+/* NAME
+/* map_search 3h
+/* SUMMARY
+/* lookup table search list support
+/* SYNOPSIS
+/* #include <map_search.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * Utility library.
+ */
+#include <name_code.h>
+
+ /*
+ * External interface.
+ *
+ * The map_search module maintains one lookup table with MAP_SEARCH results,
+ * indexed by the unparsed form of a map specification. The conversion from
+ * unparsed form to MAP_SEARCH result is controlled by a NAME_CODE mapping,
+ * Since one lookup table can support only one mapping per unparsed name,
+ * every MAP_SEARCH result in the lookup table must be built using the same
+ * NAME_CODE table.
+ *
+ * Alternative 1: no lookup table. Allow the user to specify the NAME_CODE
+ * mapping in the map_search_create() request (in addition to the unparsed
+ * form), and let the MAP_SEARCH user store each MAP_SEARCH pointer. But
+ * that would clumsify code that wants to use MAP_SEARCH functionality.
+ *
+ * Alternative 2: one lookup table per NAME_CODE mapping. Change
+ * map_search_init() to return a pointer to {HTABLE *, NAME_CODE *}, and
+ * require that the MAP_SEARCH user pass that pointer to other
+ * map_search_xxx() calls (in addition to the unparsed forms). That would be
+ * about as clumsy as Alternative 1.
+ *
+ * Alternative 3: one lookup table, distinct lookup keys per NAME_CODE table
+ * and map_spec. The caller specifies both the map_spec and the NAME_CODE
+ * mapping when it calls map_seach_create() and map_search_find(). The
+ * implementation securely prepends the name_code argument to the map_spec
+ * argument and uses the result as the table lookup key.
+ *
+ * Alternative 1 is not suitable for the smtpd_mumble_restrictions parser,
+ * which instantiates MAP_SEARCH instances without knowing which specific
+ * access feature is involved. It uses a NAME_CODE mapping that contains the
+ * superset of what all smtpd_mumble_restrictions features need. The
+ * downside is delayed error notification.
+ */
+typedef struct {
+ char *map_type_name; /* "type:name", owned */
+ char *search_order; /* null or owned */
+} MAP_SEARCH;
+
+extern void map_search_init(const NAME_CODE *);
+extern const MAP_SEARCH *map_search_create(const char *);
+extern const MAP_SEARCH *map_search_lookup(const char *);
+
+#define MAP_SEARCH_ATTR_NAME_SEARCH "search_order"
+
+#define MAP_SEARCH_CODE_UNKNOWN 127
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
diff --git a/external/ibm-public/postfix/dist/src/global/map_search.ref b/external/ibm-public/postfix/dist/src/global/map_search.ref
new file mode 100644
index 00000000000..bf8184b3e27
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/map_search.ref
@@ -0,0 +1,29 @@
+unknown: test case 0: 'type'
+unknown: warning: malformed map specification: 'type'
+unknown: warning: expected maptype:mapname instead of 'type'
+unknown: test case 1: 'type:name'
+unknown: test case 2: '{type:name}'
+unknown: test case 3: '{type:name'
+unknown: warning: malformed map specification: 'missing '}' in "{type:name"'
+unknown: test case 4: '{type}'
+unknown: warning: malformed map specification: '{type}'
+unknown: warning: expected maptype:mapname instead of 'type'
+unknown: test case 5: '{type:name foo}'
+unknown: split_nameval("foo"
+unknown: warning: malformed map attribute in '{type:name foo}': 'missing '=' after attribute name'
+unknown: test case 6: '{type:name foo=bar}'
+unknown: split_nameval("foo=bar"
+unknown: warning: unknown map attribute in '{type:name foo=bar}': 'foo'
+unknown: test case 7: '{type:name search_order=}'
+unknown: split_nameval("search_order="
+unknown: test case 8: '{type:name search_order=one, two}'
+unknown: split_nameval("search_order=one"
+unknown: split_nameval("two"
+unknown: warning: malformed map attribute in '{type:name search_order=one, two}': 'missing '=' after attribute name'
+unknown: test case 9: '{type:name {search_order=one, two}}'
+unknown: split_nameval("search_order=one, two"
+unknown: test case 10: '{type:name {search_order=one, two, bad}}'
+unknown: split_nameval("search_order=one, two, bad"
+unknown: warning: unknown search type 'bad' in '{type:name {search_order=one, two, bad}}'
+unknown: test case 11: '{inline:{a=b} {search_order=one, two}}'
+unknown: split_nameval("search_order=one, two"
diff --git a/external/ibm-public/postfix/dist/src/global/maps.h b/external/ibm-public/postfix/dist/src/global/maps.h
index ee581db961a..e53b916f7c1 100644
--- a/external/ibm-public/postfix/dist/src/global/maps.h
+++ b/external/ibm-public/postfix/dist/src/global/maps.h
@@ -1,4 +1,4 @@
-/* $NetBSD: maps.h,v 1.1.1.2 2013/01/02 18:58:59 tron Exp $ */
+/* $NetBSD: maps.h,v 1.1.1.3 2020/03/18 18:59:33 christos Exp $ */
#ifndef _MAPS_H_INCLUDED_
#define _MAPS_H_INCLUDED_
@@ -29,6 +29,7 @@ typedef struct MAPS {
extern MAPS *maps_create(const char *, const char *, int);
extern const char *maps_find(MAPS *, const char *, int);
+extern const char *maps_file_find(MAPS *, const char *, int);
extern MAPS *maps_free(MAPS *);
/* LICENSE
diff --git a/external/ibm-public/postfix/dist/src/global/memcache_proto.c b/external/ibm-public/postfix/dist/src/global/memcache_proto.c
index 5bde1bcbad9..117d1f30061 100644
--- a/external/ibm-public/postfix/dist/src/global/memcache_proto.c
+++ b/external/ibm-public/postfix/dist/src/global/memcache_proto.c
@@ -1,4 +1,4 @@
-/* $NetBSD: memcache_proto.c,v 1.1.1.2 2014/07/06 19:27:51 tron Exp $ */
+/* $NetBSD: memcache_proto.c,v 1.1.1.3 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -41,6 +41,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#include <sys_defs.h>
@@ -145,16 +150,13 @@ int memcache_fread(VSTREAM *stream, VSTRING *buf, ssize_t todo)
/*
* Do the I/O.
*/
- VSTRING_SPACE(buf, todo);
- VSTRING_AT_OFFSET(buf, todo);
- if (vstream_fread(stream, STR(buf), todo) != todo
+ if (vstream_fread_buf(stream, buf, todo) != todo
|| VSTREAM_GETC(stream) != '\r'
|| VSTREAM_GETC(stream) != '\n') {
if (msg_verbose)
msg_info("%s read: error", VSTREAM_PATH(stream));
return (-1);
} else {
- vstring_truncate(buf, todo);
VSTRING_TERMINATE(buf);
if (msg_verbose)
msg_info("%s read: %s", VSTREAM_PATH(stream), STR(buf));
diff --git a/external/ibm-public/postfix/dist/src/global/mkmap_db.c b/external/ibm-public/postfix/dist/src/global/mkmap_db.c
index 7d46da94da3..38cb8a9d206 100644
--- a/external/ibm-public/postfix/dist/src/global/mkmap_db.c
+++ b/external/ibm-public/postfix/dist/src/global/mkmap_db.c
@@ -1,4 +1,4 @@
-/* $NetBSD: mkmap_db.c,v 1.1.1.2 2013/01/02 18:58:59 tron Exp $ */
+/* $NetBSD: mkmap_db.c,v 1.1.1.3 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -115,7 +115,7 @@ static MKMAP *mkmap_db_before_open(const char *path,
* files performance degrades rapidly unless the memory pool is O(file
* size).
*
- * For "btree" files peformance is good with sorted input even for small
+ * For "btree" files performance is good with sorted input even for small
* memory pools, but with random input degrades rapidly unless the memory
* pool is O(file size).
*
diff --git a/external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.c b/external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.c
new file mode 100644
index 00000000000..8d918d6954f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.c
@@ -0,0 +1,261 @@
+/* $NetBSD: normalize_mailhost_addr.c,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+/*++
+/* NAME
+/* normalize_mailhost_addr 3
+/* SUMMARY
+/* normalize mailhost address string representation
+/* SYNOPSIS
+/* #include <normalize_mailhost_addr.h>
+/*
+/* int normalize_mailhost_addr(
+/* const char *string,
+/* char **mailhost_addr,
+/* char **bare_addr,
+/* int *addr_family)
+/* DESCRIPTION
+/* normalize_mailhost_addr() takes the RFC 2821 string
+/* representation of an IPv4 or IPv6 network address, and
+/* normalizes the "IPv6:" prefix and numeric form. An IPv6 or
+/* IPv4 form is rejected if supposed for that protocol is
+/* disabled or non-existent. If both IPv6 and IPv4 support are
+/* enabled, a V4-in-V6 address is replaced with the IPv4 form.
+/*
+/* Arguments:
+/* .IP string
+/* Null-terminated string with the RFC 2821 string representation
+/* of an IPv4 or IPv6 network address.
+/* .IP mailhost_addr
+/* Null pointer, or pointer to null-terminated string with the
+/* normalized RFC 2821 string representation of an IPv4 or
+/* IPv6 network address. Storage must be freed with myfree().
+/* .IP bare_addr
+/* Null pointer, or pointer to null-terminated string with the
+/* numeric address without prefix, such as "IPv6:". Storage
+/* must be freed with myfree().
+/* .IP addr_family
+/* Null pointer, or pointer to integer for storing the address
+/* family.
+/* DIAGNISTICS
+/* normalize_mailhost_addr() returns -1 if the input is malformed,
+/* zero otherwise.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <string.h>
+
+#ifdef STRCASECMP_IN_STRINGS_H
+#include <strings.h>
+#endif
+
+ /*
+ * Utility library.
+ */
+#include <inet_proto.h>
+#include <msg.h>
+#include <myaddrinfo.h>
+#include <mymalloc.h>
+#include <stringops.h>
+
+ /*
+ * Global library.
+ */
+#include <normalize_mailhost_addr.h>
+#include <valid_mailhost_addr.h>
+
+/* normalize_mailhost_addr - parse and normalize mailhost IP address */
+
+int normalize_mailhost_addr(const char *string, char **mailhost_addr,
+ char **bare_addr, int *addr_family)
+{
+ const char myname[] = "normalize_mailhost_addr";
+ INET_PROTO_INFO *proto_info = inet_proto_info();
+ struct addrinfo *res = 0;
+ MAI_HOSTADDR_STR hostaddr;
+ const char *valid_addr; /* IPv6:fc00::1 */
+ const char *normal_addr; /* 192.168.0.1 */
+ int normal_family;
+
+#define UPDATE_BARE_ADDR(s, v) do { \
+ if (s) myfree(s); \
+ (s) = mystrdup(v); \
+ } while(0)
+#define UPDATE_MAILHOST_ADDR(s, prefix, addr) do { \
+ if (s) myfree(s); \
+ (s) = concatenate((prefix), (addr), (char *) 0); \
+ } while (0)
+
+ /*
+ * Parse and normalize the input.
+ */
+ if ((valid_addr = valid_mailhost_addr(string, DONT_GRIPE)) == 0
+ || hostaddr_to_sockaddr(valid_addr, (char *) 0, 0, &res) != 0
+ || sockaddr_to_hostaddr(res->ai_addr, res->ai_addrlen,
+ &hostaddr, (MAI_SERVPORT_STR *) 0, 0) != 0) {
+ normal_addr = 0;
+#ifdef HAS_IPV6
+ } else if (res->ai_family == AF_INET6
+ && strncasecmp("::ffff:", hostaddr.buf, 7) == 0
+ && strchr((char *) proto_info->sa_family_list, AF_INET)) {
+ normal_addr = hostaddr.buf + 7;
+ normal_family = AF_INET;
+#endif
+ } else if (strchr((char *) proto_info->sa_family_list, res->ai_family)) {
+ normal_addr = hostaddr.buf;
+ normal_family = res->ai_family;
+ } else {
+ normal_addr = 0;
+ }
+ if (res)
+ freeaddrinfo(res);
+ if (normal_addr == 0)
+ return (-1);
+
+ /*
+ * Write the applicable outputs.
+ */
+ if (bare_addr) {
+ UPDATE_BARE_ADDR(*bare_addr, normal_addr);
+ if (msg_verbose)
+ msg_info("%s: bare_addr=%s", myname, *bare_addr);
+ }
+ if (mailhost_addr) {
+#ifdef HAS_IPV6
+ if (normal_family == AF_INET6)
+ UPDATE_MAILHOST_ADDR(*mailhost_addr, IPV6_COL, normal_addr);
+ else
+#endif
+ UPDATE_BARE_ADDR(*mailhost_addr, normal_addr);
+ if (msg_verbose)
+ msg_info("%s: mailhost_addr=%s", myname, *mailhost_addr);
+ }
+ if (addr_family) {
+ *addr_family = normal_family;
+ if (msg_verbose)
+ msg_info("%s: addr_family=%s", myname,
+ *addr_family == AF_INET6 ? "AF_INET6"
+ : *addr_family == AF_INET ? "AF_INET"
+ : "unknown");
+ }
+ return (0);
+}
+
+ /*
+ * Test program.
+ */
+#ifdef TEST
+#include <stdlib.h>
+#include <mymalloc.h>
+#include <msg.h>
+
+ /*
+ * Main test program.
+ */
+int main(int argc, char **argv)
+{
+ /* Test cases with inputs and expected outputs. */
+ typedef struct TEST_CASE {
+ const char *inet_protocols;
+ const char *mailhost_addr;
+ int exp_return;
+ const char *exp_mailhost_addr;
+ char *exp_bare_addr;
+ int exp_addr_family;
+ } TEST_CASE;
+ static TEST_CASE test_cases[] = {
+ /* IPv4 in IPv6. */
+ {"ipv4, ipv6", "ipv6:::ffff:1.2.3.4", 0, "1.2.3.4", "1.2.3.4", AF_INET},
+ {"ipv6", "ipv6:::ffff:1.2.3.4", 0, "IPv6:::ffff:1.2.3.4", "::ffff:1.2.3.4", AF_INET6},
+ /* Pass IPv4 or IPV6. */
+ {"ipv4, ipv6", "ipv6:fc00::1", 0, "IPv6:fc00::1", "fc00::1", AF_INET6},
+ {"ipv4, ipv6", "1.2.3.4", 0, "1.2.3.4", "1.2.3.4", AF_INET},
+ /* Normalize IPv4 or IPV6. */
+ {"ipv4, ipv6", "ipv6:fc00::0", 0, "IPv6:fc00::", "fc00::", AF_INET6},
+ {"ipv4, ipv6", "01.02.03.04", 0, "1.2.3.4", "1.2.3.4", AF_INET},
+ /* Suppress specific outputs. */
+ {"ipv4, ipv6", "ipv6:fc00::1", 0, 0, "fc00::1", AF_INET6},
+ {"ipv4, ipv6", "ipv6:fc00::1", 0, "IPv6:fc00::1", 0, AF_INET6},
+ {"ipv4, ipv6", "ipv6:fc00::1", 0, "IPv6:fc00::1", "fc00::1", -1},
+ /* Address type mismatch. */
+ {"ipv4, ipv6", "::ffff:1.2.3.4", -1},
+ {"ipv4", "ipv6:fc00::1", -1},
+ {"ipv6", "1.2.3.4", -1},
+ 0,
+ };
+ TEST_CASE *test_case;
+
+ /* Actual results. */
+ int act_return;
+ char *act_mailhost_addr = mystrdup("initial_mailhost_addr");
+ char *act_bare_addr = mystrdup("initial_bare_addr");
+ int act_addr_family = 0xdeadbeef;
+
+ /* Findings. */
+ int tests_failed = 0;
+ int test_failed;
+
+ for (tests_failed = 0, test_case = test_cases; test_case->inet_protocols;
+ tests_failed += test_failed, test_case++) {
+ test_failed = 0;
+ inet_proto_init(argv[0], test_case->inet_protocols);
+ act_return =
+ normalize_mailhost_addr(test_case->mailhost_addr,
+ test_case->exp_mailhost_addr ?
+ &act_mailhost_addr : (char **) 0,
+ test_case->exp_bare_addr ?
+ &act_bare_addr : (char **) 0,
+ test_case->exp_addr_family >= 0 ?
+ &act_addr_family : (int *) 0);
+ if (act_return != test_case->exp_return) {
+ msg_warn("test case %d return expected=%d actual=%d",
+ (int) (test_case - test_cases),
+ test_case->exp_return, act_return);
+ test_failed = 1;
+ continue;
+ }
+ if (test_case->exp_return != 0)
+ continue;
+ if (test_case->exp_mailhost_addr
+ && strcmp(test_case->exp_mailhost_addr, act_mailhost_addr)) {
+ msg_warn("test case %d mailhost_addr expected=%s actual=%s",
+ (int) (test_case - test_cases),
+ test_case->exp_mailhost_addr, act_mailhost_addr);
+ test_failed = 1;
+ }
+ if (test_case->exp_bare_addr
+ && strcmp(test_case->exp_bare_addr, act_bare_addr)) {
+ msg_warn("test case %d bare_addr expected=%s actual=%s",
+ (int) (test_case - test_cases),
+ test_case->exp_bare_addr, act_bare_addr);
+ test_failed = 1;
+ }
+ if (test_case->exp_addr_family >= 0
+ && test_case->exp_addr_family != act_addr_family) {
+ msg_warn("test case %d addr_family expected=0x%x actual=0x%x",
+ (int) (test_case - test_cases),
+ test_case->exp_addr_family, act_addr_family);
+ test_failed = 1;
+ }
+ }
+ if (act_mailhost_addr)
+ myfree(act_mailhost_addr);
+ if (act_bare_addr)
+ myfree(act_bare_addr);
+ if (tests_failed)
+ msg_info("tests failed: %d", tests_failed);
+ exit(tests_failed != 0);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.h b/external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.h
new file mode 100644
index 00000000000..410770450a4
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.h
@@ -0,0 +1,32 @@
+/* $NetBSD: normalize_mailhost_addr.h,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+#ifndef _NORMALIZE_MAILHOST_ADDR_H_INCLUDED_
+#define _NORMALIZE_MAILHOST_ADDR_H_INCLUDED_
+
+/*++
+/* NAME
+/* normalize_mailhost_addr 3h
+/* SUMMARY
+/* normalize mailhost address string representation
+/* SYNOPSIS
+/* #include <normalize_mailhost_addr.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * External interface.
+ */
+extern int normalize_mailhost_addr(const char *, char **, char **, int *);
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/global/off_cvt.c b/external/ibm-public/postfix/dist/src/global/off_cvt.c
index b47b6569c35..cd8e1b068e8 100644
--- a/external/ibm-public/postfix/dist/src/global/off_cvt.c
+++ b/external/ibm-public/postfix/dist/src/global/off_cvt.c
@@ -1,4 +1,4 @@
-/* $NetBSD: off_cvt.c,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */
+/* $NetBSD: off_cvt.c,v 1.1.1.2 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -40,11 +40,17 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
#include <sys_defs.h>
+#include <sys/types.h>
#include <ctype.h>
/* Utility library. */
@@ -68,29 +74,21 @@ off_t off_cvt_string(const char *str)
{
int ch;
off_t result;
- off_t res2;
- off_t res4;
- off_t res8;
- off_t res10;
+ off_t digit_value;
/*
- * Multiplication by numbers > 2 can overflow without producing a smaller
- * result mod 2^N (where N is the number of bits in the result type).
- * (Victor Duchovni, Morgan Stanley).
+ * Detect overflow before it happens. Code that attempts to detect
+ * overflow after-the-fact makes assumptions about undefined behavior.
+ * Compilers may invalidate such assumptions.
*/
for (result = 0; (ch = *(unsigned char *) str) != 0; str++) {
if (!ISDIGIT(ch))
return (-1);
- if ((res2 = result + result) < result)
- return (-1);
- if ((res4 = res2 + res2) < res2)
- return (-1);
- if ((res8 = res4 + res4) < res4)
- return (-1);
- if ((res10 = res8 + res2) < res8)
- return (-1);
- if ((result = res10 + ch - '0') < res10)
+ digit_value = ch - '0';
+ if (result > OFF_T_MAX / 10
+ || (result *= 10) > OFF_T_MAX - digit_value)
return (-1);
+ result += digit_value;
}
return (result);
}
@@ -146,6 +144,8 @@ int main(int unused_argc, char **unused_argv)
off_t offset;
while (vstring_fgets_nonl(buf, VSTREAM_IN)) {
+ if (STR(buf)[0] == '#' || STR(buf)[0] == 0)
+ continue;
if ((offset = off_cvt_string(STR(buf))) < 0) {
msg_warn("bad input %s", STR(buf));
} else {
diff --git a/external/ibm-public/postfix/dist/src/global/off_cvt.in b/external/ibm-public/postfix/dist/src/global/off_cvt.in
new file mode 100644
index 00000000000..15133e950e3
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/off_cvt.in
@@ -0,0 +1,9 @@
+# Assume 64-bit off_t (assuming 1- or 2-complement).
+# Maximum.
+9223372036854775807
+# Overflow.
+9223372036854775808
+92233720368547758070
+# off_cvt() does not accept leading signs.
++1
+-1
diff --git a/external/ibm-public/postfix/dist/src/global/off_cvt.ref b/external/ibm-public/postfix/dist/src/global/off_cvt.ref
new file mode 100644
index 00000000000..561152878ee
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/off_cvt.ref
@@ -0,0 +1,5 @@
+9223372036854775807
+unknown: warning: bad input 9223372036854775808
+unknown: warning: bad input 92233720368547758070
+unknown: warning: bad input +1
+unknown: warning: bad input -1
diff --git a/external/ibm-public/postfix/dist/src/global/opened.c b/external/ibm-public/postfix/dist/src/global/opened.c
index 6481c6c57a1..4cd5f2626f3 100644
--- a/external/ibm-public/postfix/dist/src/global/opened.c
+++ b/external/ibm-public/postfix/dist/src/global/opened.c
@@ -1,4 +1,4 @@
-/* $NetBSD: opened.c,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */
+/* $NetBSD: opened.c,v 1.1.1.2 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -44,6 +44,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -59,7 +64,8 @@
/* Global library. */
-#include "opened.h"
+#include <opened.h>
+#include <info_log_addr_form.h>
/* opened - log that a message was opened */
@@ -84,7 +90,7 @@ void vopened(const char *queue_id, const char *sender, long size, int nrcpt,
vstring_vsprintf(text, fmt, ap);
msg_info("%s: from=<%s>, size=%ld, nrcpt=%d%s%s%s",
- queue_id, sender, size, nrcpt,
+ queue_id, info_log_addr_form_sender(sender), size, nrcpt,
*TEXT ? " (" : "", TEXT, *TEXT ? ")" : "");
vstring_free(text);
}
diff --git a/external/ibm-public/postfix/dist/src/global/quote_822_local.c b/external/ibm-public/postfix/dist/src/global/quote_822_local.c
index 5c3b8cd522d..dd0c3b07e67 100644
--- a/external/ibm-public/postfix/dist/src/global/quote_822_local.c
+++ b/external/ibm-public/postfix/dist/src/global/quote_822_local.c
@@ -1,4 +1,4 @@
-/* $NetBSD: quote_822_local.c,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */
+/* $NetBSD: quote_822_local.c,v 1.1.1.2 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -45,6 +45,8 @@
/* In violation with RFCs, treat `@' as an ordinary character.
/* .IP QUOTE_FLAG_APPEND
/* Append to the result buffer, instead of overwriting it.
+/* .IP QUOTE_FLAG_BARE_LOCALPART
+/* The input is a localpart without @domain part.
/* .RE
/* STANDARDS
/* RFC 822 (ARPA Internet Text Messages)
@@ -59,6 +61,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -162,7 +169,8 @@ VSTRING *quote_822_local_flags(VSTRING *dst, const char *mbox, int flags)
start = colon + 1;
else
start = mbox;
- if ((end = strrchr(start, '@')) == 0)
+ if ((flags & QUOTE_FLAG_BARE_LOCALPART) != 0
+ || (end = strrchr(start, '@')) == 0)
end = start + strlen(start);
if ((flags & QUOTE_FLAG_APPEND) == 0)
VSTRING_RESET(dst);
@@ -180,10 +188,13 @@ VSTRING *quote_822_local_flags(VSTRING *dst, const char *mbox, int flags)
VSTRING *unquote_822_local(VSTRING *dst, const char *mbox)
{
const char *start; /* first byte of localpart */
- const char *end; /* first byte after localpart */
const char *colon;
const char *cp;
+ int in_quote = 0;
+ const char *bare_at_src;
+ int bare_at_dst_pos = -1;
+ /* Don't unquote a routing prefix. Is this still possible? */
if (mbox[0] == '@' && (colon = strchr(mbox, ':')) != 0) {
start = colon + 1;
vstring_strncpy(dst, mbox, start - mbox);
@@ -191,21 +202,28 @@ VSTRING *unquote_822_local(VSTRING *dst, const char *mbox)
start = mbox;
VSTRING_RESET(dst);
}
- if ((end = strrchr(start, '@')) == 0)
- end = start + strlen(start);
- for (cp = start; cp < end; cp++) {
- if (*cp == '"')
+ /* Locate the last unquoted '@'. */
+ for (cp = start; *cp; cp++) {
+ if (*cp == '"') {
+ in_quote = !in_quote;
continue;
- if (*cp == '\\') {
+ } else if (*cp == '@') {
+ if (!in_quote) {
+ bare_at_dst_pos = VSTRING_LEN(dst);
+ bare_at_src = cp;
+ }
+ } else if (*cp == '\\') {
if (cp[1] == 0)
continue;
cp++;
}
VSTRING_ADDCH(dst, *cp);
}
- if (*end)
- vstring_strcat(dst, end);
- else
+ /* Don't unquote text after the last unquoted '@'. */
+ if (bare_at_dst_pos >= 0) {
+ vstring_truncate(dst, bare_at_dst_pos);
+ vstring_strcat(dst, bare_at_src);
+ } else
VSTRING_TERMINATE(dst);
return (dst);
}
@@ -216,27 +234,57 @@ VSTRING *unquote_822_local(VSTRING *dst, const char *mbox)
* Proof-of-concept test program. Read an unquoted address from stdin, and
* show the quoted and unquoted results.
*/
+#include <ctype.h>
+#include <string.h>
+
+#include <msg.h>
+#include <name_mask.h>
+#include <stringops.h>
#include <vstream.h>
#include <vstring_vstream.h>
#define STR vstring_str
-int main(int unused_argc, char **unused_argv)
+int main(int unused_argc, char **argv)
{
- VSTRING *raw = vstring_alloc(100);
- VSTRING *quoted = vstring_alloc(100);
- VSTRING *unquoted = vstring_alloc(100);
-
- while (vstring_fgets_nonl(raw, VSTREAM_IN)) {
- quote_822_local(quoted, STR(raw));
- vstream_printf("quoted: %s\n", STR(quoted));
- unquote_822_local(unquoted, STR(quoted));
- vstream_printf("unquoted: %s\n", STR(unquoted));
- vstream_fflush(VSTREAM_OUT);
+ VSTRING *in = vstring_alloc(100);
+ VSTRING *out = vstring_alloc(100);
+ char *cmd;
+ char *bp;
+ int flags;
+
+ while (vstring_fgets_nonl(in, VSTREAM_IN)) {
+ bp = STR(in);
+ if ((cmd = mystrtok(&bp, CHARS_SPACE)) != 0) {
+ while (ISSPACE(*bp))
+ bp++;
+ if (*bp == 0) {
+ msg_warn("missing argument");
+ } else if (strcmp(cmd, "quote") == 0) {
+ quote_822_local(out, bp);
+ vstream_printf("'%s' quoted '%s'\n", bp, STR(out));
+ } else if (strcmp(cmd, "quote_with_flags") == 0) {
+ if ((cmd = mystrtok(&bp, CHARS_SPACE)) == 0) {
+ msg_warn("missing flags");
+ continue;
+ }
+ while (ISSPACE(*bp))
+ bp++;
+ flags = quote_flags_from_string(cmd);
+ quote_822_local_flags(out, bp, flags);
+ vstream_printf("'%s' quoted flags=%s '%s'\n",
+ bp, quote_flags_to_string((VSTRING *) 0, flags), STR(out));
+ } else if (strcmp(cmd, "unquote") == 0) {
+ unquote_822_local(out, bp);
+ vstream_printf("'%s' unquoted '%s'\n", bp, STR(out));
+ } else {
+ msg_warn("unknown command: %s", cmd);
+ }
+ vstream_fflush(VSTREAM_OUT);
+ }
}
- vstring_free(unquoted);
- vstring_free(quoted);
- vstring_free(raw);
+ vstring_free(in);
+ vstring_free(out);
return (0);
}
diff --git a/external/ibm-public/postfix/dist/src/global/quote_822_local.h b/external/ibm-public/postfix/dist/src/global/quote_822_local.h
index 4c529e8b62c..8f0a16ad5f8 100644
--- a/external/ibm-public/postfix/dist/src/global/quote_822_local.h
+++ b/external/ibm-public/postfix/dist/src/global/quote_822_local.h
@@ -1,4 +1,4 @@
-/* $NetBSD: quote_822_local.h,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */
+/* $NetBSD: quote_822_local.h,v 1.1.1.2 2020/03/18 18:59:34 christos Exp $ */
#ifndef _QUOTE_822_H_INCLUDED_
#define _QUOTE_822_H_INCLUDED_
@@ -29,7 +29,7 @@
extern VSTRING *quote_822_local_flags(VSTRING *, const char *, int);
extern VSTRING *unquote_822_local(VSTRING *, const char *);
#define quote_822_local(dst, src) \
- quote_822_local_flags((dst), (src), QUOTE_FLAG_8BITCLEAN)
+ quote_822_local_flags((dst), (src), QUOTE_FLAG_DEFAULT)
/* LICENSE
/* .ad
@@ -40,6 +40,11 @@ extern VSTRING *unquote_822_local(VSTRING *, const char *);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/quote_822_local.in b/external/ibm-public/postfix/dist/src/global/quote_822_local.in
new file mode 100644
index 00000000000..385f4d855ac
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/quote_822_local.in
@@ -0,0 +1,5 @@
+quote a@b@c@d
+quote_with_flags 8bitclean|bare_localpart a@b@c@d
+unquote "a@b@c"@d
+unquote "a@b@c"
+unquote "a@b@c"@d@e
diff --git a/external/ibm-public/postfix/dist/src/global/quote_822_local.ref b/external/ibm-public/postfix/dist/src/global/quote_822_local.ref
new file mode 100644
index 00000000000..ec759175152
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/quote_822_local.ref
@@ -0,0 +1,5 @@
+'a@b@c@d' quoted '"a@b@c"@d'
+'a@b@c@d' quoted flags=8bitclean|bare_localpart '"a@b@c@d"'
+'"a@b@c"@d' unquoted 'a@b@c@d'
+'"a@b@c"' unquoted 'a@b@c'
+'"a@b@c"@d@e' unquoted 'a@b@c@d@e'
diff --git a/external/ibm-public/postfix/dist/src/global/quote_flags.c b/external/ibm-public/postfix/dist/src/global/quote_flags.c
new file mode 100644
index 00000000000..a074e7f1749
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/quote_flags.c
@@ -0,0 +1,91 @@
+/* $NetBSD: quote_flags.c,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+/*++
+/* NAME
+/* quote_flags 3
+/* SUMMARY
+/* quote rfc 821/822 local part
+/* SYNOPSIS
+/* #include <quote_flags.h>
+/*
+/* int quote_flags_from_string(const char *string)
+/*
+/* const char *quote_flags_to_string(VSTRING *res_buf, int mask)
+/* DESCRIPTION
+/* quote_flags_from_string() converts symbolic flag names into
+/* the corresponding internal bitmask. This logs a warning and
+/* returns zero if an unknown symbolic name is specified.
+/*
+/* quote_flags_to_string() converts from internal bitmask to
+/* the corresponding symbolic names. This logs a warning and
+/* returns a null pointer if an unknown bitmask is specified.
+/*
+/* Arguments:
+/* .IP string
+/* Symbolic representation of a quote_flags bitmask, for
+/* example: \fB8bitclean | bare_localpart\fR. The conversion
+/* is case-insensitive.
+/* .IP res_buf
+/* Storage for the quote_flags_to_string() result, which has
+/* the same form as the string argument. If a null pointer is
+/* specified, quote_flags_to_string() uses storage that is
+/* overwritten with each call.
+/* .IP mask
+/* Binary representation of quote_flags.
+/* DIAGNOSTICS
+/* Fatal error: out of memory; or unknown bitmask name or value.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+
+ /*
+ * Utility library.
+ */
+#include <name_mask.h>
+
+ /*
+ * Global library.
+ */
+#include <quote_flags.h>
+
+static const NAME_MASK quote_flags_table[] = {
+ "8bitclean", QUOTE_FLAG_8BITCLEAN,
+ "expose_at", QUOTE_FLAG_EXPOSE_AT,
+ "append", QUOTE_FLAG_APPEND,
+ "bare_localpart", QUOTE_FLAG_BARE_LOCALPART,
+ 0,
+};
+
+/* quote_flags_from_string - symbolic quote flags to internal form */
+
+int quote_flags_from_string(const char *quote_flags_string)
+{
+ return (name_mask_delim_opt("quote_flags_from_string", quote_flags_table,
+ quote_flags_string, "|",
+ NAME_MASK_WARN | NAME_MASK_ANY_CASE));
+}
+
+/* quote_flags_to_string - internal form to symbolic quote flags */
+
+const char *quote_flags_to_string(VSTRING *res_buf, int quote_flags_mask)
+{
+ static VSTRING *my_buf;
+
+ if (res_buf == 0 && (res_buf = my_buf) == 0)
+ res_buf = my_buf = vstring_alloc(20);
+ return (str_name_mask_opt(res_buf, "quote_flags_to_string",
+ quote_flags_table, quote_flags_mask,
+ NAME_MASK_WARN | NAME_MASK_PIPE));
+}
diff --git a/external/ibm-public/postfix/dist/src/global/quote_flags.h b/external/ibm-public/postfix/dist/src/global/quote_flags.h
index d25772e06ea..9b5a5ba68be 100644
--- a/external/ibm-public/postfix/dist/src/global/quote_flags.h
+++ b/external/ibm-public/postfix/dist/src/global/quote_flags.h
@@ -1,4 +1,4 @@
-/* $NetBSD: quote_flags.h,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */
+/* $NetBSD: quote_flags.h,v 1.1.1.2 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -11,11 +11,22 @@
/* .nf
/*
+ * Utility library.
+ */
+#include <vstring.h>
+
+ /*
* External interface.
*/
#define QUOTE_FLAG_8BITCLEAN (1<<0) /* be 8-bit clean */
#define QUOTE_FLAG_EXPOSE_AT (1<<1) /* @ is ordinary text */
#define QUOTE_FLAG_APPEND (1<<2) /* append, not overwrite */
+#define QUOTE_FLAG_BARE_LOCALPART (1<<3)/* all localpart, no @domain */
+
+#define QUOTE_FLAG_DEFAULT QUOTE_FLAG_8BITCLEAN
+
+extern int quote_flags_from_string(const char *);
+extern const char *quote_flags_to_string(VSTRING *, int);
/* LICENSE
/* .ad
@@ -26,4 +37,9 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
diff --git a/external/ibm-public/postfix/dist/src/global/reject_deliver_request.c b/external/ibm-public/postfix/dist/src/global/reject_deliver_request.c
new file mode 100644
index 00000000000..0497f0d38d2
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/global/reject_deliver_request.c
@@ -0,0 +1,107 @@
+/* $NetBSD: reject_deliver_request.c,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+/*++
+/* NAME
+/* reject_deliver_request 3
+/* SUMMARY
+/* reject an entire delivery request
+/* SYNOPSIS
+/* #include <reject_deliver_request.h>
+/*
+/* int reject_deliver_request(
+/* const char *service,
+/* DELIVER_REQUEST *request,
+/* const char *code,
+/* const char *format, ...);
+/* DESCRIPTION
+/* reject_deliver_request() rejects an entire delivery request
+/* and bounces or defers all its recipients. The result value
+/* is the request's delivery status.
+/*
+/* Arguments:
+/* .IP service
+/* The service name from master.cf.
+/* .IP request
+/* The delivery request that is being rejected.
+/* .IP code
+/* Enhanced status code, must be in 4.X.X or 5.X.X. form.
+/* All recipients in the request are bounced or deferred
+/* depending on the status code value.
+/* .IP "format, ..."
+/* Format string and optional arguments.
+/* DIAGNOSTICS
+/* Panic: interface violation. Fatal: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <string.h>
+
+ /*
+ * Utility library.
+ */
+#include <msg.h>
+
+ /*
+ * Global library.
+ */
+#include <bounce.h>
+#include <defer.h>
+#include <deliver_completed.h>
+#include <deliver_request.h>
+#include <recipient_list.h>
+
+/* reject_deliver_request - reject an entire delivery request */
+
+int reject_deliver_request(const char *service, DELIVER_REQUEST *request,
+ const char *code,
+ const char *format,...)
+{
+ const char myname[] = "reject_deliver_request";
+ va_list ap;
+ RECIPIENT *rcpt;
+ DSN_BUF *why;
+ int status;
+ int result = 0;
+ int n;
+
+ /*
+ * Format something that we can pass to bounce_append() or
+ * defer_append().
+ */
+ va_start(ap, format);
+ why = vdsb_simple(dsb_create(), code, format, ap);
+ va_end(ap);
+ (void) DSN_FROM_DSN_BUF(why);
+ if (strchr("45", vstring_str(why->status)[0]) == 0)
+ msg_panic("%s: bad enhanced status code %s", myname, code);
+
+ /*
+ * Blindly bounce or defer all recipients.
+ */
+ for (n = 0; n < request->rcpt_list.len; n++) {
+ rcpt = request->rcpt_list.info + n;
+ status = (vstring_str(why->status)[0] != '4' ?
+ bounce_append : defer_append)
+ (DEL_REQ_TRACE_FLAGS(request->flags),
+ request->queue_id,
+ &request->msg_stats, rcpt,
+ service, &why->dsn);
+ if (status == 0)
+ deliver_completed(request->fp, rcpt->offset);
+ result |= status;
+ }
+ dsb_free(why);
+ return (result);
+}
diff --git a/external/ibm-public/postfix/dist/src/global/resolve_clnt.h b/external/ibm-public/postfix/dist/src/global/resolve_clnt.h
index 455058ab245..9d4841d9e5e 100644
--- a/external/ibm-public/postfix/dist/src/global/resolve_clnt.h
+++ b/external/ibm-public/postfix/dist/src/global/resolve_clnt.h
@@ -1,4 +1,4 @@
-/* $NetBSD: resolve_clnt.h,v 1.1.1.1 2009/06/23 10:08:47 tron Exp $ */
+/* $NetBSD: resolve_clnt.h,v 1.1.1.2 2020/03/18 18:59:34 christos Exp $ */
#ifndef _RESOLVE_CLNT_H_INCLUDED_
#define _RESOLVE_CLNT_H_INCLUDED_
@@ -55,11 +55,6 @@ extern void resolve_clnt_free(RESOLVE_REPLY *);
#define RESOLVE_NULL_FROM ""
-#define resolve_clnt_query(a, r) \
- resolve_clnt(RESOLVE_REGULAR, RESOLVE_NULL_FROM, (a), (r))
-#define resolve_clnt_verify(a, r) \
- resolve_clnt(RESOLVE_VERIFY, RESOLVE_NULL_FROM, (a), (r))
-
#define resolve_clnt_query_from(f, a, r) \
resolve_clnt(RESOLVE_REGULAR, (f), (a), (r))
#define resolve_clnt_verify_from(f, a, r) \
@@ -80,6 +75,11 @@ extern void resolve_clnt_free(RESOLVE_REPLY *);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/smtp_stream.h b/external/ibm-public/postfix/dist/src/global/smtp_stream.h
index 2890db7c11a..62e2d381f7a 100644
--- a/external/ibm-public/postfix/dist/src/global/smtp_stream.h
+++ b/external/ibm-public/postfix/dist/src/global/smtp_stream.h
@@ -1,4 +1,4 @@
-/* $NetBSD: smtp_stream.h,v 1.1.1.2 2013/01/02 18:59:00 tron Exp $ */
+/* $NetBSD: smtp_stream.h,v 1.1.1.3 2020/03/18 18:59:34 christos Exp $ */
#ifndef _SMTP_STREAM_H_INCLUDED_
#define _SMTP_STREAM_H_INCLUDED_
@@ -40,8 +40,10 @@ extern void PRINTFLIKE(2, 3) smtp_printf(VSTREAM *, const char *,...);
extern void smtp_flush(VSTREAM *);
extern int smtp_fgetc(VSTREAM *);
extern int smtp_get(VSTRING *, VSTREAM *, ssize_t, int);
+extern int smtp_get_noexcept(VSTRING *, VSTREAM *, ssize_t, int);
extern void smtp_fputs(const char *, ssize_t len, VSTREAM *);
extern void smtp_fwrite(const char *, ssize_t len, VSTREAM *);
+extern void smtp_fread_buf(VSTRING *, ssize_t len, VSTREAM *);
extern void smtp_fputc(int, VSTREAM *);
extern void smtp_vprintf(VSTREAM *, const char *, va_list);
@@ -51,6 +53,7 @@ extern void smtp_vprintf(VSTREAM *, const char *, va_list);
#define SMTP_GET_FLAG_NONE 0
#define SMTP_GET_FLAG_SKIP (1<<0) /* skip over excess input */
+#define SMTP_GET_FLAG_APPEND (1<<1) /* append instead of overwrite */
/* LICENSE
/* .ad
@@ -61,6 +64,11 @@ extern void smtp_vprintf(VSTREAM *, const char *, va_list);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/split_addr.h b/external/ibm-public/postfix/dist/src/global/split_addr.h
index 7bc2f8c3c1c..a70a1774f34 100644
--- a/external/ibm-public/postfix/dist/src/global/split_addr.h
+++ b/external/ibm-public/postfix/dist/src/global/split_addr.h
@@ -1,4 +1,4 @@
-/* $NetBSD: split_addr.h,v 1.1.1.2 2014/07/06 19:27:52 tron Exp $ */
+/* $NetBSD: split_addr.h,v 1.1.1.3 2020/03/18 18:59:34 christos Exp $ */
#ifndef _SPLIT_ADDR_H_INCLUDED_
#define _SPLIT_ADDR_H_INCLUDED_
@@ -15,7 +15,11 @@
/* External interface. */
-extern char *split_addr(char *, const char *);
+extern char *split_addr_internal(char *, const char *);
+
+ /* Legacy API. */
+
+#define split_addr split_addr_internal
/* LICENSE
/* .ad
@@ -26,6 +30,11 @@ extern char *split_addr(char *, const char *);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/strip_addr.h b/external/ibm-public/postfix/dist/src/global/strip_addr.h
index 256762e71a6..3f97f6261ad 100644
--- a/external/ibm-public/postfix/dist/src/global/strip_addr.h
+++ b/external/ibm-public/postfix/dist/src/global/strip_addr.h
@@ -1,4 +1,4 @@
-/* $NetBSD: strip_addr.h,v 1.1.1.2 2014/07/06 19:27:52 tron Exp $ */
+/* $NetBSD: strip_addr.h,v 1.1.1.3 2020/03/18 18:59:34 christos Exp $ */
#ifndef _STRIP_ADDR_H_INCLUDED_
#define _STRIP_ADDR_H_INCLUDED_
@@ -15,7 +15,9 @@
/* External interface. */
-extern char *strip_addr(const char *, char **, const char *);
+extern char *strip_addr_internal(const char *, char **, const char *);
+
+#define strip_addr strip_addr_internal
/* LICENSE
/* .ad
@@ -26,6 +28,11 @@ extern char *strip_addr(const char *, char **, const char *);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/global/strip_addr.ref b/external/ibm-public/postfix/dist/src/global/strip_addr.ref
index af218e5c031..1a28395135e 100644
--- a/external/ibm-public/postfix/dist/src/global/strip_addr.ref
+++ b/external/ibm-public/postfix/dist/src/global/strip_addr.ref
@@ -8,3 +8,5 @@ unknown: wanted: foo-ext@bar -> foo@bar -ext
unknown: strip_addr foo-ext@bar -> foo@bar -ext
unknown: wanted: foo+ext@bar -> foo@bar +ext
unknown: strip_addr foo+ext@bar -> foo@bar +ext
+unknown: wanted: foo bar+ext -> foo bar +ext
+unknown: strip_addr foo bar+ext -> foo bar +ext
diff --git a/external/ibm-public/postfix/dist/src/local/Makefile.in b/external/ibm-public/postfix/dist/src/local/Makefile.in
index 86653c2e277..648ad5133c9 100644
--- a/external/ibm-public/postfix/dist/src/local/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/local/Makefile.in
@@ -62,7 +62,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -651,6 +651,7 @@ unknown.o: ../../include/argv.h
unknown.o: ../../include/attr.h
unknown.o: ../../include/been_here.h
unknown.o: ../../include/bounce.h
+unknown.o: ../../include/canon_addr.h
unknown.o: ../../include/check_arg.h
unknown.o: ../../include/defer.h
unknown.o: ../../include/deliver_pass.h
diff --git a/external/ibm-public/postfix/dist/src/master/Makefile.in b/external/ibm-public/postfix/dist/src/master/Makefile.in
index 0a608b9bdca..1dd334d86ee 100644
--- a/external/ibm-public/postfix/dist/src/master/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/master/Makefile.in
@@ -3,13 +3,13 @@ SRCS = master.c master_conf.c master_ent.c master_sig.c master_avail.c \
master_spawn.c master_service.c master_status.c master_listen.c \
master_proto.c single_server.c multi_server.c master_vars.c \
master_wakeup.c master_flow.c master_watch.c mail_flow.c \
- master_monitor.c
+ master_monitor.c dgram_server.c
OBJS = master.o master_conf.o master_ent.o master_sig.o master_avail.o \
master_spawn.o master_service.o master_status.o master_listen.o \
master_vars.o master_wakeup.o master_watch.o master_flow.o \
master_monitor.o
LIB_OBJ = single_server.o multi_server.o trigger_server.o master_proto.o \
- mail_flow.o event_server.o
+ mail_flow.o event_server.o dgram_server.o
HDRS = mail_server.h master_proto.h mail_flow.h
INT_HDR = master.h
DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE)
@@ -83,10 +83,51 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
+dgram_server.o: ../../include/argv.h
+dgram_server.o: ../../include/attr.h
+dgram_server.o: ../../include/bounce.h
+dgram_server.o: ../../include/check_arg.h
+dgram_server.o: ../../include/chroot_uid.h
+dgram_server.o: ../../include/debug_process.h
+dgram_server.o: ../../include/deliver_request.h
+dgram_server.o: ../../include/dict.h
+dgram_server.o: ../../include/dsn.h
+dgram_server.o: ../../include/dsn_buf.h
+dgram_server.o: ../../include/events.h
+dgram_server.o: ../../include/htable.h
+dgram_server.o: ../../include/iostuff.h
+dgram_server.o: ../../include/listen.h
+dgram_server.o: ../../include/mail_conf.h
+dgram_server.o: ../../include/mail_dict.h
+dgram_server.o: ../../include/mail_params.h
+dgram_server.o: ../../include/mail_task.h
+dgram_server.o: ../../include/mail_version.h
+dgram_server.o: ../../include/maillog_client.h
+dgram_server.o: ../../include/msg.h
+dgram_server.o: ../../include/msg_stats.h
+dgram_server.o: ../../include/msg_vstream.h
+dgram_server.o: ../../include/myflock.h
+dgram_server.o: ../../include/mymalloc.h
+dgram_server.o: ../../include/nvtable.h
+dgram_server.o: ../../include/recipient_list.h
+dgram_server.o: ../../include/resolve_local.h
+dgram_server.o: ../../include/safe_open.h
+dgram_server.o: ../../include/sane_accept.h
+dgram_server.o: ../../include/split_at.h
+dgram_server.o: ../../include/stringops.h
+dgram_server.o: ../../include/sys_defs.h
+dgram_server.o: ../../include/vbuf.h
+dgram_server.o: ../../include/vstream.h
+dgram_server.o: ../../include/vstring.h
+dgram_server.o: ../../include/watchdog.h
+dgram_server.o: dgram_server.c
+dgram_server.o: mail_flow.h
+dgram_server.o: mail_server.h
+dgram_server.o: master_proto.h
event_server.o: ../../include/argv.h
event_server.o: ../../include/attr.h
event_server.o: ../../include/bounce.h
@@ -106,9 +147,9 @@ event_server.o: ../../include/mail_dict.h
event_server.o: ../../include/mail_params.h
event_server.o: ../../include/mail_task.h
event_server.o: ../../include/mail_version.h
+event_server.o: ../../include/maillog_client.h
event_server.o: ../../include/msg.h
event_server.o: ../../include/msg_stats.h
-event_server.o: ../../include/msg_syslog.h
event_server.o: ../../include/msg_vstream.h
event_server.o: ../../include/myflock.h
event_server.o: ../../include/mymalloc.h
@@ -148,8 +189,8 @@ master.o: ../../include/mail_params.h
master.o: ../../include/mail_parm_split.h
master.o: ../../include/mail_task.h
master.o: ../../include/mail_version.h
+master.o: ../../include/maillog_client.h
master.o: ../../include/msg.h
-master.o: ../../include/msg_syslog.h
master.o: ../../include/myflock.h
master.o: ../../include/mymalloc.h
master.o: ../../include/open_lock.h
@@ -327,9 +368,9 @@ multi_server.o: ../../include/mail_dict.h
multi_server.o: ../../include/mail_params.h
multi_server.o: ../../include/mail_task.h
multi_server.o: ../../include/mail_version.h
+multi_server.o: ../../include/maillog_client.h
multi_server.o: ../../include/msg.h
multi_server.o: ../../include/msg_stats.h
-multi_server.o: ../../include/msg_syslog.h
multi_server.o: ../../include/msg_vstream.h
multi_server.o: ../../include/myflock.h
multi_server.o: ../../include/mymalloc.h
@@ -369,9 +410,9 @@ single_server.o: ../../include/mail_dict.h
single_server.o: ../../include/mail_params.h
single_server.o: ../../include/mail_task.h
single_server.o: ../../include/mail_version.h
+single_server.o: ../../include/maillog_client.h
single_server.o: ../../include/msg.h
single_server.o: ../../include/msg_stats.h
-single_server.o: ../../include/msg_syslog.h
single_server.o: ../../include/msg_vstream.h
single_server.o: ../../include/myflock.h
single_server.o: ../../include/mymalloc.h
@@ -411,9 +452,9 @@ trigger_server.o: ../../include/mail_dict.h
trigger_server.o: ../../include/mail_params.h
trigger_server.o: ../../include/mail_task.h
trigger_server.o: ../../include/mail_version.h
+trigger_server.o: ../../include/maillog_client.h
trigger_server.o: ../../include/msg.h
trigger_server.o: ../../include/msg_stats.h
-trigger_server.o: ../../include/msg_syslog.h
trigger_server.o: ../../include/msg_vstream.h
trigger_server.o: ../../include/myflock.h
trigger_server.o: ../../include/mymalloc.h
diff --git a/external/ibm-public/postfix/dist/src/master/dgram_server.c b/external/ibm-public/postfix/dist/src/master/dgram_server.c
new file mode 100644
index 00000000000..be53b9f1fba
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/master/dgram_server.c
@@ -0,0 +1,667 @@
+/* $NetBSD: dgram_server.c,v 1.1.1.1 2020/03/18 18:59:34 christos Exp $ */
+
+/*++
+/* NAME
+/* dgram_server 3
+/* SUMMARY
+/* skeleton datagram server subsystem
+/* SYNOPSIS
+/* #include <mail_server.h>
+/*
+/* NORETURN dgram_server_main(argc, argv, service, key, value, ...)
+/* int argc;
+/* char **argv;
+/* void (*service)(char *buf, int len, char *service_name, char **argv);
+/* int key;
+/* DESCRIPTION
+/* This module implements a skeleton for mail subsystem programs
+/* that wake up on client request and perform some activity
+/* without further client interaction. This module supports
+/* local IPC via a UNIX-domain datagram socket. The resulting
+/* program expects to be run from the \fBmaster\fR process.
+/*
+/* dgram_server_main() is the skeleton entry point. It should
+/* be called from the application main program. The skeleton
+/* does the generic command-line options processing, initialization
+/* of configurable parameters, and receiving datagrams. The
+/* skeleton never returns.
+/*
+/* Arguments:
+/* .IP "void (*service)(char *buf, int len, char *service_name, char **argv)"
+/* A pointer to a function that is called by the skeleton each
+/* time a client sends a datagram to the program's service
+/* port. The function is run after the program has irrevocably
+/* dropped its privileges. The buffer argument specifies the
+/* data read from the datagram port; this data corresponds to
+/* request. The len argument specifies how much client data
+/* is available. The maximal size of the buffer is specified
+/* via the DGRAM_BUF_SIZE manifest constant. The service name
+/* argument corresponds to the service name in the master.cf
+/* file. The argv argument specifies command-line arguments
+/* left over after options processing.
+/* .PP
+/* Optional arguments are specified as a null-terminated list
+/* with macros that have zero or more arguments:
+/* .IP "CA_MAIL_SERVER_INT_TABLE(CONFIG_INT_TABLE *)"
+/* A table with configurable parameters, to be loaded from the
+/* global Postfix configuration file. Tables are loaded in the
+/* order as specified, and multiple instances of the same type
+/* are allowed.
+/* .IP "CA_MAIL_SERVER_LONG_TABLE(CONFIG_LONG_TABLE *)"
+/* A table with configurable parameters, to be loaded from the
+/* global Postfix configuration file. Tables are loaded in the
+/* order as specified, and multiple instances of the same type
+/* are allowed.
+/* .IP "CA_MAIL_SERVER_STR_TABLE(CONFIG_STR_TABLE *)"
+/* A table with configurable parameters, to be loaded from the
+/* global Postfix configuration file. Tables are loaded in the
+/* order as specified, and multiple instances of the same type
+/* are allowed.
+/* .IP "CA_MAIL_SERVER_BOOL_TABLE(CONFIG_BOOL_TABLE *)"
+/* A table with configurable parameters, to be loaded from the
+/* global Postfix configuration file. Tables are loaded in the
+/* order as specified, and multiple instances of the same type
+/* are allowed.
+/* .IP "CA_MAIL_SERVER_TIME_TABLE(CONFIG_TIME_TABLE *)"
+/* A table with configurable parameters, to be loaded from the
+/* global Postfix configuration file. Tables are loaded in the
+/* order as specified, and multiple instances of the same type
+/* are allowed.
+/* .IP "CA_MAIL_SERVER_RAW_TABLE(CONFIG_RAW_TABLE *)"
+/* A table with configurable parameters, to be loaded from the
+/* global Postfix configuration file. Tables are loaded in the
+/* order as specified, and multiple instances of the same type
+/* are allowed. Raw parameters are not subjected to $name
+/* evaluation.
+/* .IP "CA_MAIL_SERVER_NINT_TABLE(CONFIG_NINT_TABLE *)"
+/* A table with configurable parameters, to be loaded from the
+/* global Postfix configuration file. Tables are loaded in the
+/* order as specified, and multiple instances of the same type
+/* are allowed.
+/* .IP "CA_MAIL_SERVER_NBOOL_TABLE(CONFIG_NBOOL_TABLE *)"
+/* A table with configurable parameters, to be loaded from the
+/* global Postfix configuration file. Tables are loaded in the
+/* order as specified, and multiple instances of the same type
+/* are allowed.
+/* .IP "CA_MAIL_SERVER_PRE_INIT(void *(char *service_name, char **argv))"
+/* A pointer to a function that is called once
+/* by the skeleton after it has read the global configuration file
+/* and after it has processed command-line arguments, but before
+/* the skeleton has optionally relinquished the process privileges.
+/* .sp
+/* Only the last instance of this parameter type is remembered.
+/* .IP "CA_MAIL_SERVER_POST_INIT(void *(char *service_name, char **argv))"
+/* A pointer to a function that is called once
+/* by the skeleton after it has optionally relinquished the process
+/* privileges, but before servicing client connection requests.
+/* .sp
+/* Only the last instance of this parameter type is remembered.
+/* .IP "CA_MAIL_SERVER_LOOP(int *(char *service_name, char **argv))"
+/* A pointer to function that is executed from
+/* within the event loop, whenever an I/O or timer event has happened,
+/* or whenever nothing has happened for a specified amount of time.
+/* The result value of the function specifies how long to wait until
+/* the next event. Specify -1 to wait for "as long as it takes".
+/* .sp
+/* Only the last instance of this parameter type is remembered.
+/* .IP "CA_MAIL_SERVER_EXIT(void *(char *service_name, char **argv))"
+/* A pointer to function that is executed immediately before normal
+/* process termination.
+/* .sp
+/* Only the last instance of this parameter type is remembered.
+/* .IP "CA_MAIL_SERVER_PRE_ACCEPT(void *(char *service_name, char **argv))"
+/* Function to be executed prior to accepting a new request.
+/* .sp
+/* Only the last instance of this parameter type is remembered.
+/* .IP "CA_MAIL_SERVER_IN_FLOW_DELAY(none)"
+/* Pause $in_flow_delay seconds when no "mail flow control token"
+/* is available. A token is consumed for each connection request.
+/* .IP CA_MAIL_SERVER_SOLITARY
+/* This service must be configured with process limit of 1.
+/* .IP CA_MAIL_SERVER_UNLIMITED
+/* This service must be configured with process limit of 0.
+/* .IP CA_MAIL_SERVER_PRIVILEGED
+/* This service must be configured as privileged.
+/* .IP "CA_MAIL_SERVER_WATCHDOG(int *)"
+/* Override the default 1000s watchdog timeout. The value is
+/* used after command-line and main.cf file processing.
+/* .IP "CA_MAIL_SERVER_BOUNCE_INIT(const char *, const char **)"
+/* Initialize the DSN filter for the bounce/defer service
+/* clients with the specified map source and map names.
+/* .PP
+/* The var_use_limit variable limits the number of clients that
+/* a server can service before it commits suicide.
+/* This value is taken from the global \fBmain.cf\fR configuration
+/* file. Setting \fBvar_use_limit\fR to zero disables the client limit.
+/*
+/* The var_idle_limit variable limits the time that a service
+/* receives no client connection requests before it commits suicide.
+/* This value is taken from the global \fBmain.cf\fR configuration
+/* file. Setting \fBvar_use_limit\fR to zero disables the idle limit.
+/* DIAGNOSTICS
+/* Problems and transactions are logged to \fBsyslogd\fR(8)
+/* or \fBpostlogd\fR(8).
+/* SEE ALSO
+/* master(8), master process
+/* postlogd(8), Postfix logging
+/* syslogd(8), system logging
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+/* System library. */
+
+#include <sys_defs.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <string.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdarg.h>
+#ifdef STRCASECMP_IN_STRINGS_H
+#include <strings.h>
+#endif
+#include <time.h>
+
+/* Utility library. */
+
+#include <msg.h>
+#include <msg_vstream.h>
+#include <chroot_uid.h>
+#include <vstring.h>
+#include <vstream.h>
+#include <msg_vstream.h>
+#include <mymalloc.h>
+#include <events.h>
+#include <iostuff.h>
+#include <stringops.h>
+#include <sane_accept.h>
+#include <myflock.h>
+#include <safe_open.h>
+#include <listen.h>
+#include <watchdog.h>
+#include <split_at.h>
+
+/* Global library. */
+
+#include <mail_params.h>
+#include <mail_task.h>
+#include <debug_process.h>
+#include <mail_conf.h>
+#include <mail_dict.h>
+#include <resolve_local.h>
+#include <mail_flow.h>
+#include <mail_version.h>
+#include <bounce.h>
+#include <maillog_client.h>
+
+/* Process manager. */
+
+#include "master_proto.h"
+
+/* Application-specific */
+
+#include "mail_server.h"
+
+ /*
+ * Global state.
+ */
+static int use_count;
+
+static DGRAM_SERVER_FN dgram_server_service;
+static char *dgram_server_name;
+static char **dgram_server_argv;
+static void (*dgram_server_accept) (int, void *);
+static void (*dgram_server_onexit) (char *, char **);
+static void (*dgram_server_pre_accept) (char *, char **);
+static VSTREAM *dgram_server_lock;
+static int dgram_server_in_flow_delay;
+static unsigned dgram_server_generation;
+static int dgram_server_watchdog = 1000;
+
+/* dgram_server_exit - normal termination */
+
+static NORETURN dgram_server_exit(void)
+{
+ if (dgram_server_onexit)
+ dgram_server_onexit(dgram_server_name, dgram_server_argv);
+ exit(0);
+}
+
+/* dgram_server_abort - terminate after abnormal master exit */
+
+static void dgram_server_abort(int unused_event, void *unused_context)
+{
+ if (msg_verbose)
+ msg_info("master disconnect -- exiting");
+ dgram_server_exit();
+}
+
+/* dgram_server_timeout - idle time exceeded */
+
+static void dgram_server_timeout(int unused_event, void *unused_context)
+{
+ if (msg_verbose)
+ msg_info("idle timeout -- exiting");
+ dgram_server_exit();
+}
+
+/* dgram_server_wakeup - wake up application */
+
+static void dgram_server_wakeup(int fd)
+{
+ char buf[DGRAM_BUF_SIZE];
+ ssize_t len;
+
+ /*
+ * Commit suicide when the master process disconnected from us, after
+ * handling the client request.
+ */
+ if (master_notify(var_pid, dgram_server_generation, MASTER_STAT_TAKEN) < 0)
+ /* void */ ;
+ if (dgram_server_in_flow_delay && mail_flow_get(1) < 0)
+ doze(var_in_flow_delay * 1000000);
+ if ((len = recv(fd, buf, sizeof(buf), 0)) >= 0)
+ dgram_server_service(buf, len, dgram_server_name, dgram_server_argv);
+ if (master_notify(var_pid, dgram_server_generation, MASTER_STAT_AVAIL) < 0)
+ dgram_server_abort(EVENT_NULL_TYPE, EVENT_NULL_CONTEXT);
+ if (var_idle_limit > 0)
+ event_request_timer(dgram_server_timeout, (void *) 0, var_idle_limit);
+ /* Avoid integer wrap-around in a persistent process. */
+ if (use_count < INT_MAX)
+ use_count++;
+}
+
+/* dgram_server_accept_unix - handle UNIX-domain socket event */
+
+static void dgram_server_accept_unix(int unused_event, void *context)
+{
+ const char *myname = "dgram_server_accept";
+ int listen_fd = CAST_ANY_PTR_TO_INT(context);
+
+ if (dgram_server_lock != 0
+ && myflock(vstream_fileno(dgram_server_lock), INTERNAL_LOCK,
+ MYFLOCK_OP_NONE) < 0)
+ msg_fatal("select unlock: %m");
+
+ if (msg_verbose)
+ msg_info("%s: request arrived", myname);
+
+ /*
+ * Read whatever the other side wrote. The socket is non-blocking so we
+ * won't get stuck when multiple processes wake up.
+ */
+ if (dgram_server_pre_accept)
+ dgram_server_pre_accept(dgram_server_name, dgram_server_argv);
+ dgram_server_wakeup(listen_fd);
+}
+
+/* dgram_server_main - the real main program */
+
+NORETURN dgram_server_main(int argc, char **argv, DGRAM_SERVER_FN service,...)
+{
+ const char *myname = "dgram_server_main";
+ char *root_dir = 0;
+ char *user_name = 0;
+ int debug_me = 0;
+ int daemon_mode = 1;
+ char *service_name = basename(argv[0]);
+ int delay;
+ int c;
+ int socket_count = 1;
+ int fd;
+ va_list ap;
+ MAIL_SERVER_INIT_FN pre_init = 0;
+ MAIL_SERVER_INIT_FN post_init = 0;
+ MAIL_SERVER_LOOP_FN loop = 0;
+ int key;
+ char *transport = 0;
+ char *lock_path;
+ VSTRING *why;
+ int alone = 0;
+ int zerolimit = 0;
+ WATCHDOG *watchdog;
+ char *oname_val;
+ char *oname;
+ char *oval;
+ const char *err;
+ char *generation;
+ int msg_vstream_needed = 0;
+ const char *dsn_filter_title;
+ const char **dsn_filter_maps;
+
+ /*
+ * Process environment options as early as we can.
+ */
+ if (getenv(CONF_ENV_VERB))
+ msg_verbose = 1;
+ if (getenv(CONF_ENV_DEBUG))
+ debug_me = 1;
+
+ /*
+ * Don't die when a process goes away unexpectedly.
+ */
+ signal(SIGPIPE, SIG_IGN);
+
+ /*
+ * Don't die for frivolous reasons.
+ */
+#ifdef SIGXFSZ
+ signal(SIGXFSZ, SIG_IGN);
+#endif
+
+ /*
+ * May need this every now and then.
+ */
+ var_procname = mystrdup(basename(argv[0]));
+ set_mail_conf_str(VAR_PROCNAME, var_procname);
+
+ /*
+ * Initialize logging and exit handler. Do the syslog first, so that its
+ * initialization completes before we enter the optional chroot jail.
+ */
+ maillog_client_init(mail_task(var_procname), MAILLOG_CLIENT_FLAG_NONE);
+ if (msg_verbose)
+ msg_info("daemon started");
+
+ /*
+ * Check the Postfix library version as soon as we enable logging.
+ */
+ MAIL_VERSION_CHECK;
+
+ /*
+ * Initialize from the configuration file. Allow command-line options to
+ * override compiled-in defaults or configured parameter values.
+ */
+ mail_conf_suck();
+
+ /*
+ * After database open error, continue execution with reduced
+ * functionality.
+ */
+ dict_allow_surrogate = 1;
+
+ /*
+ * Pick up policy settings from master process. Shut up error messages to
+ * stderr, because no-one is going to see them.
+ */
+ opterr = 0;
+ while ((c = GETOPT(argc, argv, "cdDi:lm:n:o:s:t:uvVz")) > 0) {
+ switch (c) {
+ case 'c':
+ root_dir = "setme";
+ break;
+ case 'd':
+ daemon_mode = 0;
+ break;
+ case 'D':
+ debug_me = 1;
+ break;
+ case 'i':
+ mail_conf_update(VAR_MAX_IDLE, optarg);
+ break;
+ case 'l':
+ alone = 1;
+ break;
+ case 'm':
+ mail_conf_update(VAR_MAX_USE, optarg);
+ break;
+ case 'n':
+ service_name = optarg;
+ break;
+ case 'o':
+ oname_val = mystrdup(optarg);
+ if ((err = split_nameval(oname_val, &oname, &oval)) != 0)
+ msg_fatal("invalid \"-o %s\" option value: %s", optarg, err);
+ mail_conf_update(oname, oval);
+ myfree(oname_val);
+ break;
+ case 's':
+ if ((socket_count = atoi(optarg)) <= 0)
+ msg_fatal("invalid socket_count: %s", optarg);
+ break;
+ case 't':
+ transport = optarg;
+ break;
+ case 'u':
+ user_name = "setme";
+ break;
+ case 'v':
+ msg_verbose++;
+ break;
+ case 'V':
+ if (++msg_vstream_needed == 1)
+ msg_vstream_init(mail_task(var_procname), VSTREAM_ERR);
+ break;
+ case 'z':
+ zerolimit = 1;
+ break;
+ default:
+ msg_fatal("invalid option: %c", optopt);
+ break;
+ }
+ }
+ set_mail_conf_str(VAR_SERVNAME, service_name);
+
+ /*
+ * Initialize generic parameters and re-initialize logging in case of a
+ * non-default program name or logging destination.
+ */
+ mail_params_init();
+ maillog_client_init(mail_task(var_procname), MAILLOG_CLIENT_FLAG_NONE);
+
+ /*
+ * Register higher-level dictionaries and initialize the support for
+ * dynamically-loaded dictionarles.
+ */
+ mail_dict_init();
+
+ /*
+ * If not connected to stdin, stdin must not be a terminal.
+ */
+ if (daemon_mode && isatty(STDIN_FILENO)) {
+ msg_vstream_init(var_procname, VSTREAM_ERR);
+ msg_fatal("do not run this command by hand");
+ }
+
+ /*
+ * Application-specific initialization.
+ */
+ va_start(ap, service);
+ while ((key = va_arg(ap, int)) != 0) {
+ switch (key) {
+ case MAIL_SERVER_INT_TABLE:
+ get_mail_conf_int_table(va_arg(ap, CONFIG_INT_TABLE *));
+ break;
+ case MAIL_SERVER_LONG_TABLE:
+ get_mail_conf_long_table(va_arg(ap, CONFIG_LONG_TABLE *));
+ break;
+ case MAIL_SERVER_STR_TABLE:
+ get_mail_conf_str_table(va_arg(ap, CONFIG_STR_TABLE *));
+ break;
+ case MAIL_SERVER_BOOL_TABLE:
+ get_mail_conf_bool_table(va_arg(ap, CONFIG_BOOL_TABLE *));
+ break;
+ case MAIL_SERVER_TIME_TABLE:
+ get_mail_conf_time_table(va_arg(ap, CONFIG_TIME_TABLE *));
+ break;
+ case MAIL_SERVER_RAW_TABLE:
+ get_mail_conf_raw_table(va_arg(ap, CONFIG_RAW_TABLE *));
+ break;
+ case MAIL_SERVER_NINT_TABLE:
+ get_mail_conf_nint_table(va_arg(ap, CONFIG_NINT_TABLE *));
+ break;
+ case MAIL_SERVER_NBOOL_TABLE:
+ get_mail_conf_nbool_table(va_arg(ap, CONFIG_NBOOL_TABLE *));
+ break;
+ case MAIL_SERVER_PRE_INIT:
+ pre_init = va_arg(ap, MAIL_SERVER_INIT_FN);
+ break;
+ case MAIL_SERVER_POST_INIT:
+ post_init = va_arg(ap, MAIL_SERVER_INIT_FN);
+ break;
+ case MAIL_SERVER_LOOP:
+ loop = va_arg(ap, MAIL_SERVER_LOOP_FN);
+ break;
+ case MAIL_SERVER_EXIT:
+ dgram_server_onexit = va_arg(ap, MAIL_SERVER_EXIT_FN);
+ break;
+ case MAIL_SERVER_PRE_ACCEPT:
+ dgram_server_pre_accept = va_arg(ap, MAIL_SERVER_ACCEPT_FN);
+ break;
+ case MAIL_SERVER_IN_FLOW_DELAY:
+ dgram_server_in_flow_delay = 1;
+ break;
+ case MAIL_SERVER_SOLITARY:
+ if (!alone)
+ msg_fatal("service %s requires a process limit of 1",
+ service_name);
+ break;
+ case MAIL_SERVER_UNLIMITED:
+ if (!zerolimit)
+ msg_fatal("service %s requires a process limit of 0",
+ service_name);
+ break;
+ case MAIL_SERVER_PRIVILEGED:
+ if (user_name)
+ msg_fatal("service %s requires privileged operation",
+ service_name);
+ break;
+ case MAIL_SERVER_WATCHDOG:
+ dgram_server_watchdog = *va_arg(ap, int *);
+ break;
+ case MAIL_SERVER_BOUNCE_INIT:
+ dsn_filter_title = va_arg(ap, const char *);
+ dsn_filter_maps = va_arg(ap, const char **);
+ bounce_client_init(dsn_filter_title, *dsn_filter_maps);
+ break;
+ default:
+ msg_panic("%s: unknown argument type: %d", myname, key);
+ }
+ }
+ va_end(ap);
+
+ if (root_dir)
+ root_dir = var_queue_dir;
+ if (user_name)
+ user_name = var_mail_owner;
+
+ /*
+ * Can options be required?
+ */
+ if (transport == 0)
+ msg_fatal("no transport type specified");
+ else if (strcasecmp(transport, MASTER_XPORT_NAME_UXDG) == 0)
+ dgram_server_accept = dgram_server_accept_unix;
+ else
+ msg_fatal("unsupported transport type: %s", transport);
+
+ /*
+ * Retrieve process generation from environment.
+ */
+ if ((generation = getenv(MASTER_GEN_NAME)) != 0) {
+ if (!alldig(generation))
+ msg_fatal("bad generation: %s", generation);
+ OCTAL_TO_UNSIGNED(dgram_server_generation, generation);
+ if (msg_verbose)
+ msg_info("process generation: %s (%o)",
+ generation, dgram_server_generation);
+ }
+
+ /*
+ * Optionally start the debugger on ourself.
+ */
+ if (debug_me)
+ debug_process();
+
+ /*
+ * Traditionally, BSD select() can't handle multiple processes selecting
+ * on the same socket, and wakes up every process in select(). See TCP/IP
+ * Illustrated volume 2 page 532. We avoid select() collisions with an
+ * external lock file.
+ */
+ if (!alone) {
+ lock_path = concatenate(DEF_PID_DIR, "/", transport,
+ ".", service_name, (char *) 0);
+ why = vstring_alloc(1);
+ if ((dgram_server_lock = safe_open(lock_path, O_CREAT | O_RDWR, 0600,
+ (struct stat *) 0, -1, -1, why)) == 0)
+ msg_fatal("open lock file %s: %s", lock_path, vstring_str(why));
+ close_on_exec(vstream_fileno(dgram_server_lock), CLOSE_ON_EXEC);
+ myfree(lock_path);
+ vstring_free(why);
+ }
+
+ /*
+ * Set up call-back info.
+ */
+ dgram_server_service = service;
+ dgram_server_name = service_name;
+ dgram_server_argv = argv + optind;
+
+ /*
+ * Run pre-jail initialization.
+ */
+ if (chdir(var_queue_dir) < 0)
+ msg_fatal("chdir(\"%s\"): %m", var_queue_dir);
+ if (pre_init)
+ pre_init(dgram_server_name, dgram_server_argv);
+
+ /*
+ * Optionally, restrict the damage that this process can do.
+ */
+ resolve_local_init();
+ tzset();
+ chroot_uid(root_dir, user_name);
+
+ /*
+ * Run post-jail initialization.
+ */
+ if (post_init)
+ post_init(dgram_server_name, dgram_server_argv);
+
+ /*
+ * Running as a semi-resident server. Service requests. Terminate when we
+ * have serviced a sufficient number of requests, when no-one has been
+ * talking to us for a configurable amount of time, or when the master
+ * process terminated abnormally.
+ */
+ if (var_idle_limit > 0)
+ event_request_timer(dgram_server_timeout, (void *) 0, var_idle_limit);
+ for (fd = MASTER_LISTEN_FD; fd < MASTER_LISTEN_FD + socket_count; fd++) {
+ event_enable_read(fd, dgram_server_accept, CAST_INT_TO_VOID_PTR(fd));
+ close_on_exec(fd, CLOSE_ON_EXEC);
+ }
+ event_enable_read(MASTER_STATUS_FD, dgram_server_abort, (void *) 0);
+ close_on_exec(MASTER_STATUS_FD, CLOSE_ON_EXEC);
+ close_on_exec(MASTER_FLOW_READ, CLOSE_ON_EXEC);
+ close_on_exec(MASTER_FLOW_WRITE, CLOSE_ON_EXEC);
+ watchdog = watchdog_create(dgram_server_watchdog,
+ (WATCHDOG_FN) 0, (void *) 0);
+
+ /*
+ * The event loop, at last.
+ */
+ while (var_use_limit == 0 || use_count < var_use_limit) {
+ if (dgram_server_lock != 0) {
+ watchdog_stop(watchdog);
+ if (myflock(vstream_fileno(dgram_server_lock), INTERNAL_LOCK,
+ MYFLOCK_OP_EXCLUSIVE) < 0)
+ msg_fatal("select lock: %m");
+ }
+ watchdog_start(watchdog);
+ delay = loop ? loop(dgram_server_name, dgram_server_argv) : -1;
+ event_loop(delay);
+ }
+ dgram_server_exit();
+}
diff --git a/external/ibm-public/postfix/dist/src/master/master.h b/external/ibm-public/postfix/dist/src/master/master.h
index 7b24ce690ef..e3c10604c83 100644
--- a/external/ibm-public/postfix/dist/src/master/master.h
+++ b/external/ibm-public/postfix/dist/src/master/master.h
@@ -1,4 +1,4 @@
-/* $NetBSD: master.h,v 1.1.1.4 2013/09/25 19:06:32 tron Exp $ */
+/* $NetBSD: master.h,v 1.1.1.5 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -75,12 +75,13 @@ typedef struct MASTER_SERV {
#define MASTER_LIMIT_OK(limit, count) ((limit) == 0 || ((count) < (limit)))
/*
- * Service types.
+ * Service types, stream sockets unless indicated otherwise.
*/
#define MASTER_SERV_TYPE_UNIX 1 /* AF_UNIX domain socket */
#define MASTER_SERV_TYPE_INET 2 /* AF_INET domain socket */
#define MASTER_SERV_TYPE_FIFO 3 /* fifo (named pipe) */
#define MASTER_SERV_TYPE_PASS 4 /* AF_UNIX domain socket */
+#define MASTER_SERV_TYPE_UXDG 5 /* AF_UNIX domain datagram socket */
/*
* Default process management policy values. This is only the bare minimum.
@@ -111,6 +112,7 @@ typedef struct MASTER_PROC {
* master.c
*/
extern int master_detach;
+extern int init_mode;
/*
* master_ent.c
@@ -238,4 +240,9 @@ extern int master_monitor(int);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
diff --git a/external/ibm-public/postfix/dist/src/master/master_conf.c b/external/ibm-public/postfix/dist/src/master/master_conf.c
index e76edd68f51..db4ad386d30 100644
--- a/external/ibm-public/postfix/dist/src/master/master_conf.c
+++ b/external/ibm-public/postfix/dist/src/master/master_conf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: master_conf.c,v 1.1.1.2 2013/01/02 18:59:01 tron Exp $ */
+/* $NetBSD: master_conf.c,v 1.1.1.3 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -32,6 +32,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System libraries. */
@@ -125,7 +130,11 @@ void master_config(void)
* settings.
*/
else {
- serv->flags &= ~MASTER_FLAG_MARK;
+ if ((serv->flags & MASTER_FLAG_MARK) == 0)
+ msg_warn("duplicate master.cf entry for service \"%s\" (%s) "
+ "-- using the last entry", serv->ext_name, serv->name);
+ else
+ serv->flags &= ~MASTER_FLAG_MARK;
if (entry->flags & MASTER_FLAG_CONDWAKE)
serv->flags |= MASTER_FLAG_CONDWAKE;
else
diff --git a/external/ibm-public/postfix/dist/src/master/master_listen.c b/external/ibm-public/postfix/dist/src/master/master_listen.c
index 28bc9907969..b9c3d7e7548 100644
--- a/external/ibm-public/postfix/dist/src/master/master_listen.c
+++ b/external/ibm-public/postfix/dist/src/master/master_listen.c
@@ -1,4 +1,4 @@
-/* $NetBSD: master_listen.c,v 1.1.1.2 2013/09/25 19:06:32 tron Exp $ */
+/* $NetBSD: master_listen.c,v 1.1.1.3 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -37,6 +37,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -100,6 +105,17 @@ void master_listen_init(MASTER_SERV *serv)
break;
/*
+ * UNIX-domain datagram listener endpoints always come as singlets.
+ */
+ case MASTER_SERV_TYPE_UXDG:
+ set_eugid(var_owner_uid, var_owner_gid);
+ serv->listen_fd[0] =
+ unix_dgram_listen(serv->name, NON_BLOCKING);
+ close_on_exec(serv->listen_fd[0], CLOSE_ON_EXEC);
+ set_ugid(getuid(), getgid());
+ break;
+
+ /*
* FIFO listener endpoints always come as singlets.
*/
case MASTER_SERV_TYPE_FIFO:
diff --git a/external/ibm-public/postfix/dist/src/master/master_proto.h b/external/ibm-public/postfix/dist/src/master/master_proto.h
index f92a4c8e2c4..b4adef70cef 100644
--- a/external/ibm-public/postfix/dist/src/master/master_proto.h
+++ b/external/ibm-public/postfix/dist/src/master/master_proto.h
@@ -1,4 +1,4 @@
-/* $NetBSD: master_proto.h,v 1.1.1.1 2009/06/23 10:08:49 tron Exp $ */
+/* $NetBSD: master_proto.h,v 1.1.1.2 2020/03/18 18:59:34 christos Exp $ */
/*++
/* NAME
@@ -18,6 +18,7 @@
#define MASTER_XPORT_NAME_FIFO "fifo" /* local IPC */
#define MASTER_XPORT_NAME_INET "inet" /* non-local IPC */
#define MASTER_XPORT_NAME_PASS "pass" /* local IPC */
+#define MASTER_XPORT_NAME_UXDG "unix-dgram" /* local IPC */
/*
* Format of a status message sent by a child process to the process
@@ -67,5 +68,10 @@ extern int master_notify(int, unsigned, int); /* encapsulate status msg */
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
diff --git a/external/ibm-public/postfix/dist/src/milter/Makefile.in b/external/ibm-public/postfix/dist/src/milter/Makefile.in
index fa58690aac1..98e3ba00822 100644
--- a/external/ibm-public/postfix/dist/src/milter/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/milter/Makefile.in
@@ -76,7 +76,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/oqmgr/Makefile.in b/external/ibm-public/postfix/dist/src/oqmgr/Makefile.in
index 8a2ac56b09b..593042b2833 100644
--- a/external/ibm-public/postfix/dist/src/oqmgr/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/oqmgr/Makefile.in
@@ -62,7 +62,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -106,6 +106,7 @@ qmgr_active.o: ../../include/dsn_buf.h
qmgr_active.o: ../../include/dsn_mask.h
qmgr_active.o: ../../include/events.h
qmgr_active.o: ../../include/htable.h
+qmgr_active.o: ../../include/info_log_addr_form.h
qmgr_active.o: ../../include/mail_open_ok.h
qmgr_active.o: ../../include/mail_params.h
qmgr_active.o: ../../include/mail_queue.h
diff --git a/external/ibm-public/postfix/dist/src/oqmgr/qmgr_error.c b/external/ibm-public/postfix/dist/src/oqmgr/qmgr_error.c
index 985d87f0e05..bdc03f465ee 100644
--- a/external/ibm-public/postfix/dist/src/oqmgr/qmgr_error.c
+++ b/external/ibm-public/postfix/dist/src/oqmgr/qmgr_error.c
@@ -1,4 +1,4 @@
-/* $NetBSD: qmgr_error.c,v 1.1.1.1 2009/06/23 10:08:50 tron Exp $ */
+/* $NetBSD: qmgr_error.c,v 1.1.1.2 2020/03/18 18:59:35 christos Exp $ */
/*++
/* NAME
@@ -24,7 +24,7 @@
/*
/* qmgr_error_queue() looks up an error queue for the specified
/* service and problem. The result is null if the queue is not
-/* availabe.
+/* available.
/*
/* qmgr_error_nexthop() computes the next-hop information for
/* the specified problem. The result must be passed to myfree().
diff --git a/external/ibm-public/postfix/dist/src/pickup/Makefile.in b/external/ibm-public/postfix/dist/src/pickup/Makefile.in
index 300b9e15b5f..9c8766ffce1 100644
--- a/external/ibm-public/postfix/dist/src/pickup/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/pickup/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -63,6 +63,7 @@ pickup.o: ../../include/attr.h
pickup.o: ../../include/check_arg.h
pickup.o: ../../include/cleanup_user.h
pickup.o: ../../include/htable.h
+pickup.o: ../../include/info_log_addr_form.h
pickup.o: ../../include/input_transp.h
pickup.o: ../../include/iostuff.h
pickup.o: ../../include/lex_822.h
diff --git a/external/ibm-public/postfix/dist/src/pipe/Makefile.in b/external/ibm-public/postfix/dist/src/pipe/Makefile.in
index 2649d8ca1f4..42159ca3024 100644
--- a/external/ibm-public/postfix/dist/src/pipe/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/pipe/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/postalias/Makefile.in b/external/ibm-public/postfix/dist/src/postalias/Makefile.in
index 7982af60395..5e5b72dca97 100644
--- a/external/ibm-public/postfix/dist/src/postalias/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postalias/Makefile.in
@@ -28,33 +28,35 @@ tests: test1 test2 fail_test
root_tests:
test1: $(PROG) map.in map-abc1.ref map-ghi1.ref map-uABC1.ref
- ./$(PROG) map.in
+ ${SHLIB_ENV} ${VALGRIND} ./$(PROG) map.in
for key in abc ghi; \
do \
- ./$(PROG) -q $${key} map.in | diff map-$${key}1.ref -; \
+ ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -q $${key} map.in | diff map-$${key}1.ref -; \
done
- ./$(PROG) -f map.in
+ ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -f map.in
for key in ABC; \
do \
- ./$(PROG) -fq $${key} map.in | diff map-u$${key}1.ref -; \
+ ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -fq $${key} map.in | diff map-u$${key}1.ref -; \
done
rm -f map.in.db
test2: $(PROG) map.in map-abc2.ref map-ghi2.ref map-uABC2.ref
- ./$(PROG) map.in
+ ${SHLIB_ENV} ${VALGRIND} ./$(PROG) map.in
for key in abc ghi; \
do \
- echo $${key} | ./$(PROG) -q - map.in | diff map-$${key}2.ref -; \
+ echo $${key} | ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -q - map.in | diff map-$${key}2.ref -; \
done
- ./$(PROG) -f map.in
+ ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -f map.in
for key in ABC; \
do \
- echo $${key} | ./$(PROG) -fq - map.in | diff map-u$${key}2.ref -; \
+ echo $${key} | ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -fq - map.in | diff map-u$${key}2.ref -; \
done
rm -f map.in.db
fail_test: $(PROG) aliases fail_test.in fail_test.ref
- -(sh fail_test.in 2>&1 || exit 0) | sed 's/No error:/Unknown error:/' > fail_test.tmp
+ -(${SHLIB_ENV} sh fail_test.in 2>&1 || exit 0) | sed \
+ -e 's/No error:/Unknown error:/' \
+ -e 's/Success/Unknown error: 0/' > fail_test.tmp
diff fail_test.ref fail_test.tmp
rm -f fail_test.tmp
@@ -83,22 +85,24 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
postalias.o: ../../include/argv.h
postalias.o: ../../include/check_arg.h
+postalias.o: ../../include/clean_env.h
postalias.o: ../../include/dict.h
postalias.o: ../../include/dict_proxy.h
postalias.o: ../../include/mail_conf.h
postalias.o: ../../include/mail_dict.h
postalias.o: ../../include/mail_params.h
+postalias.o: ../../include/mail_parm_split.h
postalias.o: ../../include/mail_task.h
postalias.o: ../../include/mail_version.h
+postalias.o: ../../include/maillog_client.h
postalias.o: ../../include/mkmap.h
postalias.o: ../../include/msg.h
-postalias.o: ../../include/msg_syslog.h
postalias.o: ../../include/msg_vstream.h
postalias.o: ../../include/myflock.h
postalias.o: ../../include/mymalloc.h
diff --git a/external/ibm-public/postfix/dist/src/postalias/fail_test.in b/external/ibm-public/postfix/dist/src/postalias/fail_test.in
index 1502c2ce600..4a68f6e6b37 100644
--- a/external/ibm-public/postfix/dist/src/postalias/fail_test.in
+++ b/external/ibm-public/postfix/dist/src/postalias/fail_test.in
@@ -1,7 +1,7 @@
-./postalias -q xx fail:aliases
-echo xx | ./postalias -q - fail:aliases
-./postalias -d xx fail:aliases
-echo xx | ./postalias -d - fail:aliases
-./postalias -s fail:aliases
-./postalias -i fail:aliases < aliases
-./postalias fail:aliases
+${VALGRIND} ./postalias -q xx fail:aliases
+echo xx | ${VALGRIND} ./postalias -q - fail:aliases
+${VALGRIND} ./postalias -d xx fail:aliases
+echo xx | ${VALGRIND} ./postalias -d - fail:aliases
+${VALGRIND} ./postalias -s fail:aliases
+${VALGRIND} ./postalias -i fail:aliases < aliases
+${VALGRIND} ./postalias fail:aliases
diff --git a/external/ibm-public/postfix/dist/src/postcat/Makefile.in b/external/ibm-public/postfix/dist/src/postcat/Makefile.in
index ba6dd331b47..06c5eb804d6 100644
--- a/external/ibm-public/postfix/dist/src/postcat/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postcat/Makefile.in
@@ -94,18 +94,21 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
+postcat.o: ../../include/argv.h
postcat.o: ../../include/attr.h
postcat.o: ../../include/check_arg.h
+postcat.o: ../../include/clean_env.h
postcat.o: ../../include/htable.h
postcat.o: ../../include/iostuff.h
postcat.o: ../../include/is_header.h
postcat.o: ../../include/lex_822.h
postcat.o: ../../include/mail_conf.h
postcat.o: ../../include/mail_params.h
+postcat.o: ../../include/mail_parm_split.h
postcat.o: ../../include/mail_proto.h
postcat.o: ../../include/mail_queue.h
postcat.o: ../../include/mail_version.h
diff --git a/external/ibm-public/postfix/dist/src/postconf/Makefile.in b/external/ibm-public/postfix/dist/src/postconf/Makefile.in
index 8bf5a195ab6..dc382fe1f7a 100644
--- a/external/ibm-public/postfix/dist/src/postconf/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postconf/Makefile.in
@@ -15,7 +15,9 @@ TESTPROG=
MAKES = bool_table.h bool_vars.h int_table.h int_vars.h str_table.h \
str_vars.h time_table.h time_vars.h raw_table.h raw_vars.h \
nint_table.h nint_vars.h nbool_table.h nbool_vars.h long_table.h \
- long_vars.h str_fn_table.h str_fn_vars.h
+ long_vars.h str_fn_table.h str_fn_vars.h
+DB_MAKES= pcf_ldap_suffixes.h pcf_memcache_suffixes.h pcf_mysql_suffixes.h \
+ pcf_pgsql_suffixes.h pcf_sqlite_suffixes.h
TEST_TMP= main.cf master.cf test*.tmp
DUMMIES = makes_dummy # for "make -j"
PROG = postconf
@@ -36,7 +38,7 @@ $(PROG): $(OBJS) $(LIBS)
rm -f $@
(echo "# DO NOT EDIT THIS FILE. EDIT THE MAIN.CF FILE INSTEAD. THE"; \
echo "# TEXT HERE JUST SHOWS DEFAULT SETTINGS BUILT INTO POSTFIX."; \
- echo "#"; $(SHLIB_ENV) $(SHLIB_ENV) ./$(PROG) -d -c ../../conf) | \
+ echo "#"; $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -d -c ../../conf) | \
egrep -v '^(myhostname|mydomain|mynetworks|process_name|process_id) ' >$@
$(OBJS): ../../conf/makedefs.out
@@ -52,7 +54,7 @@ tests: test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 test11 \
test31 test32 test33 test34 test35 test36 test37 test39 test40 test41 \
test42 test43 test44 test45 test46 test47 test48 test49 test50 test51 \
test52 test53 test54 test55 test56 test57 test58 test59 test60 test61 \
- test62 test63
+ test62 test63 test64 test65 test66 test67 test68 test69 test70
root_tests:
@@ -67,6 +69,22 @@ makes_dummy: $(INC_DIR)/mail_params.h ../global/mail_params.c extract.awk Makefi
$(AWK) -f extract.awk ../*/*.c | $(SHELL)
touch makes_dummy
+$(DB_MAKES): extract_cfg.sh Makefile.in
+
+pcf_ldap_suffixes.h: ../global/dict_ldap.c
+ sh extract_cfg.sh -d ../global/dict_ldap.c > $@
+
+pcf_memcache_suffixes.h: ../global/dict_memcache.c
+ sh extract_cfg.sh -d ../global/dict_memcache.c > $@
+
+pcf_mysql_suffixes.h: ../global/dict_mysql.c
+ sh extract_cfg.sh -d -s ../global/dict_mysql.c > $@
+
+pcf_pgsql_suffixes.h: ../global/dict_pgsql.c
+ sh extract_cfg.sh -d -s ../global/dict_pgsql.c > $@
+
+pcf_sqlite_suffixes.h: ../global/dict_sqlite.c
+ sh extract_cfg.sh -d -s ../global/dict_sqlite.c > $@
# Define two parameters with smtpd_restriction_classes. One will be ignored.
@@ -76,7 +94,7 @@ test1: $(PROG) test1.ref
echo smtpd_restriction_classes = foo bar >> main.cf
echo foo = yes >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test1.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test1.tmp 2>&1
diff test1.ref test1.tmp
rm -f main.cf master.cf test1.tmp
@@ -88,7 +106,7 @@ test2: $(PROG) test2.ref
echo restriction_classes = foo bar >> main.cf
echo foo = yes >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test2.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test2.tmp 2>&1
diff test2.ref test2.tmp
rm -f main.cf master.cf test2.tmp
@@ -101,7 +119,7 @@ test3: $(PROG) test3.ref
echo 'bar = $$foo' >> main.cf
echo 'always_bcc = $$bar' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test3.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test3.tmp 2>&1
diff test3.ref test3.tmp
rm -f main.cf master.cf test3.tmp
@@ -115,7 +133,7 @@ test4: $(PROG) test4.ref
echo smtpd unix - n n - 0 smtpd >> master.cf
echo ' -o always_bcc=$$bar' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test4.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test4.tmp 2>&1
diff test4.ref test4.tmp
rm -f main.cf master.cf test4.tmp
@@ -131,7 +149,7 @@ test4b: $(PROG) test4b.ref
echo ' -o foo=xxx -o bar=yyy -o baz=zzz' >> master.cf
echo '#smtpd2 unix - n n - 0 smtpd' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test4b.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test4b.tmp 2>&1
diff test4b.ref test4b.tmp
rm -f main.cf master.cf test4b.tmp
@@ -144,7 +162,7 @@ test5: $(PROG) test5.ref
echo smtpd unix - n n - 0 smtpd >> master.cf
echo ' -o bar=yes -o always_bcc=$$bar -o' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test5.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test5.tmp 2>&1
diff test5.ref test5.tmp
rm -f main.cf master.cf test5.tmp
@@ -155,7 +173,7 @@ test6: $(PROG) test6.ref
touch main.cf master.cf
echo whatevershebrings unix - n n - 0 pipe >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test6.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test6.tmp
diff test6.ref test6.tmp
rm -f main.cf master.cf test6.tmp
@@ -166,7 +184,7 @@ test7: $(PROG) test7.ref
touch main.cf master.cf
echo whatevershebrings unix - n n - 0 spawn >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test7.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test7.tmp
diff test7.ref test7.tmp
rm -f main.cf master.cf test7.tmp
@@ -176,7 +194,7 @@ test8: $(PROG) test8.ref
echo whatevershebrings inet - n n - 0 spawn >> master.cf
echo whatevershebrings_time_limit=1 >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test8.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test8.tmp
diff test8.ref test8.tmp
rm -f main.cf master.cf test8.tmp
@@ -186,7 +204,7 @@ test9: $(PROG) test9.ref
echo foo inet - n n - 0 spawn >> master.cf
echo bar unix - n n - 0 spawn >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . -M '*'/inet >test9.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M '*'/inet >test9.tmp 2>&1
diff test9.ref test9.tmp
rm -f main.cf master.cf test9.tmp
@@ -196,7 +214,7 @@ test10: $(PROG) test10.ref
echo foo inet - n n - 0 spawn >> master.cf
echo bar unix - n n - 0 spawn >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . -M bar/inet foo/unix >test10.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M bar/inet foo/unix >test10.tmp 2>&1
diff test10.ref test10.tmp
rm -f main.cf master.cf test10.tmp
@@ -206,7 +224,7 @@ test11: $(PROG) test11.ref
echo foo inet - n n - 0 spawn >> master.cf
echo bar unix - n n - 0 spawn >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . -M >test11.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M >test11.tmp 2>&1
diff test11.ref test11.tmp
rm -f main.cf master.cf test11.tmp
@@ -221,7 +239,7 @@ test12: $(PROG) test12.ref
echo foo inet - n n - 0 spawn >> master.cf
echo ' -o always_bcc=$$bar -o' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . -M >test12.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -M >test12.tmp 2>&1
diff test12.ref test12.tmp
rm -f main.cf master.cf test12.tmp
@@ -235,7 +253,7 @@ test13: $(PROG) test13.ref
echo foo inet - n n - 0 spawn >> master.cf
echo ' -o smtpd_restriction_classes=bar' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test13.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test13.tmp 2>&1
diff test13.ref test13.tmp
rm -f main.cf master.cf test13.tmp
@@ -248,7 +266,7 @@ test14: $(PROG) test14.ref
echo foo inet - n n - 0 spawn >> master.cf
echo ' -o bar=yes -o baz=xx' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test14.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test14.tmp 2>&1
diff test14.ref test14.tmp
rm -f main.cf master.cf test14.tmp
@@ -262,7 +280,7 @@ test15: $(PROG) test15.ref
echo foo inet - n n - 0 spawn >> master.cf
echo ' -o bar=yes -o always_bcc=$$bar$$baz' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test15.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test15.tmp 2>&1
diff test15.ref test15.tmp
rm -f main.cf master.cf test15.tmp
@@ -271,14 +289,14 @@ test15: $(PROG) test15.ref
test16: $(PROG) test16.ref
rm -f main.cf master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test16.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test16.tmp 2>&1
diff test16.ref test16.tmp
rm -f main.cf master.cf test16.tmp
test17: $(PROG) test17.ref
rm -f main.cf master.cf
touch -t 197101010000 main.cf
- -$(SHLIB_ENV) ./$(PROG) -Mc . >test17.tmp 2>&1; exit 0
+ -$(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mc . >test17.tmp 2>&1; exit 0
diff test17.ref test17.tmp
rm -f main.cf master.cf test17.tmp
@@ -290,7 +308,7 @@ test18: $(PROG) test18.ref
echo virtual_maps=xxx >> main.cf
echo smtpd_client_connection_limit_exceptions=yyy >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test18.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test18.tmp 2>&1
diff test18.ref test18.tmp
rm -f main.cf master.cf test18.tmp
@@ -302,7 +320,7 @@ test19: $(PROG) test19.ref
echo forward_path='$$'aaaa >> main.cf
echo default_rbl_reply='$$'bbbb >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test19.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test19.tmp 2>&1
diff test19.ref test19.tmp
rm -f main.cf master.cf test19.tmp
@@ -314,7 +332,7 @@ test20: $(PROG) test20.ref
echo foo inet - n n - 0 spawn >> master.cf
echo ' -o always_bcc=$$bar$$baz' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc . >test20.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc . >test20.tmp 2>&1
diff test20.ref test20.tmp
rm -f main.cf master.cf test20.tmp
@@ -326,7 +344,7 @@ test21: $(PROG) test21.ref
echo forward_path = xxxxxxxxxxxxx xxxxxxxxxxxxxx xxxxxxxxxxxx \
xxxxxxxxxxxxx xxxxxxxxxxxxxx >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nfc . >test21.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nfc . >test21.tmp 2>&1
diff test21.ref test21.tmp
rm -f main.cf master.cf test21.tmp
@@ -337,7 +355,7 @@ test22: $(PROG) test22.ref
touch main.cf master.cf
echo whatevershebrings unix - n n - 0 smtp >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test22.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . 2>&1 | grep whatevershebrings >test22.tmp
diff test22.ref test22.tmp
rm -f main.cf master.cf test22.tmp
@@ -351,7 +369,7 @@ test23: $(PROG) test23.ref
echo whatevershebrings unix - n n - 0 smtp >> master.cf
echo ' -o always_bcc=$$name' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . -nC builtin >test23.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -nC builtin >test23.tmp 2>&1
diff test23.ref test23.tmp
rm -f main.cf master.cf test23.tmp
@@ -363,7 +381,7 @@ test24: $(PROG) test24.ref
echo whatevershebrings unix - n n - 0 smtp >> master.cf
echo ' -o always_bcc=$$name' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . -nC user >test24.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -nC user >test24.tmp 2>&1
diff test24.ref test24.tmp
rm -f main.cf master.cf test24.tmp
@@ -375,7 +393,7 @@ test25: $(PROG) test25.ref
echo whatevershebrings unix - n n - 0 smtp >> master.cf
echo ' -o always_bcc=$$name' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . -C service 2>&1 | grep whatevershebrings >test25.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -C service 2>&1 | grep whatevershebrings >test25.tmp
diff test25.ref test25.tmp
rm -f main.cf master.cf test25.tmp
@@ -389,7 +407,7 @@ test26: $(PROG) test26.ref
echo whatevershebrings unix - n n - 0 smtp >> master.cf
echo ' -o always_bcc=$$name' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . -C all >test26.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . -C all >test26.tmp 2>&1
diff test26.ref test26.tmp
rm -f main.cf master.cf test26.tmp
@@ -401,7 +419,7 @@ test27: $(PROG) test27.ref
echo whatevershebrings unix - n n - 0 smtp >> master.cf
echo ' -o always_bcc=$$name' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -c . -C all 2>&1 | grep whatevershebrings >test27.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c . -C all 2>&1 | grep whatevershebrings >test27.tmp
diff test27.ref test27.tmp
rm -f main.cf master.cf test27.tmp
@@ -418,11 +436,11 @@ test28: $(PROG) test28.ref
echo 'yy = aap' >> main.cf
echo 'db = memcache' >> main.cf
echo whatevershebrings unix - n n - 0 other >> master.cf
- echo ' -o body_checks=$$db:zz' >> master.cf
- echo 'zz_domain = whatever' >> main.cf
+ echo ' -o body_checks=$$db:$$zz' >> master.cf
+ echo 'aap_domain = whatever' >> main.cf
echo 'aa_domain = whatever' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test28.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test28.tmp 2>&1
diff test28.ref test28.tmp
rm -f main.cf master.cf test28.tmp
@@ -447,7 +465,7 @@ test29: $(PROG) test29.ref
echo 'memcachefoo_domain = bar' >> main.cf
echo 'memcachefoo_domainx = bar' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test29.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test29.tmp 2>&1
diff test29.ref test29.tmp
rm -f main.cf master.cf test29.tmp
@@ -464,7 +482,7 @@ test30: $(PROG) test30.ref
echo ' -oheader_checks=$$p3' >> master.cf
echo ' -oheaderx_checks=$$p4' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nc . >test30.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test30.tmp 2>&1
diff test30.ref test30.tmp
rm -f main.cf master.cf test30.tmp
@@ -476,7 +494,7 @@ test31: $(PROG) test31.ref
echo 'smtpd_helo_restrictions=whatever' >> main.cf
echo 'smtpd_sender_restrictions=$$smtpd_helo_restrictions' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nxc . >test31.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc . >test31.tmp 2>&1
diff test31.ref test31.tmp
rm -f main.cf master.cf test31.tmp
@@ -487,7 +505,7 @@ test32: $(PROG) test32.ref
touch main.cf master.cf
echo 'relay_domains=whatever' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -xc . fast_flush_domains >test32.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . fast_flush_domains >test32.tmp 2>&1
diff test32.ref test32.tmp
rm -f main.cf master.cf test32.tmp
@@ -499,7 +517,7 @@ test33: $(PROG) test33.ref
echo 'mydestination=whatever' >> main.cf
echo 'always_bcc=$$relay_domains' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -xc . always_bcc >test33.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . always_bcc >test33.tmp 2>&1
diff test33.ref test33.tmp
rm -f main.cf master.cf test33.tmp
@@ -510,7 +528,7 @@ test34: $(PROG) test34.ref
echo 'process_name=xxx' >> main.cf
echo 'process_id=yyy' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -xc . mydestination process_name >test34.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . mydestination process_name >test34.tmp 2>&1
diff test34.ref test34.tmp
rm -f main.cf master.cf test34.tmp
@@ -522,7 +540,7 @@ test35: $(PROG) test35.ref
echo ' -o process_name=aaa' >> master.cf
echo ' -o process_id=bbb' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -xc . process_name >test35.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xc . process_name >test35.tmp 2>&1
diff test35.ref test35.tmp
rm -f main.cf master.cf test35.tmp
@@ -532,7 +550,7 @@ test36: $(PROG) test36.ref
echo 'mydestination=$$virtual_mapx' >> main.cf
echo 'virtual_alias_maps=$$virtual_maps' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nxc . >test36.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc . >test36.tmp 2>&1
diff test36.ref test36.tmp
rm -f main.cf master.cf test36.tmp
@@ -546,7 +564,7 @@ test37: $(PROG) test37.ref
echo ' -o always_bcc=$$aaa' >> master.cf
echo ' -o aaa=ccc' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfxc . >test37.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfxc . >test37.tmp 2>&1
diff test37.ref test37.tmp
rm -f main.cf master.cf test37.tmp
@@ -557,7 +575,7 @@ test39: $(PROG) test39.ref
echo bar inet - n n - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc . '*'/unix >test39.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc . '*'/unix >test39.tmp 2>&1
diff test39.ref test39.tmp
rm -f main.cf master.cf test39.tmp
@@ -569,7 +587,7 @@ test40: $(PROG) test40.ref
echo ' -vo ccc=$$aaa' >> master.cf
echo ' -v -oddd=$$ccc' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfxc . '*'/unix >test40.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfxc . '*'/unix >test40.tmp 2>&1
diff test40.ref test40.tmp
rm -f main.cf master.cf test40.tmp
@@ -580,11 +598,11 @@ test41: $(PROG) test41.ref
echo bar unix - n n - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Pc . bar/unix/xxx=yyy bar/unix/aaa=bbb >test41.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Mfc. >>test41.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Pc . bar/unix/xxx=YYY bar/unix/aaa=BBB >>test41.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Mfc. >>test41.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Pc . >>test41.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=yyy bar/unix/aaa=bbb >test41.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test41.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=YYY bar/unix/aaa=BBB >>test41.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test41.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . >>test41.tmp 2>&1
diff test41.ref test41.tmp
rm -f main.cf master.cf test41.tmp
@@ -595,11 +613,11 @@ test42: $(PROG) test42.ref
echo bar unix - n n - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Pc . bar/unix/xxx=yyy bar/unix/aaa=bbb >test42.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Mfc. >>test42.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Pc . >>test42.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -PXc. bar/unix/xxx bar/unix/aaa >>test42.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Mfc. >>test42.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . bar/unix/xxx=yyy bar/unix/aaa=bbb >test42.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test42.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Pc . >>test42.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -PXc. bar/unix/xxx bar/unix/aaa >>test42.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test42.tmp 2>&1
diff test42.ref test42.tmp
rm -f main.cf master.cf test42.tmp
@@ -610,8 +628,8 @@ test43: $(PROG) test43.ref
echo bar unix - n n - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Fc . bar/unix/chroot=y bar/unix/command='aa -stuffobb=cc dd' >test43.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Mfc. >>test43.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Fc . bar/unix/chroot=y bar/unix/command='aa -stuffobb=cc dd' >test43.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test43.tmp 2>&1
diff test43.ref test43.tmp
rm -f main.cf master.cf test43.tmp
@@ -622,8 +640,8 @@ test44: $(PROG) test44.ref
echo bar unix - n n - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mc . bar/unix='xx inet - n n - 0 aa -stuffobb=cc dd' >test44.tmp 2>&1
- $(SHLIB_ENV) ./$(PROG) -Mfc. >>test44.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mc . bar/unix='xx inet - n n - 0 aa -stuffobb=cc dd' >test44.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >>test44.tmp 2>&1
diff test44.ref test44.tmp
rm -f main.cf master.cf test44.tmp
@@ -634,7 +652,7 @@ test45: $(PROG) test45.ref
echo bar xxxx - n n - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test45.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test45.tmp 2>&1 || true
diff test45.ref test45.tmp
rm -f main.cf master.cf test45.tmp
@@ -645,7 +663,7 @@ test46: $(PROG) test46.ref
echo bar inet X n n - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test46.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test46.tmp 2>&1 || true
diff test46.ref test46.tmp
rm -f main.cf master.cf test46.tmp
@@ -656,7 +674,7 @@ test47: $(PROG) test47.ref
echo bar inet - X n - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test47.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test47.tmp 2>&1 || true
diff test47.ref test47.tmp
rm -f main.cf master.cf test47.tmp
@@ -667,7 +685,7 @@ test48: $(PROG) test48.ref
echo bar inet - n X - 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test48.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test48.tmp 2>&1 || true
diff test48.ref test48.tmp
rm -f main.cf master.cf test48.tmp
@@ -678,7 +696,7 @@ test49: $(PROG) test49.ref
echo bar inet - n n X 0 other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test49.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test49.tmp 2>&1 || true
diff test49.ref test49.tmp
rm -f main.cf master.cf test49.tmp
@@ -689,7 +707,7 @@ test50: $(PROG) test50.ref
echo bar inet - n n - X other >> master.cf
echo baz unix - n n - 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test50.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test50.tmp 2>&1 || true
diff test50.ref test50.tmp
rm -f main.cf master.cf test50.tmp
@@ -700,7 +718,7 @@ test51: $(PROG) test51.ref
echo bar inet - n n X? 0 other >> master.cf
echo baz unix - n n 0? 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test51.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test51.tmp 2>&1 || true
diff test51.ref test51.tmp
rm -f main.cf master.cf test51.tmp
@@ -711,8 +729,8 @@ test52: $(PROG) test52.ref
echo bar inet - n n 0 0 other >> master.cf
echo baz unix - n n 0 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -MXc. bar/inet foo/unix xxx/yyy
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test52.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -MXc. bar/inet foo/unix xxx/yyy
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test52.tmp 2>&1 || true
diff test52.ref test52.tmp
rm -f main.cf master.cf test52.tmp
@@ -723,7 +741,7 @@ test53: $(PROG) test53.ref
echo bar inet - n n 0 0 other >> master.cf
echo baz unix - n n 0 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -M#c. bar/inet xxx/yyy
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet xxx/yyy
diff test53.ref master.cf
rm -f main.cf master.cf test53.tmp
@@ -734,7 +752,7 @@ test54: $(PROG) test54.ref
echo bar inet - n n 0 0 other >> master.cf
echo baz unix - n n 0 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -M#c. bar/inet foo/unix
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet foo/unix
diff test54.ref master.cf
rm -f main.cf master.cf test54.tmp
@@ -745,7 +763,7 @@ test55: $(PROG) test55.ref
echo bar inet - n n 0 0 other >> master.cf
echo baz unix - n n 0 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -M#c. bar/inet baz/unix
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet baz/unix
diff test55.ref master.cf
rm -f main.cf master.cf test55.tmp
@@ -758,7 +776,7 @@ test56: $(PROG) test56.ref
echo " -o second" >> master.cf
echo baz unix - n n 0 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -M#c. bar/inet xxx/yyy
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -M#c. bar/inet xxx/yyy
diff test56.ref master.cf
rm -f main.cf master.cf test56.tmp
@@ -775,7 +793,7 @@ test57: $(PROG) test57.ref
echo 't1 = Postfix 2.11 $${{$${x?bug:x}} == {bug}?in}compatible' >> main.cf
echo 't2 = $$t1' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -nxc. >test57.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nxc. >test57.tmp 2>&1
diff test57.ref test57.tmp
rm -f main.cf master.cf test57.tmp
@@ -788,7 +806,7 @@ test58: $(PROG) test58.ref
echo 'yy_backup = bbb' >> main.cf
echo 'yy_bogus = bbb' >> main.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./postconf -nc. >test58.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./postconf -nc. >test58.tmp 2>&1 || true
diff test58.ref test58.tmp
rm -f main.cf master.cf test58.tmp
@@ -804,7 +822,7 @@ test59: $(PROG) test59.ref
echo " { arg3a arg3b " >> master.cf
echo baz unix - n n 0 0 other >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Mfc. >test59.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Mfc. >test59.tmp 2>&1 || true
diff test59.ref test59.tmp
rm -f main.cf master.cf test59.tmp
@@ -814,7 +832,7 @@ test60: $(PROG) test60.ref
echo foo unix - n n - 0 other >> master.cf
echo ' -o always_bcc=bar' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Fhc. >test60.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Fhc. >test60.tmp 2>&1 || true
diff test60.ref test60.tmp
rm -f main.cf master.cf test60.tmp
@@ -824,7 +842,7 @@ test61: $(PROG) test61.ref
echo foo unix - n n - 0 other >> master.cf
echo ' -o always_bcc=bar' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -Phc. >test61.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -Phc. >test61.tmp 2>&1 || true
diff test61.ref test61.tmp
rm -f main.cf master.cf test61.tmp
@@ -834,7 +852,7 @@ test62: $(PROG) test62.ref
echo foo unix - n n - 0 other >> master.cf
echo ' -o always_bcc=bar' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -FHc. >test62.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -FHc. >test62.tmp 2>&1 || true
diff test62.ref test62.tmp
rm -f main.cf master.cf test62.tmp
@@ -844,10 +862,109 @@ test63: $(PROG) test63.ref
echo foo unix - n n - 0 other >> master.cf
echo ' -o always_bcc=bar' >> master.cf
touch -t 197101010000 main.cf
- $(SHLIB_ENV) ./$(PROG) -PHc. >test63.tmp 2>&1 || true
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -PHc. >test63.tmp 2>&1 || true
diff test63.ref test63.tmp
rm -f main.cf master.cf test63.tmp
+# main.cf overrides built-in default.
+
+test64: $(PROG) test64.ref
+ rm -f main.cf master.cf
+ touch main.cf master.cf
+ echo 'relayhost = relay-from-main.cf' >> main.cf
+ touch -t 197101010000 main.cf
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. relayhost >test64.tmp 2>&1
+ diff test64.ref test64.tmp
+ rm -f main.cf master.cf test64.tmp
+
+# '-o name=value' overrides main.cf.
+
+test65: $(PROG) test65.ref
+ rm -f main.cf master.cf
+ touch main.cf master.cf
+ echo 'relayhost = relay-from-main.cf' >> main.cf
+ touch -t 197101010000 main.cf
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. -o relayhost=relay-from-cmd-line relayhost >test65.tmp 2>&1
+ diff test65.ref test65.tmp
+ rm -f main.cf master.cf test65.tmp
+
+# unknown parameters in database configuration file (absolute pathname).
+
+test66: $(PROG) test66.ref
+ rm -f main.cf master.cf
+ touch master.cf
+ echo alias_maps = ldap:`pwd`/test66.cf >> main.cf
+ echo " " mysql:`pwd`/test66.cf >> main.cf
+ echo " " pgsql:`pwd`/test66.cf >> main.cf
+ echo " " sqlite:`pwd`/test66.cf >> main.cf
+ echo " " memcache:`pwd`/test66.cf >> main.cf
+ echo junk = junk >> test66.cf
+ touch -t 197101010000 main.cf
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. 2>test66.tmp >/dev/null
+ sed "s;PWD;`pwd`;" test66.ref | diff - test66.tmp
+ rm -f main.cf master.cf test66.tmp test66.cf
+
+# expand process name and service name in master.cf.
+
+test67: $(PROG) test67.ref
+ rm -f main.cf master.cf
+ touch master.cf
+ echo 'smtp inet n - n - - smtpd' >>master.cf
+ echo ' -o test1_process_name=$$process_name' >> master.cf
+ echo ' -o test1_service_name=$$service_name' >> master.cf
+ echo 'smtp unix n - n - - smtp' >>master.cf
+ echo ' -o test2_process_name=$$process_name' >> master.cf
+ echo ' -o test2_service_name=$$service_name' >> master.cf
+ touch -t 197101010000 main.cf
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -xMfc. >test67.tmp 2>&1
+ diff test67.ref test67.tmp
+ rm -f main.cf master.cf test67.tmp
+
+test68: $(PROG) test68.ref
+ rm -f main.cf master.cf
+ touch master.cf
+ echo foo = ldap:`pwd` >> main.cf
+ echo 'alias_maps = $$foo/test68.cf' >> main.cf
+ echo " " mysql:`pwd`/test68.cf >> main.cf
+ echo " " pgsql:`pwd`/test68.cf >> main.cf
+ echo " " sqlite:`pwd`/test68.cf >> main.cf
+ echo " " memcache:`pwd`/test68.cf >> main.cf
+ echo junk = junk >> test68.cf
+ touch -t 197101010000 main.cf
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -c. 2>test68.tmp >/dev/null
+ sed "s;PWD;`pwd`;" test68.ref | diff - test68.tmp
+ rm -f main.cf master.cf test68.tmp test68.cf
+
+# See also test28 for user-defined parameters defined in main.cf.
+
+test69: $(PROG) test69.ref
+ rm -f main.cf master.cf
+ touch main.cf master.cf
+ echo whatevershebrings unix - n n - 0 other >> master.cf
+ echo " -o ldap=ldap:`pwd`" >> master.cf
+ echo ' -o body_checks=$$ldap/test69.cf' >> master.cf
+ echo junk = junk >> test69.cf
+ touch -t 197101010000 main.cf
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test69.tmp 2>&1
+ sed "s;PWD;`pwd`;" test69.ref | diff - test69.tmp
+ rm -f main.cf master.cf test69.tmp test69.cf
+
+# Nasty nesting. Prove that the ldap table is detected. If support for
+# legacy table syntax is dropped, replace ldap:xyz with ldap:`pwd`/xyz
+# and update the good/bad parameter name tests.
+
+test70: $(PROG) test70.ref
+ rm -f main.cf master.cf
+ touch main.cf master.cf
+ echo "smtpd_client_restrictions = check_sender_access {" >>main.cf
+ echo " pipemap:{ldap:used} { search_order = foo, bar } }" >>main.cf
+ echo "used_server_host = 127.0.0.1" >>main.cf
+ echo "unused_server_host = 127.0.0.1" >>main.cf
+ touch -t 197101010000 main.cf
+ $(SHLIB_ENV) $(VALGRIND) ./$(PROG) -nc . >test70.tmp 2>&1
+ diff test70.ref test70.tmp
+ rm -f main.cf master.cf test70.tmp test70.cf
+
printfck: $(OBJS) $(PROG)
rm -rf printfck
mkdir printfck
@@ -861,7 +978,7 @@ lint:
clean:
rm -f *.o *core $(PROG) $(TESTPROG) junk $(MAKES) $(AUTOS) $(DUMMIES) \
- $(TEST_TMP)
+ $(TEST_TMP) $(DB_MAKES)
rm -rf printfck
tidy: clean
@@ -872,7 +989,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -949,6 +1066,7 @@ postconf_builtin.o: time_vars.h
postconf_dbms.o: ../../include/argv.h
postconf_dbms.o: ../../include/check_arg.h
postconf_dbms.o: ../../include/dict.h
+postconf_dbms.o: ../../include/dict_ht.h
postconf_dbms.o: ../../include/dict_ldap.h
postconf_dbms.o: ../../include/dict_memcache.h
postconf_dbms.o: ../../include/dict_mysql.h
@@ -970,6 +1088,11 @@ postconf_dbms.o: ../../include/sys_defs.h
postconf_dbms.o: ../../include/vbuf.h
postconf_dbms.o: ../../include/vstream.h
postconf_dbms.o: ../../include/vstring.h
+postconf_dbms.o: pcf_ldap_suffixes.h
+postconf_dbms.o: pcf_memcache_suffixes.h
+postconf_dbms.o: pcf_mysql_suffixes.h
+postconf_dbms.o: pcf_pgsql_suffixes.h
+postconf_dbms.o: pcf_sqlite_suffixes.h
postconf_dbms.o: postconf.h
postconf_dbms.o: postconf_dbms.c
postconf_edit.o: ../../include/argv.h
@@ -1100,6 +1223,7 @@ postconf_other.o: ../../include/dict.h
postconf_other.o: ../../include/dns.h
postconf_other.o: ../../include/htable.h
postconf_other.o: ../../include/mbox_conf.h
+postconf_other.o: ../../include/msg.h
postconf_other.o: ../../include/myaddrinfo.h
postconf_other.o: ../../include/myflock.h
postconf_other.o: ../../include/name_code.h
diff --git a/external/ibm-public/postfix/dist/src/postconf/extract_cfg.sh b/external/ibm-public/postfix/dist/src/postconf/extract_cfg.sh
new file mode 100644
index 00000000000..5901e951410
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postconf/extract_cfg.sh
@@ -0,0 +1,92 @@
+#!/bin/sh
+
+# To view the formatted manual page of this file, type:
+# POSTFIXSOURCE/mantools/srctoman - extract_cfg.sh | nroff -man
+
+#++
+# NAME
+# extract_cfg 1
+# SUMMARY
+# extract database parameter names from cfg_get_xxx() calls
+# SYNOPSIS
+# \fBextract_cfg [-d|-s] [\fIfile...\fB]\fR
+# DESCRIPTION
+# The \fBextract_cfg\fR command extracts the parameter names
+# from cfg_get_{str,int,bool}() calls in dict_xxx.c files. The
+# output is one parameter name per line, formatted as a C string
+# followed by comma.
+#
+# Options:
+# .IP \fB-d\fR
+# Add the "domain" parameter to the output. This is used by
+# the LDAP, memcache, and *SQL* tables.
+# .IP \fB-s\fR
+# Add the legacy SQL query parameters: "select_field", "table",
+# "where_field", and "additional_conditions".
+# LICENSE
+# .ad
+# .fi
+# The Secure Mailer license must be distributed with this software.
+# HISTORY
+# .ad
+# .fi
+# This command was introduced with Postfix 3.3.
+# AUTHOR(S)
+# Wietse Venema
+# Google, Inc.
+# 111 8th Avenue
+# New York, NY 10011, USA
+#--
+
+# In case not installed.
+m4 </dev/null || exit 1
+
+# Flags to add db_common parameter names.
+add_legacy_sql_query_params=
+add_domain_param=
+
+# Parse JCL.
+
+while :
+do
+ case "$1" in
+ -d) add_domain_param=1;;
+ -s) add_legacy_sql_query_params=1;;
+ -*) echo Bad option: $1 1>&2; exit 1;;
+ *) break;;
+ esac
+ shift
+done
+
+# We use m4 macros to extract arguments from cfg_get_xxx() calls that
+# may span multiple lines. We sandwich information of interest between
+# control-A characters. Multiple cfg_get_xxx() calls on the same line
+# should be OK, as long as the calls don't nest.
+
+(
+cat <<'EOF'
+define(`cfg_get_str',`$2
+')dnl
+define(`cfg_get_int',`$2
+')dnl
+define(`cfg_get_bool',`$2
+')dnl
+EOF
+# Convert selected C macro definitions into m4 macro definitions.
+sed 's/^#define[ ]*\([DICT_MC_NAME_A-Za-z0-9_]*\)[ ]*\("[^"]*"\)/define(`\1'"'"',`\2'"'"')/' "$@"
+) | m4 | awk -F '// { print $2 }' | (
+test -n "$add_domain_param" && {
+cat <<EOF
+"domain"
+EOF
+}
+test -n "$add_legacy_sql_query_params" && {
+cat <<EOF
+"table"
+"select_field"
+"where_field"
+"additional_conditions"
+EOF
+}
+cat -
+) | sort -u | sed 's/$/,/'
diff --git a/external/ibm-public/postfix/dist/src/postconf/test28.ref b/external/ibm-public/postfix/dist/src/postconf/test28.ref
index a16ae5e020b..cb117b009ee 100644
--- a/external/ibm-public/postfix/dist/src/postconf/test28.ref
+++ b/external/ibm-public/postfix/dist/src/postconf/test28.ref
@@ -1,10 +1,10 @@
+aap_domain = whatever
config_directory = .
db = memcache
-foo_domain = bar
header_checks = ldap:hh
hh_domain = whatever
yy = aap
-zz_domain = whatever
-./postconf: warning: ./main.cf: unused parameter: zz=$yy
+zz = $yy
+./postconf: warning: ./main.cf: unused parameter: foo_domain=bar
./postconf: warning: ./main.cf: unused parameter: aa_domain=whatever
./postconf: warning: ./main.cf: unused parameter: xx=proxy:ldap:foo
diff --git a/external/ibm-public/postfix/dist/src/postconf/test29.ref b/external/ibm-public/postfix/dist/src/postconf/test29.ref
index 75a2efafd32..d44e38dcbc3 100644
--- a/external/ibm-public/postfix/dist/src/postconf/test29.ref
+++ b/external/ibm-public/postfix/dist/src/postconf/test29.ref
@@ -1,16 +1,16 @@
config_directory = .
-ldapfoo_domain = bar
-memcachefoo_domain = bar
-mysqlfoo_domain = bar
-pgsqlfoo_domain = bar
-sqlitefoo_domain = bar
./postconf: warning: ./main.cf: unused parameter: sqlitexx=proxy:sqlite:sqlitefoo
./postconf: warning: ./main.cf: unused parameter: pgsqlxx=proxy:pgsql:pgsqlfoo
+./postconf: warning: ./main.cf: unused parameter: ldapfoo_domain=bar
./postconf: warning: ./main.cf: unused parameter: memcachefoo_domainx=bar
./postconf: warning: ./main.cf: unused parameter: sqlitefoo_domainx=bar
+./postconf: warning: ./main.cf: unused parameter: sqlitefoo_domain=bar
./postconf: warning: ./main.cf: unused parameter: memcachexx=proxy:memcache:memcachefoo
./postconf: warning: ./main.cf: unused parameter: mysqlxx=proxy:mysql:mysqlfoo
./postconf: warning: ./main.cf: unused parameter: ldapxx=proxy:ldap:ldapfoo
./postconf: warning: ./main.cf: unused parameter: ldapfoo_domainx=bar
+./postconf: warning: ./main.cf: unused parameter: memcachefoo_domain=bar
./postconf: warning: ./main.cf: unused parameter: pgsqlfoo_domainx=bar
./postconf: warning: ./main.cf: unused parameter: mysqlfoo_domainx=bar
+./postconf: warning: ./main.cf: unused parameter: mysqlfoo_domain=bar
+./postconf: warning: ./main.cf: unused parameter: pgsqlfoo_domain=bar
diff --git a/external/ibm-public/postfix/dist/src/postconf/test40.ref b/external/ibm-public/postfix/dist/src/postconf/test40.ref
index 1ca585ef656..fa3a5d71d90 100644
--- a/external/ibm-public/postfix/dist/src/postconf/test40.ref
+++ b/external/ibm-public/postfix/dist/src/postconf/test40.ref
@@ -4,3 +4,4 @@ foo unix - n n - 0 other -v
-o ccc=bbb
-v
-o ddd=bbb
+./postconf: warning: ./master.cf: unused parameter: ddd=$ccc
diff --git a/external/ibm-public/postfix/dist/src/postconf/test41.ref b/external/ibm-public/postfix/dist/src/postconf/test41.ref
index 9776e8edf73..f8200d40146 100644
--- a/external/ibm-public/postfix/dist/src/postconf/test41.ref
+++ b/external/ibm-public/postfix/dist/src/postconf/test41.ref
@@ -3,10 +3,16 @@ bar unix - n n - 0 other
-o xxx=yyy
-o aaa=bbb
baz unix - n n - 0 other
+./postconf: warning: ./master.cf: unused parameter: aaa=bbb
+./postconf: warning: ./master.cf: unused parameter: xxx=yyy
foo unix - n n - 0 other
bar unix - n n - 0 other
-o xxx=YYY
-o aaa=BBB
baz unix - n n - 0 other
+./postconf: warning: ./master.cf: unused parameter: aaa=BBB
+./postconf: warning: ./master.cf: unused parameter: xxx=YYY
bar/unix/aaa = BBB
bar/unix/xxx = YYY
+./postconf: warning: ./master.cf: unused parameter: aaa=BBB
+./postconf: warning: ./master.cf: unused parameter: xxx=YYY
diff --git a/external/ibm-public/postfix/dist/src/postconf/test42.ref b/external/ibm-public/postfix/dist/src/postconf/test42.ref
index fb95ae9610a..80676f350b8 100644
--- a/external/ibm-public/postfix/dist/src/postconf/test42.ref
+++ b/external/ibm-public/postfix/dist/src/postconf/test42.ref
@@ -3,8 +3,12 @@ bar unix - n n - 0 other
-o xxx=yyy
-o aaa=bbb
baz unix - n n - 0 other
+./postconf: warning: ./master.cf: unused parameter: aaa=bbb
+./postconf: warning: ./master.cf: unused parameter: xxx=yyy
bar/unix/aaa = bbb
bar/unix/xxx = yyy
+./postconf: warning: ./master.cf: unused parameter: aaa=bbb
+./postconf: warning: ./master.cf: unused parameter: xxx=yyy
foo unix - n n - 0 other
bar unix - n n - 0 other
baz unix - n n - 0 other
diff --git a/external/ibm-public/postfix/dist/src/postconf/test43.ref b/external/ibm-public/postfix/dist/src/postconf/test43.ref
index 34707f43036..2bfea0e05d3 100644
--- a/external/ibm-public/postfix/dist/src/postconf/test43.ref
+++ b/external/ibm-public/postfix/dist/src/postconf/test43.ref
@@ -3,3 +3,4 @@ bar unix - n y - 0 aa -stuff
-o bb=cc
dd
baz unix - n n - 0 other
+./postconf: warning: ./master.cf: unused parameter: bb=cc
diff --git a/external/ibm-public/postfix/dist/src/postconf/test44.ref b/external/ibm-public/postfix/dist/src/postconf/test44.ref
index e25a238998e..b8cf23d1cdf 100644
--- a/external/ibm-public/postfix/dist/src/postconf/test44.ref
+++ b/external/ibm-public/postfix/dist/src/postconf/test44.ref
@@ -3,3 +3,4 @@ xx inet - n n - 0 aa -stuff
-o bb=cc
dd
baz unix - n n - 0 other
+./postconf: warning: ./master.cf: unused parameter: bb=cc
diff --git a/external/ibm-public/postfix/dist/src/postconf/test59.ref b/external/ibm-public/postfix/dist/src/postconf/test59.ref
index 9c2e1fd7f79..3a7e57f6aa9 100644
--- a/external/ibm-public/postfix/dist/src/postconf/test59.ref
+++ b/external/ibm-public/postfix/dist/src/postconf/test59.ref
@@ -6,3 +6,5 @@ bar inet - n n 0 0 other
-o {name2=value2a value2b}
arg1a arg1b {arg2a arg2b} {arg3a arg3b}
baz unix - n n 0 0 other
+./postconf: warning: ./master.cf: unused parameter: name1=value1
+./postconf: warning: ./master.cf: unused parameter: name2=value2a value2b
diff --git a/external/ibm-public/postfix/dist/src/postconf/test64.ref b/external/ibm-public/postfix/dist/src/postconf/test64.ref
new file mode 100644
index 00000000000..595620cca73
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postconf/test64.ref
@@ -0,0 +1 @@
+relayhost = relay-from-main.cf
diff --git a/external/ibm-public/postfix/dist/src/postconf/test65.ref b/external/ibm-public/postfix/dist/src/postconf/test65.ref
new file mode 100644
index 00000000000..6bc7fd87154
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postconf/test65.ref
@@ -0,0 +1 @@
+relayhost = relay-from-cmd-line
diff --git a/external/ibm-public/postfix/dist/src/postconf/test66.ref b/external/ibm-public/postfix/dist/src/postconf/test66.ref
new file mode 100644
index 00000000000..bd35822e85f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postconf/test66.ref
@@ -0,0 +1,5 @@
+./postconf: warning: ldap:PWD/test66.cf: unused parameter: junk=junk
+./postconf: warning: mysql:PWD/test66.cf: unused parameter: junk=junk
+./postconf: warning: pgsql:PWD/test66.cf: unused parameter: junk=junk
+./postconf: warning: sqlite:PWD/test66.cf: unused parameter: junk=junk
+./postconf: warning: memcache:PWD/test66.cf: unused parameter: junk=junk
diff --git a/external/ibm-public/postfix/dist/src/postconf/test67.ref b/external/ibm-public/postfix/dist/src/postconf/test67.ref
new file mode 100644
index 00000000000..03def6f4600
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postconf/test67.ref
@@ -0,0 +1,10 @@
+smtp inet n - n - - smtpd
+ -o test1_process_name=smtpd
+ -o test1_service_name=smtp
+smtp unix n - n - - smtp
+ -o test2_process_name=smtp
+ -o test2_service_name=smtp
+./postconf: warning: ./master.cf: unused parameter: test1_process_name=$process_name
+./postconf: warning: ./master.cf: unused parameter: test1_service_name=$service_name
+./postconf: warning: ./master.cf: unused parameter: test2_process_name=$process_name
+./postconf: warning: ./master.cf: unused parameter: test2_service_name=$service_name
diff --git a/external/ibm-public/postfix/dist/src/postconf/test68.ref b/external/ibm-public/postfix/dist/src/postconf/test68.ref
new file mode 100644
index 00000000000..e2d7c7d0f8d
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postconf/test68.ref
@@ -0,0 +1,5 @@
+./postconf: warning: ldap:PWD/test68.cf: unused parameter: junk=junk
+./postconf: warning: mysql:PWD/test68.cf: unused parameter: junk=junk
+./postconf: warning: pgsql:PWD/test68.cf: unused parameter: junk=junk
+./postconf: warning: sqlite:PWD/test68.cf: unused parameter: junk=junk
+./postconf: warning: memcache:PWD/test68.cf: unused parameter: junk=junk
diff --git a/external/ibm-public/postfix/dist/src/postconf/test69.ref b/external/ibm-public/postfix/dist/src/postconf/test69.ref
new file mode 100644
index 00000000000..465a91fc020
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postconf/test69.ref
@@ -0,0 +1,2 @@
+./postconf: warning: ldap:PWD/test69.cf: unused parameter: junk=junk
+config_directory = .
diff --git a/external/ibm-public/postfix/dist/src/postconf/test70.ref b/external/ibm-public/postfix/dist/src/postconf/test70.ref
new file mode 100644
index 00000000000..d81a9d1b74c
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postconf/test70.ref
@@ -0,0 +1,4 @@
+config_directory = .
+smtpd_client_restrictions = check_sender_access { pipemap:{ldap:used} { search_order = foo, bar } }
+used_server_host = 127.0.0.1
+./postconf: warning: ./main.cf: unused parameter: unused_server_host=127.0.0.1
diff --git a/external/ibm-public/postfix/dist/src/postdrop/Makefile.in b/external/ibm-public/postfix/dist/src/postdrop/Makefile.in
index 024b09ec8e5..6ae3f7a9f7b 100644
--- a/external/ibm-public/postfix/dist/src/postdrop/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postdrop/Makefile.in
@@ -54,7 +54,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -74,8 +74,8 @@ postdrop.o: ../../include/mail_queue.h
postdrop.o: ../../include/mail_stream.h
postdrop.o: ../../include/mail_task.h
postdrop.o: ../../include/mail_version.h
+postdrop.o: ../../include/maillog_client.h
postdrop.o: ../../include/msg.h
-postdrop.o: ../../include/msg_syslog.h
postdrop.o: ../../include/msg_vstream.h
postdrop.o: ../../include/mymalloc.h
postdrop.o: ../../include/nvtable.h
diff --git a/external/ibm-public/postfix/dist/src/postfix/Makefile.in b/external/ibm-public/postfix/dist/src/postfix/Makefile.in
index 9be4ec19076..56ff96b0b15 100644
--- a/external/ibm-public/postfix/dist/src/postfix/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postfix/Makefile.in
@@ -58,7 +58,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -69,8 +69,8 @@ postfix.o: ../../include/mail_conf.h
postfix.o: ../../include/mail_params.h
postfix.o: ../../include/mail_parm_split.h
postfix.o: ../../include/mail_version.h
+postfix.o: ../../include/maillog_client.h
postfix.o: ../../include/msg.h
-postfix.o: ../../include/msg_syslog.h
postfix.o: ../../include/msg_vstream.h
postfix.o: ../../include/safe.h
postfix.o: ../../include/stringops.h
diff --git a/external/ibm-public/postfix/dist/src/postkick/Makefile.in b/external/ibm-public/postfix/dist/src/postkick/Makefile.in
index e0661c4c87d..a0c72710c70 100644
--- a/external/ibm-public/postfix/dist/src/postkick/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postkick/Makefile.in
@@ -54,17 +54,20 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
+postkick.o: ../../include/argv.h
postkick.o: ../../include/attr.h
postkick.o: ../../include/check_arg.h
+postkick.o: ../../include/clean_env.h
postkick.o: ../../include/events.h
postkick.o: ../../include/htable.h
postkick.o: ../../include/iostuff.h
postkick.o: ../../include/mail_conf.h
postkick.o: ../../include/mail_params.h
+postkick.o: ../../include/mail_parm_split.h
postkick.o: ../../include/mail_proto.h
postkick.o: ../../include/mail_version.h
postkick.o: ../../include/msg.h
diff --git a/external/ibm-public/postfix/dist/src/postlock/Makefile.in b/external/ibm-public/postfix/dist/src/postlock/Makefile.in
index d14c31a3209..fcb01d2e60b 100644
--- a/external/ibm-public/postfix/dist/src/postlock/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postlock/Makefile.in
@@ -54,12 +54,13 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
postlock.o: ../../include/argv.h
postlock.o: ../../include/check_arg.h
+postlock.o: ../../include/clean_env.h
postlock.o: ../../include/deliver_flock.h
postlock.o: ../../include/dot_lockfile.h
postlock.o: ../../include/dsn.h
@@ -68,6 +69,7 @@ postlock.o: ../../include/dsn_util.h
postlock.o: ../../include/iostuff.h
postlock.o: ../../include/mail_conf.h
postlock.o: ../../include/mail_params.h
+postlock.o: ../../include/mail_parm_split.h
postlock.o: ../../include/mail_version.h
postlock.o: ../../include/mbox_conf.h
postlock.o: ../../include/mbox_open.h
diff --git a/external/ibm-public/postfix/dist/src/postlog/Makefile.in b/external/ibm-public/postfix/dist/src/postlog/Makefile.in
index 76fda9b6e6c..84ee53e4b60 100644
--- a/external/ibm-public/postfix/dist/src/postlog/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postlog/Makefile.in
@@ -58,18 +58,21 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
+postlog.o: ../../include/argv.h
postlog.o: ../../include/check_arg.h
+postlog.o: ../../include/clean_env.h
postlog.o: ../../include/mail_conf.h
postlog.o: ../../include/mail_params.h
+postlog.o: ../../include/mail_parm_split.h
postlog.o: ../../include/mail_task.h
postlog.o: ../../include/mail_version.h
+postlog.o: ../../include/maillog_client.h
postlog.o: ../../include/msg.h
postlog.o: ../../include/msg_output.h
-postlog.o: ../../include/msg_syslog.h
postlog.o: ../../include/msg_vstream.h
postlog.o: ../../include/sys_defs.h
postlog.o: ../../include/vbuf.h
diff --git a/external/ibm-public/postfix/dist/src/postlogd/Makefile.in b/external/ibm-public/postfix/dist/src/postlogd/Makefile.in
new file mode 100644
index 00000000000..bdf7d050f84
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postlogd/Makefile.in
@@ -0,0 +1,74 @@
+SHELL = /bin/sh
+SRCS = postlogd.c
+OBJS = postlogd.o
+HDRS =
+TESTSRC =
+DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE)
+CFLAGS = $(DEBUG) $(OPT) $(DEFS)
+TESTPROG=
+PROG = postlogd
+INC_DIR = ../../include
+LIBS = ../../lib/lib$(LIB_PREFIX)dns$(LIB_SUFFIX) \
+ ../../lib/lib$(LIB_PREFIX)master$(LIB_SUFFIX) \
+ ../../lib/lib$(LIB_PREFIX)global$(LIB_SUFFIX) \
+ ../../lib/lib$(LIB_PREFIX)util$(LIB_SUFFIX)
+
+.c.o:; $(CC) $(CFLAGS) -c $*.c
+
+$(PROG): $(OBJS) $(LIBS)
+ $(CC) $(CFLAGS) $(SHLIB_RPATH) -o $@ $(OBJS) $(LIBS) $(SYSLIBS)
+
+$(OBJS): ../../conf/makedefs.out
+
+Makefile: Makefile.in
+ cat ../../conf/makedefs.out $? >$@
+
+test: $(TESTPROG)
+
+tests: test
+
+root_tests:
+
+update: ../../libexec/$(PROG)
+
+../../libexec/$(PROG): $(PROG)
+ cp $(PROG) ../../libexec
+
+printfck: $(OBJS) $(PROG)
+ rm -rf printfck
+ mkdir printfck
+ sed '1,/^# do not edit/!d' Makefile >printfck/Makefile
+ set -e; for i in *.c; do printfck -f .printfck $$i >printfck/$$i; done
+ cd printfck; make "INC_DIR=../../../include" `cd ..; ls *.o`
+
+lint:
+ lint $(DEFS) $(SRCS) $(LINTFIX)
+
+clean:
+ rm -f *.o *core $(PROG) $(TESTPROG) junk
+ rm -rf printfck
+
+tidy: clean
+
+depend: $(MAKES)
+ (sed '1,/^# do not edit/!d' Makefile.in; \
+ set -e; for i in [a-z][a-z0-9]*.c; do \
+ $(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
+ -e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
+ -e 's/o: \.\//o: /' -e p -e '}' ; \
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ @$(EXPORT) make -f Makefile.in Makefile 1>&2
+
+# do not edit below this line - it is generated by 'make depend'
+postlogd.o: ../../include/check_arg.h
+postlogd.o: ../../include/logwriter.h
+postlogd.o: ../../include/mail_conf.h
+postlogd.o: ../../include/mail_params.h
+postlogd.o: ../../include/mail_server.h
+postlogd.o: ../../include/mail_version.h
+postlogd.o: ../../include/msg.h
+postlogd.o: ../../include/msg_logger.h
+postlogd.o: ../../include/sys_defs.h
+postlogd.o: ../../include/vbuf.h
+postlogd.o: ../../include/vstream.h
+postlogd.o: postlogd.c
diff --git a/external/ibm-public/postfix/dist/src/postlogd/postlogd.c b/external/ibm-public/postfix/dist/src/postlogd/postlogd.c
new file mode 100644
index 00000000000..2597dc461a3
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postlogd/postlogd.c
@@ -0,0 +1,269 @@
+/* $NetBSD: postlogd.c,v 1.1.1.1 2020/03/18 18:59:35 christos Exp $ */
+
+/*++
+/* NAME
+/* postlogd 8
+/* SUMMARY
+/* Postfix internal log server
+/* SYNOPSIS
+/* \fBpostlogd\fR [generic Postfix daemon options]
+/* DESCRIPTION
+/* This program logs events on behalf of Postfix programs
+/* when the maillog configuration parameter specifies a non-empty
+/* value.
+/* BUGS
+/* Non-daemon Postfix programs don't know that they should log
+/* to the internal logging service before they have processed
+/* command-line options and main.cf parameters. These programs
+/* still log earlier events to the syslog service.
+/*
+/* If Postfix is down, the non-daemon programs \fBpostfix\fR(1),
+/* \fBpostsuper\fR(1), \fBpostmulti\fR(1), and \fBpostlog\fR(1),
+/* will log directly to \fB$maillog_file\fR. These programs
+/* expect to run with root privileges, for example during
+/* Postfix start-up, reload, or shutdown.
+/*
+/* Other non-daemon Postfix programs will never write directly to
+/* \fB$maillog_file\fR (also, logging to stdout would interfere
+/* with the operation of some of these programs). These programs
+/* can log to \fBpostlogd\fR(8) if they are run by the super-user,
+/* or if their executable file has set-gid permission. Do not
+/* set this permission on programs other than \fBpostdrop\fR(1)
+/* and \fBpostqueue\fR(1).
+/* CONFIGURATION PARAMETERS
+/* .ad
+/* .fi
+/* Changes to \fBmain.cf\fR are picked up automatically, as
+/* \fBpostlogd\fR(8) processes run for only a limited amount
+/* of time. Use the command "\fBpostfix reload\fR" to speed
+/* up a change.
+/*
+/* The text below provides only a parameter summary. See
+/* \fBpostconf\fR(5) for more details including examples.
+/* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
+/* The default location of the Postfix main.cf and master.cf
+/* configuration files.
+/* .IP "\fBmaillog_file (empty)\fR"
+/* The name of an optional logfile that is written by the Postfix
+/* \fBpostlogd\fR(8) service.
+/* .IP "\fBprocess_id (read-only)\fR"
+/* The process ID of a Postfix command or daemon process.
+/* .IP "\fBprocess_name (read-only)\fR"
+/* The process name of a Postfix command or daemon process.
+/* .IP "\fBsyslog_name (see 'postconf -d' output)\fR"
+/* A prefix that is prepended to the process name in syslog
+/* records, so that, for example, "smtpd" becomes "prefix/smtpd".
+/* .IP "\fBservice_name (read-only)\fR"
+/* The master.cf service name of a Postfix daemon process.
+/* .IP "\fBpostlogd_watchdog_timeout (10s)\fR"
+/* How much time a \fBpostlogd\fR(8) process may take to process a request
+/* before it is terminated by a built-in watchdog timer.
+/* SEE ALSO
+/* postconf(5), configuration parameters
+/* syslogd(8), system logging
+/* README_FILES
+/* .ad
+/* .fi
+/* Use "\fBpostconf readme_directory\fR" or
+/* "\fBpostconf html_directory\fR" to locate this information.
+/* .na
+/* .nf
+/* MAILLOG_README, Postfix logging to file or stdout
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* HISTORY
+/* .ad
+/* .fi
+/* This service was introduced with Postfix version 3.4.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+
+ /*
+ * Utility library.
+ */
+#include <logwriter.h>
+#include <msg.h>
+#include <msg_logger.h>
+#include <stringops.h>
+#include <vstream.h>
+
+ /*
+ * Global library.
+ */
+#include <mail_params.h>
+#include <mail_task.h>
+#include <mail_version.h>
+#include <maillog_client.h>
+
+ /*
+ * Server skeleton.
+ */
+#include <mail_server.h>
+
+ /*
+ * Tunable parameters.
+ */
+int var_postlogd_watchdog;
+
+ /*
+ * Silly little macros.
+ */
+#define STR(x) vstring_str(x)
+#define LEN(x) VSTRING_LEN(x)
+
+ /*
+ * Logfile stream.
+ */
+static VSTREAM *postlogd_stream = 0;
+
+/* postlogd_fallback - log messages from postlogd(8) itself */
+
+static void postlogd_fallback(const char *buf)
+{
+ (void) logwriter_write(postlogd_stream, buf, strlen(buf));
+}
+
+/* postlogd_service - perform service for client */
+
+static void postlogd_service(char *buf, ssize_t len, char *unused_service,
+ char **unused_argv)
+{
+
+ if (postlogd_stream) {
+ (void) logwriter_write(postlogd_stream, buf, len);
+ }
+
+ /*
+ * After a configuration change that removes the maillog_file pathname,
+ * this service may still receive messages (after "postfix reload" or
+ * after process refresh) from programs that use the old maillog_file
+ * setting. Redirect those messages to the current logging mechanism.
+ */
+ else {
+ char *bp = buf;
+ char *progname_pid;
+
+ /*
+ * Avoid surprises: strip off the date, time, host, and program[pid]:
+ * prefix that were prepended by msg_logger(3). Then, hope that the
+ * current logging driver suppresses its own PID, when it sees that
+ * there is a PID embedded in the 'program name'.
+ */
+ (void) mystrtok(&bp, CHARS_SPACE); /* month */
+ (void) mystrtok(&bp, CHARS_SPACE); /* day */
+ (void) mystrtok(&bp, CHARS_SPACE); /* time */
+ (void) mystrtok(&bp, CHARS_SPACE); /* host */
+ progname_pid = mystrtok(&bp, ":" CHARS_SPACE); /* name[pid] sans ':' */
+ bp += strspn(bp, CHARS_SPACE);
+ if (progname_pid)
+ maillog_client_init(progname_pid, MAILLOG_CLIENT_FLAG_NONE);
+ msg_info("%.*s", (int) (len - (bp - buf)), bp);
+
+ /*
+ * Restore the program name, in case postlogd(8) needs to log
+ * something about itself. We have to call maillog_client_init() in
+ * any case, because neither msg_syslog_init() nor openlog() make a
+ * copy of the name argument. We can't leave that pointing into the
+ * middle of the above message buffer.
+ */
+ maillog_client_init(mail_task((char *) 0), MAILLOG_CLIENT_FLAG_NONE);
+ }
+}
+
+/* pre_jail_init - pre-jail handling */
+
+static void pre_jail_init(char *unused_service_name, char **argv)
+{
+
+ /*
+ * During process initialization, the postlogd daemon will log events to
+ * the postlog socket, so that they can be logged to file later. Once the
+ * postlogd daemon is handling requests, it will stop logging to the
+ * postlog socket and will instead write to the logfile, to avoid
+ * infinite recursion.
+ */
+
+ /*
+ * Sanity check. This service takes no command-line arguments.
+ */
+ if (argv[0])
+ msg_fatal("unexpected command-line argument: %s", argv[0]);
+
+ /*
+ * After a configuration change that removes the maillog_file pathname,
+ * this service may still receive messages from processes that still use
+ * the old configuration. Those messages will have to be redirected to
+ * the current logging subsystem.
+ */
+ if (*var_maillog_file != 0) {
+
+ /*
+ * Instantiate the logwriter or bust.
+ */
+ postlogd_stream = logwriter_open_or_die(var_maillog_file);
+
+ /*
+ * Inform the msg_logger client to stop using the postlog socket, and
+ * to call our logwriter.
+ */
+ msg_logger_control(CA_MSG_LOGGER_CTL_FALLBACK_ONLY,
+ CA_MSG_LOGGER_CTL_FALLBACK_FN(postlogd_fallback),
+ CA_MSG_LOGGER_CTL_END);
+ }
+}
+
+/* post_jail_init - post-jail initialization */
+
+static void post_jail_init(char *unused_name, char **unused_argv)
+{
+
+ /*
+ * Prevent automatic process suicide after a limited number of client
+ * requests. It is OK to terminate after a limited amount of idle time.
+ */
+ var_use_limit = 0;
+}
+
+MAIL_VERSION_STAMP_DECLARE;
+
+/* main - pass control to the multi-threaded skeleton */
+
+int main(int argc, char **argv)
+{
+ static const CONFIG_TIME_TABLE time_table[] = {
+ VAR_POSTLOGD_WATCHDOG, DEF_POSTLOGD_WATCHDOG, &var_postlogd_watchdog, 10, 0,
+ 0,
+ };
+
+ /*
+ * Fingerprint executables and core dumps.
+ */
+ MAIL_VERSION_STAMP_ALLOCATE;
+
+ /*
+ * This is a datagram service, not a stream service, so that postlogd can
+ * restart immediately after "postfix reload" without requiring clients
+ * to resend messages. Those messages remain queued in the kernel until a
+ * new postlogd process retrieves them. It would be unreasonable to
+ * require that clients retransmit logs, especially in the case of a
+ * fatal or panic error.
+ */
+ dgram_server_main(argc, argv, postlogd_service,
+ CA_MAIL_SERVER_TIME_TABLE(time_table),
+ CA_MAIL_SERVER_PRE_INIT(pre_jail_init),
+ CA_MAIL_SERVER_POST_INIT(post_jail_init),
+ CA_MAIL_SERVER_SOLITARY,
+ CA_MAIL_SERVER_WATCHDOG(&var_postlogd_watchdog),
+ 0);
+}
diff --git a/external/ibm-public/postfix/dist/src/postmap/Makefile.in b/external/ibm-public/postfix/dist/src/postmap/Makefile.in
index f5bed55044d..3667bb65b42 100644
--- a/external/ibm-public/postfix/dist/src/postmap/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postmap/Makefile.in
@@ -26,42 +26,55 @@ update: ../../bin/$(PROG)
../../bin/$(PROG): $(PROG)
cp $(PROG) ../../bin
-tests: test1 test2 fail_test
+tests: test1 test2 fail_test quote_test file_test
root_tests:
test1: $(PROG) map.in map-abc1.ref map-ghi1.ref map-uABC1.ref
- ./$(PROG) map.in
+ $(SHLIB_ENV) ./$(PROG) map.in
for key in abc ghi; \
do \
- ./$(PROG) -q $${key} map.in | diff map-$${key}1.ref -; \
+ $(SHLIB_ENV) ./$(PROG) -q $${key} map.in | diff map-$${key}1.ref -; \
done
- ./$(PROG) -f map.in
+ $(SHLIB_ENV) ./$(PROG) -f map.in
for key in ABC; \
do \
- ./$(PROG) -fq $${key} map.in | diff map-u$${key}1.ref -; \
+ $(SHLIB_ENV) ./$(PROG) -fq $${key} map.in | diff map-u$${key}1.ref -; \
done
rm -f map.in.db
test2: $(PROG) map.in map-abc2.ref map-ghi2.ref map-uABC2.ref
- ./$(PROG) map.in
+ $(SHLIB_ENV) ./$(PROG) map.in
for key in abc ghi; \
do \
- echo $${key} | ./$(PROG) -q - map.in | diff map-$${key}2.ref -; \
+ echo $${key} | $(SHLIB_ENV) ./$(PROG) -q - map.in | diff map-$${key}2.ref -; \
done
- ./$(PROG) -f map.in
+ $(SHLIB_ENV) ./$(PROG) -f map.in
for key in ABC; \
do \
- echo $${key} | ./$(PROG) -fq - map.in | diff map-u$${key}2.ref -; \
+ echo $${key} | $(SHLIB_ENV) ./$(PROG) -fq - map.in | diff map-u$${key}2.ref -; \
done
rm -f map.in.db
fail_test: $(PROG) aliases fail_test.in fail_test.ref
- -(sh fail_test.in || exit 0) 2>&1 | \
- sed 's/No error:/Unknown error:/' > fail_test.tmp
+ -($(SHLIB_ENV) sh fail_test.in || exit 0) 2>&1 | \
+ sed -e 's/No error:/Unknown error:/' \
+ -e 's/Success/Unknown error: 0/' > fail_test.tmp
diff fail_test.ref fail_test.tmp
rm -f fail_test.tmp
+quote_test: $(PROG) aliases quote_test.in quote_test.ref
+ rm -f quote_test_map.*
+ $(SHLIB_ENV) sh quote_test.in >quote_test.tmp 2>&1
+ diff quote_test.ref quote_test.tmp
+ rm -f quote_test.tmp quote_test_map.*
+
+file_test: $(PROG) file_test.in file_test.ref
+ rm -f file_test_map.* postmap-file-1 postmap-file-2
+ $(SHLIB_ENV) sh file_test.in >file_test.tmp 2>&1
+ diff file_test.ref file_test.tmp
+ rm -f file_test.tmp file_test_map.* postmap-file-1 postmap-file-2
+
printfck: $(OBJS) $(PROG)
rm -rf printfck
mkdir printfck
@@ -73,7 +86,7 @@ lint:
lint $(DEFS) $(SRCS) $(LINTFIX)
clean:
- rm -f *.o *core $(PROG) $(TESTPROG) junk map.in.db
+ rm -f *.o *core $(PROG) $(TESTPROG) *.tmp junk *.db
rm -rf printfck
tidy: clean
@@ -84,24 +97,26 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
postmap.o: ../../include/argv.h
postmap.o: ../../include/check_arg.h
+postmap.o: ../../include/clean_env.h
postmap.o: ../../include/dict.h
postmap.o: ../../include/dict_proxy.h
postmap.o: ../../include/header_opts.h
postmap.o: ../../include/mail_conf.h
postmap.o: ../../include/mail_dict.h
postmap.o: ../../include/mail_params.h
+postmap.o: ../../include/mail_parm_split.h
postmap.o: ../../include/mail_task.h
postmap.o: ../../include/mail_version.h
+postmap.o: ../../include/maillog_client.h
postmap.o: ../../include/mime_state.h
postmap.o: ../../include/mkmap.h
postmap.o: ../../include/msg.h
-postmap.o: ../../include/msg_syslog.h
postmap.o: ../../include/msg_vstream.h
postmap.o: ../../include/myflock.h
postmap.o: ../../include/mymalloc.h
diff --git a/external/ibm-public/postfix/dist/src/postmap/fail_test.in b/external/ibm-public/postfix/dist/src/postmap/fail_test.in
index a1c6b7c5867..ce01127d3b2 100644
--- a/external/ibm-public/postfix/dist/src/postmap/fail_test.in
+++ b/external/ibm-public/postfix/dist/src/postmap/fail_test.in
@@ -1,8 +1,8 @@
-./postmap -q xx fail:aliases
-echo xx | ./postmap -q - fail:aliases
-echo xx | ./postmap -bq - fail:aliases
-./postmap -d xx fail:aliases
-echo xx | ./postmap -d - fail:aliases
-./postmap -s fail:aliases
-./postmap -i fail:aliases < aliases
-./postmap fail:aliases
+${VALGRIND} ./postmap -q xx fail:aliases
+echo xx | ${VALGRIND} ./postmap -q - fail:aliases
+echo xx | ${VALGRIND} ./postmap -bq - fail:aliases
+${VALGRIND} ./postmap -d xx fail:aliases
+echo xx | ${VALGRIND} ./postmap -d - fail:aliases
+${VALGRIND} ./postmap -s fail:aliases
+${VALGRIND} ./postmap -i fail:aliases < aliases
+${VALGRIND} ./postmap fail:aliases
diff --git a/external/ibm-public/postfix/dist/src/postmap/file_test.in b/external/ibm-public/postfix/dist/src/postmap/file_test.in
new file mode 100644
index 00000000000..8c8a1a9b8ce
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postmap/file_test.in
@@ -0,0 +1,17 @@
+echo -n this-is-file1 > postmap-file-1
+echo -n this-is-file2 > postmap-file-2
+echo 'file-1 postmap-file-1' | ${VALGRIND} ./postmap -iF file_test_map || exit 1
+echo 'file-2 postmap-file-2' | ${VALGRIND} ./postmap -iF file_test_map || exit 1
+echo 'file-3 postmap-file-3' | ${VALGRIND} ./postmap -iF file_test_map || exit 1
+echo 'entry-4 postmap-entry-4' | ${VALGRIND} ./postmap -i file_test_map || exit 1
+${VALGRIND} ./postmap -s file_test_map | LC_ALL=C sort
+${VALGRIND} ./postmap -q file-1 file_test_map
+${VALGRIND} ./postmap -q file-2 file_test_map
+${VALGRIND} ./postmap -q file-3 file_test_map
+${VALGRIND} ./postmap -q entry-4 file_test_map
+${VALGRIND} ./postmap -Fs file_test_map | LC_ALL=C sort
+${VALGRIND} ./postmap -Fq file-1 file_test_map
+${VALGRIND} ./postmap -Fq file-2 file_test_map
+${VALGRIND} ./postmap -Fq file-3 file_test_map
+${VALGRIND} ./postmap -Fq entry-4 file_test_map
+exit 0
diff --git a/external/ibm-public/postfix/dist/src/postmap/file_test.ref b/external/ibm-public/postfix/dist/src/postmap/file_test.ref
new file mode 100644
index 00000000000..bc4815d53c2
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postmap/file_test.ref
@@ -0,0 +1,14 @@
+postmap: warning: stdin, line 1: open postmap-file-3: No such file or directory: skipping this entry
+entry-4 postmap-entry-4
+file-1 dGhpcy1pcy1maWxlMQ==
+file-2 dGhpcy1pcy1maWxlMg==
+dGhpcy1pcy1maWxlMQ==
+dGhpcy1pcy1maWxlMg==
+postmap-entry-4
+postmap: warning: table hash:file_test_map.db: key entry-4: malformed BASE64 value: postmap-entry-4
+file-1 this-is-file1
+file-2 this-is-file2
+this-is-file1
+this-is-file2
+postmap: warning: table hash:file_test_map.db: key entry-4: malformed BASE64 value: postmap-entry-4
+postmap: fatal: table hash:file_test_map.db: query error
diff --git a/external/ibm-public/postfix/dist/src/postmap/quote_test.in b/external/ibm-public/postfix/dist/src/postmap/quote_test.in
new file mode 100644
index 00000000000..fb507fc0e36
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postmap/quote_test.in
@@ -0,0 +1,8 @@
+echo '"aa bb" cc' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
+echo '"dd ee ff' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
+echo 'gg\ hh ii' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
+echo '"gg\"hh" ii' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
+echo '"jj@kk" ll' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
+echo 'mm@nn@oo pp' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
+echo '@oo pp' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
+${VALGRIND} ./postmap -s quote_test_map | LC_ALL=C sort
diff --git a/external/ibm-public/postfix/dist/src/postmap/quote_test.ref b/external/ibm-public/postfix/dist/src/postmap/quote_test.ref
new file mode 100644
index 00000000000..1643244707c
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/postmap/quote_test.ref
@@ -0,0 +1,7 @@
+postmap: warning: stdin, line 1: unbalanced '"' in '"dd ee ff' -- ignoring this line
+"aa bb" cc
+"gg\"hh" ii
+"jj@kk" ll
+@oo pp
+gg\ hh ii
+mm@nn@oo pp
diff --git a/external/ibm-public/postfix/dist/src/postmulti/Makefile.in b/external/ibm-public/postfix/dist/src/postmulti/Makefile.in
index b2ba77ede20..f2e3680bf5d 100644
--- a/external/ibm-public/postfix/dist/src/postmulti/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postmulti/Makefile.in
@@ -58,7 +58,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -70,8 +70,8 @@ postmulti.o: ../../include/mail_conf.h
postmulti.o: ../../include/mail_params.h
postmulti.o: ../../include/mail_parm_split.h
postmulti.o: ../../include/mail_version.h
+postmulti.o: ../../include/maillog_client.h
postmulti.o: ../../include/msg.h
-postmulti.o: ../../include/msg_syslog.h
postmulti.o: ../../include/msg_vstream.h
postmulti.o: ../../include/mymalloc.h
postmulti.o: ../../include/name_code.h
diff --git a/external/ibm-public/postfix/dist/src/postqueue/Makefile.in b/external/ibm-public/postfix/dist/src/postqueue/Makefile.in
index 28a4fd9d4b0..f01c3ae3d64 100644
--- a/external/ibm-public/postfix/dist/src/postqueue/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postqueue/Makefile.in
@@ -54,7 +54,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -77,8 +77,8 @@ postqueue.o: ../../include/mail_queue.h
postqueue.o: ../../include/mail_run.h
postqueue.o: ../../include/mail_task.h
postqueue.o: ../../include/mail_version.h
+postqueue.o: ../../include/maillog_client.h
postqueue.o: ../../include/msg.h
-postqueue.o: ../../include/msg_syslog.h
postqueue.o: ../../include/msg_vstream.h
postqueue.o: ../../include/mymalloc.h
postqueue.o: ../../include/nvtable.h
diff --git a/external/ibm-public/postfix/dist/src/postscreen/Makefile.in b/external/ibm-public/postfix/dist/src/postscreen/Makefile.in
index 0cda37d7fd3..82798ed734d 100644
--- a/external/ibm-public/postfix/dist/src/postscreen/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postscreen/Makefile.in
@@ -65,7 +65,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -315,6 +315,7 @@ postscreen_smtpd.o: ../../include/dns.h
postscreen_smtpd.o: ../../include/ehlo_mask.h
postscreen_smtpd.o: ../../include/events.h
postscreen_smtpd.o: ../../include/htable.h
+postscreen_smtpd.o: ../../include/info_log_addr_form.h
postscreen_smtpd.o: ../../include/iostuff.h
postscreen_smtpd.o: ../../include/is_header.h
postscreen_smtpd.o: ../../include/lex_822.h
diff --git a/external/ibm-public/postfix/dist/src/postscreen/postscreen_haproxy.h b/external/ibm-public/postfix/dist/src/postscreen/postscreen_haproxy.h
index 91660846024..bf6d9d38ee4 100644
--- a/external/ibm-public/postfix/dist/src/postscreen/postscreen_haproxy.h
+++ b/external/ibm-public/postfix/dist/src/postscreen/postscreen_haproxy.h
@@ -1,4 +1,4 @@
-/* $NetBSD: postscreen_haproxy.h,v 1.1.1.1 2013/09/25 19:06:33 tron Exp $ */
+/* $NetBSD: postscreen_haproxy.h,v 1.1.1.2 2020/03/18 18:59:36 christos Exp $ */
/*++
/* NAME
@@ -24,4 +24,9 @@ extern void psc_endpt_haproxy_lookup(VSTREAM *, PSC_ENDPT_LOOKUP_FN);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
diff --git a/external/ibm-public/postfix/dist/src/postsuper/Makefile.in b/external/ibm-public/postfix/dist/src/postsuper/Makefile.in
index b9a57ca59b6..30b540a6114 100644
--- a/external/ibm-public/postfix/dist/src/postsuper/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/postsuper/Makefile.in
@@ -54,25 +54,29 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
postsuper.o: ../../include/argv.h
postsuper.o: ../../include/check_arg.h
+postsuper.o: ../../include/clean_env.h
postsuper.o: ../../include/file_id.h
postsuper.o: ../../include/mail_conf.h
postsuper.o: ../../include/mail_open_ok.h
postsuper.o: ../../include/mail_params.h
+postsuper.o: ../../include/mail_parm_split.h
postsuper.o: ../../include/mail_queue.h
postsuper.o: ../../include/mail_task.h
postsuper.o: ../../include/mail_version.h
+postsuper.o: ../../include/maillog_client.h
postsuper.o: ../../include/msg.h
-postsuper.o: ../../include/msg_syslog.h
postsuper.o: ../../include/msg_vstream.h
postsuper.o: ../../include/mymalloc.h
postsuper.o: ../../include/myrand.h
+postsuper.o: ../../include/name_mask.h
postsuper.o: ../../include/safe.h
+postsuper.o: ../../include/safe_open.h
postsuper.o: ../../include/safe_ultostr.h
postsuper.o: ../../include/sane_fsops.h
postsuper.o: ../../include/scan_dir.h
diff --git a/external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in b/external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in
index e693e4795e7..8855002f2cf 100644
--- a/external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in
@@ -58,21 +58,26 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
posttls-finger.o: ../../include/argv.h
+posttls-finger.o: ../../include/attr.h
posttls-finger.o: ../../include/check_arg.h
posttls-finger.o: ../../include/chroot_uid.h
+posttls-finger.o: ../../include/clean_env.h
posttls-finger.o: ../../include/dns.h
posttls-finger.o: ../../include/dsn.h
posttls-finger.o: ../../include/dsn_buf.h
posttls-finger.o: ../../include/host_port.h
+posttls-finger.o: ../../include/htable.h
posttls-finger.o: ../../include/inet_proto.h
posttls-finger.o: ../../include/iostuff.h
posttls-finger.o: ../../include/mail_conf.h
posttls-finger.o: ../../include/mail_params.h
+posttls-finger.o: ../../include/mail_parm_split.h
+posttls-finger.o: ../../include/mail_proto.h
posttls-finger.o: ../../include/mail_server.h
posttls-finger.o: ../../include/midna_domain.h
posttls-finger.o: ../../include/msg.h
@@ -81,6 +86,7 @@ posttls-finger.o: ../../include/myaddrinfo.h
posttls-finger.o: ../../include/mymalloc.h
posttls-finger.o: ../../include/name_code.h
posttls-finger.o: ../../include/name_mask.h
+posttls-finger.o: ../../include/nvtable.h
posttls-finger.o: ../../include/sane_connect.h
posttls-finger.o: ../../include/smtp_stream.h
posttls-finger.o: ../../include/sock_addr.h
@@ -88,6 +94,7 @@ posttls-finger.o: ../../include/stringops.h
posttls-finger.o: ../../include/sys_defs.h
posttls-finger.o: ../../include/timed_connect.h
posttls-finger.o: ../../include/tls.h
+posttls-finger.o: ../../include/tls_proxy.h
posttls-finger.o: ../../include/vbuf.h
posttls-finger.o: ../../include/vstream.h
posttls-finger.o: ../../include/vstring.h
diff --git a/external/ibm-public/postfix/dist/src/proxymap/Makefile.in b/external/ibm-public/postfix/dist/src/proxymap/Makefile.in
index 5a61fbba687..bac724748fc 100644
--- a/external/ibm-public/postfix/dist/src/proxymap/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/proxymap/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/qmgr/Makefile.in b/external/ibm-public/postfix/dist/src/qmgr/Makefile.in
index b24b7414593..79d92b2f3ca 100644
--- a/external/ibm-public/postfix/dist/src/qmgr/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/qmgr/Makefile.in
@@ -64,7 +64,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -108,6 +108,7 @@ qmgr_active.o: ../../include/dsn_buf.h
qmgr_active.o: ../../include/dsn_mask.h
qmgr_active.o: ../../include/events.h
qmgr_active.o: ../../include/htable.h
+qmgr_active.o: ../../include/info_log_addr_form.h
qmgr_active.o: ../../include/mail_open_ok.h
qmgr_active.o: ../../include/mail_params.h
qmgr_active.o: ../../include/mail_queue.h
diff --git a/external/ibm-public/postfix/dist/src/qmgr/qmgr_error.c b/external/ibm-public/postfix/dist/src/qmgr/qmgr_error.c
index 3f4beb266a7..5b1cca6b564 100644
--- a/external/ibm-public/postfix/dist/src/qmgr/qmgr_error.c
+++ b/external/ibm-public/postfix/dist/src/qmgr/qmgr_error.c
@@ -1,4 +1,4 @@
-/* $NetBSD: qmgr_error.c,v 1.1.1.1 2009/06/23 10:08:52 tron Exp $ */
+/* $NetBSD: qmgr_error.c,v 1.1.1.2 2020/03/18 18:59:36 christos Exp $ */
/*++
/* NAME
@@ -24,7 +24,7 @@
/*
/* qmgr_error_queue() looks up an error queue for the specified
/* service and problem. The result is null if the queue is not
-/* availabe.
+/* available.
/*
/* qmgr_error_nexthop() computes the next-hop information for
/* the specified problem. The result must be passed to myfree().
diff --git a/external/ibm-public/postfix/dist/src/qmqpd/Makefile.in b/external/ibm-public/postfix/dist/src/qmqpd/Makefile.in
index e0f82d5c198..d4cdf338746 100644
--- a/external/ibm-public/postfix/dist/src/qmqpd/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/qmqpd/Makefile.in
@@ -56,7 +56,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/scache/Makefile.in b/external/ibm-public/postfix/dist/src/scache/Makefile.in
index 7ccfa3f33cd..882f0c6ce83 100644
--- a/external/ibm-public/postfix/dist/src/scache/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/scache/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/sendmail/Makefile.in b/external/ibm-public/postfix/dist/src/sendmail/Makefile.in
index 86802dbd9bc..bb0298a2ae8 100644
--- a/external/ibm-public/postfix/dist/src/sendmail/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/sendmail/Makefile.in
@@ -54,13 +54,14 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
sendmail.o: ../../include/argv.h
sendmail.o: ../../include/attr.h
sendmail.o: ../../include/check_arg.h
+sendmail.o: ../../include/clean_env.h
sendmail.o: ../../include/cleanup_user.h
sendmail.o: ../../include/connect.h
sendmail.o: ../../include/debug_process.h
@@ -72,18 +73,20 @@ sendmail.o: ../../include/header_opts.h
sendmail.o: ../../include/htable.h
sendmail.o: ../../include/iostuff.h
sendmail.o: ../../include/mail_conf.h
+sendmail.o: ../../include/mail_dict.h
sendmail.o: ../../include/mail_flush.h
sendmail.o: ../../include/mail_params.h
+sendmail.o: ../../include/mail_parm_split.h
sendmail.o: ../../include/mail_proto.h
sendmail.o: ../../include/mail_queue.h
sendmail.o: ../../include/mail_run.h
sendmail.o: ../../include/mail_stream.h
sendmail.o: ../../include/mail_task.h
sendmail.o: ../../include/mail_version.h
+sendmail.o: ../../include/maillog_client.h
sendmail.o: ../../include/mime_state.h
sendmail.o: ../../include/msg.h
sendmail.o: ../../include/msg_stats.h
-sendmail.o: ../../include/msg_syslog.h
sendmail.o: ../../include/msg_vstream.h
sendmail.o: ../../include/mymalloc.h
sendmail.o: ../../include/name_code.h
diff --git a/external/ibm-public/postfix/dist/src/showq/Makefile.in b/external/ibm-public/postfix/dist/src/showq/Makefile.in
index 2192c3374a0..47b82e7bb5c 100644
--- a/external/ibm-public/postfix/dist/src/showq/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/showq/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/smtp/Makefile.in b/external/ibm-public/postfix/dist/src/smtp/Makefile.in
index 7edc54ef7ef..140192f89ae 100644
--- a/external/ibm-public/postfix/dist/src/smtp/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/smtp/Makefile.in
@@ -2,11 +2,11 @@ SHELL = /bin/sh
SRCS = smtp.c smtp_connect.c smtp_proto.c smtp_chat.c smtp_session.c \
smtp_addr.c smtp_trouble.c smtp_state.c smtp_rcpt.c smtp_tls_policy.c \
smtp_sasl_proto.c smtp_sasl_glue.c smtp_reuse.c smtp_map11.c \
- smtp_sasl_auth_cache.c smtp_key.c
+ smtp_sasl_auth_cache.c smtp_key.c smtp_misc.c
OBJS = smtp.o smtp_connect.o smtp_proto.o smtp_chat.o smtp_session.o \
smtp_addr.o smtp_trouble.o smtp_state.o smtp_rcpt.o smtp_tls_policy.o \
smtp_sasl_proto.o smtp_sasl_glue.o smtp_reuse.o smtp_map11.o \
- smtp_sasl_auth_cache.o smtp_key.o
+ smtp_sasl_auth_cache.o smtp_key.o smtp_misc.o
HDRS = smtp.h smtp_sasl.h smtp_addr.h smtp_reuse.h smtp_sasl_auth_cache.h
TESTSRC =
DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE)
@@ -33,9 +33,9 @@ Makefile: Makefile.in
test: $(TESTPROG)
-tests:
+tests: smtp_map11_test
-root_tests: smtp_map11_test
+root_tests:
update: ../../libexec/$(PROG)
@@ -71,15 +71,10 @@ smtp_unalias: smtp_unalias.c $(LIBS)
smtp_map11: smtp_map11.c $(LIBS)
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIBS) $(SYSLIBS)
-# This needs trivial-rewrite service and myorigin==mydomain
-smtp_map11_test: smtp_map11 map11_map smtp_map11.ref
- $(SHLIB_ENV) ../postmap/postmap map11_map
- $(SHLIB_ENV) ./smtp_map11 hash:map11_map foo@example.com bar@example.com \
- baz@example.com foo@example.net >smtp_map11.tmp 2>&1
- sed -e "s/MYDOMAIN/`postconf -h mydomain`/" \
- -e "s/MYHOSTNAME/`postconf -h myhostname`/" smtp_map11.ref | \
- diff - smtp_map11.tmp
- rm -f smtp_map11.tmp map11_map.db
+smtp_map11_test: smtp_map11 smtp_map11.ref
+ $(SHLIB_ENV) $(VALGRIND) ./smtp_map11 <smtp_map11.in >smtp_map11.tmp 2>&1
+ diff smtp_map11.ref smtp_map11.tmp
+ rm -f smtp_map11.tmp
depend: $(MAKES)
(sed '1,/^# do not edit/!d' Makefile.in; \
@@ -87,13 +82,14 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
lmtp_params.o: lmtp_params.c
smtp.o: ../../include/argv.h
smtp.o: ../../include/attr.h
+smtp.o: ../../include/byte_mask.h
smtp.o: ../../include/check_arg.h
smtp.o: ../../include/debug_peer.h
smtp.o: ../../include/deliver_request.h
@@ -106,8 +102,10 @@ smtp.o: ../../include/flush_clnt.h
smtp.o: ../../include/header_body_checks.h
smtp.o: ../../include/header_opts.h
smtp.o: ../../include/htable.h
+smtp.o: ../../include/iostuff.h
smtp.o: ../../include/mail_conf.h
smtp.o: ../../include/mail_params.h
+smtp.o: ../../include/mail_proto.h
smtp.o: ../../include/mail_server.h
smtp.o: ../../include/mail_version.h
smtp.o: ../../include/maps.h
@@ -129,6 +127,7 @@ smtp.o: ../../include/string_list.h
smtp.o: ../../include/stringops.h
smtp.o: ../../include/sys_defs.h
smtp.o: ../../include/tls.h
+smtp.o: ../../include/tls_proxy.h
smtp.o: ../../include/tok822.h
smtp.o: ../../include/vbuf.h
smtp.o: ../../include/vstream.h
@@ -173,6 +172,7 @@ smtp_addr.o: ../../include/string_list.h
smtp_addr.o: ../../include/stringops.h
smtp_addr.o: ../../include/sys_defs.h
smtp_addr.o: ../../include/tls.h
+smtp_addr.o: ../../include/tls_proxy.h
smtp_addr.o: ../../include/tok822.h
smtp_addr.o: ../../include/vbuf.h
smtp_addr.o: ../../include/vstream.h
@@ -222,6 +222,7 @@ smtp_chat.o: ../../include/string_list.h
smtp_chat.o: ../../include/stringops.h
smtp_chat.o: ../../include/sys_defs.h
smtp_chat.o: ../../include/tls.h
+smtp_chat.o: ../../include/tls_proxy.h
smtp_chat.o: ../../include/tok822.h
smtp_chat.o: ../../include/vbuf.h
smtp_chat.o: ../../include/vstream.h
@@ -271,6 +272,7 @@ smtp_connect.o: ../../include/stringops.h
smtp_connect.o: ../../include/sys_defs.h
smtp_connect.o: ../../include/timed_connect.h
smtp_connect.o: ../../include/tls.h
+smtp_connect.o: ../../include/tls_proxy.h
smtp_connect.o: ../../include/tok822.h
smtp_connect.o: ../../include/vbuf.h
smtp_connect.o: ../../include/vstream.h
@@ -310,6 +312,7 @@ smtp_key.o: ../../include/sock_addr.h
smtp_key.o: ../../include/string_list.h
smtp_key.o: ../../include/sys_defs.h
smtp_key.o: ../../include/tls.h
+smtp_key.o: ../../include/tls_proxy.h
smtp_key.o: ../../include/tok822.h
smtp_key.o: ../../include/vbuf.h
smtp_key.o: ../../include/vstream.h
@@ -327,6 +330,7 @@ smtp_map11.o: ../../include/dsn_buf.h
smtp_map11.o: ../../include/header_body_checks.h
smtp_map11.o: ../../include/header_opts.h
smtp_map11.o: ../../include/htable.h
+smtp_map11.o: ../../include/mail_addr_form.h
smtp_map11.o: ../../include/mail_addr_map.h
smtp_map11.o: ../../include/maps.h
smtp_map11.o: ../../include/match_list.h
@@ -348,12 +352,53 @@ smtp_map11.o: ../../include/sock_addr.h
smtp_map11.o: ../../include/string_list.h
smtp_map11.o: ../../include/sys_defs.h
smtp_map11.o: ../../include/tls.h
+smtp_map11.o: ../../include/tls_proxy.h
smtp_map11.o: ../../include/tok822.h
smtp_map11.o: ../../include/vbuf.h
smtp_map11.o: ../../include/vstream.h
smtp_map11.o: ../../include/vstring.h
smtp_map11.o: smtp.h
smtp_map11.o: smtp_map11.c
+smtp_misc.o: ../../include/argv.h
+smtp_misc.o: ../../include/attr.h
+smtp_misc.o: ../../include/check_arg.h
+smtp_misc.o: ../../include/deliver_request.h
+smtp_misc.o: ../../include/dict.h
+smtp_misc.o: ../../include/dns.h
+smtp_misc.o: ../../include/dsn.h
+smtp_misc.o: ../../include/dsn_buf.h
+smtp_misc.o: ../../include/ext_prop.h
+smtp_misc.o: ../../include/header_body_checks.h
+smtp_misc.o: ../../include/header_opts.h
+smtp_misc.o: ../../include/htable.h
+smtp_misc.o: ../../include/mail_params.h
+smtp_misc.o: ../../include/maps.h
+smtp_misc.o: ../../include/match_list.h
+smtp_misc.o: ../../include/mime_state.h
+smtp_misc.o: ../../include/msg_stats.h
+smtp_misc.o: ../../include/myaddrinfo.h
+smtp_misc.o: ../../include/myflock.h
+smtp_misc.o: ../../include/mymalloc.h
+smtp_misc.o: ../../include/name_code.h
+smtp_misc.o: ../../include/name_mask.h
+smtp_misc.o: ../../include/nvtable.h
+smtp_misc.o: ../../include/quote_821_local.h
+smtp_misc.o: ../../include/quote_822_local.h
+smtp_misc.o: ../../include/quote_flags.h
+smtp_misc.o: ../../include/recipient_list.h
+smtp_misc.o: ../../include/resolve_clnt.h
+smtp_misc.o: ../../include/scache.h
+smtp_misc.o: ../../include/sock_addr.h
+smtp_misc.o: ../../include/string_list.h
+smtp_misc.o: ../../include/sys_defs.h
+smtp_misc.o: ../../include/tls.h
+smtp_misc.o: ../../include/tls_proxy.h
+smtp_misc.o: ../../include/tok822.h
+smtp_misc.o: ../../include/vbuf.h
+smtp_misc.o: ../../include/vstream.h
+smtp_misc.o: ../../include/vstring.h
+smtp_misc.o: smtp.h
+smtp_misc.o: smtp_misc.c
smtp_params.o: smtp_params.c
smtp_proto.o: ../../include/argv.h
smtp_proto.o: ../../include/attr.h
@@ -373,6 +418,7 @@ smtp_proto.o: ../../include/header_opts.h
smtp_proto.o: ../../include/htable.h
smtp_proto.o: ../../include/iostuff.h
smtp_proto.o: ../../include/lex_822.h
+smtp_proto.o: ../../include/mail_addr_form.h
smtp_proto.o: ../../include/mail_addr_map.h
smtp_proto.o: ../../include/mail_params.h
smtp_proto.o: ../../include/mail_proto.h
@@ -392,7 +438,6 @@ smtp_proto.o: ../../include/name_code.h
smtp_proto.o: ../../include/name_mask.h
smtp_proto.o: ../../include/nvtable.h
smtp_proto.o: ../../include/off_cvt.h
-smtp_proto.o: ../../include/quote_821_local.h
smtp_proto.o: ../../include/quote_822_local.h
smtp_proto.o: ../../include/quote_flags.h
smtp_proto.o: ../../include/rec_type.h
@@ -408,6 +453,7 @@ smtp_proto.o: ../../include/string_list.h
smtp_proto.o: ../../include/stringops.h
smtp_proto.o: ../../include/sys_defs.h
smtp_proto.o: ../../include/tls.h
+smtp_proto.o: ../../include/tls_proxy.h
smtp_proto.o: ../../include/tok822.h
smtp_proto.o: ../../include/uxtext.h
smtp_proto.o: ../../include/vbuf.h
@@ -453,6 +499,7 @@ smtp_rcpt.o: ../../include/string_list.h
smtp_rcpt.o: ../../include/stringops.h
smtp_rcpt.o: ../../include/sys_defs.h
smtp_rcpt.o: ../../include/tls.h
+smtp_rcpt.o: ../../include/tls_proxy.h
smtp_rcpt.o: ../../include/tok822.h
smtp_rcpt.o: ../../include/vbuf.h
smtp_rcpt.o: ../../include/vstream.h
@@ -490,6 +537,7 @@ smtp_reuse.o: ../../include/string_list.h
smtp_reuse.o: ../../include/stringops.h
smtp_reuse.o: ../../include/sys_defs.h
smtp_reuse.o: ../../include/tls.h
+smtp_reuse.o: ../../include/tls_proxy.h
smtp_reuse.o: ../../include/tok822.h
smtp_reuse.o: ../../include/vbuf.h
smtp_reuse.o: ../../include/vstream.h
@@ -530,6 +578,7 @@ smtp_sasl_auth_cache.o: ../../include/string_list.h
smtp_sasl_auth_cache.o: ../../include/stringops.h
smtp_sasl_auth_cache.o: ../../include/sys_defs.h
smtp_sasl_auth_cache.o: ../../include/tls.h
+smtp_sasl_auth_cache.o: ../../include/tls_proxy.h
smtp_sasl_auth_cache.o: ../../include/tok822.h
smtp_sasl_auth_cache.o: ../../include/vbuf.h
smtp_sasl_auth_cache.o: ../../include/vstream.h
@@ -549,6 +598,7 @@ smtp_sasl_glue.o: ../../include/header_body_checks.h
smtp_sasl_glue.o: ../../include/header_opts.h
smtp_sasl_glue.o: ../../include/htable.h
smtp_sasl_glue.o: ../../include/mail_addr_find.h
+smtp_sasl_glue.o: ../../include/mail_addr_form.h
smtp_sasl_glue.o: ../../include/mail_params.h
smtp_sasl_glue.o: ../../include/maps.h
smtp_sasl_glue.o: ../../include/match_list.h
@@ -571,6 +621,7 @@ smtp_sasl_glue.o: ../../include/string_list.h
smtp_sasl_glue.o: ../../include/stringops.h
smtp_sasl_glue.o: ../../include/sys_defs.h
smtp_sasl_glue.o: ../../include/tls.h
+smtp_sasl_glue.o: ../../include/tls_proxy.h
smtp_sasl_glue.o: ../../include/tok822.h
smtp_sasl_glue.o: ../../include/vbuf.h
smtp_sasl_glue.o: ../../include/vstream.h
@@ -611,6 +662,7 @@ smtp_sasl_proto.o: ../../include/string_list.h
smtp_sasl_proto.o: ../../include/stringops.h
smtp_sasl_proto.o: ../../include/sys_defs.h
smtp_sasl_proto.o: ../../include/tls.h
+smtp_sasl_proto.o: ../../include/tls_proxy.h
smtp_sasl_proto.o: ../../include/tok822.h
smtp_sasl_proto.o: ../../include/vbuf.h
smtp_sasl_proto.o: ../../include/vstream.h
@@ -650,6 +702,7 @@ smtp_session.o: ../../include/string_list.h
smtp_session.o: ../../include/stringops.h
smtp_session.o: ../../include/sys_defs.h
smtp_session.o: ../../include/tls.h
+smtp_session.o: ../../include/tls_proxy.h
smtp_session.o: ../../include/tok822.h
smtp_session.o: ../../include/vbuf.h
smtp_session.o: ../../include/vstream.h
@@ -687,6 +740,7 @@ smtp_state.o: ../../include/sock_addr.h
smtp_state.o: ../../include/string_list.h
smtp_state.o: ../../include/sys_defs.h
smtp_state.o: ../../include/tls.h
+smtp_state.o: ../../include/tls_proxy.h
smtp_state.o: ../../include/tok822.h
smtp_state.o: ../../include/vbuf.h
smtp_state.o: ../../include/vstream.h
@@ -726,6 +780,7 @@ smtp_tls_policy.o: ../../include/string_list.h
smtp_tls_policy.o: ../../include/stringops.h
smtp_tls_policy.o: ../../include/sys_defs.h
smtp_tls_policy.o: ../../include/tls.h
+smtp_tls_policy.o: ../../include/tls_proxy.h
smtp_tls_policy.o: ../../include/tok822.h
smtp_tls_policy.o: ../../include/valid_hostname.h
smtp_tls_policy.o: ../../include/valid_utf8_hostname.h
@@ -770,6 +825,7 @@ smtp_trouble.o: ../../include/string_list.h
smtp_trouble.o: ../../include/stringops.h
smtp_trouble.o: ../../include/sys_defs.h
smtp_trouble.o: ../../include/tls.h
+smtp_trouble.o: ../../include/tls_proxy.h
smtp_trouble.o: ../../include/tok822.h
smtp_trouble.o: ../../include/vbuf.h
smtp_trouble.o: ../../include/vstream.h
@@ -806,6 +862,7 @@ smtp_unalias.o: ../../include/sock_addr.h
smtp_unalias.o: ../../include/string_list.h
smtp_unalias.o: ../../include/sys_defs.h
smtp_unalias.o: ../../include/tls.h
+smtp_unalias.o: ../../include/tls_proxy.h
smtp_unalias.o: ../../include/tok822.h
smtp_unalias.o: ../../include/vbuf.h
smtp_unalias.o: ../../include/vstream.h
diff --git a/external/ibm-public/postfix/dist/src/smtp/smtp_map11.in b/external/ibm-public/postfix/dist/src/smtp/smtp_map11.in
new file mode 100644
index 00000000000..242859fcfda
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/smtp/smtp_map11.in
@@ -0,0 +1,33 @@
+# Table with external-form mapping.
+maps inline:{
+ { foo@example.com = bar@com.example }
+ { bar@example.com = bar }
+ { baz@example.com = @com.example }
+ { splitme@example.com = "split me"@com.example } }
+
+# Tests for external form.
+external foo@example.com:bar@com.example
+external bar@example.com:bar@localdomain
+external baz@example.com:baz@com.example
+external foo@example.net
+external splitme@example.com:"split me"@com.example
+external splitme+ext@example.com:"split me+ext"@com.example
+external "baz+first last"@example.com:"baz+first last"@com.example
+
+# Same tests for tree form.
+tree foo@example.com:bar@com.example
+tree bar@example.com:bar@localdomain
+tree baz@example.com:baz@com.example
+tree foo@example.net
+tree splitme@example.com:"split me"@com.example
+tree splitme+ext@example.com:"split me+ext"@com.example
+tree "baz+first last"@example.com:"baz+first last"@com.example
+
+# Same tests for internal form.
+internal foo@example.com:bar@com.example
+internal bar@example.com:bar@localdomain
+internal baz@example.com:baz@com.example
+internal foo@example.net
+internal splitme@example.com:split me@com.example
+internal splitme+ext@example.com:split me+ext@com.example
+internal baz+first last@example.com:baz+first last@com.example
diff --git a/external/ibm-public/postfix/dist/src/smtp/smtp_map11.ref b/external/ibm-public/postfix/dist/src/smtp/smtp_map11.ref
index e5820c75e2e..7e6f2edefdf 100644
--- a/external/ibm-public/postfix/dist/src/smtp/smtp_map11.ref
+++ b/external/ibm-public/postfix/dist/src/smtp/smtp_map11.ref
@@ -1,67 +1,22 @@
-smtp_map11: -- start foo@example.com --
-smtp_map11: maps_find: hash:map11_map: hash:map11_map(0,fold_fix): foo@example.com = bar@com.example
-smtp_map11: mail_addr_find: foo@example.com -> bar@com.example
-smtp_map11: connect to subsystem private/rewrite
-smtp_map11: send attr request = rewrite
-smtp_map11: send attr rule = local
-smtp_map11: send attr address = bar@com.example
-smtp_map11: private/rewrite socket: wanted attribute: flags
-smtp_map11: input attribute name: flags
-smtp_map11: input attribute value: 0
-smtp_map11: private/rewrite socket: wanted attribute: address
-smtp_map11: input attribute name: address
-smtp_map11: input attribute value: bar@com.example
-smtp_map11: private/rewrite socket: wanted attribute: (list terminator)
-smtp_map11: input attribute name: (end)
-smtp_map11: rewrite_clnt: local: bar@com.example -> bar@com.example
-smtp_map11: mail_addr_map: foo@example.com -> 0: bar@com.example
-smtp_map11: smtp_map11_external: foo@example.com -> bar@com.example
-smtp_map11: -- end foo@example.com --
-smtp_map11: -- start bar@example.com --
-smtp_map11: maps_find: hash:map11_map: hash:map11_map(0,fold_fix): bar@example.com = bar
-smtp_map11: mail_addr_find: bar@example.com -> bar
-smtp_map11: send attr request = rewrite
-smtp_map11: send attr rule = local
-smtp_map11: send attr address = bar
-smtp_map11: private/rewrite socket: wanted attribute: flags
-smtp_map11: input attribute name: flags
-smtp_map11: input attribute value: 0
-smtp_map11: private/rewrite socket: wanted attribute: address
-smtp_map11: input attribute name: address
-smtp_map11: input attribute value: bar@MYDOMAIN
-smtp_map11: private/rewrite socket: wanted attribute: (list terminator)
-smtp_map11: input attribute name: (end)
-smtp_map11: rewrite_clnt: local: bar -> bar@MYDOMAIN
-smtp_map11: mail_addr_map: bar@example.com -> 0: bar@MYDOMAIN
-smtp_map11: smtp_map11_external: bar@example.com -> bar@MYDOMAIN
-smtp_map11: -- end bar@example.com --
-smtp_map11: -- start baz@example.com --
-smtp_map11: maps_find: hash:map11_map: hash:map11_map(0,fold_fix): baz@example.com = @com.example
-smtp_map11: mail_addr_find: baz@example.com -> @com.example
-smtp_map11: send attr request = rewrite
-smtp_map11: send attr rule = local
-smtp_map11: send attr address = baz@com.example
-smtp_map11: private/rewrite socket: wanted attribute: flags
-smtp_map11: input attribute name: flags
-smtp_map11: input attribute value: 0
-smtp_map11: private/rewrite socket: wanted attribute: address
-smtp_map11: input attribute name: address
-smtp_map11: input attribute value: baz@com.example
-smtp_map11: private/rewrite socket: wanted attribute: (list terminator)
-smtp_map11: input attribute name: (end)
-smtp_map11: rewrite_clnt: local: baz@com.example -> baz@com.example
-smtp_map11: mail_addr_map: baz@example.com -> 0: baz@com.example
-smtp_map11: smtp_map11_external: baz@example.com -> baz@com.example
-smtp_map11: -- end baz@example.com --
-smtp_map11: -- start foo@example.net --
-smtp_map11: maps_find: hash:map11_map: foo@example.net: not found
-smtp_map11: match_string: example.net ~? MYHOSTNAME
-smtp_map11: match_string: example.net ~? localhost.MYDOMAIN
-smtp_map11: match_string: example.net ~? localhost
-smtp_map11: match_list_match: example.net: no match
-smtp_map11: maps_find: hash:map11_map: @example.net: not found
-smtp_map11: mail_addr_find: foo@example.net -> (not found)
-smtp_map11: mail_addr_map: foo@example.net -> (not found)
-smtp_map11: smtp_map11_external: foo@example.net not found
-smtp_map11: -- end foo@example.net --
-smtp_map11: maps_free: hash:map11_map(0,fold_fix)
+inline:{ { foo@example.com = bar@com.example } { bar@example.com = bar } { baz@example.com = @com.example } { splitme@example.com = "split me"@com.example } }
+external:foo@example.com -> bar@com.example
+external:bar@example.com -> bar@localdomain
+external:baz@example.com -> baz@com.example
+external:foo@example.net -> (no match)
+external:splitme@example.com -> "split me"@com.example
+external:splitme+ext@example.com -> "split me+ext"@com.example
+external:"baz+first last"@example.com -> "baz+first last"@com.example
+tree:foo@example.com -> bar@com.example
+tree:bar@example.com -> bar@localdomain
+tree:baz@example.com -> baz@com.example
+tree:foo@example.net -> (no match)
+tree:splitme@example.com -> "split me"@com.example
+tree:splitme+ext@example.com -> "split me+ext"@com.example
+tree:"baz+first last"@example.com -> "baz+first last"@com.example
+internal:foo@example.com -> bar@com.example
+internal:bar@example.com -> bar@localdomain
+internal:baz@example.com -> baz@com.example
+internal:foo@example.net -> (no match)
+internal:splitme@example.com -> split me@com.example
+internal:splitme+ext@example.com -> split me+ext@com.example
+internal:baz+first last@example.com -> baz+first last@com.example
diff --git a/external/ibm-public/postfix/dist/src/smtp/smtp_misc.c b/external/ibm-public/postfix/dist/src/smtp/smtp_misc.c
new file mode 100644
index 00000000000..9b8a8e2db6d
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/smtp/smtp_misc.c
@@ -0,0 +1,102 @@
+/* $NetBSD: smtp_misc.c,v 1.1.1.1 2020/03/18 18:59:36 christos Exp $ */
+
+/*++
+/* NAME
+/* smtp_misc 3
+/* SUMMARY
+/* SMTP client address rewriting
+/* SYNOPSIS
+/* #include <smtp_addr.h>
+/*
+/* void smtp_rewrite_generic_internal(
+/* VSTRING *dst,
+/* const char *src);
+/*
+/* void smtp_quote_822_address_flags(
+/* VSTRING *dst,
+/* const char *src,
+/* int flags);
+/*
+/* void smtp_quote_821_address(
+/* VSTRING *dst,
+/* const char *src);
+/* DESCRIPTION
+/* smtp_rewrite_generic_internal() rewrites a non-empty address
+/* if generic mapping is enabled, otherwise copies it literally.
+/*
+/* smtp_quote_822_address_flags() is a wrapper around
+/* quote_822_local_flags(), except for the empty address which
+/* is copied literally.
+/*
+/* smtp_quote_821_address() is a wrapper around quote_821_local(),
+/* except for the empty address or with "smtp_quote_rfc821_envelope
+/* = no"; in those cases the address is copied literally.
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+
+ /*
+ * Utility library.
+ */
+#include <vstring.h>
+
+ /*
+ * Global library.
+ */
+#include <ext_prop.h>
+#include <mail_params.h>
+#include <quote_821_local.h>
+#include <quote_822_local.h>
+
+ /*
+ * Application-specific.
+ */
+#include <smtp.h>
+
+/* smtp_rewrite_generic_internal - generic non-empty address rewriting */
+
+void smtp_rewrite_generic_internal(VSTRING *dst, const char *src)
+{
+ vstring_strcpy(dst, src);
+ if (*src && smtp_generic_maps)
+ smtp_map11_internal(dst, smtp_generic_maps,
+ smtp_ext_prop_mask & EXT_PROP_GENERIC);
+}
+
+/* smtp_quote_822_address_flags - quote non-empty header address */
+
+void smtp_quote_822_address_flags(VSTRING *dst, const char *src, int flags)
+{
+ if (*src) {
+ quote_822_local_flags(dst, src, flags);
+ } else if (flags & QUOTE_FLAG_APPEND) {
+ vstring_strcat(dst, src);
+ } else {
+ vstring_strcpy(dst, src);
+ }
+}
+
+/* smtp_quote_821_address - quote non-empty envelope address */
+
+void smtp_quote_821_address(VSTRING *dst, const char *src)
+{
+ if (*src && var_smtp_quote_821_env) {
+ quote_821_local(dst, src);
+ } else {
+ vstring_strcpy(dst, src);
+ }
+}
diff --git a/external/ibm-public/postfix/dist/src/smtpd/Makefile.in b/external/ibm-public/postfix/dist/src/smtpd/Makefile.in
index 2f011a252af..009f5bd1725 100644
--- a/external/ibm-public/postfix/dist/src/smtpd/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/smtpd/Makefile.in
@@ -72,7 +72,7 @@ tidy: clean
broken-tests: smtpd_check_test smtpd_check_test2
-tests: smtpd_acl_test smtpd_exp_test \
+tests: smtpd_acl_test smtpd_addr_valid_test smtpd_exp_test \
smtpd_token_test smtpd_check_test4 smtpd_check_dsn_test \
smtpd_check_backup_test smtpd_dnswl_test smtpd_error_test \
smtpd_server_test smtpd_nullmx_test smtpd_dns_filter_test
@@ -82,84 +82,91 @@ root_tests:
# This requires that the DNS server can query porcupine.org.
smtpd_check_test: smtpd_check smtpd_check.in smtpd_check.ref smtpd_check_access
- $(SHLIB_ENV) ../postmap/postmap hash:smtpd_check_access
- $(SHLIB_ENV) ./smtpd_check <smtpd_check.in >smtpd_check.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ../postmap/postmap hash:smtpd_check_access
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_check.in >smtpd_check.tmp 2>&1
diff smtpd_check.ref smtpd_check.tmp
rm -f smtpd_check.tmp smtpd_check_access.*
# This requires that the DNS server can query porcupine.org.
smtpd_check_test2: smtpd_check smtpd_check.in2 smtpd_check.ref2 smtpd_check_access
- $(SHLIB_ENV) ../postmap/postmap hash:smtpd_check_access
- $(SHLIB_ENV) ./smtpd_check <smtpd_check.in2 >smtpd_check.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ../postmap/postmap hash:smtpd_check_access
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_check.in2 >smtpd_check.tmp 2>&1
diff smtpd_check.ref2 smtpd_check.tmp
rm -f smtpd_check.tmp smtpd_check_access.*
smtpd_check_test4: smtpd_check smtpd_check.in4 smtpd_check.ref4 smtpd_check_access
- $(SHLIB_ENV) ../postmap/postmap hash:smtpd_check_access
- $(SHLIB_ENV) ./smtpd_check <smtpd_check.in4 >smtpd_check.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ../postmap/postmap hash:smtpd_check_access
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_check.in4 >smtpd_check.tmp 2>&1
diff smtpd_check.ref4 smtpd_check.tmp
rm -f smtpd_check.tmp smtpd_check_access.*
smtpd_acl_test: smtpd_check smtpd_acl.in smtpd_acl.ref smtpd_check_access
- $(SHLIB_ENV) ../postmap/postmap hash:smtpd_check_access
- $(SHLIB_ENV) ./smtpd_check <smtpd_acl.in >smtpd_check.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ../postmap/postmap hash:smtpd_check_access
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_acl.in >smtpd_check.tmp 2>&1
diff smtpd_acl.ref smtpd_check.tmp
rm -f smtpd_check.tmp smtpd_check_access.*
+smtpd_addr_valid_test: smtpd_check smtpd_addr_valid.in smtpd_addr_valid.ref
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_addr_valid.in >smtpd_check.tmp 2>&1
+ diff smtpd_addr_valid.ref smtpd_check.tmp
+ rm -f smtpd_check.tmp
+
# This requires that the DNS server can query porcupine.org.
+ADDRINFO_FIX = sed 's/No address associated with hostname/hostname nor servname provided, or not known/'
+
smtpd_exp_test: smtpd_check smtpd_exp.in smtpd_exp.ref
- $(SHLIB_ENV) ../postmap/postmap hash:smtpd_check_access
- $(SHLIB_ENV) ./smtpd_check <smtpd_exp.in >smtpd_exp.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ../postmap/postmap hash:smtpd_check_access
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_exp.in >smtpd_exp.tmp 2>&1
diff smtpd_exp.ref smtpd_exp.tmp
rm -f smtpd_exp.tmp smtpd_check_access.*
smtpd_server_test: smtpd_check smtpd_server.in smtpd_server.ref
- $(SHLIB_ENV) ./smtpd_check <smtpd_server.in >smtpd_server.tmp 2>&1
- diff smtpd_server.ref smtpd_server.tmp
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_server.in >smtpd_server.tmp 2>&1
+ $(ADDRINFO_FIX) smtpd_server.tmp | diff smtpd_server.ref -
rm -f smtpd_server.tmp smtpd_check_access.*
smtpd_nullmx_test: smtpd_check smtpd_nullmx.in smtpd_nullmx.ref
- $(SHLIB_ENV) ../postmap/postmap hash:smtpd_check_access
- $(SHLIB_ENV) ./smtpd_check <smtpd_nullmx.in >smtpd_nullmx.tmp 2>&1
- diff smtpd_nullmx.ref smtpd_nullmx.tmp
+ $(SHLIB_ENV) $(VALGRIND) ../postmap/postmap hash:smtpd_check_access
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_nullmx.in >smtpd_nullmx.tmp 2>&1
+ $(ADDRINFO_FIX) smtpd_nullmx.tmp | diff smtpd_nullmx.ref -
rm -f smtpd_nullmx.tmp smtpd_check_access.*
smtpd_dns_filter_test: smtpd_check smtpd_dns_filter.in smtpd_dns_filter.ref \
../dns/no-mx.reg ../dns/no-a.reg ../dns/error.reg
- $(SHLIB_ENV) ./smtpd_check <smtpd_dns_filter.in 2>&1 | \
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_dns_filter.in 2>&1 | \
sed 's/\. [0-9]* IN/. TTL IN/' >smtpd_dns_filter.tmp
diff smtpd_dns_filter.ref smtpd_dns_filter.tmp
rm -f smtpd_dns_filter.tmp
smtpd_check_dsn_test: smtpd_check smtpd_check_dsn.in smtpd_check_dsn.ref smtpd_check_access
- $(SHLIB_ENV) ../postmap/postmap hash:smtpd_check_access
- $(SHLIB_ENV) ./smtpd_check <smtpd_check_dsn.in >smtpd_check.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ../postmap/postmap hash:smtpd_check_access
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_check_dsn.in >smtpd_check.tmp 2>&1
diff smtpd_check_dsn.ref smtpd_check.tmp
rm -f smtpd_check.tmp smtpd_check_access.*
# This requires that 168,100.189.7 is a local or virtual interface.
smtpd_check_backup_test: smtpd_check smtpd_check_backup.in smtpd_check_backup.ref
- $(SHLIB_ENV) ./smtpd_check <smtpd_check_backup.in >smtpd_check.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_check_backup.in >smtpd_check.tmp 2>&1
diff smtpd_check_backup.ref smtpd_check.tmp
rm -f smtpd_check.tmp
smtpd_token_test: smtpd_token smtpd_token.in smtpd_token.ref
- $(SHLIB_ENV) ./smtpd_token <smtpd_token.in >smtpd_token.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_token <smtpd_token.in >smtpd_token.tmp 2>&1
diff smtpd_token.ref smtpd_token.tmp
rm -f smtpd_token.tmp
# This requires that the DNS server can query porcupine.org and rfc-ignorant.org
smtpd_dnswl_test: smtpd_check smtpd_dnswl.in smtpd_dnswl.ref
- $(SHLIB_ENV) ./smtpd_check <smtpd_dnswl.in >smtpd_dnswl.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_dnswl.in >smtpd_dnswl.tmp 2>&1
diff smtpd_dnswl.ref smtpd_dnswl.tmp
rm -f smtpd_dnswl.tmp
smtpd_error_test: smtpd_check smtpd_error.in smtpd_error.ref
- $(SHLIB_ENV) ./smtpd_check <smtpd_error.in >smtpd_check.tmp 2>&1
+ $(SHLIB_ENV) $(VALGRIND) ./smtpd_check <smtpd_error.in >smtpd_check.tmp 2>&1
diff smtpd_error.ref smtpd_check.tmp
rm -f smtpd_check.tmp
@@ -169,7 +176,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -188,6 +195,7 @@ smtpd.o: ../../include/events.h
smtpd.o: ../../include/flush_clnt.h
smtpd.o: ../../include/htable.h
smtpd.o: ../../include/inet_proto.h
+smtpd.o: ../../include/info_log_addr_form.h
smtpd.o: ../../include/input_transp.h
smtpd.o: ../../include/iostuff.h
smtpd.o: ../../include/is_header.h
@@ -214,6 +222,7 @@ smtpd.o: ../../include/mymalloc.h
smtpd.o: ../../include/namadr_list.h
smtpd.o: ../../include/name_code.h
smtpd.o: ../../include/name_mask.h
+smtpd.o: ../../include/normalize_mailhost_addr.h
smtpd.o: ../../include/nvtable.h
smtpd.o: ../../include/off_cvt.h
smtpd.o: ../../include/quote_822_local.h
@@ -257,6 +266,7 @@ smtpd_chat.o: ../../include/argv.h
smtpd_chat.o: ../../include/attr.h
smtpd_chat.o: ../../include/check_arg.h
smtpd_chat.o: ../../include/cleanup_user.h
+smtpd_chat.o: ../../include/dict.h
smtpd_chat.o: ../../include/dns.h
smtpd_chat.o: ../../include/htable.h
smtpd_chat.o: ../../include/int_filt.h
@@ -269,9 +279,11 @@ smtpd_chat.o: ../../include/mail_error.h
smtpd_chat.o: ../../include/mail_params.h
smtpd_chat.o: ../../include/mail_proto.h
smtpd_chat.o: ../../include/mail_stream.h
+smtpd_chat.o: ../../include/maps.h
smtpd_chat.o: ../../include/milter.h
smtpd_chat.o: ../../include/msg.h
smtpd_chat.o: ../../include/myaddrinfo.h
+smtpd_chat.o: ../../include/myflock.h
smtpd_chat.o: ../../include/mymalloc.h
smtpd_chat.o: ../../include/name_code.h
smtpd_chat.o: ../../include/name_mask.h
@@ -311,6 +323,7 @@ smtpd_check.o: ../../include/fsspace.h
smtpd_check.o: ../../include/htable.h
smtpd_check.o: ../../include/inet_addr_list.h
smtpd_check.o: ../../include/inet_proto.h
+smtpd_check.o: ../../include/info_log_addr_form.h
smtpd_check.o: ../../include/input_transp.h
smtpd_check.o: ../../include/iostuff.h
smtpd_check.o: ../../include/ip_match.h
@@ -319,11 +332,13 @@ smtpd_check.o: ../../include/mac_expand.h
smtpd_check.o: ../../include/mac_parse.h
smtpd_check.o: ../../include/mail_addr.h
smtpd_check.o: ../../include/mail_addr_find.h
+smtpd_check.o: ../../include/mail_addr_form.h
smtpd_check.o: ../../include/mail_conf.h
smtpd_check.o: ../../include/mail_error.h
smtpd_check.o: ../../include/mail_params.h
smtpd_check.o: ../../include/mail_proto.h
smtpd_check.o: ../../include/mail_stream.h
+smtpd_check.o: ../../include/map_search.h
smtpd_check.o: ../../include/maps.h
smtpd_check.o: ../../include/match_list.h
smtpd_check.o: ../../include/match_parent_style.h
@@ -406,6 +421,7 @@ smtpd_haproxy.o: ../../include/check_arg.h
smtpd_haproxy.o: ../../include/dns.h
smtpd_haproxy.o: ../../include/haproxy_srvr.h
smtpd_haproxy.o: ../../include/htable.h
+smtpd_haproxy.o: ../../include/iostuff.h
smtpd_haproxy.o: ../../include/mail_params.h
smtpd_haproxy.o: ../../include/mail_stream.h
smtpd_haproxy.o: ../../include/milter.h
diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in
new file mode 100644
index 00000000000..e89537dc010
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in
@@ -0,0 +1,35 @@
+#
+# Initialize
+#
+smtpd_delay_reject 0
+mynetworks 127.0.0.0/8,168.100.189.0/28
+local_recipient_maps inline:{foo_canon=whatever,bar_canon=whatever}
+mydestination example.com
+myorigin example.com
+
+sender_canonical_maps inline:{foo@example.com=foo_canon@example.com}
+recipient_canonical_maps inline:{bar@example.com=bar_canon@example.com}
+
+sender_restrictions reject_unlisted_sender
+# Expect accept
+mail bar_canon@example.com
+# Expect accept
+mail bar@example.com
+# Expect accept
+mail foo_canon@example.com
+# Expect accept
+mail foo@example.com
+# Expect reject
+mail baz@example.com
+
+recipient_restrictions reject_unlisted_recipient
+# Expect accept
+rcpt bar_canon@example.com
+# Expect accept
+rcpt bar@example.com
+# Expect accept
+rcpt foo_canon@example.com
+# Expect reject
+rcpt foo@example.com
+# Expect reject
+mail baz@example.com
diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref
new file mode 100644
index 00000000000..768a4c47694
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref
@@ -0,0 +1,57 @@
+>>> #
+>>> # Initialize
+>>> #
+>>> smtpd_delay_reject 0
+OK
+>>> mynetworks 127.0.0.0/8,168.100.189.0/28
+OK
+>>> local_recipient_maps inline:{foo_canon=whatever,bar_canon=whatever}
+OK
+>>> mydestination example.com
+OK
+>>> myorigin example.com
+OK
+>>>
+>>> sender_canonical_maps inline:{foo@example.com=foo_canon@example.com}
+OK
+>>> recipient_canonical_maps inline:{bar@example.com=bar_canon@example.com}
+OK
+>>>
+>>> sender_restrictions reject_unlisted_sender
+OK
+>>> # Expect accept
+>>> mail bar_canon@example.com
+OK
+>>> # Expect accept
+>>> mail bar@example.com
+OK
+>>> # Expect accept
+>>> mail foo_canon@example.com
+OK
+>>> # Expect accept
+>>> mail foo@example.com
+OK
+>>> # Expect reject
+>>> mail baz@example.com
+./smtpd_check: <queue id>: reject: MAIL from localhost[127.0.0.1]: 550 5.1.0 <baz@example.com>: Sender address rejected: User unknown in local recipient table; from=<baz@example.com> proto=SMTP
+550 5.1.0 <baz@example.com>: Sender address rejected: User unknown in local recipient table
+>>>
+>>> recipient_restrictions reject_unlisted_recipient
+OK
+>>> # Expect accept
+>>> rcpt bar_canon@example.com
+OK
+>>> # Expect accept
+>>> rcpt bar@example.com
+OK
+>>> # Expect accept
+>>> rcpt foo_canon@example.com
+OK
+>>> # Expect reject
+>>> rcpt foo@example.com
+./smtpd_check: <queue id>: reject: RCPT from localhost[127.0.0.1]: 550 5.1.1 <foo@example.com>: Recipient address rejected: User unknown in local recipient table; from=<baz@example.com> to=<foo@example.com> proto=SMTP
+550 5.1.1 <foo@example.com>: Recipient address rejected: User unknown in local recipient table
+>>> # Expect reject
+>>> mail baz@example.com
+./smtpd_check: <queue id>: reject: MAIL from localhost[127.0.0.1]: 550 5.1.0 <baz@example.com>: Sender address rejected: User unknown in local recipient table; from=<baz@example.com> proto=SMTP
+550 5.1.0 <baz@example.com>: Sender address rejected: User unknown in local recipient table
diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref
index 244cfdd8117..7df38e1f0da 100644
--- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref
+++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref
@@ -10,7 +10,7 @@ OK
OK
>>> # Expect: REJECT (temporary lookup failure)
>>> helo foobar
-./smtpd_check: warning: fail:1_helo_access: table lookup problem
+./smtpd_check: warning: fail:1_helo_access lookup error for "foobar"
./smtpd_check: <queue id>: reject: HELO from localhost[127.0.0.1]: 451 4.3.5 <foobar>: Helo command rejected: Server configuration error; proto=SMTP helo=<foobar>
451 4.3.5 <foobar>: Helo command rejected: Server configuration error
>>> #
@@ -20,7 +20,7 @@ OK
OK
>>> # Expect: REJECT (temporary lookup failure)
>>> client foo.dunno.com 131.155.210.17
-./smtpd_check: warning: fail:1_client_access: table lookup problem
+./smtpd_check: warning: fail:1_client_access lookup error for "foo.dunno.com"
./smtpd_check: <queue id>: reject: CONNECT from foo.dunno.com[131.155.210.17]: 451 4.3.5 <foo.dunno.com[131.155.210.17]>: Client host rejected: Server configuration error; proto=SMTP helo=<foobar>
451 4.3.5 <foo.dunno.com[131.155.210.17]>: Client host rejected: Server configuration error
>>> #
@@ -30,7 +30,7 @@ OK
OK
>>> # Expect: REJECT (temporary lookup failure)
>>> mail reject@dunno.domain
-./smtpd_check: warning: fail:1_sender_access: table lookup problem
+./smtpd_check: warning: fail:1_sender_access lookup error for "reject@dunno.domain"
./smtpd_check: <queue id>: reject: MAIL from foo.dunno.com[131.155.210.17]: 451 4.3.5 <reject@dunno.domain>: Sender address rejected: Server configuration error; from=<reject@dunno.domain> proto=SMTP helo=<foobar>
451 4.3.5 <reject@dunno.domain>: Sender address rejected: Server configuration error
>>> #
@@ -40,7 +40,7 @@ OK
OK
>>> # Expect: REJECT (temporary lookup failure)
>>> rcpt reject@dunno.domain
-./smtpd_check: warning: fail:1_rcpt_access: table lookup problem
+./smtpd_check: warning: fail:1_rcpt_access lookup error for "reject@dunno.domain"
./smtpd_check: <queue id>: reject: RCPT from foo.dunno.com[131.155.210.17]: 451 4.3.5 <reject@dunno.domain>: Recipient address rejected: Server configuration error; from=<reject@dunno.domain> to=<reject@dunno.domain> proto=SMTP helo=<foobar>
451 4.3.5 <reject@dunno.domain>: Recipient address rejected: Server configuration error
>>> # Expect: OK
@@ -78,7 +78,7 @@ OK
>>> smtpd_null_access_lookup_key <>
OK
>>> mail <>
-./smtpd_check: warning: fail:1_sender_access: table lookup problem
+./smtpd_check: warning: fail:1_sender_access lookup error for "<>"
./smtpd_check: <queue id>: reject: MAIL from foo.dunno.com[131.155.210.17]: 451 4.3.5 <>: Sender address rejected: Server configuration error; from=<> proto=SMTP helo=<foobar>
451 4.3.5 <>: Sender address rejected: Server configuration error
>>> #
@@ -104,7 +104,7 @@ OK
>>> # Expect: REJECT (temporary lookup failure)
>>> #
>>> rewrite
-./smtpd_check: warning: local_header_rewrite_clients: fail:1_rewrite: lookup error
+./smtpd_check: warning: fail:1_rewrite lookup error for "131.155.210.17"
./smtpd_check: <queue id>: reject: RCPT from foo.dunno.com[131.155.210.17]: 451 4.3.0 Temporary lookup error; from=<> proto=SMTP helo=<foobar>
451 4.3.0 Temporary lookup error
>>> #
diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in b/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in
index 2646ac48fdd..325e9da59fb 100644
--- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in
+++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in
@@ -24,15 +24,15 @@ rcpt foo@postfix.org
#
# Check NS access
#
-helo_restrictions check_helo_ns_access,inline:{168.100.189.2=reject}
+helo_restrictions check_helo_ns_access,inline:{168.100.1.2=reject}
helo www.porcupine.org
helo example.tld
helo foo@postfix.org
-sender_restrictions check_sender_ns_access,inline:{168.100.189.2=reject}
+sender_restrictions check_sender_ns_access,inline:{168.100.1.2=reject}
mail foo@www.porcupine.org
mail example.tld
mail foo@postfix.org
-recipient_restrictions check_recipient_ns_access,inline:{168.100.189.2=reject}
+recipient_restrictions check_recipient_ns_access,inline:{168.100.1.2=reject}
rcpt foo@www.porcupine.org
rcpt foo@example.tld
rcpt foo@postfix.org
diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref b/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref
index 7ac0c8d5259..563befe8a39 100644
--- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref
+++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref
@@ -45,36 +45,39 @@ OK
>>> #
>>> # Check NS access
>>> #
->>> helo_restrictions check_helo_ns_access,inline:{168.100.189.2=reject}
+>>> helo_restrictions check_helo_ns_access,inline:{168.100.1.2=reject}
OK
>>> helo www.porcupine.org
./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <www.porcupine.org>: Helo command rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<www.porcupine.org>
554 5.7.1 <www.porcupine.org>: Helo command rejected: Access denied
>>> helo example.tld
-./smtpd_check: warning: Unable to look up NS host for tld: Host not found
+./smtpd_check: warning: Unable to look up NS host for example.tld: Host not found
OK
>>> helo foo@postfix.org
-OK
->>> sender_restrictions check_sender_ns_access,inline:{168.100.189.2=reject}
+./smtpd_check: <queue id>: reject: HELO from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@postfix.org>: Helo command rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org>
+554 5.7.1 <foo@postfix.org>: Helo command rejected: Access denied
+>>> sender_restrictions check_sender_ns_access,inline:{168.100.1.2=reject}
OK
>>> mail foo@www.porcupine.org
./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@www.porcupine.org>: Sender address rejected: Access denied; from=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org>
554 5.7.1 <foo@www.porcupine.org>: Sender address rejected: Access denied
>>> mail example.tld
-./smtpd_check: warning: Unable to look up NS host for tld: Host not found
+./smtpd_check: warning: Unable to look up NS host for example.tld: Host not found
OK
>>> mail foo@postfix.org
-OK
->>> recipient_restrictions check_recipient_ns_access,inline:{168.100.189.2=reject}
+./smtpd_check: <queue id>: reject: MAIL from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@postfix.org>: Sender address rejected: Access denied; from=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org>
+554 5.7.1 <foo@postfix.org>: Sender address rejected: Access denied
+>>> recipient_restrictions check_recipient_ns_access,inline:{168.100.1.2=reject}
OK
>>> rcpt foo@www.porcupine.org
./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@www.porcupine.org>: Recipient address rejected: Access denied; from=<foo@postfix.org> to=<foo@www.porcupine.org> proto=SMTP helo=<foo@postfix.org>
554 5.7.1 <foo@www.porcupine.org>: Recipient address rejected: Access denied
>>> rcpt foo@example.tld
-./smtpd_check: warning: Unable to look up NS host for tld: Host not found
+./smtpd_check: warning: Unable to look up NS host for foo@example.tld: Host not found
OK
>>> rcpt foo@postfix.org
-OK
+./smtpd_check: <queue id>: reject: RCPT from spike.porcupine.org[168.100.189.2]: 554 5.7.1 <foo@postfix.org>: Recipient address rejected: Access denied; from=<foo@postfix.org> to=<foo@postfix.org> proto=SMTP helo=<foo@postfix.org>
+554 5.7.1 <foo@postfix.org>: Recipient address rejected: Access denied
>>> #
>>> # Check A access
>>> #
diff --git a/external/ibm-public/postfix/dist/src/smtpd/smtpd_state.c b/external/ibm-public/postfix/dist/src/smtpd/smtpd_state.c
index b4b7dc1b8fa..4f9f1ef9d0f 100644
--- a/external/ibm-public/postfix/dist/src/smtpd/smtpd_state.c
+++ b/external/ibm-public/postfix/dist/src/smtpd/smtpd_state.c
@@ -1,4 +1,4 @@
-/* $NetBSD: smtpd_state.c,v 1.1.1.5 2013/01/02 18:59:10 tron Exp $ */
+/* $NetBSD: smtpd_state.c,v 1.1.1.6 2020/03/18 18:59:37 christos Exp $ */
/*++
/* NAME
@@ -37,6 +37,11 @@
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*
/* TLS support originally by:
/* Lutz Jaenicke
/* BTU Cottbus
@@ -147,7 +152,6 @@ void smtpd_state_init(SMTPD_STATE *state, VSTREAM *stream,
state->tls_context = 0;
#endif
-
/*
* Minimal initialization to support external authentication (e.g.,
* XCLIENT) without having to enable SASL in main.cf.
@@ -161,6 +165,7 @@ void smtpd_state_init(SMTPD_STATE *state, VSTREAM *stream,
state->milter_argv = 0;
state->milter_argc = 0;
+ state->milters = 0;
/*
* Initialize peer information.
@@ -179,6 +184,13 @@ void smtpd_state_init(SMTPD_STATE *state, VSTREAM *stream,
state->ehlo_argv = 0;
state->ehlo_buf = 0;
+
+ /*
+ * BDAT.
+ */
+ state->bdat_state = SMTPD_BDAT_STAT_NONE;
+ state->bdat_get_stream = 0;
+ state->bdat_get_buffer = 0;
}
/* smtpd_state_reset - cleanup after disconnect */
@@ -227,4 +239,12 @@ void smtpd_state_reset(SMTPD_STATE *state)
if (state->tlsproxy) /* still open after longjmp */
vstream_fclose(state->tlsproxy);
#endif
+
+ /*
+ * BDAT.
+ */
+ if (state->bdat_get_stream)
+ (void) vstream_fclose(state->bdat_get_stream);
+ if (state->bdat_get_buffer)
+ vstring_free(state->bdat_get_buffer);
}
diff --git a/external/ibm-public/postfix/dist/src/smtpstone/Makefile.in b/external/ibm-public/postfix/dist/src/smtpstone/Makefile.in
index 5d1af3447db..f86e0195b3e 100644
--- a/external/ibm-public/postfix/dist/src/smtpstone/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/smtpstone/Makefile.in
@@ -75,7 +75,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/spawn/Makefile.in b/external/ibm-public/postfix/dist/src/spawn/Makefile.in
index 85863b76d50..5097697d524 100644
--- a/external/ibm-public/postfix/dist/src/spawn/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/spawn/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/tls/Makefile.in b/external/ibm-public/postfix/dist/src/tls/Makefile.in
index 1a489605341..fec7d4542ec 100644
--- a/external/ibm-public/postfix/dist/src/tls/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/tls/Makefile.in
@@ -4,20 +4,28 @@ SRCS = tls_prng_dev.c tls_prng_egd.c tls_prng_file.c tls_fprint.c \
tls_rsa.c tls_verify.c tls_dane.c tls_certkey.c tls_session.c \
tls_client.c tls_server.c tls_scache.c tls_mgr.c tls_seed.c \
tls_level.c \
- tls_proxy_clnt.c tls_proxy_print.c tls_proxy_scan.c
+ tls_proxy_clnt.c tls_proxy_context_print.c tls_proxy_context_scan.c \
+ tls_proxy_client_init_print.c tls_proxy_client_init_scan.c \
+ tls_proxy_server_init_print.c tls_proxy_server_init_scan.c \
+ tls_proxy_client_start_print.c tls_proxy_client_start_scan.c \
+ tls_proxy_server_start_print.c tls_proxy_server_start_scan.c \
+ tls_proxy_client_misc.c
OBJS = tls_prng_dev.o tls_prng_egd.o tls_prng_file.o tls_fprint.o \
tls_prng_exch.o tls_stream.o tls_bio_ops.o tls_misc.o tls_dh.o \
tls_rsa.o tls_verify.o tls_dane.o tls_certkey.o tls_session.o \
tls_client.o tls_server.o tls_scache.o tls_mgr.o tls_seed.o \
tls_level.o \
- tls_proxy_clnt.o tls_proxy_print.o tls_proxy_scan.o
+ tls_proxy_clnt.o tls_proxy_context_print.o tls_proxy_context_scan.o \
+ tls_proxy_client_print.o tls_proxy_client_scan.o \
+ tls_proxy_server_print.o tls_proxy_server_scan.o \
+ tls_proxy_client_misc.o
HDRS = tls.h tls_prng.h tls_scache.h tls_mgr.h tls_proxy.h
TESTSRC =
DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE)
CFLAGS = $(DEBUG) $(OPT) $(DEFS)
INCL =
LIB = lib$(LIB_PREFIX)tls$(LIB_SUFFIX)
-TESTPROG= tls_dh tls_mgr tls_rsa tls_dane
+TESTPROG= tls_dh tls_mgr tls_rsa tls_dane tls_certkey
LIBS = ../../lib/lib$(LIB_PREFIX)dns$(LIB_SUFFIX) \
../../lib/lib$(LIB_PREFIX)global$(LIB_SUFFIX) \
@@ -37,7 +45,36 @@ Makefile: Makefile.in
test: $(TESTPROG)
-tests:
+tests: tls_certkey_tests
+
+tls_certkey_tests: test
+ @echo Testing loading of keys and certs
+ @for pem in goodchains.pem; do \
+ $(SHLIB_ENV) $(VALGRIND) ./tls_certkey $$pem > $$pem.out 2>&1 || exit 1; \
+ diff $$pem.ref $$pem.out || exit 1; \
+ echo " $$pem: OK"; \
+ done; \
+ for pem in *-mixed-*.pem ; do \
+ $(SHLIB_ENV) $(VALGRIND) ./tls_certkey -m $$pem > $$pem.out 2>&1 || exit 1; \
+ diff $$pem.ref $$pem.out || exit 1; \
+ echo " $$pem: OK"; \
+ $(SHLIB_ENV) $(VALGRIND) ./tls_certkey -k $$pem $$pem > $$pem.out 2>&1 || exit 1; \
+ diff $$pem.ref $$pem.out || exit 1; \
+ echo " $$pem (with key in $$pem): OK"; \
+ case $$pem in good-*) \
+ ln -sf $$pem tmpkey.pem; \
+ $(SHLIB_ENV) $(VALGRIND) ./tls_certkey -k tmpkey.pem $$pem > $$pem.out 2>&1 || exit 1; \
+ diff $$pem.ref $$pem.out || exit 1; \
+ echo " $$pem (with key in tmpkey.pem): OK"; \
+ rm -f tmpkey.pem;; \
+ esac; \
+ done; \
+ for pem in bad-*.pem; do \
+ $(SHLIB_ENV) $(VALGRIND) ./tls_certkey $$pem > $$pem.out 2>&1 && exit 1 || : ok; \
+ egrep -v 'TLS library problem' $$pem.out | diff $$pem.ref - || \
+ exit 1; \
+ echo " $$pem: OK"; \
+ done
root_tests:
@@ -69,7 +106,7 @@ lint:
lint $(DEFS) $(SRCS) $(LINTFIX)
clean:
- rm -f *.o $(LIB) *core $(TESTPROG) junk
+ rm -f *.o $(LIB) *core $(TESTPROG) junk *.pem.out
rm -rf printfck
tidy: clean
@@ -94,13 +131,18 @@ tls_dane: $(LIB) $(LIBS)
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
mv junk $@.o
+tls_certkey: $(LIB) $(LIBS)
+ mv $@.o junk
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
+ mv junk $@.o
+
depend: $(MAKES)
(sed '1,/^# do not edit/!d' Makefile.in; \
set -e; for i in [a-z][a-z0-9]*.c; do \
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -186,9 +228,11 @@ tls_dh.o: ../../include/dns.h
tls_dh.o: ../../include/mail_params.h
tls_dh.o: ../../include/msg.h
tls_dh.o: ../../include/myaddrinfo.h
+tls_dh.o: ../../include/mymalloc.h
tls_dh.o: ../../include/name_code.h
tls_dh.o: ../../include/name_mask.h
tls_dh.o: ../../include/sock_addr.h
+tls_dh.o: ../../include/stringops.h
tls_dh.o: ../../include/sys_defs.h
tls_dh.o: ../../include/vbuf.h
tls_dh.o: ../../include/vstream.h
@@ -248,17 +292,21 @@ tls_mgr.o: tls_mgr.h
tls_mgr.o: tls_scache.h
tls_misc.o: ../../include/argv.h
tls_misc.o: ../../include/check_arg.h
+tls_misc.o: ../../include/dict.h
tls_misc.o: ../../include/dns.h
tls_misc.o: ../../include/mail_conf.h
tls_misc.o: ../../include/mail_params.h
+tls_misc.o: ../../include/maps.h
tls_misc.o: ../../include/msg.h
tls_misc.o: ../../include/myaddrinfo.h
+tls_misc.o: ../../include/myflock.h
tls_misc.o: ../../include/mymalloc.h
tls_misc.o: ../../include/name_code.h
tls_misc.o: ../../include/name_mask.h
tls_misc.o: ../../include/sock_addr.h
tls_misc.o: ../../include/stringops.h
tls_misc.o: ../../include/sys_defs.h
+tls_misc.o: ../../include/valid_hostname.h
tls_misc.o: ../../include/vbuf.h
tls_misc.o: ../../include/vstream.h
tls_misc.o: ../../include/vstring.h
@@ -292,6 +340,68 @@ tls_prng_file.o: ../../include/mymalloc.h
tls_prng_file.o: ../../include/sys_defs.h
tls_prng_file.o: tls_prng.h
tls_prng_file.o: tls_prng_file.c
+tls_proxy_client_misc.o: ../../include/argv.h
+tls_proxy_client_misc.o: ../../include/attr.h
+tls_proxy_client_misc.o: ../../include/check_arg.h
+tls_proxy_client_misc.o: ../../include/dns.h
+tls_proxy_client_misc.o: ../../include/htable.h
+tls_proxy_client_misc.o: ../../include/mail_params.h
+tls_proxy_client_misc.o: ../../include/msg.h
+tls_proxy_client_misc.o: ../../include/myaddrinfo.h
+tls_proxy_client_misc.o: ../../include/mymalloc.h
+tls_proxy_client_misc.o: ../../include/name_code.h
+tls_proxy_client_misc.o: ../../include/name_mask.h
+tls_proxy_client_misc.o: ../../include/nvtable.h
+tls_proxy_client_misc.o: ../../include/sock_addr.h
+tls_proxy_client_misc.o: ../../include/sys_defs.h
+tls_proxy_client_misc.o: ../../include/vbuf.h
+tls_proxy_client_misc.o: ../../include/vstream.h
+tls_proxy_client_misc.o: ../../include/vstring.h
+tls_proxy_client_misc.o: tls.h
+tls_proxy_client_misc.o: tls_proxy.h
+tls_proxy_client_misc.o: tls_proxy_client_misc.c
+tls_proxy_client_print.o: ../../include/argv.h
+tls_proxy_client_print.o: ../../include/argv_attr.h
+tls_proxy_client_print.o: ../../include/attr.h
+tls_proxy_client_print.o: ../../include/check_arg.h
+tls_proxy_client_print.o: ../../include/dns.h
+tls_proxy_client_print.o: ../../include/htable.h
+tls_proxy_client_print.o: ../../include/mail_params.h
+tls_proxy_client_print.o: ../../include/msg.h
+tls_proxy_client_print.o: ../../include/myaddrinfo.h
+tls_proxy_client_print.o: ../../include/mymalloc.h
+tls_proxy_client_print.o: ../../include/name_code.h
+tls_proxy_client_print.o: ../../include/name_mask.h
+tls_proxy_client_print.o: ../../include/nvtable.h
+tls_proxy_client_print.o: ../../include/sock_addr.h
+tls_proxy_client_print.o: ../../include/sys_defs.h
+tls_proxy_client_print.o: ../../include/vbuf.h
+tls_proxy_client_print.o: ../../include/vstream.h
+tls_proxy_client_print.o: ../../include/vstring.h
+tls_proxy_client_print.o: tls.h
+tls_proxy_client_print.o: tls_proxy.h
+tls_proxy_client_print.o: tls_proxy_client_print.c
+tls_proxy_client_scan.o: ../../include/argv.h
+tls_proxy_client_scan.o: ../../include/argv_attr.h
+tls_proxy_client_scan.o: ../../include/attr.h
+tls_proxy_client_scan.o: ../../include/check_arg.h
+tls_proxy_client_scan.o: ../../include/dns.h
+tls_proxy_client_scan.o: ../../include/htable.h
+tls_proxy_client_scan.o: ../../include/mail_params.h
+tls_proxy_client_scan.o: ../../include/msg.h
+tls_proxy_client_scan.o: ../../include/myaddrinfo.h
+tls_proxy_client_scan.o: ../../include/mymalloc.h
+tls_proxy_client_scan.o: ../../include/name_code.h
+tls_proxy_client_scan.o: ../../include/name_mask.h
+tls_proxy_client_scan.o: ../../include/nvtable.h
+tls_proxy_client_scan.o: ../../include/sock_addr.h
+tls_proxy_client_scan.o: ../../include/sys_defs.h
+tls_proxy_client_scan.o: ../../include/vbuf.h
+tls_proxy_client_scan.o: ../../include/vstream.h
+tls_proxy_client_scan.o: ../../include/vstring.h
+tls_proxy_client_scan.o: tls.h
+tls_proxy_client_scan.o: tls_proxy.h
+tls_proxy_client_scan.o: tls_proxy_client_scan.c
tls_proxy_clnt.o: ../../include/argv.h
tls_proxy_clnt.o: ../../include/attr.h
tls_proxy_clnt.o: ../../include/check_arg.h
@@ -316,46 +426,79 @@ tls_proxy_clnt.o: ../../include/vstring.h
tls_proxy_clnt.o: tls.h
tls_proxy_clnt.o: tls_proxy.h
tls_proxy_clnt.o: tls_proxy_clnt.c
-tls_proxy_print.o: ../../include/argv.h
-tls_proxy_print.o: ../../include/attr.h
-tls_proxy_print.o: ../../include/check_arg.h
-tls_proxy_print.o: ../../include/dns.h
-tls_proxy_print.o: ../../include/htable.h
-tls_proxy_print.o: ../../include/iostuff.h
-tls_proxy_print.o: ../../include/mail_proto.h
-tls_proxy_print.o: ../../include/myaddrinfo.h
-tls_proxy_print.o: ../../include/mymalloc.h
-tls_proxy_print.o: ../../include/name_code.h
-tls_proxy_print.o: ../../include/name_mask.h
-tls_proxy_print.o: ../../include/nvtable.h
-tls_proxy_print.o: ../../include/sock_addr.h
-tls_proxy_print.o: ../../include/sys_defs.h
-tls_proxy_print.o: ../../include/vbuf.h
-tls_proxy_print.o: ../../include/vstream.h
-tls_proxy_print.o: ../../include/vstring.h
-tls_proxy_print.o: tls.h
-tls_proxy_print.o: tls_proxy.h
-tls_proxy_print.o: tls_proxy_print.c
-tls_proxy_scan.o: ../../include/argv.h
-tls_proxy_scan.o: ../../include/attr.h
-tls_proxy_scan.o: ../../include/check_arg.h
-tls_proxy_scan.o: ../../include/dns.h
-tls_proxy_scan.o: ../../include/htable.h
-tls_proxy_scan.o: ../../include/iostuff.h
-tls_proxy_scan.o: ../../include/mail_proto.h
-tls_proxy_scan.o: ../../include/myaddrinfo.h
-tls_proxy_scan.o: ../../include/mymalloc.h
-tls_proxy_scan.o: ../../include/name_code.h
-tls_proxy_scan.o: ../../include/name_mask.h
-tls_proxy_scan.o: ../../include/nvtable.h
-tls_proxy_scan.o: ../../include/sock_addr.h
-tls_proxy_scan.o: ../../include/sys_defs.h
-tls_proxy_scan.o: ../../include/vbuf.h
-tls_proxy_scan.o: ../../include/vstream.h
-tls_proxy_scan.o: ../../include/vstring.h
-tls_proxy_scan.o: tls.h
-tls_proxy_scan.o: tls_proxy.h
-tls_proxy_scan.o: tls_proxy_scan.c
+tls_proxy_context_print.o: ../../include/argv.h
+tls_proxy_context_print.o: ../../include/attr.h
+tls_proxy_context_print.o: ../../include/check_arg.h
+tls_proxy_context_print.o: ../../include/dns.h
+tls_proxy_context_print.o: ../../include/htable.h
+tls_proxy_context_print.o: ../../include/myaddrinfo.h
+tls_proxy_context_print.o: ../../include/mymalloc.h
+tls_proxy_context_print.o: ../../include/name_code.h
+tls_proxy_context_print.o: ../../include/name_mask.h
+tls_proxy_context_print.o: ../../include/nvtable.h
+tls_proxy_context_print.o: ../../include/sock_addr.h
+tls_proxy_context_print.o: ../../include/sys_defs.h
+tls_proxy_context_print.o: ../../include/vbuf.h
+tls_proxy_context_print.o: ../../include/vstream.h
+tls_proxy_context_print.o: ../../include/vstring.h
+tls_proxy_context_print.o: tls.h
+tls_proxy_context_print.o: tls_proxy.h
+tls_proxy_context_print.o: tls_proxy_context_print.c
+tls_proxy_context_scan.o: ../../include/argv.h
+tls_proxy_context_scan.o: ../../include/attr.h
+tls_proxy_context_scan.o: ../../include/check_arg.h
+tls_proxy_context_scan.o: ../../include/dns.h
+tls_proxy_context_scan.o: ../../include/htable.h
+tls_proxy_context_scan.o: ../../include/msg.h
+tls_proxy_context_scan.o: ../../include/myaddrinfo.h
+tls_proxy_context_scan.o: ../../include/mymalloc.h
+tls_proxy_context_scan.o: ../../include/name_code.h
+tls_proxy_context_scan.o: ../../include/name_mask.h
+tls_proxy_context_scan.o: ../../include/nvtable.h
+tls_proxy_context_scan.o: ../../include/sock_addr.h
+tls_proxy_context_scan.o: ../../include/sys_defs.h
+tls_proxy_context_scan.o: ../../include/vbuf.h
+tls_proxy_context_scan.o: ../../include/vstream.h
+tls_proxy_context_scan.o: ../../include/vstring.h
+tls_proxy_context_scan.o: tls.h
+tls_proxy_context_scan.o: tls_proxy.h
+tls_proxy_context_scan.o: tls_proxy_context_scan.c
+tls_proxy_server_print.o: ../../include/argv.h
+tls_proxy_server_print.o: ../../include/attr.h
+tls_proxy_server_print.o: ../../include/check_arg.h
+tls_proxy_server_print.o: ../../include/dns.h
+tls_proxy_server_print.o: ../../include/htable.h
+tls_proxy_server_print.o: ../../include/myaddrinfo.h
+tls_proxy_server_print.o: ../../include/mymalloc.h
+tls_proxy_server_print.o: ../../include/name_code.h
+tls_proxy_server_print.o: ../../include/name_mask.h
+tls_proxy_server_print.o: ../../include/nvtable.h
+tls_proxy_server_print.o: ../../include/sock_addr.h
+tls_proxy_server_print.o: ../../include/sys_defs.h
+tls_proxy_server_print.o: ../../include/vbuf.h
+tls_proxy_server_print.o: ../../include/vstream.h
+tls_proxy_server_print.o: ../../include/vstring.h
+tls_proxy_server_print.o: tls.h
+tls_proxy_server_print.o: tls_proxy.h
+tls_proxy_server_print.o: tls_proxy_server_print.c
+tls_proxy_server_scan.o: ../../include/argv.h
+tls_proxy_server_scan.o: ../../include/attr.h
+tls_proxy_server_scan.o: ../../include/check_arg.h
+tls_proxy_server_scan.o: ../../include/dns.h
+tls_proxy_server_scan.o: ../../include/htable.h
+tls_proxy_server_scan.o: ../../include/myaddrinfo.h
+tls_proxy_server_scan.o: ../../include/mymalloc.h
+tls_proxy_server_scan.o: ../../include/name_code.h
+tls_proxy_server_scan.o: ../../include/name_mask.h
+tls_proxy_server_scan.o: ../../include/nvtable.h
+tls_proxy_server_scan.o: ../../include/sock_addr.h
+tls_proxy_server_scan.o: ../../include/sys_defs.h
+tls_proxy_server_scan.o: ../../include/vbuf.h
+tls_proxy_server_scan.o: ../../include/vstream.h
+tls_proxy_server_scan.o: ../../include/vstring.h
+tls_proxy_server_scan.o: tls.h
+tls_proxy_server_scan.o: tls_proxy.h
+tls_proxy_server_scan.o: tls_proxy_server_scan.c
tls_rsa.o: ../../include/argv.h
tls_rsa.o: ../../include/check_arg.h
tls_rsa.o: ../../include/dns.h
@@ -429,6 +572,7 @@ tls_server.o: tls_server.c
tls_session.o: ../../include/argv.h
tls_session.o: ../../include/check_arg.h
tls_session.o: ../../include/dns.h
+tls_session.o: ../../include/mail_params.h
tls_session.o: ../../include/msg.h
tls_session.o: ../../include/myaddrinfo.h
tls_session.o: ../../include/mymalloc.h
diff --git a/external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem b/external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem
new file mode 100644
index 00000000000..b1895ec5215
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem
@@ -0,0 +1,64 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCu99Z6AB3EA2tA
+lWlJLPtsF2Ed81Hy2c5HYPmE8cGZJgp6YuzF+qxlBNHTk4c8HkobGqMTRU0x0qpz
+Mnltkq1JuIwjku4GzoEPcBPqJxSNVZ96pmrVWuxX+5ZnqS9gWbLZyjkCCqVQR/ny
+K0/tXij/1s7Kkol1lPOqgBhzSwgOqDLqfipxiakHZIB8TYI6p6hanNQyz4NWq1PE
+pWK9yhBJdeZJwK6K5VEMzqr//t+9dIT/dC8RoJkiHka24JzNCLx3GD/Q0GNGFGoE
+9Fcz28BelGpigWyleheqzuGPXYquEBHDAHaanRIoW0/dbG0KaKTTeHf9LegFXez2
+tJeLl+vpAgMBAAECggEBAIsJKoe7++s9BEdH82hQtGIKmgPgzKf8aCzUZLM+ISd/
+0Se74IbaUY/cqphETVx6fUzYd+niUhtbWlM8Mr3dppJEcif6o+cIxgnseAbDk1NU
+TOx7vb1ZCSJJLBWnnZwk6ziht3dl2kPXTkkgHd1zy4Sxv5W9qDmlaZN9QvCrGPX7
+ZkJnZg2QcLvjhaBCIXTYIpbTSWZjHBzecjmPrIb+NvO4/gbYgfAj9sJAPi5H3LQE
+8hZ30ylFZ03+2MKJoS+JrUZQllXyd92AmtXXv9jEFgLQ2mNETCXhsh9BK7qC8YKU
+ImZHGHgGQOA30PGEltstzgNvROKb/U2tPgVOo9v9L+ECgYEA1zLokvYwEyuN+9xc
+5L7cf4LA7k5WHNdFeERPudGO2RedfQkoZ8sP0WjCeg+LF/iWh4NfLMoGUNgxRQtv
+rv5GjDRvlvPXj6YHZo/uMgGLLeeZ6tMJ8NvnrZxNTIDPw+XTd5doiEmnrDrmJZH/
+QeT6HlBkIURjIuYpzFrBxzSvKu0CgYEA0CRAp+zP0QC75aHgvSVPB+7JU0xIEuGz
+CdYxWh7rHAztvxxdDFFwBjPEnczDmMF8o5lZwH4L1RFQ2b9UAZy451dEIVqxKp0W
+2mOemjohi3DR3nZfpS/Cpattwd61/KGSUUS0k3Lpp7ACCybqNl1wIcX50mbLOQGe
+RMu+2+NnmW0CgYBWyhpQQueqo5M0s2/ndS46YsJqmb9TDGLhGTPKLkDdPw/uAIaC
+LbwoaYadca1YMpKK/qmgx616Z2afgPg+7CAJpZAnohoavgwYCg43rrWyAsjpkslc
+kWPDedkW9JBWYldB0ReAd6we4vY0ysfWjIFvPl7Tp+APkCHlX+js7UuEFQKBgQDP
+9Eh8/kcrpDYW2cM2dz4cyOBwzvf7lXBR1aT9S4LPRcOLe4Ujt4HbUIGSv3B1AGvM
+8HwRrF2aBXDn/Rarfa/nwvKY+Iml78lTbNCbepTlQlUMlOw+mBc7eqlwV1kwDSWo
++KIJ53e3SEziY4EBzB0qQSi2pGlKjWlZhs8r1mo9iQKBgQCoZNYakj717J5FnpWC
+yhkuGYmbBItYBwL36TQqTD6Kq0oJcrBRtMxWWqMmlDV7w8BP4/A2cRXHJz2MLhm9
+Jc5OPh8OkFY4pT8NTpVYqq1pb2d5fzwRX68MKWtVBZzJqzK8w0t4QZLqqeAwQCrc
+Okn/aJneEclcdzv8JHfVMcdNxA==
+-----END PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem.ref b/external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem.ref
new file mode 100644
index 00000000000..192e9ea0ea1
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem.ref
@@ -0,0 +1,2 @@
+unknown: warning: error loading certificate chain: key at index 1 in bad-back-to-back-keys.pem not followed by a certificate
+unknown: warning: error loading private keys and certificates from: bad-back-to-back-keys.pem: disabling TLS support
diff --git a/external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem b/external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem
new file mode 100644
index 00000000000..520927a6f76
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem
@@ -0,0 +1,36 @@
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem.ref b/external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem.ref
new file mode 100644
index 00000000000..71e5f7852d7
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem.ref
@@ -0,0 +1,2 @@
+unknown: warning: error loading chain from bad-ec-cert-before-key.pem: key not first
+unknown: warning: error loading private keys and certificates from: bad-ec-cert-before-key.pem: disabling TLS support
diff --git a/external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem b/external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem
new file mode 100644
index 00000000000..1e78833a624
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem
@@ -0,0 +1,36 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgvhC73shHi6WonWdC
+rbMwDzIrjYIejrvmkNQo+7hFnp2hRANCAARYcKaWmm2MulstiE3b15jhdyZA+Fwy
+b0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfsG614fKHGUYzV
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem.ref b/external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem.ref
new file mode 100644
index 00000000000..a32b657e489
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem.ref
@@ -0,0 +1,2 @@
+unknown: warning: key at index 1 in bad-key-cert-mismatch.pem does not match next certificate
+unknown: warning: error loading private keys and certificates from: bad-key-cert-mismatch.pem: disabling TLS support
diff --git a/external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem b/external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem
new file mode 100644
index 00000000000..de1580888a8
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem
@@ -0,0 +1,64 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCu99Z6AB3EA2tA
+lWlJLPtsF2Ed81Hy2c5HYPmE8cGZJgp6YuzF+qxlBNHTk4c8HkobGqMTRU0x0qpz
+Mnltkq1JuIwjku4GzoEPcBPqJxSNVZ96pmrVWuxX+5ZnqS9gWbLZyjkCCqVQR/ny
+K0/tXij/1s7Kkol1lPOqgBhzSwgOqDLqfipxiakHZIB8TYI6p6hanNQyz4NWq1PE
+pWK9yhBJdeZJwK6K5VEMzqr//t+9dIT/dC8RoJkiHka24JzNCLx3GD/Q0GNGFGoE
+9Fcz28BelGpigWyleheqzuGPXYquEBHDAHaanRIoW0/dbG0KaKTTeHf9LegFXez2
+tJeLl+vpAgMBAAECggEBAIsJKoe7++s9BEdH82hQtGIKmgPgzKf8aCzUZLM+ISd/
+0Se74IbaUY/cqphETVx6fUzYd+niUhtbWlM8Mr3dppJEcif6o+cIxgnseAbDk1NU
+TOx7vb1ZCSJJLBWnnZwk6ziht3dl2kPXTkkgHd1zy4Sxv5W9qDmlaZN9QvCrGPX7
+ZkJnZg2QcLvjhaBCIXTYIpbTSWZjHBzecjmPrIb+NvO4/gbYgfAj9sJAPi5H3LQE
+8hZ30ylFZ03+2MKJoS+JrUZQllXyd92AmtXXv9jEFgLQ2mNETCXhsh9BK7qC8YKU
+ImZHGHgGQOA30PGEltstzgNvROKb/U2tPgVOo9v9L+ECgYEA1zLokvYwEyuN+9xc
+5L7cf4LA7k5WHNdFeERPudGO2RedfQkoZ8sP0WjCeg+LF/iWh4NfLMoGUNgxRQtv
+rv5GjDRvlvPXj6YHZo/uMgGLLeeZ6tMJ8NvnrZxNTIDPw+XTd5doiEmnrDrmJZH/
+QeT6HlBkIURjIuYpzFrBxzSvKu0CgYEA0CRAp+zP0QC75aHgvSVPB+7JU0xIEuGz
+CdYxWh7rHAztvxxdDFFwBjPEnczDmMF8o5lZwH4L1RFQ2b9UAZy451dEIVqxKp0W
+2mOemjohi3DR3nZfpS/Cpattwd61/KGSUUS0k3Lpp7ACCybqNl1wIcX50mbLOQGe
+RMu+2+NnmW0CgYBWyhpQQueqo5M0s2/ndS46YsJqmb9TDGLhGTPKLkDdPw/uAIaC
+LbwoaYadca1YMpKK/qmgx616Z2afgPg+7CAJpZAnohoavgwYCg43rrWyAsjpkslc
+kWPDedkW9JBWYldB0ReAd6we4vY0ysfWjIFvPl7Tp+APkCHlX+js7UuEFQKBgQDP
+9Eh8/kcrpDYW2cM2dz4cyOBwzvf7lXBR1aT9S4LPRcOLe4Ujt4HbUIGSv3B1AGvM
+8HwRrF2aBXDn/Rarfa/nwvKY+Iml78lTbNCbepTlQlUMlOw+mBc7eqlwV1kwDSWo
++KIJ53e3SEziY4EBzB0qQSi2pGlKjWlZhs8r1mo9iQKBgQCoZNYakj717J5FnpWC
+yhkuGYmbBItYBwL36TQqTD6Kq0oJcrBRtMxWWqMmlDV7w8BP4/A2cRXHJz2MLhm9
+Jc5OPh8OkFY4pT8NTpVYqq1pb2d5fzwRX68MKWtVBZzJqzK8w0t4QZLqqeAwQCrc
+Okn/aJneEclcdzv8JHfVMcdNxA==
+-----END PRIVATE KEY-----
diff --git a/external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem.ref b/external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem.ref
new file mode 100644
index 00000000000..a72c0d91103
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem.ref
@@ -0,0 +1,2 @@
+unknown: warning: No certs for key at index 5 in bad-rsa-key-last.pem
+unknown: warning: error loading private keys and certificates from: bad-rsa-key-last.pem: disabling TLS support
diff --git a/external/ibm-public/postfix/dist/src/tls/ecca-cert.pem b/external/ibm-public/postfix/dist/src/tls/ecca-cert.pem
new file mode 100644
index 00000000000..54418f19014
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/ecca-cert.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/ecca-pkey.pem b/external/ibm-public/postfix/dist/src/tls/ecca-pkey.pem
new file mode 100644
index 00000000000..2d95f45f39e
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/ecca-pkey.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgvhC73shHi6WonWdC
+rbMwDzIrjYIejrvmkNQo+7hFnp2hRANCAARYcKaWmm2MulstiE3b15jhdyZA+Fwy
+b0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfsG614fKHGUYzV
+-----END PRIVATE KEY-----
diff --git a/external/ibm-public/postfix/dist/src/tls/ecee-cert.pem b/external/ibm-public/postfix/dist/src/tls/ecee-cert.pem
new file mode 100644
index 00000000000..1afb2f538b0
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/ecee-cert.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/ecee-pkey.pem b/external/ibm-public/postfix/dist/src/tls/ecee-pkey.pem
new file mode 100644
index 00000000000..ffec71646df
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/ecee-pkey.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
diff --git a/external/ibm-public/postfix/dist/src/tls/ecroot-cert.pem b/external/ibm-public/postfix/dist/src/tls/ecroot-cert.pem
new file mode 100644
index 00000000000..4f5041cbc86
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/ecroot-cert.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/ecroot-pkey.pem b/external/ibm-public/postfix/dist/src/tls/ecroot-pkey.pem
new file mode 100644
index 00000000000..0d36dc4d300
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/ecroot-pkey.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg85iR6mrXjfV9O38h
+9/KivPeTKxdjXHQ6j2VCWD8K8KahRANCAAR8MXvjqDNXBKh79SxW0WpJfUBIptgx
+1xwT2k4HkP98rlo+pmzL39gpIT1P78VwKBlrq4RE7JHnzdlQzJNAWgdG
+-----END PRIVATE KEY-----
diff --git a/external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem b/external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem
new file mode 100644
index 00000000000..c7ba743663a
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem
@@ -0,0 +1,45 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
+subject=/CN=mx1.example.com
+issuer=/CN=EC issuer CA
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+
+subject=/CN=EC issuer CA
+issuer=/CN=EC root CA
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+
+subject=/CN=EC root CA
+issuer=/CN=EC root CA
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
+
diff --git a/external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem.ref b/external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem.ref
new file mode 100644
index 00000000000..95502d8c4a3
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem.ref
@@ -0,0 +1,12 @@
+depth = 0
+issuer = /CN=EC issuer CA
+subject = /CN=mx1.example.com
+
+depth = 1
+issuer = /CN=EC root CA
+subject = /CN=EC issuer CA
+
+depth = 2
+issuer = /CN=EC root CA
+subject = /CN=EC root CA
+
diff --git a/external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem b/external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem
new file mode 100644
index 00000000000..6ce758e7567
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem
@@ -0,0 +1,45 @@
+subject=/CN=mx1.example.com
+issuer=/CN=EC issuer CA
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+
+subject=/CN=EC issuer CA
+issuer=/CN=EC root CA
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+
+subject=/CN=EC root CA
+issuer=/CN=EC root CA
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
+
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
diff --git a/external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem.ref b/external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem.ref
new file mode 100644
index 00000000000..95502d8c4a3
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem.ref
@@ -0,0 +1,12 @@
+depth = 0
+issuer = /CN=EC issuer CA
+subject = /CN=mx1.example.com
+
+depth = 1
+issuer = /CN=EC root CA
+subject = /CN=EC issuer CA
+
+depth = 2
+issuer = /CN=EC root CA
+subject = /CN=EC root CA
+
diff --git a/external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem b/external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem
new file mode 100644
index 00000000000..b3dda42519f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem
@@ -0,0 +1,45 @@
+subject=/CN=mx1.example.com
+issuer=/CN=EC issuer CA
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+
+subject=/CN=EC issuer CA
+issuer=/CN=EC root CA
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
+
+subject=/CN=EC root CA
+issuer=/CN=EC root CA
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem.ref b/external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem.ref
new file mode 100644
index 00000000000..95502d8c4a3
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem.ref
@@ -0,0 +1,12 @@
+depth = 0
+issuer = /CN=EC issuer CA
+subject = /CN=mx1.example.com
+
+depth = 1
+issuer = /CN=EC root CA
+subject = /CN=EC issuer CA
+
+depth = 2
+issuer = /CN=EC root CA
+subject = /CN=EC root CA
+
diff --git a/external/ibm-public/postfix/dist/src/tls/goodchains.pem b/external/ibm-public/postfix/dist/src/tls/goodchains.pem
new file mode 100644
index 00000000000..81b2b3285a9
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/goodchains.pem
@@ -0,0 +1,121 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCu99Z6AB3EA2tA
+lWlJLPtsF2Ed81Hy2c5HYPmE8cGZJgp6YuzF+qxlBNHTk4c8HkobGqMTRU0x0qpz
+Mnltkq1JuIwjku4GzoEPcBPqJxSNVZ96pmrVWuxX+5ZnqS9gWbLZyjkCCqVQR/ny
+K0/tXij/1s7Kkol1lPOqgBhzSwgOqDLqfipxiakHZIB8TYI6p6hanNQyz4NWq1PE
+pWK9yhBJdeZJwK6K5VEMzqr//t+9dIT/dC8RoJkiHka24JzNCLx3GD/Q0GNGFGoE
+9Fcz28BelGpigWyleheqzuGPXYquEBHDAHaanRIoW0/dbG0KaKTTeHf9LegFXez2
+tJeLl+vpAgMBAAECggEBAIsJKoe7++s9BEdH82hQtGIKmgPgzKf8aCzUZLM+ISd/
+0Se74IbaUY/cqphETVx6fUzYd+niUhtbWlM8Mr3dppJEcif6o+cIxgnseAbDk1NU
+TOx7vb1ZCSJJLBWnnZwk6ziht3dl2kPXTkkgHd1zy4Sxv5W9qDmlaZN9QvCrGPX7
+ZkJnZg2QcLvjhaBCIXTYIpbTSWZjHBzecjmPrIb+NvO4/gbYgfAj9sJAPi5H3LQE
+8hZ30ylFZ03+2MKJoS+JrUZQllXyd92AmtXXv9jEFgLQ2mNETCXhsh9BK7qC8YKU
+ImZHGHgGQOA30PGEltstzgNvROKb/U2tPgVOo9v9L+ECgYEA1zLokvYwEyuN+9xc
+5L7cf4LA7k5WHNdFeERPudGO2RedfQkoZ8sP0WjCeg+LF/iWh4NfLMoGUNgxRQtv
+rv5GjDRvlvPXj6YHZo/uMgGLLeeZ6tMJ8NvnrZxNTIDPw+XTd5doiEmnrDrmJZH/
+QeT6HlBkIURjIuYpzFrBxzSvKu0CgYEA0CRAp+zP0QC75aHgvSVPB+7JU0xIEuGz
+CdYxWh7rHAztvxxdDFFwBjPEnczDmMF8o5lZwH4L1RFQ2b9UAZy451dEIVqxKp0W
+2mOemjohi3DR3nZfpS/Cpattwd61/KGSUUS0k3Lpp7ACCybqNl1wIcX50mbLOQGe
+RMu+2+NnmW0CgYBWyhpQQueqo5M0s2/ndS46YsJqmb9TDGLhGTPKLkDdPw/uAIaC
+LbwoaYadca1YMpKK/qmgx616Z2afgPg+7CAJpZAnohoavgwYCg43rrWyAsjpkslc
+kWPDedkW9JBWYldB0ReAd6we4vY0ysfWjIFvPl7Tp+APkCHlX+js7UuEFQKBgQDP
+9Eh8/kcrpDYW2cM2dz4cyOBwzvf7lXBR1aT9S4LPRcOLe4Ujt4HbUIGSv3B1AGvM
+8HwRrF2aBXDn/Rarfa/nwvKY+Iml78lTbNCbepTlQlUMlOw+mBc7eqlwV1kwDSWo
++KIJ53e3SEziY4EBzB0qQSi2pGlKjWlZhs8r1mo9iQKBgQCoZNYakj717J5FnpWC
+yhkuGYmbBItYBwL36TQqTD6Kq0oJcrBRtMxWWqMmlDV7w8BP4/A2cRXHJz2MLhm9
+Jc5OPh8OkFY4pT8NTpVYqq1pb2d5fzwRX68MKWtVBZzJqzK8w0t4QZLqqeAwQCrc
+Okn/aJneEclcdzv8JHfVMcdNxA==
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDLTCCAhWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1SU0Eg
+aXNzdWVyIENBMCAXDTE5MDEwODA2NDQzMloYDzIxMTkwMTA5MDY0NDMyWjAaMRgw
+FgYDVQQDDA9teDEuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCu99Z6AB3EA2tAlWlJLPtsF2Ed81Hy2c5HYPmE8cGZJgp6YuzF+qxl
+BNHTk4c8HkobGqMTRU0x0qpzMnltkq1JuIwjku4GzoEPcBPqJxSNVZ96pmrVWuxX
++5ZnqS9gWbLZyjkCCqVQR/nyK0/tXij/1s7Kkol1lPOqgBhzSwgOqDLqfipxiakH
+ZIB8TYI6p6hanNQyz4NWq1PEpWK9yhBJdeZJwK6K5VEMzqr//t+9dIT/dC8RoJki
+Hka24JzNCLx3GD/Q0GNGFGoE9Fcz28BelGpigWyleheqzuGPXYquEBHDAHaanRIo
+W0/dbG0KaKTTeHf9LegFXez2tJeLl+vpAgMBAAGjfjB8MB0GA1UdDgQWBBTCrBLC
+itbyxruhJFbJEaGYdG4NRjAfBgNVHSMEGDAWgBTCbuRdkXOuqXbXqJJnH5iQPhkT
+JTAJBgNVHRMEAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214
+MS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAYOgZ5NaFJhmjT6V+GI5m
+cuTsMC7WB5nQ8nbf2wxw052jgBvnZWAgnshtgWvrK0T6402VcTOzHt8VKS0KwLwk
+FESvj2rdoDGvGqUcw6DhCns98PRuts2nMTDlKYJTYWab2Q08PPYxTtRt1Y+A2sp7
+et+bxMjYr2mdO0wkqK7guUA9H2bZkGYJck5bbna67hpzx17YomBjDUjTtMiagXKs
+E5QzOXXqCQxiSunlxsMqDwt/HRxGvQy+BHuNq4epuZfeMOndIjl2ZyKdN2ABy88G
+dYqRO6nBHUO2/ZxlAZf11xpueVZZ61SueimPfzbsw0B7ZvPSi9KdbPIGBbD4cCwt
+JA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIC/jCCAeagAwIBAgIBAjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtSU0Eg
+cm9vdCBDQTAgFw0xOTAxMDgwNjQyMjRaGA8yMTE5MDEwOTA2NDIyNFowGDEWMBQG
+A1UEAwwNUlNBIGlzc3VlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAL3tLZ4hc8RmIX0Yd0uj1Z31mK94KMcVN//L0iiR/ZOFr39ma2Ys7AL0UQeV
+H9s4hUaMM91n0fkwVL0r8NUsCkuPS/MvJClWxTbN3rEzzaajD+BdyW1Y1QfdEI5t
+AI2wSSieF3GtiTmxH43lDHTeZz0qhwh8NNzh+j09DwYS+TfQnO70LdmR5Vks0SoF
+DmxTs2/DRup/iCWGd853C3T/lfixdhkdVwGNuxtuF6/xSEQirT2OUjjnVIcCPGq0
+Zbz3hFJ0xHoqiwNBv9PytfLk4BNf+VWTANFXnzNvZqWrOO8yQWS+RHIdf2+a96G2
+EFIgWz/rwo4WP9tozETlPzQc6P8CAwEAAaNTMFEwHQYDVR0OBBYEFMJu5F2Rc66p
+dteokmcfmJA+GRMlMB8GA1UdIwQYMBaAFJGpciw0EYdhbO3y0sM62cWnHTtiMA8G
+A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAD6ngGSUb9grVkhlb8M5
+geC4SEhBiysoXoxHleFW6FFe4k1v5dg/xbCbNwysToEG+2S498f2FfyNzKWVDSM7
+5al+4jYrKlwTbX6W9krH6iGhE0Sdz/YHWYdPCDYssdOvS46/+MGj16WPiOdj5UYY
+U0+TVKlqLOcpqkPKrz/9X7sM8bXi8FQHPme8ksvnB9qMdwcru/BN62tUOw1JHnmh
+CCUbI3TU5xE8fUCl4F43vsLq73EfaHs4TO9hhk2hBW7K0QOinNcFlcNy8AF7mF/T
+kY4FWI/kMfw6cXkg+F44Oy3j3KUF3hgByhWzTQimY2oRpk7U5tGuC8Xgh6eHPbRG
+Kck=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIC/DCCAeSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtSU0Eg
+cm9vdCBDQTAgFw0xOTAxMDgwNjE5NDJaGA8yMTE5MDEwOTA2MTk0MlowFjEUMBIG
+A1UEAwwLUlNBIHJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQCoZoGzTiMbZcztQVknoNmPtN7m/kDOfG95MWGSLHIDJlOI0OzpcfhiOUVh65An
+K2vHNrE37DDRl2YTmP3oBw8xn6BG6Ybe++kTR7g6xEnqR1kw6AStxo0OYE06NWp6
+yuO07nut+rNFMSSjgnjS4aj0fSiMSR7TuIzHbGvvJJXZpvYXxtnBgYQAAPJQuD0S
+oxQVSkyOIr/phPAkLWg5/d8prQDyEoMvo6NMPet/6/buqXaAvLXqUBeHgkEe+Zm2
+X8lMaz8ooT9OI/4ln/psk+jg90GTiMTAZFrKruHwBpNbVx0AyxuisiTqhv6M++fu
+1ViLHIsm+55CJj5OI676Q4JJAgMBAAGjUzBRMB0GA1UdDgQWBBSRqXIsNBGHYWzt
+8tLDOtnFpx07YjAfBgNVHSMEGDAWgBSRqXIsNBGHYWzt8tLDOtnFpx07YjAPBgNV
+HRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCHEQ8DRqrWz8xibaNEv3Id
+SEJvgfRRsMA7jk2HAnE84bO1ZLkXF9HX7oqXbIMRw5IZRUrBXO0fUwcxz3DwTYZj
+ojRPP1yNfylmc8uxyd2goMoG4OgTdt2/Ewu8bli0S9NapH9fdBYbSDUBw3QiH+Wy
+ze9BiDVLwM7eERHGj1XKlC3iUaTZTOFWrr4y5eRjCD8oMzCB/73CWMRwBGPyF+Wg
+uP8FfF7i05B9rrKELAzCr4/hqYPDYNX8mv8QzcwXbn93PY35VN5y/wBuccggv0af
+iK5NfoNxvmTp9SVD4wA2prlkq1lbjMuqoAxrKpCGG0I0x8Dzn3bTaTNETal61Wt/
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/goodchains.pem.ref b/external/ibm-public/postfix/dist/src/tls/goodchains.pem.ref
new file mode 100644
index 00000000000..ade7562acfa
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/goodchains.pem.ref
@@ -0,0 +1,24 @@
+depth = 0
+issuer = /CN=RSA issuer CA
+subject = /CN=mx1.example.com
+
+depth = 1
+issuer = /CN=RSA root CA
+subject = /CN=RSA issuer CA
+
+depth = 2
+issuer = /CN=RSA root CA
+subject = /CN=RSA root CA
+
+depth = 0
+issuer = /CN=EC issuer CA
+subject = /CN=mx1.example.com
+
+depth = 1
+issuer = /CN=EC root CA
+subject = /CN=EC issuer CA
+
+depth = 2
+issuer = /CN=EC root CA
+subject = /CN=EC root CA
+
diff --git a/external/ibm-public/postfix/dist/src/tls/mkcert.sh b/external/ibm-public/postfix/dist/src/tls/mkcert.sh
new file mode 100644
index 00000000000..c15f4e11af6
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/mkcert.sh
@@ -0,0 +1,264 @@
+#! /bin/bash
+#
+# Copyright (c) 2016 Viktor Dukhovni <openssl-users@dukhovni.org>.
+# All rights reserved.
+#
+# Licensed under the terms of the Postfix SECURE MAILER license
+# included with the Postfix source code.
+#
+# This file is dual-licensed and is also available under other terms.
+# Please contact the author.
+
+# 100 years should be enough for now
+if [ -z "$DAYS" ]; then
+ DAYS=36525
+fi
+
+if [ -z "$OPENSSL_SIGALG" ]; then
+ OPENSSL_SIGALG=sha256
+fi
+
+case ${OPENSSL_SIGALG} in
+ null) dopts=();;
+ *) dopts=(-"${OPENSSL_SIGALG}");;
+esac
+
+if [ -z "$REQMASK" ]; then
+ REQMASK=utf8only
+fi
+
+stderr_onerror() {
+ (
+ err=$("$@" >&3 2>&1) || {
+ printf "%s\n" "$err" >&2
+ exit 1
+ }
+ ) 3>&1
+}
+
+key() {
+ local key=$1; shift
+
+ local alg=rsa
+ if [ -n "$OPENSSL_KEYALG" ]; then
+ alg=$OPENSSL_KEYALG
+ fi
+
+ local bits=2048
+ if [ -n "$OPENSSL_KEYBITS" ]; then
+ bits=$OPENSSL_KEYBITS
+ fi
+
+ if [ ! -f "${key}.pem" ]; then
+ args=(-algorithm "$alg")
+ case $alg in
+ rsa) args=("${args[@]}" -pkeyopt rsa_keygen_bits:$bits );;
+ ec) args=("${args[@]}" -pkeyopt "ec_paramgen_curve:$bits")
+ args=("${args[@]}" -pkeyopt ec_param_enc:named_curve);;
+ dsa) args=(-paramfile "$bits");;
+ ed25519) ;;
+ ed448) ;;
+ *) printf "Unsupported key algorithm: %s\n" "$alg" >&2; return 1;;
+ esac
+ stderr_onerror \
+ openssl genpkey "${args[@]}" -out "${key}.pem"
+ fi
+}
+
+# Usage: $0 req keyname dn1 dn2 ...
+req() {
+ local key=$1; shift
+
+ key "$key"
+ local errs
+
+ stderr_onerror \
+ openssl req "${dopts[@]}" -new -key "${key}.pem" \
+ -config <(printf "string_mask=%s\n[req]\n%s\n%s\n[dn]\n" \
+ "$REQMASK" "prompt = no" "distinguished_name = dn"
+ for dn in "$@"; do echo "$dn"; done)
+}
+
+req_nocn() {
+ local key=$1; shift
+
+ key "$key"
+ stderr_onerror \
+ openssl req "${dopts[@]}" -new -subj / -key "${key}.pem" \
+ -config <(printf "[req]\n%s\n[dn]\nCN_default =\n" \
+ "distinguished_name = dn")
+}
+
+cert() {
+ local cert=$1; shift
+ local exts=$1; shift
+
+ stderr_onerror \
+ openssl x509 "${dopts[@]}" -req -out "${cert}.pem" \
+ -extfile <(printf "%s\n" "$exts") "$@"
+}
+
+genroot() {
+ local cn=$1; shift
+ local key=$1; shift
+ local cert=$1; shift
+ local skid="subjectKeyIdentifier = hash"
+ local akid="authorityKeyIdentifier = keyid"
+
+ exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = critical,CA:true")
+ for eku in "$@"
+ do
+ exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
+ done
+ csr=$(req "$key" "CN = $cn") || return 1
+ echo "$csr" |
+ cert "$cert" "$exts" -signkey "${key}.pem" -set_serial 1 -days "${DAYS}"
+}
+
+genca() {
+ local cn=$1; shift
+ local key=$1; shift
+ local cert=$1; shift
+ local cakey=$1; shift
+ local cacert=$1; shift
+ local skid="subjectKeyIdentifier = hash"
+ local akid="authorityKeyIdentifier = keyid"
+
+ exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = critical,CA:true")
+ for eku in "$@"
+ do
+ exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
+ done
+ if [ -n "$NC" ]; then
+ exts=$(printf "%s\nnameConstraints = %s\n" "$exts" "$NC")
+ fi
+ csr=$(req "$key" "CN = $cn") || return 1
+ echo "$csr" |
+ cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
+ -set_serial 2 -days "${DAYS}"
+}
+
+gen_nonbc_ca() {
+ local cn=$1; shift
+ local key=$1; shift
+ local cert=$1; shift
+ local cakey=$1; shift
+ local cacert=$1; shift
+ local skid="subjectKeyIdentifier = hash"
+ local akid="authorityKeyIdentifier = keyid"
+
+ exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid")
+ exts=$(printf "%s\nkeyUsage = %s\n" "$exts" "keyCertSign, cRLSign")
+ for eku in "$@"
+ do
+ exts=$(printf "%s\nextendedKeyUsage = %s\n" "$exts" "$eku")
+ done
+ csr=$(req "$key" "CN = $cn") || return 1
+ echo "$csr" |
+ cert "$cert" "$exts" -CA "${cacert}.pem" -CAkey "${cakey}.pem" \
+ -set_serial 2 -days "${DAYS}"
+}
+
+# Usage: $0 genpc keyname certname eekeyname eecertname pcext1 pcext2 ...
+#
+# Note: takes csr on stdin, so must be used with $0 req like this:
+#
+# $0 req keyname dn | $0 genpc keyname certname eekeyname eecertname pcext ...
+genpc() {
+ local key=$1; shift
+ local cert=$1; shift
+ local cakey=$1; shift
+ local ca=$1; shift
+
+ exts=$(printf "%s\n%s\n%s\n%s\n" \
+ "subjectKeyIdentifier = hash" \
+ "authorityKeyIdentifier = keyid, issuer:always" \
+ "basicConstraints = CA:false" \
+ "proxyCertInfo = critical, @pcexts";
+ echo "[pcexts]";
+ for x in "$@"; do echo $x; done)
+ cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
+ -set_serial 2 -days "${DAYS}"
+}
+
+# Usage: $0 geneealt keyname certname eekeyname eecertname alt1 alt2 ...
+#
+# Note: takes csr on stdin, so must be used with $0 req like this:
+#
+# $0 req keyname dn | $0 geneealt keyname certname eekeyname eecertname alt ...
+geneealt() {
+ local key=$1; shift
+ local cert=$1; shift
+ local cakey=$1; shift
+ local ca=$1; shift
+
+ exts=$(printf "%s\n%s\n%s\n%s\n" \
+ "subjectKeyIdentifier = hash" \
+ "authorityKeyIdentifier = keyid" \
+ "basicConstraints = CA:false" \
+ "subjectAltName = @alts";
+ echo "[alts]";
+ for x in "$@"; do echo $x; done)
+ cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
+ -set_serial 2 -days "${DAYS}"
+}
+
+genee() {
+ local OPTIND=1
+ local purpose=serverAuth
+
+ while getopts p: o
+ do
+ case $o in
+ p) purpose="$OPTARG";;
+ *) echo "Usage: $0 genee [-p EKU] cn keyname certname cakeyname cacertname" >&2
+ return 1;;
+ esac
+ done
+
+ shift $((OPTIND - 1))
+ local cn=$1; shift
+ local key=$1; shift
+ local cert=$1; shift
+ local cakey=$1; shift
+ local ca=$1; shift
+
+ exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
+ "subjectKeyIdentifier = hash" \
+ "authorityKeyIdentifier = keyid, issuer" \
+ "basicConstraints = CA:false" \
+ "extendedKeyUsage = $purpose" \
+ "subjectAltName = @alts" "DNS=${cn}")
+ csr=$(req "$key" "CN = $cn") || return 1
+ echo "$csr" |
+ cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
+ -set_serial 2 -days "${DAYS}" "$@"
+}
+
+genss() {
+ local cn=$1; shift
+ local key=$1; shift
+ local cert=$1; shift
+
+ exts=$(printf "%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
+ "subjectKeyIdentifier = hash" \
+ "authorityKeyIdentifier = keyid, issuer" \
+ "basicConstraints = CA:false" \
+ "extendedKeyUsage = serverAuth" \
+ "subjectAltName = @alts" "DNS=${cn}")
+ csr=$(req "$key" "CN = $cn") || return 1
+ echo "$csr" |
+ cert "$cert" "$exts" -signkey "${key}.pem" \
+ -set_serial 1 -days "${DAYS}" "$@"
+}
+
+gennocn() {
+ local key=$1; shift
+ local cert=$1; shift
+
+ csr=$(req_nocn "$key") || return 1
+ echo "$csr" |
+ cert "$cert" "" -signkey "${key}.pem" -set_serial 1 -days -1 "$@"
+}
+
+"$@"
diff --git a/external/ibm-public/postfix/dist/src/tls/rsaca-cert.pem b/external/ibm-public/postfix/dist/src/tls/rsaca-cert.pem
new file mode 100644
index 00000000000..1be736a8570
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/rsaca-cert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIC/jCCAeagAwIBAgIBAjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtSU0Eg
+cm9vdCBDQTAgFw0xOTAxMDgwNjQyMjRaGA8yMTE5MDEwOTA2NDIyNFowGDEWMBQG
+A1UEAwwNUlNBIGlzc3VlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAL3tLZ4hc8RmIX0Yd0uj1Z31mK94KMcVN//L0iiR/ZOFr39ma2Ys7AL0UQeV
+H9s4hUaMM91n0fkwVL0r8NUsCkuPS/MvJClWxTbN3rEzzaajD+BdyW1Y1QfdEI5t
+AI2wSSieF3GtiTmxH43lDHTeZz0qhwh8NNzh+j09DwYS+TfQnO70LdmR5Vks0SoF
+DmxTs2/DRup/iCWGd853C3T/lfixdhkdVwGNuxtuF6/xSEQirT2OUjjnVIcCPGq0
+Zbz3hFJ0xHoqiwNBv9PytfLk4BNf+VWTANFXnzNvZqWrOO8yQWS+RHIdf2+a96G2
+EFIgWz/rwo4WP9tozETlPzQc6P8CAwEAAaNTMFEwHQYDVR0OBBYEFMJu5F2Rc66p
+dteokmcfmJA+GRMlMB8GA1UdIwQYMBaAFJGpciw0EYdhbO3y0sM62cWnHTtiMA8G
+A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAD6ngGSUb9grVkhlb8M5
+geC4SEhBiysoXoxHleFW6FFe4k1v5dg/xbCbNwysToEG+2S498f2FfyNzKWVDSM7
+5al+4jYrKlwTbX6W9krH6iGhE0Sdz/YHWYdPCDYssdOvS46/+MGj16WPiOdj5UYY
+U0+TVKlqLOcpqkPKrz/9X7sM8bXi8FQHPme8ksvnB9qMdwcru/BN62tUOw1JHnmh
+CCUbI3TU5xE8fUCl4F43vsLq73EfaHs4TO9hhk2hBW7K0QOinNcFlcNy8AF7mF/T
+kY4FWI/kMfw6cXkg+F44Oy3j3KUF3hgByhWzTQimY2oRpk7U5tGuC8Xgh6eHPbRG
+Kck=
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/rsaca-pkey.pem b/external/ibm-public/postfix/dist/src/tls/rsaca-pkey.pem
new file mode 100644
index 00000000000..2381ae638e6
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/rsaca-pkey.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC97S2eIXPEZiF9
+GHdLo9Wd9ZiveCjHFTf/y9Iokf2Tha9/ZmtmLOwC9FEHlR/bOIVGjDPdZ9H5MFS9
+K/DVLApLj0vzLyQpVsU2zd6xM82mow/gXcltWNUH3RCObQCNsEkonhdxrYk5sR+N
+5Qx03mc9KocIfDTc4fo9PQ8GEvk30Jzu9C3ZkeVZLNEqBQ5sU7Nvw0bqf4glhnfO
+dwt0/5X4sXYZHVcBjbsbbhev8UhEIq09jlI451SHAjxqtGW894RSdMR6KosDQb/T
+8rXy5OATX/lVkwDRV58zb2alqzjvMkFkvkRyHX9vmvehthBSIFs/68KOFj/baMxE
+5T80HOj/AgMBAAECggEBAIY9Ch4XRMzO5uKVFVRoEwcXXHjBNAkqTS9F719veEv5
+lEY2rLhGDfY0msUCOMboVwK6+7mEtNsstugSE6GIBCrNuH/ElQmG49NNhRW4KKWb
+4Q/TGhhoTgHF1PrlvhtnOv4zZxyY7EHTmBrhhoFf5JZN5a0wpOht7EG2U1UWugEg
+/fOXp9XUsmJRxwp1jukqIi71GDVtoq3XCK7clluvNdeSlBn7D8dZ8cYUnMkqqaZA
+YYamyP3qF6UdxblW3xzGC3/0sLQvmHZOlMBuSpWUgr6NDsQPG4qXq10XePeteViw
+WnUqu11ILp8Ivoc20wJkokj1dCN3MOO0MyGcCxEX+5ECgYEA/P+Y+0AXq1j9yjNM
+aaXT3EZwSSAP/5MtZRiomFVwCgYbH6/hUV+OVih20Yhsl3MA5vgQTpSThZmmcBPC
+c3bn53OXVi6jnSzNzuQW28R8pSGoNnGT6TzG+J+my7ZxA0NTCAa72qhDgbI0dqd/
+sjk1E6hRtOkEI8fD5/IipkvxCpcCgYEAwC4FA0AA6Oy2YOAi1KeACZpIKIDcOFJz
+TLfuxhwnNi5C/1i99d5W0doCzaneECyadhGKPbv0DlVS2fe9Xm06PQLD2Y/+vkag
+iQ7V31JfwvoTQNTPVqnGcRu2ZmzI8Nja4/BcEEoxpPbMVbQ1ualkqcwpYu66ZlbD
+yWpCLSGFadkCgYEAvAkoZYzkSqjwr4jjAR6L0QrVR7Q5z8VOlvX10Iqno/uXyzxI
+Zdd0jdqzPNZ9hy6lfATg8daBsmlZh7FX88NrZt3Fm/s8BYSYTm2+A4cM8RqL0DMo
+MNDIPV9Dc+LcKgWuv6dplYE78zhEv++L/CWCqmKOn7wUJJfDpi+Tyy9kLm8CgYAy
++gIKYqfbIS8fc1TJ48Rqx6nsVIIVzokXCJMlqcIc9RiAcyGwXlHZSGMF+tEUqUAv
+oWdyCLEsPCXF+5kXuxF/rYQV6cRA5Ksgr/a7TjZomb0RrWFyM4aX6inv8Vs7x8oI
+PHGvQH76qxx4f1zg6rXw9F7mBz0aeFlmy/DR19pzwQKBgQCJWwlv7zisuTDXAuG/
+KF4VV6D2Y00pEHsxVx/RGeUXm+3HmqrZbcnccgivxyNMIAfuE5+7s2wfnjG38nnw
+DbZtp+rEcKX1h+95QnOlFxiowdlfX/ueOC2J59+Dc+R7UoDxqkQrSbdE5advHIl9
+Xb64SvwMhLzJYSYacv+fogoAPw==
+-----END PRIVATE KEY-----
diff --git a/external/ibm-public/postfix/dist/src/tls/rsaee-cert.pem b/external/ibm-public/postfix/dist/src/tls/rsaee-cert.pem
new file mode 100644
index 00000000000..9f923b4c85d
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/rsaee-cert.pem
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDLTCCAhWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1SU0Eg
+aXNzdWVyIENBMCAXDTE5MDEwODA2NDQzMloYDzIxMTkwMTA5MDY0NDMyWjAaMRgw
+FgYDVQQDDA9teDEuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCu99Z6AB3EA2tAlWlJLPtsF2Ed81Hy2c5HYPmE8cGZJgp6YuzF+qxl
+BNHTk4c8HkobGqMTRU0x0qpzMnltkq1JuIwjku4GzoEPcBPqJxSNVZ96pmrVWuxX
++5ZnqS9gWbLZyjkCCqVQR/nyK0/tXij/1s7Kkol1lPOqgBhzSwgOqDLqfipxiakH
+ZIB8TYI6p6hanNQyz4NWq1PEpWK9yhBJdeZJwK6K5VEMzqr//t+9dIT/dC8RoJki
+Hka24JzNCLx3GD/Q0GNGFGoE9Fcz28BelGpigWyleheqzuGPXYquEBHDAHaanRIo
+W0/dbG0KaKTTeHf9LegFXez2tJeLl+vpAgMBAAGjfjB8MB0GA1UdDgQWBBTCrBLC
+itbyxruhJFbJEaGYdG4NRjAfBgNVHSMEGDAWgBTCbuRdkXOuqXbXqJJnH5iQPhkT
+JTAJBgNVHRMEAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214
+MS5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAYOgZ5NaFJhmjT6V+GI5m
+cuTsMC7WB5nQ8nbf2wxw052jgBvnZWAgnshtgWvrK0T6402VcTOzHt8VKS0KwLwk
+FESvj2rdoDGvGqUcw6DhCns98PRuts2nMTDlKYJTYWab2Q08PPYxTtRt1Y+A2sp7
+et+bxMjYr2mdO0wkqK7guUA9H2bZkGYJck5bbna67hpzx17YomBjDUjTtMiagXKs
+E5QzOXXqCQxiSunlxsMqDwt/HRxGvQy+BHuNq4epuZfeMOndIjl2ZyKdN2ABy88G
+dYqRO6nBHUO2/ZxlAZf11xpueVZZ61SueimPfzbsw0B7ZvPSi9KdbPIGBbD4cCwt
+JA==
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/rsaee-pkey.pem b/external/ibm-public/postfix/dist/src/tls/rsaee-pkey.pem
new file mode 100644
index 00000000000..aa4e4981df2
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/rsaee-pkey.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCu99Z6AB3EA2tA
+lWlJLPtsF2Ed81Hy2c5HYPmE8cGZJgp6YuzF+qxlBNHTk4c8HkobGqMTRU0x0qpz
+Mnltkq1JuIwjku4GzoEPcBPqJxSNVZ96pmrVWuxX+5ZnqS9gWbLZyjkCCqVQR/ny
+K0/tXij/1s7Kkol1lPOqgBhzSwgOqDLqfipxiakHZIB8TYI6p6hanNQyz4NWq1PE
+pWK9yhBJdeZJwK6K5VEMzqr//t+9dIT/dC8RoJkiHka24JzNCLx3GD/Q0GNGFGoE
+9Fcz28BelGpigWyleheqzuGPXYquEBHDAHaanRIoW0/dbG0KaKTTeHf9LegFXez2
+tJeLl+vpAgMBAAECggEBAIsJKoe7++s9BEdH82hQtGIKmgPgzKf8aCzUZLM+ISd/
+0Se74IbaUY/cqphETVx6fUzYd+niUhtbWlM8Mr3dppJEcif6o+cIxgnseAbDk1NU
+TOx7vb1ZCSJJLBWnnZwk6ziht3dl2kPXTkkgHd1zy4Sxv5W9qDmlaZN9QvCrGPX7
+ZkJnZg2QcLvjhaBCIXTYIpbTSWZjHBzecjmPrIb+NvO4/gbYgfAj9sJAPi5H3LQE
+8hZ30ylFZ03+2MKJoS+JrUZQllXyd92AmtXXv9jEFgLQ2mNETCXhsh9BK7qC8YKU
+ImZHGHgGQOA30PGEltstzgNvROKb/U2tPgVOo9v9L+ECgYEA1zLokvYwEyuN+9xc
+5L7cf4LA7k5WHNdFeERPudGO2RedfQkoZ8sP0WjCeg+LF/iWh4NfLMoGUNgxRQtv
+rv5GjDRvlvPXj6YHZo/uMgGLLeeZ6tMJ8NvnrZxNTIDPw+XTd5doiEmnrDrmJZH/
+QeT6HlBkIURjIuYpzFrBxzSvKu0CgYEA0CRAp+zP0QC75aHgvSVPB+7JU0xIEuGz
+CdYxWh7rHAztvxxdDFFwBjPEnczDmMF8o5lZwH4L1RFQ2b9UAZy451dEIVqxKp0W
+2mOemjohi3DR3nZfpS/Cpattwd61/KGSUUS0k3Lpp7ACCybqNl1wIcX50mbLOQGe
+RMu+2+NnmW0CgYBWyhpQQueqo5M0s2/ndS46YsJqmb9TDGLhGTPKLkDdPw/uAIaC
+LbwoaYadca1YMpKK/qmgx616Z2afgPg+7CAJpZAnohoavgwYCg43rrWyAsjpkslc
+kWPDedkW9JBWYldB0ReAd6we4vY0ysfWjIFvPl7Tp+APkCHlX+js7UuEFQKBgQDP
+9Eh8/kcrpDYW2cM2dz4cyOBwzvf7lXBR1aT9S4LPRcOLe4Ujt4HbUIGSv3B1AGvM
+8HwRrF2aBXDn/Rarfa/nwvKY+Iml78lTbNCbepTlQlUMlOw+mBc7eqlwV1kwDSWo
++KIJ53e3SEziY4EBzB0qQSi2pGlKjWlZhs8r1mo9iQKBgQCoZNYakj717J5FnpWC
+yhkuGYmbBItYBwL36TQqTD6Kq0oJcrBRtMxWWqMmlDV7w8BP4/A2cRXHJz2MLhm9
+Jc5OPh8OkFY4pT8NTpVYqq1pb2d5fzwRX68MKWtVBZzJqzK8w0t4QZLqqeAwQCrc
+Okn/aJneEclcdzv8JHfVMcdNxA==
+-----END PRIVATE KEY-----
diff --git a/external/ibm-public/postfix/dist/src/tls/rsaroot-cert.pem b/external/ibm-public/postfix/dist/src/tls/rsaroot-cert.pem
new file mode 100644
index 00000000000..39114511b16
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/rsaroot-cert.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC/DCCAeSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtSU0Eg
+cm9vdCBDQTAgFw0xOTAxMDgwNjE5NDJaGA8yMTE5MDEwOTA2MTk0MlowFjEUMBIG
+A1UEAwwLUlNBIHJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQCoZoGzTiMbZcztQVknoNmPtN7m/kDOfG95MWGSLHIDJlOI0OzpcfhiOUVh65An
+K2vHNrE37DDRl2YTmP3oBw8xn6BG6Ybe++kTR7g6xEnqR1kw6AStxo0OYE06NWp6
+yuO07nut+rNFMSSjgnjS4aj0fSiMSR7TuIzHbGvvJJXZpvYXxtnBgYQAAPJQuD0S
+oxQVSkyOIr/phPAkLWg5/d8prQDyEoMvo6NMPet/6/buqXaAvLXqUBeHgkEe+Zm2
+X8lMaz8ooT9OI/4ln/psk+jg90GTiMTAZFrKruHwBpNbVx0AyxuisiTqhv6M++fu
+1ViLHIsm+55CJj5OI676Q4JJAgMBAAGjUzBRMB0GA1UdDgQWBBSRqXIsNBGHYWzt
+8tLDOtnFpx07YjAfBgNVHSMEGDAWgBSRqXIsNBGHYWzt8tLDOtnFpx07YjAPBgNV
+HRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCHEQ8DRqrWz8xibaNEv3Id
+SEJvgfRRsMA7jk2HAnE84bO1ZLkXF9HX7oqXbIMRw5IZRUrBXO0fUwcxz3DwTYZj
+ojRPP1yNfylmc8uxyd2goMoG4OgTdt2/Ewu8bli0S9NapH9fdBYbSDUBw3QiH+Wy
+ze9BiDVLwM7eERHGj1XKlC3iUaTZTOFWrr4y5eRjCD8oMzCB/73CWMRwBGPyF+Wg
+uP8FfF7i05B9rrKELAzCr4/hqYPDYNX8mv8QzcwXbn93PY35VN5y/wBuccggv0af
+iK5NfoNxvmTp9SVD4wA2prlkq1lbjMuqoAxrKpCGG0I0x8Dzn3bTaTNETal61Wt/
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/rsaroot-pkey.pem b/external/ibm-public/postfix/dist/src/tls/rsaroot-pkey.pem
new file mode 100644
index 00000000000..a5509b7266f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/rsaroot-pkey.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCoZoGzTiMbZczt
+QVknoNmPtN7m/kDOfG95MWGSLHIDJlOI0OzpcfhiOUVh65AnK2vHNrE37DDRl2YT
+mP3oBw8xn6BG6Ybe++kTR7g6xEnqR1kw6AStxo0OYE06NWp6yuO07nut+rNFMSSj
+gnjS4aj0fSiMSR7TuIzHbGvvJJXZpvYXxtnBgYQAAPJQuD0SoxQVSkyOIr/phPAk
+LWg5/d8prQDyEoMvo6NMPet/6/buqXaAvLXqUBeHgkEe+Zm2X8lMaz8ooT9OI/4l
+n/psk+jg90GTiMTAZFrKruHwBpNbVx0AyxuisiTqhv6M++fu1ViLHIsm+55CJj5O
+I676Q4JJAgMBAAECggEBAKLmzk7KpnFpb+yPC5SnJ+65M+tWRxC4FQmyuEUz03Ky
+j5pJKPTGeFVkO3b27fLGMTN798E2LR+DCo6or+3VbmA9n0kZvItWOuiYt2G54hrM
+vD3wJB6KdIdUp0BIzeFNBStQi7oIS4UCfgPiQckV3F/t9tyGG1kKLLz5aAvlY0Qw
+iXylE9h6dDZyufLPlkq0KVVuZA2Em1oa6UaqSYgKPX5KN0Oa4cVmzqXVt0BGq1tB
+SW80CAtKIH2AhCvHQ98ZlWbt1XgzFeP/3idZdjF2H0y2cg9rBDwRmFBwVTceQSbY
+Ezrh5WW4okFpldb/qxjURuhwkPpf3vMe/jOIBUoXjRECgYEA2/Xoz4Z8RmhgPjh2
+QOXwSuCWyKVpOXbCoP9hH9stVbUaxDuU7/ywSVW0P+x7hImUXnnKDp6pJ+NzO96b
+u6nBuUH6tNP+GTyWFgwHJf//6rEQg9WGIK0srX8Epg+S0wCRlvxggIwXWQe3HY9P
+KWFJJdBJ165AMoc/yeYHEsK536UCgYEAw/3xTrrOqNnstLwRJw2uKYj8BDTMgCA4
+ZW96t6hYI/Pwweuu4MXVCaCnt4tzyrYVP6FcYXK5Oa0G8yTF32mk45Nmro9Q4ZhX
+Wyavk/P37W0Ep+vSVtbJ7/zgRLTGVh8LPn3T7dVcoXx/JSvEW8Ofp49GXHKq5l2V
+0luXyZmfVtUCgYEAw0Ijnf1TWqkTLoiuqOO1kLKYB5uWshUzpvms/Ttyng+7qBEA
+IJ3e2+rBrLE/4KLE260faiT8IlWtmKr+8fM67jqc1GMPwNVgokehHOGJC4yNDYrB
+m0Y/T/Bebw+KFdb+Ztq4y8QQgc7whcQO0Lv01CV3N4gOowwe2xpgkw3bNKUCgYAf
+a/gjAiodwgqEE17Anx3cBN06o2hh5kiEYrIO/ctbwEFKJcn8uVrlVz9sWswupLCV
+af5QlT8C8y2ZD701i09nOPuOYuW5tV3T/EjL9KI8C21iqpknWPo5IpamDUF7DzET
+TMMMb1eRgE82G2U4vQ08pOjH645groJVnl+gb6OvHQKBgCurbKUMy0kPGECptAJ9
+dgqC9fricGX63bMPIcnz0V7uqvYbalNPhlmhwvMCkPNebWgzMnLQM3zrh+VnmOR2
+43MfgCm/+hqhRIyt3PQcgKS7shzrf2xPFZRMZVJFRk+sbDaD0MhUxXQ4g34tHtFz
+ozsnCRsyRaJNG8hC49dTTrlh
+-----END PRIVATE KEY-----
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_proxy.h b/external/ibm-public/postfix/dist/src/tls/tls_proxy.h
index 1beea9e2245..495360a9408 100644
--- a/external/ibm-public/postfix/dist/src/tls/tls_proxy.h
+++ b/external/ibm-public/postfix/dist/src/tls/tls_proxy.h
@@ -1,4 +1,4 @@
-/* $NetBSD: tls_proxy.h,v 1.1.1.1 2011/03/02 19:32:27 tron Exp $ */
+/* $NetBSD: tls_proxy.h,v 1.1.1.2 2020/03/18 18:59:35 christos Exp $ */
#ifndef _TLS_PROXY_H_INCLUDED_
#define _TLS_PROXY_H_INCLUDED_
@@ -33,13 +33,252 @@
#ifdef USE_TLS
+ /*
+ * TLS_CLIENT_PARAMS structure. If this changes, update all
+ * TLS_CLIENT_PARAMS related functions in tls_proxy_client_*.c.
+ *
+ * In the serialization these attributes are identified by their configuration
+ * parameter names.
+ *
+ * NOTE: this does not include openssl_path.
+ *
+ * TODO: TLS_SERVER_PARAM structure, like TLS_CLIENT_PARAMS plus
+ * VAR_TLS_SERVER_SNI_MAPS.
+ */
+typedef struct TLS_CLIENT_PARAMS {
+ char *tls_high_clist;
+ char *tls_medium_clist;
+ char *tls_low_clist;
+ char *tls_export_clist;
+ char *tls_null_clist;
+ char *tls_eecdh_auto;
+ char *tls_eecdh_strong;
+ char *tls_eecdh_ultra;
+ char *tls_bug_tweaks;
+ char *tls_ssl_options;
+ char *tls_dane_digests;
+ char *tls_mgr_service;
+ char *tls_tkt_cipher;
+ int tls_daemon_rand_bytes;
+ int tls_append_def_CA;
+ int tls_bc_pkey_fprint;
+ int tls_preempt_clist;
+ int tls_multi_wildcard;
+} TLS_CLIENT_PARAMS;
+
+#define TLS_PROXY_PARAMS(params, a1, a2, a3, a4, a5, a6, a7, a8, \
+ a9, a10, a11, a12, a13, a14, a15, a16, a17, a18) \
+ (((params)->a1), ((params)->a2), ((params)->a3), \
+ ((params)->a4), ((params)->a5), ((params)->a6), ((params)->a7), \
+ ((params)->a8), ((params)->a9), ((params)->a10), ((params)->a11), \
+ ((params)->a12), ((params)->a13), ((params)->a14), ((params)->a15), \
+ ((params)->a16), ((params)->a17), ((params)->a18))
+
+ /*
+ * tls_proxy_client_param_misc.c, tls_proxy_client_param_print.c, and
+ * tls_proxy_client_param_scan.c.
+ */
+extern TLS_CLIENT_PARAMS *tls_proxy_client_param_from_config(TLS_CLIENT_PARAMS *);
+extern char *tls_proxy_client_param_to_string(VSTRING *, TLS_CLIENT_PARAMS *);
+extern char *tls_proxy_client_param_with_names_to_string(VSTRING *, TLS_CLIENT_PARAMS *);
+extern int tls_proxy_client_param_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *);
+extern void tls_proxy_client_param_free(TLS_CLIENT_PARAMS *);
+extern int tls_proxy_client_param_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *);
+
+ /*
+ * Functions that handle TLS_XXX_INIT_PROPS and TLS_XXX_START_PROPS. These
+ * data structures are defined elsewhere, because they are also used in
+ * non-proxied requests.
+ */
+#define tls_proxy_legacy_open(service, flags, peer_stream, peer_addr, \
+ peer_port, timeout, serverid) \
+ tls_proxy_open((service), (flags), (peer_stream), (peer_addr), \
+ (peer_port), (timeout), (timeout), (serverid), \
+ (void *) 0, (void *) 0, (void *) 0)
+
extern VSTREAM *tls_proxy_open(const char *, int, VSTREAM *, const char *,
- const char *, int);
+ const char *, int, int, const char *,
+ void *, void *, void *);
+
+#define TLS_PROXY_CLIENT_INIT_PROPS(props, a1, a2, a3, a4, a5, a6, a7, a8, \
+ a9, a10, a11, a12, a13, a14) \
+ (((props)->a1), ((props)->a2), ((props)->a3), \
+ ((props)->a4), ((props)->a5), ((props)->a6), ((props)->a7), \
+ ((props)->a8), ((props)->a9), ((props)->a10), ((props)->a11), \
+ ((props)->a12), ((props)->a13), ((props)->a14))
+
+#define TLS_PROXY_CLIENT_START_PROPS(props, a1, a2, a3, a4, a5, a6, a7, a8, \
+ a9, a10, a11, a12, a13, a14) \
+ (((props)->a1), ((props)->a2), ((props)->a3), \
+ ((props)->a4), ((props)->a5), ((props)->a6), ((props)->a7), \
+ ((props)->a8), ((props)->a9), ((props)->a10), ((props)->a11), \
+ ((props)->a12), ((props)->a13), ((props)->a14))
+
extern TLS_SESS_STATE *tls_proxy_context_receive(VSTREAM *);
extern void tls_proxy_context_free(TLS_SESS_STATE *);
extern int tls_proxy_context_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *);
extern int tls_proxy_context_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *);
+extern int tls_proxy_client_init_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *);
+extern int tls_proxy_client_init_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *);
+extern void tls_proxy_client_init_free(TLS_CLIENT_INIT_PROPS *);
+extern char *tls_proxy_client_init_to_string(VSTRING *, TLS_CLIENT_INIT_PROPS *);
+extern char *tls_proxy_client_init_with_names_to_string(VSTRING *, TLS_CLIENT_INIT_PROPS *);
+
+extern int tls_proxy_client_start_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *);
+extern int tls_proxy_client_start_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *);
+extern void tls_proxy_client_start_free(TLS_CLIENT_START_PROPS *);
+
+extern int tls_proxy_server_init_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *);
+extern int tls_proxy_server_init_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *);
+extern void tls_proxy_server_init_free(TLS_SERVER_INIT_PROPS *);
+
+extern int tls_proxy_server_start_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *);
+extern int tls_proxy_server_start_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *);
+
+extern void tls_proxy_server_start_free(TLS_SERVER_START_PROPS *);
+
+#endif /* USE_TLS */
+
+ /*
+ * TLSPROXY attributes, unconditionally exposed.
+ */
+#define TLS_ATTR_REMOTE_ENDPT "remote_endpoint" /* name[addr]:port */
+#define TLS_ATTR_FLAGS "flags"
+#define TLS_ATTR_TIMEOUT "timeout"
+#define TLS_ATTR_SERVERID "serverid"
+
+#ifdef USE_TLS
+
+ /*
+ * Misc attributes.
+ */
+#define TLS_ATTR_COUNT "count"
+
+ /*
+ * TLS_SESS_STATE attributes.
+ */
+#define TLS_ATTR_PEER_CN "peer_CN"
+#define TLS_ATTR_ISSUER_CN "issuer_CN"
+#define TLS_ATTR_PEER_CERT_FPT "peer_fingerprint"
+#define TLS_ATTR_PEER_PKEY_FPT "peer_pubkey_fingerprint"
+#define TLS_ATTR_PEER_STATUS "peer_status"
+#define TLS_ATTR_CIPHER_PROTOCOL "cipher_protocol"
+#define TLS_ATTR_CIPHER_NAME "cipher_name"
+#define TLS_ATTR_CIPHER_USEBITS "cipher_usebits"
+#define TLS_ATTR_CIPHER_ALGBITS "cipher_algbits"
+#define TLS_ATTR_KEX_NAME "key_exchange"
+#define TLS_ATTR_KEX_CURVE "key_exchange_curve"
+#define TLS_ATTR_KEX_BITS "key_exchange_bits"
+#define TLS_ATTR_CLNT_SIG_NAME "clnt_signature"
+#define TLS_ATTR_CLNT_SIG_CURVE "clnt_signature_curve"
+#define TLS_ATTR_CLNT_SIG_BITS "clnt_signature_bits"
+#define TLS_ATTR_CLNT_SIG_DGST "clnt_signature_digest"
+#define TLS_ATTR_SRVR_SIG_NAME "srvr_signature"
+#define TLS_ATTR_SRVR_SIG_CURVE "srvr_signature_curve"
+#define TLS_ATTR_SRVR_SIG_BITS "srvr_signature_bits"
+#define TLS_ATTR_SRVR_SIG_DGST "srvr_signature_digest"
+#define TLS_ATTR_NAMADDR "namaddr"
+
+ /*
+ * TLS_SERVER_INIT_PROPS attributes.
+ */
+#define TLS_ATTR_LOG_PARAM "log_param"
+#define TLS_ATTR_LOG_LEVEL "log_level"
+#define TLS_ATTR_VERIFYDEPTH "verifydepth"
+#define TLS_ATTR_CACHE_TYPE "cache_type"
+#define TLS_ATTR_SET_SESSID "set_sessid"
+#define TLS_ATTR_CHAIN_FILES "chain_files"
+#define TLS_ATTR_CERT_FILE "cert_file"
+#define TLS_ATTR_KEY_FILE "key_file"
+#define TLS_ATTR_DCERT_FILE "dcert_file"
+#define TLS_ATTR_DKEY_FILE "dkey_file"
+#define TLS_ATTR_ECCERT_FILE "eccert_file"
+#define TLS_ATTR_ECKEY_FILE "eckey_file"
+#define TLS_ATTR_CAFILE "CAfile"
+#define TLS_ATTR_CAPATH "CApath"
+#define TLS_ATTR_PROTOCOLS "protocols"
+#define TLS_ATTR_EECDH_GRADE "eecdh_grade"
+#define TLS_ATTR_DH1K_PARAM_FILE "dh1024_param_file"
+#define TLS_ATTR_DH512_PARAM_FILE "dh512_param_file"
+#define TLS_ATTR_ASK_CCERT "ask_ccert"
+#define TLS_ATTR_MDALG "mdalg"
+
+ /*
+ * TLS_SERVER_START_PROPS attributes.
+ */
+#define TLS_ATTR_TIMEOUT "timeout"
+#define TLS_ATTR_REQUIRECERT "requirecert"
+#define TLS_ATTR_SERVERID "serverid"
+#define TLS_ATTR_NAMADDR "namaddr"
+#define TLS_ATTR_CIPHER_GRADE "cipher_grade"
+#define TLS_ATTR_CIPHER_EXCLUSIONS "cipher_exclusions"
+#define TLS_ATTR_MDALG "mdalg"
+
+ /*
+ * TLS_CLIENT_INIT_PROPS attributes.
+ */
+#define TLS_ATTR_LOG_PARAM "log_param"
+#define TLS_ATTR_LOG_LEVEL "log_level"
+#define TLS_ATTR_VERIFYDEPTH "verifydepth"
+#define TLS_ATTR_CACHE_TYPE "cache_type"
+#define TLS_ATTR_CHAIN_FILES "chain_files"
+#define TLS_ATTR_CERT_FILE "cert_file"
+#define TLS_ATTR_KEY_FILE "key_file"
+#define TLS_ATTR_DCERT_FILE "dcert_file"
+#define TLS_ATTR_DKEY_FILE "dkey_file"
+#define TLS_ATTR_ECCERT_FILE "eccert_file"
+#define TLS_ATTR_ECKEY_FILE "eckey_file"
+#define TLS_ATTR_CAFILE "CAfile"
+#define TLS_ATTR_CAPATH "CApath"
+#define TLS_ATTR_MDALG "mdalg"
+
+ /*
+ * TLS_CLIENT_START_PROPS attributes.
+ */
+#define TLS_ATTR_TIMEOUT "timeout"
+#define TLS_ATTR_TLS_LEVEL "tls_level"
+#define TLS_ATTR_NEXTHOP "nexthop"
+#define TLS_ATTR_HOST "host"
+#define TLS_ATTR_NAMADDR "namaddr"
+#define TLS_ATTR_SNI "sni"
+#define TLS_ATTR_SERVERID "serverid"
+#define TLS_ATTR_HELO "helo"
+#define TLS_ATTR_PROTOCOLS "protocols"
+#define TLS_ATTR_CIPHER_GRADE "cipher_grade"
+#define TLS_ATTR_CIPHER_EXCLUSIONS "cipher_exclusions"
+#define TLS_ATTR_MATCHARGV "matchargv"
+#define TLS_ATTR_MDALG "mdalg"
+#define TLS_ATTR_DANE "dane"
+
+ /*
+ * TLS_TLSA attributes.
+ */
+#define TLS_ATTR_MDALG "mdalg"
+#define TLS_ATTR_CERTS "certs"
+#define TLS_ATTR_PKEYS "pkeys"
+
+ /*
+ * TLS_CERTS attributes.
+ */
+#define TLS_ATTR_CERT "cert"
+
+ /*
+ * TLS_PKEYS attributes.
+ */
+#define TLS_ATTR_PKEY "pkey"
+
+ /*
+ * TLS_DANE attributes.
+ */
+#define TLS_ATTR_TA "ta"
+#define TLS_ATTR_EE "ee"
+#define TLS_ATTR_CERTS "certs"
+#define TLS_ATTR_PKEYS "pkeys"
+#define TLS_ATTR_DOMAIN "domain"
+#define TLS_ATTR_FLAGS "flags"
+#define TLS_ATTR_EXP "exp"
+
#endif
/* LICENSE
@@ -51,6 +290,11 @@ extern int tls_proxy_context_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_misc.c b/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_misc.c
new file mode 100644
index 00000000000..03ce33cdb68
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_misc.c
@@ -0,0 +1,192 @@
+/* $NetBSD: tls_proxy_client_misc.c,v 1.1.1.1 2020/03/18 18:59:35 christos Exp $ */
+
+/*++
+/* NAME
+/* tls_proxy_client_misc 3
+/* SUMMARY
+/* TLS_CLIENT_XXX structure support
+/* SYNOPSIS
+/* #include <tls_proxy.h>
+/*
+/* TLS_CLIENT_PARAMS *tls_proxy_client_param_from_config(params)
+/* TLS_CLIENT_PARAMS *params;
+/*
+/* char *tls_proxy_client_param_to_string(buf, params)
+/* VSTRING *buf;
+/* TLS_CLIENT_PARAMS *params;
+/*
+/* char *tls_proxy_client_param_with_names_to_string(buf, params)
+/* VSTRING *buf;
+/* TLS_CLIENT_PARAMS *params;
+/*
+/* char *tls_proxy_client_init_to_string(buf, init_props)
+/* VSTRING *buf;
+/* TLS_CLIENT_INIT_PROPS *init_props;
+/* DESCRIPTION
+/* tls_proxy_client_param_from_config() initializes a TLS_CLIENT_PARAMS
+/* structure from configuration parameters and returns its
+/* argument. Strings are not copied. The result must therefore
+/* not be passed to tls_proxy_client_param_free().
+/*
+/* tls_proxy_client_param_to_string() produces a lookup key
+/* that is unique for the TLS_CLIENT_PARAMS member values.
+/*
+/* tls_proxy_client_param_with_names_to_string() produces a
+/* string with "name = value\n" for each TLS_CLIENT_PARAMS
+/* member. This may be useful for reporting differences between
+/* TLS_CLIENT_PARAMS instances.
+/*
+/* tls_proxy_client_init_to_string() produces a lookup key
+/* that is unique for the properties received by
+/* tls_proxy_client_init_scan().
+/*
+/* tls_proxy_client_init_with_names_to_string() produces a
+/* string with "name = value\n" for each TLS_CLIENT_INIT_PROPS
+/* member. This may be useful for reporting differences between
+/* TLS_CLIENT_INIT_PROPS instances.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#ifdef USE_TLS
+
+/* System library. */
+
+#include <sys_defs.h>
+
+/* Utility library */
+
+#include <attr.h>
+#include <msg.h>
+
+/* Global library. */
+
+#include <mail_params.h>
+
+/* TLS library. */
+
+#include <tls.h>
+#include <tls_proxy.h>
+
+/* tls_proxy_client_param_from_config - initialize TLS_CLIENT_PARAMS from configuration */
+
+TLS_CLIENT_PARAMS *tls_proxy_client_param_from_config(TLS_CLIENT_PARAMS *params)
+{
+ TLS_PROXY_PARAMS(params,
+ tls_high_clist = var_tls_high_clist,
+ tls_medium_clist = var_tls_medium_clist,
+ tls_low_clist = var_tls_low_clist,
+ tls_export_clist = var_tls_export_clist,
+ tls_null_clist = var_tls_null_clist,
+ tls_eecdh_auto = var_tls_eecdh_auto,
+ tls_eecdh_strong = var_tls_eecdh_strong,
+ tls_eecdh_ultra = var_tls_eecdh_ultra,
+ tls_bug_tweaks = var_tls_bug_tweaks,
+ tls_ssl_options = var_tls_ssl_options,
+ tls_dane_digests = var_tls_dane_digests,
+ tls_mgr_service = var_tls_mgr_service,
+ tls_tkt_cipher = var_tls_tkt_cipher,
+ tls_daemon_rand_bytes = var_tls_daemon_rand_bytes,
+ tls_append_def_CA = var_tls_append_def_CA,
+ tls_bc_pkey_fprint = var_tls_bc_pkey_fprint,
+ tls_preempt_clist = var_tls_preempt_clist,
+ tls_multi_wildcard = var_tls_multi_wildcard);
+ return (params);
+}
+
+/* tls_proxy_client_param_to_string - serialize TLS_CLIENT_PARAMS to string */
+
+char *tls_proxy_client_param_to_string(VSTRING *buf, TLS_CLIENT_PARAMS *params)
+{
+ vstring_sprintf(buf, "%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n"
+ "%s\n%s\n%d\n%d\n%d\n%d\n%d\n",
+ params->tls_high_clist, params->tls_medium_clist,
+ params->tls_low_clist, params->tls_export_clist,
+ params->tls_null_clist, params->tls_eecdh_auto,
+ params->tls_eecdh_strong, params->tls_eecdh_ultra,
+ params->tls_bug_tweaks, params->tls_ssl_options,
+ params->tls_dane_digests, params->tls_mgr_service,
+ params->tls_tkt_cipher, params->tls_daemon_rand_bytes,
+ params->tls_append_def_CA, params->tls_bc_pkey_fprint,
+ params->tls_preempt_clist, params->tls_multi_wildcard);
+ return (vstring_str(buf));
+}
+
+/* tls_proxy_client_param_with_names_to_string - serialize TLS_CLIENT_PARAMS to string */
+
+char *tls_proxy_client_param_with_names_to_string(VSTRING *buf, TLS_CLIENT_PARAMS *params)
+{
+ vstring_sprintf(buf, "%s = %s\n%s = %s\n%s = %s\n%s = %s\n%s = %s\n"
+ "%s = %s\n%s = %s\n%s = %s\n%s = %s\n%s = %s\n%s = %s\n"
+ "%s = %s\n%s = %s\n%s = %d\n"
+ "%s = %d\n%s = %d\n%s = %d\n%s = %d\n",
+ VAR_TLS_HIGH_CLIST, params->tls_high_clist,
+ VAR_TLS_MEDIUM_CLIST, params->tls_medium_clist,
+ VAR_TLS_LOW_CLIST, params->tls_low_clist,
+ VAR_TLS_EXPORT_CLIST, params->tls_export_clist,
+ VAR_TLS_NULL_CLIST, params->tls_null_clist,
+ VAR_TLS_EECDH_AUTO, params->tls_eecdh_auto,
+ VAR_TLS_EECDH_STRONG, params->tls_eecdh_strong,
+ VAR_TLS_EECDH_ULTRA, params->tls_eecdh_ultra,
+ VAR_TLS_BUG_TWEAKS, params->tls_bug_tweaks,
+ VAR_TLS_SSL_OPTIONS, params->tls_ssl_options,
+ VAR_TLS_DANE_DIGESTS, params->tls_dane_digests,
+ VAR_TLS_MGR_SERVICE, params->tls_mgr_service,
+ VAR_TLS_TKT_CIPHER, params->tls_tkt_cipher,
+ VAR_TLS_DAEMON_RAND_BYTES, params->tls_daemon_rand_bytes,
+ VAR_TLS_APPEND_DEF_CA, params->tls_append_def_CA,
+ VAR_TLS_BC_PKEY_FPRINT, params->tls_bc_pkey_fprint,
+ VAR_TLS_PREEMPT_CLIST, params->tls_preempt_clist,
+ VAR_TLS_MULTI_WILDCARD, params->tls_multi_wildcard);
+ return (vstring_str(buf));
+}
+
+/* tls_proxy_client_init_to_string - serialize to string */
+
+char *tls_proxy_client_init_to_string(VSTRING *buf,
+ TLS_CLIENT_INIT_PROPS *props)
+{
+ vstring_sprintf(buf, "%s\n%s\n%d\n%s\n%s\n%s\n%s\n%s\n%s\n"
+ "%s\n%s\n%s\n%s\n%s\n", props->log_param,
+ props->log_level, props->verifydepth,
+ props->cache_type, props->chain_files,
+ props->cert_file, props->key_file,
+ props->dcert_file, props->dkey_file,
+ props->eccert_file, props->eckey_file,
+ props->CAfile, props->CApath, props->mdalg);
+ return (vstring_str(buf));
+}
+
+/* tls_proxy_client_init_with_names_to_string - serialize to string */
+
+char *tls_proxy_client_init_with_names_to_string(VSTRING *buf,
+ TLS_CLIENT_INIT_PROPS *props)
+{
+ vstring_sprintf(buf, "%s = %s\n%s = %s\n%s = %d\n%s = %s\n%s = %s\n"
+ "%s = %s\n%s = %s\n%s = %s\n%s = %s\n%s = %s\n"
+ "%s = %s\n%s = %s\n%s = %s\n%s = %s\n",
+ TLS_ATTR_LOG_PARAM, props->log_param,
+ TLS_ATTR_LOG_LEVEL, props->log_level,
+ TLS_ATTR_VERIFYDEPTH, props->verifydepth,
+ TLS_ATTR_CACHE_TYPE, props->cache_type,
+ TLS_ATTR_CHAIN_FILES, props->chain_files,
+ TLS_ATTR_CERT_FILE, props->cert_file,
+ TLS_ATTR_KEY_FILE, props->key_file,
+ TLS_ATTR_DCERT_FILE, props->dcert_file,
+ TLS_ATTR_DKEY_FILE, props->dkey_file,
+ TLS_ATTR_ECCERT_FILE, props->eccert_file,
+ TLS_ATTR_ECKEY_FILE, props->eckey_file,
+ TLS_ATTR_CAFILE, props->CAfile,
+ TLS_ATTR_CAPATH, props->CApath,
+ TLS_ATTR_MDALG, props->mdalg);
+ return (vstring_str(buf));
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_print.c b/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_print.c
new file mode 100644
index 00000000000..f747d84f8cb
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_print.c
@@ -0,0 +1,396 @@
+/* $NetBSD: tls_proxy_client_print.c,v 1.1.1.1 2020/03/18 18:59:35 christos Exp $ */
+
+/*++
+/* NAME
+/* tls_proxy_client_print 3
+/* SUMMARY
+/* write TLS_CLIENT_XXX structures to stream
+/* SYNOPSIS
+/* #include <tls_proxy.h>
+/*
+/* int tls_proxy_client_param_print(print_fn, stream, flags, ptr)
+/* ATTR_PRINT_MASTER_FN print_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* int tls_proxy_client_init_print(print_fn, stream, flags, ptr)
+/* ATTR_PRINT_MASTER_FN print_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* int tls_proxy_client_start_print(print_fn, stream, flags, ptr)
+/* ATTR_PRINT_MASTER_FN print_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/* DESCRIPTION
+/* tls_proxy_client_param_print() writes a TLS_CLIENT_PARAMS structure to
+/* the named stream using the specified attribute print routine.
+/* tls_proxy_client_param_print() is meant to be passed as a call-back to
+/* attr_print(), thusly:
+/*
+/* SEND_ATTR_FUNC(tls_proxy_client_param_print, (void *) param), ...
+/*
+/* tls_proxy_client_init_print() writes a full TLS_CLIENT_INIT_PROPS
+/* structure to the named stream using the specified attribute
+/* print routine. tls_proxy_client_init_print() is meant to
+/* be passed as a call-back to attr_print(), thusly:
+/*
+/* SEND_ATTR_FUNC(tls_proxy_client_init_print, (void *) init_props), ...
+/*
+/* tls_proxy_client_start_print() writes a TLS_CLIENT_START_PROPS
+/* structure, without stream or file descriptor members, to
+/* the named stream using the specified attribute print routine.
+/* tls_proxy_client_start_print() is meant to be passed as a
+/* call-back to attr_print(), thusly:
+/*
+/* SEND_ATTR_FUNC(tls_proxy_client_start_print, (void *) start_props), ...
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#ifdef USE_TLS
+
+/* System library. */
+
+#include <sys_defs.h>
+
+/* Utility library */
+
+#include <argv_attr.h>
+#include <attr.h>
+#include <msg.h>
+
+/* Global library. */
+
+#include <mail_params.h>
+
+/* TLS library. */
+
+#include <tls.h>
+#include <tls_proxy.h>
+
+
+#define STR(x) vstring_str(x)
+#define LEN(x) VSTRING_LEN(x)
+
+/* tls_proxy_client_param_print - send TLS_CLIENT_PARAMS over stream */
+
+int tls_proxy_client_param_print(ATTR_PRINT_MASTER_FN print_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_CLIENT_PARAMS *params = (TLS_CLIENT_PARAMS *) ptr;
+ int ret;
+
+ if (msg_verbose)
+ msg_info("begin tls_proxy_client_param_print");
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_STR(VAR_TLS_HIGH_CLIST, params->tls_high_clist),
+ SEND_ATTR_STR(VAR_TLS_MEDIUM_CLIST,
+ params->tls_medium_clist),
+ SEND_ATTR_STR(VAR_TLS_LOW_CLIST, params->tls_low_clist),
+ SEND_ATTR_STR(VAR_TLS_EXPORT_CLIST,
+ params->tls_export_clist),
+ SEND_ATTR_STR(VAR_TLS_NULL_CLIST, params->tls_null_clist),
+ SEND_ATTR_STR(VAR_TLS_EECDH_AUTO, params->tls_eecdh_auto),
+ SEND_ATTR_STR(VAR_TLS_EECDH_STRONG,
+ params->tls_eecdh_strong),
+ SEND_ATTR_STR(VAR_TLS_EECDH_ULTRA,
+ params->tls_eecdh_ultra),
+ SEND_ATTR_STR(VAR_TLS_BUG_TWEAKS, params->tls_bug_tweaks),
+ SEND_ATTR_STR(VAR_TLS_SSL_OPTIONS,
+ params->tls_ssl_options),
+ SEND_ATTR_STR(VAR_TLS_DANE_DIGESTS,
+ params->tls_dane_digests),
+ SEND_ATTR_STR(VAR_TLS_MGR_SERVICE,
+ params->tls_mgr_service),
+ SEND_ATTR_STR(VAR_TLS_TKT_CIPHER, params->tls_tkt_cipher),
+ SEND_ATTR_INT(VAR_TLS_DAEMON_RAND_BYTES,
+ params->tls_daemon_rand_bytes),
+ SEND_ATTR_INT(VAR_TLS_APPEND_DEF_CA,
+ params->tls_append_def_CA),
+ SEND_ATTR_INT(VAR_TLS_BC_PKEY_FPRINT,
+ params->tls_bc_pkey_fprint),
+ SEND_ATTR_INT(VAR_TLS_PREEMPT_CLIST,
+ params->tls_preempt_clist),
+ SEND_ATTR_INT(VAR_TLS_MULTI_WILDCARD,
+ params->tls_multi_wildcard),
+ ATTR_TYPE_END);
+ /* Do not flush the stream. */
+ if (msg_verbose)
+ msg_info("tls_proxy_client_param_print ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_init_print - send TLS_CLIENT_INIT_PROPS over stream */
+
+int tls_proxy_client_init_print(ATTR_PRINT_MASTER_FN print_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_CLIENT_INIT_PROPS *props = (TLS_CLIENT_INIT_PROPS *) ptr;
+ int ret;
+
+ if (msg_verbose)
+ msg_info("begin tls_proxy_client_init_print");
+
+#define STRING_OR_EMPTY(s) ((s) ? (s) : "")
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_STR(TLS_ATTR_LOG_PARAM,
+ STRING_OR_EMPTY(props->log_param)),
+ SEND_ATTR_STR(TLS_ATTR_LOG_LEVEL,
+ STRING_OR_EMPTY(props->log_level)),
+ SEND_ATTR_INT(TLS_ATTR_VERIFYDEPTH, props->verifydepth),
+ SEND_ATTR_STR(TLS_ATTR_CACHE_TYPE,
+ STRING_OR_EMPTY(props->cache_type)),
+ SEND_ATTR_STR(TLS_ATTR_CHAIN_FILES,
+ STRING_OR_EMPTY(props->chain_files)),
+ SEND_ATTR_STR(TLS_ATTR_CERT_FILE,
+ STRING_OR_EMPTY(props->cert_file)),
+ SEND_ATTR_STR(TLS_ATTR_KEY_FILE,
+ STRING_OR_EMPTY(props->key_file)),
+ SEND_ATTR_STR(TLS_ATTR_DCERT_FILE,
+ STRING_OR_EMPTY(props->dcert_file)),
+ SEND_ATTR_STR(TLS_ATTR_DKEY_FILE,
+ STRING_OR_EMPTY(props->dkey_file)),
+ SEND_ATTR_STR(TLS_ATTR_ECCERT_FILE,
+ STRING_OR_EMPTY(props->eccert_file)),
+ SEND_ATTR_STR(TLS_ATTR_ECKEY_FILE,
+ STRING_OR_EMPTY(props->eckey_file)),
+ SEND_ATTR_STR(TLS_ATTR_CAFILE,
+ STRING_OR_EMPTY(props->CAfile)),
+ SEND_ATTR_STR(TLS_ATTR_CAPATH,
+ STRING_OR_EMPTY(props->CApath)),
+ SEND_ATTR_STR(TLS_ATTR_MDALG,
+ STRING_OR_EMPTY(props->mdalg)),
+ ATTR_TYPE_END);
+ /* Do not flush the stream. */
+ if (msg_verbose)
+ msg_info("tls_proxy_client_init_print ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_certs_print - send x509 certificates over stream */
+
+static int tls_proxy_client_certs_print(ATTR_PRINT_MASTER_FN print_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ TLS_CERTS *tls_certs = (TLS_CERTS *) ptr;
+ TLS_CERTS *tp;
+ int count;
+ int ret;
+
+ for (tp = tls_certs, count = 0; tp != 0; tp = tp->next, count++)
+ /* void */ ;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_certs_print count=%d", count);
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_INT(TLS_ATTR_COUNT, count),
+ ATTR_TYPE_END);
+
+ if (ret == 0 && count > 0) {
+ VSTRING *buf = vstring_alloc(100);
+ int n;
+
+ for (tp = tls_certs, n = 0; ret == 0 && n < count; tp = tp->next, n++) {
+ size_t len = i2d_X509(tp->cert, (unsigned char **) 0);
+ unsigned char *bp;
+
+ VSTRING_RESET(buf);
+ VSTRING_SPACE(buf, len);
+ bp = (unsigned char *) STR(buf);
+ i2d_X509(tp->cert, &bp);
+ if ((char *) bp - STR(buf) != len)
+ msg_panic("i2d_X509 failed to encode certificate");
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_DATA(TLS_ATTR_CERT, LEN(buf), STR(buf)),
+ ATTR_TYPE_END);
+ }
+ vstring_free(buf);
+ }
+ /* Do not flush the stream. */
+ if (msg_verbose)
+ msg_info("tls_proxy_client_certs_print ret=%d", count);
+ return (ret);
+}
+
+/* tls_proxy_client_pkeys_print - send public keys over stream */
+
+static int tls_proxy_client_pkeys_print(ATTR_PRINT_MASTER_FN print_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ TLS_PKEYS *tls_pkeys = (TLS_PKEYS *) ptr;
+ TLS_PKEYS *tp;
+ int count;
+ int ret;
+
+ for (tp = tls_pkeys, count = 0; tp != 0; tp = tp->next, count++)
+ /* void */ ;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_pkeys_print count=%d", count);
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_INT(TLS_ATTR_COUNT, count),
+ ATTR_TYPE_END);
+
+ if (ret == 0 && count > 0) {
+ VSTRING *buf = vstring_alloc(100);
+ int n;
+
+ for (tp = tls_pkeys, n = 0; ret == 0 && n < count; tp = tp->next, n++) {
+ size_t len = i2d_PUBKEY(tp->pkey, (unsigned char **) 0);
+ unsigned char *bp;
+
+ VSTRING_RESET(buf);
+ VSTRING_SPACE(buf, len);
+ bp = (unsigned char *) STR(buf);
+ i2d_PUBKEY(tp->pkey, &bp);
+ if ((char *) bp - STR(buf) != len)
+ msg_panic("i2d_PUBKEY failed to encode public key");
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_DATA(TLS_ATTR_PKEY, LEN(buf), STR(buf)),
+ ATTR_TYPE_END);
+ }
+ vstring_free(buf);
+ }
+ /* Do not flush the stream. */
+ if (msg_verbose)
+ msg_info("tls_proxy_client_pkeys_print ret=%d", count);
+ return (ret);
+}
+
+/* tls_proxy_client_tlsa_print - send TLS_TLSA over stream */
+
+static int tls_proxy_client_tlsa_print(ATTR_PRINT_MASTER_FN print_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ TLS_TLSA *tls_tlsa = (TLS_TLSA *) ptr;
+ TLS_TLSA *tp;
+ int count;
+ int ret;
+
+ for (tp = tls_tlsa, count = 0; tp != 0; tp = tp->next, count++)
+ /* void */ ;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_tlsa_print count=%d", count);
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_INT(TLS_ATTR_COUNT, count),
+ ATTR_TYPE_END);
+
+ if (ret == 0 && count > 0) {
+ int n;
+
+ for (tp = tls_tlsa, n = 0; ret == 0 && n < count; tp = tp->next, n++) {
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_STR(TLS_ATTR_MDALG, tp->mdalg),
+ SEND_ATTR_FUNC(argv_attr_print,
+ (void *) tp->certs),
+ SEND_ATTR_FUNC(argv_attr_print,
+ (void *) tp->pkeys),
+ ATTR_TYPE_END);
+ }
+ }
+ /* Do not flush the stream. */
+ if (msg_verbose)
+ msg_info("tls_proxy_client_tlsa_print ret=%d", count);
+ return (ret);
+}
+
+/* tls_proxy_client_dane_print - send TLS_DANE over stream */
+
+static int tls_proxy_client_dane_print(ATTR_PRINT_MASTER_FN print_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ TLS_DANE *dane = (TLS_DANE *) ptr;
+ int ret;
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_INT(TLS_ATTR_DANE, dane != 0),
+ ATTR_TYPE_END);
+ if (msg_verbose)
+ msg_info("tls_proxy_client_dane_print dane=%d", dane != 0);
+
+ if (ret == 0 && dane != 0) {
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_FUNC(tls_proxy_client_tlsa_print,
+ (void *) dane->ta),
+ SEND_ATTR_FUNC(tls_proxy_client_tlsa_print,
+ (void *) dane->ee),
+ SEND_ATTR_FUNC(tls_proxy_client_certs_print,
+ (void *) dane->certs),
+ SEND_ATTR_FUNC(tls_proxy_client_pkeys_print,
+ (void *) dane->pkeys),
+ SEND_ATTR_STR(TLS_ATTR_DOMAIN,
+ STRING_OR_EMPTY(dane->base_domain)),
+ SEND_ATTR_INT(TLS_ATTR_FLAGS, dane->flags),
+ SEND_ATTR_LONG(TLS_ATTR_EXP, dane->expires),
+ ATTR_TYPE_END);
+ }
+ /* Do not flush the stream. */
+ if (msg_verbose)
+ msg_info("tls_proxy_client_dane_print ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_start_print - send TLS_CLIENT_START_PROPS over stream */
+
+int tls_proxy_client_start_print(ATTR_PRINT_MASTER_FN print_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ TLS_CLIENT_START_PROPS *props = (TLS_CLIENT_START_PROPS *) ptr;
+ int ret;
+
+ if (msg_verbose)
+ msg_info("begin tls_proxy_client_start_print");
+
+#define STRING_OR_EMPTY(s) ((s) ? (s) : "")
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_INT(TLS_ATTR_TIMEOUT, props->timeout),
+ SEND_ATTR_INT(TLS_ATTR_TLS_LEVEL, props->tls_level),
+ SEND_ATTR_STR(TLS_ATTR_NEXTHOP,
+ STRING_OR_EMPTY(props->nexthop)),
+ SEND_ATTR_STR(TLS_ATTR_HOST,
+ STRING_OR_EMPTY(props->host)),
+ SEND_ATTR_STR(TLS_ATTR_NAMADDR,
+ STRING_OR_EMPTY(props->namaddr)),
+ SEND_ATTR_STR(TLS_ATTR_SNI,
+ STRING_OR_EMPTY(props->sni)),
+ SEND_ATTR_STR(TLS_ATTR_SERVERID,
+ STRING_OR_EMPTY(props->serverid)),
+ SEND_ATTR_STR(TLS_ATTR_HELO,
+ STRING_OR_EMPTY(props->helo)),
+ SEND_ATTR_STR(TLS_ATTR_PROTOCOLS,
+ STRING_OR_EMPTY(props->protocols)),
+ SEND_ATTR_STR(TLS_ATTR_CIPHER_GRADE,
+ STRING_OR_EMPTY(props->cipher_grade)),
+ SEND_ATTR_STR(TLS_ATTR_CIPHER_EXCLUSIONS,
+ STRING_OR_EMPTY(props->cipher_exclusions)),
+ SEND_ATTR_FUNC(argv_attr_print,
+ (void *) props->matchargv),
+ SEND_ATTR_STR(TLS_ATTR_MDALG,
+ STRING_OR_EMPTY(props->mdalg)),
+ SEND_ATTR_FUNC(tls_proxy_client_dane_print,
+ (void *) props->dane),
+ ATTR_TYPE_END);
+ /* Do not flush the stream. */
+ if (msg_verbose)
+ msg_info("tls_proxy_client_start_print ret=%d", ret);
+ return (ret);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_scan.c b/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_scan.c
new file mode 100644
index 00000000000..309124858c1
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/tls_proxy_client_scan.c
@@ -0,0 +1,683 @@
+/* $NetBSD: tls_proxy_client_scan.c,v 1.1.1.1 2020/03/18 18:59:35 christos Exp $ */
+
+/*++
+/* NAME
+/* tls_proxy_client_scan 3
+/* SUMMARY
+/* read TLS_CLIENT_XXX structures from stream
+/* SYNOPSIS
+/* #include <tls_proxy.h>
+/*
+/* int tls_proxy_client_param_scan(scan_fn, stream, flags, ptr)
+/* ATTR_SCAN_MASTER_FN scan_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* void tls_proxy_client_param_free(params)
+/* TLS_CLIENT_PARAMS *params;
+/*
+/* int tls_proxy_client_init_scan(scan_fn, stream, flags, ptr)
+/* ATTR_SCAN_MASTER_FN scan_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* void tls_proxy_client_init_free(init_props)
+/* TLS_CLIENT_INIT_PROPS *init_props;
+/*
+/* int tls_proxy_client_start_scan(scan_fn, stream, flags, ptr)
+/* ATTR_SCAN_MASTER_FN scan_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* void tls_proxy_client_start_free(start_props)
+/* TLS_CLIENT_START_PROPS *start_props;
+/* DESCRIPTION
+/* tls_proxy_client_param_scan() reads a TLS_CLIENT_PARAMS structure from
+/* the named stream using the specified attribute scan routine.
+/* tls_proxy_client_param_scan() is meant to be passed as a call-back
+/* function to attr_scan(), as shown below.
+/*
+/* tls_proxy_client_param_free() destroys a TLS_CLIENT_PARAMS structure
+/* that was created by tls_proxy_client_param_scan().
+/*
+/* TLS_CLIENT_PARAMS *param = 0;
+/* ...
+/* ... RECV_ATTR_FUNC(tls_proxy_client_param_scan, (void *) &param)
+/* ...
+/* if (param != 0)
+/* tls_proxy_client_param_free(param);
+/*
+/* tls_proxy_client_init_scan() reads a full TLS_CLIENT_INIT_PROPS
+/* structure from the named stream using the specified attribute
+/* scan routine. tls_proxy_client_init_scan() is meant to be passed
+/* as a call-back function to attr_scan(), as shown below.
+/*
+/* tls_proxy_client_init_free() destroys a TLS_CLIENT_INIT_PROPS
+/* structure that was created by tls_proxy_client_init_scan().
+/*
+/* TLS_CLIENT_INIT_PROPS *init_props = 0;
+/* ...
+/* ... RECV_ATTR_FUNC(tls_proxy_client_init_scan, (void *) &init_props)
+/* ...
+/* if (init_props != 0)
+/* tls_proxy_client_init_free(init_props);
+/*
+/* tls_proxy_client_start_scan() reads a TLS_CLIENT_START_PROPS
+/* structure, without the stream of file descriptor members,
+/* from the named stream using the specified attribute scan
+/* routine. tls_proxy_client_start_scan() is meant to be passed
+/* as a call-back function to attr_scan(), as shown below.
+/*
+/* tls_proxy_client_start_free() destroys a TLS_CLIENT_START_PROPS
+/* structure that was created by tls_proxy_client_start_scan().
+/*
+/* TLS_CLIENT_START_PROPS *start_props = 0;
+/* ...
+/* ... RECV_ATTR_FUNC(tls_proxy_client_start_scan, (void *) &start_props)
+/* ...
+/* if (start_props != 0)
+/* tls_proxy_client_start_free(start_props);
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#ifdef USE_TLS
+
+/* System library. */
+
+#include <sys_defs.h>
+
+/* Utility library */
+
+#include <argv_attr.h>
+#include <attr.h>
+#include <msg.h>
+#include <vstring.h>
+
+/* Global library. */
+
+#include <mail_params.h>
+
+/* TLS library. */
+
+#include <tls.h>
+#include <tls_proxy.h>
+
+#define STR(x) vstring_str(x)
+#define LEN(x) VSTRING_LEN(x)
+
+/* tls_proxy_client_param_free - destroy TLS_CLIENT_PARAMS structure */
+
+void tls_proxy_client_param_free(TLS_CLIENT_PARAMS *params)
+{
+ myfree(params->tls_high_clist);
+ myfree(params->tls_medium_clist);
+ myfree(params->tls_low_clist);
+ myfree(params->tls_export_clist);
+ myfree(params->tls_null_clist);
+ myfree(params->tls_eecdh_auto);
+ myfree(params->tls_eecdh_strong);
+ myfree(params->tls_eecdh_ultra);
+ myfree(params->tls_bug_tweaks);
+ myfree(params->tls_ssl_options);
+ myfree(params->tls_dane_digests);
+ myfree(params->tls_mgr_service);
+ myfree(params->tls_tkt_cipher);
+ myfree((void *) params);
+}
+
+/* tls_proxy_client_param_scan - receive TLS_CLIENT_PARAMS from stream */
+
+int tls_proxy_client_param_scan(ATTR_SCAN_MASTER_FN scan_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_CLIENT_PARAMS *params
+ = (TLS_CLIENT_PARAMS *) mymalloc(sizeof(*params));
+ int ret;
+ VSTRING *tls_high_clist = vstring_alloc(25);
+ VSTRING *tls_medium_clist = vstring_alloc(25);
+ VSTRING *tls_low_clist = vstring_alloc(25);
+ VSTRING *tls_export_clist = vstring_alloc(25);
+ VSTRING *tls_null_clist = vstring_alloc(25);
+ VSTRING *tls_eecdh_auto = vstring_alloc(25);
+ VSTRING *tls_eecdh_strong = vstring_alloc(25);
+ VSTRING *tls_eecdh_ultra = vstring_alloc(25);
+ VSTRING *tls_bug_tweaks = vstring_alloc(25);
+ VSTRING *tls_ssl_options = vstring_alloc(25);
+ VSTRING *tls_dane_digests = vstring_alloc(25);
+ VSTRING *tls_mgr_service = vstring_alloc(25);
+ VSTRING *tls_tkt_cipher = vstring_alloc(25);
+
+ if (msg_verbose)
+ msg_info("begin tls_proxy_client_param_scan");
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer types.
+ */
+ memset(params, 0, sizeof(*params));
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_STR(VAR_TLS_HIGH_CLIST, tls_high_clist),
+ RECV_ATTR_STR(VAR_TLS_MEDIUM_CLIST, tls_medium_clist),
+ RECV_ATTR_STR(VAR_TLS_LOW_CLIST, tls_low_clist),
+ RECV_ATTR_STR(VAR_TLS_EXPORT_CLIST, tls_export_clist),
+ RECV_ATTR_STR(VAR_TLS_NULL_CLIST, tls_null_clist),
+ RECV_ATTR_STR(VAR_TLS_EECDH_AUTO, tls_eecdh_auto),
+ RECV_ATTR_STR(VAR_TLS_EECDH_STRONG, tls_eecdh_strong),
+ RECV_ATTR_STR(VAR_TLS_EECDH_ULTRA, tls_eecdh_ultra),
+ RECV_ATTR_STR(VAR_TLS_BUG_TWEAKS, tls_bug_tweaks),
+ RECV_ATTR_STR(VAR_TLS_SSL_OPTIONS, tls_ssl_options),
+ RECV_ATTR_STR(VAR_TLS_DANE_DIGESTS, tls_dane_digests),
+ RECV_ATTR_STR(VAR_TLS_MGR_SERVICE, tls_mgr_service),
+ RECV_ATTR_STR(VAR_TLS_TKT_CIPHER, tls_tkt_cipher),
+ RECV_ATTR_INT(VAR_TLS_DAEMON_RAND_BYTES,
+ &params->tls_daemon_rand_bytes),
+ RECV_ATTR_INT(VAR_TLS_APPEND_DEF_CA,
+ &params->tls_append_def_CA),
+ RECV_ATTR_INT(VAR_TLS_BC_PKEY_FPRINT,
+ &params->tls_bc_pkey_fprint),
+ RECV_ATTR_INT(VAR_TLS_PREEMPT_CLIST,
+ &params->tls_preempt_clist),
+ RECV_ATTR_INT(VAR_TLS_MULTI_WILDCARD,
+ &params->tls_multi_wildcard),
+ ATTR_TYPE_END);
+ /* Always construct a well-formed structure. */
+ params->tls_high_clist = vstring_export(tls_high_clist);
+ params->tls_medium_clist = vstring_export(tls_medium_clist);
+ params->tls_low_clist = vstring_export(tls_low_clist);
+ params->tls_export_clist = vstring_export(tls_export_clist);
+ params->tls_null_clist = vstring_export(tls_null_clist);
+ params->tls_eecdh_auto = vstring_export(tls_eecdh_auto);
+ params->tls_eecdh_strong = vstring_export(tls_eecdh_strong);
+ params->tls_eecdh_ultra = vstring_export(tls_eecdh_ultra);
+ params->tls_bug_tweaks = vstring_export(tls_bug_tweaks);
+ params->tls_ssl_options = vstring_export(tls_ssl_options);
+ params->tls_dane_digests = vstring_export(tls_dane_digests);
+ params->tls_mgr_service = vstring_export(tls_mgr_service);
+ params->tls_tkt_cipher = vstring_export(tls_tkt_cipher);
+
+ ret = (ret == 18 ? 1 : -1);
+ if (ret != 1) {
+ tls_proxy_client_param_free(params);
+ params = 0;
+ }
+ *(TLS_CLIENT_PARAMS **) ptr = params;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_param_scan ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_init_free - destroy TLS_CLIENT_INIT_PROPS structure */
+
+void tls_proxy_client_init_free(TLS_CLIENT_INIT_PROPS *props)
+{
+ myfree((void *) props->log_param);
+ myfree((void *) props->log_level);
+ myfree((void *) props->cache_type);
+ myfree((void *) props->chain_files);
+ myfree((void *) props->cert_file);
+ myfree((void *) props->key_file);
+ myfree((void *) props->dcert_file);
+ myfree((void *) props->dkey_file);
+ myfree((void *) props->eccert_file);
+ myfree((void *) props->eckey_file);
+ myfree((void *) props->CAfile);
+ myfree((void *) props->CApath);
+ myfree((void *) props->mdalg);
+ myfree((void *) props);
+}
+
+/* tls_proxy_client_init_scan - receive TLS_CLIENT_INIT_PROPS from stream */
+
+int tls_proxy_client_init_scan(ATTR_SCAN_MASTER_FN scan_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_CLIENT_INIT_PROPS *props
+ = (TLS_CLIENT_INIT_PROPS *) mymalloc(sizeof(*props));
+ int ret;
+ VSTRING *log_param = vstring_alloc(25);
+ VSTRING *log_level = vstring_alloc(25);
+ VSTRING *cache_type = vstring_alloc(25);
+ VSTRING *chain_files = vstring_alloc(25);
+ VSTRING *cert_file = vstring_alloc(25);
+ VSTRING *key_file = vstring_alloc(25);
+ VSTRING *dcert_file = vstring_alloc(25);
+ VSTRING *dkey_file = vstring_alloc(25);
+ VSTRING *eccert_file = vstring_alloc(25);
+ VSTRING *eckey_file = vstring_alloc(25);
+ VSTRING *CAfile = vstring_alloc(25);
+ VSTRING *CApath = vstring_alloc(25);
+ VSTRING *mdalg = vstring_alloc(25);
+
+ if (msg_verbose)
+ msg_info("begin tls_proxy_client_init_scan");
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer types.
+ */
+ memset(props, 0, sizeof(*props));
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_STR(TLS_ATTR_LOG_PARAM, log_param),
+ RECV_ATTR_STR(TLS_ATTR_LOG_LEVEL, log_level),
+ RECV_ATTR_INT(TLS_ATTR_VERIFYDEPTH, &props->verifydepth),
+ RECV_ATTR_STR(TLS_ATTR_CACHE_TYPE, cache_type),
+ RECV_ATTR_STR(TLS_ATTR_CHAIN_FILES, chain_files),
+ RECV_ATTR_STR(TLS_ATTR_CERT_FILE, cert_file),
+ RECV_ATTR_STR(TLS_ATTR_KEY_FILE, key_file),
+ RECV_ATTR_STR(TLS_ATTR_DCERT_FILE, dcert_file),
+ RECV_ATTR_STR(TLS_ATTR_DKEY_FILE, dkey_file),
+ RECV_ATTR_STR(TLS_ATTR_ECCERT_FILE, eccert_file),
+ RECV_ATTR_STR(TLS_ATTR_ECKEY_FILE, eckey_file),
+ RECV_ATTR_STR(TLS_ATTR_CAFILE, CAfile),
+ RECV_ATTR_STR(TLS_ATTR_CAPATH, CApath),
+ RECV_ATTR_STR(TLS_ATTR_MDALG, mdalg),
+ ATTR_TYPE_END);
+ /* Always construct a well-formed structure. */
+ props->log_param = vstring_export(log_param);
+ props->log_level = vstring_export(log_level);
+ props->cache_type = vstring_export(cache_type);
+ props->chain_files = vstring_export(chain_files);
+ props->cert_file = vstring_export(cert_file);
+ props->key_file = vstring_export(key_file);
+ props->dcert_file = vstring_export(dcert_file);
+ props->dkey_file = vstring_export(dkey_file);
+ props->eccert_file = vstring_export(eccert_file);
+ props->eckey_file = vstring_export(eckey_file);
+ props->CAfile = vstring_export(CAfile);
+ props->CApath = vstring_export(CApath);
+ props->mdalg = vstring_export(mdalg);
+ ret = (ret == 14 ? 1 : -1);
+ if (ret != 1) {
+ tls_proxy_client_init_free(props);
+ props = 0;
+ }
+ *(TLS_CLIENT_INIT_PROPS **) ptr = props;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_init_scan ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_certs_free - destroy TLS_PKEYS from stream */
+
+static void tls_proxy_client_certs_free(TLS_CERTS *tp)
+{
+ if (tp->next)
+ tls_proxy_client_certs_free(tp->next);
+ if (tp->cert)
+ X509_free(tp->cert);
+ myfree((void *) tp);
+}
+
+/* tls_proxy_client_pkeys_free - destroy TLS_PKEYS from stream */
+
+static void tls_proxy_client_pkeys_free(TLS_PKEYS *tp)
+{
+ if (tp->next)
+ tls_proxy_client_pkeys_free(tp->next);
+ if (tp->pkey)
+ EVP_PKEY_free(tp->pkey);
+ myfree((void *) tp);
+}
+
+/* tls_proxy_client_tlsa_free - destroy TLS_TLSA from stream */
+
+static void tls_proxy_client_tlsa_free(TLS_TLSA *tp)
+{
+ if (tp->next)
+ tls_proxy_client_tlsa_free(tp->next);
+ myfree(tp->mdalg);
+ if (tp->certs)
+ argv_free(tp->certs);
+ if (tp->pkeys)
+ argv_free(tp->pkeys);
+ myfree((void *) tp);
+}
+
+/* tls_proxy_client_dane_free - destroy TLS_DANE from stream */
+
+static void tls_proxy_client_dane_free(TLS_DANE *dane)
+{
+ if (dane->ta)
+ tls_proxy_client_tlsa_free(dane->ta);
+ if (dane->ee)
+ tls_proxy_client_tlsa_free(dane->ee);
+ if (dane->certs)
+ tls_proxy_client_certs_free(dane->certs);
+ if (dane->pkeys)
+ tls_proxy_client_pkeys_free(dane->pkeys);
+ myfree(dane->base_domain);
+ if (dane->refs-- == 1)
+ myfree((void *) dane);
+}
+
+/* tls_proxy_client_start_free - destroy TLS_CLIENT_START_PROPS structure */
+
+void tls_proxy_client_start_free(TLS_CLIENT_START_PROPS *props)
+{
+ myfree((void *) props->nexthop);
+ myfree((void *) props->host);
+ myfree((void *) props->namaddr);
+ myfree((void *) props->sni);
+ myfree((void *) props->serverid);
+ myfree((void *) props->helo);
+ myfree((void *) props->protocols);
+ myfree((void *) props->cipher_grade);
+ myfree((void *) props->cipher_exclusions);
+ if (props->matchargv)
+ argv_free((ARGV *) props->matchargv);
+ myfree((void *) props->mdalg);
+ if (props->dane)
+ tls_proxy_client_dane_free((TLS_DANE *) props->dane);
+ myfree((void *) props);
+}
+
+/* tls_proxy_client_certs_scan - receive TLS_CERTS from stream */
+
+static int tls_proxy_client_certs_scan(ATTR_SCAN_MASTER_FN scan_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ int ret;
+ int count;
+ VSTRING *buf = 0;
+ TLS_CERTS **tpp;
+ TLS_CERTS *head = 0;
+ TLS_CERTS *tp;
+ int n;
+
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_INT(TLS_ATTR_COUNT, &count),
+ ATTR_TYPE_END);
+ if (msg_verbose)
+ msg_info("tls_proxy_client_certs_scan count=%d", count);
+
+ for (tpp = &head, n = 0; ret == 1 && n < count; n++, tpp = &tp->next) {
+ *tpp = tp = (TLS_CERTS *) mymalloc(sizeof(*tp));
+ const unsigned char *bp;
+
+ if (buf == 0)
+ buf = vstring_alloc(100);
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer
+ * types.
+ */
+ memset(tp, 0, sizeof(*tp));
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_DATA(TLS_ATTR_CERT, buf),
+ ATTR_TYPE_END);
+ /* Always construct a well-formed structure. */
+ if (ret == 1) {
+ bp = (const unsigned char *) STR(buf);
+ if (d2i_X509(&tp->cert, &bp, LEN(buf)) == 0
+ || LEN(buf) != ((char *) bp) - STR(buf)) {
+ msg_warn("malformed certificate in TLS_CERTS");
+ ret = -1;
+ }
+ } else {
+ tp->cert = 0;
+ }
+ tp->next = 0;
+ }
+ if (buf)
+ vstring_free(buf);
+ if (ret != 1) {
+ tls_proxy_client_certs_free(head);
+ head = 0;
+ }
+ *(TLS_CERTS **) ptr = head;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_certs_scan ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_pkeys_scan - receive TLS_PKEYS from stream */
+
+static int tls_proxy_client_pkeys_scan(ATTR_SCAN_MASTER_FN scan_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ int ret;
+ int count;
+ VSTRING *buf = vstring_alloc(100);
+ TLS_PKEYS **tpp;
+ TLS_PKEYS *head = 0;
+ TLS_PKEYS *tp;
+ int n;
+
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_INT(TLS_ATTR_COUNT, &count),
+ ATTR_TYPE_END);
+ if (msg_verbose)
+ msg_info("tls_proxy_client_pkeys_scan count=%d", count);
+
+ for (tpp = &head, n = 0; ret == 1 && n < count; n++, tpp = &tp->next) {
+ *tpp = tp = (TLS_PKEYS *) mymalloc(sizeof(*tp));
+ const unsigned char *bp;
+
+ if (buf == 0)
+ buf = vstring_alloc(100);
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer
+ * types.
+ */
+ memset(tp, 0, sizeof(*tp));
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_DATA(TLS_ATTR_PKEY, buf),
+ ATTR_TYPE_END);
+ /* Always construct a well-formed structure. */
+ if (ret == 1) {
+ bp = (const unsigned char *) STR(buf);
+ if (d2i_PUBKEY(&tp->pkey, &bp, LEN(buf)) == 0
+ || LEN(buf) != (char *) bp - STR(buf)) {
+ msg_warn("malformed public key in TLS_PKEYS");
+ ret = -1;
+ }
+ } else {
+ tp->pkey = 0;
+ }
+ tp->next = 0;
+ }
+ if (buf)
+ vstring_free(buf);
+ if (ret != 1) {
+ tls_proxy_client_pkeys_free(head);
+ head = 0;
+ }
+ *(TLS_PKEYS **) ptr = head;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_pkeys_scan ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_tlsa_scan - receive TLS_TLSA from stream */
+
+static int tls_proxy_client_tlsa_scan(ATTR_SCAN_MASTER_FN scan_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ int ret;
+ int count;
+ TLS_TLSA **tpp;
+ TLS_TLSA *head = 0;
+ TLS_TLSA *tp;
+ int n;
+
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_INT(TLS_ATTR_COUNT, &count),
+ ATTR_TYPE_END);
+ if (msg_verbose)
+ msg_info("tls_proxy_client_tlsa_scan count=%d", count);
+
+ for (tpp = &head, n = 0; ret == 1 && n < count; n++, tpp = &tp->next) {
+ *tpp = tp = (TLS_TLSA *) mymalloc(sizeof(*tp));
+ VSTRING *mdalg = vstring_alloc(25);
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer
+ * types.
+ */
+ memset(tp, 0, sizeof(*tp));
+ /* Always construct a well-formed structure. */
+ tp->certs = 0; /* scan_fn may return early */
+ tp->pkeys = 0;
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_STR(TLS_ATTR_MDALG, mdalg),
+ RECV_ATTR_FUNC(argv_attr_scan, &tp->certs),
+ RECV_ATTR_FUNC(argv_attr_scan, &tp->pkeys),
+ ATTR_TYPE_END);
+ tp->mdalg = vstring_export(mdalg);
+ tp->next = 0;
+ ret = (ret == 3 ? 1 : -1);
+ }
+ if (ret != 1) {
+ tls_proxy_client_tlsa_free(head);
+ head = 0;
+ }
+ *(TLS_TLSA **) ptr = head;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_tlsa_scan ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_dane_scan - receive TLS_DANE from stream */
+
+static int tls_proxy_client_dane_scan(ATTR_SCAN_MASTER_FN scan_fn,
+ VSTREAM *fp, int flags, void *ptr)
+{
+ TLS_DANE *dane = 0;
+ int ret;
+ int have_dane = 0;
+
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_INT(TLS_ATTR_DANE, &have_dane),
+ ATTR_TYPE_END);
+ if (msg_verbose)
+ msg_info("tls_proxy_client_dane_scan have_dane=%d", have_dane);
+
+ if (ret == 1 && have_dane) {
+ VSTRING *base_domain = vstring_alloc(25);
+ long expires;
+
+ dane = (TLS_DANE *) mymalloc(sizeof(*dane));
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer
+ * types.
+ */
+ memset(dane, 0, sizeof(*dane));
+ /* Always construct a well-formed structure. */
+ dane->ta = 0; /* scan_fn may return early */
+ dane->ee = 0;
+ dane->certs = 0;
+ dane->pkeys = 0;
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_FUNC(tls_proxy_client_tlsa_scan,
+ &dane->ta),
+ RECV_ATTR_FUNC(tls_proxy_client_tlsa_scan,
+ &dane->ee),
+ RECV_ATTR_FUNC(tls_proxy_client_certs_scan,
+ &dane->certs),
+ RECV_ATTR_FUNC(tls_proxy_client_pkeys_scan,
+ &dane->pkeys),
+ RECV_ATTR_STR(TLS_ATTR_DOMAIN, base_domain),
+ RECV_ATTR_INT(TLS_ATTR_FLAGS, &dane->flags),
+ RECV_ATTR_LONG(TLS_ATTR_EXP, &expires),
+ ATTR_TYPE_END);
+ /* Always construct a well-formed structure. */
+ dane->base_domain = vstring_export(base_domain);
+ dane->expires = expires;
+ dane->refs = 1;
+ ret = (ret == 7 ? 1 : -1);
+ /* XXX if scan_fn() completed normally, sanity check dane->flags. */
+ if (ret != 1) {
+ tls_proxy_client_dane_free(dane);
+ dane = 0;
+ }
+ }
+ *(TLS_DANE **) ptr = dane;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_dane_scan ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_client_start_scan - receive TLS_CLIENT_START_PROPS from stream */
+
+int tls_proxy_client_start_scan(ATTR_SCAN_MASTER_FN scan_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_CLIENT_START_PROPS *props
+ = (TLS_CLIENT_START_PROPS *) mymalloc(sizeof(*props));
+ int ret;
+ VSTRING *nexthop = vstring_alloc(25);
+ VSTRING *host = vstring_alloc(25);
+ VSTRING *namaddr = vstring_alloc(25);
+ VSTRING *sni = vstring_alloc(25);
+ VSTRING *serverid = vstring_alloc(25);
+ VSTRING *helo = vstring_alloc(25);
+ VSTRING *protocols = vstring_alloc(25);
+ VSTRING *cipher_grade = vstring_alloc(25);
+ VSTRING *cipher_exclusions = vstring_alloc(25);
+ VSTRING *mdalg = vstring_alloc(25);
+
+ if (msg_verbose)
+ msg_info("begin tls_proxy_client_start_scan");
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer types.
+ */
+ memset(props, 0, sizeof(*props));
+ props->ctx = 0;
+ props->stream = 0;
+ props->fd = -1;
+ props->dane = 0; /* scan_fn may return early */
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_INT(TLS_ATTR_TIMEOUT, &props->timeout),
+ RECV_ATTR_INT(TLS_ATTR_TLS_LEVEL, &props->tls_level),
+ RECV_ATTR_STR(TLS_ATTR_NEXTHOP, nexthop),
+ RECV_ATTR_STR(TLS_ATTR_HOST, host),
+ RECV_ATTR_STR(TLS_ATTR_NAMADDR, namaddr),
+ RECV_ATTR_STR(TLS_ATTR_SNI, sni),
+ RECV_ATTR_STR(TLS_ATTR_SERVERID, serverid),
+ RECV_ATTR_STR(TLS_ATTR_HELO, helo),
+ RECV_ATTR_STR(TLS_ATTR_PROTOCOLS, protocols),
+ RECV_ATTR_STR(TLS_ATTR_CIPHER_GRADE, cipher_grade),
+ RECV_ATTR_STR(TLS_ATTR_CIPHER_EXCLUSIONS,
+ cipher_exclusions),
+ RECV_ATTR_FUNC(argv_attr_scan, &props->matchargv),
+ RECV_ATTR_STR(TLS_ATTR_MDALG, mdalg),
+ RECV_ATTR_FUNC(tls_proxy_client_dane_scan,
+ &props->dane),
+ ATTR_TYPE_END);
+ /* Always construct a well-formed structure. */
+ props->nexthop = vstring_export(nexthop);
+ props->host = vstring_export(host);
+ props->namaddr = vstring_export(namaddr);
+ props->sni = vstring_export(sni);
+ props->serverid = vstring_export(serverid);
+ props->helo = vstring_export(helo);
+ props->protocols = vstring_export(protocols);
+ props->cipher_grade = vstring_export(cipher_grade);
+ props->cipher_exclusions = vstring_export(cipher_exclusions);
+ props->mdalg = vstring_export(mdalg);
+ ret = (ret == 14 ? 1 : -1);
+ if (ret != 1) {
+ tls_proxy_client_start_free(props);
+ props = 0;
+ }
+ *(TLS_CLIENT_START_PROPS **) ptr = props;
+ if (msg_verbose)
+ msg_info("tls_proxy_client_start_scan ret=%d", ret);
+ return (ret);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_proxy_context_print.c b/external/ibm-public/postfix/dist/src/tls/tls_proxy_context_print.c
new file mode 100644
index 00000000000..572fce1dde0
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/tls_proxy_context_print.c
@@ -0,0 +1,114 @@
+/* $NetBSD: tls_proxy_context_print.c,v 1.1.1.1 2020/03/18 18:59:35 christos Exp $ */
+
+/*++
+/* NAME
+/* tls_proxy_context_print
+/* SUMMARY
+/* write TLS_ATTR_STATE structure to stream
+/* SYNOPSIS
+/* #include <tls_proxy.h>
+/*
+/* int tls_proxy_context_print(print_fn, stream, flags, ptr)
+/* ATTR_PRINT_MASTER_FN print_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/* DESCRIPTION
+/* tls_proxy_context_print() writes the public members of a
+/* TLS_ATTR_STATE structure to the named stream using the
+/* specified attribute print routine. tls_proxy_context_print()
+/* is meant to be passed as a call-back to attr_print(), thusly:
+/*
+/* ... SEND_ATTR_FUNC(tls_proxy_context_print, (void *) tls_context), ...
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* IBM T.J. Watson Research
+/* P.O. Box 704
+/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#ifdef USE_TLS
+
+/* System library. */
+
+#include <sys_defs.h>
+
+/* Utility library */
+
+#include <attr.h>
+
+/* TLS library. */
+
+#include <tls.h>
+#include <tls_proxy.h>
+
+/* tls_proxy_context_print - send TLS session state over stream */
+
+int tls_proxy_context_print(ATTR_PRINT_MASTER_FN print_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_SESS_STATE *tp = (TLS_SESS_STATE *) ptr;
+ int ret;
+
+#define STRING_OR_EMPTY(s) ((s) ? (s) : "")
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_STR(TLS_ATTR_PEER_CN,
+ STRING_OR_EMPTY(tp->peer_CN)),
+ SEND_ATTR_STR(TLS_ATTR_ISSUER_CN,
+ STRING_OR_EMPTY(tp->issuer_CN)),
+ SEND_ATTR_STR(TLS_ATTR_PEER_CERT_FPT,
+ STRING_OR_EMPTY(tp->peer_cert_fprint)),
+ SEND_ATTR_STR(TLS_ATTR_PEER_PKEY_FPT,
+ STRING_OR_EMPTY(tp->peer_pkey_fprint)),
+ SEND_ATTR_INT(TLS_ATTR_PEER_STATUS,
+ tp->peer_status),
+ SEND_ATTR_STR(TLS_ATTR_CIPHER_PROTOCOL,
+ STRING_OR_EMPTY(tp->protocol)),
+ SEND_ATTR_STR(TLS_ATTR_CIPHER_NAME,
+ STRING_OR_EMPTY(tp->cipher_name)),
+ SEND_ATTR_INT(TLS_ATTR_CIPHER_USEBITS,
+ tp->cipher_usebits),
+ SEND_ATTR_INT(TLS_ATTR_CIPHER_ALGBITS,
+ tp->cipher_algbits),
+ SEND_ATTR_STR(TLS_ATTR_KEX_NAME,
+ STRING_OR_EMPTY(tp->kex_name)),
+ SEND_ATTR_STR(TLS_ATTR_KEX_CURVE,
+ STRING_OR_EMPTY(tp->kex_curve)),
+ SEND_ATTR_INT(TLS_ATTR_KEX_BITS,
+ tp->kex_bits),
+ SEND_ATTR_STR(TLS_ATTR_CLNT_SIG_NAME,
+ STRING_OR_EMPTY(tp->clnt_sig_name)),
+ SEND_ATTR_STR(TLS_ATTR_CLNT_SIG_CURVE,
+ STRING_OR_EMPTY(tp->clnt_sig_curve)),
+ SEND_ATTR_INT(TLS_ATTR_CLNT_SIG_BITS,
+ tp->clnt_sig_bits),
+ SEND_ATTR_STR(TLS_ATTR_CLNT_SIG_DGST,
+ STRING_OR_EMPTY(tp->clnt_sig_dgst)),
+ SEND_ATTR_STR(TLS_ATTR_SRVR_SIG_NAME,
+ STRING_OR_EMPTY(tp->srvr_sig_name)),
+ SEND_ATTR_STR(TLS_ATTR_SRVR_SIG_CURVE,
+ STRING_OR_EMPTY(tp->srvr_sig_curve)),
+ SEND_ATTR_INT(TLS_ATTR_SRVR_SIG_BITS,
+ tp->srvr_sig_bits),
+ SEND_ATTR_STR(TLS_ATTR_SRVR_SIG_DGST,
+ STRING_OR_EMPTY(tp->srvr_sig_dgst)),
+ SEND_ATTR_STR(TLS_ATTR_NAMADDR,
+ STRING_OR_EMPTY(tp->namaddr)),
+ ATTR_TYPE_END);
+ /* Do not flush the stream. */
+ return (ret);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_proxy_context_scan.c b/external/ibm-public/postfix/dist/src/tls/tls_proxy_context_scan.c
new file mode 100644
index 00000000000..7731fe957d8
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/tls_proxy_context_scan.c
@@ -0,0 +1,190 @@
+/* $NetBSD: tls_proxy_context_scan.c,v 1.1.1.1 2020/03/18 18:59:35 christos Exp $ */
+
+/*++
+/* NAME
+/* tls_proxy_context_scan
+/* SUMMARY
+/* read TLS session state from stream
+/* SYNOPSIS
+/* #include <tls_proxy.h>
+/*
+/* int tls_proxy_context_scan(scan_fn, stream, flags, ptr)
+/* ATTR_SCAN_MASTER_FN scan_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* void tls_proxy_context_free(tls_context)
+/* TLS_SESS_STATE *tls_context;
+/* DESCRIPTION
+/* tls_proxy_context_scan() reads the public members of a
+/* TLS_ATTR_STATE structure from the named stream using the
+/* specified attribute scan routine. tls_proxy_context_scan()
+/* is meant to be passed as a call-back to attr_scan() as shown
+/* below.
+/*
+/* tls_proxy_context_free() destroys a TLS context object that
+/* was received with tls_proxy_context_scan().
+/*
+/* TLS_ATTR_STATE *tls_context = 0;
+/* ...
+/* ... RECV_ATTR_FUNC(tls_proxy_context_scan, (void *) &tls_context), ...
+/* ...
+/* if (tls_context)
+/* tls_proxy_context_free(tls_context);
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* IBM T.J. Watson Research
+/* P.O. Box 704
+/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#ifdef USE_TLS
+
+/* System library. */
+
+#include <sys_defs.h>
+
+/* Utility library */
+
+#include <attr.h>
+#include <msg.h>
+
+/* TLS library. */
+
+#include <tls.h>
+#include <tls_proxy.h>
+
+/* tls_proxy_context_scan - receive TLS session state from stream */
+
+int tls_proxy_context_scan(ATTR_SCAN_MASTER_FN scan_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_SESS_STATE *tls_context
+ = (TLS_SESS_STATE *) mymalloc(sizeof(*tls_context));;
+ int ret;
+ VSTRING *peer_CN = vstring_alloc(25);
+ VSTRING *issuer_CN = vstring_alloc(25);
+ VSTRING *peer_cert_fprint = vstring_alloc(60); /* 60 for SHA-1 */
+ VSTRING *peer_pkey_fprint = vstring_alloc(60); /* 60 for SHA-1 */
+ VSTRING *protocol = vstring_alloc(25);
+ VSTRING *cipher_name = vstring_alloc(25);
+ VSTRING *kex_name = vstring_alloc(25);
+ VSTRING *kex_curve = vstring_alloc(25);
+ VSTRING *clnt_sig_name = vstring_alloc(25);
+ VSTRING *clnt_sig_curve = vstring_alloc(25);
+ VSTRING *clnt_sig_dgst = vstring_alloc(25);
+ VSTRING *srvr_sig_name = vstring_alloc(25);
+ VSTRING *srvr_sig_curve = vstring_alloc(25);
+ VSTRING *srvr_sig_dgst = vstring_alloc(25);
+ VSTRING *namaddr = vstring_alloc(100);
+
+ if (msg_verbose)
+ msg_info("begin tls_proxy_context_scan");
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer types.
+ */
+ memset(tls_context, 0, sizeof(*tls_context));
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_STR(TLS_ATTR_PEER_CN, peer_CN),
+ RECV_ATTR_STR(TLS_ATTR_ISSUER_CN, issuer_CN),
+ RECV_ATTR_STR(TLS_ATTR_PEER_CERT_FPT, peer_cert_fprint),
+ RECV_ATTR_STR(TLS_ATTR_PEER_PKEY_FPT, peer_pkey_fprint),
+ RECV_ATTR_INT(TLS_ATTR_PEER_STATUS,
+ &tls_context->peer_status),
+ RECV_ATTR_STR(TLS_ATTR_CIPHER_PROTOCOL, protocol),
+ RECV_ATTR_STR(TLS_ATTR_CIPHER_NAME, cipher_name),
+ RECV_ATTR_INT(TLS_ATTR_CIPHER_USEBITS,
+ &tls_context->cipher_usebits),
+ RECV_ATTR_INT(TLS_ATTR_CIPHER_ALGBITS,
+ &tls_context->cipher_algbits),
+ RECV_ATTR_STR(TLS_ATTR_KEX_NAME, kex_name),
+ RECV_ATTR_STR(TLS_ATTR_KEX_CURVE, kex_curve),
+ RECV_ATTR_INT(TLS_ATTR_KEX_BITS, &tls_context->kex_bits),
+ RECV_ATTR_STR(TLS_ATTR_CLNT_SIG_NAME, clnt_sig_name),
+ RECV_ATTR_STR(TLS_ATTR_CLNT_SIG_CURVE, clnt_sig_curve),
+ RECV_ATTR_INT(TLS_ATTR_CLNT_SIG_BITS, &tls_context->clnt_sig_bits),
+ RECV_ATTR_STR(TLS_ATTR_CLNT_SIG_DGST, clnt_sig_dgst),
+ RECV_ATTR_STR(TLS_ATTR_SRVR_SIG_NAME, srvr_sig_name),
+ RECV_ATTR_STR(TLS_ATTR_SRVR_SIG_CURVE, srvr_sig_curve),
+ RECV_ATTR_INT(TLS_ATTR_SRVR_SIG_BITS, &tls_context->srvr_sig_bits),
+ RECV_ATTR_STR(TLS_ATTR_SRVR_SIG_DGST, srvr_sig_dgst),
+ RECV_ATTR_STR(TLS_ATTR_NAMADDR, namaddr),
+ ATTR_TYPE_END);
+ /* Always construct a well-formed structure. */
+ tls_context->peer_CN = vstring_export(peer_CN);
+ tls_context->issuer_CN = vstring_export(issuer_CN);
+ tls_context->peer_cert_fprint = vstring_export(peer_cert_fprint);
+ tls_context->peer_pkey_fprint = vstring_export(peer_pkey_fprint);
+ tls_context->protocol = vstring_export(protocol);
+ tls_context->cipher_name = vstring_export(cipher_name);
+ tls_context->kex_name = vstring_export(kex_name);
+ tls_context->kex_curve = vstring_export(kex_curve);
+ tls_context->clnt_sig_name = vstring_export(clnt_sig_name);
+ tls_context->clnt_sig_curve = vstring_export(clnt_sig_curve);
+ tls_context->clnt_sig_dgst = vstring_export(clnt_sig_dgst);
+ tls_context->srvr_sig_name = vstring_export(srvr_sig_name);
+ tls_context->srvr_sig_curve = vstring_export(srvr_sig_curve);
+ tls_context->srvr_sig_dgst = vstring_export(srvr_sig_dgst);
+ tls_context->namaddr = vstring_export(namaddr);
+ ret = (ret == 21 ? 1 : -1);
+ if (ret != 1) {
+ tls_proxy_context_free(tls_context);
+ tls_context = 0;
+ }
+ *(TLS_SESS_STATE **) ptr = tls_context;
+ if (msg_verbose)
+ msg_info("tls_proxy_context_scan ret=%d", ret);
+ return (ret);
+}
+
+/* tls_proxy_context_free - destroy object from tls_proxy_context_receive() */
+
+void tls_proxy_context_free(TLS_SESS_STATE *tls_context)
+{
+ if (tls_context->peer_CN)
+ myfree(tls_context->peer_CN);
+ if (tls_context->issuer_CN)
+ myfree(tls_context->issuer_CN);
+ if (tls_context->peer_cert_fprint)
+ myfree(tls_context->peer_cert_fprint);
+ if (tls_context->peer_pkey_fprint)
+ myfree(tls_context->peer_pkey_fprint);
+ if (tls_context->protocol)
+ myfree((void *) tls_context->protocol);
+ if (tls_context->cipher_name)
+ myfree((void *) tls_context->cipher_name);
+ if (tls_context->kex_name)
+ myfree((void *) tls_context->kex_name);
+ if (tls_context->kex_curve)
+ myfree((void *) tls_context->kex_curve);
+ if (tls_context->clnt_sig_name)
+ myfree((void *) tls_context->clnt_sig_name);
+ if (tls_context->clnt_sig_curve)
+ myfree((void *) tls_context->clnt_sig_curve);
+ if (tls_context->clnt_sig_dgst)
+ myfree((void *) tls_context->clnt_sig_dgst);
+ if (tls_context->srvr_sig_name)
+ myfree((void *) tls_context->srvr_sig_name);
+ if (tls_context->srvr_sig_curve)
+ myfree((void *) tls_context->srvr_sig_curve);
+ if (tls_context->srvr_sig_dgst)
+ myfree((void *) tls_context->srvr_sig_dgst);
+ if (tls_context->namaddr)
+ myfree((void *) tls_context->namaddr);
+ myfree((void *) tls_context);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_proxy_server_print.c b/external/ibm-public/postfix/dist/src/tls/tls_proxy_server_print.c
new file mode 100644
index 00000000000..b5d56b88bfa
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/tls_proxy_server_print.c
@@ -0,0 +1,145 @@
+/* $NetBSD: tls_proxy_server_print.c,v 1.1.1.1 2020/03/18 18:59:35 christos Exp $ */
+
+/*++
+/* NAME
+/* tls_proxy_server_print 3
+/* SUMMARY
+/* write TLS_SERVER_XXX structures to stream
+/* SYNOPSIS
+/* #include <tls_proxy.h>
+/*
+/* int tls_proxy_server_init_print(print_fn, stream, flags, ptr)
+/* ATTR_PRINT_MASTER_FN print_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* int tls_proxy_server_start_print(print_fn, stream, flags, ptr)
+/* ATTR_PRINT_MASTER_FN print_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/* DESCRIPTION
+/* tls_proxy_server_init_print() writes a TLS_SERVER_INIT_PROPS
+/* structure to the named stream using the specified attribute print
+/* routine. tls_proxy_server_init_print() is meant to be passed as
+/* a call-back to attr_print(), thusly:
+/*
+/* ... SEND_ATTR_FUNC(tls_proxy_server_init_print, (void *) init_props), ...
+/*
+/* tls_proxy_server_start_print() writes a TLS_SERVER_START_PROPS
+/* structure to the named stream using the specified attribute print
+/* routine. tls_proxy_server_start_print() is meant to be passed as
+/* a call-back to attr_print(), thusly:
+/*
+/* ... SEND_ATTR_FUNC(tls_proxy_server_start_print, (void *) start_props), ...
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#ifdef USE_TLS
+
+/* System library. */
+
+#include <sys_defs.h>
+
+/* Utility library */
+
+#include <attr.h>
+
+/* TLS library. */
+
+#include <tls.h>
+#include <tls_proxy.h>
+
+/* tls_proxy_server_init_print - send TLS_SERVER_INIT_PROPS over stream */
+
+int tls_proxy_server_init_print(ATTR_PRINT_MASTER_FN print_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_SERVER_INIT_PROPS *props = (TLS_SERVER_INIT_PROPS *) ptr;
+ int ret;
+
+#define STRING_OR_EMPTY(s) ((s) ? (s) : "")
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_STR(TLS_ATTR_LOG_PARAM,
+ STRING_OR_EMPTY(props->log_param)),
+ SEND_ATTR_STR(TLS_ATTR_LOG_LEVEL,
+ STRING_OR_EMPTY(props->log_level)),
+ SEND_ATTR_INT(TLS_ATTR_VERIFYDEPTH, props->verifydepth),
+ SEND_ATTR_STR(TLS_ATTR_CACHE_TYPE,
+ STRING_OR_EMPTY(props->cache_type)),
+ SEND_ATTR_INT(TLS_ATTR_SET_SESSID, props->set_sessid),
+ SEND_ATTR_STR(TLS_ATTR_CHAIN_FILES,
+ STRING_OR_EMPTY(props->chain_files)),
+ SEND_ATTR_STR(TLS_ATTR_CERT_FILE,
+ STRING_OR_EMPTY(props->cert_file)),
+ SEND_ATTR_STR(TLS_ATTR_KEY_FILE,
+ STRING_OR_EMPTY(props->key_file)),
+ SEND_ATTR_STR(TLS_ATTR_DCERT_FILE,
+ STRING_OR_EMPTY(props->dcert_file)),
+ SEND_ATTR_STR(TLS_ATTR_DKEY_FILE,
+ STRING_OR_EMPTY(props->dkey_file)),
+ SEND_ATTR_STR(TLS_ATTR_ECCERT_FILE,
+ STRING_OR_EMPTY(props->eccert_file)),
+ SEND_ATTR_STR(TLS_ATTR_ECKEY_FILE,
+ STRING_OR_EMPTY(props->eckey_file)),
+ SEND_ATTR_STR(TLS_ATTR_CAFILE,
+ STRING_OR_EMPTY(props->CAfile)),
+ SEND_ATTR_STR(TLS_ATTR_CAPATH,
+ STRING_OR_EMPTY(props->CApath)),
+ SEND_ATTR_STR(TLS_ATTR_PROTOCOLS,
+ STRING_OR_EMPTY(props->protocols)),
+ SEND_ATTR_STR(TLS_ATTR_EECDH_GRADE,
+ STRING_OR_EMPTY(props->eecdh_grade)),
+ SEND_ATTR_STR(TLS_ATTR_DH1K_PARAM_FILE,
+ STRING_OR_EMPTY(props->dh1024_param_file)),
+ SEND_ATTR_STR(TLS_ATTR_DH512_PARAM_FILE,
+ STRING_OR_EMPTY(props->dh512_param_file)),
+ SEND_ATTR_INT(TLS_ATTR_ASK_CCERT, props->ask_ccert),
+ SEND_ATTR_STR(TLS_ATTR_MDALG,
+ STRING_OR_EMPTY(props->mdalg)),
+ ATTR_TYPE_END);
+ /* Do not flush the stream. */
+ return (ret);
+}
+
+/* tls_proxy_server_start_print - send TLS_SERVER_START_PROPS over stream */
+
+int tls_proxy_server_start_print(ATTR_PRINT_MASTER_FN print_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_SERVER_START_PROPS *props = (TLS_SERVER_START_PROPS *) ptr;
+ int ret;
+
+#define STRING_OR_EMPTY(s) ((s) ? (s) : "")
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_INT(TLS_ATTR_TIMEOUT, props->timeout),
+ SEND_ATTR_INT(TLS_ATTR_REQUIRECERT, props->requirecert),
+ SEND_ATTR_STR(TLS_ATTR_SERVERID,
+ STRING_OR_EMPTY(props->serverid)),
+ SEND_ATTR_STR(TLS_ATTR_NAMADDR,
+ STRING_OR_EMPTY(props->namaddr)),
+ SEND_ATTR_STR(TLS_ATTR_CIPHER_GRADE,
+ STRING_OR_EMPTY(props->cipher_grade)),
+ SEND_ATTR_STR(TLS_ATTR_CIPHER_EXCLUSIONS,
+ STRING_OR_EMPTY(props->cipher_exclusions)),
+ SEND_ATTR_STR(TLS_ATTR_MDALG,
+ STRING_OR_EMPTY(props->mdalg)),
+ ATTR_TYPE_END);
+ /* Do not flush the stream. */
+ return (ret);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_proxy_server_scan.c b/external/ibm-public/postfix/dist/src/tls/tls_proxy_server_scan.c
new file mode 100644
index 00000000000..caa46d3cbee
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/tls_proxy_server_scan.c
@@ -0,0 +1,247 @@
+/* $NetBSD: tls_proxy_server_scan.c,v 1.1.1.1 2020/03/18 18:59:35 christos Exp $ */
+
+/*++
+/* NAME
+/* tls_proxy_server_scan 3
+/* SUMMARY
+/* read TLS_SERVER_XXX structures from stream
+/* SYNOPSIS
+/* #include <tls_proxy.h>
+/*
+/* int tls_proxy_server_init_scan(scan_fn, stream, flags, ptr)
+/* ATTR_SCAN_MASTER_FN scan_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* tls_proxy_server_init_free(init_props)
+/* TLS_SERVER_INIT_PROPS *init_props;
+/*
+/* int tls_proxy_server_start_scan(scan_fn, stream, flags, ptr)
+/* ATTR_SCAN_MASTER_FN scan_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/*
+/* void tls_proxy_server_start_free(start_props)
+/* TLS_SERVER_START_PROPS *start_props;
+/* DESCRIPTION
+/* tls_proxy_server_init_scan() reads a TLS_SERVER_INIT_PROPS
+/* structure from the named stream using the specified attribute
+/* scan routine. tls_proxy_server_init_scan() is meant to be passed
+/* as a call-back function to attr_scan(), as shown below.
+/*
+/* tls_proxy_server_init_free() destroys a TLS_SERVER_INIT_PROPS
+/* structure that was created by tls_proxy_server_init_scan().
+/*
+/* TLS_SERVER_INIT_PROPS *init_props = 0;
+/* ...
+/* ... RECV_ATTR_FUNC(tls_proxy_server_init_scan, (void *) &init_props)
+/* ...
+/* if (init_props)
+/* tls_proxy_client_init_free(init_props);
+/*
+/* tls_proxy_server_start_scan() reads a TLS_SERVER_START_PROPS
+/* structure from the named stream using the specified attribute
+/* scan routine. tls_proxy_server_start_scan() is meant to be passed
+/* as a call-back function to attr_scan(), as shown below.
+/*
+/* tls_proxy_server_start_free() destroys a TLS_SERVER_START_PROPS
+/* structure that was created by tls_proxy_server_start_scan().
+/*
+/* TLS_SERVER_START_PROPS *start_props = 0;
+/* ...
+/* ... RECV_ATTR_FUNC(tls_proxy_server_start_scan, (void *) &start_props)
+/* ...
+/* if (start_props)
+/* tls_proxy_server_start_free(start_props);
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#ifdef USE_TLS
+
+/* System library. */
+
+#include <sys_defs.h>
+
+/* Utility library */
+
+#include <attr.h>
+
+/* TLS library. */
+
+#include <tls.h>
+#include <tls_proxy.h>
+
+/* tls_proxy_server_init_scan - receive TLS_SERVER_INIT_PROPS from stream */
+
+int tls_proxy_server_init_scan(ATTR_SCAN_MASTER_FN scan_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_SERVER_INIT_PROPS *props
+ = (TLS_SERVER_INIT_PROPS *) mymalloc(sizeof(*props));
+ int ret;
+ VSTRING *log_param = vstring_alloc(25);
+ VSTRING *log_level = vstring_alloc(25);
+ VSTRING *cache_type = vstring_alloc(25);
+ VSTRING *chain_files = vstring_alloc(25);
+ VSTRING *cert_file = vstring_alloc(25);
+ VSTRING *key_file = vstring_alloc(25);
+ VSTRING *dcert_file = vstring_alloc(25);
+ VSTRING *dkey_file = vstring_alloc(25);
+ VSTRING *eccert_file = vstring_alloc(25);
+ VSTRING *eckey_file = vstring_alloc(25);
+ VSTRING *CAfile = vstring_alloc(25);
+ VSTRING *CApath = vstring_alloc(25);
+ VSTRING *protocols = vstring_alloc(25);
+ VSTRING *eecdh_grade = vstring_alloc(25);
+ VSTRING *dh1024_param_file = vstring_alloc(25);
+ VSTRING *dh512_param_file = vstring_alloc(25);
+ VSTRING *mdalg = vstring_alloc(25);
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer types.
+ */
+ memset(props, 0, sizeof(*props));
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_STR(TLS_ATTR_LOG_PARAM, log_param),
+ RECV_ATTR_STR(TLS_ATTR_LOG_LEVEL, log_level),
+ RECV_ATTR_INT(TLS_ATTR_VERIFYDEPTH, &props->verifydepth),
+ RECV_ATTR_STR(TLS_ATTR_CACHE_TYPE, cache_type),
+ RECV_ATTR_INT(TLS_ATTR_SET_SESSID, &props->set_sessid),
+ RECV_ATTR_STR(TLS_ATTR_CHAIN_FILES, chain_files),
+ RECV_ATTR_STR(TLS_ATTR_CERT_FILE, cert_file),
+ RECV_ATTR_STR(TLS_ATTR_KEY_FILE, key_file),
+ RECV_ATTR_STR(TLS_ATTR_DCERT_FILE, dcert_file),
+ RECV_ATTR_STR(TLS_ATTR_DKEY_FILE, dkey_file),
+ RECV_ATTR_STR(TLS_ATTR_ECCERT_FILE, eccert_file),
+ RECV_ATTR_STR(TLS_ATTR_ECKEY_FILE, eckey_file),
+ RECV_ATTR_STR(TLS_ATTR_CAFILE, CAfile),
+ RECV_ATTR_STR(TLS_ATTR_CAPATH, CApath),
+ RECV_ATTR_STR(TLS_ATTR_PROTOCOLS, protocols),
+ RECV_ATTR_STR(TLS_ATTR_EECDH_GRADE, eecdh_grade),
+ RECV_ATTR_STR(TLS_ATTR_DH1K_PARAM_FILE, dh1024_param_file),
+ RECV_ATTR_STR(TLS_ATTR_DH512_PARAM_FILE, dh512_param_file),
+ RECV_ATTR_INT(TLS_ATTR_ASK_CCERT, &props->ask_ccert),
+ RECV_ATTR_STR(TLS_ATTR_MDALG, mdalg),
+ ATTR_TYPE_END);
+ /* Always construct a well-formed structure. */
+ props->log_param = vstring_export(log_param);
+ props->log_level = vstring_export(log_level);
+ props->cache_type = vstring_export(cache_type);
+ props->chain_files = vstring_export(chain_files);
+ props->cert_file = vstring_export(cert_file);
+ props->key_file = vstring_export(key_file);
+ props->dcert_file = vstring_export(dcert_file);
+ props->dkey_file = vstring_export(dkey_file);
+ props->eccert_file = vstring_export(eccert_file);
+ props->eckey_file = vstring_export(eckey_file);
+ props->CAfile = vstring_export(CAfile);
+ props->CApath = vstring_export(CApath);
+ props->protocols = vstring_export(protocols);
+ props->eecdh_grade = vstring_export(eecdh_grade);
+ props->dh1024_param_file = vstring_export(dh1024_param_file);
+ props->dh512_param_file = vstring_export(dh512_param_file);
+ props->mdalg = vstring_export(mdalg);
+ ret = (ret == 20 ? 1 : -1);
+ if (ret != 1) {
+ tls_proxy_server_init_free(props);
+ props = 0;
+ }
+ *(TLS_SERVER_INIT_PROPS **) ptr = props;
+ return (ret);
+}
+
+/* tls_proxy_server_init_free - destroy TLS_SERVER_INIT_PROPS structure */
+
+void tls_proxy_server_init_free(TLS_SERVER_INIT_PROPS *props)
+{
+ myfree((void *) props->log_param);
+ myfree((void *) props->log_level);
+ myfree((void *) props->cache_type);
+ myfree((void *) props->chain_files);
+ myfree((void *) props->cert_file);
+ myfree((void *) props->key_file);
+ myfree((void *) props->dcert_file);
+ myfree((void *) props->dkey_file);
+ myfree((void *) props->eccert_file);
+ myfree((void *) props->eckey_file);
+ myfree((void *) props->CAfile);
+ myfree((void *) props->CApath);
+ myfree((void *) props->protocols);
+ myfree((void *) props->eecdh_grade);
+ myfree((void *) props->dh1024_param_file);
+ myfree((void *) props->dh512_param_file);
+ myfree((void *) props->mdalg);
+ myfree((void *) props);
+}
+
+/* tls_proxy_server_start_scan - receive TLS_SERVER_START_PROPS from stream */
+
+int tls_proxy_server_start_scan(ATTR_SCAN_MASTER_FN scan_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ TLS_SERVER_START_PROPS *props
+ = (TLS_SERVER_START_PROPS *) mymalloc(sizeof(*props));
+ int ret;
+ VSTRING *serverid = vstring_alloc(25);
+ VSTRING *namaddr = vstring_alloc(25);
+ VSTRING *cipher_grade = vstring_alloc(25);
+ VSTRING *cipher_exclusions = vstring_alloc(25);
+ VSTRING *mdalg = vstring_alloc(25);
+
+ /*
+ * Note: memset() is not a portable way to initialize non-integer types.
+ */
+ memset(props, 0, sizeof(*props));
+ props->ctx = 0;
+ props->stream = 0;
+ /* XXX Caller sets fd. */
+ ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_INT(TLS_ATTR_TIMEOUT, &props->timeout),
+ RECV_ATTR_INT(TLS_ATTR_REQUIRECERT, &props->requirecert),
+ RECV_ATTR_STR(TLS_ATTR_SERVERID, serverid),
+ RECV_ATTR_STR(TLS_ATTR_NAMADDR, namaddr),
+ RECV_ATTR_STR(TLS_ATTR_CIPHER_GRADE, cipher_grade),
+ RECV_ATTR_STR(TLS_ATTR_CIPHER_EXCLUSIONS,
+ cipher_exclusions),
+ RECV_ATTR_STR(TLS_ATTR_MDALG, mdalg),
+ ATTR_TYPE_END);
+ props->serverid = vstring_export(serverid);
+ props->namaddr = vstring_export(namaddr);
+ props->cipher_grade = vstring_export(cipher_grade);
+ props->cipher_exclusions = vstring_export(cipher_exclusions);
+ props->mdalg = vstring_export(mdalg);
+ ret = (ret == 7 ? 1 : -1);
+ if (ret != 1) {
+ tls_proxy_server_start_free(props);
+ props = 0;
+ }
+ *(TLS_SERVER_START_PROPS **) ptr = props;
+ return (ret);
+}
+
+/* tls_proxy_server_start_free - destroy TLS_SERVER_START_PROPS structure */
+
+void tls_proxy_server_start_free(TLS_SERVER_START_PROPS *props)
+{
+ /* XXX Caller closes fd. */
+ myfree((void *) props->serverid);
+ myfree((void *) props->namaddr);
+ myfree((void *) props->cipher_grade);
+ myfree((void *) props->cipher_exclusions);
+ myfree((void *) props->mdalg);
+ myfree((void *) props);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/tls/tls_session.c b/external/ibm-public/postfix/dist/src/tls/tls_session.c
index f0b210bed1c..a93fe6d2cf2 100644
--- a/external/ibm-public/postfix/dist/src/tls/tls_session.c
+++ b/external/ibm-public/postfix/dist/src/tls/tls_session.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tls_session.c,v 1.1.1.1 2009/06/23 10:08:57 tron Exp $ */
+/* $NetBSD: tls_session.c,v 1.1.1.2 2020/03/18 18:59:35 christos Exp $ */
/*++
/* NAME
@@ -52,6 +52,11 @@
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*
/* Victor Duchovni
/* Morgan Stanley
/*--*/
@@ -68,6 +73,10 @@
#include <msg.h>
#include <mymalloc.h>
+/* Global library. */
+
+#include <mail_params.h>
+
/* TLS library. */
#define TLS_INTERNAL
@@ -92,6 +101,18 @@ void tls_session_stop(TLS_APPL_STATE *unused_ctx, VSTREAM *stream, int timeou
msg_panic("%s: stream has no active TLS context", myname);
/*
+ * According to RFC 2246 (TLS 1.0), there is no requirement to wait for
+ * the peer's close-notify. If the application protocol provides
+ * sufficient session termination signaling, then there's no need to
+ * duplicate that at the TLS close-notify layer.
+ *
+ * https://tools.ietf.org/html/rfc2246#section-7.2.1
+ * https://tools.ietf.org/html/rfc4346#section-7.2.1
+ * https://tools.ietf.org/html/rfc5246#section-7.2.1
+ *
+ * Specify 'tls_fast_shutdown = no' to enable the historical behavior
+ * described below.
+ *
* Perform SSL_shutdown() twice, as the first attempt will send out the
* shutdown alert but it will not wait for the peer's shutdown alert.
* Therefore, when we are the first party to send the alert, we must call
@@ -101,7 +122,7 @@ void tls_session_stop(TLS_APPL_STATE *unused_ctx, VSTREAM *stream, int timeou
*/
if (!failure) {
retval = tls_bio_shutdown(vstream_fileno(stream), timeout, TLScontext);
- if (retval == 0)
+ if (!var_tls_fast_shutdown && retval == 0)
tls_bio_shutdown(vstream_fileno(stream), timeout, TLScontext);
}
tls_free_context(TLScontext);
@@ -140,7 +161,7 @@ VSTRING *tls_session_passivate(SSL_SESSION *session)
vstring_free(session_data);
return (0);
}
- VSTRING_AT_OFFSET(session_data, actual_size); /* XXX not public */
+ vstring_set_payload_size(session_data, actual_size);
return (session_data);
}
@@ -149,18 +170,13 @@ VSTRING *tls_session_passivate(SSL_SESSION *session)
SSL_SESSION *tls_session_activate(const char *session_data, int session_data_len)
{
-#if (OPENSSL_VERSION_NUMBER < 0x0090707fL)
-#define BOGUS_CONST
-#else
-#define BOGUS_CONST const
-#endif
SSL_SESSION *session;
- BOGUS_CONST unsigned char *ptr;
+ const unsigned char *ptr;
/*
* Activate the SSL_SESSION object.
*/
- ptr = (BOGUS_CONST unsigned char *) session_data;
+ ptr = (const unsigned char *) session_data;
session = d2i_SSL_SESSION((SSL_SESSION **) 0, &ptr, session_data_len);
if (!session)
tls_print_errors();
diff --git a/external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem b/external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem
new file mode 100644
index 00000000000..ab21d3a6701
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem
@@ -0,0 +1,51 @@
+subject=/CN=mx1.example.com
+issuer=/CN=EC issuer CA
+-----BEGIN CERTIFICATE-----
+MIIBoTCCAUagAwIBAgIBAjAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxFQyBpc3N1
+ZXIgQ0EwIBcNMTkwMTA4MDY0NjE0WhgPMjExOTAxMDkwNjQ2MTRaMBoxGDAWBgNV
+BAMMD214MS5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBOO
+wif9FUdKXAiD9T1bpr4RH01IOOhdxHZ4kwf3gmdEB0wK6jeaUVTXcBpH4qHSI6al
+VORejU7dxLLviwq8DPejfjB8MB0GA1UdDgQWBBQXbO9McKUU3NbzBCPTD84CgDOa
+XzAfBgNVHSMEGDAWgBSU9MnNFunfhaJ7NB97/8cPhfSv5DAJBgNVHRMEAjAAMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD214MS5leGFtcGxlLmNvbTAK
+BggqhkjOPQQDAgNJADBGAiEA6gE5EIg1Ap+Gmr+xC7CPKZQ60XNwm8wUJyaCDIk7
+CqMCIQCBCJ/BKwfJgmQ7KpTztuEdincvgyN7O6HM3FPfl+Fndg==
+-----END CERTIFICATE-----
+
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgkiPSKH+bHsvO1+AH
+S555wf6m/Ii2VxJpyqbGqu8j5myhRANCAAQTjsIn/RVHSlwIg/U9W6a+ER9NSDjo
+XcR2eJMH94JnRAdMCuo3mlFU13AaR+Kh0iOmpVTkXo1O3cSy74sKvAz3
+-----END PRIVATE KEY-----
+
+subject=/CN=EC issuer CA
+issuer=/CN=EC root CA
+-----BEGIN CERTIFICATE-----
+MIIBcDCCARagAwIBAgIBAjAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2NDUyNFoYDzIxMTkwMTA5MDY0NTI0WjAXMRUwEwYDVQQD
+DAxFQyBpc3N1ZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARYcKaWmm2M
+ulstiE3b15jhdyZA+Fwyb0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfs
+G614fKHGUYzVo1MwUTAdBgNVHQ4EFgQUlPTJzRbp34WiezQfe//HD4X0r+QwHwYD
+VR0jBBgwFoAU1HqQiWes42EpdB5ooHRxYr8z4V4wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiBALgvWsycg6I1MZq6XKAlgNukQXPT/IgPiC+7Vn80U
+WQIhAPqpsF4oPV7VKgFgVNmNm6MDKuuDQ47Jt/Lk79qkwqM7
+-----END CERTIFICATE-----
+
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgvhC73shHi6WonWdC
+rbMwDzIrjYIejrvmkNQo+7hFnp2hRANCAARYcKaWmm2MulstiE3b15jhdyZA+Fwy
+b0dE2W8pWKDSP/qsXTs7NvH5H8JjNZmDY4q1Nq7FRXfsG614fKHGUYzV
+-----END PRIVATE KEY-----
+
+subject=/CN=EC root CA
+issuer=/CN=EC root CA
+-----BEGIN CERTIFICATE-----
+MIIBbzCCARSgAwIBAgIBATAKBggqhkjOPQQDAjAVMRMwEQYDVQQDDApFQyByb290
+IENBMCAXDTE5MDEwODA2MTk1OFoYDzIxMTkwMTA5MDYxOTU4WjAVMRMwEQYDVQQD
+DApFQyByb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfDF746gzVwSo
+e/UsVtFqSX1ASKbYMdccE9pOB5D/fK5aPqZsy9/YKSE9T+/FcCgZa6uEROyR583Z
+UMyTQFoHRqNTMFEwHQYDVR0OBBYEFNR6kIlnrONhKXQeaKB0cWK/M+FeMB8GA1Ud
+IwQYMBaAFNR6kIlnrONhKXQeaKB0cWK/M+FeMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDSQAwRgIhALZ4ZLphG1ebIkAX+UnxJBVtDKxkq8qz0uBI0N7AEW7X
+AiEAx8PLYRJjlGiWUdadeuCuavx0gNxd3wpOWTz+lC3nu/o=
+-----END CERTIFICATE-----
diff --git a/external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem.ref b/external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem.ref
new file mode 100644
index 00000000000..c9ce8dbb692
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem.ref
@@ -0,0 +1,13 @@
+unknown: warning: ignoring 2nd key at index 4 in warn-mixed-multi-key.pem after 1st at 2
+depth = 0
+issuer = /CN=EC issuer CA
+subject = /CN=mx1.example.com
+
+depth = 1
+issuer = /CN=EC root CA
+subject = /CN=EC issuer CA
+
+depth = 2
+issuer = /CN=EC root CA
+subject = /CN=EC root CA
+
diff --git a/external/ibm-public/postfix/dist/src/tlsmgr/Makefile.in b/external/ibm-public/postfix/dist/src/tlsmgr/Makefile.in
index 7d983e7bb7e..8e7aab6b0fe 100644
--- a/external/ibm-public/postfix/dist/src/tlsmgr/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/tlsmgr/Makefile.in
@@ -58,7 +58,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/tlsproxy/Makefile.in b/external/ibm-public/postfix/dist/src/tlsproxy/Makefile.in
index 744b1d1218a..c72aa812827 100644
--- a/external/ibm-public/postfix/dist/src/tlsproxy/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/tlsproxy/Makefile.in
@@ -57,12 +57,13 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
tlsproxy.o: ../../include/argv.h
tlsproxy.o: ../../include/attr.h
+tlsproxy.o: ../../include/been_here.h
tlsproxy.o: ../../include/check_arg.h
tlsproxy.o: ../../include/dns.h
tlsproxy.o: ../../include/events.h
@@ -81,6 +82,7 @@ tlsproxy.o: ../../include/name_mask.h
tlsproxy.o: ../../include/nbbio.h
tlsproxy.o: ../../include/nvtable.h
tlsproxy.o: ../../include/sock_addr.h
+tlsproxy.o: ../../include/split_at.h
tlsproxy.o: ../../include/sys_defs.h
tlsproxy.o: ../../include/tls.h
tlsproxy.o: ../../include/tls_proxy.h
@@ -90,9 +92,11 @@ tlsproxy.o: ../../include/vstring.h
tlsproxy.o: tlsproxy.c
tlsproxy.o: tlsproxy.h
tlsproxy_state.o: ../../include/argv.h
+tlsproxy_state.o: ../../include/attr.h
tlsproxy_state.o: ../../include/check_arg.h
tlsproxy_state.o: ../../include/dns.h
tlsproxy_state.o: ../../include/events.h
+tlsproxy_state.o: ../../include/htable.h
tlsproxy_state.o: ../../include/mail_conf.h
tlsproxy_state.o: ../../include/mail_server.h
tlsproxy_state.o: ../../include/msg.h
@@ -101,9 +105,11 @@ tlsproxy_state.o: ../../include/mymalloc.h
tlsproxy_state.o: ../../include/name_code.h
tlsproxy_state.o: ../../include/name_mask.h
tlsproxy_state.o: ../../include/nbbio.h
+tlsproxy_state.o: ../../include/nvtable.h
tlsproxy_state.o: ../../include/sock_addr.h
tlsproxy_state.o: ../../include/sys_defs.h
tlsproxy_state.o: ../../include/tls.h
+tlsproxy_state.o: ../../include/tls_proxy.h
tlsproxy_state.o: ../../include/vbuf.h
tlsproxy_state.o: ../../include/vstream.h
tlsproxy_state.o: ../../include/vstring.h
diff --git a/external/ibm-public/postfix/dist/src/tlsproxy/tlsproxy.h b/external/ibm-public/postfix/dist/src/tlsproxy/tlsproxy.h
index 3b3993ca85b..b95434b81fd 100644
--- a/external/ibm-public/postfix/dist/src/tlsproxy/tlsproxy.h
+++ b/external/ibm-public/postfix/dist/src/tlsproxy/tlsproxy.h
@@ -1,4 +1,4 @@
-/* $NetBSD: tlsproxy.h,v 1.1.1.2 2013/01/02 18:59:10 tron Exp $ */
+/* $NetBSD: tlsproxy.h,v 1.1.1.3 2020/03/18 18:59:37 christos Exp $ */
/*++
/* NAME
@@ -27,19 +27,29 @@
typedef struct {
int flags; /* see below */
int req_flags; /* request flags, see tls_proxy.h */
+ int is_server_role; /* avoid clumsy handler code */
char *service; /* argv[0] */
VSTREAM *plaintext_stream; /* local peer: postscreen(8), etc. */
NBBIO *plaintext_buf; /* plaintext buffer */
int ciphertext_fd; /* remote peer */
EVENT_NOTIFY_FN ciphertext_timer; /* kludge */
int timeout; /* read/write time limit */
+ int handshake_timeout; /* in-handshake time limit */
+ int session_timeout; /* post-handshake time limit */
char *remote_endpt; /* printable remote endpoint */
char *server_id; /* cache management */
- TLS_SESS_STATE *tls_context; /* llibtls state */
+ TLS_APPL_STATE *appl_state; /* libtls state */
+ TLS_SESS_STATE *tls_context; /* libtls state */
int ssl_last_err; /* TLS I/O state */
+ TLS_CLIENT_PARAMS *tls_params; /* globals not part of init_props */
+ TLS_SERVER_INIT_PROPS *server_init_props;
+ TLS_SERVER_START_PROPS *server_start_props;
+ TLS_CLIENT_INIT_PROPS *client_init_props;
+ TLS_CLIENT_START_PROPS *client_start_props;
} TLSP_STATE;
#define TLSP_FLAG_DO_HANDSHAKE (1<<0)
+#define TLSP_FLAG_NO_MORE_CIPHERTEXT_IO (1<<1) /* overrides DO_HANDSHAKE */
extern TLSP_STATE *tlsp_state_create(const char *, VSTREAM *);
extern void tlsp_state_free(TLSP_STATE *);
@@ -53,4 +63,9 @@ extern void tlsp_state_free(TLSP_STATE *);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
diff --git a/external/ibm-public/postfix/dist/src/trivial-rewrite/Makefile.in b/external/ibm-public/postfix/dist/src/trivial-rewrite/Makefile.in
index f9e47df444d..92fa6664465 100644
--- a/external/ibm-public/postfix/dist/src/trivial-rewrite/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/trivial-rewrite/Makefile.in
@@ -6,7 +6,7 @@ TESTSRC =
DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE)
CFLAGS = $(DEBUG) $(OPT) $(DEFS)
LIB =
-TESTPROG=
+TESTPROG= transport
PROG = trivial-rewrite
LIBS = ../../lib/lib$(LIB_PREFIX)master$(LIB_SUFFIX) \
../../lib/lib$(LIB_PREFIX)global$(LIB_SUFFIX) \
@@ -29,7 +29,7 @@ Makefile: Makefile.in
test: $(TESTPROG)
-tests:
+tests: transport_test
root_tests:
@@ -38,6 +38,16 @@ $(BIN_DIR)/$(PROG): $(PROG)
update: $(BIN_DIR)/$(PROG)
+transport: transport.c $(LIB) $(LIBS)
+ -mv $@.o junk
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
+ mv junk $@.o
+
+transport_test: transport transport.in transport.ref
+ $(SHLIB_ENV) sh transport.in >transport.tmp 2>&1
+ diff transport.ref transport.tmp
+ rm -f transport.tmp
+
printfck: $(OBJS) $(PROG)
rm -rf printfck
mkdir printfck
@@ -61,7 +71,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -73,6 +83,7 @@ resolve.o: ../../include/domain_list.h
resolve.o: ../../include/htable.h
resolve.o: ../../include/iostuff.h
resolve.o: ../../include/mail_addr_find.h
+resolve.o: ../../include/mail_addr_form.h
resolve.o: ../../include/mail_conf.h
resolve.o: ../../include/mail_params.h
resolve.o: ../../include/mail_proto.h
@@ -134,6 +145,8 @@ transport.o: ../../include/dict.h
transport.o: ../../include/events.h
transport.o: ../../include/htable.h
transport.o: ../../include/iostuff.h
+transport.o: ../../include/mail_addr_find.h
+transport.o: ../../include/mail_addr_form.h
transport.o: ../../include/mail_params.h
transport.o: ../../include/mail_proto.h
transport.o: ../../include/maps.h
diff --git a/external/ibm-public/postfix/dist/src/trivial-rewrite/transport.in b/external/ibm-public/postfix/dist/src/trivial-rewrite/transport.in
new file mode 100644
index 00000000000..1ed3a538258
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/trivial-rewrite/transport.in
@@ -0,0 +1,45 @@
+#!/bin/sh
+
+# Format: address:expected_channel:expected_nexthop
+# No expectation means no match is expected.
+# Specify "-" to expect an empty string.
+
+echo ==== no wildcard
+${VALGRIND} ./transport 'inline:{rcpt1@example1.com=channel1:nexthop1, rcpt2@example2=channel2:, example3=channel3}' <<'EOF'
+rcpt1@example1.com:channel1:nexthop1
+rcpt1+ext1@example1.com:channel1:nexthop1
+rcpt2@example2:channel2:example2
+rcpt@example3:channel3:example3
+EOF
+
+echo ==== with wildcard channel and nexthop
+${VALGRIND} ./transport 'inline:{*=channel0:nexthop0, rcpt1@example1.com=channel1:nexthop1}' <<'EOF'
+rcpt1@example1.com:channel1:nexthop1
+rcpt2@example2:channel0:nexthop0
+EOF
+
+echo ==== with wildcard channel only
+${VALGRIND} ./transport 'inline:{*=channel0, rcpt1@example1.com=channel1:nexthop1}' <<'EOF'
+rcpt1@example1.com:channel1:nexthop1
+rcpt2@example2:channel0:example2
+EOF
+
+echo ==== with wildcard nexthop only
+${VALGRIND} ./transport 'inline:{*=:nexthop0, rcpt1@example1.com=channel1:nexthop1}' <<'EOF'
+rcpt1@example1.com:channel1:nexthop1
+rcpt2@example2:DEFAULT:nexthop0
+EOF
+
+echo ==== with wildcard empty fields.
+${VALGRIND} ./transport 'inline:{*=:, rcpt1@example1.com=channel1:nexthop1}' <<'EOF'
+rcpt1@example1.com:channel1:nexthop1
+rcpt2@example2:DEFAULT:example2
+EOF
+
+echo === subdomain test
+${VALGRIND} ./transport 'inline:{example=:example-result,.example=:dot-example-result}' <<'EOF'
+plain1+ext@other-example:
+foo@example:DEFAULT:example-result
+foo@sub.example:DEFAULT:dot-example-result
+foo@sub.sub.example:DEFAULT:dot-example-result
+EOF
diff --git a/external/ibm-public/postfix/dist/src/trivial-rewrite/transport.ref b/external/ibm-public/postfix/dist/src/trivial-rewrite/transport.ref
new file mode 100644
index 00000000000..47ab07b4df6
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/trivial-rewrite/transport.ref
@@ -0,0 +1,22 @@
+==== no wildcard
+rcpt1@example1.com:example1.com -> channel1:nexthop1
+rcpt1+ext1@example1.com:example1.com -> channel1:nexthop1
+rcpt2@example2:example2 -> channel2:example2
+rcpt@example3:example3 -> channel3:example3
+==== with wildcard channel and nexthop
+rcpt1@example1.com:example1.com -> channel1:nexthop1
+rcpt2@example2:example2 -> channel0:nexthop0
+==== with wildcard channel only
+rcpt1@example1.com:example1.com -> channel1:nexthop1
+rcpt2@example2:example2 -> channel0:example2
+==== with wildcard nexthop only
+rcpt1@example1.com:example1.com -> channel1:nexthop1
+rcpt2@example2:example2 -> DEFAULT:nexthop0
+==== with wildcard empty fields.
+rcpt1@example1.com:example1.com -> channel1:nexthop1
+rcpt2@example2:example2 -> DEFAULT:example2
+=== subdomain test
+plain1+ext@other-example:other-example -> (not found)
+foo@example:example -> DEFAULT:example-result
+foo@sub.example:sub.example -> DEFAULT:dot-example-result
+foo@sub.sub.example:sub.sub.example -> DEFAULT:dot-example-result
diff --git a/external/ibm-public/postfix/dist/src/util/Makefile.in b/external/ibm-public/postfix/dist/src/util/Makefile.in
index a14bb36b2b8..6c23678ab4f 100644
--- a/external/ibm-public/postfix/dist/src/util/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/util/Makefile.in
@@ -39,7 +39,10 @@ SRCS = alldig.c allprint.c argv.c argv_split.c attr_clnt.c attr_print0.c \
dict_sockmap.c line_number.c recv_pass_attr.c pass_accept.c \
poll_fd.c timecmp.c slmdb.c dict_pipe.c dict_random.c \
valid_utf8_hostname.c midna_domain.c argv_splitq.c balpar.c dict_union.c \
- extpar.c dict_inline.c casefold.c dict_utf8.c strcasecmp_utf8.c
+ extpar.c dict_inline.c casefold.c dict_utf8.c strcasecmp_utf8.c \
+ split_qnameval.c argv_attr_print.c argv_attr_scan.c dict_file.c \
+ msg_logger.c logwriter.c unix_dgram_connect.c unix_dgram_listen.c \
+ byte_mask.c
OBJS = alldig.o allprint.o argv.o argv_split.o attr_clnt.o attr_print0.o \
attr_print64.o attr_print_plain.o attr_scan0.o attr_scan64.o \
attr_scan_plain.o auto_clnt.o base64_code.o basename.o binhash.o \
@@ -80,7 +83,10 @@ OBJS = alldig.o allprint.o argv.o argv_split.o attr_clnt.o attr_print0.o \
dict_sockmap.o line_number.o recv_pass_attr.o pass_accept.o \
poll_fd.o timecmp.o $(NON_PLUGIN_MAP_OBJ) dict_pipe.o dict_random.o \
valid_utf8_hostname.o midna_domain.o argv_splitq.o balpar.o dict_union.o \
- extpar.o dict_inline.o casefold.o dict_utf8.o strcasecmp_utf8.o
+ extpar.o dict_inline.o casefold.o dict_utf8.o strcasecmp_utf8.o \
+ split_qnameval.o argv_attr_print.o argv_attr_scan.o dict_file.o \
+ msg_logger.o logwriter.o unix_dgram_connect.o unix_dgram_listen.o \
+ byte_mask.o
# MAP_OBJ is for maps that may be dynamically loaded with dynamicmaps.cf.
# When hard-linking these, makedefs sets NON_PLUGIN_MAP_OBJ=$(MAP_OBJ),
# otherwise it sets the PLUGIN_* macros.
@@ -109,7 +115,8 @@ HDRS = argv.h attr.h attr_clnt.h auto_clnt.h base64_code.h binhash.h \
edit_file.h dict_cache.h dict_thash.h ip_match.h nbbio.h base32_code.h \
dict_fail.h warn_stat.h dict_sockmap.h line_number.h timecmp.h \
slmdb.h compat_va_copy.h dict_pipe.h dict_random.h \
- valid_utf8_hostname.h midna_domain.h dict_union.h dict_inline.h check_arg.h
+ valid_utf8_hostname.h midna_domain.h dict_union.h dict_inline.h \
+ check_arg.h argv_attr.h msg_logger.h logwriter.h byte_mask.h
TESTSRC = fifo_open.c fifo_rdwr_bug.c fifo_rdonly_bug.c select_bug.c \
stream_test.c dup2_pass_on_exec.c
DEFS = -I. -D$(SYSTYPE)
@@ -128,7 +135,8 @@ TESTPROG= dict_open dup2_pass_on_exec events exec_command fifo_open \
unix_recv_fd unix_send_fd stream_recv_fd stream_send_fd hex_code \
myaddrinfo myaddrinfo4 inet_proto sane_basename format_tv \
valid_utf8_string ip_match base32_code msg_rate_delay netstring \
- vstream timecmp dict_cache midna_domain casefold strcasecmp_utf8
+ vstream timecmp dict_cache midna_domain casefold strcasecmp_utf8 \
+ vbuf_print split_qnameval vstream msg_logger byte_mask
PLUGIN_MAP_SO = $(LIB_PREFIX)pcre$(LIB_SUFFIX)
LIB_DIR = ../../lib
@@ -213,6 +221,11 @@ vstring: $(LIB)
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
mv junk $@.o
+msg_logger: msg_logger.c $(LIB)
+ mv $@.o junk
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
+ mv junk $@.o
+
msg_syslog: msg_syslog.c $(LIB)
mv $@.o junk
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
@@ -340,6 +353,11 @@ name_mask: $(LIB)
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
mv junk $@.o
+byte_mask: $(LIB)
+ mv $@.o junk
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
+ mv junk $@.o
+
rand_sleep: $(LIB)
mv $@.o junk
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
@@ -519,6 +537,16 @@ strcasecmp_utf8: $(LIB)
$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
mv junk $@.o
+vbuf_print: $(LIB)
+ mv $@.o junk
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
+ mv junk $@.o
+
+split_qnameval: $(LIB)
+ mv $@.o junk
+ $(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(SYSLIBS)
+ mv junk $@.o
+
tests: all valid_hostname_test mac_expand_test dict_test unescape_test \
hex_quote_test ctable_test inet_addr_list_test base64_code_test \
attr_scan64_test attr_scan0_test dict_pcre_test host_port_test \
@@ -526,135 +554,185 @@ tests: all valid_hostname_test mac_expand_test dict_test unescape_test \
myaddrinfo_test format_tv_test ip_match_test name_mask_tests \
base32_code_test dict_thash_test surrogate_test timecmp_test \
dict_static_test dict_inline_test midna_domain_test casefold_test \
- dict_utf8_test strcasecmp_utf8_test
+ dict_utf8_test strcasecmp_utf8_test vbuf_print_test dict_regexp_test \
+ dict_union_test dict_pipe_test miss_endif_cidr_test \
+ miss_endif_pcre_test miss_endif_regexp_test split_qnameval_test \
+ vstring_test vstream_test dict_pcre_file_test dict_regexp_file_test \
+ dict_cidr_file_test dict_static_file_test dict_random_test \
+ dict_random_file_test dict_inline_file_test byte_mask_tests
root_tests:
valid_hostname_test: valid_hostname valid_hostname.in valid_hostname.ref
- $(SHLIB_ENV) ./valid_hostname <valid_hostname.in 2>valid_hostname.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./valid_hostname <valid_hostname.in 2>valid_hostname.tmp
diff valid_hostname.ref valid_hostname.tmp
rm -f valid_hostname.tmp
mac_expand_test: mac_expand mac_expand.in mac_expand.ref
- $(SHLIB_ENV) ./mac_expand <mac_expand.in >mac_expand.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./mac_expand <mac_expand.in >mac_expand.tmp 2>&1
diff mac_expand.ref mac_expand.tmp
rm -f mac_expand.tmp
unescape_test: unescape unescape.in unescape.ref
- $(SHLIB_ENV) ./unescape <unescape.in | od -cb >unescape.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./unescape <unescape.in | od -cb >unescape.tmp
diff -b unescape.ref unescape.tmp
-# $(SHLIB_ENV) ./unescape <unescape.in | $(SHLIB_ENV) ./unescape -e >unescape.tmp
+# $(SHLIB_ENV) ${VALGRIND} ./unescape <unescape.in | $(SHLIB_ENV) ./unescape -e >unescape.tmp
# diff unescape.in unescape.tmp
rm -f unescape.tmp
hex_quote_test: hex_quote
- $(SHLIB_ENV) ./hex_quote <hex_quote.c | od -cb >hex_quote.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./hex_quote <hex_quote.c | od -cb >hex_quote.tmp
od -cb <hex_quote.c >hex_quote.ref
cmp hex_quote.ref hex_quote.tmp
rm -f hex_quote.ref hex_quote.tmp
ctable_test: ctable
- $(SHLIB_ENV) ./ctable <ctable.in >ctable.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./ctable <ctable.in >ctable.tmp 2>&1
diff ctable.ref ctable.tmp
rm -f ctable.tmp
# On Linux, following test may require "modprobe ipv6" to enable IPv6.
inet_addr_list_test: inet_addr_list
- $(SHLIB_ENV) ./inet_addr_list `cat inet_addr_list.in` >inet_addr_list.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./inet_addr_list `cat inet_addr_list.in` >inet_addr_list.tmp 2>&1
diff inet_addr_list.ref inet_addr_list.tmp
rm -f inet_addr_list.tmp
sane_basename_test: sane_basename
- $(SHLIB_ENV) ./sane_basename <sane_basename.in >sane_basename.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./sane_basename <sane_basename.in >sane_basename.tmp 2>&1
diff sane_basename.ref sane_basename.tmp
rm -f sane_basename.tmp
base64_code_test: base64_code
- $(SHLIB_ENV) ./base64_code
+ $(SHLIB_ENV) ${VALGRIND} ./base64_code
attr_scan64_test: attr_print64 attr_scan64 attr_scan64.ref
- ($(SHLIB_ENV) ./attr_print64 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan64)) >attr_scan64.tmp 2>&1 3>&1
+ ($(SHLIB_ENV) ${VALGRIND} ./attr_print64 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan64)) >attr_scan64.tmp 2>&1 3>&1
diff attr_scan64.ref attr_scan64.tmp
rm -f attr_scan64.tmp
attr_scan0_test: attr_print0 attr_scan0 attr_scan0.ref
- ($(SHLIB_ENV) ./attr_print0 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan0)) >attr_scan0.tmp 2>&1 3>&1
+ ($(SHLIB_ENV) ${VALGRIND} ./attr_print0 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan0)) >attr_scan0.tmp 2>&1 3>&1
diff attr_scan0.ref attr_scan0.tmp
rm -f attr_scan0.tmp
dict_test: dict_open testdb dict_test.in dict_test.ref
rm -f testdb.db testdb.dir testdb.pag
$(SHLIB_ENV) ../postmap/postmap -N hash:testdb
- $(SHLIB_ENV) ./dict_open hash:testdb write < dict_test.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_test.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open hash:testdb write < dict_test.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_test.tmp
diff dict_test.ref dict_test.tmp
$(SHLIB_ENV) ../postmap/postmap -n hash:testdb
- $(SHLIB_ENV) ./dict_open hash:testdb write < dict_test.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_test.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open hash:testdb write < dict_test.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_test.tmp
diff dict_test.ref dict_test.tmp
rm -f testdb.db testdb.dir testdb.pag dict_test.tmp
dict_pcre_test: dict_open dict_pcre.in dict_pcre.map dict_pcre.ref
- $(SHLIB_ENV) ./dict_open pcre:dict_pcre.map read <dict_pcre.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:dict_pcre.map read <dict_pcre.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre.tmp
diff dict_pcre.ref dict_pcre.tmp
rm -f dict_pcre.tmp
+dict_pcre_file_test: dict_open dict_pcre_file.in dict_pcre_file.map dict_pcre_file.ref
+ echo this-is-file1 > dict_pcre_file1
+ echo this-is-file2 > dict_pcre_file2
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:dict_pcre_file.map \
+ read src_rhs_is_file <dict_pcre_file.in 2>&1 | \
+ sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre_file.tmp
+ diff dict_pcre_file.ref dict_pcre_file.tmp
+ rm -f dict_pcre_file.tmp dict_pcre_file1 dict_pcre_file2
+
dict_regexp_test: dict_open dict_regexp.in dict_regexp.map dict_regexp.ref
- $(SHLIB_ENV) ./dict_open regexp:dict_regexp.map read <dict_regexp.in | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_regexp.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:dict_regexp.map read <dict_regexp.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_regexp.tmp
diff dict_regexp.ref dict_regexp.tmp
rm -f dict_regexp.tmp
+dict_regexp_file_test: dict_open dict_regexp_file.in dict_regexp_file.map dict_regexp_file.ref
+ echo this-is-file1 > dict_regexp_file1
+ echo this-is-file2 > dict_regexp_file2
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:dict_regexp_file.map \
+ read src_rhs_is_file <dict_regexp_file.in 2>&1 | \
+ sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_regexp_file.tmp
+ diff dict_regexp_file.ref dict_regexp_file.tmp
+ rm -f dict_regexp_file.tmp dict_regexp_file1 dict_regexp_file2
+
dict_cidr_test: dict_open dict_cidr.in dict_cidr.map dict_cidr.ref
- $(SHLIB_ENV) ./dict_open cidr:dict_cidr.map read <dict_cidr.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_cidr.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:dict_cidr.map read <dict_cidr.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_cidr.tmp
diff dict_cidr.ref dict_cidr.tmp
rm -f dict_cidr.tmp
+dict_cidr_file_test: dict_open dict_cidr_file.in dict_cidr_file.map dict_cidr_file.ref
+ echo this-is-file1 > dict_cidr_file1
+ echo this-is-file2 > dict_cidr_file2
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:dict_cidr_file.map \
+ read src_rhs_is_file <dict_cidr_file.in 2>&1 | \
+ sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_cidr_file.tmp
+ diff dict_cidr_file.ref dict_cidr_file.tmp
+ rm -f dict_cidr_file.tmp dict_cidr_file1 dict_cidr_file2
+
+miss_endif_cidr_test: dict_open miss_endif_cidr.map miss_endif_cidr.ref
+ echo get 1.2.3.5 | $(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:miss_endif_cidr.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_cidr.tmp
+ diff miss_endif_cidr.ref dict_cidr.tmp
+ rm -f dict_cidr.tmp
+
+miss_endif_pcre_test: dict_open miss_endif_re.map miss_endif_pcre.ref
+ echo get 1.2.3.5 | $(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:miss_endif_re.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre.tmp
+ diff miss_endif_pcre.ref dict_pcre.tmp
+ rm -f dict_pcre.tmp
+
+miss_endif_regexp_test: dict_open miss_endif_re.map miss_endif_regexp.ref
+ echo get 1.2.3.5 | $(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:miss_endif_re.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_regexp.tmp
+ diff miss_endif_regexp.ref dict_regexp.tmp
+ rm -f dict_regexp.tmp
+
+split_qnameval_test: split_qnameval update
+ $(SHLIB_ENV) ${VALGRIND} ./split_qnameval
+
dict_seq_test: dict_open testdb dict_seq.in dict_seq.ref
rm -f testdb.db testdb.dir testdb.pag
- $(SHLIB_ENV) ./dict_open hash:testdb create sync < dict_seq.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' > dict_seq.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open hash:testdb create sync < dict_seq.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' > dict_seq.tmp
diff dict_seq.ref dict_seq.tmp
rm -f testdb.db testdb.dir testdb.pag dict_seq.tmp
host_port_test: host_port host_port.in host_port.ref
- $(SHLIB_ENV) ./host_port <host_port.in >host_port.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./host_port <host_port.in >host_port.tmp 2>&1
diff host_port.ref host_port.tmp
rm -f host_port.tmp
attr_scan_plain_test: attr_print_plain attr_scan_plain attr_scan_plain.ref
- ($(SHLIB_ENV) ./attr_print_plain 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan_plain)) >attr_scan_plain.tmp 2>&1 3>&1
+ ($(SHLIB_ENV) ${VALGRIND} ./attr_print_plain 2>&3 | (sleep 1; $(SHLIB_ENV) ./attr_scan_plain)) >attr_scan_plain.tmp 2>&1 3>&1
diff attr_scan_plain.ref attr_scan_plain.tmp
rm -f attr_scan_plain.tmp
htable_test: htable /usr/share/dict/words
- $(SHLIB_ENV) ./htable < /usr/share/dict/words
+ $(SHLIB_ENV) ${VALGRIND} ./htable < /usr/share/dict/words
hex_code_test: hex_code
- $(SHLIB_ENV) ./hex_code
+ $(SHLIB_ENV) ${VALGRIND} ./hex_code
timecmp_test: timecmp
- $(SHLIB_ENV) ./timecmp
+ $(SHLIB_ENV) ${VALGRIND} ./timecmp
myaddrinfo_test: myaddrinfo myaddrinfo.ref myaddrinfo.ref2
- $(SHLIB_ENV) ./myaddrinfo all belly.porcupine.org 168.100.189.2 >myaddrinfo.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo all belly.porcupine.org 168.100.189.2 >myaddrinfo.tmp 2>&1
diff myaddrinfo.ref myaddrinfo.tmp
rm -f myaddrinfo.tmp
- $(SHLIB_ENV) ./myaddrinfo all null.porcupine.org 10.0.0.0 >myaddrinfo.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo all null.porcupine.org 10.0.0.0 >myaddrinfo.tmp 2>&1
diff myaddrinfo.ref2 myaddrinfo.tmp
rm -f myaddrinfo.tmp
myaddrinfo4_test: myaddrinfo4 myaddrinfo4.ref myaddrinfo4.ref2
- $(SHLIB_ENV) ./myaddrinfo4 all belly.porcupine.org 168.100.189.2 >myaddrinfo4.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo4 all belly.porcupine.org 168.100.189.2 >myaddrinfo4.tmp 2>&1
diff myaddrinfo4.ref myaddrinfo4.tmp
- $(SHLIB_ENV) ./myaddrinfo4 all null.porcupine.org 10.0.0.0 >myaddrinfo4.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./myaddrinfo4 all null.porcupine.org 10.0.0.0 >myaddrinfo4.tmp 2>&1
diff myaddrinfo4.ref2 myaddrinfo4.tmp
rm -f myaddrinfo4.tmp
format_tv_test: format_tv format_tv.in format_tv.ref
- $(SHLIB_ENV) ./format_tv <format_tv.in >format_tv.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./format_tv <format_tv.in >format_tv.tmp
diff format_tv.ref format_tv.tmp
rm -f format_tv.tmp
ip_match_test: ip_match ip_match.in ip_match.ref
- $(SHLIB_ENV) ./ip_match <ip_match.in >ip_match.tmp
+ $(SHLIB_ENV) ${VALGRIND} ./ip_match <ip_match.in >ip_match.tmp
diff ip_match.ref ip_match.tmp
rm -f ip_match.tmp
@@ -663,113 +741,183 @@ name_mask_tests: name_mask_test0 name_mask_test1 name_mask_test2 \
name_mask_test7 name_mask_test8 name_mask_test9
name_mask_test0: name_mask name_mask.in name_mask.ref0
- $(SHLIB_ENV) ./name_mask IGNORE IGNORE < name_mask.in > name_mask.tmp 2>&0
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask IGNORE IGNORE < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref0 name_mask.tmp
rm -f name_mask.tmp
name_mask_test1: name_mask name_mask.in name_mask.ref1
- $(SHLIB_ENV) ./name_mask NUMBER,WARN NUMBER < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN NUMBER < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref1 name_mask.tmp
rm -f name_mask.tmp
name_mask_test2: name_mask name_mask.in name_mask.ref2
- $(SHLIB_ENV) ./name_mask NUMBER,RETURN NUMBER < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,RETURN NUMBER < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref2 name_mask.tmp
rm -f name_mask.tmp
name_mask_test3: name_mask name_mask.in name_mask.ref3
- $(SHLIB_ENV) ./name_mask WARN NUMBER < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask WARN NUMBER < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref3 name_mask.tmp
rm -f name_mask.tmp
name_mask_test4: name_mask name_mask.in name_mask.ref4
- $(SHLIB_ENV) ./name_mask RETURN NUMBER < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask RETURN NUMBER < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref4 name_mask.tmp
rm -f name_mask.tmp
name_mask_test5: name_mask name_mask.in name_mask.ref5
- $(SHLIB_ENV) ./name_mask NUMBER,WARN RETURN < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN RETURN < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref5 name_mask.tmp
rm -f name_mask.tmp
name_mask_test6: name_mask name_mask.in name_mask.ref6
- $(SHLIB_ENV) ./name_mask NUMBER,WARN WARN < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN WARN < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref6 name_mask.tmp
rm -f name_mask.tmp
name_mask_test7: name_mask name_mask.in name_mask.ref7
- $(SHLIB_ENV) ./name_mask NUMBER,WARN IGNORE < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN IGNORE < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref7 name_mask.tmp
rm -f name_mask.tmp
name_mask_test8: name_mask name_mask.in name_mask.ref8
- $(SHLIB_ENV) ./name_mask NUMBER,WARN NUMBER,COMMA < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN NUMBER,COMMA < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref8 name_mask.tmp
rm -f name_mask.tmp
name_mask_test9: name_mask name_mask.in name_mask.ref9
- $(SHLIB_ENV) ./name_mask NUMBER,WARN NUMBER,PIPE < name_mask.in > name_mask.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN NUMBER,PIPE < name_mask.in > name_mask.tmp 2>&1
diff name_mask.ref9 name_mask.tmp
rm -f name_mask.tmp
+byte_mask_tests: byte_mask_test0 byte_mask_test1 byte_mask_test2
+
+byte_mask_test0: byte_mask byte_mask.in byte_mask.ref0
+ while read line; do \
+ echo "$$line" | $(SHLIB_ENV) ${VALGRIND} ./byte_mask IGNORE IGNORE; \
+ done < byte_mask.in > byte_mask.tmp 2>&1
+ diff byte_mask.ref0 byte_mask.tmp
+ rm -f byte_mask.tmp
+
+byte_mask_test1: byte_mask byte_mask.in byte_mask.ref1
+ while read line; do \
+ echo "$$line" | $(SHLIB_ENV) ${VALGRIND} ./byte_mask WARN WARN; \
+ done < byte_mask.in > byte_mask.tmp 2>&1
+ diff byte_mask.ref1 byte_mask.tmp
+ rm -f byte_mask.tmp
+
+byte_mask_test2: byte_mask byte_mask.in byte_mask.ref2
+ -while read line; do \
+ echo "$$line" | $(SHLIB_ENV) ${VALGRIND} ./byte_mask FATAL FATAL; \
+ done < byte_mask.in > byte_mask.tmp 2>&1
+ diff byte_mask.ref2 byte_mask.tmp
+ rm -f byte_mask.tmp
+
base32_code_test: base32_code
- $(SHLIB_ENV) ./base32_code
+ $(SHLIB_ENV) ${VALGRIND} ./base32_code
-dict_thash_test: ../postmap/postmap dict_thash.map
- $(SHLIB_ENV) ../postmap/postmap -s texthash:dict_thash.map | sort >dict_thash.tmp 2>&1
- tr '[A-Z]' '[a-z]' <dict_thash.map | sort | diff -b dict_thash.tmp -
+dict_thash_test: ../postmap/postmap dict_thash.map dict_thash.in dict_thash.ref
+ $(SHLIB_ENV) ../postmap/postmap -fs texthash:dict_thash.map 2>&1 | \
+ LANG=C sort | diff dict_thash.map -
+ $(SHLIB_ENV) ../postmap/postmap -fs texthash:dict_thash.in >dict_thash.tmp 2>&1
+ diff dict_thash.ref dict_thash.tmp
rm -f dict_thash.tmp
surrogate_test: dict_open surrogate.ref
cp /dev/null surrogate.tmp
- echo get foo|$(SHLIB_ENV) ./dict_open cidr:/xx write >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open cidr:/xx read >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open pcre:/xx write >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open pcre:/xx read >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open regexp:/xx write >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open regexp:/xx read >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open unix:xx write >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open unix:xx read >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open texthash:/xx write >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open texthash:/xx read >>surrogate.tmp 2>&1
- echo get foo|$(SHLIB_ENV) ./dict_open hash:/xx read >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:/xx write >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:/xx read >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:/xx write >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:/xx read >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:/xx write >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:/xx read >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open unix:xx write >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open unix:xx read >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open texthash:/xx write >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open texthash:/xx read >>surrogate.tmp 2>&1
+ echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open hash:/xx read >>surrogate.tmp 2>&1
diff surrogate.ref surrogate.tmp
rm -f surrogate.tmp
dict_static_test: dict_open dict_static.ref
(set -e; \
(echo get foo; echo get bar) | $(SHLIB_ENV) \
- ./dict_open static:fooxx read; \
- $(SHLIB_ENV) ./dict_open static:'{ foo xx ' read </dev/null; \
- $(SHLIB_ENV) ./dict_open static:'{ foo xx }x' read </dev/null; \
+ ${VALGRIND} ./dict_open static:fooxx read; \
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open static:'{ foo xx ' read </dev/null; \
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open static:'{ foo xx }x' read </dev/null; \
(echo get foo; echo get bar) | $(SHLIB_ENV) \
- ./dict_open static:'{ foo xx }' read; \
+ ${VALGRIND} ./dict_open static:'{ foo xx }' read; \
) >dict_static.tmp 2>&1
diff dict_static.ref dict_static.tmp
rm -f dict_static.tmp
+dict_static_file_test: dict_open dict_static_file.ref
+ echo this-is-file1 > dict_static_file1
+ (set -e; \
+ echo get foo | $(SHLIB_ENV) \
+ ${VALGRIND} ./dict_open static:fooxx read src_rhs_is_file; \
+ (echo get file1; echo get file2) | $(SHLIB_ENV) \
+ ${VALGRIND} ./dict_open static:'{ dict_static_file1 }' read src_rhs_is_file; \
+ ) >dict_static_file.tmp 2>&1
+ diff dict_static_file.ref dict_static_file.tmp
+ rm -f dict_static_file.tmp dict_static_file1
+
+dict_random_test: dict_open dict_random.ref
+ (set -e; \
+ (echo get foo; echo get bar) | $(SHLIB_ENV) \
+ ${VALGRIND} ./dict_open randmap:'{123 123}' read; \
+ echo get foo | $(SHLIB_ENV) ${VALGRIND} ./dict_open randmap:123 read; \
+ echo get foo | $(SHLIB_ENV) ${VALGRIND} ./dict_open randmap:'{ 123 ' read; \
+ echo get foo | $(SHLIB_ENV) ${VALGRIND} ./dict_open randmap:'{ 123 }x' read; \
+ ) >dict_random.tmp 2>&1
+ diff dict_random.ref dict_random.tmp
+ rm -f dict_random.tmp
+
+dict_random_file_test: dict_open dict_random_file.ref
+ echo this-is-file1 > dict_random_file1
+ (set -e; \
+ echo get foo | $(SHLIB_ENV) \
+ ${VALGRIND} ./dict_open randmap:'{fooxx}' read src_rhs_is_file; \
+ (echo get foo; echo get bar) | $(SHLIB_ENV) \
+ ${VALGRIND} ./dict_open randmap:'{ dict_random_file1 }' read src_rhs_is_file; \
+ ) >dict_random_file.tmp 2>&1
+ diff dict_random_file.ref dict_random_file.tmp
+ rm -f dict_random_file.tmp dict_random_file1
+
dict_inline_test: dict_open dict_inline.ref
(set -e; \
- $(SHLIB_ENV) ./dict_open inline:'{ }' read </dev/null; \
- $(SHLIB_ENV) ./dict_open inline:'{ foo = xx }' read </dev/null; \
- $(SHLIB_ENV) ./dict_open inline:'{ foo=xx }x' read </dev/null; \
- $(SHLIB_ENV) ./dict_open inline:'{ foo=xx x' read </dev/null; \
- $(SHLIB_ENV) ./dict_open inline:'{ foo=xx {x=y}x}' read </dev/null; \
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ }' read </dev/null; \
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ foo = xx }' read </dev/null; \
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ foo=xx }x' read </dev/null; \
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ foo=xx x' read </dev/null; \
+ $(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ foo=xx {x=y}x}' read </dev/null; \
(echo get foo; echo get bar; echo get baz) | $(SHLIB_ENV) \
- ./dict_open inline:'{ foo=XX, { bAr = lotsa stuff }}' read fold_fix; \
+ ${VALGRIND} ./dict_open inline:'{ foo=XX, { bAr = lotsa stuff }}' read fold_fix; \
(echo get foo; echo get bar; echo get baz) | $(SHLIB_ENV) \
- ./dict_open inline:'{ foo=XX, { bAr = lotsa stuff }}' read 'fold_fix,utf8_request'; \
+ ${VALGRIND} ./dict_open inline:'{ foo=XX, { bAr = lotsa stuff }}' read 'fold_fix,utf8_request'; \
) >dict_inline.tmp 2>&1
diff dict_inline.ref dict_inline.tmp
rm -f dict_inline.tmp
+dict_inline_file_test: dict_open dict_inline_file.ref
+ (set -e; \
+ echo get foo | $(SHLIB_ENV) ${VALGRIND} \
+ ./dict_open inline:'{ foo=xx, bar=yy }' read src_rhs_is_file; \
+ echo this-is-file1 > dict_inline_file1; \
+ echo this-is-file2 > dict_inline_file2; \
+ (echo get file1; echo get file2; echo get file3) | $(SHLIB_ENV) \
+ ${VALGRIND} ./dict_open inline:'{ file1=dict_inline_file1, file2=dict_inline_file2}' read src_rhs_is_file; \
+ ) >dict_inline_file.tmp 2>&1
+ diff dict_inline_file.ref dict_inline_file.tmp
+ rm -f dict_inline_file.tmp dict_inline_file1 dict_inline_file2
+
midna_domain_test: midna_domain midna_domain_test.in midna_domain_test.ref
- $(SHLIB_ENV) ./midna_domain <midna_domain_test.in >midna_domain_test.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./midna_domain <midna_domain_test.in >midna_domain_test.tmp 2>&1
diff midna_domain_test.ref midna_domain_test.tmp
rm -f midna_domain_test.tmp
casefold_test: casefold casefold_test.in casefold_test.ref
- $(SHLIB_ENV) ./casefold <casefold_test.in >casefold_test.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./casefold <casefold_test.in >casefold_test.tmp 2>&1
diff casefold_test.ref casefold_test.tmp
rm -f casefold_test.tmp
@@ -780,17 +928,42 @@ dict_utf8_test: dict_open dict_utf8_test.in dict_utf8_test.ref
strcasecmp_utf8_test: strcasecmp_utf8 strcasecmp_utf8_test.in \
strcasecmp_utf8_test.ref
- $(SHLIB_ENV) ./strcasecmp_utf8 <strcasecmp_utf8_test.in >strcasecmp_utf8_test.tmp 2>&1
+ $(SHLIB_ENV) ${VALGRIND} ./strcasecmp_utf8 <strcasecmp_utf8_test.in >strcasecmp_utf8_test.tmp 2>&1
diff strcasecmp_utf8_test.ref strcasecmp_utf8_test.tmp
rm -f strcasecmp_utf8_test.tmp
+vbuf_print_test: vbuf_print vbuf_print_test.in vbuf_print_test.ref
+ $(SHLIB_ENV) ${VALGRIND} ./vbuf_print <vbuf_print_test.in >vbuf_print_test.tmp 2>&1
+ diff vbuf_print_test.ref vbuf_print_test.tmp
+ rm -f vbuf_print_test.tmp
+
+dict_union_test: dict_open dict_union_test.in dict_union_test.ref
+ $(SHLIB_ENV) sh -x dict_union_test.in >dict_union_test.tmp 2>&1
+ diff dict_union_test.ref dict_union_test.tmp
+ rm -f dict_union_test.tmp
+
+dict_pipe_test: dict_open dict_pipe_test.in dict_pipe_test.ref
+ $(SHLIB_ENV) sh -x dict_pipe_test.in >dict_pipe_test.tmp 2>&1
+ diff dict_pipe_test.ref dict_pipe_test.tmp
+ rm -f dict_pipe_test.tmp
+
+vstring_test: dict_open vstring vstring_test.ref
+ $(SHLIB_ENV) ./vstring one two three >vstring_test.tmp 2>&1
+ diff vstring_test.ref vstring_test.tmp
+ rm -f vstring_test.tmp
+
+vstream_test: dict_open vstream vstream_test.in vstream_test.ref
+ $(SHLIB_ENV) ./vstream <vstream_test.in >vstream_test.tmp 2>&1
+ diff vstream_test.ref vstream_test.tmp
+ rm -f vstream_test.tmp
+
depend: $(MAKES)
(sed '1,/^# do not edit/!d' Makefile.in; \
set -e; for i in [a-z][a-z0-9]*.c; do \
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -823,6 +996,32 @@ argv.o: argv.h
argv.o: msg.h
argv.o: mymalloc.h
argv.o: sys_defs.h
+argv_attr_print.o: argv.h
+argv_attr_print.o: argv_attr.h
+argv_attr_print.o: argv_attr_print.c
+argv_attr_print.o: attr.h
+argv_attr_print.o: check_arg.h
+argv_attr_print.o: htable.h
+argv_attr_print.o: msg.h
+argv_attr_print.o: mymalloc.h
+argv_attr_print.o: nvtable.h
+argv_attr_print.o: sys_defs.h
+argv_attr_print.o: vbuf.h
+argv_attr_print.o: vstream.h
+argv_attr_print.o: vstring.h
+argv_attr_scan.o: argv.h
+argv_attr_scan.o: argv_attr.h
+argv_attr_scan.o: argv_attr_scan.c
+argv_attr_scan.o: attr.h
+argv_attr_scan.o: check_arg.h
+argv_attr_scan.o: htable.h
+argv_attr_scan.o: msg.h
+argv_attr_scan.o: mymalloc.h
+argv_attr_scan.o: nvtable.h
+argv_attr_scan.o: sys_defs.h
+argv_attr_scan.o: vbuf.h
+argv_attr_scan.o: vstream.h
+argv_attr_scan.o: vstring.h
argv_split.o: argv.h
argv_split.o: argv_split.c
argv_split.o: check_arg.h
@@ -974,6 +1173,15 @@ binhash.o: binhash.h
binhash.o: msg.h
binhash.o: mymalloc.h
binhash.o: sys_defs.h
+byte_mask.o: byte_mask.c
+byte_mask.o: byte_mask.h
+byte_mask.o: check_arg.h
+byte_mask.o: msg.h
+byte_mask.o: mymalloc.h
+byte_mask.o: stringops.h
+byte_mask.o: sys_defs.h
+byte_mask.o: vbuf.h
+byte_mask.o: vstring.h
casefold.o: casefold.c
casefold.o: check_arg.h
casefold.o: msg.h
@@ -1088,6 +1296,7 @@ dict_cidr.o: dict.h
dict_cidr.o: dict_cidr.c
dict_cidr.o: dict_cidr.h
dict_cidr.o: msg.h
+dict_cidr.o: mvect.h
dict_cidr.o: myaddrinfo.h
dict_cidr.o: myflock.h
dict_cidr.o: mymalloc.h
@@ -1152,6 +1361,18 @@ dict_fail.o: sys_defs.h
dict_fail.o: vbuf.h
dict_fail.o: vstream.h
dict_fail.o: vstring.h
+dict_file.o: argv.h
+dict_file.o: base64_code.h
+dict_file.o: check_arg.h
+dict_file.o: dict.h
+dict_file.o: dict_file.c
+dict_file.o: msg.h
+dict_file.o: myflock.h
+dict_file.o: mymalloc.h
+dict_file.o: sys_defs.h
+dict_file.o: vbuf.h
+dict_file.o: vstream.h
+dict_file.o: vstring.h
dict_ht.o: argv.h
dict_ht.o: check_arg.h
dict_ht.o: dict.h
@@ -1269,6 +1490,7 @@ dict_pcre.o: dict_pcre.c
dict_pcre.o: dict_pcre.h
dict_pcre.o: mac_parse.h
dict_pcre.o: msg.h
+dict_pcre.o: mvect.h
dict_pcre.o: myflock.h
dict_pcre.o: mymalloc.h
dict_pcre.o: readlline.h
@@ -1314,6 +1536,7 @@ dict_regexp.o: dict_regexp.c
dict_regexp.o: dict_regexp.h
dict_regexp.o: mac_parse.h
dict_regexp.o: msg.h
+dict_regexp.o: mvect.h
dict_regexp.o: myflock.h
dict_regexp.o: mymalloc.h
dict_regexp.o: readlline.h
@@ -1726,9 +1949,18 @@ load_file.o: vbuf.h
load_file.o: vstream.h
load_file.o: warn_stat.h
load_lib.o: load_lib.c
-load_lib.o: load_lib.h
-load_lib.o: msg.h
load_lib.o: sys_defs.h
+logwriter.o: check_arg.h
+logwriter.o: iostuff.h
+logwriter.o: logwriter.c
+logwriter.o: logwriter.h
+logwriter.o: msg.h
+logwriter.o: mymalloc.h
+logwriter.o: safe_open.h
+logwriter.o: sys_defs.h
+logwriter.o: vbuf.h
+logwriter.o: vstream.h
+logwriter.o: vstring.h
lowercase.o: check_arg.h
lowercase.o: lowercase.c
lowercase.o: stringops.h
@@ -1809,6 +2041,7 @@ midna_domain.o: midna_domain.c
midna_domain.o: midna_domain.h
midna_domain.o: msg.h
midna_domain.o: mymalloc.h
+midna_domain.o: name_mask.h
midna_domain.o: stringops.h
midna_domain.o: sys_defs.h
midna_domain.o: valid_hostname.h
@@ -1818,6 +2051,20 @@ msg.o: msg.c
msg.o: msg.h
msg.o: msg_output.h
msg.o: sys_defs.h
+msg_logger.o: check_arg.h
+msg_logger.o: connect.h
+msg_logger.o: iostuff.h
+msg_logger.o: logwriter.h
+msg_logger.o: msg.h
+msg_logger.o: msg_logger.c
+msg_logger.o: msg_logger.h
+msg_logger.o: msg_output.h
+msg_logger.o: mymalloc.h
+msg_logger.o: safe.h
+msg_logger.o: sys_defs.h
+msg_logger.o: vbuf.h
+msg_logger.o: vstream.h
+msg_logger.o: vstring.h
msg_output.o: check_arg.h
msg_output.o: msg_output.c
msg_output.o: msg_output.h
@@ -1841,6 +2088,7 @@ msg_syslog.o: msg.h
msg_syslog.o: msg_output.h
msg_syslog.o: msg_syslog.c
msg_syslog.o: msg_syslog.h
+msg_syslog.o: mymalloc.h
msg_syslog.o: safe.h
msg_syslog.o: stringops.h
msg_syslog.o: sys_defs.h
@@ -2125,6 +2373,13 @@ split_nameval.o: stringops.h
split_nameval.o: sys_defs.h
split_nameval.o: vbuf.h
split_nameval.o: vstring.h
+split_qnameval.o: check_arg.h
+split_qnameval.o: msg.h
+split_qnameval.o: split_qnameval.c
+split_qnameval.o: stringops.h
+split_qnameval.o: sys_defs.h
+split_qnameval.o: vbuf.h
+split_qnameval.o: vstring.h
stat_as.o: msg.h
stat_as.o: set_eugid.h
stat_as.o: stat_as.c
@@ -2225,6 +2480,17 @@ unix_connect.o: sane_connect.h
unix_connect.o: sys_defs.h
unix_connect.o: timed_connect.h
unix_connect.o: unix_connect.c
+unix_dgram_connect.o: connect.h
+unix_dgram_connect.o: iostuff.h
+unix_dgram_connect.o: msg.h
+unix_dgram_connect.o: sys_defs.h
+unix_dgram_connect.o: unix_dgram_connect.c
+unix_dgram_listen.o: htable.h
+unix_dgram_listen.o: iostuff.h
+unix_dgram_listen.o: listen.h
+unix_dgram_listen.o: msg.h
+unix_dgram_listen.o: sys_defs.h
+unix_dgram_listen.o: unix_dgram_listen.c
unix_listen.o: htable.h
unix_listen.o: iostuff.h
unix_listen.o: listen.h
@@ -2298,6 +2564,7 @@ vbuf.o: vbuf.c
vbuf.o: vbuf.h
vbuf_print.o: check_arg.h
vbuf_print.o: msg.h
+vbuf_print.o: mymalloc.h
vbuf_print.o: sys_defs.h
vbuf_print.o: vbuf.h
vbuf_print.o: vbuf_print.c
diff --git a/external/ibm-public/postfix/dist/src/util/argv_attr.h b/external/ibm-public/postfix/dist/src/util/argv_attr.h
new file mode 100644
index 00000000000..071c6ba59b9
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/argv_attr.h
@@ -0,0 +1,45 @@
+/* $NetBSD: argv_attr.h,v 1.1.1.1 2020/03/18 18:59:37 christos Exp $ */
+
+#ifndef _ARGV_ATTR_H_INCLUDED_
+#define _ARGV_ATTR_H_INCLUDED_
+
+/*++
+/* NAME
+/* argv_attr 3h
+/* SUMMARY
+/* argv serialization/deserialization
+/* SYNOPSIS
+/* #include <argv_attr.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * Utility library.
+ */
+#include <argv.h>
+#include <attr.h>
+#include <check_arg.h>
+#include <vstream.h>
+
+ /*
+ * External API.
+ */
+#define ARGV_ATTR_SIZE "argv_size"
+#define ARGV_ATTR_VALUE "argv_value"
+#define ARGV_ATTR_MAX 1024
+
+extern int argv_attr_print(ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *);
+extern int argv_attr_scan(ATTR_SCAN_MASTER_FN, VSTREAM *, int, void *);
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/util/argv_attr_print.c b/external/ibm-public/postfix/dist/src/util/argv_attr_print.c
new file mode 100644
index 00000000000..f9a25bec9eb
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/argv_attr_print.c
@@ -0,0 +1,75 @@
+/* $NetBSD: argv_attr_print.c,v 1.1.1.1 2020/03/18 18:59:37 christos Exp $ */
+
+/*++
+/* NAME
+/* argv_attr_print
+/* SUMMARY
+/* write ARGV to stream
+/* SYNOPSIS
+/* #include <argv_attr.h>
+/*
+/* int argv_attr_print(print_fn, stream, flags, ptr)
+/* ATTR_PRINT_MASTER_FN print_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/* DESCRIPTION
+/* argv_attr_print() writes an ARGV to the named stream using
+/* the specified attribute print routine. argv_attr_print() is meant
+/* to be passed as a call-back to attr_print(), thusly:
+/*
+/* ... SEND_ATTR_FUNC(argv_attr_print, (void *) argv), ...
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/*
+/* The result value is zero in case of success, non-zero
+/* otherwise.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+
+ /*
+ * Utility library.
+ */
+#include <argv.h>
+#include <argv_attr.h>
+#include <attr.h>
+#include <vstream.h>
+#include <msg.h>
+
+/* argv_attr_print - write ARGV to stream */
+
+int argv_attr_print(ATTR_PRINT_MASTER_FN print_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ ARGV *argv = (ARGV *) ptr;
+ int n;
+ int ret;
+ int argc = argv ? argv->argc : 0;
+
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_INT(ARGV_ATTR_SIZE, argc),
+ ATTR_TYPE_END);
+ if (msg_verbose)
+ msg_info("argv_attr_print count=%d", argc);
+ for (n = 0; ret == 0 && n < argc; n++)
+ ret = print_fn(fp, flags | ATTR_FLAG_MORE,
+ SEND_ATTR_STR(ARGV_ATTR_VALUE, argv->argv[n]),
+ ATTR_TYPE_END);
+ if (msg_verbose)
+ msg_info("argv_attr_print ret=%d", ret);
+ /* Do not flush the stream. */
+ return (ret);
+}
diff --git a/external/ibm-public/postfix/dist/src/util/argv_attr_scan.c b/external/ibm-public/postfix/dist/src/util/argv_attr_scan.c
new file mode 100644
index 00000000000..c6170a425a8
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/argv_attr_scan.c
@@ -0,0 +1,95 @@
+/* $NetBSD: argv_attr_scan.c,v 1.1.1.1 2020/03/18 18:59:37 christos Exp $ */
+
+/*++
+/* NAME
+/* argv_attr_scan
+/* SUMMARY
+/* read ARGV from stream
+/* SYNOPSIS
+/* #include <argv_attr.h>
+/*
+/* int argv_attr_scan(scan_fn, stream, flags, ptr)
+/* ATTR_SCAN_MASTER_FN scan_fn;
+/* VSTREAM *stream;
+/* int flags;
+/* void *ptr;
+/* DESCRIPTION
+/* argv_attr_scan() creates an ARGV and reads its contents
+/* from the named stream using the specified attribute scan
+/* routine. argv_attr_scan() is meant to be passed as a call-back
+/* to attr_scan(), thusly:
+/*
+/* ARGV *argv = 0;
+/* ...
+/* ... RECV_ATTR_FUNC(argv_attr_scan, (void *) &argv), ...
+/* ...
+/* if (argv)
+/* argv_free(argv);
+/* DIAGNOSTICS
+/* Fatal: out of memory.
+/*
+/* In case of error, this function returns non-zero and creates
+/* an ARGV null pointer.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+
+ /*
+ * Utility library.
+ */
+#include <argv.h>
+#include <argv_attr.h>
+#include <attr.h>
+#include <msg.h>
+#include <vstream.h>
+#include <vstring.h>
+
+/* argv_attr_scan - write ARGV to stream */
+
+int argv_attr_scan(ATTR_PRINT_MASTER_FN scan_fn, VSTREAM *fp,
+ int flags, void *ptr)
+{
+ ARGV *argv = 0;
+ int size;
+ int ret;
+
+ if ((ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_INT(ARGV_ATTR_SIZE, &size),
+ ATTR_TYPE_END)) == 1) {
+ if (msg_verbose)
+ msg_info("argv_attr_scan count=%d", size);
+ if (size < 0 || size > ARGV_ATTR_MAX) {
+ msg_warn("invalid size %d from %s while reading ARGV",
+ size, VSTREAM_PATH(fp));
+ ret = -1;
+ } else if (size > 0) {
+ VSTRING *buffer = vstring_alloc(100);
+
+ argv = argv_alloc(size);
+ while (ret == 1 && size-- > 0) {
+ if ((ret = scan_fn(fp, flags | ATTR_FLAG_MORE,
+ RECV_ATTR_STR(ARGV_ATTR_VALUE, buffer),
+ ATTR_TYPE_END)) == 1)
+ argv_add(argv, vstring_str(buffer), ARGV_END);
+ }
+ argv_terminate(argv);
+ vstring_free(buffer);
+ }
+ }
+ *(ARGV **) ptr = argv;
+ if (msg_verbose)
+ msg_info("argv_attr_scan ret=%d", ret);
+ return (ret);
+}
diff --git a/external/ibm-public/postfix/dist/src/util/byte_mask.c b/external/ibm-public/postfix/dist/src/util/byte_mask.c
new file mode 100644
index 00000000000..087f9fd000f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/byte_mask.c
@@ -0,0 +1,308 @@
+/* $NetBSD: byte_mask.c,v 1.1.1.1 2020/03/18 18:59:37 christos Exp $ */
+
+/*++
+/* NAME
+/* byte_mask 3
+/* SUMMARY
+/* map byte sequence to bit mask
+/* SYNOPSIS
+/* #include <byte_mask.h>
+/*
+/* typedef struct {
+/* .in +4
+/* int byte_val;
+/* int mask;
+/* .in -4
+/* } BYTE_MASK;
+/*
+/* int byte_mask(
+/* const char *context,
+/* const BYTE_MASK *table,
+/* const char *bytes);
+/*
+/* const char *str_byte_mask(
+/* const char *context,
+/* const BYTE_MASK *table,
+/* int mask);
+/*
+/* int byte_mask_opt(
+/* const char *context;
+/* const BYTE_MASK *table,
+/* const char *bytes,
+/* int flags);
+/*
+/* const char *str_byte_mask_opt(
+/* VSTRING *buf,
+/* const char *context,
+/* const BYTE_MASK *table,
+/* int mask,
+/* int flags);
+/* DESCRIPTION
+/* byte_mask() takes a null-terminated \fItable\fR with (byte
+/* value, single-bit mask) pairs and computes the bit-wise OR
+/* of the masks that correspond to the byte values pointed to
+/* by the \fIbytes\fR argument.
+/*
+/* str_byte_mask() translates a bit mask into its equivalent
+/* bytes. The result is written to a static buffer that is
+/* overwritten upon each call.
+/*
+/* byte_mask_opt() and str_byte_mask_opt() are extended versions
+/* with additional fine control.
+/*
+/* Arguments:
+/* .IP buf
+/* Null pointer or pointer to buffer storage.
+/* .IP context
+/* What kind of byte values and bit masks are being manipulated,
+/* reported in error messages. Typically, this would be the
+/* name of a user-configurable parameter or command-line
+/* attribute.
+/* .IP table
+/* Table with (byte value, single-bit mask) pairs.
+/* .IP bytes
+/* A null-terminated string that is to be converted into a bit
+/* mask.
+/* .IP mask
+/* A bit mask that is to be converted into null-terminated
+/* string.
+/* .IP flags
+/* Bit-wise OR of one or more of the following. Where features
+/* would have conflicting results (e.g., FATAL versus IGNORE),
+/* the feature that takes precedence is described first.
+/*
+/* When converting from string to mask, at least one of the
+/* following must be specified: BYTE_MASK_FATAL, BYTE_MASK_RETURN,
+/* BYTE_MASK_WARN or BYTE_MASK_IGNORE.
+/*
+/* When converting from mask to string, at least one of the
+/* following must be specified: BYTE_MASK_FATAL, BYTE_MASK_RETURN,
+/* BYTE_MASK_WARN or BYTE_MASK_IGNORE.
+/* .RS
+/* .IP BYTE_MASK_FATAL
+/* Require that all values in \fIbytes\fR exist in \fItable\fR,
+/* and require that all bits listed in \fImask\fR exist in
+/* \fItable\fR. Terminate with a fatal run-time error if this
+/* condition is not met. This feature is enabled by default
+/* when calling byte_mask() or str_name_mask().
+/* .IP BYTE_MASK_RETURN
+/* Require that all values in \fIbytes\fR exist in \fItable\fR,
+/* and require that all bits listed in \fImask\fR exist in
+/* \fItable\fR. Log a warning, and return 0 (byte_mask()) or
+/* a null pointer (str_byte_mask()) if this condition is not
+/* met. This feature is not enabled by default when calling
+/* byte_mask() or str_name_mask().
+/* .IP BYTE_MASK_WARN
+/* Require that all values in \fIbytes\fR exist in \fItable\fR,
+/* and require that all bits listed in \fImask\fR exist in
+/* \fItable\fR. Log a warning if this condition is not met,
+/* continue processing, and return all valid bits or bytes.
+/* This feature is not enabled by default when calling byte_mask()
+/* or str_byte_mask().
+/* .IP BYTE_MASK_IGNORE
+/* Silently ignore values in \fIbytes\fR that don't exist in
+/* \fItable\fR, and silently ignore bits listed in \fImask\fR
+/* that don't exist in \fItable\fR. This feature is not enabled
+/* by default when calling byte_mask() or str_byte_mask().
+/* .IP BYTE_MASK_ANY_CASE
+/* Enable case-insensitive matching. This feature is not
+/* enabled by default when calling byte_mask(); it has no
+/* effect with str_byte_mask().
+/* .RE
+/* The value BYTE_MASK_NONE explicitly requests no features,
+/* and BYTE_MASK_DEFAULT enables the default options.
+/* DIAGNOSTICS
+/* Fatal: the \fIbytes\fR argument specifies a name not found in
+/* \fItable\fR, or the \fImask\fR specifies a bit not found in
+/* \fItable\fR.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* HISTORY
+/* This code is a clone of Postfix name_mask(3).
+/* AUTHOR(S)
+/* Wietse Venema
+/* IBM T.J. Watson Research
+/* P.O. Box 704
+/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+/* System library. */
+
+#include <sys_defs.h>
+#include <string.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <ctype.h>
+
+/* Utility library. */
+
+#include <msg.h>
+#include <mymalloc.h>
+#include <stringops.h>
+#include <byte_mask.h>
+#include <vstring.h>
+
+#define STR(x) vstring_str(x)
+
+/* byte_mask_opt - compute mask corresponding to byte string */
+
+int byte_mask_opt(const char *context, const BYTE_MASK *table,
+ const char *bytes, int flags)
+{
+ const char myname[] = "byte_mask";
+ const char *bp;
+ int result = 0;
+ const BYTE_MASK *np;
+
+ if ((flags & BYTE_MASK_REQUIRED) == 0)
+ msg_panic("%s: missing BYTE_MASK_FATAL/RETURN/WARN/IGNORE flag",
+ myname);
+
+ /*
+ * Iterate over bytes string, and look up each byte in the table. If the
+ * byte is found, merge its mask with the result.
+ */
+ for (bp = bytes; *bp; bp++) {
+ int byte_val = *(const unsigned char *) bp;
+
+ for (np = table; /* void */ ; np++) {
+ if (np->byte_val == 0) {
+ if (flags & BYTE_MASK_FATAL) {
+ msg_fatal("unknown %s value \"%c\" in \"%s\"",
+ context, byte_val, bytes);
+ } else if (flags & BYTE_MASK_RETURN) {
+ msg_warn("unknown %s value \"%c\" in \"%s\"",
+ context, byte_val, bytes);
+ return (0);
+ } else if (flags & BYTE_MASK_WARN) {
+ msg_warn("unknown %s value \"%c\" in \"%s\"",
+ context, byte_val, bytes);
+ }
+ break;
+ }
+ if ((flags & BYTE_MASK_ANY_CASE) ?
+ (TOLOWER(byte_val) == TOLOWER(np->byte_val)) :
+ (byte_val == np->byte_val)) {
+ if (msg_verbose)
+ msg_info("%s: %c", myname, byte_val);
+ result |= np->mask;
+ break;
+ }
+ }
+ }
+ return (result);
+}
+
+/* str_byte_mask_opt - mask to string */
+
+const char *str_byte_mask_opt(VSTRING *buf, const char *context,
+ const BYTE_MASK *table,
+ int mask, int flags)
+{
+ const char myname[] = "byte_mask";
+ const BYTE_MASK *np;
+ static VSTRING *my_buf = 0;
+
+ if ((flags & STR_BYTE_MASK_REQUIRED) == 0)
+ msg_panic("%s: missing BYTE_MASK_FATAL/RETURN/WARN/IGNORE flag",
+ myname);
+
+ if (buf == 0) {
+ if (my_buf == 0)
+ my_buf = vstring_alloc(1);
+ buf = my_buf;
+ }
+ VSTRING_RESET(buf);
+
+ for (np = table; mask != 0; np++) {
+ if (np->byte_val == 0) {
+ if (flags & BYTE_MASK_FATAL) {
+ msg_fatal("%s: unknown %s bit in mask: 0x%x",
+ myname, context, mask);
+ } else if (flags & BYTE_MASK_RETURN) {
+ msg_warn("%s: unknown %s bit in mask: 0x%x",
+ myname, context, mask);
+ return (0);
+ } else if (flags & BYTE_MASK_WARN) {
+ msg_warn("%s: unknown %s bit in mask: 0x%x",
+ myname, context, mask);
+ }
+ break;
+ }
+ if (mask & np->mask) {
+ mask &= ~np->mask;
+ vstring_sprintf_append(buf, "%c", np->byte_val);
+ }
+ }
+ VSTRING_TERMINATE(buf);
+
+ return (STR(buf));
+}
+
+#ifdef TEST
+
+ /*
+ * Stand-alone test program.
+ */
+#include <stdlib.h>
+#include <vstream.h>
+#include <vstring_vstream.h>
+#include <name_mask.h>
+
+int main(int argc, char **argv)
+{
+ static const BYTE_MASK demo_table[] = {
+ '0', 1 << 0,
+ '1', 1 << 1,
+ '2', 1 << 2,
+ '3', 1 << 3,
+ 0, 0,
+ };
+ static const NAME_MASK feature_table[] = {
+ "DEFAULT", BYTE_MASK_DEFAULT,
+ "FATAL", BYTE_MASK_FATAL,
+ "ANY_CASE", BYTE_MASK_ANY_CASE,
+ "RETURN", BYTE_MASK_RETURN,
+ "WARN", BYTE_MASK_WARN,
+ "IGNORE", BYTE_MASK_IGNORE,
+ 0,
+ };
+ int in_feature_mask;
+ int out_feature_mask;
+ int demo_mask;
+ const char *demo_str;
+ VSTRING *out_buf = vstring_alloc(1);
+ VSTRING *in_buf = vstring_alloc(1);
+
+ if (argc != 3)
+ msg_fatal("usage: %s in-feature-mask out-feature-mask", argv[0]);
+ in_feature_mask = name_mask(argv[1], feature_table, argv[1]);
+ out_feature_mask = name_mask(argv[2], feature_table, argv[2]);
+ while (vstring_get_nonl(in_buf, VSTREAM_IN) != VSTREAM_EOF) {
+ demo_mask = byte_mask_opt("name", demo_table,
+ STR(in_buf), in_feature_mask);
+ demo_str = str_byte_mask_opt(out_buf, "mask", demo_table,
+ demo_mask, out_feature_mask);
+ vstream_printf("%s -> 0x%x -> %s\n",
+ STR(in_buf), demo_mask,
+ demo_str ? demo_str : "(null)");
+ demo_mask <<=1;
+ demo_str = str_byte_mask_opt(out_buf, "mask", demo_table,
+ demo_mask, out_feature_mask);
+ vstream_printf("0x%x -> %s\n",
+ demo_mask, demo_str ? demo_str : "(null)");
+ vstream_fflush(VSTREAM_OUT);
+ }
+ vstring_free(in_buf);
+ vstring_free(out_buf);
+ exit(0);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/util/byte_mask.h b/external/ibm-public/postfix/dist/src/util/byte_mask.h
new file mode 100644
index 00000000000..75aa02a6105
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/byte_mask.h
@@ -0,0 +1,66 @@
+/* $NetBSD: byte_mask.h,v 1.1.1.1 2020/03/18 18:59:37 christos Exp $ */
+
+#ifndef _BYTE_MASK_H_INCLUDED_
+#define _BYTE_MASK_H_INCLUDED_
+
+/*++
+/* NAME
+/* byte_mask 3h
+/* SUMMARY
+/* map names to bit mask
+/* SYNOPSIS
+/* #include <byte_mask.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * Utility library.
+ */
+#include <vstring.h>
+
+ /*
+ * External interface.
+ */
+typedef struct {
+ int byte_val;
+ int mask;
+} BYTE_MASK;
+
+#define BYTE_MASK_FATAL (1<<0)
+#define BYTE_MASK_ANY_CASE (1<<1)
+#define BYTE_MASK_RETURN (1<<2)
+#define BYTE_MASK_WARN (1<<6)
+#define BYTE_MASK_IGNORE (1<<7)
+
+#define BYTE_MASK_REQUIRED \
+ (BYTE_MASK_FATAL | BYTE_MASK_RETURN | BYTE_MASK_WARN | BYTE_MASK_IGNORE)
+#define STR_BYTE_MASK_REQUIRED (BYTE_MASK_REQUIRED)
+
+#define BYTE_MASK_NONE 0
+#define BYTE_MASK_DEFAULT (BYTE_MASK_FATAL)
+
+#define byte_mask(tag, table, str) \
+ byte_mask_opt((tag), (table), (str), BYTE_MASK_DEFAULT)
+#define str_byte_mask(tag, table, mask) \
+ str_byte_mask_opt(((VSTRING *) 0), (tag), (table), (mask), BYTE_MASK_DEFAULT)
+
+extern int byte_mask_opt(const char *, const BYTE_MASK *, const char *, int);
+extern const char *str_byte_mask_opt(VSTRING *, const char *, const BYTE_MASK *, int, int);
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* IBM T.J. Watson Research
+/* P.O. Box 704
+/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/util/byte_mask.in b/external/ibm-public/postfix/dist/src/util/byte_mask.in
new file mode 100644
index 00000000000..6d89c5ab27c
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/byte_mask.in
@@ -0,0 +1,7 @@
+0123
+0
+1
+2
+3
+1234
+abcd
diff --git a/external/ibm-public/postfix/dist/src/util/byte_mask.ref0 b/external/ibm-public/postfix/dist/src/util/byte_mask.ref0
new file mode 100644
index 00000000000..a6ab11be9f5
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/byte_mask.ref0
@@ -0,0 +1,14 @@
+0123 -> 0xf -> 0123
+0x1e -> 123
+0 -> 0x1 -> 0
+0x2 -> 1
+1 -> 0x2 -> 1
+0x4 -> 2
+2 -> 0x4 -> 2
+0x8 -> 3
+3 -> 0x8 -> 3
+0x10 ->
+1234 -> 0xe -> 123
+0x1c -> 23
+abcd -> 0x0 ->
+0x0 ->
diff --git a/external/ibm-public/postfix/dist/src/util/byte_mask.ref1 b/external/ibm-public/postfix/dist/src/util/byte_mask.ref1
new file mode 100644
index 00000000000..92e3f4f0ace
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/byte_mask.ref1
@@ -0,0 +1,22 @@
+unknown: warning: byte_mask: unknown mask bit in mask: 0x10
+0123 -> 0xf -> 0123
+0x1e -> 123
+0 -> 0x1 -> 0
+0x2 -> 1
+1 -> 0x2 -> 1
+0x4 -> 2
+2 -> 0x4 -> 2
+0x8 -> 3
+unknown: warning: byte_mask: unknown mask bit in mask: 0x10
+3 -> 0x8 -> 3
+0x10 ->
+unknown: warning: unknown name value "4" in "1234"
+unknown: warning: byte_mask: unknown mask bit in mask: 0x10
+1234 -> 0xe -> 123
+0x1c -> 23
+unknown: warning: unknown name value "a" in "abcd"
+unknown: warning: unknown name value "b" in "abcd"
+unknown: warning: unknown name value "c" in "abcd"
+unknown: warning: unknown name value "d" in "abcd"
+abcd -> 0x0 ->
+0x0 ->
diff --git a/external/ibm-public/postfix/dist/src/util/byte_mask.ref2 b/external/ibm-public/postfix/dist/src/util/byte_mask.ref2
new file mode 100644
index 00000000000..631ec533d39
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/byte_mask.ref2
@@ -0,0 +1,10 @@
+unknown: fatal: byte_mask: unknown mask bit in mask: 0x10
+0 -> 0x1 -> 0
+0x2 -> 1
+1 -> 0x2 -> 1
+0x4 -> 2
+2 -> 0x4 -> 2
+0x8 -> 3
+unknown: fatal: byte_mask: unknown mask bit in mask: 0x10
+unknown: fatal: unknown name value "4" in "1234"
+unknown: fatal: unknown name value "a" in "abcd"
diff --git a/external/ibm-public/postfix/dist/src/util/cidr_match.h b/external/ibm-public/postfix/dist/src/util/cidr_match.h
index 84800a985b5..7d575de9115 100644
--- a/external/ibm-public/postfix/dist/src/util/cidr_match.h
+++ b/external/ibm-public/postfix/dist/src/util/cidr_match.h
@@ -1,4 +1,4 @@
-/* $NetBSD: cidr_match.h,v 1.1.1.1 2009/06/23 10:08:59 tron Exp $ */
+/* $NetBSD: cidr_match.h,v 1.1.1.2 2020/03/18 18:59:37 christos Exp $ */
#ifndef _CIDR_MATCH_H_INCLUDED_
#define _CIDR_MATCH_H_INCLUDED_
@@ -40,6 +40,8 @@
* Each parsed CIDR pattern can be member of a linked list.
*/
typedef struct CIDR_MATCH {
+ int op; /* operation, match or control flow */
+ int match; /* positive or negative match */
unsigned char net_bytes[CIDR_MATCH_ABYTES]; /* network portion */
unsigned char mask_bytes[CIDR_MATCH_ABYTES]; /* network mask */
unsigned char addr_family; /* AF_XXX */
@@ -47,9 +49,20 @@ typedef struct CIDR_MATCH {
unsigned char addr_bit_count; /* optimization */
unsigned char mask_shift; /* optimization */
struct CIDR_MATCH *next; /* next entry */
+ struct CIDR_MATCH *block_end; /* block terminator */
} CIDR_MATCH;
-extern VSTRING *cidr_match_parse(CIDR_MATCH *, char *, VSTRING *);
+#define CIDR_MATCH_OP_MATCH 1 /* Match this pattern */
+#define CIDR_MATCH_OP_IF 2 /* Increase if/endif nesting on match */
+#define CIDR_MATCH_OP_ENDIF 3 /* Decrease if/endif nesting on match */
+
+#define CIDR_MATCH_TRUE 1 /* Request positive match */
+#define CIDR_MATCH_FALSE 0 /* Request negative match */
+
+extern VSTRING *cidr_match_parse(CIDR_MATCH *, char *, int, VSTRING *);
+extern VSTRING *cidr_match_parse_if(CIDR_MATCH *, char *, int, VSTRING *);
+extern void cidr_match_endif(CIDR_MATCH *);
+
extern CIDR_MATCH *cidr_match_execute(CIDR_MATCH *, const char *);
/* LICENSE
@@ -61,6 +74,11 @@ extern CIDR_MATCH *cidr_match_execute(CIDR_MATCH *, const char *);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/util/clean_env.c b/external/ibm-public/postfix/dist/src/util/clean_env.c
index c4ccd2f2563..de74f3cf06b 100644
--- a/external/ibm-public/postfix/dist/src/util/clean_env.c
+++ b/external/ibm-public/postfix/dist/src/util/clean_env.c
@@ -1,4 +1,4 @@
-/* $NetBSD: clean_env.c,v 1.1.1.1 2009/06/23 10:08:59 tron Exp $ */
+/* $NetBSD: clean_env.c,v 1.1.1.2 2020/03/18 18:59:37 christos Exp $ */
/*++
/* NAME
@@ -10,12 +10,18 @@
/*
/* void clean_env(preserve_list)
/* const char **preserve_list;
+/*
+/* void update_env(preserve_list)
+/* const char **preserve_list;
/* DESCRIPTION
/* clean_env() reduces the process environment to the bare minimum.
/* The function takes a null-terminated list of arguments.
/* Each argument specifies the name of an environment variable
/* that should be preserved, or specifies a name=value that should
/* be entered into the new environment.
+/*
+/* update_env() applies name=value settings, but otherwise does not
+/* change the process environment.
/* DIAGNOSTICS
/* Fatal error: out of memory.
/* SEE ALSO
@@ -29,6 +35,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -87,3 +98,33 @@ void clean_env(char **preserve_list)
*/
argv_free(save_list);
}
+
+/* update_env - apply name=value settings only */
+
+void update_env(char **preserve_list)
+{
+ char **cpp;
+ ARGV *save_list;
+ char *eq;
+
+ /*
+ * Extract name=value settings.
+ */
+ save_list = argv_alloc(10);
+ for (cpp = preserve_list; *cpp; cpp++)
+ if ((eq = strchr(*cpp, '=')) != 0)
+ argv_addn(save_list, STRING_AND_LENGTH(*cpp, eq - *cpp),
+ STRING_AND_LENGTH(eq + 1, strlen(eq + 1)), (char *) 0);
+
+ /*
+ * Apply name=value settings.
+ */
+ for (cpp = save_list->argv; *cpp; cpp += 2)
+ if (setenv(cpp[0], cpp[1], 1))
+ msg_fatal("setenv(%s, %s): %m", cpp[0], cpp[1]);
+
+ /*
+ * Cleanup.
+ */
+ argv_free(save_list);
+}
diff --git a/external/ibm-public/postfix/dist/src/util/clean_env.h b/external/ibm-public/postfix/dist/src/util/clean_env.h
index 42f83b09605..515c3b7e73e 100644
--- a/external/ibm-public/postfix/dist/src/util/clean_env.h
+++ b/external/ibm-public/postfix/dist/src/util/clean_env.h
@@ -1,4 +1,4 @@
-/* $NetBSD: clean_env.h,v 1.1.1.1 2009/06/23 10:08:59 tron Exp $ */
+/* $NetBSD: clean_env.h,v 1.1.1.2 2020/03/18 18:59:37 christos Exp $ */
#ifndef _CLEAN_ENV_H_INCLUDED_
#define _CLEAN_ENV_H_INCLUDED_
@@ -17,6 +17,7 @@
* External interface.
*/
extern void clean_env(char **);
+extern void update_env(char **);
/* LICENSE
/* .ad
@@ -27,6 +28,11 @@ extern void clean_env(char **);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/util/connect.h b/external/ibm-public/postfix/dist/src/util/connect.h
index 14cfb5914ae..21f8ad87ccd 100644
--- a/external/ibm-public/postfix/dist/src/util/connect.h
+++ b/external/ibm-public/postfix/dist/src/util/connect.h
@@ -1,4 +1,4 @@
-/* $NetBSD: connect.h,v 1.1.1.3 2013/09/25 19:06:36 tron Exp $ */
+/* $NetBSD: connect.h,v 1.1.1.4 2020/03/18 18:59:37 christos Exp $ */
#ifndef _CONNECT_H_INCLUDED_
#define _CONNECT_H_INCLUDED_
@@ -24,6 +24,7 @@
extern int unix_connect(const char *, int, int);
extern int inet_connect(const char *, int, int);
extern int stream_connect(const char *, int, int);
+extern int unix_dgram_connect(const char *, int);
/* LICENSE
/* .ad
@@ -34,6 +35,11 @@ extern int stream_connect(const char *, int, int);
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
#endif
diff --git a/external/ibm-public/postfix/dist/src/util/dict_cidr.in b/external/ibm-public/postfix/dist/src/util/dict_cidr.in
index 1798a60c9de..ee20c17452d 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_cidr.in
+++ b/external/ibm-public/postfix/dist/src/util/dict_cidr.in
@@ -9,3 +9,15 @@ get 2001:240:5c7:0:2d0:b7ff:fe88:2ca7
get 2001:240:5c7:0:2d0:b7ff:febe:ca9f
get 1.1.1.1
get 1:1:1:1:1:1:1:1
+get 1.2.3.3
+get 1.2.3.4
+get 1.2.3.5
+get 1.2.3.6
+get 1.2.3.7
+get 1.2.3.8
+get ::f3
+get ::f4
+get ::f5
+get ::f6
+get ::f7
+get ::f8
diff --git a/external/ibm-public/postfix/dist/src/util/dict_cidr.map b/external/ibm-public/postfix/dist/src/util/dict_cidr.map
index 518e17149c8..ac0f9b5fee1 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_cidr.map
+++ b/external/ibm-public/postfix/dist/src/util/dict_cidr.map
@@ -7,12 +7,44 @@
172.999.0.0/21 whatever
172.16.1.999 whatever
172.16.1.4
+if 1.2.0.0/16
+if 1.2.3.4/30
+1.2.3.3 1.2.3.3 can't happen
+1.2.3.4 1.2.3.4 can happen
+1.2.3.5 1.2.3.5 can happen
+1.2.3.6 1.2.3.6 can happen
+1.2.3.7 1.2.3.7 can happen
+1.2.3.8 1.2.3.8 can't happen
+endif
+endif
+if !1.2.3.4/30
+1.2.3.3 1.2.3.3 can happen
+1.2.3.8 1.2.3.8 can happen
+endif
+if ::f4/126
+::f3 ::f3 can't happen
+::f4 ::f4 can happen
+::f5 ::f5 can happen
+::f6 ::f6 can happen
+::f7 ::f7 can happen
+::f8 ::f8 can't happen
+endif
+if !::f4/126
+::f3 ::f3 can happen
+::f8 ::f8 can happen
+endif
2001:240:5c7:0:2d0:b7ff:fe88:2ca7 match 2001:240:5c7:0:2d0:b7ff:fe88:2ca7
2001:240:5c7::/64 match netblock 2001:240:5c7::/64
1.0.0.0/0 match 0.0.0.0/0
-0.0.0.0/0 match 0.0.0.0/0
+! ! 0.0.0.0/0 match 0.0.0.0/0
1::/0 match ::/0
::/0 match ::/0
-[1234 foo
-[1234]junk bar
-172.16.1.3/3x whatever
+[1234 can't happen
+[1234]junk can't happen
+172.16.1.3/3x can't happen
+endif
+endif
+if 1:2::3:4
+if 1:2::3:5
+if !
+!
diff --git a/external/ibm-public/postfix/dist/src/util/dict_cidr.ref b/external/ibm-public/postfix/dist/src/util/dict_cidr.ref
index 4a185392884..a83de6b0c5e 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_cidr.ref
+++ b/external/ibm-public/postfix/dist/src/util/dict_cidr.ref
@@ -3,11 +3,17 @@
./dict_open: warning: cidr map dict_cidr.map, line 7: bad net/mask pattern: "172.999.0.0/21": skipping this rule
./dict_open: warning: cidr map dict_cidr.map, line 8: bad address pattern: "172.16.1.999": skipping this rule
./dict_open: warning: cidr map dict_cidr.map, line 9: no lookup result: skipping this rule
-./dict_open: warning: cidr map dict_cidr.map, line 12: non-null host address bits in "1.0.0.0/0", perhaps you should use "0.0.0.0/0" instead: skipping this rule
-./dict_open: warning: cidr map dict_cidr.map, line 14: non-null host address bits in "1::/0", perhaps you should use "::/0" instead: skipping this rule
-./dict_open: warning: cidr map dict_cidr.map, line 16: missing ']' character after "[1234": skipping this rule
-./dict_open: warning: cidr map dict_cidr.map, line 17: garbage after "[1234]": skipping this rule
-./dict_open: warning: cidr map dict_cidr.map, line 18: bad net/mask pattern: "172.16.1.3/3x": skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 38: non-null host address bits in "1.0.0.0/0", perhaps you should use "0.0.0.0/0" instead: skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 40: non-null host address bits in "1::/0", perhaps you should use "::/0" instead: skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 42: missing ']' character after "[1234": skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 43: garbage after "[1234]": skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 44: bad net/mask pattern: "172.16.1.3/3x": skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 45: ENDIF without IF: skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 46: ENDIF without IF: skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 49: no address pattern: skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 50: no address pattern: skipping this rule
+./dict_open: warning: cidr map dict_cidr.map, line 48: IF has no matching ENDIF
+./dict_open: warning: cidr map dict_cidr.map, line 47: IF has no matching ENDIF
owner=untrusted (uid=USER)
> get 172.16.0.0
172.16.0.0=554 match bad netblock 172.16.0.0/21
@@ -31,3 +37,27 @@ owner=untrusted (uid=USER)
1.1.1.1=match 0.0.0.0/0
> get 1:1:1:1:1:1:1:1
1:1:1:1:1:1:1:1=match ::/0
+> get 1.2.3.3
+1.2.3.3=1.2.3.3 can happen
+> get 1.2.3.4
+1.2.3.4=1.2.3.4 can happen
+> get 1.2.3.5
+1.2.3.5=1.2.3.5 can happen
+> get 1.2.3.6
+1.2.3.6=1.2.3.6 can happen
+> get 1.2.3.7
+1.2.3.7=1.2.3.7 can happen
+> get 1.2.3.8
+1.2.3.8=1.2.3.8 can happen
+> get ::f3
+::f3=::f3 can happen
+> get ::f4
+::f4=::f4 can happen
+> get ::f5
+::f5=::f5 can happen
+> get ::f6
+::f6=::f6 can happen
+> get ::f7
+::f7=::f7 can happen
+> get ::f8
+::f8=::f8 can happen
diff --git a/external/ibm-public/postfix/dist/src/util/dict_cidr_file.in b/external/ibm-public/postfix/dist/src/util/dict_cidr_file.in
new file mode 100644
index 00000000000..531d7352ac9
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_cidr_file.in
@@ -0,0 +1,3 @@
+get 1.1.1.1
+get 2.2.2.2
+get 3.3.3.3
diff --git a/external/ibm-public/postfix/dist/src/util/dict_cidr_file.map b/external/ibm-public/postfix/dist/src/util/dict_cidr_file.map
new file mode 100644
index 00000000000..e85e8ca4b2c
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_cidr_file.map
@@ -0,0 +1,3 @@
+1.1.1.1 dict_cidr_file1
+2.2.2.2 dict_cidr_file2
+3.3.3.3 dict_cidr_file3
diff --git a/external/ibm-public/postfix/dist/src/util/dict_cidr_file.ref b/external/ibm-public/postfix/dist/src/util/dict_cidr_file.ref
new file mode 100644
index 00000000000..3e9e79205c7
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_cidr_file.ref
@@ -0,0 +1,8 @@
+./dict_open: warning: cidr map dict_cidr_file.map, line 3: open dict_cidr_file3: No such file or directory: skipping this rule
+owner=untrusted (uid=USER)
+> get 1.1.1.1
+1.1.1.1=dGhpcy1pcy1maWxlMQo=
+> get 2.2.2.2
+2.2.2.2=dGhpcy1pcy1maWxlMgo=
+> get 3.3.3.3
+3.3.3.3: not found
diff --git a/external/ibm-public/postfix/dist/src/util/dict_file.c b/external/ibm-public/postfix/dist/src/util/dict_file.c
new file mode 100644
index 00000000000..57adf29d9c9
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_file.c
@@ -0,0 +1,233 @@
+/* $NetBSD: dict_file.c,v 1.1.1.1 2020/03/18 18:59:37 christos Exp $ */
+
+/*++
+/* NAME
+/* dict_file_to_buf 3
+/* SUMMARY
+/* include content from file as blob
+/* SYNOPSIS
+/* #include <dict.h>
+/*
+/* VSTRING *dict_file_to_buf(
+/* DICT *dict,
+/* const char *pathnames)
+/*
+/* VSTRING *dict_file_to_b64(
+/* DICT *dict,
+/* const char *pathnames)
+/*
+/* VSTRING *dict_file_from_b64(
+/* DICT *dict,
+/* const char *value)
+/*
+/* char *dict_file_get_error(
+/* DICT *dict)
+/*
+/* void dict_file_purge_buffers(
+/* DICT *dict)
+/*
+/* const char *dict_file_lookup(
+/* DICT *dict)
+/* DESCRIPTION
+/* dict_file_to_buf() reads the content of the specified files,
+/* with names separated by CHARS_COMMA_SP, while inserting a
+/* gratuitous newline character between files. It returns a
+/* pointer to a buffer which is owned by the DICT, or a null
+/* pointer in case of error.
+/*
+/* dict_file_to_b64() invokes dict_file_to_buf() and converts
+/* the result to base64. It returns a pointer to a buffer which
+/* is owned by the DICT, or a null pointer in case of error.
+/*
+/* dict_file_from_b64() converts a value from base64. It returns
+/* a pointer to a buffer which is owned by the DICT, or a null
+/* pointer in case of error.
+/*
+/* dict_file_purge_buffers() disposes of dict_file-related
+/* memory that are associated with this DICT.
+/*
+/* dict_file_get_error() should be called only after error;
+/* it returns a desciption of the problem. Storage is owned
+/* by the caller.
+/*
+/* dict_file_lookup() wraps the dictionary lookup method and
+/* decodes the base64 lookup result. The dictionary must be
+/* opened with DICT_FLAG_SRC_RHS_IS_FILE. Sets dict->error to
+/* DICT_ERR_CONFIG if the content is invalid. Decoding is not
+/* built into the dict->lookup() method, because that would
+/* complicate the implementation of map nesting (inline, thash),
+/* map composition (pipemap, unionmap), and map proxying.
+/* DIAGNOSTICS
+/* Panic: interface violation.
+/*
+/* In case of error the VSTRING result value is a null pointer, and
+/* an error description can be retrieved with dict_file_get_error().
+/* The storage is owned by the caller.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <sys/stat.h>
+#include <string.h>
+
+ /*
+ * Utility library.
+ */
+#include <base64_code.h>
+#include <dict.h>
+#include <msg.h>
+#include <mymalloc.h>
+#include <vstream.h>
+#include <vstring.h>
+
+ /*
+ * SLMs.
+ */
+#define STR(x) vstring_str(x)
+#define LEN(x) VSTRING_LEN(x)
+
+/* dict_file_to_buf - read files into a buffer */
+
+VSTRING *dict_file_to_buf(DICT *dict, const char *pathnames)
+{
+ struct stat st;
+ VSTREAM *fp = 0;
+ ARGV *argv;
+ char **cpp;
+
+ /* dict_file_to_buf() postcondition: dict->file_buf exists. */
+ if (dict->file_buf == 0)
+ dict->file_buf = vstring_alloc(100);
+
+#define DICT_FILE_RETURN(retval) do { \
+ argv_free(argv); \
+ if (fp) vstream_fclose(fp); \
+ return (retval); \
+ } while (0);
+
+ argv = argv_split(pathnames, CHARS_COMMA_SP);
+ if (argv->argc == 0) {
+ vstring_sprintf(dict->file_buf, "empty pathname list: >>%s<<'",
+ pathnames);
+ DICT_FILE_RETURN(0);
+ }
+ VSTRING_RESET(dict->file_buf);
+ for (cpp = argv->argv; *cpp; cpp++) {
+ if ((fp = vstream_fopen(*cpp, O_RDONLY, 0)) == 0
+ || fstat(vstream_fileno(fp), &st) < 0) {
+ vstring_sprintf(dict->file_buf, "open %s: %m", *cpp);
+ DICT_FILE_RETURN(0);
+ }
+ if (st.st_size > SSIZE_T_MAX - LEN(dict->file_buf)) {
+ vstring_sprintf(dict->file_buf, "file too large: %s", pathnames);
+ DICT_FILE_RETURN(0);
+ }
+ if (vstream_fread_app(fp, dict->file_buf, st.st_size) != st.st_size) {
+ vstring_sprintf(dict->file_buf, "read %s: %m", *cpp);
+ DICT_FILE_RETURN(0);
+ }
+ (void) vstream_fclose(fp);
+ fp = 0;
+ if (cpp[1] != 0)
+ VSTRING_ADDCH(dict->file_buf, '\n');
+ }
+ VSTRING_TERMINATE(dict->file_buf);
+ DICT_FILE_RETURN(dict->file_buf);
+}
+
+/* dict_file_to_b64 - read files into a base64-encoded buffer */
+
+VSTRING *dict_file_to_b64(DICT *dict, const char *pathnames)
+{
+ ssize_t helper;
+
+ if (dict_file_to_buf(dict, pathnames) == 0)
+ return (0);
+ if (dict->file_b64 == 0)
+ dict->file_b64 = vstring_alloc(100);
+ helper = (LEN(dict->file_buf) + 2) / 3;
+ if (helper > SSIZE_T_MAX / 4) {
+ vstring_sprintf(dict->file_buf, "file too large: %s", pathnames);
+ return (0);
+ }
+ VSTRING_RESET(dict->file_b64);
+ VSTRING_SPACE(dict->file_b64, helper * 4);
+ return (base64_encode(dict->file_b64, STR(dict->file_buf),
+ LEN(dict->file_buf)));
+}
+
+/* dict_file_from_b64 - convert value from base64 */
+
+VSTRING *dict_file_from_b64(DICT *dict, const char *value)
+{
+ ssize_t helper;
+ VSTRING *result;
+
+ if (dict->file_buf == 0)
+ dict->file_buf = vstring_alloc(100);
+ helper = strlen(value) / 4;
+ VSTRING_RESET(dict->file_buf);
+ VSTRING_SPACE(dict->file_buf, helper * 3);
+ result = base64_decode(dict->file_buf, value, strlen(value));
+ if (result == 0)
+ vstring_sprintf(dict->file_buf, "malformed BASE64 value: %.30s", value);
+ return (result);
+}
+
+/* dict_file_get_error - return error text */
+
+char *dict_file_get_error(DICT *dict)
+{
+ if (dict->file_buf == 0)
+ msg_panic("dict_file_get_error: no buffer");
+ return (mystrdup(STR(dict->file_buf)));
+}
+
+/* dict_file_purge_buffers - purge file buffers */
+
+void dict_file_purge_buffers(DICT *dict)
+{
+ if (dict->file_buf) {
+ vstring_free(dict->file_buf);
+ dict->file_buf = 0;
+ }
+ if (dict->file_b64) {
+ vstring_free(dict->file_b64);
+ dict->file_b64 = 0;
+ }
+}
+
+/* dict_file_lookup - look up and decode dictionary entry */
+
+const char *dict_file_lookup(DICT *dict, const char *key)
+{
+ const char myname[] = "dict_file_lookup";
+ const char *res;
+ VSTRING *unb64;
+ char *err;
+
+ if ((dict->flags & DICT_FLAG_SRC_RHS_IS_FILE) == 0)
+ msg_panic("%s: dictionary opened without DICT_FLAG_SRC_RHS_IS_FILE",
+ myname);
+ if ((res = dict->lookup(dict, key)) == 0)
+ return (0);
+ if ((unb64 = dict_file_from_b64(dict, res)) == 0) {
+ err = dict_file_get_error(dict);
+ msg_warn("table %s:%s: key %s: %s", dict->type, dict->name, key, err);
+ myfree(err);
+ dict->error = DICT_ERR_CONFIG;
+ return (0);
+ }
+ return STR(unb64);
+}
diff --git a/external/ibm-public/postfix/dist/src/util/dict_inline_file.ref b/external/ibm-public/postfix/dist/src/util/dict_inline_file.ref
new file mode 100644
index 00000000000..9d49e95f420
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_inline_file.ref
@@ -0,0 +1,12 @@
+./dict_open: error: open xx: No such file or directory: "inline:{ foo=xx, bar=yy }"; need "inline:{name=filename...}"
+owner=trusted (uid=2147483647)
+> get foo
+./dict_open: warning: inline:{ foo=xx, bar=yy } is unavailable. open xx: No such file or directory: "inline:{ foo=xx, bar=yy }"; need "inline:{name=filename...}"
+foo: error
+owner=trusted (uid=2147483647)
+> get file1
+file1=dGhpcy1pcy1maWxlMQo=
+> get file2
+file2=dGhpcy1pcy1maWxlMgo=
+> get file3
+file3: not found
diff --git a/external/ibm-public/postfix/dist/src/util/dict_pcre.in b/external/ibm-public/postfix/dist/src/util/dict_pcre.in
index 324342e8313..b0644bdc6b3 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_pcre.in
+++ b/external/ibm-public/postfix/dist/src/util/dict_pcre.in
@@ -6,6 +6,7 @@ get 3
get true3
get c
get d
+get 1235
get 1234
get 123
get bar/find
diff --git a/external/ibm-public/postfix/dist/src/util/dict_pcre.map b/external/ibm-public/postfix/dist/src/util/dict_pcre.map
index f646a1f3b52..7a6cefb6f84 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_pcre.map
+++ b/external/ibm-public/postfix/dist/src/util/dict_pcre.map
@@ -20,3 +20,8 @@ endif
endif
# trailing whitespace above
!
+# dangling endif and if
+endif
+endif
+if /./
+if /./
diff --git a/external/ibm-public/postfix/dist/src/util/dict_pcre.ref b/external/ibm-public/postfix/dist/src/util/dict_pcre.ref
index 29e9dfb5fae..23eef8e01fd 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_pcre.ref
+++ b/external/ibm-public/postfix/dist/src/util/dict_pcre.ref
@@ -2,10 +2,14 @@
./dict_open: warning: pcre map dict_pcre.map, line 1: do not prepend whitespace to statements between IF and ENDIF
./dict_open: warning: pcre map dict_pcre.map, line 5: ignoring extra text after ENDIF
./dict_open: warning: pcre map dict_pcre.map, line 8: unknown regexp option "!": skipping this rule
-./dict_open: warning: dict_pcre.map, line 9: no replacement text: using empty string
+./dict_open: warning: pcre map dict_pcre.map, line 9: no replacement text: using empty string
./dict_open: warning: pcre map dict_pcre.map, line 10: out of range replacement index "5": skipping this rule
./dict_open: warning: pcre map dict_pcre.map, line 17: $number found in negative match replacement text: skipping this rule
./dict_open: warning: pcre map dict_pcre.map, line 22: no regexp: skipping this rule
+./dict_open: warning: pcre map dict_pcre.map, line 24: ignoring ENDIF without matching IF
+./dict_open: warning: pcre map dict_pcre.map, line 25: ignoring ENDIF without matching IF
+./dict_open: warning: pcre map dict_pcre.map, line 27: IF has no matching ENDIF
+./dict_open: warning: pcre map dict_pcre.map, line 26: IF has no matching ENDIF
owner=untrusted (uid=USER)
> get true
true: not found
@@ -23,6 +27,8 @@ true3=3
c=
> get d
d: not found
+> get 1235
+1235=(1)(2)(3)
> get 1234
1234=(1)(2)(3)(4)
> get 123
diff --git a/external/ibm-public/postfix/dist/src/util/dict_pcre_file.in b/external/ibm-public/postfix/dist/src/util/dict_pcre_file.in
new file mode 100644
index 00000000000..28c0bd5bdea
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_pcre_file.in
@@ -0,0 +1,4 @@
+get file1
+get file2
+get file3
+get files12
diff --git a/external/ibm-public/postfix/dist/src/util/dict_pcre_file.map b/external/ibm-public/postfix/dist/src/util/dict_pcre_file.map
new file mode 100644
index 00000000000..4fd12e60ecb
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_pcre_file.map
@@ -0,0 +1,6 @@
+/file1/ dict_pcre_file1
+/file2/ dict_pcre_file2
+/file3/ dict_pcre_file3
+/files12/ dict_pcre_file1, dict_pcre_file2
+/files13/ dict_pcre_file1, dict_pcre_file3
+/file-comma/ ,
diff --git a/external/ibm-public/postfix/dist/src/util/dict_pcre_file.ref b/external/ibm-public/postfix/dist/src/util/dict_pcre_file.ref
new file mode 100644
index 00000000000..727306d91c3
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_pcre_file.ref
@@ -0,0 +1,12 @@
+./dict_open: warning: pcre map dict_pcre_file.map, line 3: open dict_pcre_file3: No such file or directory: skipping this rule
+./dict_open: warning: pcre map dict_pcre_file.map, line 5: open dict_pcre_file3: No such file or directory: skipping this rule
+./dict_open: warning: pcre map dict_pcre_file.map, line 6: empty pathname list: >>,<<': skipping this rule
+owner=untrusted (uid=USER)
+> get file1
+file1=dGhpcy1pcy1maWxlMQo=
+> get file2
+file2=dGhpcy1pcy1maWxlMgo=
+> get file3
+file3: not found
+> get files12
+files12=dGhpcy1pcy1maWxlMQoKdGhpcy1pcy1maWxlMgo=
diff --git a/external/ibm-public/postfix/dist/src/util/dict_pipe_test.in b/external/ibm-public/postfix/dist/src/util/dict_pipe_test.in
new file mode 100644
index 00000000000..9626dcd3f96
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_pipe_test.in
@@ -0,0 +1,9 @@
+${VALGRIND} ./dict_open 'pipemap:{inline:{k1=v1,k2=v2},inline:{v2=v3}}' read <<EOF
+get k0
+get k1
+get k2
+EOF
+${VALGRIND} ./dict_open 'pipemap:{inline:{k1=v1},fail:fail}' read <<EOF
+get k0
+get k1
+EOF
diff --git a/external/ibm-public/postfix/dist/src/util/dict_pipe_test.ref b/external/ibm-public/postfix/dist/src/util/dict_pipe_test.ref
new file mode 100644
index 00000000000..ecb865a6427
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_pipe_test.ref
@@ -0,0 +1,14 @@
++ ./dict_open pipemap:{inline:{k1=v1,k2=v2},inline:{v2=v3}} read
+owner=trusted (uid=2147483647)
+> get k0
+k0: not found
+> get k1
+k1: not found
+> get k2
+k2=v3
++ ./dict_open pipemap:{inline:{k1=v1},fail:fail} read
+owner=trusted (uid=2147483647)
+> get k0
+k0: not found
+> get k1
+k1: error
diff --git a/external/ibm-public/postfix/dist/src/util/dict_random.ref b/external/ibm-public/postfix/dist/src/util/dict_random.ref
new file mode 100644
index 00000000000..09934094b90
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_random.ref
@@ -0,0 +1,20 @@
+owner=trusted (uid=0)
+> get foo
+foo=123
+> get bar
+bar=123
+./dict_open: error: bad syntax: "randmap:123"; need "randmap:{value...}"
+owner=trusted (uid=2147483647)
+> get foo
+./dict_open: warning: randmap:123 is unavailable. bad syntax: "randmap:123"; need "randmap:{value...}"
+foo: error
+./dict_open: error: bad syntax: "randmap:{ 123 "; need "randmap:{value...}"
+owner=trusted (uid=2147483647)
+> get foo
+./dict_open: warning: randmap:{ 123 is unavailable. bad syntax: "randmap:{ 123 "; need "randmap:{value...}"
+foo: error
+./dict_open: error: bad syntax: "randmap:{ 123 }x"; need "randmap:{value...}"
+owner=trusted (uid=2147483647)
+> get foo
+./dict_open: warning: randmap:{ 123 }x is unavailable. bad syntax: "randmap:{ 123 }x"; need "randmap:{value...}"
+foo: error
diff --git a/external/ibm-public/postfix/dist/src/util/dict_random_file.ref b/external/ibm-public/postfix/dist/src/util/dict_random_file.ref
new file mode 100644
index 00000000000..cb0187379fa
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_random_file.ref
@@ -0,0 +1,10 @@
+./dict_open: error: open fooxx: No such file or directory
+owner=trusted (uid=2147483647)
+> get foo
+./dict_open: warning: randmap:{fooxx} is unavailable. open fooxx: No such file or directory
+foo: error
+owner=trusted (uid=0)
+> get foo
+foo=dGhpcy1pcy1maWxlMQo=
+> get bar
+bar=dGhpcy1pcy1maWxlMQo=
diff --git a/external/ibm-public/postfix/dist/src/util/dict_regexp.map b/external/ibm-public/postfix/dist/src/util/dict_regexp.map
index f646a1f3b52..7a6cefb6f84 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_regexp.map
+++ b/external/ibm-public/postfix/dist/src/util/dict_regexp.map
@@ -20,3 +20,8 @@ endif
endif
# trailing whitespace above
!
+# dangling endif and if
+endif
+endif
+if /./
+if /./
diff --git a/external/ibm-public/postfix/dist/src/util/dict_regexp.ref b/external/ibm-public/postfix/dist/src/util/dict_regexp.ref
index 589300dc218..2a08a3b73ab 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_regexp.ref
+++ b/external/ibm-public/postfix/dist/src/util/dict_regexp.ref
@@ -1,10 +1,15 @@
./dict_open: warning: regexp map dict_regexp.map, line 1: ignoring extra text after IF statement: "fodder"
./dict_open: warning: regexp map dict_regexp.map, line 1: do not prepend whitespace to statements between IF and ENDIF
./dict_open: warning: regexp map dict_regexp.map, line 5: ignoring extra text after ENDIF
-./dict_open: warning: regexp map dict_regexp.map, line 9: using empty replacement string
+./dict_open: warning: regexp map dict_regexp.map, line 9: no replacement text: using empty string
./dict_open: warning: regexp map dict_regexp.map, line 10: out of range replacement index "5": skipping this rule
./dict_open: warning: regexp map dict_regexp.map, line 17: $number found in negative match replacement text: skipping this rule
./dict_open: warning: regexp map dict_regexp.map, line 22: no regexp: skipping this rule
+./dict_open: warning: regexp map dict_regexp.map, line 24: ignoring ENDIF without matching IF
+./dict_open: warning: regexp map dict_regexp.map, line 25: ignoring ENDIF without matching IF
+./dict_open: warning: regexp map dict_regexp.map, line 27: IF has no matching ENDIF
+./dict_open: warning: regexp map dict_regexp.map, line 26: IF has no matching ENDIF
+owner=untrusted (uid=USER)
> get true
true: not found
> get true1
diff --git a/external/ibm-public/postfix/dist/src/util/dict_regexp_file.in b/external/ibm-public/postfix/dist/src/util/dict_regexp_file.in
new file mode 100644
index 00000000000..fef4146ea9a
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_regexp_file.in
@@ -0,0 +1,3 @@
+get file1
+get file2
+get file3
diff --git a/external/ibm-public/postfix/dist/src/util/dict_regexp_file.map b/external/ibm-public/postfix/dist/src/util/dict_regexp_file.map
new file mode 100644
index 00000000000..41c6b6af2f6
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_regexp_file.map
@@ -0,0 +1,3 @@
+/file1/ dict_regexp_file1
+/file2/ dict_regexp_file2
+/file3/ dict_regexp_file3
diff --git a/external/ibm-public/postfix/dist/src/util/dict_regexp_file.ref b/external/ibm-public/postfix/dist/src/util/dict_regexp_file.ref
new file mode 100644
index 00000000000..2218143623f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_regexp_file.ref
@@ -0,0 +1,8 @@
+./dict_open: warning: regexp map dict_regexp_file.map, line 3: open dict_regexp_file3: No such file or directory: skipping this rule
+owner=untrusted (uid=USER)
+> get file1
+file1=dGhpcy1pcy1maWxlMQo=
+> get file2
+file2=dGhpcy1pcy1maWxlMgo=
+> get file3
+file3: not found
diff --git a/external/ibm-public/postfix/dist/src/util/dict_static_file.ref b/external/ibm-public/postfix/dist/src/util/dict_static_file.ref
new file mode 100644
index 00000000000..259f9fb67a0
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_static_file.ref
@@ -0,0 +1,10 @@
+./dict_open: error: open fooxx: No such file or directory
+owner=trusted (uid=2147483647)
+> get foo
+./dict_open: warning: static:fooxx is unavailable. open fooxx: No such file or directory
+foo: error
+owner=trusted (uid=2147483647)
+> get file1
+file1=dGhpcy1pcy1maWxlMQo=
+> get file2
+file2=dGhpcy1pcy1maWxlMQo=
diff --git a/external/ibm-public/postfix/dist/src/util/dict_thash.in b/external/ibm-public/postfix/dist/src/util/dict_thash.in
new file mode 100644
index 00000000000..89938f67028
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_thash.in
@@ -0,0 +1,5 @@
+"the answer is 42
+xxx: yyy
+xxx
+aaa bbb
+aaa bbb
diff --git a/external/ibm-public/postfix/dist/src/util/dict_thash.map b/external/ibm-public/postfix/dist/src/util/dict_thash.map
index 95b54fd826d..cce1144ea2c 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_thash.map
+++ b/external/ibm-public/postfix/dist/src/util/dict_thash.map
@@ -1,15 +1,17 @@
-allascii.c 915
-alldig.c 928
-allprint.c 943
-allspace.c 931
-argv.c 5271
-argv_split.c 2780
-attr_clnt.c 5813
-attr_print0.c 7243
-attr_print64.c 8104
-attr_print_plain.c 7086
-attr_scan0.c 15454
-attr_scan64.c 17256
-attr_scan_plain.c 16924
-auto_clnt.c 9819
-ABCDEF 012345
+"the answer is" 42
+ABCDEF 012345
+allascii.c 915
+alldig.c 928
+allprint.c 943
+allspace.c 931
+argv.c 5271
+argv_split.c 2780
+attr_clnt.c 5813
+attr_print0.c 7243
+attr_print64.c 8104
+attr_print_plain.c 7086
+attr_scan0.c 15454
+attr_scan64.c 17256
+attr_scan_plain.c 16924
+auto_clnt.c 9819
+the answer is 42
diff --git a/external/ibm-public/postfix/dist/src/util/dict_thash.ref b/external/ibm-public/postfix/dist/src/util/dict_thash.ref
new file mode 100644
index 00000000000..efdc2079907
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_thash.ref
@@ -0,0 +1,6 @@
+postmap: warning: dict_thash.in, line 1: unbalanced '"' in '"the answer is 42' -- ignoring this line
+postmap: warning: dict_thash.in, line 2: record is in "key: value" format; is this an alias file?
+postmap: warning: dict_thash.in, line 3: expected format: key whitespace value -- ignoring this line
+postmap: warning: dict_thash.in, line 5: duplicate entry: "aaa"
+aaa bbb
+xxx: yyy
diff --git a/external/ibm-public/postfix/dist/src/util/dict_union_test.in b/external/ibm-public/postfix/dist/src/util/dict_union_test.in
new file mode 100644
index 00000000000..9d111d43ef4
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_union_test.in
@@ -0,0 +1,7 @@
+${VALGRIND} ./dict_open 'unionmap:{static:one,static:two,inline:{foo=three}}' read <<EOF
+get foo
+get bar
+EOF
+${VALGRIND} ./dict_open 'unionmap:{static:one,fail:fail}' read <<EOF
+get foo
+EOF
diff --git a/external/ibm-public/postfix/dist/src/util/dict_union_test.ref b/external/ibm-public/postfix/dist/src/util/dict_union_test.ref
new file mode 100644
index 00000000000..b6094107cfe
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/dict_union_test.ref
@@ -0,0 +1,10 @@
++ ./dict_open unionmap:{static:one,static:two,inline:{foo=three}} read
+owner=trusted (uid=2147483647)
+> get foo
+foo=one,two,three
+> get bar
+bar=one,two
++ ./dict_open unionmap:{static:one,fail:fail} read
+owner=trusted (uid=2147483647)
+> get foo
+foo: error
diff --git a/external/ibm-public/postfix/dist/src/util/dict_utf8_test.in b/external/ibm-public/postfix/dist/src/util/dict_utf8_test.in
index ec83be61b98..f8d453674a6 100644
--- a/external/ibm-public/postfix/dist/src/util/dict_utf8_test.in
+++ b/external/ibm-public/postfix/dist/src/util/dict_utf8_test.in
@@ -1,6 +1,6 @@
#!/bin/sh
-awk 'BEGIN {
+LC_ALL=C awk 'BEGIN {
print "flags"
print "verbose"
printf "get foo\n"
@@ -11,4 +11,4 @@ awk 'BEGIN {
printf "put xxx %c%c%c\n", 128, 128, 128
printf "get xxx\n"
exit
-}' | ./dict_open internal:whatever write utf8_request
+}' | ${VALGRIND} ./dict_open internal:whatever write utf8_request
diff --git a/external/ibm-public/postfix/dist/src/util/hex_quote.c b/external/ibm-public/postfix/dist/src/util/hex_quote.c
index 094f7d3ccb5..e93e574bd96 100644
--- a/external/ibm-public/postfix/dist/src/util/hex_quote.c
+++ b/external/ibm-public/postfix/dist/src/util/hex_quote.c
@@ -1,4 +1,4 @@
-/* $NetBSD: hex_quote.c,v 1.1.1.1 2009/06/23 10:09:00 tron Exp $ */
+/* $NetBSD: hex_quote.c,v 1.1.1.2 2020/03/18 18:59:38 christos Exp $ */
/*++
/* NAME
@@ -37,6 +37,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -121,9 +126,7 @@ static ssize_t read_buf(VSTREAM *fp, VSTRING *buf)
{
ssize_t len;
- VSTRING_RESET(buf);
- len = vstream_fread(fp, STR(buf), vstring_avail(buf));
- VSTRING_AT_OFFSET(buf, len); /* XXX */
+ len = vstream_fread_buf(fp, buf, BUFLEN);
VSTRING_TERMINATE(buf);
return (len);
}
diff --git a/external/ibm-public/postfix/dist/src/util/killme_after.c b/external/ibm-public/postfix/dist/src/util/killme_after.c
index 6b0829bb20b..5f4d8b593ba 100644
--- a/external/ibm-public/postfix/dist/src/util/killme_after.c
+++ b/external/ibm-public/postfix/dist/src/util/killme_after.c
@@ -1,4 +1,4 @@
-/* $NetBSD: killme_after.c,v 1.1.1.1 2009/06/23 10:09:00 tron Exp $ */
+/* $NetBSD: killme_after.c,v 1.1.1.2 2020/03/18 18:59:38 christos Exp $ */
/*++
/* NAME
@@ -26,6 +26,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -48,11 +53,17 @@ void killme_after(unsigned int seconds)
* Schedule an ALARM signal, and make sure the signal will be delivered
* even if we are being called from a signal handler and SIGALRM delivery
* is blocked.
+ *
+ * Undocumented: when a process runs with PID 1, Linux won't deliver a
+ * signal unless the process specifies a handler (i.e. SIG_DFL is treated
+ * as SIG_IGN). Conveniently, _exit() can be used directly as a signal
+ * handler. This changes the wait status that a parent would see, but in
+ * the case of "init" mode on Linux, no-one would care.
*/
alarm(0);
sigemptyset(&sig_action.sa_mask);
sig_action.sa_flags = 0;
- sig_action.sa_handler = SIG_DFL;
+ sig_action.sa_handler = (getpid() == 1 ? _exit : SIG_DFL);
sigaction(SIGALRM, &sig_action, (struct sigaction *) 0);
alarm(seconds);
sigaddset(&sig_action.sa_mask, SIGALRM);
diff --git a/external/ibm-public/postfix/dist/src/util/logwriter.c b/external/ibm-public/postfix/dist/src/util/logwriter.c
new file mode 100644
index 00000000000..76f21c2a7cc
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/logwriter.c
@@ -0,0 +1,126 @@
+/* $NetBSD: logwriter.c,v 1.1.1.1 2020/03/18 18:59:38 christos Exp $ */
+
+/*++
+/* NAME
+/* logwriter 3
+/* SUMMARY
+/* logfile writer
+/* SYNOPSIS
+/* #include <logwriter.h>
+/*
+/* VSTREAM *logwriter_open_or_die(
+/* const char *path)
+/*
+/* int logwriter_write(
+/* VSTREAM *file,
+/* const char *buffer.
+/* ssize_t buflen)
+/*
+/* int logwriter_close(
+/* VSTREAM *file)
+/*
+/* int logwriter_one_shot(
+/* const char *path,
+/* const char *buffer,
+/* ssize_t buflen)
+/* DESCRIPTION
+/* This module manages a logfile writer.
+/*
+/* logwriter_open_or_die() safely opens the specified file in
+/* write+append mode. File open/create errors are fatal.
+/*
+/* logwriter_write() writes the buffer plus newline to the
+/* open logfile. The result is zero if successful, VSTREAM_EOF
+/* if the operation failed.
+/*
+/* logwriter_close() closes the logfile and destroys the VSTREAM
+/* instance. The result is zero if there were no errors writing
+/* the file, VSTREAM_EOF otherwise.
+/*
+/* logwriter_one_shot() combines all the above operations. The
+/* result is zero if successful, VSTREAM_EOF if any operation
+/* failed.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+
+ /*
+ * Utility library.
+ */
+#include <iostuff.h>
+#include <logwriter.h>
+#include <msg.h>
+#include <mymalloc.h>
+#include <safe_open.h>
+#include <vstream.h>
+
+ /*
+ * Application-specific.
+ */
+
+/* logwriter_open_or_die - open logfile */
+
+VSTREAM *logwriter_open_or_die(const char *path)
+{
+ VSTREAM *fp;
+ VSTRING *why = vstring_alloc(100);
+
+#define NO_STATP ((struct stat *) 0)
+#define NO_CHOWN (-1)
+#define NO_CHGRP (-1)
+
+ fp = safe_open(path, O_CREAT | O_WRONLY | O_APPEND, 0644,
+ NO_STATP, NO_CHOWN, NO_CHGRP, why);
+ if (fp == 0)
+ msg_fatal("open logfile '%s': %s", path, vstring_str(why));
+ close_on_exec(vstream_fileno(fp), CLOSE_ON_EXEC);
+ vstring_free(why);
+ return (fp);
+}
+
+/* logwriter_write - append to logfile */
+
+int logwriter_write(VSTREAM *fp, const char *buf, ssize_t len)
+{
+ if (len < 0)
+ msg_panic("logwriter_write: negative length %ld", (long) len);
+ if (vstream_fwrite(fp, buf, len) != len)
+ return (VSTREAM_EOF);
+ VSTREAM_PUTC('\n', fp);
+ return (vstream_fflush(fp));
+}
+
+/* logwriter_close - close logfile */
+
+int logwriter_close(VSTREAM *fp)
+{
+ return (vstream_fclose(fp));
+}
+
+/* logwriter_one_shot - one-shot logwriter */
+
+int logwriter_one_shot(const char *path, const char *buf, ssize_t len)
+{
+ VSTREAM *fp;
+ int err;
+
+ fp = logwriter_open_or_die(path);
+ err = logwriter_write(fp, buf, len);
+ err |= logwriter_close(fp);
+ return (err ? VSTREAM_EOF : 0);
+}
diff --git a/external/ibm-public/postfix/dist/src/util/logwriter.h b/external/ibm-public/postfix/dist/src/util/logwriter.h
new file mode 100644
index 00000000000..737c56d4be6
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/logwriter.h
@@ -0,0 +1,40 @@
+/* $NetBSD: logwriter.h,v 1.1.1.1 2020/03/18 18:59:38 christos Exp $ */
+
+#ifndef _LOGWRITER_H_INCLUDED_
+#define _LOGWRITER_H_INCLUDED_
+
+/*++
+/* NAME
+/* logwriter 3h
+/* SUMMARY
+/* logfile writer
+/* SYNOPSIS
+/* #include <logwriter.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * Utility library.
+ */
+#include <vstream.h>
+
+ /*
+ * External interface.
+ */
+extern VSTREAM *logwriter_open_or_die(const char *);
+extern int logwriter_write(VSTREAM *, const char *, ssize_t);
+extern int logwriter_close(VSTREAM *);
+extern int logwriter_one_shot(const char *, const char *, ssize_t);
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/util/mac_expand.in b/external/ibm-public/postfix/dist/src/util/mac_expand.in
index 29f78f20fce..dbc583c0f80 100644
--- a/external/ibm-public/postfix/dist/src/util/mac_expand.in
+++ b/external/ibm-public/postfix/dist/src/util/mac_expand.in
@@ -1,7 +1,12 @@
name1 = name1-value
+$name1
$(name1
-$(name )
+$(name1)
+$( name1)
+$(name1 )
+$(na me1)
+${na me1}
${${name1} != {}?name 1 defined, |$name1|$name2|}
${ ${name1} != {}?name 1 defined, |$name1|$name2|}
${ ${name1} ?name 1 defined, |$name1|$name2|}
diff --git a/external/ibm-public/postfix/dist/src/util/mac_expand.ref b/external/ibm-public/postfix/dist/src/util/mac_expand.ref
index 973dc50ba5a..9ffcb410fa4 100644
--- a/external/ibm-public/postfix/dist/src/util/mac_expand.ref
+++ b/external/ibm-public/postfix/dist/src/util/mac_expand.ref
@@ -1,19 +1,30 @@
<< name1 = name1-value
<<
+<< $name1
+stat=0 result=name1-value
<< $(name1
unknown: warning: truncated macro reference: "$(name1"
stat=1 result=
-<< $(name )
-unknown: warning: attribute name syntax error at: "...name>>> "
+<< $(name1)
+stat=0 result=name1-value
+<< $( name1)
+stat=0 result=name1-value
+<< $(name1 )
+stat=0 result=name1-value
+<< $(na me1)
+unknown: warning: attribute name syntax error at: "...na>>> me1"
+stat=1 result=
+<< ${na me1}
+unknown: warning: attribute name syntax error at: "...na>>> me1"
stat=1 result=
<< ${${name1} != {}?name 1 defined, |$name1|$name2|}
unknown: warning: attribute name syntax error at: "...>>>${name1} != {}?name "
stat=1 result=
<< ${ ${name1} != {}?name 1 defined, |$name1|$name2|}
-unknown: warning: attribute name syntax error at: "...>>> ${name1} != {}?name"
+unknown: warning: attribute name syntax error at: "... >>>${name1} != {}?name "
stat=1 result=
<< ${ ${name1} ?name 1 defined, |$name1|$name2|}
-unknown: warning: attribute name syntax error at: "...>>> ${name1} ?name 1 de"
+unknown: warning: attribute name syntax error at: "... >>>${name1} ?name 1 def"
stat=1 result=
<< ${{$name1} ? {name 1 defined, |$name1|$name2|} : {name 1 undefined, |$name1|$name2|} }
unknown: warning: "==" or "!="" or "<"" or "<="" or ">="" or ">" expected at: "...$name1}>>>? {name 1 defined, |"
@@ -51,16 +62,13 @@ stat=1 result=
unknown: warning: "==" or "!="" or "<"" or "<="" or ">="" or ">" expected at: "...text}>>>= {}"
stat=1 result=
<< ${{${ name1}} == {}}
-unknown: warning: attribute name syntax error at: "...>>> name1"
-stat=1 result=
+stat=0 result=
<< ${name1?{${ name1}}:{${name2}}}
-unknown: warning: attribute name syntax error at: "...>>> name1"
-stat=1 result=
+stat=0 result=name1-value
<< ${name2?{${ name1}}:{${name2}}}
stat=2 result=
<< ${name2?{${name1}}:{${ name2}}}
-unknown: warning: attribute name syntax error at: "...>>> name2"
-stat=1 result=
+stat=2 result=
<< ${name2:{${name1}}:{${name2}}}
unknown: warning: unexpected input at: "...${name1}}>>>:{${name2}}"
stat=1 result=name1-value
diff --git a/external/ibm-public/postfix/dist/src/util/midna_domain_test.ref b/external/ibm-public/postfix/dist/src/util/midna_domain_test.ref
index 17e4fcc6804..c1db0bdf711 100644
--- a/external/ibm-public/postfix/dist/src/util/midna_domain_test.ref
+++ b/external/ibm-public/postfix/dist/src/util/midna_domain_test.ref
@@ -1,11 +1,11 @@
./midna_domain: > # Upper-case greek -> lower-case greek.
./midna_domain: > Δημοσθένους.example.com
./midna_domain: unconditional conversions:
-./midna_domain: "Δημοσθένους.example.com" ->utf8 "δημοσθένουσ.example.com"
-./midna_domain: "Δημοσθένους.example.com" ->ascii "xn--ixanjetild6aev.example.com"
+./midna_domain: "Δημοσθένους.example.com" ->utf8 "δημοσθένους.example.com"
+./midna_domain: "Δημοσθένους.example.com" ->ascii "xn--ixanjetild1af0a.example.com"
./midna_domain: conditional conversions:
-./midna_domain: "Δημοσθένους.example.com" ->ascii "xn--ixanjetild6aev.example.com" ->utf8 "δημοσθένουσ.example.com"
-./midna_domain: warning: "Δημοσθένους.example.com" != "δημοσθένουσ.example.com"
+./midna_domain: "Δημοσθένους.example.com" ->ascii "xn--ixanjetild1af0a.example.com" ->utf8 "δημοσθένους.example.com"
+./midna_domain: warning: "Δημοσθένους.example.com" != "δημοσθένους.example.com"
./midna_domain: > # Upper-case ASCII -> lower-case ASCII.
./midna_domain: > Hello.example.com
./midna_domain: unconditional conversions:
@@ -17,22 +17,22 @@
./midna_domain: > # Invalid LDH label('-' at begin or end).
./midna_domain: > bad-.example.com
./midna_domain: unconditional conversions:
-./midna_domain: warning: midna_domain_to_utf8_create: Problem translating domain "bad-.example.com" to UTF8 form: U_UNSUPPORTED_ERROR
+./midna_domain: warning: midna_domain_to_utf8_create: Problem translating domain "bad-.example.com" to UTF8 form: UIDNA_ERROR_TRAILING_HYPHEN
./midna_domain: "bad-.example.com" ->utf8 "(error)"
-./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "bad-.example.com" to ASCII form: U_UNSUPPORTED_ERROR
+./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "bad-.example.com" to ASCII form: UIDNA_ERROR_TRAILING_HYPHEN
./midna_domain: "bad-.example.com" ->ascii "(error)"
./midna_domain: conditional conversions:
./midna_domain: > -bad.example.com
./midna_domain: unconditional conversions:
-./midna_domain: warning: midna_domain_to_utf8_create: Problem translating domain "-bad.example.com" to UTF8 form: U_INDEX_OUTOFBOUNDS_ERROR
+./midna_domain: warning: midna_domain_to_utf8_create: Problem translating domain "-bad.example.com" to UTF8 form: UIDNA_ERROR_LEADING_HYPHEN
./midna_domain: "-bad.example.com" ->utf8 "(error)"
-./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "-bad.example.com" to ASCII form: U_INDEX_OUTOFBOUNDS_ERROR
+./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "-bad.example.com" to ASCII form: UIDNA_ERROR_LEADING_HYPHEN
./midna_domain: "-bad.example.com" ->ascii "(error)"
./midna_domain: conditional conversions:
./midna_domain: > # Invalid LDH (label > 63 bytes).
./midna_domain: > abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789.example.com
./midna_domain: unconditional conversions:
-./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789.example.com" to ASCII form: U_MISSING_RESOURCE_ERROR
+./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789.example.com" to ASCII form: UIDNA_ERROR_LABEL_TOO_LONG
./midna_domain: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789.example.com" ->utf8 "(error)"
./midna_domain: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789.example.com" ->ascii "(error)"
./midna_domain: conditional conversions:
@@ -46,7 +46,7 @@
./midna_domain: > # Invalid name (length > 255 bytes).
./midna_domain: > abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.example.com
./midna_domain: unconditional conversions:
-./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcde" to ASCII form: U_FILE_ACCESS_ERROR
+./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcde" to ASCII form: UIDNA_ERROR_DOMAIN_NAME_TOO_LONG
./midna_domain: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.example.com" ->utf8 "(error)"
./midna_domain: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567.example.com" ->ascii "(error)"
./midna_domain: conditional conversions:
@@ -82,8 +82,8 @@
./midna_domain: > # Bad a-label.
./midna_domain: > xn--123456.example.com
./midna_domain: unconditional conversions:
-./midna_domain: warning: midna_domain_to_utf8_create: Problem translating domain "xn--123456.example.com" to UTF8 form: [BOGUS UErrorCode]
+./midna_domain: warning: midna_domain_to_utf8_create: Problem translating domain "xn--123456.example.com" to UTF8 form: UIDNA_ERROR_PUNYCODE
./midna_domain: "xn--123456.example.com" ->utf8 "(error)"
-./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "xn--123456.example.com" to ASCII form: [BOGUS UErrorCode]
+./midna_domain: warning: midna_domain_to_ascii_create: Problem translating domain "xn--123456.example.com" to ASCII form: UIDNA_ERROR_PUNYCODE
./midna_domain: "xn--123456.example.com" ->ascii "(error)"
./midna_domain: conditional conversions:
diff --git a/external/ibm-public/postfix/dist/src/util/miss_endif_cidr.map b/external/ibm-public/postfix/dist/src/util/miss_endif_cidr.map
new file mode 100644
index 00000000000..7c882081c98
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/miss_endif_cidr.map
@@ -0,0 +1 @@
+if 1.2.3.4
diff --git a/external/ibm-public/postfix/dist/src/util/miss_endif_cidr.ref b/external/ibm-public/postfix/dist/src/util/miss_endif_cidr.ref
new file mode 100644
index 00000000000..df5dc6cd30b
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/miss_endif_cidr.ref
@@ -0,0 +1,4 @@
+./dict_open: warning: cidr map miss_endif_cidr.map, line 1: IF has no matching ENDIF
+owner=untrusted (uid=USER)
+> get 1.2.3.5
+1.2.3.5: not found
diff --git a/external/ibm-public/postfix/dist/src/util/miss_endif_pcre.ref b/external/ibm-public/postfix/dist/src/util/miss_endif_pcre.ref
new file mode 100644
index 00000000000..21d74024b93
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/miss_endif_pcre.ref
@@ -0,0 +1,4 @@
+./dict_open: warning: pcre map miss_endif_re.map, line 1: IF has no matching ENDIF
+owner=untrusted (uid=USER)
+> get 1.2.3.5
+1.2.3.5: not found
diff --git a/external/ibm-public/postfix/dist/src/util/miss_endif_re.map b/external/ibm-public/postfix/dist/src/util/miss_endif_re.map
new file mode 100644
index 00000000000..b085ecb8846
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/miss_endif_re.map
@@ -0,0 +1 @@
+if /foo/
diff --git a/external/ibm-public/postfix/dist/src/util/miss_endif_regexp.ref b/external/ibm-public/postfix/dist/src/util/miss_endif_regexp.ref
new file mode 100644
index 00000000000..f77f95aff5b
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/miss_endif_regexp.ref
@@ -0,0 +1,4 @@
+./dict_open: warning: regexp map miss_endif_re.map, line 1: IF has no matching ENDIF
+owner=untrusted (uid=USER)
+> get 1.2.3.5
+1.2.3.5: not found
diff --git a/external/ibm-public/postfix/dist/src/util/msg_logger.c b/external/ibm-public/postfix/dist/src/util/msg_logger.c
new file mode 100644
index 00000000000..75a74e72fc8
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/msg_logger.c
@@ -0,0 +1,373 @@
+/* $NetBSD: msg_logger.c,v 1.1.1.1 2020/03/18 18:59:38 christos Exp $ */
+
+/*++
+/* NAME
+/* msg_logger 3
+/* SUMMARY
+/* direct diagnostics to logger service
+/* SYNOPSIS
+/* #include <msg_logger.h>
+/*
+/* void msg_logger_init(
+/* const char *progname,
+/* const char *hostname,
+/* const char *unix_path,
+/* void (*fallback)(const char *))
+/*
+/* void msg_logger_control(
+/* int key,...)
+/* DESCRIPTION
+/* This module implements support to report msg(3) diagnostics
+/* through a logger daemon, with an optional fallback mechanism.
+/* The log record format is like traditional syslog:
+/*
+/* .nf
+/* Mmm dd host progname[pid]: text...
+/* .fi
+/*
+/* msg_logger_init() arranges that subsequent msg(3) calls
+/* will write to an internal logging service. This function
+/* may also be used to update msg_logger settings.
+/*
+/* Arguments:
+/* .IP progname
+/* The program name that is prepended to a log record.
+/* .IP hostname
+/* The host name that is prepended to a log record. Only the
+/* first hostname label will be used.
+/* .IP unix_path
+/* Pathname of a unix-domain datagram service endpoint. A
+/* typical use case is the pathname of the postlog socket.
+/* .IP fallback
+/* Null pointer, or pointer to function that will be called
+/* with a formatted message when the logger service is not
+/* (yet) available. A typical use case is to pass the record
+/* to the logwriter(3) module.
+/* .PP
+/* msg_logger_control() makes adjustments to the msg_logger
+/* client. These adjustments remain in effect until the next
+/* msg_logger_init() or msg_logger_control() call. The arguments
+/* are a list of macros with zero or more arguments, terminated
+/* with CA_MSG_LOGGER_CTL_END which has none. The following
+/* lists the names and the types of the corresponding value
+/* arguments.
+/*
+/* Arguments:
+/* .IP CA_MSG_LOGGER_CTL_FALLBACK_ONLY
+/* Disable the logging socket, and use the fallback function
+/* only. This remains in effect until the next msg_logger_init()
+/* call.
+/* .IP CA_MSG_LOGGER_CTL_FALLBACK(void (*)(const char *))
+/* Override the fallback setting (see above) with the specified
+/* function pointer. This remains in effect until the next
+/* msg_logger_init() or msg_logger_control() call.
+/* .IP CA_MSG_LOGGER_CTL_DISABLE
+/* Disable the msg_logger. This remains in effect until the
+/* next msg_logger_init() call.
+/* .IP CA_MSG_LOGGER_CTL_CONNECT_NOW
+/* Close the logging socket if it was already open, and open
+/* the logging socket now, if permitted by current settings.
+/* Otherwise, the open is delayed until a logging request.
+/* SEE ALSO
+/* msg(3) diagnostics module
+/* BUGS
+/* Output records are truncated to ~2000 characters, because
+/* unlimited logging is a liability.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System libraries.
+ */
+#include <sys_defs.h>
+#include <sys/socket.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+ /*
+ * Application-specific.
+ */
+#include <connect.h>
+#include <logwriter.h>
+#include <msg.h>
+#include <msg_logger.h>
+#include <msg_output.h>
+#include <mymalloc.h>
+#include <safe.h>
+#include <vstream.h>
+#include <vstring.h>
+
+ /*
+ * Saved state from msg_logger_init().
+ */
+static char *msg_logger_progname;
+static char *msg_logger_hostname;
+static char *msg_logger_unix_path;
+static void (*msg_logger_fallback_fn) (const char *);
+static int msg_logger_fallback_only_override = 0;
+static int msg_logger_enable = 0;
+
+#define MSG_LOGGER_NEED_SOCKET() (msg_logger_fallback_only_override == 0)
+
+ /*
+ * Other state.
+ */
+#define MSG_LOGGER_SOCK_NONE (-1)
+
+static VSTRING *msg_logger_buf;
+static int msg_logger_sock = MSG_LOGGER_SOCK_NONE;
+
+ /*
+ * Safety limit.
+ */
+#define MSG_LOGGER_RECLEN 2000
+
+ /*
+ * SLMs.
+ */
+#define STR(x) vstring_str(x)
+#define LEN(x) VSTRING_LEN(x)
+
+/* msg_logger_connect - connect to logger service */
+
+static void msg_logger_connect(void)
+{
+ if (msg_logger_sock == MSG_LOGGER_SOCK_NONE) {
+ msg_logger_sock = unix_dgram_connect(msg_logger_unix_path, BLOCKING);
+ if (msg_logger_sock >= 0)
+ close_on_exec(msg_logger_sock, CLOSE_ON_EXEC);
+ }
+}
+
+/* msg_logger_disconnect - disconnect from logger service */
+
+static void msg_logger_disconnect(void)
+{
+ if (msg_logger_sock != MSG_LOGGER_SOCK_NONE) {
+ (void) close(msg_logger_sock);
+ msg_logger_sock = MSG_LOGGER_SOCK_NONE;
+ }
+}
+
+/* msg_logger_print - log info to service or file */
+
+static void msg_logger_print(int level, const char *text)
+{
+ time_t now;
+ struct tm *lt;
+ ssize_t len;
+
+ /*
+ * This test is simple enough that we don't bother with unregistering the
+ * msg_logger_print() function.
+ */
+ if (msg_logger_enable == 0)
+ return;
+
+ /*
+ * TODO: this should be a reusable NAME_CODE table plus lookup function.
+ */
+ static int log_level[] = {
+ MSG_INFO, MSG_WARN, MSG_ERROR, MSG_FATAL, MSG_PANIC,
+ };
+ static char *severity_name[] = {
+ "info", "warning", "error", "fatal", "panic",
+ };
+
+ /*
+ * Note: there is code in postlogd(8) that attempts to strip off
+ * information that is prepended here. If the formatting below is
+ * changed, then postlogd needs to be updated as well.
+ */
+
+ /*
+ * Format the time stamp.
+ */
+ if (time(&now) < 0)
+ msg_fatal("no time: %m");
+ lt = localtime(&now);
+ VSTRING_RESET(msg_logger_buf);
+ if ((len = strftime(vstring_str(msg_logger_buf),
+ vstring_avail(msg_logger_buf),
+ "%b %d %H:%M:%S ", lt)) == 0)
+ msg_fatal("strftime: %m");
+ vstring_set_payload_size(msg_logger_buf, len);
+
+ /*
+ * Format the host name (first name label only).
+ */
+ vstring_sprintf_append(msg_logger_buf, "%.*s ",
+ (int) strcspn(msg_logger_hostname, "."),
+ msg_logger_hostname);
+
+ /*
+ * Format the message.
+ */
+ if (level < 0 || level >= (int) (sizeof(log_level) / sizeof(log_level[0])))
+ msg_panic("msg_logger_print: invalid severity level: %d", level);
+
+ if (level == MSG_INFO) {
+ vstring_sprintf_append(msg_logger_buf, "%s[%ld]: %.*s",
+ msg_logger_progname, (long) getpid(),
+ (int) MSG_LOGGER_RECLEN, text);
+ } else {
+ vstring_sprintf_append(msg_logger_buf, "%s[%ld]: %s: %.*s",
+ msg_logger_progname, (long) getpid(),
+ severity_name[level], (int) MSG_LOGGER_RECLEN, text);
+ }
+
+ /*
+ * Connect to logging service, or fall back to direct log. Many systems
+ * will report ENOENT if the endpoint does not exist, ECONNREFUSED if no
+ * server has opened the endpoint.
+ */
+ if (MSG_LOGGER_NEED_SOCKET())
+ msg_logger_connect();
+ if (msg_logger_sock != MSG_LOGGER_SOCK_NONE) {
+ send(msg_logger_sock, STR(msg_logger_buf), LEN(msg_logger_buf), 0);
+ } else if (msg_logger_fallback_fn) {
+ msg_logger_fallback_fn(STR(msg_logger_buf));
+ }
+}
+
+/* msg_logger_init - initialize */
+
+void msg_logger_init(const char *progname, const char *hostname,
+ const char *unix_path, void (*fallback) (const char *))
+{
+ static int first_call = 1;
+ extern char **environ;
+
+ /*
+ * XXX If this program is set-gid, then TZ must not be trusted. This
+ * scrubbing code is in the wrong place.
+ */
+ if (first_call) {
+ if (unsafe())
+ while (getenv("TZ")) /* There may be multiple. */
+ if (unsetenv("TZ") < 0) { /* Desperate measures. */
+ environ[0] = 0;
+ msg_fatal("unsetenv: %m");
+ }
+ tzset();
+ }
+
+ /*
+ * Save the request info. Use free-after-update because this data will be
+ * accessed when mystrdup() runs out of memory.
+ */
+#define UPDATE_AND_FREE(dst, src) do { \
+ if ((dst) == 0 || strcmp((dst), (src)) != 0) { \
+ char *_bak = (dst); \
+ (dst) = mystrdup(src); \
+ if ((_bak)) myfree(_bak); \
+ } \
+ } while (0)
+
+ UPDATE_AND_FREE(msg_logger_progname, progname);
+ UPDATE_AND_FREE(msg_logger_hostname, hostname);
+ UPDATE_AND_FREE(msg_logger_unix_path, unix_path);
+ msg_logger_fallback_fn = fallback;
+
+ /*
+ * One-time activity: register the output handler, and allocate a buffer.
+ */
+ if (first_call) {
+ first_call = 0;
+ msg_output(msg_logger_print);
+ msg_logger_buf = vstring_alloc(2048);
+ }
+
+ /*
+ * Always.
+ */
+ msg_logger_enable = 1;
+ msg_logger_fallback_only_override = 0;
+}
+
+/* msg_logger_control - tweak the client */
+
+void msg_logger_control(int name,...)
+{
+ const char *myname = "msg_logger_control";
+ va_list ap;
+
+ /*
+ * Overrides remain in effect until the next msg_logger_init() or
+ * msg_logger_control() call,
+ */
+ for (va_start(ap, name); name != MSG_LOGGER_CTL_END; name = va_arg(ap, int)) {
+ switch (name) {
+ case MSG_LOGGER_CTL_FALLBACK_ONLY:
+ msg_logger_fallback_only_override = 1;
+ msg_logger_disconnect();
+ break;
+ case MSG_LOGGER_CTL_FALLBACK_FN:
+ msg_logger_fallback_fn = va_arg(ap, MSG_LOGGER_FALLBACK_FN);
+ break;
+ case MSG_LOGGER_CTL_DISABLE:
+ msg_logger_enable = 0;
+ break;
+ case MSG_LOGGER_CTL_CONNECT_NOW:
+ msg_logger_disconnect();
+ if (MSG_LOGGER_NEED_SOCKET())
+ msg_logger_connect();
+ break;
+ default:
+ msg_panic("%s: bad name %d", myname, name);
+ }
+ }
+ va_end(ap);
+}
+
+#ifdef TEST
+
+ /*
+ * Proof-of-concept program to test the msg_logger module.
+ *
+ * Usage: msg_logger hostname unix_path fallback_path text...
+ */
+static char *fallback_path;
+
+static void fallback(const char *msg)
+{
+ if (logwriter_one_shot(fallback_path, msg) != 0)
+ msg_fatal("unable to fall back to directly write %s: %m",
+ fallback_path);
+}
+
+int main(int argc, char **argv)
+{
+ VSTRING *vp = vstring_alloc(256);
+
+ if (argc < 4)
+ msg_fatal("usage: %s host port path text to log", argv[0]);
+ msg_logger_init(argv[0], argv[1], argv[2], fallback);
+ fallback_path = argv[3];
+ argc -= 3;
+ argv += 3;
+ while (--argc && *++argv) {
+ vstring_strcat(vp, *argv);
+ if (argv[1])
+ vstring_strcat(vp, " ");
+ }
+ msg_warn("static text");
+ msg_warn("dynamic text: >%s<", vstring_str(vp));
+ msg_warn("dynamic numeric: >%d<", 42);
+ msg_warn("error text: >%m<");
+ msg_warn("dynamic: >%s<: error: >%m<", vstring_str(vp));
+ vstring_free(vp);
+ return (0);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/util/msg_logger.h b/external/ibm-public/postfix/dist/src/util/msg_logger.h
new file mode 100644
index 00000000000..68d5a098604
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/msg_logger.h
@@ -0,0 +1,64 @@
+/* $NetBSD: msg_logger.h,v 1.1.1.1 2020/03/18 18:59:38 christos Exp $ */
+
+#ifndef _MSG_LOGGER_H_INCLUDED_
+#define _MSG_LOGGER_H_INCLUDED_
+
+/*++
+/* NAME
+/* msg_logger 3h
+/* SUMMARY
+/* direct diagnostics to logger service
+/* SYNOPSIS
+/* #include <msg_logger.h>
+/* DESCRIPTION
+/* .nf
+
+ /*
+ * System library.
+ */
+#include <stdarg.h>
+
+ /*
+ * Utility library.
+ */
+#include <check_arg.h>
+
+ /*
+ * External interface.
+ */
+typedef void (*MSG_LOGGER_FALLBACK_FN) (const char *);
+
+extern void msg_logger_init(const char *, const char *, const char *,
+ MSG_LOGGER_FALLBACK_FN);
+extern void msg_logger_control(int,...);
+
+/* Internal-only API: type-unchecked arguments. */
+#define MSG_LOGGER_CTL_END 0
+#define MSG_LOGGER_CTL_FALLBACK_ONLY 1
+#define MSG_LOGGER_CTL_FALLBACK_FN 2
+#define MSG_LOGGER_CTL_DISABLE 3
+#define MSG_LOGGER_CTL_CONNECT_NOW 4
+
+/* Safer API: type-checked arguments, external use. */
+#define CA_MSG_LOGGER_CTL_END MSG_LOGGER_CTL_END
+#define CA_MSG_LOGGER_CTL_FALLBACK_ONLY MSG_LOGGER_CTL_FALLBACK_ONLY
+#define CA_MSG_LOGGER_CTL_FALLBACK_FN(v) \
+ MSG_LOGGER_CTL_FALLBACK_FN, CHECK_VAL(MSG_LOGGER_CTL, \
+ MSG_LOGGER_FALLBACK_FN, (v))
+#define CA_MSG_LOGGER_CTL_DISABLE MSG_LOGGER_CTL_DISABLE
+#define CA_MSG_LOGGER_CTL_CONNECT_NOW MSG_LOGGER_CTL_CONNECT_NOW
+
+CHECK_VAL_HELPER_DCL(MSG_LOGGER_CTL, MSG_LOGGER_FALLBACK_FN);
+
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/util/msg_syslog.c b/external/ibm-public/postfix/dist/src/util/msg_syslog.c
index 383a7afeb20..00b7079b9ac 100644
--- a/external/ibm-public/postfix/dist/src/util/msg_syslog.c
+++ b/external/ibm-public/postfix/dist/src/util/msg_syslog.c
@@ -1,4 +1,4 @@
-/* $NetBSD: msg_syslog.c,v 1.1.1.1 2009/06/23 10:09:00 tron Exp $ */
+/* $NetBSD: msg_syslog.c,v 1.1.1.2 2020/03/18 18:59:38 christos Exp $ */
/*++
/* NAME
@@ -13,18 +13,26 @@
/* int log_opt;
/* int facility;
/*
-/* int msg_syslog_facility(facility_name)
+/* int msg_syslog_set_facility(facility_name)
/* const char *facility_name;
+/*
+/* void msg_syslog_disable(void)
/* DESCRIPTION
/* This module implements support to report msg(3) diagnostics
/* via the syslog daemon.
/*
/* msg_syslog_init() is a wrapper around the openlog(3) routine
/* that directs subsequent msg(3) output to the syslog daemon.
+/* This function may also be called to update msg_syslog
+/* settings. If the program name appears to contain a process ID
+/* then msg_syslog_init will attempt to suppress its own PID.
/*
-/* msg_syslog_facility() is a helper routine that overrides the
+/* msg_syslog_set_facility() is a helper routine that overrides the
/* logging facility that is specified with msg_syslog_init().
/* The result is zero in case of an unknown facility name.
+/*
+/* msg_syslog_disable() turns off the msg_syslog client,
+/* until a subsequent msg_syslog_init() call.
/* SEE ALSO
/* syslog(3) syslog library
/* msg(3) diagnostics module
@@ -41,6 +49,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System libraries. */
@@ -61,6 +74,7 @@
#include "msg_output.h"
#include "msg_syslog.h"
#include "safe.h"
+#include <mymalloc.h>
/*
* Stay a little below the 2048-byte limit of older syslog()
@@ -140,7 +154,8 @@ static struct facility_list facility_list[] = {
0,
};
-static int syslog_facility;
+static int msg_syslog_facility;
+static int msg_syslog_enable;
/* msg_syslog_print - log info to syslog daemon */
@@ -153,14 +168,17 @@ static void msg_syslog_print(int level, const char *text)
"info", "warning", "error", "fatal", "panic",
};
+ if (msg_syslog_enable == 0)
+ return;
+
if (level < 0 || level >= (int) (sizeof(log_level) / sizeof(log_level[0])))
msg_panic("msg_syslog_print: invalid severity level: %d", level);
if (level == MSG_INFO) {
- syslog(syslog_facility | log_level[level], "%.*s",
+ syslog(msg_syslog_facility | log_level[level], "%.*s",
(int) MSG_SYSLOG_RECLEN, text);
} else {
- syslog(syslog_facility | log_level[level], "%s: %.*s",
+ syslog(msg_syslog_facility | log_level[level], "%s: %.*s",
severity_name[level], (int) MSG_SYSLOG_RECLEN, text);
}
}
@@ -170,36 +188,54 @@ static void msg_syslog_print(int level, const char *text)
void msg_syslog_init(const char *name, int logopt, int facility)
{
static int first_call = 1;
+ extern char **environ;
/*
* XXX If this program is set-gid, then TZ must not be trusted. This
* scrubbing code is in the wrong place.
*/
- if (unsafe())
- putenv("TZ=UTC");
- tzset();
+ if (first_call) {
+ if (unsafe())
+ while (getenv("TZ")) /* There may be multiple. */
+ if (unsetenv("TZ") < 0) { /* Desperate measures. */
+ environ[0] = 0;
+ msg_fatal("unsetenv: %m");
+ }
+ tzset();
+ }
+ /* Hack for internal logging forwarding after config change. */
+ if (strchr(name, '[') != 0)
+ logopt &= ~LOG_PID;
openlog(name, LOG_NDELAY | logopt, facility);
if (first_call) {
first_call = 0;
msg_output(msg_syslog_print);
}
+ msg_syslog_enable = 1;
}
-/* msg_syslog_facility - set logging facility by name */
+/* msg_syslog_set_facility - set logging facility by name */
-int msg_syslog_facility(const char *facility_name)
+int msg_syslog_set_facility(const char *facility_name)
{
struct facility_list *fnp;
for (fnp = facility_list; fnp->name; ++fnp) {
if (!strcmp(fnp->name, facility_name)) {
- syslog_facility = fnp->facility;
+ msg_syslog_facility = fnp->facility;
return (1);
}
}
return 0;
}
+/* msg_syslog_disable - disable the msg_syslog client */
+
+void msg_syslog_disable(void)
+{
+ msg_syslog_enable = 0;
+}
+
#ifdef TEST
/*
diff --git a/external/ibm-public/postfix/dist/src/util/split_qnameval.c b/external/ibm-public/postfix/dist/src/util/split_qnameval.c
new file mode 100644
index 00000000000..6fbd8731ade
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/split_qnameval.c
@@ -0,0 +1,170 @@
+/* $NetBSD: split_qnameval.c,v 1.1.1.1 2020/03/18 18:59:38 christos Exp $ */
+
+/*++
+/* NAME
+/* split_qnameval 3
+/* SUMMARY
+/* name-value splitter
+/* SYNOPSIS
+/* #include <stringops.h>
+/*
+/* const char *split_qnameval(buf, name, value)
+/* char *buf;
+/* char **name;
+/* char **value;
+/* DESCRIPTION
+/* split_qnameval() expects text of the form "key = value"
+/* or "key =", where the key may be quoted with backslash or
+/* double quotes. The buffer argument is broken up into the key
+/* and value substrings.
+/*
+/* Arguments:
+/* .IP buf
+/* Result from readlline() or equivalent. The buffer is modified.
+/* .IP key
+/* Upon successful completion, this is set to the key
+/* substring.
+/* .IP value
+/* Upon successful completion, this is set to the value
+/* substring.
+/* SEE ALSO
+/* split_nameval(3) name-value splitter
+/* BUGS
+/* DIAGNOSTICS
+/* The result is a null pointer in case of success, a string
+/* describing the error otherwise: missing '=' after attribute
+/* name; missing attribute name.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+/* System libraries. */
+
+#include <sys_defs.h>
+#include <ctype.h>
+#include <string.h>
+
+/* Utility library. */
+
+#include <msg.h>
+#include <stringops.h>
+
+/* split_qnameval - split "key = value", support quoted key */
+
+const char *split_qnameval(char *buf, char **pkey, char **pvalue)
+{
+ int in_quotes = 0;
+ char *key;
+ char *key_end;
+ char *value;
+
+ for (key = buf; *key && ISSPACE(*key); key++)
+ /* void */ ;
+ if (*key == 0)
+ return ("no key found; expected format: key = value");
+
+ for (key_end = key; *key_end; key_end++) {
+ if (*key_end == '\\') {
+ if (*++key_end == 0)
+ break;
+ } else if (ISSPACE(*key_end) || *key_end == '=') {
+ if (!in_quotes)
+ break;
+ } else if (*key_end == '"') {
+ in_quotes = !in_quotes;
+ }
+ }
+ if (in_quotes) {
+ return ("unbalanced '\"\'");
+ }
+ value = key_end;
+ while (ISSPACE(*value))
+ value++;
+ if (*value != '=')
+ return ("missing '=' after attribute name");
+ *key_end = 0;
+ do {
+ value++;
+ } while (ISSPACE(*value));
+ trimblanks(value, 0)[0] = 0;
+ *pkey = key;
+ *pvalue = value;
+ return (0);
+}
+
+#ifdef TEST
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+#include <mymalloc.h>
+
+static int compare(int test_number, const char *what,
+ const char *expect, const char *real)
+{
+ if ((expect == 0 && real == 0)
+ || (expect != 0 && real != 0 && strcmp(expect, real) == 0)) {
+ return (0);
+ } else {
+ msg_warn("test %d: %s mis-match: expect='%s', real='%s'",
+ test_number, what, expect ? expect : "(null)",
+ real ? real : "(null)");
+ return (1);
+ }
+}
+
+int main(int argc, char **argv)
+{
+ struct test_info {
+ const char *input;
+ const char *expect_result;
+ const char *expect_key;
+ const char *expect_value;
+ };
+ static const struct test_info test_info[] = {
+ /* Unquoted keys. */
+ {"xx = yy", 0, "xx", "yy"},
+ {"xx=yy", 0, "xx", "yy"},
+ {"xx =", 0, "xx", ""},
+ {"xx=", 0, "xx", ""},
+ {"xx", "missing '=' after attribute name", 0, 0},
+ /* Quoted keys. */
+ {"\"xx \" = yy", 0, "\"xx \"", "yy"},
+ {"\"xx \"= yy", 0, "\"xx \"", "yy"},
+ {"\"xx \" =", 0, "\"xx \"", ""},
+ {"\"xx \"=", 0, "\"xx \"", ""},
+ {"\"xx \"", "missing '=' after attribute name", 0, 0},
+ {"\"xx ", "unbalanced '\"'", 0, 0},
+ /* Backslash escapes. */
+ {"\"\\\"xx \" = yy", 0, "\"\\\"xx \"", "yy"},
+ {0,},
+ };
+
+ int errs = 0;
+ const struct test_info *tp;
+
+ for (tp = test_info; tp->input != 0; tp++) {
+ const char *result;
+ char *key = 0;
+ char *value = 0;
+ char *buf = mystrdup(tp->input);
+ int test_number = (int) (tp - test_info);
+
+ result = split_qnameval(buf, &key, &value);
+ errs += compare(test_number, "result", tp->expect_result, result);
+ errs += compare(test_number, "key", tp->expect_key, key);
+ errs += compare(test_number, "value", tp->expect_value, value);
+ myfree(buf);
+ }
+ exit(errs);
+}
+
+#endif
diff --git a/external/ibm-public/postfix/dist/src/util/unix_dgram_connect.c b/external/ibm-public/postfix/dist/src/util/unix_dgram_connect.c
new file mode 100644
index 00000000000..1c50ba59cde
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/unix_dgram_connect.c
@@ -0,0 +1,93 @@
+/* $NetBSD: unix_dgram_connect.c,v 1.1.1.1 2020/03/18 18:59:38 christos Exp $ */
+
+/*++
+/* NAME
+/* unix_dgram_connect 3
+/* SUMMARY
+/* connect to UNIX-domain datagram server
+/* SYNOPSIS
+/* #include <connect.h>
+/*
+/* int unix_dgram_connect(
+/* const char *path,
+/* int block_mode)
+/* DESCRIPTION
+/* unix_dgram_connect() connects to the specified UNIX-domain
+/* datagram server, and returns the resulting file descriptor.
+/*
+/* Arguments:
+/* .IP path
+/* Null-terminated string with connection destination.`
+/* .IP block_mode
+/* Either NON_BLOCKING for a non-blocking socket, or BLOCKING for
+/* blocking mode.
+/* DIAGNOSIICS
+/* Fatal errors: path too large, can't create socket.
+/*
+/* Other errors result in a -1 result value, with errno indicating
+/* why the service is unavailable.
+/* .sp
+/* ENOENT: the named socket does not exist.
+/* .sp
+/* ECONNREFUSED: the named socket is not open.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+#include <string.h>
+
+ /*
+ * Utility library.
+ */
+#include <msg.h>
+#include <connect.h>
+#include <iostuff.h>
+
+/* unix_dgram_connect - connect to UNIX-domain datagram service */
+
+int unix_dgram_connect(const char *path, int block_mode)
+{
+ const char myname[] = "unix_dgram_connect";
+#undef sun
+ struct sockaddr_un sun;
+ ssize_t path_len;
+ int sock;
+
+ /*
+ * Translate address information to internal form.
+ */
+ if ((path_len = strlen(path)) >= sizeof(sun.sun_path))
+ msg_fatal("%s: unix-domain name too long: %s", myname, path);
+ memset((void *) &sun, 0, sizeof(sun));
+ sun.sun_family = AF_UNIX;
+#ifdef HAS_SUN_LEN
+ sun.sun_len = path_len + 1;
+#endif
+ memcpy(sun.sun_path, path, path_len + 1);
+
+ /*
+ * Create a client socket.
+ */
+ if ((sock = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0)
+ msg_fatal("%s: socket: %m", myname);
+ if (connect(sock, (struct sockaddr *) &sun, sizeof(sun)) < 0) {
+ close(sock);
+ return (-1);
+ }
+ non_blocking(sock, block_mode);
+ return (sock);
+}
diff --git a/external/ibm-public/postfix/dist/src/util/unix_dgram_listen.c b/external/ibm-public/postfix/dist/src/util/unix_dgram_listen.c
new file mode 100644
index 00000000000..233745b1aa2
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/unix_dgram_listen.c
@@ -0,0 +1,95 @@
+/* $NetBSD: unix_dgram_listen.c,v 1.1.1.1 2020/03/18 18:59:38 christos Exp $ */
+
+/*++
+/* NAME
+/* unix_dgram_listen 3
+/* SUMMARY
+/* listen to UNIX-domain datagram server
+/* SYNOPSIS
+/* #include <listen.h>
+/*
+/* int unix_dgram_listen(
+/* const char *path,
+/* int block_mode)
+/* DESCRIPTION
+/* unix_dgram_listen() binds to the specified UNIX-domain
+/* datagram endpoint, and returns the resulting file descriptor.
+/*
+/* Arguments:
+/* .IP path
+/* Null-terminated string with connection destination.
+/* .IP backlog
+/* Either NON_BLOCKING for a non-blocking socket, or BLOCKING for
+/* blocking mode.
+/* DIAGNOSIICS
+/* Fatal errors: path too large, can't create socket.
+/* LICENSE
+/* .ad
+/* .fi
+/* The Secure Mailer license must be distributed with this software.
+/* AUTHOR(S)
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
+/*--*/
+
+ /*
+ * System library.
+ */
+#include <sys_defs.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+
+ /*
+ * Utility library.
+ */
+#include <iostuff.h>
+#include <listen.h>
+#include <msg.h>
+
+/* unix_dgram_listen - bind to UNIX-domain datagram endpoint */
+
+int unix_dgram_listen(const char *path, int block_mode)
+{
+ const char myname[] = "unix_dgram_listen";
+#undef sun
+ struct sockaddr_un sun;
+ ssize_t path_len;
+ int sock;
+
+ /*
+ * Translate address information to internal form.
+ */
+ if ((path_len = strlen(path)) >= sizeof(sun.sun_path))
+ msg_fatal("%s: unix-domain name too long: %s", myname, path);
+ memset((void *) &sun, 0, sizeof(sun));
+ sun.sun_family = AF_UNIX;
+#ifdef HAS_SUN_LEN
+ sun.sun_len = path_len + 1;
+#endif
+ memcpy(sun.sun_path, path, path_len + 1);
+
+ /*
+ * Create a 'server' socket.
+ */
+ if ((sock = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0)
+ msg_fatal("%s: socket: %m", myname);
+ if (unlink(path) < 0 && errno != ENOENT)
+ msg_fatal( "remove %s: %m", path);
+ if (bind(sock, (struct sockaddr *) & sun, sizeof(sun)) < 0)
+ msg_fatal( "bind: %s: %m", path);
+#ifdef FCHMOD_UNIX_SOCKETS
+ if (fchmod(sock, 0666) < 0)
+ msg_fatal("fchmod socket %s: %m", path);
+#else
+ if (chmod(path, 0666) < 0)
+ msg_fatal("chmod socket %s: %m", path);
+#endif
+ non_blocking(sock, block_mode);
+ return (sock);
+}
diff --git a/external/ibm-public/postfix/dist/src/util/unsafe.c b/external/ibm-public/postfix/dist/src/util/unsafe.c
index 0f0d0822dee..27e02f32dff 100644
--- a/external/ibm-public/postfix/dist/src/util/unsafe.c
+++ b/external/ibm-public/postfix/dist/src/util/unsafe.c
@@ -1,4 +1,4 @@
-/* $NetBSD: unsafe.c,v 1.1.1.1 2009/06/23 10:09:01 tron Exp $ */
+/* $NetBSD: unsafe.c,v 1.1.1.2 2020/03/18 18:59:38 christos Exp $ */
/*++
/* NAME
@@ -10,13 +10,20 @@
/*
/* int unsafe()
/* DESCRIPTION
-/* The \fBunsafe()\fR routine attempts to determine if the process runs
-/* with any privileges that do not belong to the user. The purpose is
-/* to make it easy to taint any user-provided data such as the current
-/* working directory, the process environment, etcetera.
+/* The \fBunsafe()\fR routine attempts to determine if the process
+/* (runs with privileges or has access to information) that the
+/* controlling user has no access to. The purpose is to prevent
+/* misuse of privileges, including access to protected information.
/*
-/* On UNIX systems, the result is true when any of the following
-/* conditions is true:
+/* The result is always false when both of the following conditions
+/* are true:
+/* .IP \(bu
+/* The real UID is zero.
+/* .IP \(bu
+/* The effective UID is zero.
+/* .PP
+/* Otherwise, the result is true if any of the following conditions
+/* is true:
/* .IP \(bu
/* The issetuid kernel flag is non-zero (on systems that support
/* this concept).
@@ -33,6 +40,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -48,6 +60,17 @@
int unsafe(void)
{
+
+ /*
+ * The super-user is trusted.
+ */
+ if (getuid() == 0 && geteuid() == 0)
+ return (0);
+
+ /*
+ * Danger: don't trust inherited process attributes, and don't leak
+ * privileged info that the parent has no access to.
+ */
return (geteuid() != getuid()
#ifdef HAS_ISSETUGID
|| issetugid()
diff --git a/external/ibm-public/postfix/dist/src/util/vbuf_print_test.in b/external/ibm-public/postfix/dist/src/util/vbuf_print_test.in
new file mode 100644
index 00000000000..5ed13dc1f8f
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/vbuf_print_test.in
@@ -0,0 +1,33 @@
+# Check width and precision.
+%-30.20s 123456789012345678901234567890
+%30.20s 123456789012345678901234567890
+
+%d 123456789
+%+10d 123456789
+%-10d 123456789
+%10d 123456789
+%10.10d 123456789
+
+%+ld 123456789
+%-ld 123456789
+%ld 123456789
+%10ld 123456789
+%10.10ld 123456789
+
+%+lo 123456789
+%-lo 123456789
+%lo 123456789
+%10lo 123456789
+%10.10lo 123456789
+
+%f 1e308
+%.100f 1e308
+%g 1e308
+%.309g 1e308
+
+%s foo
+%0s foo
+%.0s foo
+%10s foo
+%+10s foo
+%-10s foo
diff --git a/external/ibm-public/postfix/dist/src/util/vbuf_print_test.ref b/external/ibm-public/postfix/dist/src/util/vbuf_print_test.ref
new file mode 100644
index 00000000000..346c9199147
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/vbuf_print_test.ref
@@ -0,0 +1,27 @@
+./vbuf_print: "12345678901234567890 "
+./vbuf_print: " 12345678901234567890"
+./vbuf_print: "123456789"
+./vbuf_print: "+123456789"
+./vbuf_print: "123456789 "
+./vbuf_print: " 123456789"
+./vbuf_print: "0123456789"
+./vbuf_print: "+123456789"
+./vbuf_print: "123456789"
+./vbuf_print: "123456789"
+./vbuf_print: " 123456789"
+./vbuf_print: "0123456789"
+./vbuf_print: "726746425"
+./vbuf_print: "726746425"
+./vbuf_print: "726746425"
+./vbuf_print: " 726746425"
+./vbuf_print: "0726746425"
+./vbuf_print: "100000000000000001097906362944045541740492309677311846336810682903157585404911491537163328978494688899061249669721172515611590283743140088328307009198146046031271664502933027185697489699588559043338384466165001178426897626212945177628091195786707458122783970171784415105291802893207873272974885715430223118336.000000"
+./vbuf_print: "100000000000000001097906362944045541740492309677311846336810682903157585404911491537163328978494688899061249669721172515611590283743140088328307009198146046031271664502933027185697489699588559043338384466165001178426897626212945177628091195786707458122783970171784415105291802893207873272974885715430223118336.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+./vbuf_print: "1e+308"
+./vbuf_print: "100000000000000001097906362944045541740492309677311846336810682903157585404911491537163328978494688899061249669721172515611590283743140088328307009198146046031271664502933027185697489699588559043338384466165001178426897626212945177628091195786707458122783970171784415105291802893207873272974885715430223118336"
+./vbuf_print: "foo"
+./vbuf_print: "foo"
+./vbuf_print: ""
+./vbuf_print: " foo"
+./vbuf_print: " foo"
+./vbuf_print: "foo "
diff --git a/external/ibm-public/postfix/dist/src/util/vstream_test.in b/external/ibm-public/postfix/dist/src/util/vstream_test.in
new file mode 100644
index 00000000000..b6687c8cd6c
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/vstream_test.in
@@ -0,0 +1,3 @@
+abcdef
+ghijkl
+mnopqr
diff --git a/external/ibm-public/postfix/dist/src/util/vstream_test.ref b/external/ibm-public/postfix/dist/src/util/vstream_test.ref
new file mode 100644
index 00000000000..cf03053aee7
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/vstream_test.ref
@@ -0,0 +1,8 @@
+abcdef
+ghijkl
+mnopqr
+1234567890
+final memory stream write offset: 12
+buffer size: 12, content: hallo world
+reading memory stream: hallo world
+final memory stream read offset: 12
diff --git a/external/ibm-public/postfix/dist/src/util/vstring_test.ref b/external/ibm-public/postfix/dist/src/util/vstring_test.ref
new file mode 100644
index 00000000000..54c54cf4897
--- /dev/null
+++ b/external/ibm-public/postfix/dist/src/util/vstring_test.ref
@@ -0,0 +1,6 @@
+payload/buffer size 1/1, strlen() 1
+payload/buffer size 2/2, strlen() 2
+payload/buffer size 3/4, strlen() 4
+payload/buffer size 4/4, strlen() 4
+payload/buffer size 5/8, strlen() 8
+argv concatenated: ./vstring.one.two.three.
diff --git a/external/ibm-public/postfix/dist/src/util/vstring_vstream.c b/external/ibm-public/postfix/dist/src/util/vstring_vstream.c
index 0da97822c0d..72501c5566a 100644
--- a/external/ibm-public/postfix/dist/src/util/vstring_vstream.c
+++ b/external/ibm-public/postfix/dist/src/util/vstring_vstream.c
@@ -1,4 +1,4 @@
-/* $NetBSD: vstring_vstream.c,v 1.1.1.2 2014/07/06 19:27:59 tron Exp $ */
+/* $NetBSD: vstring_vstream.c,v 1.1.1.3 2020/03/18 18:59:38 christos Exp $ */
/*++
/* NAME
@@ -8,6 +8,39 @@
/* SYNOPSIS
/* #include <vstring_vstream.h>
/*
+/* int vstring_get_flags(vp, fp, flags)
+/* VSTRING *vp;
+/* VSTREAM *fp;
+/* int flags
+/*
+/* int vstring_get_flags_nonl(vp, fp, flags)
+/* VSTRING *vp;
+/* VSTREAM *fp;
+/* int flags
+/*
+/* int vstring_get_flags_null(vp, fp, flags)
+/* VSTRING *vp;
+/* VSTREAM *fp;
+/* int flags
+/*
+/* int vstring_get_flags_bound(vp, fp, flags, bound)
+/* VSTRING *vp;
+/* VSTREAM *fp;
+/* ssize_t bound;
+/* int flags
+/*
+/* int vstring_get_flags_nonl_bound(vp, fp, flags, bound)
+/* VSTRING *vp;
+/* VSTREAM *fp;
+/* ssize_t bound;
+/* int flags
+/*
+/* int vstring_get_flags_null_bound(vp, fp, flags, bound)
+/* VSTRING *vp;
+/* VSTREAM *fp;
+/* ssize_t bound;
+/* int flags
+/* CONVENIENCE API
/* int vstring_get(vp, fp)
/* VSTRING *vp;
/* VSTREAM *fp;
@@ -38,19 +71,25 @@
/* The routines in this module each read one newline or null-terminated
/* string from an input stream. In all cases the result is either the
/* last character read, typically the record terminator, or VSTREAM_EOF.
+/* The flags argument is VSTRING_GET_FLAG_NONE (default) or
+/* VSTRING_GET_FLAG_APPEND (append instead of overwrite).
/*
-/* vstring_get() reads one line from the named stream, including the
+/* vstring_get_flags() reads one line from the named stream, including the
/* terminating newline character if present.
/*
-/* vstring_get_nonl() reads a line from the named stream and strips
+/* vstring_get_flags_nonl() reads a line from the named stream and strips
/* the trailing newline character.
/*
-/* vstring_get_null() reads a null-terminated string from the named
+/* vstring_get_flags_null() reads a null-terminated string from the named
/* stream.
/*
-/* the vstring_get<whatever>_bound() routines read no more
+/* the vstring_get_flags<whatever>_bound() routines read no more
/* than \fIbound\fR characters. Otherwise they behave like the
/* unbounded versions documented above.
+/*
+/* The functions without _flags in their name accept the same
+/* arguments except flags. These functions use the default
+/* flags value.
/* DIAGNOSTICS
/* Fatal errors: memory allocation failure.
/* Panic: improper string bound.
@@ -63,6 +102,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */
@@ -81,100 +125,121 @@
/*
* Macro to return the last character added to a VSTRING, for consistency.
*/
-#define VSTRING_GET_RESULT(vp) \
- (VSTRING_LEN(vp) > 0 ? vstring_end(vp)[-1] : VSTREAM_EOF)
+#define VSTRING_GET_RESULT(vp, baselen) \
+ (VSTRING_LEN(vp) > (base_len) ? vstring_end(vp)[-1] : VSTREAM_EOF)
-/* vstring_get - read line from file, keep newline */
+/* vstring_get_flags - read line from file, keep newline */
-int vstring_get(VSTRING *vp, VSTREAM *fp)
+int vstring_get_flags(VSTRING *vp, VSTREAM *fp, int flags)
{
int c;
+ ssize_t base_len;
- VSTRING_RESET(vp);
+ if ((flags & VSTRING_GET_FLAG_APPEND) == 0)
+ VSTRING_RESET(vp);
+ base_len = VSTRING_LEN(vp);
while ((c = VSTREAM_GETC(fp)) != VSTREAM_EOF) {
VSTRING_ADDCH(vp, c);
if (c == '\n')
break;
}
VSTRING_TERMINATE(vp);
- return (VSTRING_GET_RESULT(vp));
+ return (VSTRING_GET_RESULT(vp, baselen));
}
-/* vstring_get_nonl - read line from file, strip newline */
+/* vstring_get_flags_nonl - read line from file, strip newline */
-int vstring_get_nonl(VSTRING *vp, VSTREAM *fp)
+int vstring_get_flags_nonl(VSTRING *vp, VSTREAM *fp, int flags)
{
int c;
+ ssize_t base_len;
- VSTRING_RESET(vp);
+ if ((flags & VSTRING_GET_FLAG_APPEND) == 0)
+ VSTRING_RESET(vp);
+ base_len = VSTRING_LEN(vp);
while ((c = VSTREAM_GETC(fp)) != VSTREAM_EOF && c != '\n')
VSTRING_ADDCH(vp, c);
VSTRING_TERMINATE(vp);
- return (c == '\n' ? c : VSTRING_GET_RESULT(vp));
+ return (c == '\n' ? c : VSTRING_GET_RESULT(vp, baselen));
}
-/* vstring_get_null - read null-terminated string from file */
+/* vstring_get_flags_null - read null-terminated string from file */
-int vstring_get_null(VSTRING *vp, VSTREAM *fp)
+int vstring_get_flags_null(VSTRING *vp, VSTREAM *fp, int flags)
{
int c;
+ ssize_t base_len;
- VSTRING_RESET(vp);
+ if ((flags & VSTRING_GET_FLAG_APPEND) == 0)
+ VSTRING_RESET(vp);
+ base_len = VSTRING_LEN(vp);
while ((c = VSTREAM_GETC(fp)) != VSTREAM_EOF && c != 0)
VSTRING_ADDCH(vp, c);
VSTRING_TERMINATE(vp);
- return (c == 0 ? c : VSTRING_GET_RESULT(vp));
+ return (c == 0 ? c : VSTRING_GET_RESULT(vp, baselen));
}
-/* vstring_get_bound - read line from file, keep newline, up to bound */
+/* vstring_get_flags_bound - read line from file, keep newline, up to bound */
-int vstring_get_bound(VSTRING *vp, VSTREAM *fp, ssize_t bound)
+int vstring_get_flags_bound(VSTRING *vp, VSTREAM *fp, int flags,
+ ssize_t bound)
{
int c;
+ ssize_t base_len;
if (bound <= 0)
msg_panic("vstring_get_bound: invalid bound %ld", (long) bound);
- VSTRING_RESET(vp);
+ if ((flags & VSTRING_GET_FLAG_APPEND) == 0)
+ VSTRING_RESET(vp);
+ base_len = VSTRING_LEN(vp);
while (bound-- > 0 && (c = VSTREAM_GETC(fp)) != VSTREAM_EOF) {
VSTRING_ADDCH(vp, c);
if (c == '\n')
break;
}
VSTRING_TERMINATE(vp);
- return (VSTRING_GET_RESULT(vp));
+ return (VSTRING_GET_RESULT(vp, baselen));
}
-/* vstring_get_nonl_bound - read line from file, strip newline, up to bound */
+/* vstring_get_flags_nonl_bound - read line from file, strip newline, up to bound */
-int vstring_get_nonl_bound(VSTRING *vp, VSTREAM *fp, ssize_t bound)
+int vstring_get_flags_nonl_bound(VSTRING *vp, VSTREAM *fp, int flags,
+ ssize_t bound)
{
int c;
+ ssize_t base_len;
if (bound <= 0)
msg_panic("vstring_get_nonl_bound: invalid bound %ld", (long) bound);
- VSTRING_RESET(vp);
+ if ((flags & VSTRING_GET_FLAG_APPEND) == 0)
+ VSTRING_RESET(vp);
+ base_len = VSTRING_LEN(vp);
while (bound-- > 0 && (c = VSTREAM_GETC(fp)) != VSTREAM_EOF && c != '\n')
VSTRING_ADDCH(vp, c);
VSTRING_TERMINATE(vp);
- return (c == '\n' ? c : VSTRING_GET_RESULT(vp));
+ return (c == '\n' ? c : VSTRING_GET_RESULT(vp, baselen));
}
-/* vstring_get_null_bound - read null-terminated string from file */
+/* vstring_get_flags_null_bound - read null-terminated string from file */
-int vstring_get_null_bound(VSTRING *vp, VSTREAM *fp, ssize_t bound)
+int vstring_get_flags_null_bound(VSTRING *vp, VSTREAM *fp, int flags,
+ ssize_t bound)
{
int c;
+ ssize_t base_len;
if (bound <= 0)
msg_panic("vstring_get_null_bound: invalid bound %ld", (long) bound);
- VSTRING_RESET(vp);
+ if ((flags & VSTRING_GET_FLAG_APPEND) == 0)
+ VSTRING_RESET(vp);
+ base_len = VSTRING_LEN(vp);
while (bound-- > 0 && (c = VSTREAM_GETC(fp)) != VSTREAM_EOF && c != 0)
VSTRING_ADDCH(vp, c);
VSTRING_TERMINATE(vp);
- return (c == 0 ? c : VSTRING_GET_RESULT(vp));
+ return (c == 0 ? c : VSTRING_GET_RESULT(vp, baselen));
}
#ifdef TEST
diff --git a/external/ibm-public/postfix/dist/src/verify/Makefile.in b/external/ibm-public/postfix/dist/src/verify/Makefile.in
index f7f09b4fb13..b5ba328cc80 100644
--- a/external/ibm-public/postfix/dist/src/verify/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/verify/Makefile.in
@@ -55,7 +55,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/virtual/Makefile.in b/external/ibm-public/postfix/dist/src/virtual/Makefile.in
index c31af594d55..31fff0ec9f8 100644
--- a/external/ibm-public/postfix/dist/src/virtual/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/virtual/Makefile.in
@@ -56,7 +56,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
@@ -94,6 +94,7 @@ mailbox.o: ../../include/dsn_buf.h
mailbox.o: ../../include/dsn_util.h
mailbox.o: ../../include/htable.h
mailbox.o: ../../include/mail_addr_find.h
+mailbox.o: ../../include/mail_addr_form.h
mailbox.o: ../../include/mail_copy.h
mailbox.o: ../../include/mail_params.h
mailbox.o: ../../include/maps.h
@@ -210,6 +211,7 @@ virtual.o: ../../include/flush_clnt.h
virtual.o: ../../include/htable.h
virtual.o: ../../include/iostuff.h
virtual.o: ../../include/mail_addr_find.h
+virtual.o: ../../include/mail_addr_form.h
virtual.o: ../../include/mail_conf.h
virtual.o: ../../include/mail_params.h
virtual.o: ../../include/mail_queue.h
diff --git a/external/ibm-public/postfix/dist/src/xsasl/Makefile.in b/external/ibm-public/postfix/dist/src/xsasl/Makefile.in
index 9a7b171b571..ad483021b19 100644
--- a/external/ibm-public/postfix/dist/src/xsasl/Makefile.in
+++ b/external/ibm-public/postfix/dist/src/xsasl/Makefile.in
@@ -77,7 +77,7 @@ depend: $(MAKES)
$(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-e 's/o: \.\//o: /' -e p -e '}' ; \
- done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
+ done | LANG=C sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
@$(EXPORT) make -f Makefile.in Makefile 1>&2
# do not edit below this line - it is generated by 'make depend'
diff --git a/external/ibm-public/postfix/dist/src/xsasl/xsasl_server.c b/external/ibm-public/postfix/dist/src/xsasl/xsasl_server.c
index bffd0cfa40f..278fdb227a5 100644
--- a/external/ibm-public/postfix/dist/src/xsasl/xsasl_server.c
+++ b/external/ibm-public/postfix/dist/src/xsasl/xsasl_server.c
@@ -1,4 +1,4 @@
-/* $NetBSD: xsasl_server.c,v 1.1.1.1 2009/06/23 10:09:02 tron Exp $ */
+/* $NetBSD: xsasl_server.c,v 1.1.1.2 2020/03/18 18:59:38 christos Exp $ */
/*++
/* NAME
@@ -94,7 +94,7 @@
/* It destroys a SASL server instance, and disables further
/* read/write operations if encryption was turned on.
/*
-/* xsasl_server_first() produces the server reponse for the
+/* xsasl_server_first() produces the server response for the
/* client AUTH command. The client input are an authentication
/* method, and an optional initial response or null pointer.
/* The initial response and server non-error replies are BASE64
@@ -128,11 +128,15 @@
/* after successful authentication.
/*
/* Arguments:
+/* .IP addr_family
+/* The network address family: AF_INET6 or AF_INET.
/* .IP auth_method
/* AUTH command authentication method.
/* .IP client_addr
/* IPv4 or IPv6 address (no surrounding [] or ipv6: prefix),
/* or zero-length string if unavailable.
+/* .IP client_port
+/* TCP port or zero-length string if unavailable.
/* .IP init_resp
/* AUTH command initial response or null pointer.
/* .IP implementation
@@ -150,6 +154,8 @@
/* .IP server_addr
/* IPv4 or IPv6 address (no surrounding [] or ipv6: prefix),
/* or zero-length string if unavailable.
+/* .IP server_port
+/* TCP port or zero-length string if unavailable.
/* .IP server_reply
/* BASE64 encoded server non-error reply (without SMTP reply
/* code or enhanced status code), or ASCII error description.
@@ -198,6 +204,11 @@
/* IBM T.J. Watson Research
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
+/*
+/* Wietse Venema
+/* Google, Inc.
+/* 111 8th Avenue
+/* New York, NY 10011, USA
/*--*/
/* System library. */