head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC6:1.1.1.1 netbsd-11-0-RC5:1.1.1.1 netbsd-11-0-RC4:1.1.1.1 PFIX-3-11-2:1.1.1.1 netbsd-11-0-RC3:1.1.1.1 netbsd-11-0-RC2:1.1.1.1 netbsd-11-0-RC1:1.1.1.1 perseant-exfatfs-base-20250801:1.1.1.1 netbsd-11:1.1.1.1.0.8 netbsd-11-base:1.1.1.1 PFIX-3-10-1:1.1.1.1 netbsd-10-1-RELEASE:1.1.1.1 perseant-exfatfs-base-20240630:1.1.1.1 perseant-exfatfs:1.1.1.1.0.6 perseant-exfatfs-base:1.1.1.1 netbsd-9-4-RELEASE:1.1.1.1.4.2 netbsd-10-0-RELEASE:1.1.1.1 netbsd-10-0-RC6:1.1.1.1 netbsd-10-0-RC5:1.1.1.1 netbsd-10-0-RC4:1.1.1.1 netbsd-10-0-RC3:1.1.1.1 netbsd-10-0-RC2:1.1.1.1 netbsd-9:1.1.1.1.0.4 PFIX-3-8-4:1.1.1.1 netbsd-10-0-RC1:1.1.1.1 netbsd-10:1.1.1.1.0.2 netbsd-10-base:1.1.1.1 PFIX-3-7-3:1.1.1.1 VENEMA:1.1.1; locks; strict; comment @# @; 1.1 date 2022.10.08.16.09.00; author christos; state Exp; branches 1.1.1.1; next ; commitid kRUbAM0nqDWDQVWD; 1.1.1.1 date 2022.10.08.16.09.00; author christos; state Exp; branches 1.1.1.1.4.1; next ; commitid kRUbAM0nqDWDQVWD; 1.1.1.1.4.1 date 2022.10.08.16.09.00; author martin; state dead; branches; next 1.1.1.1.4.2; commitid yzNdlh5ioUjfxQRE; 1.1.1.1.4.2 date 2023.12.25.12.54.32; author martin; state Exp; branches; next ; commitid yzNdlh5ioUjfxQRE; desc @@ 1.1 log @Initial revision @ text @PPoossttffiixx PPoossttssccrreeeenn HHoowwttoo ((PPoossttffiixx 22..88 -- 33..55)) ------------------------------------------------------------------------------- IInnttrroodduuccttiioonn This document describes features that are available in Postfix 2.8 - 3.5. The Postfix postscreen(8) daemon provides additional protection against mail server overload. One postscreen(8) process handles multiple inbound SMTP connections, and decides which clients may talk to a Postfix SMTP server process. By keeping spambots away, postscreen(8) leaves more SMTP server processes available for legitimate clients, and delays the onset of server overload conditions. postscreen(8) should not be used on SMTP ports that receive mail from end-user clients (MUAs). In a typical deployment, postscreen(8) handles the MX service on TCP port 25, while MUA clients submit mail via the submission service on TCP port 587 which requires client authentication. Alternatively, a site could set up a dedicated, non-postscreen, "port 25" server that provides submission service and client authentication, but no MX service. postscreen(8) maintains a temporary allowlist for clients that pass its tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. postscreen(8) is part of a multi-layer defense. * As the first layer, postscreen(8) blocks connections from zombies and other spambots that are responsible for about 90% of all spam. It is implemented as a single process to make this defense as inexpensive as possible. * The second layer implements more complex SMTP-level access checks with Postfix SMTP servers, policy daemons, and Milter applications. * The third layer performs light-weight content inspection with the Postfix built-in header_checks and body_checks. This can block unacceptable attachments such as executable programs, and worms or viruses with easy-to- recognize signatures. * The fourth layer provides heavy-weight content inspection with external content filters. Typical examples are Amavisd-new, SpamAssassin, and Milter applications. Each layer reduces the spam volume. The general strategy is to use the less expensive defenses first, and to use the more expensive defenses only for the spam that remains. Topics in this document: * Introduction * The basic idea behind postscreen(8) * General operation * Quick tests before everything else * Tests before the 220 SMTP server greeting * Tests after the 220 SMTP server greeting * Other errors * When all tests succeed * Configuring the postscreen(8) service * Historical notes and credits TThhee bbaassiicc iiddeeaa bbeehhiinndd ppoossttssccrreeeenn((88)) Most email is spam, and most spam is sent out by zombies (malware on compromised end-user computers). Wietse expects that the zombie problem will get worse before things improve, if ever. Without a tool like postscreen(8) that keeps the zombies away, Postfix would be spending most of its resources not receiving email. The main challenge for postscreen(8) is to make an is-a-zombie decision based on a single measurement. This is necessary because many zombies try to fly under the radar and avoid spamming the same site repeatedly. Once postscreen(8) decides that a client is not-a-zombie, it allowlists the client temporarily to avoid further delays for legitimate mail. Zombies have challenges too: they have only a limited amount of time to deliver spam before their IP address becomes denylisted. To speed up spam deliveries, zombies make compromises in their SMTP protocol implementation. For example, they speak before their turn, or they ignore responses from SMTP servers and continue sending mail even when the server tells them to go away. postscreen(8) uses a variety of measurements to recognize zombies. First, postscreen(8) determines if the remote SMTP client IP address is denylisted. Second, postscreen(8) looks for protocol compromises that are made to speed up delivery. These are good indicators for making is-a-zombie decisions based on single measurements. postscreen(8) does not inspect message content. Message content can vary from one delivery to the next, especially with clients that (also) send legitimate email. Content is not a good indicator for making is-a-zombie decisions based on single measurements, and that is the problem that postscreen(8) is focused on. GGeenneerraall ooppeerraattiioonn For each connection from an SMTP client, postscreen(8) performs a number of tests in the order as described below. Some tests introduce a delay of a few seconds. postscreen(8) maintains a temporary allowlist for clients that pass its tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. By default, postscreen(8) hands off all connections to a Postfix SMTP server process after logging its findings. This mode is useful for non-destructive testing. In a typical production setting, postscreen(8) is configured to reject mail from clients that fail one or more tests, after logging the helo, sender and recipient information. Note: postscreen(8) is not an SMTP proxy; this is intentional. The purpose is to keep zombies away from Postfix, with minimal overhead for legitimate clients. QQuuiicckk tteessttss bbeeffoorree eevveerryytthhiinngg eellssee Before engaging in SMTP-level tests. postscreen(8) queries a number of local deny and allowlists. These tests speed up the handling of known clients. * Permanent allow/denylist test * Temporary allowlist test * MX Policy test PPeerrmmaanneenntt aallllooww//ddeennyylliisstt tteesstt The postscreen_access_list parameter (default: permit_mynetworks) specifies a permanent access list for SMTP client IP addresses. Typically one would specify something that allowlists local networks, followed by a CIDR table for selective allow- and denylisting. Example: /etc/postfix/main.cf: postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr /etc/postfix/postscreen_access.cidr: # Rules are evaluated in the order as specified. # Denylist 192.168.* except 192.168.0.1. 192.168.0.1 permit 192.168.0.0/16 reject See the postscreen_access_list manpage documentation for more details. When the SMTP client address matches a "permit" action, postscreen(8) logs this with the client address and port number as: WWHHIITTEELLIISSTTEEDD [address]:port The allowlist action is not configurable: immediately hand off the connection to a Postfix SMTP server process. When the SMTP client address matches a "reject" action, postscreen(8) logs this with the client address and port number as: BBLLAACCKKLLIISSTTEEDD [address]:port The postscreen_blacklist_action parameter specifies the action that is taken next. See "When tests fail before the 220 SMTP server greeting" below. TTeemmppoorraarryy aalllloowwlliisstt tteesstt The postscreen(8) daemon maintains a temporary allowlist for SMTP client IP addresses that have passed all the tests described below. The postscreen_cache_map parameter specifies the location of the temporary allowlist. The temporary allowlist is not used for SMTP client addresses that appear on the permanent access list. By default the temporary allowlist is not shared with other postscreen(8) daemons. See Sharing the temporary allowlist below for alternatives. When the SMTP client address appears on the temporary allowlist, postscreen(8) logs this with the client address and port number as: PPAASSSS OOLLDD [address]:port The action is not configurable: immediately hand off the connection to a Postfix SMTP server process. The client is excluded from further tests until its temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. Expired entries are silently renewed if possible. MMXX PPoolliiccyy tteesstt When the remote SMTP client is not on the static access list or temporary allowlist, postscreen(8) can implement a number of allowlist tests, before it grants the client a temporary allowlist status that allows it to talk to a Postfix SMTP server process. When postscreen(8) is configured to monitor all primary and backup MX addresses, it can refuse to allowlist clients that connect to a backup MX address only (an old spammer trick to take advantage of backup MX hosts with weaker anti-spam policies than primary MX hosts). NOTE: The following solution is for small sites. Larger sites would have to share the postscreen(8) cache between primary and backup MTAs, which would introduce a common point of failure. * First, configure the host to listen on both primary and backup MX addresses. Use the appropriate ifconfig or ip command for the local operating system, or update the appropriate configuration files and "refresh" the network protocol stack. Second, configure Postfix to listen on the new IP address (this step is needed when you have specified inet_interfaces in main.cf). * Then, configure postscreen(8) to deny the temporary allowlist status on the backup MX address(es). An example for Wietse's server is: /etc/postfix/main.cf: postscreen_whitelist_interfaces = !168.100.189.8 static:all Translation: allow clients to obtain the temporary allowlist status on all server IP addresses except 168.100.189.8, which is a backup MX address. When a non-allowlisted client connects the backup MX address, postscreen(8) logs this with the client address and port number as: CCOONNNNEECCTT ffrroomm [address]:port ttoo [[116688..110000..118899..88]]::2255 WWHHIITTEELLIISSTT VVEETTOO [address]:port Translation: the client at [address]:port connected to the backup MX address 168.100.189.8 while it was not allowlisted. The client will not be granted the temporary allowlist status, even if passes all the allowlist tests described below. TTeessttss bbeeffoorree tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg The postscreen_greet_wait parameter specifies a short time interval before the "220 text..." server greeting, where postscreen(8) can run a number of tests in parallel. When a good client passes these tests, and no "deep protocol tests" are configured, postscreen(8) adds the client to the temporary allowlist and hands off the "live" connection to a Postfix SMTP server process. The client can then continue as if postscreen(8) never even existed (except of course for the short postscreen_greet_wait delay). * Pregreet test * DNS Allow/denylist test * When tests fail before the 220 SMTP server greeting PPrreeggrreeeett tteesstt The SMTP protocol is a classic example of a protocol where the server speaks before the client. postscreen(8) detects zombies that are in a hurry and that speak before their turn. This test is enabled by default. The postscreen_greet_banner parameter specifies the text portion of a "220- text..." teaser banner (default: $smtpd_banner). Note that this becomes the first part of a multi-line server greeting. The postscreen(8) daemon sends this before the postscreen_greet_wait timer is started. The purpose of the teaser banner is to confuse zombies so that they speak before their turn. It has no effect on SMTP clients that correctly implement the protocol. To avoid problems with poorly-implemented SMTP engines in network appliances or network testing tools, either exclude them from all tests with the postscreen_access_list feature or else specify an empty teaser banner: /etc/postfix/main.cf: # Exclude broken clients by allowlisting. Clients in mynetworks # should always be allowlisted. postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr /etc/postfix/postscreen_access.cidr: 192.168.254.0/24 permit /etc/postfix/main.cf: # Disable the teaser banner (try allowlisting first if you can). postscreen_greet_banner = When an SMTP client sends a command before the postscreen_greet_wait time has elapsed, postscreen(8) logs this as: PPRREEGGRREEEETT count aafftteerr time ffrroomm [address]:port text... Translation: the client at [address]:port sent count bytes before its turn to speak. This happened time seconds after the postscreen_greet_wait timer was started. The text is what the client sent (truncated to 100 bytes, and with non-printable characters replaced with C-style escapes such as \r for carriage- return and \n for newline). The postscreen_greet_action parameter specifies the action that is taken next. See "When tests fail before the 220 SMTP server greeting" below. DDNNSS AAllllooww//ddeennyylliisstt tteesstt The postscreen_dnsbl_sites parameter (default: empty) specifies a list of DNS blocklist servers with optional filters and weight factors (positive weights for denylisting, negative for allowlisting). These servers will be queried in parallel with the reverse client IP address. This test is disabled by default. CAUTION: when postscreen rejects mail, its SMTP reply contains the DNSBL domain name. Use the postscreen_dnsbl_reply_map feature to hide "password" information in DNSBL domain names. When the postscreen_greet_wait time has elapsed, and the combined DNSBL score is equal to or greater than the postscreen_dnsbl_threshold parameter value, postscreen(8) logs this as: DDNNSSBBLL rraannkk count ffoorr [address]:port Translation: the SMTP client at [address]:port has a combined DNSBL score of count. The postscreen_dnsbl_action parameter specifies the action that is taken when the combined DNSBL score is equal to or greater than the threshold. See "When tests fail before the 220 SMTP server greeting" below. WWhheenn tteessttss ffaaiill bbeeffoorree tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg When the client address matches the permanent denylist, or when the client fails the pregreet or DNSBL tests, the action is specified with postscreen_blacklist_action, postscreen_greet_action, or postscreen_dnsbl_action, respectively. iiggnnoorree (default) Ignore the failure of this test. Allow other tests to complete. Repeat this test the next time the client connects. This option is useful for testing and collecting statistics without blocking mail. eennffoorrccee Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects. ddrroopp Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects. TTeessttss aafftteerr tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg In this phase of the protocol, postscreen(8) implements a number of "deep protocol" tests. These tests use an SMTP protocol engine that is built into the postscreen(8) server. Important note: these protocol tests are disabled by default. They are more intrusive than the pregreet and DNSBL tests, and they have limitations as discussed next. * The main limitation of "after 220 greeting" tests is that a new client must disconnect after passing these tests (reason: postscreen is not a proxy). Then the client must reconnect from the same IP address before it can deliver mail. The following measures may help to avoid email delays: o Allow "good" clients to skip tests with the postscreen_dnsbl_whitelist_threshold feature (Postfix 2.11 and later). This is especially effective for sites such as Google that never retry immediately from the same IP address. o Small sites: Configure postscreen(8) to listen on multiple IP addresses, published in DNS as different IP addresses for the same MX hostname or for different MX hostnames. This avoids mail delivery delays with clients that reconnect immediately from the same IP address. o Large sites: Share the postscreen(8) cache between different Postfix MTAs with a large-enough memcache_table(5). Again, this avoids mail delivery delays with clients that reconnect immediately from the same IP address. * postscreen(8)'s built-in SMTP engine does not implement the AUTH, XCLIENT, and XFORWARD features. If you need to make these services available on port 25, then do not enable the tests after the 220 server greeting. * End-user clients should connect directly to the submission service, so that they never have to deal with postscreen(8)'s tests. The following "after 220 greeting" tests are available: * Command pipelining test * Non-SMTP command test * Bare newline test * When tests fail after the 220 SMTP server greeting CCoommmmaanndd ppiippeelliinniinngg tteesstt By default, SMTP is a half-duplex protocol: the sender and receiver send one command and one response at a time. Unlike the Postfix SMTP server, postscreen (8) does not announce support for ESMTP command pipelining. Therefore, clients are not allowed to send multiple commands. postscreen(8)'s deep protocol test for this is disabled by default. With "postscreen_pipelining_enable = yes", postscreen(8) detects zombies that send multiple commands, instead of sending one command and waiting for the server to reply. This test is opportunistically enabled when postscreen(8) has to use the built- in SMTP engine anyway. This is to make postscreen(8) logging more informative. When a client sends multiple commands, postscreen(8) logs this as: CCOOMMMMAANNDD PPIIPPEELLIINNIINNGG ffrroomm [address]:port aafftteerr command: text Translation: the SMTP client at [address]:port sent multiple SMTP commands, instead of sending one command and then waiting for the server to reply. This happened after the client sent command. The text shows part of the input that was sent too early; it is not logged with Postfix 2.8. The postscreen_pipelining_action parameter specifies the action that is taken next. See "When tests fail after the 220 SMTP server greeting" below. NNoonn--SSMMTTPP ccoommmmaanndd tteesstt Some spambots send their mail through open proxies. A symptom of this is the usage of commands such as CONNECT and other non-SMTP commands. Just like the Postfix SMTP server's smtpd_forbidden_commands feature, postscreen(8) has an equivalent postscreen_forbidden_commands feature to block these clients. postscreen(8)'s deep protocol test for this is disabled by default. With "postscreen_non_smtp_command_enable = yes", postscreen(8) detects zombies that send commands specified with the postscreen_forbidden_commands parameter. This also detects commands with the syntax of a message header label. The latter is a symptom that the client is sending message content after ignoring all the responses from postscreen(8) that reject mail. This test is opportunistically enabled when postscreen(8) has to use the built- in SMTP engine anyway. This is to make postscreen(8) logging more informative. When a client sends non-SMTP commands, postscreen(8) logs this as: NNOONN--SSMMTTPP CCOOMMMMAANNDD ffrroomm [address]:port aafftteerr command: text Translation: the SMTP client at [address]:port sent a command that matches the postscreen_forbidden_commands parameter, or that has the syntax of a message header label (text followed by optional space and ":"). The "aafftteerr command" portion is logged with Postfix 2.10 and later. The postscreen_non_smtp_command_action parameter specifies the action that is taken next. See "When tests fail after the 220 SMTP server greeting" below. BBaarree nneewwlliinnee tteesstt SMTP is a line-oriented protocol: lines have a limited length, and are terminated with . Lines ending in a "bare" , that is newline not preceded by carriage return, are not allowed in SMTP. postscreen(8)'s deep protocol test for this is disabled by default. With "postscreen_bare_newline_enable = yes", postscreen(8) detects clients that send lines ending in bare newline characters. This test is opportunistically enabled when postscreen(8) has to use the built- in SMTP engine anyway. This is to make postscreen(8) logging more informative. When a client sends bare newline characters, postscreen(8) logs this as: BBAARREE NNEEWWLLIINNEE ffrroomm [address]:port aafftteerr command Translation: the SMTP client at [address]:port sent a bare newline character, that is newline not preceded by carriage return. The "aafftteerr command" portion is logged with Postfix 2.10 and later. The postscreen_bare_newline_action parameter specifies the action that is taken next. See "When tests fail after the 220 SMTP server greeting" below. WWhheenn tteessttss ffaaiill aafftteerr tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg When the client fails the pipelining, non-SMTP command or bare newline tests, the action is specified with postscreen_pipelining_action, postscreen_non_smtp_command_action or postscreen_bare_newline_action, respectively. iiggnnoorree (default for bare newline) Ignore the failure of this test. Allow other tests to complete. Do NOT repeat this test before the result from some other test expires. This option is useful for testing and collecting statistics without blocking mail permanently. eennffoorrccee (default for pipelining) Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects. ddrroopp (default for non-SMTP commands) Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects. This action is compatible with the Postfix SMTP server's smtpd_forbidden_commands feature. OOtthheerr eerrrroorrss When an SMTP client hangs up unexpectedly, postscreen(8) logs this as: HHAANNGGUUPP aafftteerr time ffrroomm [address]:port iinn test name Translation: the SMTP client at [address]:port disconnected unexpectedly, time seconds after the start of the test named test name. There is no punishment for hanging up. A client that hangs up without sending the QUIT command can still pass all postscreen(8) tests. The following errors are reported by the built-in SMTP engine. This engine never accepts mail, therefore it has per-session limits on the number of commands and on the session length. CCOOMMMMAANNDD TTIIMMEE LLIIMMIITT ffrroomm [address]:port aafftteerr command Translation: the SMTP client at [address]:port reached the per-command time limit as specified with the postscreen_command_time_limit parameter. The session is terminated immediately. The "aafftteerr command" portion is logged with Postfix 2.10 and later. CCOOMMMMAANNDD CCOOUUNNTT LLIIMMIITT ffrroomm [address]:port aafftteerr command Translation: the SMTP client at [address]:port reached the per-session command count limit as specified with the postscreen_command_count_limit parameter. The session is terminated immediately. The "aafftteerr command" portion is logged with Postfix 2.10 and later. CCOOMMMMAANNDD LLEENNGGTTHH LLIIMMIITT ffrroomm [address]:port aafftteerr command Translation: the SMTP client at [address]:port reached the per-command length limit, as specified with the line_length_limit parameter. The session is terminated immediately. The "aafftteerr command" portion is logged with Postfix 2.10 and later. When an SMTP client makes too many connections at the same time, postscreen(8) rejects the connection with a 421 status code and logs: NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: ttoooo mmaannyy ccoonnnneeccttiioonnss The postscreen_client_connection_count_limit parameter controls this limit. When an SMTP client connects after postscreen(8) has reached a connection count limit, postscreen(8) rejects the connection with a 421 status code and logs: NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: aallll ssccrreeeenniinngg ppoorrttss bbuussyy NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: aallll sseerrvveerr ppoorrttss bbuussyy The postscreen_pre_queue_limit and postscreen_post_queue_limit parameters control these limits. WWhheenn aallll tteessttss ssuucccceeeedd When a new SMTP client passes all tests (i.e. it is not allowlisted via some mechanism), postscreen(8) logs this as: PPAASSSS NNEEWW [address]:port Where [address]:port are the client IP address and port. Then, postscreen(8) creates a temporary allowlist entry that excludes the client IP address from further tests until the temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. When no "deep protocol tests" are configured, postscreen(8) hands off the "live" connection to a Postfix SMTP server process. The client can then continue as if postscreen(8) never even existed (except for the short postscreen_greet_wait delay). When any "deep protocol tests" are configured, postscreen(8) cannot hand off the "live" connection to a Postfix SMTP server process in the middle of the session. Instead, postscreen(8) defers mail delivery attempts with a 4XX status, logs the helo/sender/recipient information, and waits for the client to disconnect. The next time the client connects it will be allowed to talk to a Postfix SMTP server process to deliver its mail. postscreen(8) mitigates the impact of this limitation by giving deep protocol tests a long expiration time. CCoonnffiigguurriinngg tthhee ppoossttssccrreeeenn((88)) sseerrvviiccee postscreen(8) has been tested on FreeBSD [4-8], Linux 2.[4-6] and Solaris 9 systems. * Turning on postscreen(8) without blocking mail * postscreen(8) TLS configuration * Blocking mail with postscreen(8) * Turning off postscreen(8) * Sharing the temporary allowlist TTuurrnniinngg oonn ppoossttssccrreeeenn((88)) wwiitthhoouutt bblloocckkiinngg mmaaiill To enable the postscreen(8) service and log client information without blocking mail: 1. Make sure that local clients and systems with non-standard SMTP implementations are excluded from any postscreen(8) tests. The default is to exclude all clients in mynetworks. To exclude additional clients, for example, third-party performance monitoring tools (these tend to have broken SMTP implementations): /etc/postfix/main.cf: # Exclude broken clients by allowlisting. Clients in mynetworks # should always be allowlisted. postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr /etc/postfix/postscreen_access.cidr: 192.168.254.0/24 permit 2. Comment out the "smtp inet ... smtpd" service in master.cf, including any "-o parameter=value" entries that follow. /etc/postfix/master.cf: #smtp inet n - n - - smtpd # -o parameter=value ... 3. Uncomment the new "smtpd pass ... smtpd" service in master.cf, and duplicate any "-o parameter=value" entries from the smtpd service that was commented out in the previous step. /etc/postfix/master.cf: smtpd pass - - n - - smtpd -o parameter=value ... 4. Uncomment the new "smtp inet ... postscreen" service in master.cf. /etc/postfix/master.cf: smtp inet n - n - 1 postscreen 5. Uncomment the new "tlsproxy unix ... tlsproxy" service in master.cf. This service implements STARTTLS support for postscreen(8). /etc/postfix/master.cf: tlsproxy unix - - n - 0 tlsproxy 6. Uncomment the new "dnsblog unix ... dnsblog" service in master.cf. This service does DNSBL lookups for postscreen(8) and logs results. /etc/postfix/master.cf: dnsblog unix - - n - 0 dnsblog 7. To enable DNSBL lookups, list some DNS blocklist sites in main.cf, separated by whitespace. Different sites can have different weights. For example: /etc/postfix/main.cf: postscreen_dnsbl_threshold = 2 postscreen_dnsbl_sites = zen.spamhaus.org*2 bl.spamcop.net*1 b.barracudacentral.org*1 Note: if your DNSBL queries have a "secret" in the domain name, you must censor this information from the postscreen(8) SMTP replies. For example: /etc/postfix/main.cf: postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply /etc/postfix/dnsbl_reply: # Secret DNSBL name Name in postscreen(8) replies secret.zen.dq.spamhaus.net zen.spamhaus.org The texthash: format is similar to hash: except that there is no need to run postmap(1) before the file can be used, and that it does not detect changes after the file is read. It is new with Postfix version 2.8. 8. Read the new configuration with "postfix reload". Notes: * Some postscreen(8) configuration parameters implement stress-dependent behavior. This is supported only when the default value is stress-dependent (that is, "postconf -d parametername" output shows "parametername = $ {stress?something}${stress:something}" or "parametername = ${stress? {something}:{something}}"). Other parameters always evaluate as if the stress value is the empty string. * See "Tests before the 220 SMTP server greeting" for details about the logging from these postscreen(8) tests. * If you run Postfix 2.6 or earlier you must stop and start the master daemon ("postfix stop; postfix start"). This is needed because the Postfix "pass" master service type did not work reliably on all systems. ppoossttssccrreeeenn((88)) TTLLSS ccoonnffiigguurraattiioonn postscreen(8) TLS support is available for remote SMTP clients that aren't allowlisted, including clients that need to renew their temporary allowlist status. When a remote SMTP client requests TLS service, postscreen(8) invisibly hands off the connection to a tlsproxy(8) process. Then, tlsproxy(8) encrypts and decrypts the traffic between postscreen(8) and the remote SMTP client. One tlsproxy(8) process can handle multiple SMTP sessions. The number of tlsproxy (8) processes slowly increases with server load, but it should always be much smaller than the number of postscreen(8) TLS sessions. TLS support for postscreen(8) and tlsproxy(8) uses the same parameters as with smtpd(8). We recommend that you keep the relevant configuration parameters in main.cf. If you must specify "-o smtpd_mumble=value" parameter overrides in master.cf for a postscreen-protected smtpd(8) service, then you should specify those same parameter overrides for the postscreen(8) and tlsproxy(8) services. BBlloocckkiinngg mmaaiill wwiitthh ppoossttssccrreeeenn((88)) For compatibility with smtpd(8), postscreen(8) implements the soft_bounce safety feature. This causes Postfix to reject mail with a "try again" reply code. * To turn this on for all of Postfix, specify "soft_bounce = yes" in main.cf. * To turn this on for postscreen(8) only, append "-o soft_bounce=yes" (note: NO SPACES around '=') to the postscreen entry in master.cf. Execute "postfix reload" to make the change effective. After testing, do not forget to remove the soft_bounce feature, otherwise senders won't receive their non-delivery notification until many days later. To use the postscreen(8) service to block mail, edit main.cf and specify one or more of: * "postscreen_dnsbl_action = enforce", to reject clients that are on DNS blocklists, and to log the helo/sender/recipient information. With good DNSBLs this reduces the amount of load on Postfix SMTP servers dramatically. * "postscreen_greet_action = enforce", to reject clients that talk before their turn, and to log the helo/sender/recipient information. This stops over half of all known-to-be illegitimate connections to Wietse's mail server. It is backup protection for zombies that haven't yet been denylisted. * You can also enable "deep protocol tests", but these are more intrusive than the pregreet or DNSBL tests. When a good client passes the "deep protocol tests", postscreen(8) adds the client to the temporary allowlist but it cannot hand off the "live" connection to a Postfix SMTP server process in the middle of the session. Instead, postscreen(8) defers mail delivery attempts with a 4XX status, logs the helo/sender/recipient information, and waits for the client to disconnect. When the good client comes back in a later session, it is allowed to talk directly to a Postfix SMTP server. See "Tests after the 220 SMTP server greeting" above for limitations with AUTH and other features that clients may need. An unexpected benefit from "deep protocol tests" is that some "good" clients don't return after the 4XX reply; these clients were not so good after all. Unfortunately, some senders will retry requests from different IP addresses, and may never get allowlisted. For this reason, Wietse stopped using "deep protocol tests" on his own internet-facing mail server. * There is also support for permanent denylisting and allowlisting; see the description of the postscreen_access_list parameter for details. TTuurrnniinngg ooffff ppoossttssccrreeeenn((88)) To turn off postscreen(8) and handle mail directly with Postfix SMTP server processes: 1. Comment out the "smtp inet ... postscreen" service in master.cf, including any "-o parameter=value" entries that follow. /etc/postfix/master.cf: #smtp inet n - n - 1 postscreen # -o parameter=value ... 2. Comment out the "dnsblog unix ... dnsblog" service in master.cf. /etc/postfix/master.cf: #dnsblog unix - - n - 0 dnsblog 3. Comment out the "smtpd pass ... smtpd" service in master.cf, including any "-o parameter=value" entries that follow. /etc/postfix/master.cf: #smtpd pass - - n - - smtpd # -o parameter=value ... 4. Comment out the "tlsproxy unix ... tlsproxy" service in master.cf, including any "-o parameter=value" entries that follow. /etc/postfix/master.cf: #tlsproxy unix - - n - 0 tlsproxy # -o parameter=value ... 5. Uncomment the "smtp inet ... smtpd" service in master.cf, including any "- o parameter=value" entries that may follow. /etc/postfix/master.cf: smtp inet n - n - - smtpd -o parameter=value ... 6. Read the new configuration with "postfix reload". SShhaarriinngg tthhee tteemmppoorraarryy aalllloowwlliisstt By default, the temporary allowlist is not shared between multiple postscreen (8) daemons. To enable sharing, choose one of the following options: * A non-persistent memcache: temporary allowlist can be shared between postscreen(8) daemons on the same host or different hosts. Disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons because memcache: has no first-next API (but see example 4 below for memcache: with persistent backup). This requires Postfix 2.9 or later. # Example 1: non-persistent memcache: allowlist. /etc/postfix/main.cf: postscreen_cache_map = memcache:/etc/postfix/postscreen_cache postscreen_cache_cleanup_interval = 0 /etc/postfix/postscreen_cache: memcache = inet:127.0.0.1:11211 key_format = postscreen:%s * A persistent lmdb: temporary allowlist can be shared between postscreen(8) daemons that run under the same master(8) daemon, or under different master (8) daemons on the same host. Disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons except one that is responsible for cache cleanup. This requires Postfix 2.11 or later. # Example 2: persistent lmdb: allowlist. /etc/postfix/main.cf: postscreen_cache_map = lmdb:$data_directory/postscreen_cache # See note 1 below. # postscreen_cache_cleanup_interval = 0 * Other kinds of persistent temporary allowlist can be shared only between postscreen(8) daemons that run under the same master(8) daemon. In this case, temporary allowlist access must be shared through the proxymap(8) daemon. This requires Postfix 2.9 or later. # Example 3: proxied btree: allowlist. /etc/postfix/main.cf: postscreen_cache_map = proxy:btree:/var/lib/postfix/postscreen_cache # See note 1 below. # postscreen_cache_cleanup_interval = 0 # Example 4: proxied btree: allowlist with memcache: accelerator. /etc/postfix/main.cf: postscreen_cache_map = memcache:/etc/postfix/postscreen_cache proxy_write_maps = proxy:btree:/var/lib/postfix/postscreen_cache ... other proxied tables ... # See note 1 below. # postscreen_cache_cleanup_interval = 0 /etc/postfix/postscreen_cache: # Note: the $data_directory macro is not defined in this context. memcache = inet:127.0.0.1:11211 backup = proxy:btree:/var/lib/postfix/postscreen_cache key_format = postscreen:%s Note 1: disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons except one that is responsible for cache cleanup. Note 2: postscreen(8) cache sharing via proxymap(8) requires Postfix 2.9 or later; earlier proxymap(8) implementations don't support cache cleanup. HHiissttoorriiccaall nnootteess aanndd ccrreeddiittss Many ideas in postscreen(8) were explored in earlier work by Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic Control. Wietse threw together a crude prototype with pregreet and dnsbl support in June 2009, because he needed something new for a Mailserver conference presentation in July. Ralf Hildebrandt ran this code on several servers to collect real- world statistics. This version used the dnsblog(8) ad-hoc DNS client program. Wietse needed new material for a LISA conference presentation in November 2010, so he added support for DNSBL weights and filters in August, followed by a major code rewrite, deep protocol tests, helo/sender/recipient logging, and stress-adaptive behavior in September. Ralf Hildebrandt ran this code on several servers to collect real-world statistics. This version still used the embarrassing dnsblog(8) ad-hoc DNS client program. Wietse added STARTTLS support in December 2010. This makes postscreen(8) usable for sites that require TLS support. The implementation introduces the tlsproxy (8) event-driven TLS proxy that decrypts/encrypts the sessions for multiple SMTP clients. The tlsproxy(8) implementation led to the discovery of a "new" class of vulnerability (CVE-2011-0411) that affected multiple implementations of SMTP, POP, IMAP, NNTP, and FTP over TLS. postscreen(8) was officially released as part of the Postfix 2.8 stable release in January 2011. @ 1.1.1.1 log @Import Postfix-3.7.3 (previous version was 3.5.2) This is the Postfix 3.7 (stable) release. The stable Postfix release is called postfix-3.7.x where 3=major release number, 7=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called postfix-3.8-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 3.5 or earlier, read RELEASE_NOTES-3.6 before proceeding. License change --------------- This software is distributed with a dual license: in addition to the historical IBM Public License 1.0, it is now also distributed with the more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. Bugfix for messages not delivered after "warning: Unexpected record type 'X' ============================================================================ Due to a bug introduced in Postfix 3.7.0, a message could falsely be flagged as corrupt with "warning: Unexpected record type 'X'". Such messages were moved to the "corrupt" queue directory, where they may still be found. See below for instructions to deal with these falsely flagged messages. This could happen for messages with 5000 or more recipients, or with fewer recipients on a busy mail server. The problem was first reported by Frank Brendel, reproduced by John Alex. A file in the "corrupt" queue directory may be inspected with the command "postcat /var/spool/postfix/corrupt/. If delivery of the file is still desired, the file can be moved back to /var/spool/postfix/incoming after updating Postfix and executing "postfix reload". Major changes - configuration ----------------------------- [Feature 20210605] Support to inline the content of small cidr:, pcre:, and regexp: tables in Postfix parameter values. Example: smtpd_forbidden_commands = CONNECT GET POST regexp:{{/^[^A-Z]/ Thrash}} This is the new smtpd_forbidden_commands default value. It will immediately disconnect a remote SMTP client when a command does not start with a letter (a-z or A-Z). The basic syntax is: /etc/postfix/main.cf: parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. /etc/postfix/master.cf: .. -o { parameter = .. map-type:{ { rule-1 }, { rule-2 } .. } .. } .. where map-type is one of cidr, pcre, or regexp. Postfix ignores whitespace after '{' and before '}', and writes each rule as one text line to a nameless in-memory file: in-memory file: rule-1 rule-2 .. Postfix parses the result as if it is a file in /etc/postfix. Note: if a rule contains $, specify $$ to keep Postfix from trying to do $name expansion as it evaluates the parameter value. Major changes - lmdb support ---------------------------- [Feature 20210605] Overhauled the LMDB client's error handling, and added integration tests for future-proofing. There are no visible changes in documented behavior. Major changes - logging ----------------------- [Feature 20210815] To make the maillog_file feature more useful, the postlog(1) command is now set-gid postdrop, so that unprivileged programs can use it to write logging through the postlogd(8) daemon. This required hardening the postlog(1) command against privilege escalation attacks. DO NOT turn on the set-gid bit with older postlog(1) implementations. Major changes - pcre2 support ----------------------------- [Feature 20211127] Support for the pcre2 library (the legacy pcre library is no longer maintained). The Postfix build procedure automatically detects if the pcre2 library is installed, and if it is unavailable, the Postfix build procedure will detect if the legacy pcre library is installed. See PCRE_README if you need to build Postfix with a specific library. Visible differences: some error messages may have a different text, and the 'X' pattern flag is no longer supported with pcre2. Major changes - security ------------------------ [Feature 20220102] Postfix programs now randomize the initial state of in-memory hash tables, to defend against hash collision attacks involving a large number of attacker-chosen lookup keys. Presently, the only known opportunity for such attacks involves remote SMTP client IPv6 addresses in the anvil(8) service. The attack would require making hundreds of short-lived connections per second from thousands of different IP addresses, because the anvil(8) service drops inactive counters after 100s. Other in-memory hash tables with attacker-chosen lookup keys are by design limited in size. The fix is cheap, and therefore implemented for all Postfix in-memory hash tables. Problem reported by Pascal Junod. [Feature 20211030] The postqueue command now sanitizes non-printable characters (such as newlines) in strings before they are formatted as json or as legacy output. These outputs are piped into other programs that are run by administrative users. This closes a hypothetical opportunity for privilege escalation. [Feature 20210815] Updated defense against remote clients or servers that 'trickle' SMTP or LMTP traffic, based on per-request deadlines and minimum data rates. Per-request deadlines: The new {smtpd,smtp,lmtp}_per_request_deadline parameters replace {smtpd,smtp,lmtp}_per_record_deadline, with backwards compatible default settings. This defense is enabled by default in the Postfix SMTP server in case of overload. The new smtpd_per_record_deadline parameter limits the combined time for the Postfix SMTP server to receive a request and to send a response, while the new {smtp,lmtp}_per_record_deadline parameters limit the combined time for the Postfix SMTP or LMTP client to send a request and to receive a response. Minimum data rates: The new smtpd_min_data_rate parameter enforces a minimum plaintext data transfer rate for DATA and BDAT requests, but only when smtpd_per_record_deadline is enabled. After a read operation transfers N plaintext bytes (possibly after TLS decryption), and after the DATA or BDAT request deadline is decreased by the elapsed time of that read operation, the DATA or BDAT request deadline is increased by N/smtpd_min_data_rate seconds. However, the deadline is never increased beyond the smtpd_timeout value. The default minimum data rate is 500 (bytes/second) but is still subject to change. The new {smtp,lmtp}_min_data_rate parameters enforce the corresponding minimum DATA transfer rates for the Postfix SMTP and LMTP client. Major changes - tls support --------------------------- [Cleanup 20220121] The new tlsproxy_client_security_level parameter replaces tlsproxy_client_level, and the new tlsproxy_client_policy_maps parameter replaces tlsproxy_client_policy. This is for consistent parameter naming (tlsproxy_client_xxx corresponds to smtp_tls_xxx). This change was made with backwards-compatible default settings. [Feature 20210926] Postfix was updated to support OpenSSL 3.0.0 API features, and to work around OpenSSL 3.0.0 bit-rot (avoid using deprecated API features). Other code health ----------------- [typos] Typo fixes by raf. [pre-release checks] Added pre-release checks to detect a) new typos in documentation and source-code comments, b) missing entries in the postfix-files file (some documentation would not be installed), c) missing rules in the postlink script (some text would not have a hyperlink in documentation), and d) missing map-based $parameter names in the proxy_read_maps default value (the proxymap daemon would not automatically authorize some proxied maps). [memory stream] Improved support for memory-based streams made it possible to inline small cidr:, pcre:, and regexp: maps in Postfix parameter values, and to eliminate some ad-hoc code that converted tlsproxy(8) protocol data to or from serialized form. ************************************************************************* This is the Postfix 3.6 (stable) release. The stable Postfix release is called postfix-3.6.x where 3=major release number, 6=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called postfix-3.7-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. The mail_release_date configuration parameter (format: yyyymmdd) specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 3.4 or earlier, read RELEASE_NOTES-3.5 before proceeding. License change --------------- This software is distributed with a dual license: in addition to the historical IBM Public License 1.0, it is now also distributed with the more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. Major changes - internal protocol identification ------------------------------------------------ [Incompat 20200920] Internal protocols have changed. You need to "postfix stop" before updating, or before backing out to an earlier release, otherwise long-running daemons (pickup, qmgr, verify, tlsproxy, postscreen) may fail to communicate with the rest of Postfix, causing mail delivery delays until Postfix is restarted. This change does not affect message files in Postfix queue directories, only the communication between running Postfix programs. With this change, every Postfix internal service, including the postdrop command, announces the name of its protocol before doing any other I/O. Every Postfix client program, including the Postfix sendmail command, will verify that the protocol name matches what it is supposed to be. The purpose of this change is to produce better error messages, for example, when someone configures the discard daemon as a bounce service in master.cf, or vice versa. This change may break third-party programs that implement a Postfix-internal protocol such as qpsmtpd. Such programs have never been supported. Fortunately, this will be an easy fix: look at the first data from the cleanup daemon: if it is a protocol announcement, you're talking to Postfix 3.6 or later. That's the only real change. Major changes - tls ------------------- [Incompat 20200705] The minimum supported OpenSSL version is 1.1.1, which will reach the end of life by 2023-09-11. Postfix 3.6 is expected to reach the end of support in 2025. Until then, Postfix will be updated as needed for compatibility with OpenSSL. The default fingerprint digest has changed from md5 to sha256 (Postfix 3.6 with compatibility_level >= 3.6). With a lower compatibility_level setting, Postfix defaults to using md5, and logs a warning when a Postfix configuration specifies no explicit digest type. Export-grade Diffie-Hellman key exchange is no longer supported, and the tlsproxy_tls_dh512_param_file parameter is ignored, [Feature 20200906] The tlstype.pl helper script by Viktor Dukhovni reports TLS information per message delivery. This processes output from the collate.pl script. See auxiliary/collate/README.tlstype and auxiliary/collate/tlstype.pl. Major changes - compatibility level ----------------------------------- [Feature 20210109] Starting with Postfix version 3.6, the compatibility level is "3.6". In future Postfix releases, the compatibility level will be the Postfix version that introduced the last incompatible change. The level is formatted as 'major.minor.patch', where 'patch' is usually omitted and defaults to zero. Earlier compatibility levels are 0, 1 and 2. This also introduces main.cf and master.cf support for the <=level, " which matches an empty sender address, and the "@@domain" wildcard pattern. More information about those can be found in the postconf(5) manpage. Example: /etc/postfix/main.cf: # Allow root and postfix full control, anyone else can only # send mail as themselves. Use "uid:" followed by the numerical # UID when the UID has no entry in the UNIX password file. local_login_sender_maps = inline:{ { root = *}, { postfix = * } }, pcre:/etc/postfix/login_senders /etc/postfix/login_senders: # Allow both the bare username and the user@@domain forms. /(.+)/ $1 $1@@example.com Major changes - order of relay and recipient restrictions --------------------------------------------------------- [Incompat 20210131] With smtpd_relay_before_recipient_restrictions=yes, the Postfix SMTP server will evaluate smtpd_relay_restrictions before smtpd_recipient_restrictions. This is the default behavior with compatibility_level >= 3.6. This change makes the implemented behavior consistent with existing documentation. There is a backwards-compatibility warning that allows users to freeze historical behavior. See COMPATIBILITY_README for details. Major changes - respectful logging ---------------------------------- [Feature 20210220] Postfix version 3.6 deprecates terminology that implies white is better than black. Instead, Postfix prefers 'allowlist', 'denylist', and variations on those words. This change affects Postfix documentation, and postscreen parameters and logging. To keep the old postscreen logging set "respectful_logging = no" in main.cf. Noel Jones assisted with the initial transition. Changes in documentation ------------------------ Postfix documentation was updated to use 'allowlist', 'denylist', etc. These documentation changes do not affect Postfix behavior. Changes in parameter names -------------------------- The following postscreen parameters replace names that contain 'blacklist' or 'whitelist': postscreen_allowlist_interfaces postscreen_denylist_action postscreen_dnsbl_allowlist_threshold These new parameters have backwards-compatible default settings that support the old parameter names, so that the name change should not affect Postfix behavior. This means that existing management tools that use the old parameter names should keep working as before. This compatibility safety net may break when some management tools use the new parameter names, and some use the old names, such that different tools will disagree on how Postfix works. Changes in logging ------------------ The following logging replaces forms that contain 'blacklist' or 'whitelist': postfix/postscreen[pid]: ALLOWLIST VETO [address]:port postfix/postscreen[pid]: ALLOWLISTED [address]:port postfix/postscreen[pid]: DENYLISTED [address]:port To avoid breaking logfile analysis tools, Postfix keeps logging the old forms by default, as long as the compatibility_level parameter setting is less than 3.6, and the respectful_logging parameter is not explicitly configured. As a reminder, Postfix will log the following: postfix/postscreen[pid]: Using backwards-compatible default setting respectful_logging=no for client [address]:port To keep logging the old form, make the setting "respectful_logging = no" permanent in main.cf, for example: # postconf "respectful_logging = no" # postfix reload To stop the reminder, configure the respectful_logging parameter to "yes" or "no", or configure "compatibility_level = 3.6". Major changes - threaded bounces -------------------------------- [Feature 20201205] Support for threaded bounces. This allows mail readers to present a non-delivery, delayed delivery, or successful delivery notification in the same email thread as the original message. Unfortunately, this also makes it easy for users to mistakenly delete the whole email thread (all related messages), instead of deleting only the delivery status notification. To enable, specify "enable_threaded_bounces = yes". Other changes - smtpd_sasl_mechanism_list ----------------------------------------- [Feature 20200906] The smtpd_sasl_mechanism_list parameter (default: !external, static:rest) prevents confusing errors when a SASL backend announces EXTERNAL support which Postfix does not support. Other changes - delivery logging -------------------------------- [Incompat 20200531] Postfix delivery agents now log an explicit record when delegating delivery to a different Postfix delivery agent. For example, with "best_mx_transport = local", an SMTP delivery agent will now log when a recipient will be delivered locally. This makes the delegating delivery agent visible, where it would otherwise have remained invisible, which would complicate troubleshooting. postfix/smtp[pid]: queueid: passing to transport=local This will usually be followed by logging for an actual delivery: postfix/local[pid]: queueid: to=, relay=local, ... Other examples: the local delivery agent will log a record that it defers mailbox delivery through mailbox_transport or through fallback_transport. Other changes - error logging ----------------------------- [Incompat 20200531] Postfix programs will now log "Application error" instead of "Success" or "Unknown error: 0" when an operation fails with errno == 0, i.e., the error originates from non-kernel code. Other changes - dns lookups --------------------------- [Feature 20200509] The threadsafe resolver API (res_nxxx() calls) is now the default, not because the API is threadsafe, but because this is the API where new features are being added. To build old style, build with: make makefiles CCARGS="-DNO_RES_NCALLS..." This is the default for systems that are known not to support the threadsafe resolver API. @ text @@ 1.1.1.1.4.1 log @file POSTSCREEN_3_5_README was added on branch netbsd-9 on 2023-12-25 12:54:31 +0000 @ text @d1 863 @ 1.1.1.1.4.2 log @Pull up the following, requeste by kim in ticket #1779: external/ibm-public/postfix/dist/README_FILES/BDAT_README up to 1.1.1.2 external/ibm-public/postfix/dist/README_FILES/MAILLOG_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_3_5_README up to 1.1.1.1 external/ibm-public/postfix/dist/html/BDAT_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/MAILLOG_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/makedefs.1.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/postlogd.8.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/POSTSCREEN_3_5_README.html up to 1.1.1.2 external/ibm-public/postfix/dist/html/postfix-doc.css up to 1.1.1.1 external/ibm-public/postfix/dist/man/man1/makedefs.1 up to 1.3 external/ibm-public/postfix/dist/man/man8/postlogd.8 up to 1.3 external/ibm-public/postfix/dist/mantools/missing-proxy-read-maps up to 1.1.1.3 external/ibm-public/postfix/dist/mantools/spelldiff up to 1.1.1.1 external/ibm-public/postfix/dist/mantools/check-double-cc up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/check-double-install-proto-text up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/check-double-proto-html up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/comment.c up to 1.2 external/ibm-public/postfix/dist/mantools/check-postfix-files up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/check-spell-cc up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/check-spell-install-proto-text up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/check-spell-proto-html up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/deroff up to 1.1.1.1 external/ibm-public/postfix/dist/mantools/find-double up to 1.1.1.1 external/ibm-public/postfix/dist/mantools/check-double-history up to 1.1.1.1 external/ibm-public/postfix/dist/mantools/check-spell-history up to 1.1.1.1 external/ibm-public/postfix/dist/mantools/check-table-proto up to 1.1.1.1 external/ibm-public/postfix/dist/proto/BDAT_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/MAILLOG_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/POSTSCREEN_3_5_README.html up to 1.1.1.2 external/ibm-public/postfix/dist/proto/stop.double-cc up to 1.1.1.2 external/ibm-public/postfix/dist/proto/stop.double-install-proto-text up to 1.1.1.1 external/ibm-public/postfix/dist/proto/stop.double-proto-html up to 1.1.1.2 external/ibm-public/postfix/dist/proto/stop.spell-cc up to 1.1.1.2 external/ibm-public/postfix/dist/proto/stop.spell-proto-html up to 1.1.1.2 external/ibm-public/postfix/dist/proto/stop.double-history up to 1.1.1.1 external/ibm-public/postfix/dist/proto/stop.spell-history up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/bounce_notify_util_tester.c up to 1.2 external/ibm-public/postfix/dist/src/bounce/logfile-no-msgid-no-eoh-event up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/logfile-no-msgid-with-eoh-event up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-no-eoh-event up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-eoh-event up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-filter up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/logfile-with-msgid-with-long-line up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/msgfile-no-msgid-no-eoh-event up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/msgfile-no-msgid-with-eoh-event up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-no-eoh-event up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-eoh-event up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/obs_template_test.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-filter up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/msgfile-with-msgid-with-long-line up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/no-msgid-no-eoh-event-no-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/no-msgid-no-eoh-event-with-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/no-msgid-with-eoh-event-no-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/no-msgid-with-eoh-event-with-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/with-msgid-no-eoh-event-no-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/with-msgid-no-eoh-event-with-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/with-msgid-with-eoh-event-no-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/with-msgid-with-eoh-event-with-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/with-msgid-with-filter-no-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/with-msgid-with-filter-with-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/with-msgid-with-long-line-no-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/bounce/with-msgid-with-long-line-with-thread.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13e up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13f up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13g up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13h up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in13i up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13e up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13f up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13g up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13h up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13i up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/test-queue-file13e up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/test-queue-file13f up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/test-queue-file13g up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/test-queue-file13h up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/test-queue-file13i up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17a up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17b up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17c up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17d up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17e up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17f up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.in17g up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17a1 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17a2 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17b1 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17b2 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17c1 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17c2 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17d1 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17d2 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17e1 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17e2 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17f1 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17f2 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17g1 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref17g2 up to 1.1.1.1 external/ibm-public/postfix/dist/src/cleanup/test-queue-file17 up to 1.1.1.1 external/ibm-public/postfix/dist/src/dns/dns_str_resflags.c up to 1.3 external/ibm-public/postfix/dist/src/dns/dns_sec.c up to 1.2 external/ibm-public/postfix/dist/src/global/header_body_checks_strip.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/info_log_addr_form.c up to 1.2 external/ibm-public/postfix/dist/src/global/info_log_addr_form.h up to 1.2 external/ibm-public/postfix/dist/src/global/mail_addr_crunch.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/mail_addr_crunch.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/mail_addr_find.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/map_search.c up to 1.4 external/ibm-public/postfix/dist/src/global/map_search.h up to 1.2 external/ibm-public/postfix/dist/src/global/mail_addr_find.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/mail_addr_form.c up to 1.2 external/ibm-public/postfix/dist/src/global/mail_addr_form.h up to 1.2 external/ibm-public/postfix/dist/src/global/mail_addr_map.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/maillog_client.c up to 1.3 external/ibm-public/postfix/dist/src/global/maillog_client.h up to 1.2 external/ibm-public/postfix/dist/src/global/map_search.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.c up to 1.3 external/ibm-public/postfix/dist/src/global/normalize_mailhost_addr.h up to 1.2 external/ibm-public/postfix/dist/src/global/off_cvt.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/off_cvt.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/quote_822_local.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/global/quote_822_local.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/global/quote_flags.c up to 1.2 external/ibm-public/postfix/dist/src/global/reject_deliver_request.c up to 1.2 external/ibm-public/postfix/dist/src/global/compat_level.c up to 1.3 external/ibm-public/postfix/dist/src/global/compat_level.h up to 1.3 external/ibm-public/postfix/dist/src/global/test_main.c up to 1.2 external/ibm-public/postfix/dist/src/global/compat_level_convert.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/compat_level_convert.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/compat_level_expand.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/compat_level_expand.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.c up to 1.2 external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.h up to 1.2 external/ibm-public/postfix/dist/src/global/config_known_tcp_ports.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/delivered_hdr.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/hfrom_format.c up to 1.2 external/ibm-public/postfix/dist/src/global/hfrom_format.h up to 1.2 external/ibm-public/postfix/dist/src/global/hfrom_format.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/login_sender_match.c up to 1.2 external/ibm-public/postfix/dist/src/global/login_sender_match.h up to 1.2 external/ibm-public/postfix/dist/src/global/login_sender_match.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/global/sasl_mech_filter.c up to 1.2 external/ibm-public/postfix/dist/src/global/sasl_mech_filter.h up to 1.2 external/ibm-public/postfix/dist/src/global/test_main.h up to 1.2 external/ibm-public/postfix/dist/src/master/dgram_server.c up to 1.3 external/ibm-public/postfix/dist/src/postconf/extract_cfg.sh up to 1.1.1.1 external/ibm-public/postfix/dist/src/postconf/test64.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postconf/test65.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postconf/test66.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postconf/test67.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postconf/test68.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postconf/test69.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postconf/test70.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postconf/test71.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postmap/file_test.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/postmap/file_test.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postmap/quote_test.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/postmap/quote_test.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/postmap/lmdb_abb up to 1.1.1.1 external/ibm-public/postfix/dist/src/postmap/lmdb_abb.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/smtp/smtp_misc.c up to 1.2 external/ibm-public/postfix/dist/src/smtp/smtp_map11.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_addr_valid.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/bad-back-to-back-keys.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/bad-ec-cert-before-key.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/bad-key-cert-mismatch.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/bad-rsa-key-last.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/ecca-cert.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/ecca-pkey.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/ecee-cert.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/ecee-pkey.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/ecroot-cert.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/ecroot-pkey.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/good-mixed-keyfirst.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/good-mixed-keylast.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/good-mixed-keymiddle.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/goodchains.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/goodchains.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/mkcert.sh up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/rsaca-cert.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/rsaca-pkey.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/rsaee-cert.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/rsaee-pkey.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/rsaroot-cert.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/rsaroot-pkey.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/tls_proxy_client_misc.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_proxy_client_print.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_proxy_client_scan.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_proxy_context_print.c up to 1.3 external/ibm-public/postfix/dist/src/tls/tls_proxy_context_scan.c up to 1.3 external/ibm-public/postfix/dist/src/tls/tls_proxy_server_print.c up to 1.3 external/ibm-public/postfix/dist/src/tls/tls_proxy_server_scan.c up to 1.3 external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem up to 1.1.1.1 external/ibm-public/postfix/dist/src/tls/warn-mixed-multi-key.pem.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/trivial-rewrite/transport.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/trivial-rewrite/transport.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/mkmap_db.c up to 1.2 external/ibm-public/postfix/dist/src/util/mkmap.h up to 1.2 external/ibm-public/postfix/dist/src/util/argv_attr.h up to 1.3 external/ibm-public/postfix/dist/src/util/argv_attr_print.c up to 1.3 external/ibm-public/postfix/dist/src/util/argv_attr_scan.c up to 1.3 external/ibm-public/postfix/dist/src/util/byte_mask.c up to 1.2 external/ibm-public/postfix/dist/src/util/byte_mask.h up to 1.2 external/ibm-public/postfix/dist/src/util/byte_mask.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/byte_mask.ref0 up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/byte_mask.ref1 up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/byte_mask.ref2 up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_file.c up to 1.3 external/ibm-public/postfix/dist/src/util/dict_cidr_file.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/logwriter.c up to 1.2 external/ibm-public/postfix/dist/src/util/dict_cidr_file.map up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_cidr_file.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_inline_file.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_pcre_file.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_pcre_file.map up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_pcre_file.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_pipe_test.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_pipe_test.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_random.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_random_file.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_regexp_file.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_regexp_file.map up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_regexp_file.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_static_file.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_thash.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_thash.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_union_test.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_union_test.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/logwriter.h up to 1.2 external/ibm-public/postfix/dist/src/util/miss_endif_cidr.map up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/miss_endif_cidr.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/miss_endif_pcre.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/miss_endif_re.map up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/miss_endif_regexp.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/msg_logger.c up to 1.3 external/ibm-public/postfix/dist/src/util/msg_logger.h up to 1.2 external/ibm-public/postfix/dist/src/util/split_qnameval.c up to 1.2 external/ibm-public/postfix/dist/src/util/unix_dgram_connect.c up to 1.3 external/ibm-public/postfix/dist/src/util/unix_dgram_listen.c up to 1.3 external/ibm-public/postfix/dist/src/util/vbuf_print_test.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/vbuf_print_test.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/vstream_test.in up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/vstream_test.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/vstring_test.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/sane_strtol.c up to 1.2 external/ibm-public/postfix/dist/src/util/argv_split_at.c up to 1.2 external/ibm-public/postfix/dist/src/util/dict_stream.c up to 1.2 external/ibm-public/postfix/dist/src/util/dict_inline_cidr.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_inline_pcre.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_inline_regexp.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/dict_stream.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/find_inet.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/hash_fnv.c up to 1.3 external/ibm-public/postfix/dist/src/util/hash_fnv.h up to 1.3 external/ibm-public/postfix/dist/src/util/known_tcp_ports.c up to 1.2 external/ibm-public/postfix/dist/src/util/known_tcp_ports.h up to 1.2 external/ibm-public/postfix/dist/src/util/known_tcp_ports.ref up to 1.1.1.1 external/ibm-public/postfix/dist/src/util/ldseed.c up to 1.2 external/ibm-public/postfix/dist/src/util/ldseed.h up to 1.2 external/ibm-public/postfix/dist/src/util/mystrtok.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/sane_strtol.h up to 1.2 external/ibm-public/postfix/dist/src/util/inet_addr_sizes.c up to 1.2 external/ibm-public/postfix/dist/src/util/inet_addr_sizes.h up to 1.2 external/ibm-public/postfix/dist/src/util/inet_prefix_top.c up to 1.2 external/ibm-public/postfix/dist/src/util/inet_prefix_top.h up to 1.2 external/ibm-public/postfix/dist/src/util/mkmap_cdb.c up to 1.2 external/ibm-public/postfix/dist/src/util/mkmap_dbm.c up to 1.2 external/ibm-public/postfix/dist/src/util/mkmap_fail.c up to 1.2 external/ibm-public/postfix/dist/src/util/mkmap_lmdb.c up to 1.2 external/ibm-public/postfix/dist/src/util/mkmap_open.c up to 1.2 external/ibm-public/postfix/dist/src/util/mkmap_sdbm.c up to 1.2 external/ibm-public/postfix/dist/src/postlogd/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/postlogd/postlogd.c up to 1.3 external/ibm-public/postfix/dist/RELEASE_NOTES-3.1 up to 1.1.1.1 external/ibm-public/postfix/dist/RELEASE_NOTES-3.2 up to 1.1.1.1 external/ibm-public/postfix/dist/RELEASE_NOTES-3.3 up to 1.1.1.1 external/ibm-public/postfix/dist/RELEASE_NOTES-3.4 up to 1.1.1.1 external/ibm-public/postfix/dist/RELEASE_NOTES-3.5 up to 1.1.1.1 external/ibm-public/postfix/dist/RELEASE_NOTES-3.6 up to 1.1.1.1 external/ibm-public/postfix/dist/WISHLIST up to 1.1.1.2 external/ibm-public/postfix/dist/RELEASE_NOTES-3.7 up to 1.1.1.1 external/ibm-public/postfix/dist/README_FILES/CYRUS_README delete external/ibm-public/postfix/dist/src/global/mkmap.h delete external/ibm-public/postfix/dist/src/global/mkmap_cdb.c delete external/ibm-public/postfix/dist/src/global/mkmap_db.c delete external/ibm-public/postfix/dist/src/global/mkmap_dbm.c delete external/ibm-public/postfix/dist/src/global/mkmap_fail.c delete external/ibm-public/postfix/dist/src/global/mkmap_lmdb.c delete external/ibm-public/postfix/dist/src/global/mkmap_open.c delete external/ibm-public/postfix/dist/src/global/mkmap_sdbm.c delete external/ibm-public/postfix/dist/src/smtp/map11_map delete external/ibm-public/postfix/dist/src/tls/tls_proxy_print.c delete external/ibm-public/postfix/dist/src/tls/tls_proxy_scan.c delete external/ibm-public/postfix/dist/src/util/percentm.c delete external/ibm-public/postfix/dist/src/util/percentm.h delete external/ibm-public/postfix/Makefile.inc up to 1.31 (+patch) external/ibm-public/postfix/dist/AAAREADME up to 1.1.1.4 external/ibm-public/postfix/dist/HISTORY up to 1.1.1.29 external/ibm-public/postfix/dist/INSTALL up to 1.1.1.9 external/ibm-public/postfix/dist/LICENSE up to 1.1.1.2 external/ibm-public/postfix/dist/Makefile up to 1.1.1.3 external/ibm-public/postfix/dist/Makefile.in up to 1.1.1.10 external/ibm-public/postfix/dist/Makefile.init up to 1.1.1.3 external/ibm-public/postfix/dist/RELEASE_NOTES up to 1.1.1.17 external/ibm-public/postfix/dist/TLS_ACKNOWLEDGEMENTS up to 1.1.1.2 external/ibm-public/postfix/dist/TLS_CHANGES up to 1.1.1.2 external/ibm-public/postfix/dist/TLS_LICENSE up to 1.1.1.2 external/ibm-public/postfix/dist/US_PATENT_6321267 up to 1.1.1.2 external/ibm-public/postfix/dist/makedefs up to 1.16 external/ibm-public/postfix/dist/postfix-env.sh up to 1.1.1.2 external/ibm-public/postfix/dist/postfix-install up to 1.8 external/ibm-public/postfix/dist/README_FILES/AAAREADME up to 1.1.1.6 external/ibm-public/postfix/dist/README_FILES/ADDRESS_CLASS_README up to 1.1.1.2 external/ibm-public/postfix/dist/README_FILES/ADDRESS_REWRITING_README up to 1.1.1.5 external/ibm-public/postfix/dist/README_FILES/ADDRESS_VERIFICATION_README up to 1.10 external/ibm-public/postfix/dist/README_FILES/BACKSCATTER_README up to 1.1.1.5 external/ibm-public/postfix/dist/README_FILES/BASIC_CONFIGURATION_README up to 1.1.1.6 external/ibm-public/postfix/dist/README_FILES/BUILTIN_FILTER_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/COMPATIBILITY_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/CONNECTION_CACHE_README up to 1.1.1.5 external/ibm-public/postfix/dist/README_FILES/DATABASE_README up to 1.1.1.9 external/ibm-public/postfix/dist/README_FILES/DB_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/DEBUG_README up to 1.1.1.5 external/ibm-public/postfix/dist/README_FILES/FILTER_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/FORWARD_SECRECY_README up to 1.1.1.5 external/ibm-public/postfix/dist/README_FILES/INSTALL up to 1.10 external/ibm-public/postfix/dist/README_FILES/IPV6_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/LDAP_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/LINUX_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/LMDB_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/MILTER_README up to 1.1.1.9 external/ibm-public/postfix/dist/README_FILES/MULTI_INSTANCE_README up to 1.1.1.7 external/ibm-public/postfix/dist/README_FILES/MYSQL_README up to 1.1.1.5 external/ibm-public/postfix/dist/README_FILES/OVERVIEW up to 1.1.1.5 external/ibm-public/postfix/dist/README_FILES/PCRE_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/PGSQL_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/POSTSCREEN_README up to 1.1.1.7 external/ibm-public/postfix/dist/README_FILES/QSHAPE_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES up to 1.1.1.17 external/ibm-public/postfix/dist/README_FILES/SASL_README up to 1.1.1.11 external/ibm-public/postfix/dist/README_FILES/SCHEDULER_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/SMTPD_ACCESS_README up to 1.1.1.6 external/ibm-public/postfix/dist/README_FILES/SMTPD_POLICY_README up to 1.1.1.7 external/ibm-public/postfix/dist/README_FILES/SMTPD_PROXY_README up to 1.1.1.6 external/ibm-public/postfix/dist/README_FILES/SMTPUTF8_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/SOHO_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/SQLITE_README up to 1.1.1.4 external/ibm-public/postfix/dist/README_FILES/STANDARD_CONFIGURATION_README up to 1.1.1.6 external/ibm-public/postfix/dist/README_FILES/STRESS_README up to 1.1.1.6 external/ibm-public/postfix/dist/README_FILES/TLS_LEGACY_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/TLS_README up to 1.14 external/ibm-public/postfix/dist/README_FILES/TUNING_README up to 1.1.1.5 external/ibm-public/postfix/dist/README_FILES/VIRTUAL_README up to 1.1.1.3 external/ibm-public/postfix/dist/README_FILES/XCLIENT_README up to 1.1.1.4 external/ibm-public/postfix/dist/conf/LICENSE up to 1.1.1.2 external/ibm-public/postfix/dist/conf/TLS_LICENSE up to 1.1.1.2 external/ibm-public/postfix/dist/conf/access up to 1.1.1.8 external/ibm-public/postfix/dist/conf/aliases up to 1.1.1.5 external/ibm-public/postfix/dist/conf/canonical up to 1.1.1.5 external/ibm-public/postfix/dist/conf/generic up to 1.1.1.4 external/ibm-public/postfix/dist/conf/header_checks up to 1.1.1.6 external/ibm-public/postfix/dist/conf/main.cf up to 1.10 external/ibm-public/postfix/dist/conf/master.cf up to 1.11 external/ibm-public/postfix/dist/conf/post-install up to 1.4 external/ibm-public/postfix/dist/conf/postfix-files up to 1.9 external/ibm-public/postfix/dist/conf/postfix-script up to 1.4 external/ibm-public/postfix/dist/conf/postfix-tls-script up to 1.5 external/ibm-public/postfix/dist/conf/postmulti-script up to 1.3 external/ibm-public/postfix/dist/conf/relocated up to 1.1.1.3 external/ibm-public/postfix/dist/conf/transport up to 1.1.1.5 external/ibm-public/postfix/dist/conf/virtual up to 1.1.1.6 external/ibm-public/postfix/dist/html/ADDRESS_CLASS_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/ADDRESS_REWRITING_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/ADDRESS_VERIFICATION_README.html up to 1.11 external/ibm-public/postfix/dist/html/BACKSCATTER_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/BASIC_CONFIGURATION_README.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/BUILTIN_FILTER_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/CDB_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/COMPATIBILITY_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/CONNECTION_CACHE_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/CONTENT_INSPECTION_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/DATABASE_README.html up to 1.1.1.10 external/ibm-public/postfix/dist/html/DB_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/DEBUG_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/DSN_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/ETRN_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/FILTER_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/FORWARD_SECRECY_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/INSTALL.html up to 1.10 external/ibm-public/postfix/dist/html/IPV6_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/LDAP_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/LINUX_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/LMDB_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/LOCAL_RECIPIENT_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/MAILDROP_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/MEMCACHE_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/MILTER_README.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/MULTI_INSTANCE_README.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/MYSQL_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/Makefile.in up to 1.1.1.7 external/ibm-public/postfix/dist/html/NFS_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/OVERVIEW.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/PACKAGE_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/PCRE_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/PGSQL_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/POSTSCREEN_README.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/QSHAPE_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/RESTRICTION_CLASS_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/SASL_README.html up to 1.1.1.11 external/ibm-public/postfix/dist/html/SCHEDULER_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/SMTPD_ACCESS_README.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/SMTPD_POLICY_README.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/SMTPD_PROXY_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/SMTPUTF8_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/SOHO_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/SQLITE_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/STANDARD_CONFIGURATION_README.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/STRESS_README.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/TLS_LEGACY_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/TLS_README.html up to 1.15 external/ibm-public/postfix/dist/html/TUNING_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/UUCP_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/VERP_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/VIRTUAL_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/XCLIENT_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/XFORWARD_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/access.5.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/aliases.5.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/anvil.8.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/bounce.5.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/bounce.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/canonical.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/cidr_table.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/cleanup.8.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/defer.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/discard.8.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/dnsblog.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/error.8.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/flush.8.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/generic.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/header_checks.5.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/index.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/ldap_table.5.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/lmdb_table.5.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/lmtp.8.html up to 1.1.1.12 external/ibm-public/postfix/dist/html/local.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/mailq.1.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/master.5.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/master.8.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/memcache_table.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/mysql_table.5.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/newaliases.1.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/nisplus_table.5.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/oqmgr.8.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/pcre_table.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/pgsql_table.5.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/pickup.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/pipe.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/postalias.1.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/postcat.1.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/postconf.1.html up to 1.1.1.11 external/ibm-public/postfix/dist/html/postconf.5.html up to 1.19 external/ibm-public/postfix/dist/html/postdrop.1.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/postfix-manuals.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/postfix-tls.1.html up to 1.1.1.3 external/ibm-public/postfix/dist/html/postfix-wrapper.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/postfix.1.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/postkick.1.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/postlock.1.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/postlog.1.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/postmap.1.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/postmulti.1.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/postqueue.1.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/postscreen.8.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/postsuper.1.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/posttls-finger.1.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/proxymap.8.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/qmgr.8.html up to 1.1.1.9 external/ibm-public/postfix/dist/html/qmqp-sink.1.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/qmqp-source.1.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/qmqpd.8.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/qshape.1.html up to 1.1.1.4 external/ibm-public/postfix/dist/html/regexp_table.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/relocated.5.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/scache.8.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/sendmail.1.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/showq.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/smtp-sink.1.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/smtp-source.1.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/smtp.8.html up to 1.1.1.12 external/ibm-public/postfix/dist/html/smtpd.8.html up to 1.1.1.13 external/ibm-public/postfix/dist/html/socketmap_table.5.html up to 1.1.1.5 external/ibm-public/postfix/dist/html/spawn.8.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/sqlite_table.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/tcp_table.5.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/tlsmgr.8.html up to 1.1.1.6 external/ibm-public/postfix/dist/html/tlsproxy.8.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/trace.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/transport.5.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/trivial-rewrite.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/verify.8.html up to 1.1.1.8 external/ibm-public/postfix/dist/html/virtual.5.html up to 1.1.1.7 external/ibm-public/postfix/dist/html/virtual.8.html up to 1.1.1.7 external/ibm-public/postfix/dist/man/Makefile.in up to 1.1.1.7 external/ibm-public/postfix/dist/man/man1/postalias.1 up to 1.4 external/ibm-public/postfix/dist/man/man1/postcat.1 up to 1.4 external/ibm-public/postfix/dist/man/man1/postconf.1 up to 1.4 external/ibm-public/postfix/dist/man/man1/postdrop.1 up to 1.4 external/ibm-public/postfix/dist/man/man1/postfix-tls.1 up to 1.3 external/ibm-public/postfix/dist/man/man1/postfix.1 up to 1.6 external/ibm-public/postfix/dist/man/man1/postkick.1 up to 1.3 external/ibm-public/postfix/dist/man/man1/postlock.1 up to 1.3 external/ibm-public/postfix/dist/man/man1/postlog.1 up to 1.5 external/ibm-public/postfix/dist/man/man1/postmap.1 up to 1.4 external/ibm-public/postfix/dist/man/man1/postmulti.1 up to 1.4 external/ibm-public/postfix/dist/man/man1/postqueue.1 up to 1.5 external/ibm-public/postfix/dist/man/man1/postsuper.1 up to 1.4 external/ibm-public/postfix/dist/man/man1/posttls-finger.1 up to 1.5 external/ibm-public/postfix/dist/man/man1/sendmail.1 up to 1.4 external/ibm-public/postfix/dist/man/man1/smtp-sink.1 up to 1.3 external/ibm-public/postfix/dist/man/man5/access.5 up to 1.4 external/ibm-public/postfix/dist/man/man5/aliases.5 up to 1.5 external/ibm-public/postfix/dist/man/man5/canonical.5 up to 1.4 external/ibm-public/postfix/dist/man/man5/cidr_table.5 up to 1.5 external/ibm-public/postfix/dist/man/man5/generic.5 up to 1.4 external/ibm-public/postfix/dist/man/man5/header_checks.5 up to 1.3 external/ibm-public/postfix/dist/man/man5/ldap_table.5 up to 1.5 external/ibm-public/postfix/dist/man/man5/lmdb_table.5 up to 1.3 external/ibm-public/postfix/dist/man/man5/master.5 up to 1.4 external/ibm-public/postfix/dist/man/man5/mysql_table.5 up to 1.5 external/ibm-public/postfix/dist/man/man5/pcre_table.5 up to 1.4 external/ibm-public/postfix/dist/man/man5/pgsql_table.5 up to 1.5 external/ibm-public/postfix/dist/man/man5/postconf.5 up to 1.19 external/ibm-public/postfix/dist/man/man5/regexp_table.5 up to 1.4 external/ibm-public/postfix/dist/man/man5/relocated.5 up to 1.3 external/ibm-public/postfix/dist/man/man5/socketmap_table.5 up to 1.3 external/ibm-public/postfix/dist/man/man5/sqlite_table.5 up to 1.4 external/ibm-public/postfix/dist/man/man5/tcp_table.5 up to 1.3 external/ibm-public/postfix/dist/man/man5/transport.5 up to 1.4 external/ibm-public/postfix/dist/man/man5/virtual.5 up to 1.5 external/ibm-public/postfix/dist/man/man8/anvil.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/bounce.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/cleanup.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/discard.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/dnsblog.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/error.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/flush.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/local.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/master.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/oqmgr.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/pickup.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/pipe.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/postscreen.8 up to 1.5 external/ibm-public/postfix/dist/man/man8/proxymap.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/qmgr.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/qmqpd.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/scache.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/showq.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/smtp.8 up to 1.5 external/ibm-public/postfix/dist/man/man8/smtpd.8 up to 1.5 external/ibm-public/postfix/dist/man/man8/spawn.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/tlsmgr.8 up to 1.3 external/ibm-public/postfix/dist/man/man8/tlsproxy.8 up to 1.5 external/ibm-public/postfix/dist/man/man8/trivial-rewrite.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/verify.8 up to 1.4 external/ibm-public/postfix/dist/man/man8/virtual.8 up to 1.4 external/ibm-public/postfix/dist/mantools/ccformat up to 1.1.1.3 external/ibm-public/postfix/dist/mantools/check-postlink up to 1.1.1.3 external/ibm-public/postfix/dist/mantools/fixman up to 1.1.1.3 external/ibm-public/postfix/dist/mantools/make-relnotes up to 1.1.1.3 external/ibm-public/postfix/dist/mantools/make_soho_readme up to 1.1.1.4 external/ibm-public/postfix/dist/mantools/makemanidx up to 1.1.1.4 external/ibm-public/postfix/dist/mantools/man2html up to 1.1.1.5 external/ibm-public/postfix/dist/mantools/manlint up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/manspell up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/postconf2man up to 1.1.1.5 external/ibm-public/postfix/dist/mantools/postlink up to 1.1.1.13 external/ibm-public/postfix/dist/mantools/readme2html up to 1.1.1.2 external/ibm-public/postfix/dist/mantools/spell up to 1.1.1.3 external/ibm-public/postfix/dist/mantools/srctoman up to 1.1.1.3 external/ibm-public/postfix/dist/proto/ADDRESS_CLASS_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/ADDRESS_REWRITING_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/ADDRESS_VERIFICATION_README.html up to 1.11 external/ibm-public/postfix/dist/proto/BACKSCATTER_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/BASIC_CONFIGURATION_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/BUILTIN_FILTER_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/CDB_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/COMPATIBILITY_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/CONNECTION_CACHE_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/CONTENT_INSPECTION_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/DATABASE_README.html up to 1.1.1.10 external/ibm-public/postfix/dist/proto/DB_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/DEBUG_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/DSN_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/ETRN_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/FILTER_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/FORWARD_SECRECY_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/INSTALL.html up to 1.10 external/ibm-public/postfix/dist/proto/IPV6_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/LDAP_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/LINUX_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/LMDB_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/LOCAL_RECIPIENT_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/MAILDROP_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/MEMCACHE_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/MILTER_README.html up to 1.1.1.9 external/ibm-public/postfix/dist/proto/MULTI_INSTANCE_README.html up to 1.1.1.8 external/ibm-public/postfix/dist/proto/MYSQL_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/Makefile.in up to 1.1.1.7 external/ibm-public/postfix/dist/proto/NFS_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/OVERVIEW.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/PACKAGE_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/PCRE_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/PGSQL_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/POSTSCREEN_README.html up to 1.1.1.8 external/ibm-public/postfix/dist/proto/QSHAPE_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/RESTRICTION_CLASS_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/SASL_README.html up to 1.1.1.11 external/ibm-public/postfix/dist/proto/SCHEDULER_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/SMTPD_ACCESS_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/SMTPD_POLICY_README.html up to 1.1.1.7 external/ibm-public/postfix/dist/proto/SMTPD_PROXY_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/SMTPUTF8_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/SQLITE_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/STANDARD_CONFIGURATION_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/STRESS_README.html up to 1.1.1.7 external/ibm-public/postfix/dist/proto/TLS_LEGACY_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/TLS_README.html up to 1.14 external/ibm-public/postfix/dist/proto/TUNING_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/UUCP_README.html up to 1.1.1.3 external/ibm-public/postfix/dist/proto/VERP_README.html up to 1.1.1.5 external/ibm-public/postfix/dist/proto/VIRTUAL_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/XCLIENT_README.html up to 1.1.1.6 external/ibm-public/postfix/dist/proto/XFORWARD_README.html up to 1.1.1.4 external/ibm-public/postfix/dist/proto/access up to 1.1.1.8 external/ibm-public/postfix/dist/proto/aliases up to 1.1.1.6 external/ibm-public/postfix/dist/proto/canonical up to 1.1.1.5 external/ibm-public/postfix/dist/proto/cidr_table up to 1.1.1.6 external/ibm-public/postfix/dist/proto/generic up to 1.1.1.4 external/ibm-public/postfix/dist/proto/header_checks up to 1.1.1.7 external/ibm-public/postfix/dist/proto/ldap_table up to 1.1.1.7 external/ibm-public/postfix/dist/proto/lmdb_table up to 1.1.1.3 external/ibm-public/postfix/dist/proto/master up to 1.1.1.8 external/ibm-public/postfix/dist/proto/mysql_table up to 1.1.1.8 external/ibm-public/postfix/dist/proto/pcre_table up to 1.1.1.6 external/ibm-public/postfix/dist/proto/pgsql_table up to 1.1.1.8 external/ibm-public/postfix/dist/proto/postconf.html.prolog up to 1.1.1.5 external/ibm-public/postfix/dist/proto/postconf.man.prolog up to 1.1.1.4 external/ibm-public/postfix/dist/proto/postconf.proto up to 1.19 external/ibm-public/postfix/dist/proto/regexp_table up to 1.1.1.6 external/ibm-public/postfix/dist/proto/relocated up to 1.1.1.3 external/ibm-public/postfix/dist/proto/socketmap_table up to 1.1.1.3 external/ibm-public/postfix/dist/proto/sqlite_table up to 1.1.1.5 external/ibm-public/postfix/dist/proto/stop up to 1.1.1.7 external/ibm-public/postfix/dist/proto/tcp_table up to 1.1.1.4 external/ibm-public/postfix/dist/proto/transport up to 1.1.1.5 external/ibm-public/postfix/dist/proto/virtual up to 1.1.1.6 external/ibm-public/postfix/dist/src/anvil/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/anvil/anvil.c up to 1.4 external/ibm-public/postfix/dist/src/bounce/2template_test.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/bounce/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/bounce/bounce.c up to 1.4 external/ibm-public/postfix/dist/src/bounce/bounce_notify_util.c up to 1.4 external/ibm-public/postfix/dist/src/bounce/bounce_service.h up to 1.3 external/ibm-public/postfix/dist/src/bounce/bounce_template.c up to 1.4 external/ibm-public/postfix/dist/src/bounce/bounce_template.h up to 1.3 external/ibm-public/postfix/dist/src/bounce/bounce_templates.c up to 1.3 external/ibm-public/postfix/dist/src/bounce/template_test.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/cleanup/Makefile.in up to 1.1.1.9 external/ibm-public/postfix/dist/src/cleanup/cleanup.c up to 1.8 external/ibm-public/postfix/dist/src/cleanup/cleanup.h up to 1.10 external/ibm-public/postfix/dist/src/cleanup/cleanup_addr.c up to 1.3 external/ibm-public/postfix/dist/src/cleanup/cleanup_api.c up to 1.4 external/ibm-public/postfix/dist/src/cleanup/cleanup_body_edit.c up to 1.3 external/ibm-public/postfix/dist/src/cleanup/cleanup_envelope.c up to 1.5 external/ibm-public/postfix/dist/src/cleanup/cleanup_init.c up to 1.7 external/ibm-public/postfix/dist/src/cleanup/cleanup_map11.c up to 1.3 external/ibm-public/postfix/dist/src/cleanup/cleanup_map1n.c up to 1.4 external/ibm-public/postfix/dist/src/cleanup/cleanup_message.c up to 1.4 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.c up to 1.5 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13c up to 1.1.1.2 external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.ref13d up to 1.1.1.2 external/ibm-public/postfix/dist/src/cleanup/cleanup_out.c up to 1.3 external/ibm-public/postfix/dist/src/cleanup/cleanup_out_recipient.c up to 1.4 external/ibm-public/postfix/dist/src/cleanup/cleanup_region.c up to 1.3 external/ibm-public/postfix/dist/src/cleanup/cleanup_state.c up to 1.4 external/ibm-public/postfix/dist/src/discard/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/discard/discard.c up to 1.3 external/ibm-public/postfix/dist/src/dns/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/dns/dns.h up to 1.6 external/ibm-public/postfix/dist/src/dns/dns_lookup.c up to 1.8 external/ibm-public/postfix/dist/src/dns/dns_rr.c up to 1.3 external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.c up to 1.3 external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/dns/dns_rr_eq_sa.ref up to 1.1.1.5 external/ibm-public/postfix/dist/src/dns/dns_rr_to_pa.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/dns/dns_rr_to_sa.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/dns/dns_sa_to_rr.c up to 1.3 external/ibm-public/postfix/dist/src/dns/dns_sa_to_rr.ref up to 1.1.1.5 external/ibm-public/postfix/dist/src/dns/dns_strrecord.c up to 1.3 external/ibm-public/postfix/dist/src/dns/dns_strtype.c up to 1.2 external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_ncache.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.1_bind_plain.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/dns/dnsbl_ttl_127.0.0.2_bind_plain.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/dns/error.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/dns/mxonly_test.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/dns/no-a.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/dns/no-aaaa.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/dns/no-mx.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/dns/nullmx_test.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/dns/nxdomain_test.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/dns/test_dns_lookup.c up to 1.3 external/ibm-public/postfix/dist/src/dnsblog/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/dnsblog/dnsblog.c up to 1.4 external/ibm-public/postfix/dist/src/error/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/error/error.c up to 1.3 external/ibm-public/postfix/dist/src/flush/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/flush/flush.c up to 1.4 external/ibm-public/postfix/dist/src/fsstone/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/global/Makefile.in up to 1.1.1.10 external/ibm-public/postfix/dist/src/global/abounce.c up to 1.3 external/ibm-public/postfix/dist/src/global/anvil_clnt.c up to 1.4 external/ibm-public/postfix/dist/src/global/anvil_clnt.h up to 1.3 external/ibm-public/postfix/dist/src/global/been_here.c up to 1.4 external/ibm-public/postfix/dist/src/global/been_here.h up to 1.3 external/ibm-public/postfix/dist/src/global/bounce.c up to 1.3 external/ibm-public/postfix/dist/src/global/bounce_log.c up to 1.3 external/ibm-public/postfix/dist/src/global/cleanup_strerror.c up to 1.2 external/ibm-public/postfix/dist/src/global/cleanup_user.h up to 1.3 external/ibm-public/postfix/dist/src/global/clnt_stream.c up to 1.4 external/ibm-public/postfix/dist/src/global/clnt_stream.h up to 1.2 external/ibm-public/postfix/dist/src/global/db_common.c up to 1.3 external/ibm-public/postfix/dist/src/global/debug_peer.c up to 1.3 external/ibm-public/postfix/dist/src/global/defer.c up to 1.3 external/ibm-public/postfix/dist/src/global/deliver_pass.c up to 1.3 external/ibm-public/postfix/dist/src/global/deliver_request.c up to 1.3 external/ibm-public/postfix/dist/src/global/deliver_request.h up to 1.3 external/ibm-public/postfix/dist/src/global/delivered_hdr.c up to 1.3 external/ibm-public/postfix/dist/src/global/dict_ldap.c up to 1.5 external/ibm-public/postfix/dist/src/global/dict_memcache.c up to 1.3 external/ibm-public/postfix/dist/src/global/dict_mysql.c up to 1.4 external/ibm-public/postfix/dist/src/global/dict_pgsql.c up to 1.4 external/ibm-public/postfix/dist/src/global/dict_proxy.c up to 1.3 external/ibm-public/postfix/dist/src/global/dict_proxy.h up to 1.3 external/ibm-public/postfix/dist/src/global/dict_sqlite.c up to 1.4 external/ibm-public/postfix/dist/src/global/dsb_scan.c up to 1.3 external/ibm-public/postfix/dist/src/global/dsb_scan.h up to 1.2 external/ibm-public/postfix/dist/src/global/dsn_print.c up to 1.3 external/ibm-public/postfix/dist/src/global/dsn_print.h up to 1.2 external/ibm-public/postfix/dist/src/global/dynamicmaps.c up to 1.4 external/ibm-public/postfix/dist/src/global/ehlo_mask.c up to 1.3 external/ibm-public/postfix/dist/src/global/ehlo_mask.h up to 1.3 external/ibm-public/postfix/dist/src/global/flush_clnt.c up to 1.3 external/ibm-public/postfix/dist/src/global/haproxy_srvr.c up to 1.3 external/ibm-public/postfix/dist/src/global/haproxy_srvr.h up to 1.2 external/ibm-public/postfix/dist/src/global/header_body_checks.c up to 1.3 external/ibm-public/postfix/dist/src/global/header_body_checks.h up to 1.3 external/ibm-public/postfix/dist/src/global/log_adhoc.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_addr_crunch.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_addr_crunch.h up to 1.2 external/ibm-public/postfix/dist/src/global/mail_addr_find.c up to 1.4 external/ibm-public/postfix/dist/src/global/mail_addr_find.h up to 1.2 external/ibm-public/postfix/dist/src/global/mail_addr_map.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_addr_map.h up to 1.2 external/ibm-public/postfix/dist/src/global/mail_command_client.c up to 1.4 external/ibm-public/postfix/dist/src/global/mail_conf.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_conf.h up to 1.3 external/ibm-public/postfix/dist/src/global/mail_conf_int.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_conf_long.c up to 1.2 external/ibm-public/postfix/dist/src/global/mail_conf_nint.c up to 1.2 external/ibm-public/postfix/dist/src/global/mail_conf_time.c up to 1.4 external/ibm-public/postfix/dist/src/global/mail_copy.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_dict.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_error.c up to 1.2 external/ibm-public/postfix/dist/src/global/mail_params.c up to 1.5 external/ibm-public/postfix/dist/src/global/mail_params.h up to 1.19 external/ibm-public/postfix/dist/src/global/mail_parm_split.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_proto.h up to 1.5 external/ibm-public/postfix/dist/src/global/mail_queue.h up to 1.3 external/ibm-public/postfix/dist/src/global/mail_stream.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_task.c up to 1.3 external/ibm-public/postfix/dist/src/global/mail_version.h up to 1.6 external/ibm-public/postfix/dist/src/global/maps.c up to 1.4 external/ibm-public/postfix/dist/src/global/maps.h up to 1.2 external/ibm-public/postfix/dist/src/global/maps.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/global/memcache_proto.c up to 1.3 external/ibm-public/postfix/dist/src/global/mime_state.c up to 1.3 external/ibm-public/postfix/dist/src/global/mkmap_proxy.c up to 1.2 external/ibm-public/postfix/dist/src/global/msg_stats.h up to 1.2 external/ibm-public/postfix/dist/src/global/msg_stats_print.c up to 1.3 external/ibm-public/postfix/dist/src/global/msg_stats_scan.c up to 1.3 external/ibm-public/postfix/dist/src/global/namadr_list.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/global/namadr_list.ref up to 1.1.1.5 external/ibm-public/postfix/dist/src/global/off_cvt.c up to 1.2 external/ibm-public/postfix/dist/src/global/opened.c up to 1.2 external/ibm-public/postfix/dist/src/global/post_mail.c up to 1.4 external/ibm-public/postfix/dist/src/global/post_mail.h up to 1.3 external/ibm-public/postfix/dist/src/global/quote_822_local.c up to 1.3 external/ibm-public/postfix/dist/src/global/quote_822_local.h up to 1.2 external/ibm-public/postfix/dist/src/global/quote_flags.h up to 1.2 external/ibm-public/postfix/dist/src/global/rcpt_buf.c up to 1.4 external/ibm-public/postfix/dist/src/global/rcpt_buf.h up to 1.2 external/ibm-public/postfix/dist/src/global/rcpt_print.c up to 1.3 external/ibm-public/postfix/dist/src/global/rcpt_print.h up to 1.2 external/ibm-public/postfix/dist/src/global/rec_type.h up to 1.3 external/ibm-public/postfix/dist/src/global/record.c up to 1.4 external/ibm-public/postfix/dist/src/global/resolve_clnt.c up to 1.4 external/ibm-public/postfix/dist/src/global/resolve_clnt.h up to 1.2 external/ibm-public/postfix/dist/src/global/rewrite_clnt.c up to 1.3 external/ibm-public/postfix/dist/src/global/scache.h up to 1.3 external/ibm-public/postfix/dist/src/global/scache_clnt.c up to 1.3 external/ibm-public/postfix/dist/src/global/sent.c up to 1.3 external/ibm-public/postfix/dist/src/global/server_acl.c up to 1.3 external/ibm-public/postfix/dist/src/global/server_acl.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/global/server_acl.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/global/smtp_reply_footer.c up to 1.3 external/ibm-public/postfix/dist/src/global/smtp_stream.c up to 1.5 external/ibm-public/postfix/dist/src/global/smtp_stream.h up to 1.4 external/ibm-public/postfix/dist/src/global/smtputf8.h up to 1.3 external/ibm-public/postfix/dist/src/global/split_addr.c up to 1.3 external/ibm-public/postfix/dist/src/global/split_addr.h up to 1.2 external/ibm-public/postfix/dist/src/global/strip_addr.c up to 1.4 external/ibm-public/postfix/dist/src/global/strip_addr.h up to 1.2 external/ibm-public/postfix/dist/src/global/strip_addr.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/global/trace.c up to 1.3 external/ibm-public/postfix/dist/src/global/uxtext.c up to 1.3 external/ibm-public/postfix/dist/src/global/verify.c up to 1.4 external/ibm-public/postfix/dist/src/global/verify_clnt.c up to 1.3 external/ibm-public/postfix/dist/src/global/verify_sender_addr.c up to 1.4 external/ibm-public/postfix/dist/src/global/xtext.c up to 1.3 external/ibm-public/postfix/dist/src/local/Makefile.in up to 1.1.1.8 external/ibm-public/postfix/dist/src/local/alias.c up to 1.3 external/ibm-public/postfix/dist/src/local/forward.c up to 1.4 external/ibm-public/postfix/dist/src/local/local.c up to 1.4 external/ibm-public/postfix/dist/src/local/local_expand.c up to 1.3 external/ibm-public/postfix/dist/src/local/mailbox.c up to 1.4 external/ibm-public/postfix/dist/src/local/unknown.c up to 1.8 external/ibm-public/postfix/dist/src/master/Makefile.in up to 1.1.1.7 external/ibm-public/postfix/dist/src/master/event_server.c up to 1.4 external/ibm-public/postfix/dist/src/master/mail_server.h up to 1.4 external/ibm-public/postfix/dist/src/master/master.c up to 1.4 external/ibm-public/postfix/dist/src/master/master.h up to 1.2 external/ibm-public/postfix/dist/src/master/master_conf.c up to 1.2 external/ibm-public/postfix/dist/src/master/master_ent.c up to 1.4 external/ibm-public/postfix/dist/src/master/master_listen.c up to 1.2 external/ibm-public/postfix/dist/src/master/master_monitor.c up to 1.3 external/ibm-public/postfix/dist/src/master/master_proto.h up to 1.2 external/ibm-public/postfix/dist/src/master/master_sig.c up to 1.3 external/ibm-public/postfix/dist/src/master/master_spawn.c up to 1.3 external/ibm-public/postfix/dist/src/master/master_vars.c up to 1.3 external/ibm-public/postfix/dist/src/master/master_wakeup.c up to 1.3 external/ibm-public/postfix/dist/src/master/multi_server.c up to 1.4 external/ibm-public/postfix/dist/src/master/single_server.c up to 1.4 external/ibm-public/postfix/dist/src/master/trigger_server.c up to 1.4 external/ibm-public/postfix/dist/src/milter/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/milter/milter.c up to 1.5 external/ibm-public/postfix/dist/src/milter/milter.h up to 1.4 external/ibm-public/postfix/dist/src/milter/milter8.c up to 1.5 external/ibm-public/postfix/dist/src/milter/milter_macros.c up to 1.3 external/ibm-public/postfix/dist/src/milter/test-milter.c up to 1.3 external/ibm-public/postfix/dist/src/oqmgr/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/oqmgr/qmgr.c up to 1.3 external/ibm-public/postfix/dist/src/oqmgr/qmgr.h up to 1.3 external/ibm-public/postfix/dist/src/oqmgr/qmgr_active.c up to 1.3 external/ibm-public/postfix/dist/src/oqmgr/qmgr_deliver.c up to 1.3 external/ibm-public/postfix/dist/src/oqmgr/qmgr_entry.c up to 1.3 external/ibm-public/postfix/dist/src/oqmgr/qmgr_error.c up to 1.2 external/ibm-public/postfix/dist/src/oqmgr/qmgr_feedback.c up to 1.2 external/ibm-public/postfix/dist/src/oqmgr/qmgr_message.c up to 1.4 external/ibm-public/postfix/dist/src/pickup/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/pickup/pickup.c up to 1.4 external/ibm-public/postfix/dist/src/pipe/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/pipe/pipe.c up to 1.4 external/ibm-public/postfix/dist/src/postalias/Makefile.in up to 1.1.1.6 external/ibm-public/postfix/dist/src/postalias/fail_test.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/postalias/fail_test.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postalias/postalias.c up to 1.5 external/ibm-public/postfix/dist/src/postcat/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/postcat/postcat.c up to 1.4 external/ibm-public/postfix/dist/src/postconf/Makefile.in up to 1.1.1.11 external/ibm-public/postfix/dist/src/postconf/extract.awk up to 1.1.1.6 external/ibm-public/postfix/dist/src/postconf/install_vars.h up to 1.2 external/ibm-public/postfix/dist/src/postconf/postconf.c up to 1.4 external/ibm-public/postfix/dist/src/postconf/postconf.h up to 1.4 external/ibm-public/postfix/dist/src/postconf/postconf_builtin.c up to 1.4 external/ibm-public/postfix/dist/src/postconf/postconf_dbms.c up to 1.5 external/ibm-public/postfix/dist/src/postconf/postconf_edit.c up to 1.3 external/ibm-public/postfix/dist/src/postconf/postconf_lookup.c up to 1.4 external/ibm-public/postfix/dist/src/postconf/postconf_main.c up to 1.4 external/ibm-public/postfix/dist/src/postconf/postconf_master.c up to 1.8 external/ibm-public/postfix/dist/src/postconf/postconf_misc.c up to 1.3 external/ibm-public/postfix/dist/src/postconf/postconf_user.c up to 1.4 external/ibm-public/postfix/dist/src/postconf/test28.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/postconf/test29.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/postconf/test34.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postconf/test35.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postconf/test40.ref up to 1.1.1.4 external/ibm-public/postfix/dist/src/postconf/test41.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postconf/test42.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postconf/test43.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postconf/test44.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postconf/test58.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/postconf/test59.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/postdrop/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/postdrop/postdrop.c up to 1.4 external/ibm-public/postfix/dist/src/postfix/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/postfix/postfix.c up to 1.6 external/ibm-public/postfix/dist/src/postkick/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/postkick/postkick.c up to 1.4 external/ibm-public/postfix/dist/src/postlock/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/postlock/postlock.c up to 1.4 external/ibm-public/postfix/dist/src/postlog/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/postlog/postlog.c up to 1.5 external/ibm-public/postfix/dist/src/postmap/Makefile.in up to 1.1.1.7 external/ibm-public/postfix/dist/src/postmap/fail_test.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/postmap/fail_test.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/postmap/postmap.c up to 1.5 external/ibm-public/postfix/dist/src/postmulti/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/postmulti/postmulti.c up to 1.4 external/ibm-public/postfix/dist/src/postqueue/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/postqueue/postqueue.c up to 1.5 external/ibm-public/postfix/dist/src/postqueue/showq_compat.c up to 1.4 external/ibm-public/postfix/dist/src/postqueue/showq_json.c up to 1.4 external/ibm-public/postfix/dist/src/postscreen/Makefile.in up to 1.1.1.7 external/ibm-public/postfix/dist/src/postscreen/postscreen.c up to 1.5 external/ibm-public/postfix/dist/src/postscreen/postscreen.h up to 1.4 external/ibm-public/postfix/dist/src/postscreen/postscreen_dnsbl.c up to 1.4 external/ibm-public/postfix/dist/src/postscreen/postscreen_early.c up to 1.4 external/ibm-public/postfix/dist/src/postscreen/postscreen_endpt.c up to 1.4 external/ibm-public/postfix/dist/src/postscreen/postscreen_haproxy.c up to 1.3 external/ibm-public/postfix/dist/src/postscreen/postscreen_haproxy.h up to 1.2 external/ibm-public/postfix/dist/src/postscreen/postscreen_misc.c up to 1.4 external/ibm-public/postfix/dist/src/postscreen/postscreen_send.c up to 1.3 external/ibm-public/postfix/dist/src/postscreen/postscreen_smtpd.c up to 1.5 external/ibm-public/postfix/dist/src/postscreen/postscreen_starttls.c up to 1.4 external/ibm-public/postfix/dist/src/postscreen/postscreen_state.c up to 1.4 external/ibm-public/postfix/dist/src/postscreen/postscreen_tests.c up to 1.4 external/ibm-public/postfix/dist/src/postsuper/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/postsuper/postsuper.c up to 1.4 external/ibm-public/postfix/dist/src/posttls-finger/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/posttls-finger/posttls-finger.c up to 1.5 external/ibm-public/postfix/dist/src/proxymap/Makefile.in up to 1.1.1.6 external/ibm-public/postfix/dist/src/proxymap/proxymap.c up to 1.4 external/ibm-public/postfix/dist/src/qmgr/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/qmgr/qmgr.c up to 1.3 external/ibm-public/postfix/dist/src/qmgr/qmgr.h up to 1.3 external/ibm-public/postfix/dist/src/qmgr/qmgr_active.c up to 1.3 external/ibm-public/postfix/dist/src/qmgr/qmgr_deliver.c up to 1.3 external/ibm-public/postfix/dist/src/qmgr/qmgr_entry.c up to 1.3 external/ibm-public/postfix/dist/src/qmgr/qmgr_error.c up to 1.2 external/ibm-public/postfix/dist/src/qmgr/qmgr_feedback.c up to 1.2 external/ibm-public/postfix/dist/src/qmgr/qmgr_message.c up to 1.4 external/ibm-public/postfix/dist/src/qmqpd/Makefile.in up to 1.1.1.6 external/ibm-public/postfix/dist/src/qmqpd/qmqpd.c up to 1.4 external/ibm-public/postfix/dist/src/qmqpd/qmqpd_peer.c up to 1.3 external/ibm-public/postfix/dist/src/scache/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/scache/scache.c up to 1.4 external/ibm-public/postfix/dist/src/sendmail/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/sendmail/sendmail.c up to 1.4 external/ibm-public/postfix/dist/src/showq/Makefile.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/showq/showq.c up to 1.5 external/ibm-public/postfix/dist/src/smtp/Makefile.in up to 1.1.1.10 external/ibm-public/postfix/dist/src/smtp/lmtp_params.c up to 1.5 external/ibm-public/postfix/dist/src/smtp/smtp.c up to 1.13 external/ibm-public/postfix/dist/src/smtp/smtp.h up to 1.5 external/ibm-public/postfix/dist/src/smtp/smtp_addr.c up to 1.5 external/ibm-public/postfix/dist/src/smtp/smtp_addr.h up to 1.3 external/ibm-public/postfix/dist/src/smtp/smtp_chat.c up to 1.4 external/ibm-public/postfix/dist/src/smtp/smtp_connect.c up to 1.5 external/ibm-public/postfix/dist/src/smtp/smtp_key.c up to 1.3 external/ibm-public/postfix/dist/src/smtp/smtp_map11.c up to 1.3 external/ibm-public/postfix/dist/src/smtp/smtp_map11.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtp/smtp_params.c up to 1.5 external/ibm-public/postfix/dist/src/smtp/smtp_proto.c up to 1.5 external/ibm-public/postfix/dist/src/smtp/smtp_rcpt.c up to 1.3 external/ibm-public/postfix/dist/src/smtp/smtp_reuse.c up to 1.4 external/ibm-public/postfix/dist/src/smtp/smtp_sasl_auth_cache.c up to 1.3 external/ibm-public/postfix/dist/src/smtp/smtp_sasl_glue.c up to 1.3 external/ibm-public/postfix/dist/src/smtp/smtp_sasl_proto.c up to 1.3 external/ibm-public/postfix/dist/src/smtp/smtp_session.c up to 1.5 external/ibm-public/postfix/dist/src/smtp/smtp_state.c up to 1.3 external/ibm-public/postfix/dist/src/smtp/smtp_tls_policy.c up to 1.4 external/ibm-public/postfix/dist/src/smtp/smtp_trouble.c up to 1.3 external/ibm-public/postfix/dist/src/smtpd/Makefile.in up to 1.1.1.11 external/ibm-public/postfix/dist/src/smtpd/pfilter.c up to 1.2 (+patch) external/ibm-public/postfix/dist/src/smtpd/smtpd.c up to 1.20 external/ibm-public/postfix/dist/src/smtpd/smtpd.h up to 1.5 external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_acl.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_chat.c up to 1.4 external/ibm-public/postfix/dist/src/smtpd/smtpd_chat.h up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_check.c up to 1.6 external/ibm-public/postfix/dist/src/smtpd/smtpd_check.h up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in2 up to 1.1.1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_check.in3 up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref up to 1.1.1.5 external/ibm-public/postfix/dist/src/smtpd/smtpd_check.ref2 up to 1.1.1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_check_backup.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_check_dsn.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_dns_filter.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/smtpd/smtpd_dnswl.ref up to 1.1.1.4 external/ibm-public/postfix/dist/src/smtpd/smtpd_error.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_error.ref up to 1.1.1.4 external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.in up to 1.1.1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_exp.ref up to 1.1.1.5 external/ibm-public/postfix/dist/src/smtpd/smtpd_expand.h up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_haproxy.c up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_milter.c up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_nullmx.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/smtpd/smtpd_peer.c up to 1.5 external/ibm-public/postfix/dist/src/smtpd/smtpd_proxy.c up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_resolve.c up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_resolve.h up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_sasl_glue.c up to 1.5 external/ibm-public/postfix/dist/src/smtpd/smtpd_sasl_proto.c up to 1.3 external/ibm-public/postfix/dist/src/smtpd/smtpd_server.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/smtpd/smtpd_server.ref up to 1.1.1.4 external/ibm-public/postfix/dist/src/smtpd/smtpd_state.c up to 1.2 external/ibm-public/postfix/dist/src/smtpstone/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/smtpstone/smtp-sink.c up to 1.3 external/ibm-public/postfix/dist/src/smtpstone/smtp-source.c up to 1.3 external/ibm-public/postfix/dist/src/spawn/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/spawn/spawn.c up to 1.4 external/ibm-public/postfix/dist/src/tls/Makefile.in up to 1.1.1.10 external/ibm-public/postfix/dist/src/tls/tls.h up to 1.5 external/ibm-public/postfix/dist/src/tls/tls_bio_ops.c up to 1.1.1.6 external/ibm-public/postfix/dist/src/tls/tls_certkey.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_client.c up to 1.13 external/ibm-public/postfix/dist/src/tls/tls_dane.c up to 1.5 external/ibm-public/postfix/dist/src/tls/tls_dh.c up to 1.5 external/ibm-public/postfix/dist/src/tls/tls_fprint.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_mgr.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_misc.c up to 1.5 external/ibm-public/postfix/dist/src/tls/tls_proxy.h up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_proxy_clnt.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_rsa.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_scache.c up to 1.4 external/ibm-public/postfix/dist/src/tls/tls_server.c up to 1.12 external/ibm-public/postfix/dist/src/tls/tls_session.c up to 1.3 external/ibm-public/postfix/dist/src/tls/tls_verify.c up to 1.4 external/ibm-public/postfix/dist/src/tlsmgr/Makefile.in up to 1.1.1.6 external/ibm-public/postfix/dist/src/tlsmgr/tlsmgr.c up to 1.4 external/ibm-public/postfix/dist/src/tlsproxy/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/tlsproxy/tlsproxy.c up to 1.6 external/ibm-public/postfix/dist/src/tlsproxy/tlsproxy.h up to 1.2 external/ibm-public/postfix/dist/src/tlsproxy/tlsproxy_state.c up to 1.3 external/ibm-public/postfix/dist/src/trivial-rewrite/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/trivial-rewrite/resolve.c up to 1.4 external/ibm-public/postfix/dist/src/trivial-rewrite/rewrite.c up to 1.3 external/ibm-public/postfix/dist/src/trivial-rewrite/transport.c up to 1.4 external/ibm-public/postfix/dist/src/trivial-rewrite/trivial-rewrite.c up to 1.4 external/ibm-public/postfix/dist/src/trivial-rewrite/trivial-rewrite.h up to 1.3 external/ibm-public/postfix/dist/src/util/Makefile.in up to 1.1.1.11 external/ibm-public/postfix/dist/src/util/allascii.c up to 1.3 external/ibm-public/postfix/dist/src/util/alldig.c up to 1.2 external/ibm-public/postfix/dist/src/util/argv.c up to 1.4 external/ibm-public/postfix/dist/src/util/argv.h up to 1.4 external/ibm-public/postfix/dist/src/util/attr.h up to 1.5 external/ibm-public/postfix/dist/src/util/attr_clnt.c up to 1.3 external/ibm-public/postfix/dist/src/util/attr_clnt.h up to 1.3 external/ibm-public/postfix/dist/src/util/attr_print0.c up to 1.3 external/ibm-public/postfix/dist/src/util/attr_print64.c up to 1.3 external/ibm-public/postfix/dist/src/util/attr_print_plain.c up to 1.3 external/ibm-public/postfix/dist/src/util/attr_scan0.c up to 1.3 external/ibm-public/postfix/dist/src/util/attr_scan0.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/util/attr_scan64.c up to 1.3 external/ibm-public/postfix/dist/src/util/attr_scan64.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/util/attr_scan_plain.c up to 1.3 external/ibm-public/postfix/dist/src/util/attr_scan_plain.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/util/auto_clnt.c up to 1.4 external/ibm-public/postfix/dist/src/util/auto_clnt.h up to 1.2 external/ibm-public/postfix/dist/src/util/base32_code.h up to 1.3 external/ibm-public/postfix/dist/src/util/base64_code.h up to 1.3 external/ibm-public/postfix/dist/src/util/binhash.c up to 1.3 external/ibm-public/postfix/dist/src/util/binhash.h up to 1.3 external/ibm-public/postfix/dist/src/util/casefold.c up to 1.3 external/ibm-public/postfix/dist/src/util/check_arg.h up to 1.3 external/ibm-public/postfix/dist/src/util/cidr_match.c up to 1.4 external/ibm-public/postfix/dist/src/util/cidr_match.h up to 1.2 external/ibm-public/postfix/dist/src/util/clean_env.c up to 1.3 external/ibm-public/postfix/dist/src/util/clean_env.h up to 1.2 external/ibm-public/postfix/dist/src/util/connect.h up to 1.2 external/ibm-public/postfix/dist/src/util/dict.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict.h up to 1.5 external/ibm-public/postfix/dist/src/util/dict_alloc.c up to 1.3 external/ibm-public/postfix/dist/src/util/dict_cache.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict_cdb.c up to 1.3 external/ibm-public/postfix/dist/src/util/dict_cdb.h up to 1.2 external/ibm-public/postfix/dist/src/util/dict_cidr.c up to 1.5 external/ibm-public/postfix/dist/src/util/dict_cidr.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/dict_cidr.map up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/dict_cidr.ref up to 1.1.1.4 external/ibm-public/postfix/dist/src/util/dict_db.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict_db.h up to 1.4 external/ibm-public/postfix/dist/src/util/dict_dbm.h up to 1.2 external/ibm-public/postfix/dist/src/util/dict_fail.c up to 1.2 external/ibm-public/postfix/dist/src/util/dict_fail.h up to 1.2 external/ibm-public/postfix/dist/src/util/dict_inline.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict_lmdb.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict_lmdb.h up to 1.3 external/ibm-public/postfix/dist/src/util/dict_open.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict_pcre.c up to 1.5 external/ibm-public/postfix/dist/src/util/dict_pcre.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/dict_pcre.map up to 1.1.1.3 external/ibm-public/postfix/dist/src/util/dict_pcre.ref up to 1.1.1.4 external/ibm-public/postfix/dist/src/util/dict_random.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict_random.h up to 1.3 external/ibm-public/postfix/dist/src/util/dict_regexp.c up to 1.5 external/ibm-public/postfix/dist/src/util/dict_regexp.map up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/dict_regexp.ref up to 1.1.1.3 external/ibm-public/postfix/dist/src/util/dict_sdbm.h up to 1.2 external/ibm-public/postfix/dist/src/util/dict_static.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict_thash.c up to 1.4 external/ibm-public/postfix/dist/src/util/dict_thash.map up to 1.1.1.3 external/ibm-public/postfix/dist/src/util/dict_union.c up to 1.3 external/ibm-public/postfix/dist/src/util/dict_utf8.c up to 1.3 external/ibm-public/postfix/dist/src/util/dict_utf8_test.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/dup2_pass_on_exec.c up to 1.2 external/ibm-public/postfix/dist/src/util/edit_file.c up to 1.4 external/ibm-public/postfix/dist/src/util/edit_file.h up to 1.3 external/ibm-public/postfix/dist/src/util/extpar.c up to 1.4 external/ibm-public/postfix/dist/src/util/find_inet.c up to 1.3 external/ibm-public/postfix/dist/src/util/gccw.c up to 1.2 external/ibm-public/postfix/dist/src/util/hex_code.c up to 1.3 external/ibm-public/postfix/dist/src/util/hex_code.h up to 1.4 external/ibm-public/postfix/dist/src/util/hex_quote.c up to 1.2 external/ibm-public/postfix/dist/src/util/host_port.h up to 1.3 external/ibm-public/postfix/dist/src/util/htable.c up to 1.4 external/ibm-public/postfix/dist/src/util/inet_addr_host.c up to 1.3 external/ibm-public/postfix/dist/src/util/inet_addr_list.in up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/inet_addr_list.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/inet_connect.c up to 1.3 external/ibm-public/postfix/dist/src/util/inet_listen.c up to 1.3 external/ibm-public/postfix/dist/src/util/inet_proto.c up to 1.4 external/ibm-public/postfix/dist/src/util/inet_proto.h up to 1.2 external/ibm-public/postfix/dist/src/util/killme_after.c up to 1.2 external/ibm-public/postfix/dist/src/util/listen.h up to 1.3 external/ibm-public/postfix/dist/src/util/load_lib.c up to 1.3 external/ibm-public/postfix/dist/src/util/lstat_as.h up to 1.3 external/ibm-public/postfix/dist/src/util/mac_expand.c up to 1.4 external/ibm-public/postfix/dist/src/util/mac_expand.h up to 1.4 external/ibm-public/postfix/dist/src/util/mac_expand.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/util/mac_expand.ref up to 1.1.1.4 external/ibm-public/postfix/dist/src/util/mac_parse.h up to 1.3 external/ibm-public/postfix/dist/src/util/make_dirs.c up to 1.2 external/ibm-public/postfix/dist/src/util/match_list.c up to 1.3 external/ibm-public/postfix/dist/src/util/match_ops.c up to 1.3 external/ibm-public/postfix/dist/src/util/midna_domain.c up to 1.4 external/ibm-public/postfix/dist/src/util/midna_domain.h up to 1.4 external/ibm-public/postfix/dist/src/util/midna_domain_test.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/msg_output.c up to 1.4 external/ibm-public/postfix/dist/src/util/msg_output.h up to 1.3 external/ibm-public/postfix/dist/src/util/msg_syslog.c up to 1.2 external/ibm-public/postfix/dist/src/util/msg_syslog.h up to 1.3 external/ibm-public/postfix/dist/src/util/mvect.c up to 1.3 external/ibm-public/postfix/dist/src/util/myaddrinfo.c up to 1.3 external/ibm-public/postfix/dist/src/util/myaddrinfo.h up to 1.3 external/ibm-public/postfix/dist/src/util/myaddrinfo.ref up to 1.1.1.5 external/ibm-public/postfix/dist/src/util/myaddrinfo4.ref up to 1.1.1.2 external/ibm-public/postfix/dist/src/util/myflock.c up to 1.3 external/ibm-public/postfix/dist/src/util/myflock.h up to 1.3 external/ibm-public/postfix/dist/src/util/mymalloc.c up to 1.4 external/ibm-public/postfix/dist/src/util/mymalloc.h up to 1.4 external/ibm-public/postfix/dist/src/util/mystrtok.c up to 1.4 external/ibm-public/postfix/dist/src/util/name_mask.c up to 1.3 external/ibm-public/postfix/dist/src/util/nbbio.c up to 1.3 external/ibm-public/postfix/dist/src/util/netstring.c up to 1.3 external/ibm-public/postfix/dist/src/util/peekfd.c up to 1.3 external/ibm-public/postfix/dist/src/util/printable.c up to 1.3 external/ibm-public/postfix/dist/src/util/recv_pass_attr.c up to 1.3 external/ibm-public/postfix/dist/src/util/sane_fsops.h up to 1.3 external/ibm-public/postfix/dist/src/util/sane_link.c up to 1.2 external/ibm-public/postfix/dist/src/util/sane_rename.c up to 1.2 external/ibm-public/postfix/dist/src/util/sane_socketpair.h up to 1.3 external/ibm-public/postfix/dist/src/util/slmdb.c up to 1.4 external/ibm-public/postfix/dist/src/util/sock_addr.c up to 1.3 external/ibm-public/postfix/dist/src/util/sock_addr.h up to 1.2 external/ibm-public/postfix/dist/src/util/split_nameval.c up to 1.2 external/ibm-public/postfix/dist/src/util/stat_as.h up to 1.3 external/ibm-public/postfix/dist/src/util/stringops.h up to 1.5 external/ibm-public/postfix/dist/src/util/sys_compat.c up to 1.3 external/ibm-public/postfix/dist/src/util/sys_defs.h up to 1.14 external/ibm-public/postfix/dist/src/util/timed_wait.h up to 1.3 external/ibm-public/postfix/dist/src/util/unix_pass_fd_fix.c up to 1.2 external/ibm-public/postfix/dist/src/util/unix_send_fd.c up to 1.8 external/ibm-public/postfix/dist/src/util/unsafe.c up to 1.2 external/ibm-public/postfix/dist/src/util/valid_hostname.c up to 1.3 external/ibm-public/postfix/dist/src/util/valid_hostname.h up to 1.2 external/ibm-public/postfix/dist/src/util/vbuf.c up to 1.3 external/ibm-public/postfix/dist/src/util/vbuf_print.c up to 1.4 external/ibm-public/postfix/dist/src/util/vstream.c up to 1.4 external/ibm-public/postfix/dist/src/util/vstream.h up to 1.4 external/ibm-public/postfix/dist/src/util/vstream_tweak.c up to 1.3 external/ibm-public/postfix/dist/src/util/vstring.c up to 1.4 external/ibm-public/postfix/dist/src/util/vstring.h up to 1.4 external/ibm-public/postfix/dist/src/util/vstring_vstream.c up to 1.2 external/ibm-public/postfix/dist/src/util/vstring_vstream.h up to 1.3 external/ibm-public/postfix/dist/src/util/watchdog.c up to 1.3 external/ibm-public/postfix/dist/src/verify/Makefile.in up to 1.1.1.6 external/ibm-public/postfix/dist/src/verify/verify.c up to 1.4 external/ibm-public/postfix/dist/src/virtual/Makefile.in up to 1.1.1.5 external/ibm-public/postfix/dist/src/virtual/mailbox.c up to 1.3 external/ibm-public/postfix/dist/src/virtual/virtual.c up to 1.4 external/ibm-public/postfix/dist/src/xsasl/Makefile.in up to 1.1.1.4 external/ibm-public/postfix/dist/src/xsasl/xsasl.h up to 1.3 external/ibm-public/postfix/dist/src/xsasl/xsasl_cyrus_client.c up to 1.3 external/ibm-public/postfix/dist/src/xsasl/xsasl_cyrus_server.c up to 1.4 external/ibm-public/postfix/dist/src/xsasl/xsasl_dovecot_server.c up to 1.4 external/ibm-public/postfix/dist/src/xsasl/xsasl_saslc_client.c up to 1.2 external/ibm-public/postfix/dist/src/xsasl/xsasl_server.c up to 1.2 external/ibm-public/postfix/lib/dns/Makefile up to 1.4 external/ibm-public/postfix/lib/global/Makefile up to 1.10 external/ibm-public/postfix/lib/masterlib/Makefile up to 1.3 external/ibm-public/postfix/lib/milter/Makefile up to 1.2 external/ibm-public/postfix/lib/tls/Makefile up to 1.4 external/ibm-public/postfix/lib/util/Makefile up to 1.11 external/ibm-public/postfix/lib/xsasl/Makefile up to 1.3 external/ibm-public/postfix/libexec/smtp/Makefile up to 1.4 external/ibm-public/postfix/libexec/smtpd/Makefile up to 1.9 (+patch) external/ibm-public/postfix/libexec/tlsproxy/Makefile up to 1.2 external/ibm-public/postfix/sbin/postconf/Makefile up to 1.9 doc/3RDPARTY (apply patch) Update Postfix to 3.8.4. @ text @a0 863 PPoossttffiixx PPoossttssccrreeeenn HHoowwttoo ((PPoossttffiixx 22..88 -- 33..55)) ------------------------------------------------------------------------------- IInnttrroodduuccttiioonn This document describes features that are available in Postfix 2.8 - 3.5. The Postfix postscreen(8) daemon provides additional protection against mail server overload. One postscreen(8) process handles multiple inbound SMTP connections, and decides which clients may talk to a Postfix SMTP server process. By keeping spambots away, postscreen(8) leaves more SMTP server processes available for legitimate clients, and delays the onset of server overload conditions. postscreen(8) should not be used on SMTP ports that receive mail from end-user clients (MUAs). In a typical deployment, postscreen(8) handles the MX service on TCP port 25, while MUA clients submit mail via the submission service on TCP port 587 which requires client authentication. Alternatively, a site could set up a dedicated, non-postscreen, "port 25" server that provides submission service and client authentication, but no MX service. postscreen(8) maintains a temporary allowlist for clients that pass its tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. postscreen(8) is part of a multi-layer defense. * As the first layer, postscreen(8) blocks connections from zombies and other spambots that are responsible for about 90% of all spam. It is implemented as a single process to make this defense as inexpensive as possible. * The second layer implements more complex SMTP-level access checks with Postfix SMTP servers, policy daemons, and Milter applications. * The third layer performs light-weight content inspection with the Postfix built-in header_checks and body_checks. This can block unacceptable attachments such as executable programs, and worms or viruses with easy-to- recognize signatures. * The fourth layer provides heavy-weight content inspection with external content filters. Typical examples are Amavisd-new, SpamAssassin, and Milter applications. Each layer reduces the spam volume. The general strategy is to use the less expensive defenses first, and to use the more expensive defenses only for the spam that remains. Topics in this document: * Introduction * The basic idea behind postscreen(8) * General operation * Quick tests before everything else * Tests before the 220 SMTP server greeting * Tests after the 220 SMTP server greeting * Other errors * When all tests succeed * Configuring the postscreen(8) service * Historical notes and credits TThhee bbaassiicc iiddeeaa bbeehhiinndd ppoossttssccrreeeenn((88)) Most email is spam, and most spam is sent out by zombies (malware on compromised end-user computers). Wietse expects that the zombie problem will get worse before things improve, if ever. Without a tool like postscreen(8) that keeps the zombies away, Postfix would be spending most of its resources not receiving email. The main challenge for postscreen(8) is to make an is-a-zombie decision based on a single measurement. This is necessary because many zombies try to fly under the radar and avoid spamming the same site repeatedly. Once postscreen(8) decides that a client is not-a-zombie, it allowlists the client temporarily to avoid further delays for legitimate mail. Zombies have challenges too: they have only a limited amount of time to deliver spam before their IP address becomes denylisted. To speed up spam deliveries, zombies make compromises in their SMTP protocol implementation. For example, they speak before their turn, or they ignore responses from SMTP servers and continue sending mail even when the server tells them to go away. postscreen(8) uses a variety of measurements to recognize zombies. First, postscreen(8) determines if the remote SMTP client IP address is denylisted. Second, postscreen(8) looks for protocol compromises that are made to speed up delivery. These are good indicators for making is-a-zombie decisions based on single measurements. postscreen(8) does not inspect message content. Message content can vary from one delivery to the next, especially with clients that (also) send legitimate email. Content is not a good indicator for making is-a-zombie decisions based on single measurements, and that is the problem that postscreen(8) is focused on. GGeenneerraall ooppeerraattiioonn For each connection from an SMTP client, postscreen(8) performs a number of tests in the order as described below. Some tests introduce a delay of a few seconds. postscreen(8) maintains a temporary allowlist for clients that pass its tests; by allowing allowlisted clients to skip tests, postscreen(8) minimizes its impact on legitimate email traffic. By default, postscreen(8) hands off all connections to a Postfix SMTP server process after logging its findings. This mode is useful for non-destructive testing. In a typical production setting, postscreen(8) is configured to reject mail from clients that fail one or more tests, after logging the helo, sender and recipient information. Note: postscreen(8) is not an SMTP proxy; this is intentional. The purpose is to keep zombies away from Postfix, with minimal overhead for legitimate clients. QQuuiicckk tteessttss bbeeffoorree eevveerryytthhiinngg eellssee Before engaging in SMTP-level tests. postscreen(8) queries a number of local deny and allowlists. These tests speed up the handling of known clients. * Permanent allow/denylist test * Temporary allowlist test * MX Policy test PPeerrmmaanneenntt aallllooww//ddeennyylliisstt tteesstt The postscreen_access_list parameter (default: permit_mynetworks) specifies a permanent access list for SMTP client IP addresses. Typically one would specify something that allowlists local networks, followed by a CIDR table for selective allow- and denylisting. Example: /etc/postfix/main.cf: postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr /etc/postfix/postscreen_access.cidr: # Rules are evaluated in the order as specified. # Denylist 192.168.* except 192.168.0.1. 192.168.0.1 permit 192.168.0.0/16 reject See the postscreen_access_list manpage documentation for more details. When the SMTP client address matches a "permit" action, postscreen(8) logs this with the client address and port number as: WWHHIITTEELLIISSTTEEDD [address]:port The allowlist action is not configurable: immediately hand off the connection to a Postfix SMTP server process. When the SMTP client address matches a "reject" action, postscreen(8) logs this with the client address and port number as: BBLLAACCKKLLIISSTTEEDD [address]:port The postscreen_blacklist_action parameter specifies the action that is taken next. See "When tests fail before the 220 SMTP server greeting" below. TTeemmppoorraarryy aalllloowwlliisstt tteesstt The postscreen(8) daemon maintains a temporary allowlist for SMTP client IP addresses that have passed all the tests described below. The postscreen_cache_map parameter specifies the location of the temporary allowlist. The temporary allowlist is not used for SMTP client addresses that appear on the permanent access list. By default the temporary allowlist is not shared with other postscreen(8) daemons. See Sharing the temporary allowlist below for alternatives. When the SMTP client address appears on the temporary allowlist, postscreen(8) logs this with the client address and port number as: PPAASSSS OOLLDD [address]:port The action is not configurable: immediately hand off the connection to a Postfix SMTP server process. The client is excluded from further tests until its temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. Expired entries are silently renewed if possible. MMXX PPoolliiccyy tteesstt When the remote SMTP client is not on the static access list or temporary allowlist, postscreen(8) can implement a number of allowlist tests, before it grants the client a temporary allowlist status that allows it to talk to a Postfix SMTP server process. When postscreen(8) is configured to monitor all primary and backup MX addresses, it can refuse to allowlist clients that connect to a backup MX address only (an old spammer trick to take advantage of backup MX hosts with weaker anti-spam policies than primary MX hosts). NOTE: The following solution is for small sites. Larger sites would have to share the postscreen(8) cache between primary and backup MTAs, which would introduce a common point of failure. * First, configure the host to listen on both primary and backup MX addresses. Use the appropriate ifconfig or ip command for the local operating system, or update the appropriate configuration files and "refresh" the network protocol stack. Second, configure Postfix to listen on the new IP address (this step is needed when you have specified inet_interfaces in main.cf). * Then, configure postscreen(8) to deny the temporary allowlist status on the backup MX address(es). An example for Wietse's server is: /etc/postfix/main.cf: postscreen_whitelist_interfaces = !168.100.189.8 static:all Translation: allow clients to obtain the temporary allowlist status on all server IP addresses except 168.100.189.8, which is a backup MX address. When a non-allowlisted client connects the backup MX address, postscreen(8) logs this with the client address and port number as: CCOONNNNEECCTT ffrroomm [address]:port ttoo [[116688..110000..118899..88]]::2255 WWHHIITTEELLIISSTT VVEETTOO [address]:port Translation: the client at [address]:port connected to the backup MX address 168.100.189.8 while it was not allowlisted. The client will not be granted the temporary allowlist status, even if passes all the allowlist tests described below. TTeessttss bbeeffoorree tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg The postscreen_greet_wait parameter specifies a short time interval before the "220 text..." server greeting, where postscreen(8) can run a number of tests in parallel. When a good client passes these tests, and no "deep protocol tests" are configured, postscreen(8) adds the client to the temporary allowlist and hands off the "live" connection to a Postfix SMTP server process. The client can then continue as if postscreen(8) never even existed (except of course for the short postscreen_greet_wait delay). * Pregreet test * DNS Allow/denylist test * When tests fail before the 220 SMTP server greeting PPrreeggrreeeett tteesstt The SMTP protocol is a classic example of a protocol where the server speaks before the client. postscreen(8) detects zombies that are in a hurry and that speak before their turn. This test is enabled by default. The postscreen_greet_banner parameter specifies the text portion of a "220- text..." teaser banner (default: $smtpd_banner). Note that this becomes the first part of a multi-line server greeting. The postscreen(8) daemon sends this before the postscreen_greet_wait timer is started. The purpose of the teaser banner is to confuse zombies so that they speak before their turn. It has no effect on SMTP clients that correctly implement the protocol. To avoid problems with poorly-implemented SMTP engines in network appliances or network testing tools, either exclude them from all tests with the postscreen_access_list feature or else specify an empty teaser banner: /etc/postfix/main.cf: # Exclude broken clients by allowlisting. Clients in mynetworks # should always be allowlisted. postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr /etc/postfix/postscreen_access.cidr: 192.168.254.0/24 permit /etc/postfix/main.cf: # Disable the teaser banner (try allowlisting first if you can). postscreen_greet_banner = When an SMTP client sends a command before the postscreen_greet_wait time has elapsed, postscreen(8) logs this as: PPRREEGGRREEEETT count aafftteerr time ffrroomm [address]:port text... Translation: the client at [address]:port sent count bytes before its turn to speak. This happened time seconds after the postscreen_greet_wait timer was started. The text is what the client sent (truncated to 100 bytes, and with non-printable characters replaced with C-style escapes such as \r for carriage- return and \n for newline). The postscreen_greet_action parameter specifies the action that is taken next. See "When tests fail before the 220 SMTP server greeting" below. DDNNSS AAllllooww//ddeennyylliisstt tteesstt The postscreen_dnsbl_sites parameter (default: empty) specifies a list of DNS blocklist servers with optional filters and weight factors (positive weights for denylisting, negative for allowlisting). These servers will be queried in parallel with the reverse client IP address. This test is disabled by default. CAUTION: when postscreen rejects mail, its SMTP reply contains the DNSBL domain name. Use the postscreen_dnsbl_reply_map feature to hide "password" information in DNSBL domain names. When the postscreen_greet_wait time has elapsed, and the combined DNSBL score is equal to or greater than the postscreen_dnsbl_threshold parameter value, postscreen(8) logs this as: DDNNSSBBLL rraannkk count ffoorr [address]:port Translation: the SMTP client at [address]:port has a combined DNSBL score of count. The postscreen_dnsbl_action parameter specifies the action that is taken when the combined DNSBL score is equal to or greater than the threshold. See "When tests fail before the 220 SMTP server greeting" below. WWhheenn tteessttss ffaaiill bbeeffoorree tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg When the client address matches the permanent denylist, or when the client fails the pregreet or DNSBL tests, the action is specified with postscreen_blacklist_action, postscreen_greet_action, or postscreen_dnsbl_action, respectively. iiggnnoorree (default) Ignore the failure of this test. Allow other tests to complete. Repeat this test the next time the client connects. This option is useful for testing and collecting statistics without blocking mail. eennffoorrccee Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects. ddrroopp Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects. TTeessttss aafftteerr tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg In this phase of the protocol, postscreen(8) implements a number of "deep protocol" tests. These tests use an SMTP protocol engine that is built into the postscreen(8) server. Important note: these protocol tests are disabled by default. They are more intrusive than the pregreet and DNSBL tests, and they have limitations as discussed next. * The main limitation of "after 220 greeting" tests is that a new client must disconnect after passing these tests (reason: postscreen is not a proxy). Then the client must reconnect from the same IP address before it can deliver mail. The following measures may help to avoid email delays: o Allow "good" clients to skip tests with the postscreen_dnsbl_whitelist_threshold feature (Postfix 2.11 and later). This is especially effective for sites such as Google that never retry immediately from the same IP address. o Small sites: Configure postscreen(8) to listen on multiple IP addresses, published in DNS as different IP addresses for the same MX hostname or for different MX hostnames. This avoids mail delivery delays with clients that reconnect immediately from the same IP address. o Large sites: Share the postscreen(8) cache between different Postfix MTAs with a large-enough memcache_table(5). Again, this avoids mail delivery delays with clients that reconnect immediately from the same IP address. * postscreen(8)'s built-in SMTP engine does not implement the AUTH, XCLIENT, and XFORWARD features. If you need to make these services available on port 25, then do not enable the tests after the 220 server greeting. * End-user clients should connect directly to the submission service, so that they never have to deal with postscreen(8)'s tests. The following "after 220 greeting" tests are available: * Command pipelining test * Non-SMTP command test * Bare newline test * When tests fail after the 220 SMTP server greeting CCoommmmaanndd ppiippeelliinniinngg tteesstt By default, SMTP is a half-duplex protocol: the sender and receiver send one command and one response at a time. Unlike the Postfix SMTP server, postscreen (8) does not announce support for ESMTP command pipelining. Therefore, clients are not allowed to send multiple commands. postscreen(8)'s deep protocol test for this is disabled by default. With "postscreen_pipelining_enable = yes", postscreen(8) detects zombies that send multiple commands, instead of sending one command and waiting for the server to reply. This test is opportunistically enabled when postscreen(8) has to use the built- in SMTP engine anyway. This is to make postscreen(8) logging more informative. When a client sends multiple commands, postscreen(8) logs this as: CCOOMMMMAANNDD PPIIPPEELLIINNIINNGG ffrroomm [address]:port aafftteerr command: text Translation: the SMTP client at [address]:port sent multiple SMTP commands, instead of sending one command and then waiting for the server to reply. This happened after the client sent command. The text shows part of the input that was sent too early; it is not logged with Postfix 2.8. The postscreen_pipelining_action parameter specifies the action that is taken next. See "When tests fail after the 220 SMTP server greeting" below. NNoonn--SSMMTTPP ccoommmmaanndd tteesstt Some spambots send their mail through open proxies. A symptom of this is the usage of commands such as CONNECT and other non-SMTP commands. Just like the Postfix SMTP server's smtpd_forbidden_commands feature, postscreen(8) has an equivalent postscreen_forbidden_commands feature to block these clients. postscreen(8)'s deep protocol test for this is disabled by default. With "postscreen_non_smtp_command_enable = yes", postscreen(8) detects zombies that send commands specified with the postscreen_forbidden_commands parameter. This also detects commands with the syntax of a message header label. The latter is a symptom that the client is sending message content after ignoring all the responses from postscreen(8) that reject mail. This test is opportunistically enabled when postscreen(8) has to use the built- in SMTP engine anyway. This is to make postscreen(8) logging more informative. When a client sends non-SMTP commands, postscreen(8) logs this as: NNOONN--SSMMTTPP CCOOMMMMAANNDD ffrroomm [address]:port aafftteerr command: text Translation: the SMTP client at [address]:port sent a command that matches the postscreen_forbidden_commands parameter, or that has the syntax of a message header label (text followed by optional space and ":"). The "aafftteerr command" portion is logged with Postfix 2.10 and later. The postscreen_non_smtp_command_action parameter specifies the action that is taken next. See "When tests fail after the 220 SMTP server greeting" below. BBaarree nneewwlliinnee tteesstt SMTP is a line-oriented protocol: lines have a limited length, and are terminated with . Lines ending in a "bare" , that is newline not preceded by carriage return, are not allowed in SMTP. postscreen(8)'s deep protocol test for this is disabled by default. With "postscreen_bare_newline_enable = yes", postscreen(8) detects clients that send lines ending in bare newline characters. This test is opportunistically enabled when postscreen(8) has to use the built- in SMTP engine anyway. This is to make postscreen(8) logging more informative. When a client sends bare newline characters, postscreen(8) logs this as: BBAARREE NNEEWWLLIINNEE ffrroomm [address]:port aafftteerr command Translation: the SMTP client at [address]:port sent a bare newline character, that is newline not preceded by carriage return. The "aafftteerr command" portion is logged with Postfix 2.10 and later. The postscreen_bare_newline_action parameter specifies the action that is taken next. See "When tests fail after the 220 SMTP server greeting" below. WWhheenn tteessttss ffaaiill aafftteerr tthhee 222200 SSMMTTPP sseerrvveerr ggrreeeettiinngg When the client fails the pipelining, non-SMTP command or bare newline tests, the action is specified with postscreen_pipelining_action, postscreen_non_smtp_command_action or postscreen_bare_newline_action, respectively. iiggnnoorree (default for bare newline) Ignore the failure of this test. Allow other tests to complete. Do NOT repeat this test before the result from some other test expires. This option is useful for testing and collecting statistics without blocking mail permanently. eennffoorrccee (default for pipelining) Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects. ddrroopp (default for non-SMTP commands) Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects. This action is compatible with the Postfix SMTP server's smtpd_forbidden_commands feature. OOtthheerr eerrrroorrss When an SMTP client hangs up unexpectedly, postscreen(8) logs this as: HHAANNGGUUPP aafftteerr time ffrroomm [address]:port iinn test name Translation: the SMTP client at [address]:port disconnected unexpectedly, time seconds after the start of the test named test name. There is no punishment for hanging up. A client that hangs up without sending the QUIT command can still pass all postscreen(8) tests. The following errors are reported by the built-in SMTP engine. This engine never accepts mail, therefore it has per-session limits on the number of commands and on the session length. CCOOMMMMAANNDD TTIIMMEE LLIIMMIITT ffrroomm [address]:port aafftteerr command Translation: the SMTP client at [address]:port reached the per-command time limit as specified with the postscreen_command_time_limit parameter. The session is terminated immediately. The "aafftteerr command" portion is logged with Postfix 2.10 and later. CCOOMMMMAANNDD CCOOUUNNTT LLIIMMIITT ffrroomm [address]:port aafftteerr command Translation: the SMTP client at [address]:port reached the per-session command count limit as specified with the postscreen_command_count_limit parameter. The session is terminated immediately. The "aafftteerr command" portion is logged with Postfix 2.10 and later. CCOOMMMMAANNDD LLEENNGGTTHH LLIIMMIITT ffrroomm [address]:port aafftteerr command Translation: the SMTP client at [address]:port reached the per-command length limit, as specified with the line_length_limit parameter. The session is terminated immediately. The "aafftteerr command" portion is logged with Postfix 2.10 and later. When an SMTP client makes too many connections at the same time, postscreen(8) rejects the connection with a 421 status code and logs: NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: ttoooo mmaannyy ccoonnnneeccttiioonnss The postscreen_client_connection_count_limit parameter controls this limit. When an SMTP client connects after postscreen(8) has reached a connection count limit, postscreen(8) rejects the connection with a 421 status code and logs: NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: aallll ssccrreeeenniinngg ppoorrttss bbuussyy NNOOQQUUEEUUEE:: rreejjeecctt:: CCOONNNNEECCTT ffrroomm [address]:port:: aallll sseerrvveerr ppoorrttss bbuussyy The postscreen_pre_queue_limit and postscreen_post_queue_limit parameters control these limits. WWhheenn aallll tteessttss ssuucccceeeedd When a new SMTP client passes all tests (i.e. it is not allowlisted via some mechanism), postscreen(8) logs this as: PPAASSSS NNEEWW [address]:port Where [address]:port are the client IP address and port. Then, postscreen(8) creates a temporary allowlist entry that excludes the client IP address from further tests until the temporary allowlist entry expires, as controlled with the postscreen_*_ttl parameters. When no "deep protocol tests" are configured, postscreen(8) hands off the "live" connection to a Postfix SMTP server process. The client can then continue as if postscreen(8) never even existed (except for the short postscreen_greet_wait delay). When any "deep protocol tests" are configured, postscreen(8) cannot hand off the "live" connection to a Postfix SMTP server process in the middle of the session. Instead, postscreen(8) defers mail delivery attempts with a 4XX status, logs the helo/sender/recipient information, and waits for the client to disconnect. The next time the client connects it will be allowed to talk to a Postfix SMTP server process to deliver its mail. postscreen(8) mitigates the impact of this limitation by giving deep protocol tests a long expiration time. CCoonnffiigguurriinngg tthhee ppoossttssccrreeeenn((88)) sseerrvviiccee postscreen(8) has been tested on FreeBSD [4-8], Linux 2.[4-6] and Solaris 9 systems. * Turning on postscreen(8) without blocking mail * postscreen(8) TLS configuration * Blocking mail with postscreen(8) * Turning off postscreen(8) * Sharing the temporary allowlist TTuurrnniinngg oonn ppoossttssccrreeeenn((88)) wwiitthhoouutt bblloocckkiinngg mmaaiill To enable the postscreen(8) service and log client information without blocking mail: 1. Make sure that local clients and systems with non-standard SMTP implementations are excluded from any postscreen(8) tests. The default is to exclude all clients in mynetworks. To exclude additional clients, for example, third-party performance monitoring tools (these tend to have broken SMTP implementations): /etc/postfix/main.cf: # Exclude broken clients by allowlisting. Clients in mynetworks # should always be allowlisted. postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr /etc/postfix/postscreen_access.cidr: 192.168.254.0/24 permit 2. Comment out the "smtp inet ... smtpd" service in master.cf, including any "-o parameter=value" entries that follow. /etc/postfix/master.cf: #smtp inet n - n - - smtpd # -o parameter=value ... 3. Uncomment the new "smtpd pass ... smtpd" service in master.cf, and duplicate any "-o parameter=value" entries from the smtpd service that was commented out in the previous step. /etc/postfix/master.cf: smtpd pass - - n - - smtpd -o parameter=value ... 4. Uncomment the new "smtp inet ... postscreen" service in master.cf. /etc/postfix/master.cf: smtp inet n - n - 1 postscreen 5. Uncomment the new "tlsproxy unix ... tlsproxy" service in master.cf. This service implements STARTTLS support for postscreen(8). /etc/postfix/master.cf: tlsproxy unix - - n - 0 tlsproxy 6. Uncomment the new "dnsblog unix ... dnsblog" service in master.cf. This service does DNSBL lookups for postscreen(8) and logs results. /etc/postfix/master.cf: dnsblog unix - - n - 0 dnsblog 7. To enable DNSBL lookups, list some DNS blocklist sites in main.cf, separated by whitespace. Different sites can have different weights. For example: /etc/postfix/main.cf: postscreen_dnsbl_threshold = 2 postscreen_dnsbl_sites = zen.spamhaus.org*2 bl.spamcop.net*1 b.barracudacentral.org*1 Note: if your DNSBL queries have a "secret" in the domain name, you must censor this information from the postscreen(8) SMTP replies. For example: /etc/postfix/main.cf: postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply /etc/postfix/dnsbl_reply: # Secret DNSBL name Name in postscreen(8) replies secret.zen.dq.spamhaus.net zen.spamhaus.org The texthash: format is similar to hash: except that there is no need to run postmap(1) before the file can be used, and that it does not detect changes after the file is read. It is new with Postfix version 2.8. 8. Read the new configuration with "postfix reload". Notes: * Some postscreen(8) configuration parameters implement stress-dependent behavior. This is supported only when the default value is stress-dependent (that is, "postconf -d parametername" output shows "parametername = $ {stress?something}${stress:something}" or "parametername = ${stress? {something}:{something}}"). Other parameters always evaluate as if the stress value is the empty string. * See "Tests before the 220 SMTP server greeting" for details about the logging from these postscreen(8) tests. * If you run Postfix 2.6 or earlier you must stop and start the master daemon ("postfix stop; postfix start"). This is needed because the Postfix "pass" master service type did not work reliably on all systems. ppoossttssccrreeeenn((88)) TTLLSS ccoonnffiigguurraattiioonn postscreen(8) TLS support is available for remote SMTP clients that aren't allowlisted, including clients that need to renew their temporary allowlist status. When a remote SMTP client requests TLS service, postscreen(8) invisibly hands off the connection to a tlsproxy(8) process. Then, tlsproxy(8) encrypts and decrypts the traffic between postscreen(8) and the remote SMTP client. One tlsproxy(8) process can handle multiple SMTP sessions. The number of tlsproxy (8) processes slowly increases with server load, but it should always be much smaller than the number of postscreen(8) TLS sessions. TLS support for postscreen(8) and tlsproxy(8) uses the same parameters as with smtpd(8). We recommend that you keep the relevant configuration parameters in main.cf. If you must specify "-o smtpd_mumble=value" parameter overrides in master.cf for a postscreen-protected smtpd(8) service, then you should specify those same parameter overrides for the postscreen(8) and tlsproxy(8) services. BBlloocckkiinngg mmaaiill wwiitthh ppoossttssccrreeeenn((88)) For compatibility with smtpd(8), postscreen(8) implements the soft_bounce safety feature. This causes Postfix to reject mail with a "try again" reply code. * To turn this on for all of Postfix, specify "soft_bounce = yes" in main.cf. * To turn this on for postscreen(8) only, append "-o soft_bounce=yes" (note: NO SPACES around '=') to the postscreen entry in master.cf. Execute "postfix reload" to make the change effective. After testing, do not forget to remove the soft_bounce feature, otherwise senders won't receive their non-delivery notification until many days later. To use the postscreen(8) service to block mail, edit main.cf and specify one or more of: * "postscreen_dnsbl_action = enforce", to reject clients that are on DNS blocklists, and to log the helo/sender/recipient information. With good DNSBLs this reduces the amount of load on Postfix SMTP servers dramatically. * "postscreen_greet_action = enforce", to reject clients that talk before their turn, and to log the helo/sender/recipient information. This stops over half of all known-to-be illegitimate connections to Wietse's mail server. It is backup protection for zombies that haven't yet been denylisted. * You can also enable "deep protocol tests", but these are more intrusive than the pregreet or DNSBL tests. When a good client passes the "deep protocol tests", postscreen(8) adds the client to the temporary allowlist but it cannot hand off the "live" connection to a Postfix SMTP server process in the middle of the session. Instead, postscreen(8) defers mail delivery attempts with a 4XX status, logs the helo/sender/recipient information, and waits for the client to disconnect. When the good client comes back in a later session, it is allowed to talk directly to a Postfix SMTP server. See "Tests after the 220 SMTP server greeting" above for limitations with AUTH and other features that clients may need. An unexpected benefit from "deep protocol tests" is that some "good" clients don't return after the 4XX reply; these clients were not so good after all. Unfortunately, some senders will retry requests from different IP addresses, and may never get allowlisted. For this reason, Wietse stopped using "deep protocol tests" on his own internet-facing mail server. * There is also support for permanent denylisting and allowlisting; see the description of the postscreen_access_list parameter for details. TTuurrnniinngg ooffff ppoossttssccrreeeenn((88)) To turn off postscreen(8) and handle mail directly with Postfix SMTP server processes: 1. Comment out the "smtp inet ... postscreen" service in master.cf, including any "-o parameter=value" entries that follow. /etc/postfix/master.cf: #smtp inet n - n - 1 postscreen # -o parameter=value ... 2. Comment out the "dnsblog unix ... dnsblog" service in master.cf. /etc/postfix/master.cf: #dnsblog unix - - n - 0 dnsblog 3. Comment out the "smtpd pass ... smtpd" service in master.cf, including any "-o parameter=value" entries that follow. /etc/postfix/master.cf: #smtpd pass - - n - - smtpd # -o parameter=value ... 4. Comment out the "tlsproxy unix ... tlsproxy" service in master.cf, including any "-o parameter=value" entries that follow. /etc/postfix/master.cf: #tlsproxy unix - - n - 0 tlsproxy # -o parameter=value ... 5. Uncomment the "smtp inet ... smtpd" service in master.cf, including any "- o parameter=value" entries that may follow. /etc/postfix/master.cf: smtp inet n - n - - smtpd -o parameter=value ... 6. Read the new configuration with "postfix reload". SShhaarriinngg tthhee tteemmppoorraarryy aalllloowwlliisstt By default, the temporary allowlist is not shared between multiple postscreen (8) daemons. To enable sharing, choose one of the following options: * A non-persistent memcache: temporary allowlist can be shared between postscreen(8) daemons on the same host or different hosts. Disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons because memcache: has no first-next API (but see example 4 below for memcache: with persistent backup). This requires Postfix 2.9 or later. # Example 1: non-persistent memcache: allowlist. /etc/postfix/main.cf: postscreen_cache_map = memcache:/etc/postfix/postscreen_cache postscreen_cache_cleanup_interval = 0 /etc/postfix/postscreen_cache: memcache = inet:127.0.0.1:11211 key_format = postscreen:%s * A persistent lmdb: temporary allowlist can be shared between postscreen(8) daemons that run under the same master(8) daemon, or under different master (8) daemons on the same host. Disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons except one that is responsible for cache cleanup. This requires Postfix 2.11 or later. # Example 2: persistent lmdb: allowlist. /etc/postfix/main.cf: postscreen_cache_map = lmdb:$data_directory/postscreen_cache # See note 1 below. # postscreen_cache_cleanup_interval = 0 * Other kinds of persistent temporary allowlist can be shared only between postscreen(8) daemons that run under the same master(8) daemon. In this case, temporary allowlist access must be shared through the proxymap(8) daemon. This requires Postfix 2.9 or later. # Example 3: proxied btree: allowlist. /etc/postfix/main.cf: postscreen_cache_map = proxy:btree:/var/lib/postfix/postscreen_cache # See note 1 below. # postscreen_cache_cleanup_interval = 0 # Example 4: proxied btree: allowlist with memcache: accelerator. /etc/postfix/main.cf: postscreen_cache_map = memcache:/etc/postfix/postscreen_cache proxy_write_maps = proxy:btree:/var/lib/postfix/postscreen_cache ... other proxied tables ... # See note 1 below. # postscreen_cache_cleanup_interval = 0 /etc/postfix/postscreen_cache: # Note: the $data_directory macro is not defined in this context. memcache = inet:127.0.0.1:11211 backup = proxy:btree:/var/lib/postfix/postscreen_cache key_format = postscreen:%s Note 1: disable cache cleanup (postscreen_cache_cleanup_interval = 0) in all postscreen(8) daemons except one that is responsible for cache cleanup. Note 2: postscreen(8) cache sharing via proxymap(8) requires Postfix 2.9 or later; earlier proxymap(8) implementations don't support cache cleanup. HHiissttoorriiccaall nnootteess aanndd ccrreeddiittss Many ideas in postscreen(8) were explored in earlier work by Michael Tokarev, in OpenBSD spamd, and in MailChannels Traffic Control. Wietse threw together a crude prototype with pregreet and dnsbl support in June 2009, because he needed something new for a Mailserver conference presentation in July. Ralf Hildebrandt ran this code on several servers to collect real- world statistics. This version used the dnsblog(8) ad-hoc DNS client program. Wietse needed new material for a LISA conference presentation in November 2010, so he added support for DNSBL weights and filters in August, followed by a major code rewrite, deep protocol tests, helo/sender/recipient logging, and stress-adaptive behavior in September. Ralf Hildebrandt ran this code on several servers to collect real-world statistics. This version still used the embarrassing dnsblog(8) ad-hoc DNS client program. Wietse added STARTTLS support in December 2010. This makes postscreen(8) usable for sites that require TLS support. The implementation introduces the tlsproxy (8) event-driven TLS proxy that decrypts/encrypts the sessions for multiple SMTP clients. The tlsproxy(8) implementation led to the discovery of a "new" class of vulnerability (CVE-2011-0411) that affected multiple implementations of SMTP, POP, IMAP, NNTP, and FTP over TLS. postscreen(8) was officially released as part of the Postfix 2.8 stable release in January 2011. @