Revision tags: PFIX-3-8-4
|
#
1.1.1.10 |
|
23-Dec-2023 |
christos |
Import Postfix 3.8.4 (last was 3.7.3)
December 22, 2023: 3.8.4/3.7.9
|
Revision tags: PFIX-3-7-3
|
#
1.1.1.9 |
|
08-Oct-2022 |
christos |
Import Postfix-3.7.3 (previous version was 3.5.2)
This is the Postfix 3.7 (stable) release.
The stable Postfix release is called postfix-3.7.x where 3=major release number, 7=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called postfix-3.8-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 3.5 or earlier, read RELEASE_NOTES-3.6 before proceeding.
License change
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base PFIX-3-5-2 phil-wifi-20200421 phil-wifi-20200411 phil-wifi-20200406 PFIX-3-5-0
|
#
1.1.1.8 |
|
18-Mar-2020 |
christos |
This is the Postfix 3.5 (stable) release.
The stable Postfix release is called postfix-3.5.x where 3=major release number, 5=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called postfix-3.6-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 3.3 or earlier, read RELEASE_NOTES-3.4 before proceeding.
License change
|
Revision tags: netbsd-9-3-RELEASE netbsd-9-2-RELEASE netbsd-9-1-RELEASE is-mlppp-base netbsd-8-2-RELEASE netbsd-9-0-RELEASE netbsd-9-0-RC2 netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-merge-20190127 pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 PFIX-3-1-4
|
#
1.1.1.7 |
|
14-Feb-2017 |
christos |
branches: 1.1.1.7.12; The stable Postfix release is called postfix-3.0.x where 3=major release number, 0=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called postfix-3.1-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 2.10 or earlier, read RELEASE_NOTES-2.11 before proceeding.
Notes for distribution maintainers
|
Revision tags: netbsd-7-2-RELEASE netbsd-7-1-2-RELEASE netbsd-7-1-1-RELEASE netbsd-7-1-RELEASE netbsd-7-1-RC2 netbsd-7-nhusb-base-20170116 bouyer-socketcan-base pgoyette-localcount-20170107 netbsd-7-1-RC1 pgoyette-localcount-20161104 netbsd-7-0-2-RELEASE localcount-20160914 netbsd-7-nhusb-base pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base netbsd-7-0-1-RELEASE netbsd-7-0-RELEASE PFIX-2-11-6 netbsd-7-0-RC3 netbsd-7-0-RC2 netbsd-7-0-RC1 PFIX-2-11-4 PFIX-2-11-3 netbsd-7-base PFIX-2-11-1 tls-earlyentropy-base tls-maxphys-base
|
#
1.1.1.6 |
|
06-Jul-2014 |
tron |
branches: 1.1.1.6.6; 1.1.1.6.10; Import Postfix 2.11.1. The main changes since version 2.10.* are: - Support for PKI-less TLS server certificate verification with DANE (DNS-based Authentication of Named Entities) where the CA public key or the server certificate is identified via DNSSEC lookup. This requires a DNS resolver that validates DNSSEC replies. The problem with conventional PKI is that there are literally hundreds of organizations world-wide that can provide a certificate in anyone's name. DANE limits trust to the people who control the target DNS zone and its parent zones. - A new postscreen_dnsbl_whitelist_threshold feature to allow clients to skip postscreen tests based on their DNSBL score. This can eliminate email delays due to "after 220 greeting" protocol tests, which otherwise require that a client reconnects before it can deliver mail. Some providers such as Google don't retry from the same IP address, and that can result in large email delivery delays. - The recipient_delimiter feature now supports different delimiters, for example both "+" and "-". As before, this implementation recognizes exactly one delimiter character per email address, and exactly one address extension per email address. - Advanced master.cf query/update support to access service attributes as "name = value" pairs. For example to turn off chroot on all services use "postconf -F '*/*/chroot = n'", and to change/add a "-o name=value" setting use "postconf -P 'smtp/inet/name = value'". This was developed primarily to allow automated tools to manage Postfix systems without having to parse Postfix configuration files.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 PFIX-2-10-3 PFIX-2-10-2
|
#
1.1.1.5 |
|
25-Sep-2013 |
tron |
branches: 1.1.1.5.2; Import Postfix 2.10.2. Major changes since version 2.9.* are: - Separation of relay policy (with smtpd_relay_restrictions) from spam policy (with smtpd_{client, helo, sender, recipient}_restrictions), which makes accidental open relay configuration less likely. The default is backwards compatible. - HAproxy load-balancer support for postscreen(8) and smtpd(8). The nginx proxy was already supported by Postfix 2.9 smtpd(8), using XCLIENT commands. - Support for the TLSv1 and TLSv2 protocols, as well as support to turn them off if needed for inter-operability. - Laptop-friendly configuration. By default, Postfix now uses UNIX-domain sockets instead of FIFOs, and thus avoids MTIME file system updates on an idle mail system. - Revised postconf(1) command. The "-x" option expands $name in a parameter value (both main.cf and master.cf); the "-o name=value" option overrides a main.cf parameter setting; and postconf(1) now warns about a $name that has no name=value setting. - Sendmail-style "socketmap" lookup tables.
|
Revision tags: PFIX-2-9-7
|
#
1.1.1.4 |
|
21-Aug-2013 |
tron |
Import Postfix 2.9.7. Changes since version 2.9.5: - Thanks to OpenSSL documentation, the Postfix 2.9.0..2.9.5 SMTP client and server used an incorrect procedure to compute TLS certificate PUBLIC-KEY fingerprints (these may be used in the check_ccert_access and in smtp_tls_policy_maps features). Support for certificate PUBLIC-KEY finger prints was introduced with Postfix 2.9; there is no known problem with the certificate fingerprint algorithms available since Postfix 2.2. Specify "tls_legacy_public_key_fingerprints = yes" temporarily, pending a migration from configuration files with incorrect Postfix 2.9.0..2.9.5 certificate PUBLIC-KEY finger prints, to the correct fingerprints used by Postfix 2.9.6 and later. - Bugfix (introduced: Postfix 2.0): when myhostname is not listed in mydestination, the trivial-rewrite resolver may log "do not list in both mydestination and ". The fix is to re-resolve a domain-less address after adding $myhostname as the surrogate domain, so that it pops out with the right address-class label. Reported by Quanah Gibson-Mount. - Bugfix (introduced: Postfix 2.3): don't reuse TCP connections when smtp_tls_policy_maps is specified. TLS policies may depend on the remote destination, but the Postfix <2.11 SMTP connection cache client does not distinguish between different destinations that resolve to the same IP address. Victor Duchovni. Found during Postfix 2.11 code maintenance. - Bugfix (introduced: Postfix 2.2): don't reuse TCP connections when SASL authentication is enabled. SASL passwords may depend on the remote SMTP server hostname, but the Postfix <2.11 SMTP connection cache client does not distinguish between different hostnames that resolve to the same IP address. Found during Postfix 2.11 code maintenance.
|
Revision tags: netbsd-6-0-6-RELEASE netbsd-6-1-5-RELEASE yamt-pagecache-tag8 netbsd-6-1-4-RELEASE netbsd-6-0-5-RELEASE netbsd-6-1-3-RELEASE netbsd-6-0-4-RELEASE netbsd-6-1-2-RELEASE netbsd-6-0-3-RELEASE netbsd-6-1-1-RELEASE riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base netbsd-6-0-2-RELEASE netbsd-6-1-RELEASE netbsd-6-1-RC4 netbsd-6-1-RC3 agc-symver-base netbsd-6-1-RC2 netbsd-6-1-RC1 yamt-pagecache-base8 PFIX-2-9-5 PFIX-2-8-13 netbsd-6-0-1-RELEASE yamt-pagecache-base7 matt-nb6-plus-nbase yamt-pagecache-base6 netbsd-6-0-RELEASE netbsd-6-0-RC2 matt-nb6-plus-base netbsd-6-0-RC1 PFIX-2-8-12 PFIX-2-8-11 yamt-pagecache-base5 yamt-pagecache-base4 PFIX-2-8-8 netbsd-6-base yamt-pagecache-base3 PFIX-2-8-7 yamt-pagecache-base2 yamt-pagecache-base PFIX-2-8-6 PFIX-2-8-5 PFIX-2-8-4 cherry-xenmp-base PFIX-2-8-3 PFIX-2-8-2 PFIX-2-8-1 bouyer-quota2-nbase
|
#
1.1.1.3 |
|
02-Mar-2011 |
tron |
branches: 1.1.1.3.4; 1.1.1.3.10; Import Postfix 2.8.1. Changes since version 2.7.*: Postfix stable release 2.8.0 is available. This release continues the move towards improving code and documentation, and making the system better prepared for changes in the threat environment.
The postscreen daemon (a zombie blocker in front of Postfix) is now included with the stable release. postscreen now supports TLS and can log the rejected sender, recipient and helo information. See the POSTSCREEN_README file for recommended usage scenarios.
Support for DNS whitelisting (permit_rhswl_client), and for pattern matching to filter the responses from DNS white/blacklist servers (e.g., reject_rhsbl_client zen.spamhaus.org=127.0.0.[1..10]).
Improved message tracking across SMTP-based content filters; the after-filter SMTP server can log the before-filter queue ID (the XCLIENT protocol was extended).
Read-only support for sqlite databases. See sqlite_table(5) and SQLITE_README.
Support for 'footers' that are appended to SMTP server "reject" responses. See "smtpd_reject_footer" in the postconf(5) manpage.
|
Revision tags: bouyer-quota2-base matt-mips64-premerge-20101231 PFIX-2-7-2
|
#
1.1.1.2 |
|
27-Nov-2010 |
tron |
branches: 1.1.1.2.2; Import Postfix 2.7.2. Changes since Postfix 2.7.1: - Postfix no longer automatically appends the system default CA (certificate authority) certificates, when it reads the CA certificates specified with {smtp, lmtp, smtpd}_tls_CAfile or with {smtp, lmtp, smtpd}_tls_CApath. This prevents third-party certificates from getting mail relay permission with the permit_tls_all_clientcerts feature. Unfortunately, this change may cause compatibility problems with configurations that rely on certificate verification for other purposes. To get the old behavior, specify "tls_append_default_CA = yes". - A prior fix for compatibility with Postfix < 2.3 was incomplete. When pipe-to-command delivery fails with a signal, mail is now correctly deferred, instead of being returned to sender. - Poor smtpd_proxy_filter TCP performance over loopback (127.0.0.1) connections was fixed by adapting the output buffer size to the MTU. - The SMTP server no longer applies the reject_rhsbl_helo feature to non-domain forms such as network addresses. This would cause false positives with dbl.spamhaus.org. - The Postfix SMTP server failed to deliver a "421" response and hang up the connection after Milter error. Instead, the server delivered a "503 Access denied" response and left the connection open, due to some Postfix 1.1 workaround for RFC 2821. - The milter_header_checks parser failed to enable any of the actions that have no effect on message delivery (warn, replace, prepend, ignore, dunno, and ok).
|
Revision tags: PFIX-2-7-1 PFIX-2-6-6 matt-premerge-20091211 PFIX-2-6-5 PFIX-2-6-2
|
#
1.1.1.1 |
|
23-Jun-2009 |
tron |
branches: 1.1.1.1.2; 1.1.1.1.4; Import Postfix 2.6.2.
|
Revision tags: PFIX-3-5-0
|
#
1.1.1.8 |
|
18-Mar-2020 |
christos |
This is the Postfix 3.5 (stable) release.
The stable Postfix release is called postfix-3.5.x where 3=major release number, 5=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called postfix-3.6-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 3.3 or earlier, read RELEASE_NOTES-3.4 before proceeding.
License change
|
Revision tags: netbsd-9-0-RELEASE netbsd-9-0-RC2 netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-merge-20190127 pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 PFIX-3-1-4
|
#
1.1.1.7 |
|
14-Feb-2017 |
christos |
The stable Postfix release is called postfix-3.0.x where 3=major release number, 0=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called postfix-3.1-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 2.10 or earlier, read RELEASE_NOTES-2.11 before proceeding.
Notes for distribution maintainers
|
Revision tags: netbsd-7-2-RELEASE netbsd-7-1-2-RELEASE netbsd-7-1-1-RELEASE netbsd-7-1-RELEASE netbsd-7-1-RC2 netbsd-7-nhusb-base-20170116 bouyer-socketcan-base pgoyette-localcount-20170107 netbsd-7-1-RC1 pgoyette-localcount-20161104 netbsd-7-0-2-RELEASE localcount-20160914 netbsd-7-nhusb-base pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base netbsd-7-0-1-RELEASE netbsd-7-0-RELEASE PFIX-2-11-6 netbsd-7-0-RC3 netbsd-7-0-RC2 netbsd-7-0-RC1 PFIX-2-11-4 PFIX-2-11-3 netbsd-7-base PFIX-2-11-1 tls-earlyentropy-base tls-maxphys-base
|
#
1.1.1.6 |
|
06-Jul-2014 |
tron |
branches: 1.1.1.6.6; 1.1.1.6.10; Import Postfix 2.11.1. The main changes since version 2.10.* are: - Support for PKI-less TLS server certificate verification with DANE (DNS-based Authentication of Named Entities) where the CA public key or the server certificate is identified via DNSSEC lookup. This requires a DNS resolver that validates DNSSEC replies. The problem with conventional PKI is that there are literally hundreds of organizations world-wide that can provide a certificate in anyone's name. DANE limits trust to the people who control the target DNS zone and its parent zones. - A new postscreen_dnsbl_whitelist_threshold feature to allow clients to skip postscreen tests based on their DNSBL score. This can eliminate email delays due to "after 220 greeting" protocol tests, which otherwise require that a client reconnects before it can deliver mail. Some providers such as Google don't retry from the same IP address, and that can result in large email delivery delays. - The recipient_delimiter feature now supports different delimiters, for example both "+" and "-". As before, this implementation recognizes exactly one delimiter character per email address, and exactly one address extension per email address. - Advanced master.cf query/update support to access service attributes as "name = value" pairs. For example to turn off chroot on all services use "postconf -F '*/*/chroot = n'", and to change/add a "-o name=value" setting use "postconf -P 'smtp/inet/name = value'". This was developed primarily to allow automated tools to manage Postfix systems without having to parse Postfix configuration files.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 PFIX-2-10-3 PFIX-2-10-2
|
#
1.1.1.5 |
|
25-Sep-2013 |
tron |
branches: 1.1.1.5.2; Import Postfix 2.10.2. Major changes since version 2.9.* are: - Separation of relay policy (with smtpd_relay_restrictions) from spam policy (with smtpd_{client, helo, sender, recipient}_restrictions), which makes accidental open relay configuration less likely. The default is backwards compatible. - HAproxy load-balancer support for postscreen(8) and smtpd(8). The nginx proxy was already supported by Postfix 2.9 smtpd(8), using XCLIENT commands. - Support for the TLSv1 and TLSv2 protocols, as well as support to turn them off if needed for inter-operability. - Laptop-friendly configuration. By default, Postfix now uses UNIX-domain sockets instead of FIFOs, and thus avoids MTIME file system updates on an idle mail system. - Revised postconf(1) command. The "-x" option expands $name in a parameter value (both main.cf and master.cf); the "-o name=value" option overrides a main.cf parameter setting; and postconf(1) now warns about a $name that has no name=value setting. - Sendmail-style "socketmap" lookup tables.
|
Revision tags: PFIX-2-9-7
|
#
1.1.1.4 |
|
21-Aug-2013 |
tron |
Import Postfix 2.9.7. Changes since version 2.9.5: - Thanks to OpenSSL documentation, the Postfix 2.9.0..2.9.5 SMTP client and server used an incorrect procedure to compute TLS certificate PUBLIC-KEY fingerprints (these may be used in the check_ccert_access and in smtp_tls_policy_maps features). Support for certificate PUBLIC-KEY finger prints was introduced with Postfix 2.9; there is no known problem with the certificate fingerprint algorithms available since Postfix 2.2. Specify "tls_legacy_public_key_fingerprints = yes" temporarily, pending a migration from configuration files with incorrect Postfix 2.9.0..2.9.5 certificate PUBLIC-KEY finger prints, to the correct fingerprints used by Postfix 2.9.6 and later. - Bugfix (introduced: Postfix 2.0): when myhostname is not listed in mydestination, the trivial-rewrite resolver may log "do not list in both mydestination and ". The fix is to re-resolve a domain-less address after adding $myhostname as the surrogate domain, so that it pops out with the right address-class label. Reported by Quanah Gibson-Mount. - Bugfix (introduced: Postfix 2.3): don't reuse TCP connections when smtp_tls_policy_maps is specified. TLS policies may depend on the remote destination, but the Postfix <2.11 SMTP connection cache client does not distinguish between different destinations that resolve to the same IP address. Victor Duchovni. Found during Postfix 2.11 code maintenance. - Bugfix (introduced: Postfix 2.2): don't reuse TCP connections when SASL authentication is enabled. SASL passwords may depend on the remote SMTP server hostname, but the Postfix <2.11 SMTP connection cache client does not distinguish between different hostnames that resolve to the same IP address. Found during Postfix 2.11 code maintenance.
|
Revision tags: netbsd-6-0-6-RELEASE netbsd-6-1-5-RELEASE yamt-pagecache-tag8 netbsd-6-1-4-RELEASE netbsd-6-0-5-RELEASE netbsd-6-1-3-RELEASE netbsd-6-0-4-RELEASE netbsd-6-1-2-RELEASE netbsd-6-0-3-RELEASE netbsd-6-1-1-RELEASE riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base netbsd-6-0-2-RELEASE netbsd-6-1-RELEASE netbsd-6-1-RC4 netbsd-6-1-RC3 agc-symver-base netbsd-6-1-RC2 netbsd-6-1-RC1 yamt-pagecache-base8 PFIX-2-9-5 PFIX-2-8-13 netbsd-6-0-1-RELEASE yamt-pagecache-base7 matt-nb6-plus-nbase yamt-pagecache-base6 netbsd-6-0-RELEASE netbsd-6-0-RC2 matt-nb6-plus-base netbsd-6-0-RC1 PFIX-2-8-12 PFIX-2-8-11 yamt-pagecache-base5 yamt-pagecache-base4 PFIX-2-8-8 netbsd-6-base yamt-pagecache-base3 PFIX-2-8-7 yamt-pagecache-base2 yamt-pagecache-base PFIX-2-8-6 PFIX-2-8-5 PFIX-2-8-4 cherry-xenmp-base PFIX-2-8-3 PFIX-2-8-2 PFIX-2-8-1 bouyer-quota2-nbase
|
#
1.1.1.3 |
|
02-Mar-2011 |
tron |
branches: 1.1.1.3.4; 1.1.1.3.10; Import Postfix 2.8.1. Changes since version 2.7.*: Postfix stable release 2.8.0 is available. This release continues the move towards improving code and documentation, and making the system better prepared for changes in the threat environment.
The postscreen daemon (a zombie blocker in front of Postfix) is now included with the stable release. postscreen now supports TLS and can log the rejected sender, recipient and helo information. See the POSTSCREEN_README file for recommended usage scenarios.
Support for DNS whitelisting (permit_rhswl_client), and for pattern matching to filter the responses from DNS white/blacklist servers (e.g., reject_rhsbl_client zen.spamhaus.org=127.0.0.[1..10]).
Improved message tracking across SMTP-based content filters; the after-filter SMTP server can log the before-filter queue ID (the XCLIENT protocol was extended).
Read-only support for sqlite databases. See sqlite_table(5) and SQLITE_README.
Support for 'footers' that are appended to SMTP server "reject" responses. See "smtpd_reject_footer" in the postconf(5) manpage.
|
Revision tags: bouyer-quota2-base matt-mips64-premerge-20101231 PFIX-2-7-2
|
#
1.1.1.2 |
|
27-Nov-2010 |
tron |
branches: 1.1.1.2.2; Import Postfix 2.7.2. Changes since Postfix 2.7.1: - Postfix no longer automatically appends the system default CA (certificate authority) certificates, when it reads the CA certificates specified with {smtp, lmtp, smtpd}_tls_CAfile or with {smtp, lmtp, smtpd}_tls_CApath. This prevents third-party certificates from getting mail relay permission with the permit_tls_all_clientcerts feature. Unfortunately, this change may cause compatibility problems with configurations that rely on certificate verification for other purposes. To get the old behavior, specify "tls_append_default_CA = yes". - A prior fix for compatibility with Postfix < 2.3 was incomplete. When pipe-to-command delivery fails with a signal, mail is now correctly deferred, instead of being returned to sender. - Poor smtpd_proxy_filter TCP performance over loopback (127.0.0.1) connections was fixed by adapting the output buffer size to the MTU. - The SMTP server no longer applies the reject_rhsbl_helo feature to non-domain forms such as network addresses. This would cause false positives with dbl.spamhaus.org. - The Postfix SMTP server failed to deliver a "421" response and hang up the connection after Milter error. Instead, the server delivered a "503 Access denied" response and left the connection open, due to some Postfix 1.1 workaround for RFC 2821. - The milter_header_checks parser failed to enable any of the actions that have no effect on message delivery (warn, replace, prepend, ignore, dunno, and ok).
|
Revision tags: PFIX-2-7-1 PFIX-2-6-6 matt-premerge-20091211 PFIX-2-6-5 PFIX-2-6-2
|
#
1.1.1.1 |
|
23-Jun-2009 |
tron |
branches: 1.1.1.1.2; 1.1.1.1.4; Import Postfix 2.6.2.
|
Revision tags: netbsd-8-1-RC1 pgoyette-compat-merge-20190127 pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 PFIX-3-1-4
|
#
1.1.1.7 |
|
14-Feb-2017 |
christos |
The stable Postfix release is called postfix-3.0.x where 3=major release number, 0=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date.
New features are developed in snapshot releases. These are called postfix-3.1-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released.
The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 2.10 or earlier, read RELEASE_NOTES-2.11 before proceeding.
Notes for distribution maintainers
|
Revision tags: netbsd-7-2-RELEASE netbsd-7-1-2-RELEASE netbsd-7-1-1-RELEASE netbsd-7-1-RELEASE netbsd-7-1-RC2 netbsd-7-nhusb-base-20170116 bouyer-socketcan-base pgoyette-localcount-20170107 netbsd-7-1-RC1 pgoyette-localcount-20161104 netbsd-7-0-2-RELEASE localcount-20160914 netbsd-7-nhusb-base pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base netbsd-7-0-1-RELEASE netbsd-7-0-RELEASE PFIX-2-11-6 netbsd-7-0-RC3 netbsd-7-0-RC2 netbsd-7-0-RC1 PFIX-2-11-4 PFIX-2-11-3 netbsd-7-base PFIX-2-11-1 tls-earlyentropy-base tls-maxphys-base
|
#
1.1.1.6 |
|
06-Jul-2014 |
tron |
branches: 1.1.1.6.6; 1.1.1.6.10; Import Postfix 2.11.1. The main changes since version 2.10.* are: - Support for PKI-less TLS server certificate verification with DANE (DNS-based Authentication of Named Entities) where the CA public key or the server certificate is identified via DNSSEC lookup. This requires a DNS resolver that validates DNSSEC replies. The problem with conventional PKI is that there are literally hundreds of organizations world-wide that can provide a certificate in anyone's name. DANE limits trust to the people who control the target DNS zone and its parent zones. - A new postscreen_dnsbl_whitelist_threshold feature to allow clients to skip postscreen tests based on their DNSBL score. This can eliminate email delays due to "after 220 greeting" protocol tests, which otherwise require that a client reconnects before it can deliver mail. Some providers such as Google don't retry from the same IP address, and that can result in large email delivery delays. - The recipient_delimiter feature now supports different delimiters, for example both "+" and "-". As before, this implementation recognizes exactly one delimiter character per email address, and exactly one address extension per email address. - Advanced master.cf query/update support to access service attributes as "name = value" pairs. For example to turn off chroot on all services use "postconf -F '*/*/chroot = n'", and to change/add a "-o name=value" setting use "postconf -P 'smtp/inet/name = value'". This was developed primarily to allow automated tools to manage Postfix systems without having to parse Postfix configuration files.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 PFIX-2-10-3 PFIX-2-10-2
|
#
1.1.1.5 |
|
25-Sep-2013 |
tron |
branches: 1.1.1.5.2; Import Postfix 2.10.2. Major changes since version 2.9.* are: - Separation of relay policy (with smtpd_relay_restrictions) from spam policy (with smtpd_{client, helo, sender, recipient}_restrictions), which makes accidental open relay configuration less likely. The default is backwards compatible. - HAproxy load-balancer support for postscreen(8) and smtpd(8). The nginx proxy was already supported by Postfix 2.9 smtpd(8), using XCLIENT commands. - Support for the TLSv1 and TLSv2 protocols, as well as support to turn them off if needed for inter-operability. - Laptop-friendly configuration. By default, Postfix now uses UNIX-domain sockets instead of FIFOs, and thus avoids MTIME file system updates on an idle mail system. - Revised postconf(1) command. The "-x" option expands $name in a parameter value (both main.cf and master.cf); the "-o name=value" option overrides a main.cf parameter setting; and postconf(1) now warns about a $name that has no name=value setting. - Sendmail-style "socketmap" lookup tables.
|
Revision tags: PFIX-2-9-7
|
#
1.1.1.4 |
|
21-Aug-2013 |
tron |
Import Postfix 2.9.7. Changes since version 2.9.5: - Thanks to OpenSSL documentation, the Postfix 2.9.0..2.9.5 SMTP client and server used an incorrect procedure to compute TLS certificate PUBLIC-KEY fingerprints (these may be used in the check_ccert_access and in smtp_tls_policy_maps features). Support for certificate PUBLIC-KEY finger prints was introduced with Postfix 2.9; there is no known problem with the certificate fingerprint algorithms available since Postfix 2.2. Specify "tls_legacy_public_key_fingerprints = yes" temporarily, pending a migration from configuration files with incorrect Postfix 2.9.0..2.9.5 certificate PUBLIC-KEY finger prints, to the correct fingerprints used by Postfix 2.9.6 and later. - Bugfix (introduced: Postfix 2.0): when myhostname is not listed in mydestination, the trivial-rewrite resolver may log "do not list in both mydestination and ". The fix is to re-resolve a domain-less address after adding $myhostname as the surrogate domain, so that it pops out with the right address-class label. Reported by Quanah Gibson-Mount. - Bugfix (introduced: Postfix 2.3): don't reuse TCP connections when smtp_tls_policy_maps is specified. TLS policies may depend on the remote destination, but the Postfix <2.11 SMTP connection cache client does not distinguish between different destinations that resolve to the same IP address. Victor Duchovni. Found during Postfix 2.11 code maintenance. - Bugfix (introduced: Postfix 2.2): don't reuse TCP connections when SASL authentication is enabled. SASL passwords may depend on the remote SMTP server hostname, but the Postfix <2.11 SMTP connection cache client does not distinguish between different hostnames that resolve to the same IP address. Found during Postfix 2.11 code maintenance.
|
Revision tags: netbsd-6-0-6-RELEASE netbsd-6-1-5-RELEASE yamt-pagecache-tag8 netbsd-6-1-4-RELEASE netbsd-6-0-5-RELEASE netbsd-6-1-3-RELEASE netbsd-6-0-4-RELEASE netbsd-6-1-2-RELEASE netbsd-6-0-3-RELEASE netbsd-6-1-1-RELEASE riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base netbsd-6-0-2-RELEASE netbsd-6-1-RELEASE netbsd-6-1-RC4 netbsd-6-1-RC3 agc-symver-base netbsd-6-1-RC2 netbsd-6-1-RC1 yamt-pagecache-base8 PFIX-2-9-5 PFIX-2-8-13 netbsd-6-0-1-RELEASE yamt-pagecache-base7 matt-nb6-plus-nbase yamt-pagecache-base6 netbsd-6-0-RELEASE netbsd-6-0-RC2 matt-nb6-plus-base netbsd-6-0-RC1 PFIX-2-8-12 PFIX-2-8-11 yamt-pagecache-base5 yamt-pagecache-base4 PFIX-2-8-8 netbsd-6-base yamt-pagecache-base3 PFIX-2-8-7 yamt-pagecache-base2 yamt-pagecache-base PFIX-2-8-6 PFIX-2-8-5 PFIX-2-8-4 cherry-xenmp-base PFIX-2-8-3 PFIX-2-8-2 PFIX-2-8-1 bouyer-quota2-nbase
|
#
1.1.1.3 |
|
02-Mar-2011 |
tron |
branches: 1.1.1.3.4; 1.1.1.3.10; Import Postfix 2.8.1. Changes since version 2.7.*: Postfix stable release 2.8.0 is available. This release continues the move towards improving code and documentation, and making the system better prepared for changes in the threat environment.
The postscreen daemon (a zombie blocker in front of Postfix) is now included with the stable release. postscreen now supports TLS and can log the rejected sender, recipient and helo information. See the POSTSCREEN_README file for recommended usage scenarios.
Support for DNS whitelisting (permit_rhswl_client), and for pattern matching to filter the responses from DNS white/blacklist servers (e.g., reject_rhsbl_client zen.spamhaus.org=127.0.0.[1..10]).
Improved message tracking across SMTP-based content filters; the after-filter SMTP server can log the before-filter queue ID (the XCLIENT protocol was extended).
Read-only support for sqlite databases. See sqlite_table(5) and SQLITE_README.
Support for 'footers' that are appended to SMTP server "reject" responses. See "smtpd_reject_footer" in the postconf(5) manpage.
|
Revision tags: bouyer-quota2-base matt-mips64-premerge-20101231 PFIX-2-7-2
|
#
1.1.1.2 |
|
27-Nov-2010 |
tron |
branches: 1.1.1.2.2; Import Postfix 2.7.2. Changes since Postfix 2.7.1: - Postfix no longer automatically appends the system default CA (certificate authority) certificates, when it reads the CA certificates specified with {smtp, lmtp, smtpd}_tls_CAfile or with {smtp, lmtp, smtpd}_tls_CApath. This prevents third-party certificates from getting mail relay permission with the permit_tls_all_clientcerts feature. Unfortunately, this change may cause compatibility problems with configurations that rely on certificate verification for other purposes. To get the old behavior, specify "tls_append_default_CA = yes". - A prior fix for compatibility with Postfix < 2.3 was incomplete. When pipe-to-command delivery fails with a signal, mail is now correctly deferred, instead of being returned to sender. - Poor smtpd_proxy_filter TCP performance over loopback (127.0.0.1) connections was fixed by adapting the output buffer size to the MTU. - The SMTP server no longer applies the reject_rhsbl_helo feature to non-domain forms such as network addresses. This would cause false positives with dbl.spamhaus.org. - The Postfix SMTP server failed to deliver a "421" response and hang up the connection after Milter error. Instead, the server delivered a "503 Access denied" response and left the connection open, due to some Postfix 1.1 workaround for RFC 2821. - The milter_header_checks parser failed to enable any of the actions that have no effect on message delivery (warn, replace, prepend, ignore, dunno, and ok).
|
Revision tags: PFIX-2-7-1 PFIX-2-6-6 matt-premerge-20091211 PFIX-2-6-5 PFIX-2-6-2
|
#
1.1.1.1 |
|
23-Jun-2009 |
tron |
branches: 1.1.1.1.2; 1.1.1.1.4; Import Postfix 2.6.2.
|